CSS 3D Clouds - <AUTHOR> http://www.clicktorelease.com/code/css3dclouds/

<comment><USER2> Great demo and presentation.

This is apparently based on the WebGL clouds demo, which is equally as amazing: <http://mrdoob.com/131/Clouds>

</comment><comment><USER3> As beautiful as this is, it still saddens me that the best we have for efficient cloud effects is drifting camera-facing billboards displaying pre- rendered poofs.

<comment><USER4> I recently read a paper: Volumetric Clouds and Mega Particles[1]. Here's a demo of it in action: <http://www.youtube.com/watch?v=3QqD26SXWDc> It looks to be somewhat better than billboards and cheap as well, though it does have some drawbacks.

[1] <http://www.inframez.com/events_volclouds_slide18.htm>

</comment></comment><comment><USER5> I'm impressed that not only did this run on my Android phone in the stock browser, but that it was relatively smooth (hitching infrequently but for probably 300ms when it did).

<comment><USER3> There's a reason that this technique (prerendered sprites on camera-facing billboards) has been used for so many years, and continues to be used to this day. When you have an effect too intensive to be rendered in real time, prerendered billboards are a workaround that can often yield impressive results.

Clouds and other pseudo-particle effects are a really common place to see them these days, but I remember first being aware of them used for the Mumbo Tokens[1] in Banjo Kazooie on the N64.

[1] <http://banjokazooie.wikia.com/wiki/Mumbo_Token>

<comment><USER6> I remember them from Super Mario 64. They used sprites do give the impression of high-poly spheres: <http://i.imgur.com/59T0Kqj.jpg>

</comment></comment></comment><comment><USER7> I remember seeing this a year ago. It's awesome how smooth it has become— last time I checked, it was choppy on my machine whereas now it's butter smooth. Browsers are sure improving rapidly these days.

</comment><comment><USER8> Hmm, on Chrome 24.0.1312.69 on 64 bit Linux the depth effect is missing. When rotated, it looks like a picture of a cloud painted on an invisible wall. No problem in Firefox.

<comment><USER9> In Chrome type about:gpu in your URL bar, might give you some clues. (Then check out about:flags to see if there are any relevant options you can change).

<comment><USER10> til of about:gpu, if you haven't seen it, and you're using chrome, take a quick look. Some of the problems listed for my machine have the relevant issue number next to them. Granted some of them are behind a 403 for me, but it's still an interesting reporting page to me.

</comment></comment></comment><comment><USER11> I was expecting it to be a complete horror-show on my G5 mac, but it was actually really smooth (once it had settled down of course..). Really nice work. Well done!

<comment><USER12> How many G5 (or other PowerPC based Macs) are still out there, you think? I am working on an App, and debating whether to go through all the trouble to make it compatible with PPC architecture for the first release.

<comment><USER13> I dropped PPC a few years ago and nobody has complained. Mind you this is scientific software, but it has a few thousand users around the world.

</comment></comment></comment><comment><USER14> I like how Michael Bay was an option. Also very surprised it works so well on my Nexus 4. Touch screen rotation is a bit weird tho, but wow.. no lag.

<comment><USER15> The N4 is the fastest phone I've ever owned. 4 cores running @ 1.7Ghz + a GPU. Stunning performance.

</comment></comment><comment><USER16> Amazing demos. Are there any real-world applications using something like this?

</comment><comment><USER17> Look great but the title "CSS 3D Clouds" is not truthful.

<comment><USER3> How do you figure? The point is that the 3D is achieved using CSS instead of WebGL. It's not _pure_ CSS, but it's CSS where it counts.

<comment><USER18> I think this is totally bad-ass.

</comment></comment></comment><comment><USER19> Looks great -- only tweak would be to add proper depth sorting to avoid the "popping" effect (more visible with the darker textures).

</comment><comment><USER20> If the explosion micheal bay effect happened in real time it would be sick

</comment><comment><USER21> This is very well done. I especially love the Michael Bay option.

</comment><comment><USER22> Awesome on chrome on Ubuntu 64-bit, buggy and slow on Firefox.

</comment><comment><USER23> This is really awesome! Add it to twitter bootstrap for kicks!

</comment><comment><USER24> It is simply amazing, also the speed is quite good!

</comment><comment><USER25> It seems that if I get all the options to "a lot" I get at least one or two clouds replaced by a white box icon. I imagine it's not loading them properly?

<comment><USER26> It's probably because you turned on the "box" setting. To you know, render boxes. It's the bottom setting in the Texture list.

</comment></comment><comment><USER27> The speed is excellent -- really smooth.

</comment><comment><USER28> Very slow on Firefox 18.0.2, linux

</comment><comment><USER29> Works great on my blackberry z10.

</comment><comment><USER30> it does look pretty good. I m quite amazed such a technique is doable via css

</comment><comment><USER31> Love the Michael Bay

</comment><comment><USER32> speed is very good compare to WebGL

</comment><comment><USER33> this is seriously cool.

</comment><comment><USER34> WOW

</comment><comment><USER35> the cloud animation could use a little bit of easing. It looks a bit choppy right now on mouse move.</comment>


Also against individual IQ worries - <AUTHOR> https://www.scottaaronson.com/blog/?p=3473 <comment><USER2> Intelligence is real. IQ measures something associated with intelligence. But people should care more about doing what they want to do rather than a number that might say something about their ability to do what they may want to do.

Interest usually implies a level understanding. If you're interested in something, you should be able to do that thing at least modestly well.</comment>


Ask HN: Approachable solution for multi-factor SSH authentication? - <AUTHOR>

My venture has a significant security component, and I'm looking right now into hardening remote access to core servers and infrastructure.
I've worked before in high security environments that used things like smart card (US DOD CAC) authentication, and these worked very well with ssh and ssh authentication forwarding. It was actually more user-friendly than standard SSH passphrase + key, in that you could cache the card PIN locally and then ssh around at will. It would just keep authenticating with your physical credential until the PIN cache timed out (we used 60 seconds) or you yanked your card.
Is there any vendor that sells a solution like this that's "hacker friendly" and affordable for independent entities? I've done some searching and I just can't find anything that doesn't seem "enterprisey" with the standard enterprise $call for pricing, awful UX, etc.
I use a Mac as my primary work machine, and I'd like something that can be used for several purposes e.g. both SSH auth and file / encrypted volume encryption, etc.
The poverty of good approachable solutions in this space feels almost like some kind of conspiracy given the demand that's probably out there. <comment><USER3> RFC6238 TOTP (popularized by Google Authenticator) should fit your needs well.

* It is an open algorithm based on [http://tools.ietf.org/html/rfc6238](http://tools.ietf.org/html/rfc6238)

* Both the server and client work completely offline based on a pre-shared key and current time. It does not need any third-party services, network calls, or paid plans.

* The Google Authenticator app for saving secrets and generating tokens is open-source and available on Android and iOS. It does not share the secrets or tokens with Google. Others have also published compatible apps.

* There is already a Debian/Ubuntu package for adding it to logins, including SSH logins: libpam-google-authenticator

* If that's not sufficient, then there are libraries for various languages.

* And if not, or if you want to build your own branded client, then both the server and client implementations take about 10 lines of code: [http://en.wikipedia.org/wiki/Google_Authenticator#Technical_...](http://en.wikipedia.org/wiki/Google_Authenticator#Technical_description)

</comment><comment><USER4> Aside from TOTP, as pointed out by TOTP:

\- the Yubikey is a hardware authentication token (with various modes - <USER2> particular, the "type my password" mode can be plugged into nearly anything)

\- companies like Duo Security sell two-factor authentication

\- ssh-agent (part of OpenSSH) allows you to keep authenticating, with or without confirmation

\- you can get a _lot_ of security from doing your web browsing and your development/system administration on different machines

Of course, it's hard to recommend something without any details about your situation or what you're looking for.

Also, there is no conspiracy. People just don't care that much about security.

</comment><comment><USER5> This just came out: [https://www.scaleft.com/](https://www.scaleft.com/)</comment>


Ask HN: Would you pay for a better GCP / AWS UI? - <AUTHOR> <comment><USER2> Teams with large workloads tend to automate their administration workload with tools like Terraform and CloudFormation.

That said, it'd be nice to have something that makes diagnosing common problems easier, i.e. a nicer cloudwatch logs viewer, an overview of all target groups and their load balancers, attached containers, etc.

So a largely read-only view of my resources, properly designed by good UI designers is something I'd pay for, but being a startup, I couldn't pay too much, probably no more than $50/mo.

Hope that answer helps.

</comment><comment><USER3> No, AWS sucks, GCP is awesome as is. We only run on GCP now and would never go back.

#BoycottBezos</comment>


African wildlife officials appalled as EU opposes a total ban on ivory trade - <AUTHOR> https://www.theguardian.com/environment/2016/jul/06/african-wildlife-officials-appalled-as-eu-opposes-a-total-ban-on-ivory-trade <comment><AUTHOR> You guys should consider donating to the International Anti-Poaching Foundation[0][1] which fights these poachers. The founder, Damien Mander[2], is an Australian ex spec-ops sniper who is using his military experience to train the park rangers since they, unlike the poachers, tend to be poorly equipped and trained as well as understaffed.

There is also the David Sheldrick Wildlife Trust[3][4] which takes care of elephant and rhino orphans (most of them are orphans due to poaching). For $50 a year, you can become a sponsor of a particular orphan and they'll send you photos and updates about how your sponsored animal is doing. You can for example sponsor this little fella [5][6]. It's a great gift.

[0] [http://www.iapf.org/](http://www.iapf.org/)

[1] [http://en.wikipedia.org/wiki/International_Anti- Poaching_Fou...](http://en.wikipedia.org/wiki/International_Anti- Poaching_Fou..).

[2] [http://en.wikipedia.org/wiki/Damien_Mander](http://en.wikipedia.org/wiki/Damien_Mander)

[3] [http://www.sheldrickwildlifetrust.org](http://www.sheldrickwildlifetrust.org)

[4] [http://en.wikipedia.org/wiki/David_Sheldrick_Wildlife_Trust](http://en.wikipedia.org/wiki/David_Sheldrick_Wildlife_Trust)

[5] [http://www.sheldrickwildlifetrust.org/asp/orphan_profile.asp...](http://www.sheldrickwildlifetrust.org/asp/orphan_profile.asp?N=318)

[6] [http://instagram.com/p/sigT3IAUKb](http://instagram.com/p/sigT3IAUKb)

P.S. You should subscribe to [http://reddit.com/r/babyelephantgifs](http://reddit.com/r/babyelephantgifs) and [http://reddit.com/r/babyrhinogifs](http://reddit.com/r/babyrhinogifs) for a daily dose of adorable pachyderm content.

<comment><USER2> That first link 404's btw, removing /en/ seems to fix it.

<comment><AUTHOR> Fixed thanks.

<comment><USER3> Guess ycombinator is automatically truncating it.

<comment><AUTHOR> It's actually my sloppiness. I copied the link from a comment I made previously and didn't check it. Fixed now.

</comment></comment></comment></comment></comment><comment><USER4> I'm coming to the conclusion that a better long-term solution might be more along the lines of what Pembient[1] is doing: devise methods to produce ivory and related materials in the lab, ensure that it is indistinguishable from the "organic" stuff, and then flood the market into oblivion.

Anti-poaching methods are obviously needed to fill in the gaps while technology catches up, and should be continued or perhaps even escalated. But the most effective weapon against poachers could prove to be the very markets that draw people to poaching in the first place. Remove poaching's feasibility as a lucrative profession, and the profession dies.

[1]: [http://pembient.com](http://pembient.com)

</comment><comment><USER5> I fully support anti-poaching measures, but what this article doesn't discuss is the effect of a total ban on trade of existing ivory products. Old musical instruments (pipe organs, old pianos, some wind instruments) with any ivory in them (e.g. decorative inlays or the key slips on a 1000+ kg organ) cannot have their ivory parts repaired and the instrument cannot be sold under a complete trade ban, which is a shame and a waste. This came up with the US Forestry and Wildlife Service recently when they also proposed a complete ban. There are a handful of folks who recover ivory from art/antiques exactly for restoring other products without resulting in new poaching.

Edit: see this article, which was just updated today, about the effect of ivory bans on musicians and instruments [http://americanorchestras.org/advocacy-government/travel- wit...](http://americanorchestras.org/advocacy-government/travel-with- instruments/endangered-species-material/ivory-ban-impact-on-orchestras.html)

<comment><USER6> Sure, let's not avoid killing thousands of endangered animals so people can keep restoring old pianos. Priorities, right ?

<comment><USER7> The reason Rhinos are being poached is the fact that its illegal to take their horns. They cannot farm Rhinos for horns so wild Rhinos end up being killed for it. It is in fact possible to remove Rhino horns safely eithout killing the animal.

This issue is another perfect example of people thousands of miles away detached being in an uproar with half assed solutions like "ban ivory" which exacerbate the problem.

<comment><USER8> Rhinos can't really be farmed. They have awful temperaments and require massive amounts of land.

(...another perfect example of people thousands of miles away detached being in an uproar with half assed solutions like "farm rhinos" which exacerbate the problem...)

<comment><USER7> According to this VICE article, there are in reality a lot of rhino farms. They say there are simply more illegal poachers because the trade has been illegal for so long, and became dominated by criminals. Sort of like prohibition-era USA.

[http://motherboard.vice.com/read/rhino-horn-crisis-and- the-d...](http://motherboard.vice.com/read/rhino-horn-crisis-and-the-darknet)

<comment><USER8> You're right, there are a number of white rhino farms. It's the black rhino that's more farm-resistant. I hadn't realized the distinction, thanks.

With enough money, anything can be farmed... But can that supply enough horn to solve poaching? (honest question, I can't find an authoritative answer)

</comment></comment></comment></comment></comment></comment><comment><USER9> Just to play devil's advocate; If there was a total ban, then it would go underground and nobody can really watch what's happening with the ivory trade. There is already A LOT of ivory out there, it's not like it goes bad or anything, so you'd be forcing estates to go underground or destroy it if it weren't regulated.

I think it's a complex situation, not as simple as saying "elephants died, therefore bad".

<comment><AUTHOR> This is silly. By allowing trade, you are sustaining a market for it. Furthermore, a legal market would be a cover for the illegal market.

<comment><USER10> This is a fantasy. Making ivory trade illegal today in every country in the world wouldn't suddenly make the demand go away.

It only drives the price up and makes crime and violence more likely as the rewards are even higher. Take the market for all kinds of drugs as an easy example. Making it illegal is very short-sighted: it doesn't suddenly make drugs disappear from society, it just makes it more expensive and this incentivizes people to crime to protect their drug business. If it was legal, drug crime would dry up overnight, like it did when Alcohol prohibition ended. You don't see the brewing company that makes Miller lite take out a hit on Yuengling Lager nowadays, do you?

If you want to preserve these animals, legal markets for them should be strongly encouraged. Think of solutions that may be developed as far as harvesting ivory that wouldn't kill the animals if it was legal. Maybe private farming that sustains these populations in some way would be developed. Chickens that lay eggs aren't in danger of going extinct anytime soon because they're being preserved because they make people money. Just having a market for a good isn't a bad thing.

Just driving it underground harder and harder encourages poor and desperate people to risk everything for a massive payday.

<comment><AUTHOR> > It only drives the price up and makes crime and violence more likely as the > rewards are even higher.

What's the black market price for Kinder Surprise eggs, an item that's illegal in the US.

Comparing this with drugs is not the same. No one "needs" ivory the same way they "need" heroin.

> Making it illegal is very short-sighted:

Why is it that poaching skyrockets whenever the restrictions are relaxed?

> Think of solutions that may be developed as far as harvesting ivory that > wouldn't kill the animals if it was legal.

How does that stop poaching?

> Maybe private farming that sustains these populations in some way would be > developed.

Do you know much about elephants? Do you know much about elephant husbandry? Can you talk a bit more about these proposals and the possible problems?

<comment><USER11> > What's the black market price for Kinder Surprise eggs, an item that's > illegal in the US.

Kinder eggs are not a good analogy. The market demand is not really for "Kinder eggs" it is for "kid's chocolate." The segment has many alternatives. If all chocolate was banned (or difficult to source as it was in the Soviet Union) we would indeed see a thriving black market (as it was in SU).

<comment><AUTHOR> Whereas ivory doesn't have alternatives?

<comment><USER11> Not in the sense that other metals can be an "alternative" for gold. Brand name (Kinder) vs. the substance (chocolate).

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Does anyone have context for the EU opposition to the ban? Economic interests?

<comment><USER13> Because black markets for these goods are much more devastating to the animal populations than a legal regulated marketplace.

<comment><AUTHOR> This is simply not true and this 'meme' is really harmful. A legal market would only encourage consumption and serve as a cover for the black market.

<comment><USER14> I would like to see some evidence on either side of this argument.

I can see that there is logic to both cases. Saying one side is "simply not true" doesn't make your case. Is there any firm evidence either way.

<comment><AUTHOR> Read the comments in this thread. The current crisis is generally attributed to the 2008 lifting of CITES restrictions that has allowed African countries to sell their stockpiles to China and Japan.

</comment></comment></comment></comment></comment><comment><USER15> Correct me if I'm wrong but I can't imagine that the legitimate cases for the use of ivory/elephant products are economically significant at all to the EU. Because of this, I'm confused as to why they would be treading so lightly and avoiding a complete ban.

<comment><USER16> It's not about that of course. It's that the EU feels like just banning without ivory trade without a support network behind in Africa will just lead to even more devastating black market ivory trade.

We can see how bad the previous bans went and how the wild life suffers in those same African countries that already banned poaching... but where the elephants keep dying awfully because the local governments are corrupt and let the poaching continue gaining even higher margins after the ban.

It's exactly that the EU wants to avoid.

<comment><AUTHOR> > how the wild life suffers in those same African countries that already > banned poaching

Which specific countries are you talking about?

</comment></comment></comment><comment><USER17> Simple solution: if you can't hammer out the details of what you really want in time, extend the current one.

</comment><comment><USER18> The article mostly describes how elephants populations have been dwindling with the ban in place. I do not see any statistics supporting the view that elephant populations will dwindle any more quickly/slowly without a ban.

<comment><USER19> There have been periods with and without bans. Elephant population decreased faster when there were no bans.

[http://www.iol.co.za/dailynews/opinion/controversial-call- fo...](http://www.iol.co.za/dailynews/opinion/controversial-call-for- unrestricted-commercial-exports-2043369)

"About half the continental population was lost in the decade before the Appendix I listing in 1989, and a dramatic spike occurred again after a "one- off" ivory sale in 2008 to China and Japan."

"Cites [Appendix I] saved African elephants from certain extinction 27 years ago by listing them on Appendix I. It ended the poaching crisis and elephant populations began to recover, until their protection under Cites was weakened, causing poaching to escalate again."

<comment><USER16> That piece fails to address that the reason is that the Western nations stopped financing so much the anti poaching enforcement in african countries.

It was not exactly the lift of the ban, it was that Western nations decided that the problem was controlled, or that it was time that African nation started taking care of the poaching problem themselves and cut funding.

</comment></comment></comment><comment><USER20> What's so good about ivory? Why can't other non-animal-based materials be used? I don't see the appeal to go to such great lengths to kill an animal for its horn/tusks.

<comment><USER11> It is a cultural thing. In some countries the horn is ground up and used for (pseudo)medical purposes.

</comment></comment><comment><USER21> So very frustrating. We've done the same thing in this country when Europe had it together. Can't Africa get a break from our first world bureaucracy's?

</comment><comment><USER22> In other news, the EC is trying all kinds of soaps to wash the grease off their hands.

</comment><comment><USER23> What's stopping ivory farms from being opened in countries with local demand for ivory?

<comment><USER24> Expense. Raising elephants/rhinos is probably extremely expensive, especially when you consider how little ivory you get from an elephant raised for, say, 10 years. Poaching is only lucrative because the poachers don't bear the cost of raising the livestock.

Also if you tried to establish a farm where you raised elephants for ivory, the moral outrage would almost certainly get you shut down, with an new law if no existing ones covered it. The "countries with local demand for ivory" are in general countries that have made ivory trade largely illegal already, because most of the population agrees it's pretty repugnant.

<comment><USER25> Not to mention that creating a farm for elephants would make a great target for poachers. No one would take on that risk of raising an elephant for 25 years, only to have a poacher kill it and take the ivory (and all the elephants value).

</comment></comment></comment><comment><USER26> Just a hint of what the EU is really made of.

<comment><USER27> Is it better to surface the trade and regulate it, or push it underground?

<comment><AUTHOR> There isn't a black market for everything. E.g. how big is the black market for Kinder Surprise eggs in the US? How big is the market for leaded gasoline?

<comment><USER27> People don't often decorate their homes and make other items out of leaded gasoline or kinder surprise eggs. Luxury items are created from ivory.

<comment><AUTHOR> Right. There isn't that big of a market for luxury items.

</comment></comment></comment></comment></comment><comment><USER28> What the hell is wrong with these people? It's 2016, use your brains you savages.

<comment><USER13> "It's the current year" is not an argument.

</comment></comment><comment><USER29> It seems that the Europeans are concerned about the black market. The same reason why the War on Drugs is so ineffective. Banning the market without effectively controlling supply is a disaster.

<comment><USER30> > ITT: People who understand why the War on Drugs is ineffective but can't > fathom why pushing all ivory trade into the black market could have similar > results.

With all due respect, "ITT:" (In This Thread) is hardly constructive. First off you cannot generalise all of the replies already made, and secondly you cannot know the direction of future replies or how the conversation will evolve.

If you want to make a point comparing the ivory trade to the war on drugs, that's great, it might generate some thoughtful discussion. But this "ITT" nonsense from Reddit is just that, nonsense.

<comment><USER29> Yeah, you're totally right. Edited.

</comment></comment></comment><comment><USER31> I see why GB left. Is there any legitimate purpose for ivory besides aesthetic?

<comment><USER32> Why do you assume the UK disagrees with this stance? They might have lobbied for it.

<comment><USER33> The wider assumption is that the UK will actually leave. The referendum was in no way binding.</comment></comment></comment>


Spotify had a £16.66m loss in 2009 - <AUTHOR> http://eu.techcrunch.com/2010/11/22/spotify-had-a-16-66m-loss-in-2009-a-rumoured-us-launch-is-now-imperative/ <comment><USER2> Its depressing to see techcrunch's continuous berating of spotify, along with it and the last.fm debacle its hard to think techcrunch dont have an anti euro startup.

Spotify is a very young company that has managed to successfully enter a market with the highest of barriers to entry, released a technically superb application, and built up one of the most devoted fanbases I have ever seen.

Spotify are still young and they have masses of potential for revenue, I think at this point they just have to have a free service because people dont believe that a service this good could existe, I have a hard time explaining spotify to people that havent used it not because its complicated, just because they dont believe it can work like that.

<comment><USER3> _Its depressing to see techcrunch's continuous berating of spotify_

First of all, I don't see this article as berating spotify. The headline (which is inconclusive at best, not a clear "berating") aside, the article is quite positive about Spotify's stats and their potential over the next few years.

 _along with it and the last.fm debacle its hard to think techcrunch dont have an anti euro startup_

Secondly, this article is on TechCrunch EU, by Mike Butcher, which afaik had nothing to do with the TechCrunch US, Arrington-led "last.fm debacle" if you want to call it that. For anyone who knows Mike, it's hard to accuse him of having an anti-euro startup stance. Mike is probably one of the most active people in Europe when it comes to trying to convince everyone that Europe is a great place for startups.

TC-EU organises events, gets people together, writes about them, and generally does everything they can to help the european startup scene pick up.

<comment><USER2> To be fair I didnt check the author of the article, and I do agree that Mike has been a really good job promoting and helping local startups.

But I didnt make this comment on the article in isolation, there is a long list of techcrunch articles questioning spotify's viability ever since its inception, its being held to a much higher standard than it should be, and as as far as I can tell the only company really successfully getting any leverage against record labels I think they should be backed at every opportunity.

</comment></comment></comment><comment><USER4> The desktop application is crafty enough to have me consider subscribing: If you lower your _OS-wide_ volume to 0 during a grating audio ad, the ad is paused and resumes when you bump your volume up again.

Physically taking off your headphones to let ads run gets old! Perhaps the discerning cheapskate puts an analogue volume dial in the chain.

<comment><USER5> Yes a very annoying app. Also consider that it _forces_ updates and that when the app is running and you want to click on a list item, it suddenly inserts an ad which you up clicking anyway.

They may think they have me by the balls, but they're not installed on my computer any more.

Ironically, we were all outraged at this kind of behaviour in the late 90s when it was called adware. Now, magically, it's a good thing.

<comment><USER6> Well the ads are there to support the unlimited free music they're giving you, so you can't complain too much.

On the adware front - the app doesn't auto-run, doesn't self install, is easy to uninstall and doesn't show ads when it isn't running. So it bares little resemblance to the adware of the 90s.

With all that said though - I shouldn't imagine they care very much about having non-paying customers 'by the balls' I would expect they care much more about those that pay.

<comment><USER5> All good points.

My argument is based on user experience. Both spotify and the 90s adware are on the wrong side of the line separating "understandably has ads" and "annoyingly has ads". No doubt that spotify is closer to the line compared to 90s adware.

</comment></comment></comment></comment><comment><USER7> Spotify is a great service but they are operating in a market where there is a lot of pressure from all sides, much more so than in other markets.

I hope they survive because we certainly need something like spotify, but after absorbing the 'Imeem' founders' advice from the start-up school talks I came away with the viewpoint that spotify's future is anything but assured.

As for TC having an 'anti-euro-startup whatever', they report the news, they don't actually make it. Either spotify has a loss or they haven't, don't shoot the messenger. And I'm not exactly a TC fan.

<comment><USER8> TC don't just report the news. Sorry but there are plenty of examples of their personal opinions creeping in.

Not that I have a problem with that but TC do like to play clairvoyants.

</comment></comment><comment><USER8> Compared to so many other IMHO less serving startups receiving funding up the yazoo it's hard to imagine spotify not being able to get the funding needed.

I have been using it ever since it was only out in beta and haven't looked back ever since. Today iTunes is primarily used for iTU and Podcasts all other music is played from Spotify which btw supports locally stored music and actually have a social service that works.

<comment><USER9> Their support for local music is still a bit second-rate, imo. Not least because of its lack of codec support.

</comment></comment><comment><USER10> Spotify Sweden is profitable. <http://martinweigert.com/spotify-is-profitable- in-sweden>

Noteworthy because that's where it started and Sweden can be ahead of the curve from the rest of Europe.

</comment><comment><USER11> Spotify did a great job of alienating me as a potential user. Here was my experience:

\- heard of Spotify

\- went to Spotify.com, read something like "Download our thing and play all this Free Music!"

\- downloaded their thing

\- opened their thing to find an iTunes clone. With no Free Music anywhere to be found.

I spent the better part of 10 minutes trying to figure out how to get it to find and play some of this Free Music before giving up.

I can only assume that most of their potential users are going through the same thing. If so, it's not surprising that they're bleeding money so fast.

<comment><USER9> Genuinely confused about what you're doing to get this experience. It's almost all free; you just click and... it plays?

<comment><USER11> I don't know. It's been uninstalled for months.

I think they used to market it as "we'll find you all sorts of cool music", so the expectation I had was that I'd be able to type in an artist or song and it would run an iTunes-esque "Genius" on it to give you a playlist.

Instead, I'd type in an artist or song and it would come back with no results.

It was happy to play music that I already had on my machine, but seemingly had no capability to go out and find new music from the internet. Given that that was its stated purpose, I was annoyed and uninstalled it.

<comment><USER12> Then I'm afraid you must have missed something. If, for example (as it was the first net screenshot I found) you enter "bella" into the top left search box, you get back this: [http://mediamemo.allthingsd.com/files/2009/08/spotify_deskto...](http://mediamemo.allthingsd.com/files/2009/08/spotify_desktop_client.png)

Double click any of those and it will instantly start streaming the song.

<comment><USER11> Indeed, that's what I was expecting to see. Now imagine you'd typed "bella" and you saw an empty list. That was Spotify when I gave them a shot.

I might have to try again at some point.

<comment><USER13> It's probably worth giving it a go but unless you have very mainstream musical tastes, expect to be at least somewhat disappointed.

Their catalogue isn't too bad for a free service (probably around 40% of what I search for comes up with useful results) although having to listen to adverts every four songs seems a bit much, and it's certainly not worth paying to get rid of them.

</comment></comment></comment></comment></comment></comment><comment><USER14> Yeah but how much money was _not_ spent on music because people could just listen to it on Spotify. That's what I'd like to know (if it were possible)

<comment><USER15> > because people could just listen to it on Spotify.

And Youtube, or the radio!</comment></comment>


End of Linux 2.6 Kernel; To Start Afresh From 2.8 - <AUTHOR> http://digitizor.com/2011/05/24/end-linux-2-6/

<comment><USER2> This is not a guarantee. Linus is speculating, so is the website. Title is misleading</comment>


Coursera's Startup Engineering students getting charged by Amazon - <AUTHOR> http://imgur.com/a/2Ybeq

<comment><USER2> They seem to get charged because they start the wrong instance and/or multiple ones.</comment>


Harry Potter and the Methods of Rationality just got several fascinating updates - <AUTHOR> http://hpmor.com

<comment><USER2> Hmm... I wouldn't agree with the people in this thread hailing it as a great work of literature. The main character is a complete Mary Sue - somewhat like Ender, but, in my opinion, considerably worse, although it's been toned down a bit in the later chapters.

But I only say that to counter those people - it's indeed a delightful and addictive read. The only problem is that it updates quite infrequently and is nowhere near done - I had been suspecting that it'd been abandoned. Reading 90 or so chapters (at high speed, due to the addictiveness) only to come to a screeching halt and have to wait months for a few more chapters is not that fun!

<comment> loup-vaillant While Harry _is_ ridiculously overpowered, his enemies are correspondingly scary.

Eliezer won't abandon this fic. If I recall correctly, there is one last arc left after the current one one. Though I would't count on it before next year.

<comment><USER3> Not just his enemies. For me, a number of the most memorable flourishes of the book are how formidable it makes some of the other people, at least in some respects --- the defense professor especially, but at various points in the story he turns the formidability firehose on people like Hermione and Aurors and the prankster brothers. It's a bit of a dramatic problem, actually, because it leaves people who haven't been sprayed looking so ineffectual that it's hard to understand why they take up so much dramatic space. E.g., I think the story would work better if Draco got more formidability to justify his apparent importance. At least Draco could have gotten a chance to win big by applying some of the applied organization theory tips from his father, perhaps by being the one to deploy effective staff/delegation/incentive techniques in the war games. Or the unimpressive frontline support security provided by his father could be backed by a second-line security specialist chosen by his father who shows up on call and gets some of the formidability and formidabilitytrainer love that the story gives to Aurors and defense professors.

<comment> loup-vaillant Err, Draco sounded pretty formidable to me. He came close to overcome his education, and even _did_ overcome it to some extent. Crabbe and Goyle are very apt bruisers, formidable broomstick riders, and once showed a rather sophisticated education (being able to change the level of politeness at will without sounding fake is quite a feat at that age --"Da boss want to speak with ya" vs "Mr Malfoy requests an audience with you").

Your suggestions do sound good, though.

</comment></comment></comment></comment><comment><USER4> If you've not read this yet, don't start... unless you have a weekend to spend on it.

HP & the MoR is one of the most compulsive and intelligent reading experiences out there. Comparable to the late Iain M Banks in compulsion, imho, and half again as clever and witty.

<comment><USER5> Actually, you've made a good pitch for Iain M. Banks, haven't read him yet, but if it's half as good... :)

<comment><USER6> The inverse of half again is two thirds. Just sayin'. :)

</comment></comment></comment><comment><USER7> Out of interest, how many people recommending this usually read fanfiction? Because I gave it a try a good while back but got a bit frustrated with it. It seemed to read more as a parody (albeit a good one) rather than something more faithful to the characters.

<comment><USER8> I have never read any other fanfiction but I found this series a good primer on modern logic and fun idle reading.

Unfortunately, it has a few cringeworthy moments and tropes[1]. It is definitely precocious at parts and not hard to draw the parallels with the whole Übermensch/Singularity thing (though to my understanding, the author has distanced himself from the organization and is currently at MIRI).

My chief criticism would be that it is overly bashful of the original Harry Potter story logic but lacks a tight plot through the second half. (Admittedly something very difficult to do with serialized fiction.) Up until chapter 87 I got the feel the story went off the rails, but the last few updates have been very interesting (no spoilers.)

If you enjoyed Snow Crash and do not mind fantasy, you would probably be into this. Don't take it too seriously and keep in mind it is about 1000 pages now.

[1] In particular: [http://tvtropes.org/pmwiki/pmwiki.php/Main/MarySue](http://tvtropes.org/pmwiki/pmwiki.php/Main/MarySue) / [http://tvtropes.org/pmwiki/pmwiki.php/Main/MartyStu](http://tvtropes.org/pmwiki/pmwiki.php/Main/MartyStu)

<comment><USER9> Interestingly enough, Yudkowsky probably uses these tropes deliberately. He himself is a reader of tvtropes.org[1], he's made explicit reference to using tropes before[2], and it makes senes that someone like Yudkowsky would know exactly which tropes he was and wasn't including.

[1] [http://tvtropes.org/pmwiki/pmwiki.php/Creator/EliezerYudkows...](http://tvtropes.org/pmwiki/pmwiki.php/Creator/EliezerYudkowsky?from=Main.EliezerYudkowsky) [2] [http://hpmor.com/chapter/7](http://hpmor.com/chapter/7)

<comment><USER7> But that almost makes it worse! Knowingly writing a Mary Sue is almost inexcusable if you're trying to write legitimate fiction (rather than an educational parody). I have nothing against parodies, especially good ones, but I just think they should be labelled as such. It slightly pains me that it's being held up as a good example of fan fiction when, arguably, it's not.

<comment><USER10> I have mixed feelings about "trying to write legitimate fiction". Sometimes I have distinct feeling the author just abandons all pretense of writing literature in order to get the point across or turn the story in the way necessary for him. OTOH, I have seen stranger (in my opinion) styles being considered legitimate, and even commendable, examples of literature, so who I am to judge? I'd read it as long as it is entertaining and thought-provoking, and stop if it ever stops being so, and I think that'd be enough.

As for labeling, who cares?

</comment></comment></comment></comment></comment><comment><USER11> Lost two nights to this one. It is definitely the best fan fiction I have read and more so. IMO JK Rowling's version pales in comparision to this, but without the inconsistencies of the original book, this HPMOR wouldn't have been possible. If you've read the original, you owe it to yourself to read this.

</comment><comment><AUTHOR> If you've not read this, strap yourself in - you're in for a ride. Eliezer, an AI researcher, has created this novel from a simple yet fascinating standpoint - what if Harry was a brilliant rationalist who engaged the magical world from a scientific standpoint? Don't dismiss this because it's a fanfic or incomplete - it introduces rationality, breaks many fantasy and geek tropes, and builds off Rowling's universe in a highly entertaining and thought- provoking page turner (I guess a modernization of this idiom would be "iPad flicker").

</comment><comment><USER12> I've just realised that this is somewhat the inverse of the Science of Discworld books.

Those books are split into alternative chapters of popular science, and Discworld stories about the characters reacting to our science from their point of view as characters in a fantasty novel.

So you get wizards that accidentally create a "strange" universe full of "roundworlds" and then having them wondering why people don't fall off the bottom, cue chapter on gravity and planet formation. Or in the second one they meet the "God of evolution".

I avoided reading them for years assuming they were going to be full of Dorling Kindersley "Science of Star Wars" type books full of pop-up AT-ATs and cut-away diagrams of lightsabers, but they're among the best pop science books I've read (though, I'm a fan of Pratchett, which undoubtedly helps)

</comment><comment><USER13> Just gotta say, I don't appreciate the "women in refrigerators" trope.

<comment><USER12> I read an earlier version of this and felt it had a few very dark moments that, even allowing for it being based off a young adult book, seemed out of place. I've never read the original and so I wondered if this was playing off something in the source material e.g. villains that couldn't really be villainous in an adult way.

<comment><USER13> The original is full of Dastardly-and-Muttley villains who are evil because it says "evil" on their character sheet; what motivations they have are shallow and their plots are made by Acme.

</comment></comment></comment><comment><USER14> Do you have to have read (or like) Harry Potter to appreciate this? I read several chapters (8 or so) and I actually found the story very distracting from the rationality message.

<comment><USER15> I would say yes. So much of the world is taken directly from the actual Harry Potter books and a lot of the fun is to see the effect new Harry has on the same world.

<comment> loup-vaillant I would say no. There are readers who haven't read the original book, and still enjoy the fanfic. I agree that much of the fun is taken away from those, though.

<comment><USER4> You need some familiarity with the world, though, to get many of the jokes ("In what universe would someone like Hermione get sorted anywhere but Ravenclaw?" \- "Ron's just..." "You just don't see any good reason for him to exist?" "Yeah.") and also knowing the story allows you to anticipate certain realities before Harry gets to grip with them. For example, we all know that Voldemort is Professor Quirrell, but Harry doesn't (at least not as far as I've read).

Background knowledge definitely helps with the enjoyment - and imho is the only reason why you'd want to read the JK Rowling books or watch the movies! I mean, I don't dislike the books (I've read them), but they're not much more than decent entertainment (with some of them dragging on, and on, and on).

<comment> loup-vaillant I... Agree. I'd advise someone who is reading the fanfic to watch the first two films, then maybe read a summary of the rest.

</comment></comment></comment></comment></comment><comment><USER16> Is it done yet? I read it when it was half the length it is now, and thoroughly enjoyed it. When it is done I will read it again, starting from the beginning.

<comment><USER17> I don't know if Eliezer has said anything about how long he intends it to be. A new story arc just started, and it's pretty great. It seems like this could go on for a few more years.

<comment><USER18> He said that he is done through chapter 96, and implied that it might be the end (said at chapter 86 that there were "2 or 3" arcs left, and arcs tend to be about 4 chapters...).

</comment></comment></comment><comment><USER19> If you like HPMOR as entertainment (rather than just for educational value), then another fanfic you might enjoy is "A Study in Magic" [1].

It's a crossover between HP and the BBC's "Sherlock", where the Dursleys get killed before the start of the story in one of Moriarty's schemes against Holmes. Holmes and Watson end up adopting Harry and raising him. Harry learns a lot about observation and deduction from Holmes, and makes good use of this dealing with the problems he confronts at Hogwarts. Holmes is not content to act like a normal Muggle parent and ignore the wizarding world once his child leaves for Hogwarts. He takes an active (and not always welcomed) interest in wizard affairs.

[1] [http://www.fanfiction.net/s/7578572/1/A-Study-in- Magic](http://www.fanfiction.net/s/7578572/1/A-Study-in-Magic)

</comment><comment><USER20> The index page looks really interesting, the kind of index page that would lead me to read the book. Can someone give a gist of what this fanfic is about?

(I loved the Harry Potter series and I love Nassim Talebs works if that matters)

<comment><USER21> Imagine if Harry Potter was a little more inquisitive...

In this universe, HP was raised by scientists. So, whenever he is introduced to some new magic, he says "Why? How? What are the limits?"

For example - could one apparate to the moon?

<comment><USER22> Also many (but not all) characters have had their competence, intelligence, and in general their power level increased significantly (so that the story stays interesting, given that Harry's intelligence has been greatly boosted too).

</comment></comment></comment><comment><USER23> I've not seen this before - the first three chapters have had me guffawing something dreadful!

I'm going to have to ration my reading of this...

</comment><comment><USER15> If you are just starting this, make it through at least chapter 10 before deciding if you want to stop reading. That's where things really pick up.

</comment><comment><USER24> I stumbled over this a few years back and decided not to start reading it until Yudkowsky stopped adding to it or at least chunked some subset of the chapters into one or more books. When I read fiction such as this I want there to be a clearly defined beginning and end to the story. Eternal soap-operas, even if clever, aren't for me.

<comment> loup-vaillant It will end soon. I'd say in a year from now, at most. There is also an e-pub version.

</comment></comment><comment><USER25> So, why should an adult choose to read this over actual literature?

<comment><USER26> I agree with you in all possible ways.

Counting that your average lifespan will be around 85 years, and you've been reading real literature since you were 14, that gives you 71 years of good reading. That is, if you are lucky enough to preserve your eyesight.

On average, let's say you read about 12 books per year, which gives you the sad total amount of 852 books you'll be able to read in your whole life. In my case, I've still got enough time for 684 more books. Think about this when you go into a library. A whole life worth of books fits into a couple of bookshelves...

There are more authors worth reading than books I'll ever be able to read before I die. So, nope. IMO you should NOT choose to read this over actual literature.

<comment><USER27> Someone so concerned to optimize their reading experience really ought to be reading more than 12 books a year.

<comment><USER26> If I was reading more than 12 books a year, I wouldn't be so concerned to optimize my reading experience ;)

Anyway, that was just an average, and I was just talking about literature, I wasn't including essays or technical books.

<comment><USER27> So you're happy to read things other than "literature". (Quite right!)

Which makes it a bit strange to say "don't read this, because it isn't literature". (Not your actual words, but I don't believe I'm misrepresenting your meaning.)

As you clearly appreciate, there are many reasons for reading things. Some of those reasons are best served by reading highbrow literature, some by reading technical books. Is there some general principle that makes it obvious to you that there is no good reason that would be well served by reading HPMoR?

Perhaps you have read enough of it to know you don't like it. Perhaps you've found "fanfiction is always junk" so reliable a guide that it would take an enormous amount of contrary evidence to change your mind in any instance. Fair enough, in both cases; but in both cases the actual reasons are much more detailed than "it isn't _literature_ , so away with it".</comment></comment></comment></comment></comment>


Dumpster – A self-hosted file upload server supporting YubiKey OTP tokens - <AUTHOR> https://github.com/nmaggioni/Dumpster <comment><AUTHOR> This is my first API-based NodeJS project, I use it daily on my team's production server. Any feedback is gladly accepted!</comment>


Show HN: I was bored with verbosity of React, then this happens - <AUTHOR> http://i.imgur.com/QXUNT2y.jpg <comment><USER2> This is not detailed enough for "Show HN", just a screenshot.

<comment><AUTHOR> Sorry for that, I just want to "show" my idea and to see how people think about it, for more detail please take a look at my reply to `sova`.

</comment></comment><comment><USER3> Could you explain some more on how you're using all those interesting symbols?

<comment><AUTHOR> Sorry, just it's for my need, not ready and recommended for others, but still, if you're bored like me, please install Vim, vim-javascript and vim-jsx-pretty plugins, enable concealing by adding `set conceallevel=2` into vimrc, then add the below file into `~/.vim/after/syntax/javascript.vim`. [https://github.com/thenewvu/dotfiles/blob/master/.vim/after/...](https://github.com/thenewvu/dotfiles/blob/master/.vim/after/syntax/javascript.vim)

Oh .. wait, you need to install nerd-fonts as well, gooling for that.

For using, I don't know, I just feel good with it. That's all.

<comment><USER3> Ah so does VIM convert your cool glyphs into text before compiling?

<comment><AUTHOR> No .. it just "displays" those icons, the origin code is still valid and verbose, you can think it as a kind of code highlighting.

<comment><USER3> Ah, very nice. That's actually not a bad way to go on the long and beautiful path to Code Canvas</comment></comment></comment></comment></comment>


Instagram iOS session hijack - <AUTHOR> https://gist.github.com/stevegraham/9a98627eebd6b09d4483?hn <comment><AUTHOR> OP here. I discovered this years ago. I suspect it has been extant for as long as Instagram itself. I actually posted a comment about this 216 days ago! ([https://news.ycombinator.com/item?id=6959472](https://news.ycombinator.com/item?id=6959472)). When I checked again on Saturday, I couldn't believe my eyes when it I saw it still hadn't been fixed. I reported it to FB immediately, to which they responded it's been reported "some" times and the Instagram team were working on moving all endpoints to HTTPS and they closed the ticket without further discussion. I was incensed that such a fundamental and critical flaw was allowed to exist for so long. Because of this I decided public disclosure was justified.

<comment><AUTHOR> The reply from Facebook:

"Hi Stevie,

This issue has been reported some already so unfortunately cannot reward you, instagram is working to get https for all endpoints. Its a pretty high barrier to exploitation to already sniffing someones traffic however.

Thanks,

 _name removed_

Security

Facebook"

And here I am sitting in the Apple Store around the corner from my apartment watching various cookies whizz past my screen.

I don't agree the barrier to exploit is high. All it takes is one sufficiently skilled person to release a tool so simple even a script kiddie can use it. At that point Pandora's Box has been blown apart. The obvious precedent for this is Firesheep (now sadly not functional) from back in 2010.

<comment><USER2> _> >"All it takes is one sufficiently skilled person to release a tool so simple even a script kiddie can use it"_

And that's why this was made :-)... [http://en.wikipedia.org/wiki/Firesheep](http://en.wikipedia.org/wiki/Firesheep)

Maybe you should contribute instagram-sniffing to it :) [https://github.com/codebutler/firesheep](https://github.com/codebutler/firesheep)

<comment><AUTHOR> Thanks, I referenced Firesheep in the grandparent. FS is currently very broken. I still couldn't get it to work after downloading the source and making some changes. The OS X API used by FS has long been deprecated and simply doesn't work on Mavericks. If there is enough interest I will write "Instasheep" this evening.

<comment><USER3> Got the instasheep domain name if you want me to point it at a github repo.

<comment><USER4> #1380asal

<comment><USER4> salam

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Relevant comment:

 _@wodim I adhered to the FB responsible disclosure procedure. FB replied saying they 're already aware of the issue and closed the ticket._

<comment><USER6> "Closed the ticket" as what, though? "Duplicate, working on fixing" or "won't fix"? Because those are pretty different...

<comment><USER7> Duplicates of non-public security vulnerabilities should be treated the same as the original reports (including the same rewards consideration process), especially if it was independently discovered.

An unfixed security vulnerability is still an unfixed security vulnerability, no matter how many people discover it in the interim. By refusing to coordinate with the new submitter, the new submitter does not know if the vulnerability will ever be fixed and is reasonably justified in using public disclosure.

The one case where refusing to coordinate with the new submitter is reasonable is when the new submitter learned about the vulnerability from the original submitter, which means that the original submitter has violated responsible disclosure. In that case, nobody would deserve a reward.

<comment><USER6> > Duplicates of non-public security vulnerabilities should be treated the same > as the original reports (including the same rewards consideration process), > especially if it was independently discovered.

This is rare for bug bounty rewards. All the programs I am aware of only reward the first reporter.

> By refusing to coordinate with the new submitter, the new submitter does not > know if the vulnerability will ever be fixed and is reasonably justified in > using public disclosure.

That's kind of what I'm pointing out here. We are missing information about what Facebook actually said and when it was said. The "we already know about it" response could mean "we know about it and are working on fixing it" or it could mean "we know about it and we don't care". In the former case, it is not responsible to publicly disclose the issue until it is fixed. In the later, it is.

A separate scenario is if the company is taking a long time to fix the issue. This is obviously subjective, but in my opinion it is understandable for a reporter to publicly disclose a long-standing issue in an attempt to force the company to act.

<comment><USER8> Yes, rewards to every submitter basically lead to the first guy telling N of his friends to all claim the bounty, too. It sucks to work for dozens of hours on something and then find out they already know about it, but the other option just leads to there being no bounties at all.

</comment></comment></comment></comment></comment><comment><USER9> Full and public disclosure is always responsible.

STOP USING THE TERM RESPONSIBLE DISCLOSURE. It serves only to frame full, public disclosure as "irresponsible disclosure", which is false.

<comment><USER10> No it is not in different situation. If I tell you your social security number is now accidentally written in your HTML file (probably because you copied and pasted the wrong thing), and now I tell the world "hey come look at sneak's SSN" instead of waiting for you to resolve is wrong.

Now back to this gist.

Is he responsible? It depends on how the situation was played out.

Based on what OP said:

* He found this 216 days ago and wrote about it as a comment on HN

* He didn't say whether he reported that day but he recalled Instagram was making HTTP request a year prior to that day he wrote the comment

* He didn't tell us when he report this issue to FB. Yesterday? Last week?

* FB said they are aware of this situation and closed the ticket. Like someone else said here, "closing" has different meanings. I've never reported any vuln to FB so I don't know how that works. But on HackOne, particpating program can close a ticket and set the ticket to "Not Applicable" meaning someone else has already reported.

So the decision factor is:

* when was the first report submitted by OP? Yesterday? Last week? 3 months ago? 216 days ago?

* if it was very recent, OP doesn't know the exact time the last duplicate report was sent out. Give FB a little more time and ask FB again in a week or so.

I did say in my other comment fixing this issue should be pretty trivia for Instagram as an outsider, but I also should acknowledge any major change to infrastructure should have a proper audit and roll out.

 _edit_ :

One last point. If OP thinks he's doing the right thing, let it be. There are too many things unknown to me so I am just listing all the possible consideration. I have tons of bug bounty reports unfixed for 3 months on various sites and I still email those sec teams back and forth to look at progress. It's an individual decision and with every decision comes a consequence to bear.

<comment><USER9> > If I tell you your social security number is now accidentally written in > your HTML file (probably because you copied and pasted the wrong thing), and > now I tell the world "hey come look at sneak's SSN" instead of waiting for > you to resolve is wrong.

No, sharing links to published data on the public, unauthenticated web is not wrong.

<comment><USER10> How so?

People accidentally leak password in source code. Instead of telling HN everyone come look at this embarrassing source code, first thing to do is to contact source owner to remove it. Yes, there is cache and Internet archive, but don't publish that until resolved is the proper interpretation of responsible disclosure.

</comment></comment></comment></comment><comment><USER11> I reported this issue a long time ago. Got the same messages back from facebook as everyone else in the thread. I've reported other issues and always get the same thing back.

It sounds like Facebook Security gets a lot of pushback from the developers. Certain things like coffee shop attacks and a lot of other REAL ISSUES get no notice for a long time. It took up until last year to get a damn HSTS header.

I actually reported an issue today about a security practice they implemented completely incorrectly. I got a response back that it was not meant for any actual security.

In theory it's unacceptable, but in practice this is a big company with thousands of employees and a lot of moving parts. Small changes can be hard to make....which to get back to my original point is why facebook seems to just ignore a lot issues but keep the pipes open for the occasional big one.

</comment><comment><USER12> I remember when back in the day Facebook didn't default to HTTPS. You could just put your 802.11 card to monitor mode, power up ettercap in an area where there are a lot of unencrypted WiFi packets flying around, and easily you have dozens of session cookies. Script-kiddie level.

More interesting would be to take over a network (MITM style) and set up iptables to route all connections to Facebook IP's to a local webserver (DNAT target helps). Then you host a phishing FB page and soon you have logged emails and passwords from unsuspecting users. I think this can actually work even if Facebook does default to HTTPS, because users never actually reach Facebook itself.

<comment><USER13> "I think this can actually work even if Facebook does default to HTTPS, because users never actually reach Facebook itself."

The certificate won't match. I don't know how many users will click past the big red warning page most browsers show, but I don't have much sympathy for them if they do.

<comment><USER12> I was referring to serving an ordinary HTTP page on port 80. Most people type facebook.com into the address bar and hit Enter (and don't have HTTPSEverywhere). In normal circumstances, Facebook would issue a redirect to [https://facebook.com](https://facebook.com), but if you're controlling the network you just serve the front page via HTTP.

<comment><USER13> Yes, I suppose that might work at least some of the time. Most browsers these days, however, would send you to the https site simply because you had visited it more frequently unless you typed out the full url and managed not to select the offered completion.

<comment><USER14> > _Most browsers these days, however, would send you to the https site simply > because you had visited it more frequently_

Actually, in that case, modern browsers would _completely refuse_ to send you to the http site, even if you typed it in explicitly. All thanks to Facebook's 90 day HSTS header [0].

They could improve their security further by getting Facebook into the Chromium preload list. That list, which is shared with Firefox, eliminates the need for an initial, clear connection.

[0]: [https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security)

[1]: [https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...](https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json)

</comment></comment></comment></comment></comment><comment><USER15> I recently found that a very popular web-service serves its api console over HTTP, rendering all API keys vulnerable to MITM. I sent over a mail to their security issues mail address. Still waiting for a response.

Step 1 of securing an API: Use SSL.

</comment><comment><USER10> So let me get this straight: this is just the classic non-HTTPS traffic sniffing.

I am not sure why Instagram isn't moving all calls to HTTPS. Instagram itself is not as complicated as Facebook and shouldn't really be bounded to HTTP so badly.

They can easily do 301/302 redirect to HTTPS, then perform HSTS (for browser, not for API calls) in addition and let the proxy like nginx handles it to their usual port 80 requests. Problem solved.

How much more work do they need to do to shift from HTTP to HTTPS? I just don't get it.

<comment><USER16> Instagram run on Amazon AWS, though Facebook finally moved Instagram to their own datacenters (as of June 2014) where FB use SSL hardware cards (cheaper than CPU and ELB for SSL on AWS).

 _We also terminate our SSL at the ELB level, which lessens the CPU load on nginx._ \-- [http://instagram- engineering.tumblr.com/post/13649370142/wha...](http://instagram- engineering.tumblr.com/post/13649370142/what-powers-instagram-hundreds-of- instances-dozens-of)

[http://www.zdnet.com/instagram-finally-picked-up-and- moved-f...](http://www.zdnet.com/instagram-finally-picked-up-and-moved-from- aws-to-facebook-7000031014/)

[http://instagram- engineering.tumblr.com/post/89992572022/mig...](http://instagram- engineering.tumblr.com/post/89992572022/migrating-aws-fb)

</comment></comment><comment><USER17> I'm trying to reproduce this on a macbook. I'm a developer, not a networks guy so please excuse me for not knowing the basics!

After doing `sudo tcpdump -In -i en0 -s 2048 -A dst i.instagram.com`, and using every instagram feature from my iPhone, nothing happens in the terminal.

```

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on en0, link-type IEEE802_11_RADIO (802.11 plus radiotap header), capture size 2048 bytes

```

I try running with -v and -vv, but no difference (except it doesn't suggest running in verbose more).

After hitting C-c to stop the program, it outputs

```

^C

0 packets captured

29816 packets received by filter

0 packets dropped by kernel

```

So there's a lot of things being captured, but the filter does not catch my Instagram activity. I'm logged in there, refreshing, getting images, getting followers/following, etc.

EDIT: oh shit, HN doenst do markdown. That sucks.

<comment><USER18> Monitor/promiscuous mode only works on WEP and open wifi networks. I assume you have a WAP network so this isn't working. As a POC you can add your phone as a network interface. To do that:

         1. Plug in your iPhone/iPad into your computer via USB cable
         2. Go into Xcode Organizer and find your iDevice's UID
         3. Hop over to terminal and type 'rvictl -s <UID>'
         4. Type 'sudo tcpdump -n -i rvi0 -s 2048 -A dst i.instagram.com'
         5. Open Instagram on the device, and the packet info should appear in terminal. The rest is the same
         6. When you're done you can type 'rvictl -x <UID>'

</comment></comment><comment><USER19> Same goes for Android [http://thehackernews.com/2014/07/instagram-mobile-app- issue-...](http://thehackernews.com/2014/07/instagram-mobile-app-issue-leads- to_27.html)

</comment><comment><USER20> I found a way to hijack someone's instagram account by accident. All it took was signing up for Facebook.

Never could get any traction with Instagram to look into the issue.

<comment><USER21> Maybe try FB's bug bounty program?

[https://www.facebook.com/whitehat](https://www.facebook.com/whitehat)

</comment></comment><comment><USER22> Websites need to start taking more responsibility with HTTPS. Reddit, and a few other popular sites can also have their sessions hijacked.

<comment><USER23> reddit was quick to patch the heartbleed bug, but I got downvoted when I put forward that it wasn't a big deal as HTTP is probably 99.99% of traffic.

</comment></comment><comment><USER24> Every couple of months one of my friends insists that she's "quitting Instagram" because of how often things go wrong on the platform. Several times a month she gets logged into someone else's account with full read/write/update access and I believe even gets access to their Facebook. Between the above, the 4+ accounts she's has deleted for no reason, and the bugginess of often having a blank UI, it's becoming harder and harder to enjoy browsing on Instagram.</comment>


Do Lockdowns Save Many Lives? In Most Places, the Data Say No - <AUTHOR> https://www.wsj.com/articles/do-lockdowns-save-many-lives-is-most-places-the-data-say-no-11587930911 <comment><USER3> Maybe we should have a conversation about the age distribution of the deaths. Because no one in the media is willing to publish aggregated world data.

[https://www.statista.com/statistics/1105061/coronavirus- deat...](https://www.statista.com/statistics/1105061/coronavirus-deaths-by- region-in-italy/)

[https://www.statista.com/statistics/1109867/coronavirus- deat...](https://www.statista.com/statistics/1109867/coronavirus-death-rates- by-age-new-york-city/)

<comment><USER4> I believe it is widely known that the disease disproportionately affects older people.

Are you saying you wish we had worldwide stats for the demographic breakdown of the deaths? (If someone does that, could I also request a breakdown that shows the size of the demographic -- for example, in the charts the parent poster shared, I assume that there just aren't many 90+ year olds alive (as a percentage of the population), and so there aren't many deaths -- but a ratio would make it way easier to tell.)

<comment><USER5> I think they're saying we should realize that a septuagenarian or an octogenarian is, economically speaking, a drain on society and we should be having a conversation about whether stopping the world economy to keep cost centers running makes sense.

<comment><USER6> Yes, because the elderly among us are, like all human beings, merely vehicles of economic value.

My parents wish I would call or write to my cost centers more, but I don't see the incentive to invest my valuable time for little to no ROI.

</comment></comment></comment></comment><comment><USER7> This honestly looks like a propaganda piece that directly contradicts a ton of evidence to the contrary.

<comment><USER8> I think calling something propaganda is a great way to silence discussion.

It's arrogant to assume that the lockdowns are the only way to respond to this virus. I don't want to assume. I want to be informed by the data. That landscape is shifting, and I want our leaders to be willing to change their minds as new data comes in and we learn more.

Maybe we carry on with lockdowns, maybe they were a good idea in cities, but never for suburbs. It's really hard to tell at this point.

I was for the lockdowns, and I'm willing to stay that way, but I'm willing to hear more facts ,data, and analysis.

We all work at keyboards, and get to stay employed. The cost/benefit analysis for coders as individuals is a hell of a lot different than it is for construction workers, restaurant workers, retail, etc. We should really try to be sensitive to that, instead of acting as if economic devastation doesn't cost lives, and is just a bit of pain to endure while we save lives from the virus.

I grew up in an economically depressed area. Poverty, loss of livelihood and misery kill people too. Think about the fact that this is mainly being done to protect elderly people who have already earned the money they need for life, and is primarily costing young earners their livelihoods.

The political system in the US already favors the elderly at the expense of the young. Do you think you're ever going to see Social Security checks equivalent to what you are paying in?

<comment><USER7> > I was for the lockdowns, and I'm willing to stay that way, but I'm willing > to hear more facts ,data, and analysis.

Then look at the data. There's an entire subreddit of all the latest papers and analysis regarding the disease and its spread, and the ineffectiveness of lockdowns has been debunked time and time again, especially now that we have models that have high approximations of the real-time spread of the disease. We have examples from Singapore, Germany, Brazil, and various US states about how easing lockdowns without concern for the necessary sanitary measures has a very measurable impact on new infections and deaths.

In the beginning there were no clear exit scenarios. We have multiple governments that have expressed them now, with specific goals and measures that have to be considered to not reignite the spread of the disease.

So yes, I consider this propaganda because the basic premise of the article is flawed and is the subject of journalists failing to navigate the current state of research, and its implied motivation of defending premature openings at the cost of an additional tens of thousands of lives.

</comment></comment></comment><comment><USER9> > To normalize for an unambiguous comparison of deaths between states at the > midpoint of an epidemic, we counted deaths per million population for a > fixed 21-day period, measured from when the death rate first hit 1 per > million—e.g.,‒three deaths in Iowa or 19 in New York state. A state's "days > to shutdown" was the time after a state crossed the 1 per million threshold > until it ordered businesses shut down.

Can someone better at stats walk through this? Doing a simple test like this and then claiming lockdowns don't work does not seem genuine.

<comment><USER10> The places that are slow to shut down are the places that are more dispersed and thus have a lower R0. Thus this is totally bogus.

</comment></comment><comment><USER11> Suppose perfect lockdowns, so no new infections after lockdown, not even family members.

Suppose incubation is 1w, then 1w of worsening syntoms, and then death at 3w, consistent with Italy and other countries (sp. in places with enough beds, deaths seemed to have occurred later).

Then, isn't the whole premise wrong? You want to study lockdowns but only look at deaths from infections BEFORE the lockdown?

Am I missing something?

</comment><comment><USER12> Any idea how one could procure this wihtout the paywall?

<comment><USER9> [https://www.foxnews.com/opinion/do-lockdowns-save-many- lives...](https://www.foxnews.com/opinion/do-lockdowns-save-many-lives-in- most-places-data-say-no)

Excerpt:

Do quick shutdowns work to fight the spread of Covid-19? Joe Malchow, Yinon Weiss and I wanted to find out. We set out to quantify how many deaths were caused by delayed shutdown orders on a state-by-state basis.

To normalize for an unambiguous comparison of deaths between states at the midpoint of an epidemic, we counted deaths per million population for a fixed 21-day period, measured from when the death rate first hit 1 per million—e.g.,‒three deaths in Iowa or 19 in New York state. A state's "days to shutdown" was the time after a state crossed the 1 per million threshold until it ordered businesses shut down.

CLICK HERE TO GET THE OPINION NEWSLETTER

We ran a simple one-variable correlation of deaths per million and days to shutdown, which ranged from minus-10 days (some states shut down before any sign of Covid-19) to 35 days for South Dakota, one of seven states with limited or no shutdown.

CLICK HERE TO GET THE FOX NEWS APP

The correlation coefficient was 5.5%—so low that the engineers I used to employ would have summarized it as "no correlation" and moved on to find the real cause of the problem. (The trendline sloped downward—states that delayed more tended to have lower death rates—but that's also a meaningless result due to the low correlation coefficient.)

<comment><USER12> Isn't that just an excerpt? It links to WSJ at the end...

<comment><USER9> You're right, thanks! - <USER2>

</comment></comment></comment></comment><comment><USER13> The author is a well known government hands-off libertarian, so keep the bias in mind.

<comment><USER9> Wikipedia:

> Rodgers is known for his public relations acumen, brash personality, and > strong advocacy of laissez-faire capitalism

> Laizzes-faire is an economic system in which transactions between private > parties are absent of any form of government intervention such as > regulation, privileges, imperialism, tariffs and subsidies

</comment></comment><comment><USER14> The saying is only 3 meals from anarchy. Pick your poison: economic collapse or avoid coronavirus. I'd take the virus, personally.</comment>


Show HN: Covid Help Center for Arts Professionals - <AUTHOR> https://www.covidhelpcenter.com/ <comment><AUTHOR> Dear all,

Thank you for checking out the site! I started www.covidhelpcenter.com to help arts professionals and organizations find COVID-19 emergency relief funds.

I used to run a popular classical music concert series in Vancouver, Canada up until the outbreak, so I have been collecting such information to help myself and others.

I would sincerely appreciate any comments or feedbacks!</comment>


Facebook confirms it will officially support gifs - <AUTHOR> http://techcrunch.com/2015/05/29/facebook-confirms-it-will-officially-support-gifs

<comment><USER2> I've seen a few already in comments on my newsfeed. Surprisingly, it seems a little more streamlined than on tumblr. Can't help but wonder how my grandma is going to embrace gifs.

</comment><comment><USER3> Reading the title, I was worried for a moment that I had clicked through a time portal. GIFs. Aren't they as old as CompuServe? Then I read the body text, thinking: "Do I know _anyone_ who hasn't turned off GIF animation in their browser yet?"

</comment><comment><USER4> Hahaha

This is how Facebook begins to die.</comment>


Announcing SSH Access Through Cloudflare - <AUTHOR> https://blog.cloudflare.com/releasing-the-cloudflare-access-feature-that-let-us-smash-a-vpn-on-stage/ <comment><USER2> > When you attempt to reach a web application behind Access, we instead > redirect you to your identity provider. Once you login, we generate a JSON > Web Token and store that token as a cookie in your browser. SSH connections > require a slightly different flow for your end users, but one that is just > as convenient.

> First, you need to install cloudflared. cloudflared is a lightweight command > line tool published by Cloudflare that will proxy traffic from your device > to the server over SSH. You can remove the need for any unique commands by > adding two lines to your SSH config file that will always use cloudflared to > proxy traffic for a particular hostname.

> Once set-up, you can attempt to reach the resource over SSH from your > command line or code editor

IDK but it seems a bit more complicated than just using public keys on a public port.</comment>


Ask HN: Our script was flagged as malicious by Google Ads, help - <AUTHOR> Hello fellow HNers!
Our startup does attribution: user clicked ad, user looked at these 4 pages, user filled out form, receptionist qualified lead, customer bought, you got ROI. On the customer's website, it behaves like a combo of Google Analytics, CallRail and Hubspot.
And then Google Ads scanner flagged our script as "malicious" software and shut down all the ads, of all the businesses, us and our friends, that have it on their site. YIKES. Company killer if we can't get this fixed.
We went to customer support, they said the script is malicious and our only option is to take it down on our site. No can do, this is our startup.
Here's what it does: * It tracks user activity page by page and even movement, throughout the session, after they come from any source, one of which is Google ads * Duplicates Callrail, using number swapping and custom phone numbers for each session, so we can attribute phone calls. * Provide an API that clients can use to wrap up their contact form submissions into a JSON object and do an AJAX call, allowing us to intercept the inquiries on their site. (Customers must implement it specifically) * Embedded in the script are the following: fingerprint.js, a Call-Rail style number swapping script (custom), and jQuery. That's pretty much it.
Interestingly, we haven't run afoul of the main scanner (Search Console Security Issues), it's just the ad scanner (YOur Google Ads are disapproved).
Does anyone have any insight into A) which part of this they think is the problem, with emphasis on any direct experience you have or B) how we can get details from the technical team on what the issue is ?
p.s. - For various reasons owing to the large audience here and people we know, we can't disclose the company names or URLs here. I'm happy to sidebar with specific people though if you're willing to help. <comment><USER2> Browser fingerprinting is generally frowned upon by many major browser vendors and ad blockers.

It also goes against user's rights for privacy and tracking prevention that they have control over.

I wouldn't be surprised if google ads classifies fingerprinting as malicious.

Remove it from the bundle and try again.

Additionally, the ability to intercept form submissions can also be seen as malicious.

Especially if it's a 3rd party script doing the interception and making AJAX calls to another domain.

This is basically what malicious scripts do.

HTH I have been building adtech for Google Ads etc for 15+ years. Happy to talk more if needed. But I'm pretty sure the two changes above will fix it.

<comment><AUTHOR> Do you know if I fix it, how to trigger a rescan of the offending URL, not the advertisers' page? I'm trying to figure out what the lifecycle and stickiness of a flagged URL is.

Example: www.advertiser.com contains -> a.startup.com/script.js

I'm considering this strategy: * drop fingerprinting and form submission like you suggest * resubmit advertiser.com's ads for a rescan, but if theyve got startup.com's url flagged, will they rescan that URL too? * problem: how do I know how to long wait to see if it worked?

My next move would be: * setting up a new subdomain, new filename (like b.startup.com/newscript.js)

Thoughts?

<comment><USER2> The last time this happened with a client, fixing the script was good enough to resolve the issue with Google after resubmission.

But that may have changed.

</comment></comment></comment><comment><USER3> The way you describe your script literally makes it sound like malicious software.

Do you webpack/rollup the entire thing together, or is fingerprint/jquery included as-is?

<comment><AUTHOR> It's all packed up into one script together using a bundler.</comment></comment>


Ask HN for a career advice - <AUTHOR>

Here's where I'm at:

  * 1993: Graduated with a degree in Mech Eng (middle east). Worked in plant maintenance management & coordination (around 5 years).
  * 1998: M.Sc. Mech Eng (London, UK)
  * 2000: Developed a passion for software.
  * 2003: M.Sc. Info Sys (Boston, MA). Worked in mid-east as software developer leveraging my plant maintenance experience.
  * 2007: Moved to Canada. Worked in developing web-apps for end-user, B2B, enterprise.
 I'm currently contracting for The Man (read: lucrative but soul sucking), and will soon be outsourced (primarily to save office space). I've tried launching a product but failed post-implementation (partner quit).
I'm at a career cross-roads. I'm starting a service company, but being drained out of motivation and ideas. I have a family of four and minimal social support.
<personal_observations> I'm getting old. The IT industry is pitiful (bad clientele, outsourcing, non-involvement, ...). It's not as easy as other professions to make money (although not too difficult either). Indicators are not in favor of the industry (bubble, economy, ...). My choice of technology isn't aligned with The Norm (further difficulties in landing a 'job'). I'm not being part of something BIG. </>
I've been advised to move back to Engineering, and try finding a job. I've thought of 'merging' the two careers, but totally lack ideas.
I've always appreciated the insights of HN community and would like to hear what you have to say.
[sorry for lots of 'I's] <comment><USER2> As far as "merging" your jobs, this jumps out at me: +plant maintenance management & coordination (around 5 years). +software developer leveraging my plant maintenance experience.

I'm sure you've seen in 5+ years something in plant management that could probably be automated or had a pretty GUI put on top for pretty graphs. Is there anything you can think of that you could look in to developing that you could whitebox and sell to plants for management? Perhaps it was something during your software development experience that you thought would have been cool to pursue but The Man decided to take a different direction?

If you feel you've been out of the loop I'm sure you must have some contacts that would be more than happy to talk to you about their problems.

Initial barriers I see: I know some industries run certain vendor equipment so integrating or even convincing them to buy would be a bit difficult.

My other thought would be to go back to Engineering and use your software experience to make your life easier by automating your daily tasks so you can spend more energy doing something else (working for advancement, not working long weeks, or whatever other goals you have).

<comment><AUTHOR> Thank you for taking the time and your thoughts.

Investing in a product is an interesting idea, but: 1) I'm out of the loop as you mentioned. 2) Bad taste from my little adventure. 3) Lack of motivation and 4) Lack the sales channels especially for enterprises.

</comment></comment><comment> y-l Yeah I would like to hear advice too. I am based in a developing country and my choice of technologies is absolutely not helping me do anything (I learned ruby on rails and I want to start a service company as well).</comment>


Show HN: A list of GitHub users that have founded a company - <AUTHOR> https://github.com/vreaxe/founders-in-github <comment><USER2> That's somewhat uncomfortably close to dox'ing.</comment>


Mike Maples: The Party is Over - <AUTHOR> http://www.pehub.com/wordpress/?p=2816

<comment><USER2> I was most struck by this:

 _But it also has an agreement with Google that Maple is hoping will eliminate any need for the company to market its services. If you Google a dentist in some markets right now, a customer review in DemandForce's system will pop up_

Pop up where? In the natural search results? Is it standard practice for Google to have such special arrangements?

</comment><comment><USER3> As a developer with some spare time and an idea, this certainly won't be stopping me.

<comment><USER4> Part of the issue might be that there aren't many venture-scale consumer- oriented projects left to fund. As a corollary, the low cost of trying ideas and starting consumer-oriented software companies has decreased the need for VC money in that arena.

<comment><USER5> > Part of the issue might be that there aren't many venture-scale consumer- > oriented projects left to fund.

(1) Yes, there are. (2) Some of the remaining ones are 1-50x bigger than anything that has been done so far.

</comment></comment></comment><comment><USER6> "[H]e said he has switched his primary focus to business software and services." As would I, if I spent 23 years at IBM and a dozen or so years as a VP at Microsoft. You have nearly four decades of experience in the field, why give that up?

<comment><USER7> Selling to small and medium businesses is fantastic because they have money and they might even be willing to spend it. The same cannot be said of college kids who are only willing to buy ringtones and alcohol.

<comment><USER8> The problem with this is that it is much easier to get to all of those college kids than it is to get to the SMB market. You _need_ funding to sell into this space because you are going to end up pissing most of it away on marketing. There are no CxOs or VPs you can go to and get a five-figure sale, no conferences that will provide enough leads to generate a 10x return on whatever it cost you to get to the conference, and no viral campaigns that can get your product in front of millions of twenty year-olds with a small bit of disposable income.

This is a late-adopting, retail-driven market and you will be competing with companies that have serious marketing budgets and established relationships throughout the distribution channel.

<comment><USER7> How about making a freemium subscription web app where the base paid plan is $9/month?

Note: I have never worked in a startup.</comment></comment></comment></comment>


Mental models for designers (2019) - <AUTHOR> https://dropbox.design/article/mental-models-for-designers <comment><USER2> I really enjoyed the article and find several of the models quite useful.

However, I think the Diamond model can be over-used. It's often the right model when you need to _explore_ a topic or _persuade_ a group to your vision or line of thinking. It's perhaps not the best model for effective decision- making though. When the time comes to make a crisp decision, I want to see the recommendation framed up in the first section. If I'm reading a recommendation that we implement policy X, I want to know in the first paragraph (or two, max) that's what this document is about, what the author's recommendation is, and then see why and what alternatives where explored. I _specifically do not want_ to read any story about the history, the existential problem, or why we need this policy before I know the recommendation. All that material that may have been important at kickoff is now relegated to supporting points in the middle, to an appendix, or removed entirely.

I read way too many "we need a decision here" documents that flow like murder mysteries.

Bottom Line Up Front for some topics, please.

<comment><USER3> Begin with your thesis. This applies to just about all writing / communication. There needs to be a very good reason to deviate from this.

</comment></comment><comment><USER4> I like that this article is very clear, visual and to the point. From my experience those exact same approaches/models are very useful throughout many situations in business, not only for designers. Consider e.g. sales where you also need to

\- show (the customer) how to solve the problem (he/or she has)

\- create a clear decision framework (and get the customer on board)

\- craft a narrative around our solution

to succeed. There you also need your problem solving skills, a model for decision making and a way to communicate in a way that reaches and convinces your audience.

</comment><comment><USER5> Well, at this point, screaming about these not being mental models is about as useful as complaining about re-posted imagery not being actual "memes." (In the original sense of the word meme).

A mental model is something you use to make predictions so that you don't have to store all the nuances of a system in memory. It's a reduced-entropy representation of a phenomena of the universe that you have to interact with. It's a simple oracle. Newtonian gravity is a mental model.

These are recipes and formalized guidance, i.e., wisdom, for dissecting problems and presenting solutions. These are algorithms.

If you believe these will work, you have a mental model of the world that you have checked to verify these steps. The model that the author has of readers is that they will enjoy this post.

<comment><USER6> Slightly confused if you don't mind clarifying. Are you saying that what a mental model actually is isn't correct in how this article uses them?

<comment><USER5> Yes. A model takes input, runs a process, and provides output. It's a model because it is simpler than the real process, but provides reasonable approximations. Newtonian Physics is a model of physical interaction from gravity and mass.

A mental model is an internal construct the mind uses to represent parts of the world. You have a mental model of your body. You have a mental model of how physics works. You have a mental model of how your friends would react to certain situations. etc. A model says "If the world is in this state, then the next state is this one."

Wisdom, or aphorisms, are things that are taught to people which are shorthand for solutions to complicated situations. They are algorithms. They say "These are the answers to problems that you might encounter". Sometimes, they provide guidance. They are heuristics. This article should be "Polya-like heuristics for designers"

You would teach someone a mental model like this: "Think of a person as a robot programmed to reproduce and eat". This allows you to draw conclusions by querying your model of a robot and applying that to the person. You could predict how the person would make decisions. It might be wise to do that or not.

You would teach someone wisdom or an aphorism like this: "If you encounter a hard problem, break it down into sub problems". True, there is potentially a model there: All problems are just collections of subproblems, but that's something you have to build up by following the guidance. It doesn't actually give you a model, it prods you to build one ... if necessary.

The article does not provide any models, it only suggests steps to break down problems or communicate solutions. You, the reader, are using your internal mental models of the world to see if the stuff you are being suggested actually makes sense. If you start crafting new models, it is not because this article contains any of them.

</comment></comment></comment><comment><USER6> Great writeup. Think I found this one on HN the other day also: [https://untools.co](https://untools.co)

I find these very helpful as a manager. Highly advised read even if you're not a designer for this Dropbox one. The Untools ones as an engineer, manager, or almost anything really. The focus is decision making, problem solving, and big picture thinking.

</comment><comment><USER7> Relevant: [https://untools.co/](https://untools.co/)</comment>


OneLook Thesaurus - <AUTHOR> http://www.onelook.com/thesaurus/ <comment><USER2> This is really good!</comment>


Show HN: sweepstakes + Twitter = TweetStakes - <AUTHOR>

A friend of mine and I were talking a while back and we realized that it would be cool to run some sweepstakes on Twitter. We put up a sign up page for a while to collect some emails and we got 200 sign ups.
Once we received some sign ups we got together about 2 weekends ago and we put together a web application that lets people create sweepstakes on Twitter by counting the mentions and picking winners etc.
I want to get your opinion on the site before we let those 200 people know that we are ready for beta. I would very much appreciate your feedback. Thanks in advance.
The url is: http://www.tweetstak.es <comment><USER2> [ <http://www.tweetstak.es]>( <http://www.tweetstak.es>)

</comment><comment><USER3> I don't know if this exists but I think it's a nice idea. Two things though: 1\. in my country (The Netherlands) there are laws surrounding sweepstakes and I guess in other countries also. Make sure you write something about that on your website. And maybe those laws even apply to you, so check that out. 2\. why not make this idea broader and have Tweet Polls?

<comment><AUTHOR> That is a really good point that we will immediately implement in our Terms of Use.

2\. That is a brilliant suggestion, I have a personal side project that is very much on this using mobile devices! This would be a great addition.

Thank you, this is exactly the type of feedback I was hoping for.

</comment></comment><comment><USER3> I was going to sign up but the Twitter oauth asked me things to approve that I am wondering if you are really using or need. Like authorizing your web app to change my profile and read my DM. Is your web app changing profiles or reading DM? If not, skip that in the approval process.

<comment><AUTHOR> Honestly, I was not aware of that! We certainly don't need to modify your profile or read your direct messages.

The only thing we use it for is to check the mentions and follows so far.

Thank you for your help!

<comment><USER3> What I don't know, is if you can choose the permissions. So maybe this is standard with Twitter oAuth. I know with the Facebook one you can choose which permissions you want to ask the user.</comment></comment></comment>


MyPals – New feel-good Social Network for families, friends and creative talents - <AUTHOR> https://www.mypals.me <comment><USER2> You might try NOT stealing background images from Campo Santo / Firewatch for the "invite new pals" header/"hero" image...

[https://imgur.com/a/NXON1RL](https://imgur.com/a/NXON1RL)

What will the excuse be?

1) "We outsourced it, and we totally trusted random internet person not to steal shit!"

2) "We have no idea what copyright is, and will dig our heels in, this is totally fair game!"

3) "This happens all the time, how do you think Google Image Search can display these images in the first place, eh???"

<comment><AUTHOR> as already mentioned, you could have just written a friendly message per e-mail! Of course we removed it right away. We are sorry about the incident. Won't happen again. Best regards, Your MyPals team</comment></comment>


Free idea.  Is it worth more than that or has it been done already? - <AUTHOR>

I'm working on an easier to use database for my school district.  I was watching my son play The Sims and was wondering if anyone has adapted this concept as the front end to a database.  I'm visualizing our superintendent sitting at his desk where he sees a map of the city and can scroll to the building or classroom and then click on a hyperlinked object to get information about that place.  The principals would see their buildings, the teachers would see their student's faces, etc.<p>This might speed up the decision making process - if it were networked the stakeholders could meet virtually.<p> <comment><USER2> Sounds really hard to make.

<comment><AUTHOR> For me it would be, but watching my son play The Sims makes me think the hardest part has already been invented. I asked him if his creations could have hyperlinks added, he said no but that people make add-ins.</comment></comment>


Linux Credit Card - <AUTHOR> http://www.linuxfoundation.org/programs/linux-credit-card

<comment><USER2> Great initiative but it is too shame that they are not planning to make it worldwide :/</comment>