Zener diodes have coupled quantum noise that travels at c [pdf] - <AUTHOR> http://vixra.org/pdf/1603.0389v2.pdf <comment><USER3> I only skimmed the first page of the linked paper and got a bad vibe from the arguments it tries to establish against the validity of Special Relativity. I looked through the author's list of past publications and that proved enlightening: he published a lot of papers in Apeiron, a lesser online journal edited by people who are known in the community to support fringe ideas.

And another thing caught my eye: a paper by Cahill from 2006 which claims in its title that variations of the Michelson-Morley experiment show deviations that are caused by gravitational waves. The abstract of the paper goes on to explain that these waves supposedly have much stronger effects than predicted by BR because their physics are completely different than what GR describes. This claim of detecting gravitational waves (a decade before the massive LIGO effort made its first detection) alone shows that the author is "out there".

Take what this guy reads with a big pinch of salt. He seems to be on a crusade against relativity and the notion that space is not absolute.

<comment><USER4> Yeah, but LIGO invalidated popular interpretation of Michelson-Morley experiment results anyway.

<comment><USER3> Huh? How so?

<comment><USER4> It detected waves in something instead of nothing.

<comment><USER3> I do not understand what you are trying to say here. Gravitational waves are wave patterns existing inside the curvature of space-time. There is no separate medium that carries them. It is literally only space and time.

<comment><USER4> I strictly skeptical about any physical curvature of "space-time", because that requires extra-dimensions. Moreover, it's not clear what you name "space" or "space-time" here, due to ambiguity. If you referring to mathematical model, then "space-time" is just mathematical abstraction. I'm okay with that because it good for calculations. If you seriously believe that we have "space-time" as physical object, then we are in trouble.

LIGO detected waves in physical vacuum/quantum field/quantum foam/you name it. You can represent these waves in your favorite mathematical model and use your favorite tools for calculations, but don't mix mathematics and physics, please. For me, it's like "space is polygon because this predicted by OpenGL theory, which very accurately predicts our reality".

<comment><USER3> There is no "ambiguity" between space and space-time. They are clearly defined terms. Space means the 3d space that we experience around us. Space-time includes time as a fourth dimension.

While time as a dimenauon can be seen as a mathematical formality (it manifests as a different physical quantity in our observations), it _does_ behave much (but not exactly) like the spatial dimensions.

The entirety of GR, especially the space curvature part is formulated without embedding space and time into a higher dimensional space of any kind. This avoids any speculation about extra dimensions "around" our universe. It also causes the enormous mathematical complexity of GR.

Back to the topic of gravitational waves: these arise out of Einsteins field equation which describes space-time curvature as a result of the distribution of mass and energy in space. These equations show the property that certain small deviations of _curvature_ from their resting state propagate through space as waves. These curvature changes can be measured as changed in physical length of solid objects. This is what LIGO achieved. There is no room in current theories for any different kind of propagation medium for gravitational waves.

I seems to me that you have some difficulties understanding SR and GR. This is understandable because both describe phenomena that are not directly observable in our everyday lives.

<comment><USER4> You did this again. "Einstein field equation which describes space-time curvature" is mathematics. Formulas are correct, and they will stay correct long time after GR will be abandoned. You just need to do one more step: translate mathematics back into physics. Lets me quote very beginning of book about Quantum(Integer) Mechanics:

Chapter 2

The Formulation of Quantum Mechanics

2.1

Basic Theoretical Concepts

Every physical theory involves some basic physical concepts, a mathematical formalism, and set of correspondence rules which map the physical concepts onto the mathematical objects that represent them. The correspondence rules are first used to express a physical problem in mathematical terms. Once the mathematical version of the problem is formulated, it may be solved by purely mathematical techniques that need not have any physical interpretation. _The formal solution is then translated back into the physical world by means of the correspondence rules._

I cannot measure space-time with ruler, not touch it, nor walk 10 seconds ago, nor curve it. It's just mathematical abstraction. When we translate space-time back into physics, we will have coordinates of points in 3D space and time points, which we can measure with ruler and clock.

Same for gravity waves. If we want to translate this back into physics, we will need to reinterpret results of Michelson experiment. He has two predictions: 1) ether is stationary, 2) ether is attached to planets and objects like atmosphere (see Master of Light book). He failed to find ether wind, thus theory of static ether was abandoned. But he also struggled to find _any_ deviations of light travel time, so that led Einstein to think that c is constant, so he developed his GR theory. Michelson-Morley experiment was redone with precision of up to 1E-17 (distance to Alpha-Centaur is just 4E16m), which was good for GR. But then LIGO found that speed of light in vacuum is NOT constant. Thus, GR is not valid anymore. So we should return to theory of Ether, or you need carefully explain to me why you still think that c==constant and GR is valid.

I understand that you may be invested heavily into learning of mainstream theories, but every theory has limited life. If you think that I will change my mind if I will spend some more years on learning of SR and GR, then I should inform you that I think that formulas in these theories are mostly correct, but they lack interpretation, which lead to lack of intuition. I tested my theory on students and it's working well. I can explain what Ether, double slit experiment, atom, and many other things in short time. I hope, with intuition and formulas they will do much more than with just formulas.

<comment><USER3> Please point me to the publication from LIGO where they state that the measured speed of light is not constant. Any publication like this would be much more sensational than the apperntly superluminal neutrinos in the OPERA experiment (which turned out to be caused by faulty equipment).

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> I mean, I don't understand any of this, but I doubt it's worth trying to understand. At any rate, this is a strange HN submission title for a paper whose abstract claims to have unified quantum mechanics and gravity. Also, if a 2016 paper really did do what it claimed in the abstract, my untrained intuition tells me that it's bunk because it's languished for 2 years in obscurity. Oh, and he solved dark matter too. That's a nice side effect.

This seems relevant: [https://www.scottaaronson.com/blog/?p=304](https://www.scottaaronson.com/blog/?p=304)

</comment><comment><USER6> At university one of the assignment was to create hybrid ic, I made white noise generator using zenner diode, it worked fine but when it was touched inappropriately it started playing music.

</comment><comment><USER7> What is this?

The author mostly self-quotes and his articles are published on either _vixra.org_ ("arxiv" reversed, in case you missed it; _Physicist Gerard 't Hooft writes, "When a paper is published in viXra, it is usually a sign that it is not likely to contain acceptable results. It may, but the odds against that are considerable"_ from [0]) or in the - as it appears - <USER2> _Progress in Physics Journal_ [1]. He even cites news sites.

These are more red flags than one should reasonably need to think it's BS, imo.

[0] [https://en.wikipedia.org/wiki/ViXra](https://en.wikipedia.org/wiki/ViXra) [1] [https://en.wikipedia.org/wiki/Progress_in_Physics](https://en.wikipedia.org/wiki/Progress_in_Physics)

</comment><comment><AUTHOR> Check out figure 11 -- it doesn't look like instrumentation noise.

<comment><USER8> This was going to be my reply also. Seems it would be easy to set up a similar experiment with zener diodes and achieve the same results. In fact, with DSO's readily available these days, this should be reproducible in every university worldwide, and it would be cool to see attempted correlations across much greater distances.</comment></comment>


Show HN: Get notified when your Google Sheet changes - <AUTHOR> https://checksheet.app <comment><AUTHOR> Hi, developer behind Check Sheet here.

Check Sheet is a free add-on for Google Sheets that adds the ability to define rules that will trigger an email notification when your spreadsheet changes. For example if a certain cell exceeds a value or if all values in a column match a string.

Google Sheets does have very basic notification functionality built in but it can only trigger notifications on _any_ change, you can't narrow it down further than that.

This is the MVP I've built in a couple of months, any feedback is much appreciated.</comment>


Tweet at this bot to make games using emojis for scripting - <AUTHOR> http://gdevbot.sparklinlabs.com/?1

<comment><AUTHOR> I tried submitting this bot I made yesterday ([https://news.ycombinator.com/item?id=7924323](https://news.ycombinator.com/item?id=7924323)) but didn't realize it was the middle of the night in the US. Trying again in the hopes that it will catch some more attention.

<comment><USER2> Interesting. But it's a bit hard to tell what the bot does just from this page. Could the sample games show the Tweets that were sent to create them?

<comment><AUTHOR> Thanks! Yes, I implemented the logging system after those two games were made so they don't have a public log right now but I'm gonna try and build a little game to demonstrate the whole thing. Feel free to follow [https://twitter.com/gdevbot](https://twitter.com/gdevbot) for updates.

EDIT: I'm building a little game now, you can see it get build over here - [http://gdevbot.sparklinlabs.com/p/starpick/edit](http://gdevbot.sparklinlabs.com/p/starpick/edit)

<comment><AUTHOR> And precisely 60 tweets later... here's a game! Hold mouse down to move, catch the stars, avoid the spikes. [http://gdevbot.sparklinlabs.com/p/starpick/edit](http://gdevbot.sparklinlabs.com/p/starpick/edit)

<comment><USER3> Whoa. Reminds me a bit of Logo.

</comment></comment></comment></comment></comment><comment><USER4> Fantastic stuff. Can you give some more info on how it was created, what libraries it uses etc.?

<comment><AUTHOR> Sure! (I made the source code public at [https://bitbucket.org/sparklinlabs/gdevbot/src](https://bitbucket.org/sparklinlabs/gdevbot/src) btw)

So basically it's a Node.js app built in CoffeeScript. I'm using node-twitter- api to subscribe to the bot's twitter notifications ([https://bitbucket.org/sparklinlabs/gdevbot/src/tip/app.coffe...](https://bitbucket.org/sparklinlabs/gdevbot/src/tip/app.coffee?at=default#cl-276)).

Whenever a tweet arrives, I check various stuff (is it a retweet? are multiple people mentioned? more than one hashtag?) to decide whether it's a command or it should just be ignored. If all checks out, I parse the tweet's text ([https://bitbucket.org/sparklinlabs/gdevbot/src/tip/app.coffe...](https://bitbucket.org/sparklinlabs/gdevbot/src/tip/app.coffee?at=default#cl-16)) into a command and relay it to the backend for processing ([https://bitbucket.org/sparklinlabs/gdevbot/src/tip/lib/backe...](https://bitbucket.org/sparklinlabs/gdevbot/src/tip/lib/backend.coffee#cl-142)).

Images are validated & their size clamped using a node graphics-magick module. Emoji scripts are parsed using a custom parser I cobbled together ([https://bitbucket.org/sparklinlabs/gdevbot/src/tip/public/js...](https://bitbucket.org/sparklinlabs/gdevbot/src/tip/public/js/parseScript.coffee)) and JavaScript comes out on the other end.

The tiny game engine works with actors (or game objects in Unity3D parlance, it's very similar except 2D-only), they can have components (an image, one or more scripts) on them and can be parented to one another.

I've been building a cooperative game-making platform called CraftStudio ([http://craftstud.io/](http://craftstud.io/)) for the past 2-3 years and @gdevbot was just a kind of crazy "why the hell not" project inspired by all that work that I decided to build a couple weeks ago.

</comment></comment><comment><USER5> There should be a game jam with this system as the theme</comment>


5G networks could throw weather forecasting into chaos - <AUTHOR> https://grist.org/article/5g-networks-could-throw-weather-forecasting-into-chaos/ <comment><USER2> Ultra high frequencies at ultra high power closely positioned with no testing or guidelines for safety and we hear nothing of it.

We have known for quite some time that radar was going to be an issue.. why so late to the game?</comment>


Show HN: Simple shell function for querying cppreference.com from your shell - <AUTHOR> https://gitlab.com/snippets/1933703 <comment><AUTHOR> I would like to clarify to those of you who go to the comments first that I chose to do this with firefox, so the result opens a new tab in browser. However, replace firefox with w3m and it will work just fine.</comment>


The code Dennis Nedry used to shut down Jurassic Park's security system - <AUTHOR> https://www.youtube.com/watch?v=Yq2Vkgsams0 <comment><AUTHOR> Also check out his Youtube channel[1], it's filled with videos just like this. Many hackers will enjoy it!

[1] [https://www.youtube.com/channel/UCzOc0EEdwWAlnwrWV-7sDbg](https://www.youtube.com/channel/UCzOc0EEdwWAlnwrWV-7sDbg)</comment>


Some 100,000 or more WordPress sites infected by mysterious malware - <AUTHOR> http://arstechnica.com/security/2014/12/some-100000-or-more-wordpress-sites-infected-by-mysterious-malware/

<comment><USER2> Worse yet... the knowledge of this goes back many months.

[http://blog.sucuri.net/2014/09/slider-revolution-plugin- crit...](http://blog.sucuri.net/2014/09/slider-revolution-plugin-critical- vulnerability-being-exploited.html)</comment>


The Best and Worst Airlines in the World - <AUTHOR> https://www.bloomberg.com/news/articles/2017-01-09/the-best-and-worst-airlines-in-the-world?cmpid=socialflow-facebook-asia&utm_content=asia&utm_campaign=socialflow-organic&utm_source=facebook&utm_medium=social <comment><USER2> ... for on-time performance, not by any other measure.</comment>


Woman paid $1k+ to save 100 dogs from being eaten during a dog-meat festival - <AUTHOR> http://time.com/3929673/china-yulin-dog-meat-festival-rescue-cruel/

<comment><USER2> What's the difference between pigs, cows, sheep and dogs? Why is it okay to eat the former but eating the latter causes outrage?

<comment><USER3> My understanding is that the outrage is over the method in which the dogs are kept/killed. Some (many?) are burned/boiled alive to release endorphins/chemicals which is said to enhance the flavor:

[http://www.nydailynews.com/entertainment/gossip/ricky- gervai...](http://www.nydailynews.com/entertainment/gossip/ricky-gervais- leads-campaign-china-dog-meat-festival-article-1.2259866)

<comment><USER2> Holy shit, yeah, that's completely unacceptable.</comment></comment></comment>


Free screencasts about the text editor Vim - <AUTHOR> http://vimcasts.org/ <comment><USER2> These are awesome too: <http://www.derekwyatt.org/vim/vim-tutorial-videos/>

More of a zero-to-hero approach for vim newbies.

</comment><comment><USER3> Previous discussion

<http://news.ycombinator.com/item?id=1228779>

</comment><comment><USER4> Not updated since May of last year. But what's there is certainly quality.</comment>


What computer graphics were in 1984: Unboxing an Atari touch tablet - <AUTHOR> http://technologizer.com/2009/01/19/ataris-1984-touch-tablet-a-retro-unboxing/

<comment><USER2> I quite enjoyed that. It really does amaze me how far computer graphics software/hardware has come since those days. I'd love to know what the guys who worked on that bit of kit went on to do.

</comment><comment><USER3> Looked interesting - but, 14 pages - seems a bit excessive.</comment>


Look Who Uses Wordpress - <AUTHOR> https://contribute.nrcc.org/wp-login.php <comment><AUTHOR> They are running ads everywhere right now. So tempting to peek under the hood.</comment>


GameAnalytics for Developers goes free - <AUTHOR> http://www.gameanalytics.com/

<comment><USER2> This is a pretty big deal for small developers.

I decided not to use analytics in my current game (ask me why not, if you're curious), but certainly will in the next. So when it comes time to decide which service to use, GA will be really tough to beat.</comment>


Interview with Seedcamp founder Saul Klein  - <AUTHOR> http://www.e-consultancy.com/news-blog/363867/interview-with-seedcamp-founder-saul-klein.html We recently reported on the launch of Seedcamp, a VC-backed project that will provide a shot in the arm to Europe's technology startups.
<comment><USER2> Quite amusing that the interviewer mentions this article in the interview...

[http://www.e-consultancy.com/news-blog/361373/will-the- geeks...](http://www.e-consultancy.com/news-blog/361373/will-the-geeks-really- rule-the-world.html)</comment>


Magento Marketplace Breached? - <AUTHOR> https://magento.com/blog/magento-news/magento-marketplace-security-update <comment><AUTHOR> I added a question mark, because it's not clear from their statement if there is actually a breach.

But I also received this mail from Adobe / Magento :

Dear Magento Marketplace Account Holder,

We are writing to let you know about an issue that we recently identified, and quickly fixed, that impacted some of your Magento Marketplace account information. On November 21, 2019, our security team discovered a vulnerability that resulted in an _unauthorized third-party accessing account information_ related to Magento Marketplace account holders.

Upon discovery, we immediately launched an investigation, shut down the service and addressed the issue. No passwords or financial data (including payment card information) were impacted. None of the Magento core products or services were affected by this issue.

The Magento Marketplace account information accessed was the information associated with your Magento Marketplace user account, including name, email, MageID, billing and shipping address information, billing and shipping phone number, and limited commercial information (percentages for payments to developers).

We take these issues seriously and are committed to helping ensure our platforms are secure. We are reviewing our processes to help prevent these types of events from occurring in the future.

We regret that this issue occurred and apologize for any inconvenience this may have caused. As noted above, the issue has been fixed. However, as always, we recommend following security best practices. Please follow this link to the Magento Security Center for more information.

If you have any questions about this issue, please reach out through the Magento Marketplace Help Center.

Thank you, Magento Marketplace Customer Support

<comment><USER2> That email is so vague that it makes me think the situation is far worse and they're just feeding a "nothing to see here" story just before a holiday weekend in the US. A compromised marketplace would be a great means of sprinkling nefarious code into packages during deployment. I hope my suspicious are proven to not be the case, but only because of all the people locked into Magento relying on some dev shop to keep their business going.</comment></comment>


What I Learned After I Published My Twitter Password - <AUTHOR> http://blogs.wsj.com/digits/2014/07/15/commentary-what-i-learned-and-what-you-should-know-after-i-published-my-twitter-password

<comment><USER2> I think this is just illustrating precisely the _point_ of two-factor authentication, which is defense in depth. Right now, you have one factor which means that anything that compromises that factor compromises _you_ , and who knows what bizarre attacks someone can land once they've started penetrating your defenses. By publishing your password, you're going back down to a single factor (and in some ways it's worse than that, because who knows what security policies are in place for most services - having half of a two- factor pair here has clearly been interpreted as being someone "more authenticated" than having NONE of a single factor).

That said, I would love it if the default single factor authentication method were public keys rather than passwords. I get how impractical that is with people constantly trying to access things in some device-independent way, but I fantasize about a world where everyone carries around a cheap hardware authentication module that just negotiates the cryptographic part of SSL handshakes as the primary authentication factor (with passwords and biometrics as secondary and tertiary factors as desired). Sure would be nice if the only thing that could be leaked after a data breach was your public key.

<comment><USER3> "a world where everyone carries around a cheap hardware authentication module"

You mean you don't have ssh-agent and Google Authenticator on your mobile 'phone?

<comment><USER2> Well, what I mean is that we'd ideally have a situation where there are cheap dedicated hardware modules which contain your private key, so that you never have to trust your private key to a phone or a laptop. A phone can play that role and likely will at some point, but I'd still like something that is dumber than a phone, because I don't want the device itself to be able to harbor malware. Plus, the idea of such an HSM would be that you carry it around and then you can plug it in (or wirelessly connect it) to any system you're using, and all that system would be able to do is ask it to use its private key (which the system wouldn't be able to see) to calculate the response to some authentication query. If you're worried that your terminal might be compromised, you wouldn't really want to connect it to your phone.

Also, Google Authenticator is similar to a really fancy password because it's a symmetric key system. It's nice because you only have to enter in one-time passwords on untrusted devices, but the downside is that both you _and_ the service you're authenticating with has the same key, meaning that if either you _or_ the service you're authenticating with is compromised, the attacker can authenticate as you. With SSL, the service being compromised doesn't actually get the attacker anything except your public key.

<comment><USER3> I agree with your point about modern 'phones being too easy to compromise although I don't agree about the terminal being a specific vector - if I'm concerned that the terminal is compromised, I'm not going to use it.

Also a good point re GA - I'm not sure why it uses symmetric keys. When it first came out I'd have assumed it was for relative easy of data entry but now that even bash trivially displays QR codes it's due an update.

</comment></comment></comment></comment><comment><USER4> I think two factor authentification is just an excuse to confirm your real identity, as it is much harder to obtain a fake phone number compared to a fake email address. I bet internally someone using two factor authentification is seen as more valuable to advertisers, since the phone number can probably be tied to a credit card record and other information collected by banks and other large real world companies. To 95% of twitter users it would probably be completely inconsequential if their account were compromised, just create a new one an let all your friends know.

<comment><USER5> And to the last 5% that use the "Log in with Twitter" buttons in order to avoid creating another (probably weak) password, 2-factor is invaluable since it protects not just our twitter network but any accounts that it has been linked to.

<comment><USER4> Sure if you don't care that Twitter knows all the services you use, then that is fine. It does make little sense to me to use Twitter as your main identity provider.

</comment></comment></comment><comment><USER6> The article mentions using Google Authenticator but I'd recommend Duo (Duo Mobile on Android) as it lets you reorganize your accounts, assign icons to various accounts, and only shows the token you care about via expanding with a much larger font. Once I passed around 6 two-factor accounts Google Authenticator became too hard to use.

<comment><USER7> Have you tried Authy? How does Duo Mobile compare to that?

<comment><USER8> Authy is much more complicated to setup compared to Duo. In my TFA app experiments quite a few people had problems with the setup process (failing to complete it in several cases). They were pretty technical people too, which says a lot about Authy's usability...

<comment><USER9> There are also a lot of security concerns about Authy that were raised a while back. If you read the comments, it doesn't instill a lot of confidence in the team to implement a secure platform of this sort[0].

Unfortunately, security is one of the few areas in which 90% isn't "good enough" \- all you need is one point of failure for an entire system to get compromised.

[0] [https://news.ycombinator.com/item?id=4921684](https://news.ycombinator.com/item?id=4921684)

</comment></comment></comment></comment><comment><USER10> Lots of good points there, but this seemed a bit odd: "...it's worth managing your passwords, as inconvenient as that can be." Personally I find it much more convenient to use a password manager than to try to remember what username (or was it an email address?) and password I used for every obscure thing I've ever had to log into. Even if you tried to use the same password for everything, completely ignoring how bad an idea that would be, I think a good password manager would _still_ be more convenient, since there are often restrictions on usernames and passwords that prevent you from using the same thing. (For example, my bank boneheadedly requires an alphanumeric password of exactly 6 characters...)

</comment><comment><USER11> I really hate Twitter's TFA approach and have it disabled for security reasons. Primarily, if someone gets access to your cellphone network account (Sprint, ATT, etc.) they can receive texts on your behalf. So if your Twitter password happens to be the same as your ATT password, you're out of luck. I only use two factor authentication if I can add it to my Authenticator app and save the code/QR code somewhere offline. Everything else is just too complex to be secure.

<comment><USER12> > So if your Twitter password happens to be the same as your ATT password, > you're out of luck.

Why would you have both passwords be the same? That makes no sense. All passwords should be different.

> I only use two factor authentication if I can add it to my Authenticator app > and save the code/QR code somewhere offline. Everything else is just too > complex to be secure.

TOTP based two-factor auth ( _e.g. Google Authenticator_ ) is my preferred method as well though I'll still set up an alternative method if it's not available. For example Namecheap offers 2FA via SMS. While not preferred, it's better than nothing.

<comment><USER13> > Why would you have both passwords be the same? That makes no sense. All > passwords should be different.

I'd put good money on the percentage of AT&T customers who use the same password for all their web services being sizable enough to make that a valid concern.

</comment></comment></comment><comment><USER14> This may not be the ideal place to ask this but here it goes:

What about authenticating a logout? If someone is intercepting your communication, and you logout, how can you be sure that your logout has actually executed?

The "You have signed out" page could display a one-time code that should match a second set of seemingly randomly generated codes on your mobile phone.

</comment><comment><USER15> I was completely shocked when I read this yesterday morning while drinking my morning coffee. The best outcome that could arise from the author disclosing his password is him receiving hundreds of texts that day. I understand the point he is making, but still a very risky move.

<comment><USER16> As long as his Twitter account was isolated[1], the only risk was losing control of his twitter account for a few days. And given the fact that he published an article previously saying that he was going to give away his password, I don't think that he would run into much trouble even if they used his twitter account for malicious purposes.

[1]This is, the twitter account wasn't being used to log into other services.

<comment><USER10> You assume that losing control of his twitter account couldn't have unforeseen consequences. I'm sure the author didn't expect that he would end up having to change his phone number. It's not at all implausible that there could have been further repercussions.

</comment></comment></comment><comment><USER17> Good article. In both this and the previous articles, the author seemed to know what he was talking about, gave actual security advice, and ran an interesting experiment.

</comment><comment><USER18> Up until last fall, a hacker could social engineer their way into an AT&T account.

OP's Twitter account is only as secure at his cell phone service account.

</comment><comment><USER19> ISTR someone building a site out there that let you play with Google Authenticator on your own without messing with your Google account. Did I imagine that?

<comment><USER20> Like this TOTP debugger? [https://google- authenticator.googlecode.com/git/libpam/totp....](https://google- authenticator.googlecode.com/git/libpam/totp.html)

It used to generate a QR code for you to scan, but that's apparently broken.

</comment></comment><comment><USER21> How does SMS based 2FA work when you're overseas? Will you still be able to receive it and will it incur international charges?

<comment><USER22> It should work, but some networks are really bad at delivering messages, dropping them or delaying them by hours.

As for charges, that may be a problem. But I have never seen international charges of over a dollar for a simple text. But I haven't been to really exotic locations.

I still use SMS for the second factor, it's way less secure, but I have it mostly to protect against opportunistic attacks, and having the second factor bound to a device that I will lose or kill with 100% certainty isn't a great solution for me.

</comment></comment><comment><USER23> My company makes this password manager: [http://www.cloudentr.com/](http://www.cloudentr.com/) Give it a try! You can secure all your passwords using your mobile phone as second factor of authentication.

<comment><USER20> I could not find any technical details from Gemalto besides this blurb, which doesn't inspire confidence:

"We encrypt your CloudEntr password with a cryptographic hash function – and make sure you're the only one with the key. We also secure your web logins with AES-256 symmetric key encryption algorithm."

<comment><USER23> sweis,

I met with the CloudEntr team to learn more about the technical implementation. They are working on a security page which will provide more details soon. In the meantime, I can share what I learned from them.

The CloudEntr password is stored hashed and salted on our servers, it is also used to encrypt and decrypt all the application passwords and notes within our web browser plug-in.

I will post the link to the security page once it is published! Thanks for your feedback.

</comment></comment></comment><comment><USER24> OK, the key newsy takeaway:

> _But a glaring flaw in Twitter's account-security system lets anyone who > obtains your password learn whatever mobile-phone number you've associated > with your Twitter account if you turned on a simple but highly effective > security measure_

So...I don't know what the "flaw" is...but it doesn't seem to me that the OP learned the biggest lesson of all about security: that pretty much everything is a tradeoff.

Granted, I'm having a hard time thinking why Twitter would feel the need to expose the phone-number at all to a user outside of his/her own account page, so I'm guessing that is some unintended bug. However, consider the situation: The OP gives away his password...Two-factor authentication never, ever meant "hey, it's just as strong as if you give away one of the factors"...I've never designed a security system before, but I'm guessing things would become very convoluted if security designers had to treat giving away your password -- as a public announcement and media figure -- as anything _but_ an edge case. The inconvenience of 2-factor-authentication is meant to offset the problem of total compromise given the relatively frequent chance of getting phished. Twitter's flaw, as described, is likely not a main attack vector for phishers who are sending out thousands and thousands of emails and hoping to get turnkey access to someone's account...even if Twitter gives away the phone- number through some sort of exerted effort...that's unlikely to be the exerted effort used by mass phishers. It's a totally different security game when you're the target of thousands rather than one target among thousands.

(that said, Twitter should fix the flaw, unless there's some other dependency on having the phone number be accessible)

<comment><USER2> >So...I don't know what the "flaw" is...but it doesn't seem to me that the OP learned the biggest lesson of all about security: that pretty much everything is a tradeoff.

The flaw is side-channel data leakage about the authentication process and about the user data - they're revealing private information to someone who has not successfully authenticated. Just because the guy published his password doesn't mean it's not a flaw - if someone got his password from a compromised database they shouldn't be able to leverage that into finding out his phone number or _anything else about him_ , if he's already arranged with Twitter (or any other service) to a protocol which basically says, "Don't believe anyone saying they are me unless they both know my password and have my phone."

Frankly, a well-designed 2FA system shouldn't even reveal whether or not you've successfully authenticated using one of the factors. For TOTP this is possible because you can enter in the username, password and TOTP code all at the same time (though it's rare to see this implementation). Even if TOTP is not enabled for most accounts, you'd still want to show the box and say, "Leave this blank if you don't have TOTP enabled". For this SMS-based second- factor, I'm not sure how to design it so that there are _no_ side-channel attacks other than sending an SMS with an authentication token every single time, whether or not the password was entered correctly (which allows random people with your login to just randomly send you authentication spam).

<comment><USER24> OK, I see that the flaw was that the phone number was revealed to a user when, after installing the Twitter for iPhone app, wanted to specify that the code be sent via text to a phone number...And the Twitter app reminds the user -- who again, has successfully entered the password -- what number the message goes to.

So, if you're thinking, _what kind of dumbass would need to be reminded what phone the code was going to?_...well, the OP for starters. In fact, he recommends readers to get Google Voice numbers (ooh, another attack vector/dependency, but let's ignore that for now)...so, if you're such a user, who has a phone and some burner numbers, and you tell the Twitter app to send a reminder to your phone number...and nothing comes...that's going to seem like a point of failure.

And IMO, that situation is going to be much more likely than the case of a user telling the world his password and username. Also, it seems more likely than phishers doing something more damaging than getting phone numbers after _manually_ going through the phone app for each password stolen...My impression is that such phishers do not typically rely on manual methods, especially if by doing so, they don't get access to the target account...seems like a low return on investment of effort.

<comment><USER2> The threat model isn't "what if someone tells everyone their username and password", it's "What if someone gets your username and password". I think most of the time people have _one_ number they connect to, and everything else will be fringe cases. If you're worried they'll forget what phone number it's sent to, you can do the same thing you do with other verification/reset loops - "Enter your e-mail address and we'll send you an e-mail with the phone number you used". It might not always be the best authentication method, but at this point almost all authentication falls back to "I control the e-mail address that I controlled when I started the account" at this point anyway.

Plus, at the very least you could just reveal the last 2 digits of the phone number upon request. That's still side-channel data leakage, but at least it's much more contained.</comment></comment></comment></comment>


'Hamilton' Scalpers Pocket $240k Every Week - <AUTHOR> http://www.bloomberg.com/news/articles/2016-05-04/why-you-can-t-get-hamilton-tickets-for-a-reasonable-price <comment><USER2> Technical solutions are unnecessary. Just make the tickets non-transferrable, and have the ticket holder produce ID confirming the name on the ticket matches the person. Plenty of music festivals, Vegas nightclubs and other places already employ this strategy very effectively.

<comment><USER3> It's such an obvious solution that there must be a good reason they're not doing it already. I refuse to accept that they simply have not considered that.

My guess is it's something in the "that's just not the way it's done" family... Perhaps their venue controls ticket sales and doesn't care, or they have an intermediary like Ticketmaster who doesn't care. Or maybe it's more of a logistics concern, like they just think that doing such a thing would necessitate too big a change to entry procedure, likely slowing entry down too much? Or a more general logistics concern of they're not set up in person or online to do it that way, and changing now would be more trouble than it's worth?

<comment><USER4> Dave Chappelle had a 2-ticket limit, where the purchaser and a guest was allowed. The tickets were purchased via Ticketmaster, and whomever was at the door was checking the tickets against our IDs. As a matter of fact, they went through the line ahead of time to match tickets to IDs to ensure we could get in quickly. Just adding this, so as to point out that it's even possible via TM.

</comment></comment></comment><comment><USER5> So, they sell tickets below market value, then they are surprised when people re-sell them at market value and are feeling ripped off?

Why not auction all tickets, and if you want to give people the chance to see it for cheap, have lottery tickets which require ID?

<comment><USER6> They do do a lottery, but it's a day-of thing.

<comment><USER7> The Hamilton lottery is not worth your time if you're only going to try it once. 100+ people competing for 12 seats (where each lottery winner can get 2 tickets). And now there is an online component, which means you are competing against even more people.

</comment></comment></comment><comment><USER8> Interesting Planet Money episode about ticket scalping - [http://www.npr.org/sections/money/2013/06/25/195641030/episo...](http://www.npr.org/sections/money/2013/06/25/195641030/episode-468-kid- rock-vs-the-scalpers)

</comment><comment><USER9> As long as tickets are transferable, this just sounds like capitalism working.

How much money do staffing agencies, warehouses, ecommerce sites, and the entire middle man industry make each week?

I salute the ticket resellers. Thank you for creating a secondary market for tickets.

<comment><USER10> Does anyone honestly think the performances can only sell out because of scalpers willing to nobly buy large quantities for resale?

I strongly suspect they want it this way: promoters and performers like the aura of hard-to-get tickets, long lines, and sold-out shows. Plus, they can risk public derision and boycotts if they actually tried to sell at the market clearing price -- people are more tolerant of paying a big markup from some random guy for the exclusivity than buying it openly at the same huge markup from a faceless corporation.

</comment></comment><comment><USER11> Is this a surprise?

Scalping was made legal in New York a few years ago, pushed by a legislative leader just sentenced to 12 years in prison for bribery and extortion.

The old law barred resale for profit, which kept scalping underground and prices under control.

Now you have conditions where a monopolist (Ticketmaster), who also operates a scalping^H "resale" site who (shockingly!) is having trouble stopping bulk buyers. I'm sure the usurious fees they earn on ticket purchase and resale encourages them to halt the process.

<comment><USER3> I'm not sure that any anti-resale laws would have reduced the scalping or the scalped prices noticeably, considering just what a hot ticket show this is. I've been in NYC for over 10 years and I've never seen such buzz about a Broadway show as this.

<comment><USER4> I don't live in NYC anymore, but I did for a little over a decade. I recall The Book of Mormon had an enormous buzz as well. I had friends stay at my place a couple times so they could come to town to see the show.

<comment><USER3> That definitely had a lot of buzz, but still less than Hamilton.

</comment></comment></comment></comment><comment><USER12> I was informed at some point recently that a lot of the reselling is in fact done by the theatre. This allows them to make more money on crowded showtimes without looking like the bad guy.

</comment><comment><USER13> >The Broadway hit "Hamilton" is making millions. It could be making millions more if not for scalpers snapping up seats and hawking them for $2,000 a piece or more.

That makes absolutely no sense.

<comment><USER14> The extra profit is going to the scalpers, not the show's producers who could presumably sell them at higher prices given the demand.

<comment><USER15> bingo: I'd feel much better about paying $1000 for a ticket if I knew it was going straight to LMM and the rest of the show's cast/creative, instead of some random dude on StubHub.

</comment></comment></comment><comment><USER16> What are effective methods for stopping ticket scalpers? Heavily penalizing resale is kind of a crappy route but for a show like Hamilton I wonder what the legitimate person resale case is. Has any artist fended off the scalpers successfully?

<comment><USER17> Raise the price. Scalpers are taking advantage of a market where price is not equal to what people are willing to pay. Be more dynamic with ticket prices, and scalpers have no margin to keep.

<comment><USER16> I disagree with that. There are many reasons artists want to keep prices low. In this case maybe you don't want to reserve your ticket a full year in advance. An artist might also want their work to be accessible to more people than those that can afford a $1000 ticket. Raising the price is too simplistic an option.

<comment><USER18> The problem is that they _aren 't_ keeping prices low. They are setting an artificially low face value, and then letting scalpers capture all the excess value. The real cost to see Hamilton right now is $1000+, not whatever (lower) number is on the ticket.

By not allowing incredibly devoted fans to participate in an auction for tickets, they are actually making shows _less_ accessible for the people who want it most. It's unfair that you can get to see a performance for $50 because you happened to get a ticket, but I am unable to even if I'm willing to pay $500.

<comment><USER19> > It's unfair that you can get to see a performance for $50 because you > happened to get a ticket, but I am unable to even if I'm willing to pay > $500.

The person who can only afford to pay $50 might consider it unfair that they can't get to see it just because you can afford to pay $500.

</comment></comment></comment></comment></comment><comment><USER15> _" Tickets are now sold out through January 2017, according to Ticketmaster's website."_

and THIS is why ticket scalpers suck. Literally the only options to see Hamilton any time this year are to pay ridiculous rates ($1000-2000 each for good seats) to a scalper, or enter the same-day lottery and pray.

I predict it's only going to get worse now that Hamilton has grabbed 16 Tony Award nominations (and is likely to win a truckload of them).

<comment><USER20> That's not really the ticket scalper's fault, is it? If the tickets were only sold at the low face-value price, they would still be sold out, and your only option would still be the same-day lottery. This way, people who really want to see the show at least have an option to pay extra to see it.

<comment><USER15> It depends on what percentage of tickets the scalpers are buying for each show vs. how many are available to actual fans. The article says in one case, a ticket broker managed to buy 20,000 tickets.</comment></comment></comment>


Microsoft committed to invest $100 million in SUSE Linux - <AUTHOR> http://www.microsoft.com/Presspass/press/2011/jul11/07-25MSSUSEExtensionPR.mspx

<comment><USER2> So that Microsoft can collect tax on Linux and that SUSE Linux will be the safe choice for people that dont want to be sued by Microsoft ? I dont trust it</comment>


The Curse of Development - <AUTHOR> https://www.ribbonfarm.com/2010/04/14/the-gervais-principle-iii-the-curse-of-development/ <comment><USER2> This is how nonsense is written by smart people to bamboozle the rest.

This is some truths, mixed with half truths, mixed with made up pop psychology, wrapped in a rug of made up bullshit, served on a platter of popular culture references for consumption by people that are starving for structure.

<comment><USER3> "to bamboozle the rest." What do you mean by this? Do you suggest the author is trying to confuse/deceive people, because he clearly puts LOTS of work into his blog and I don't imagine he directly gets profit from it [so I have no idea what his motivation would be].

That's a very poetic criticism and all, but I guess it doesn't really mean anything.

The situation is this: Many professionals (such as myself) find the world of business entirely irrational and unpredictable. Those like me are trying to make heads or tails of it and often just resort to humor (Dilbert, the Office, Silicon Valley) which gives us the simplistic narrative -> other people are crazy.

But some of us know there's more to it than that, and are actually trying to wrap our heads around it. It's not clear if you don't think understanding work matters or if you think there's a better source of truth for explaining the massive irrationalities of work.

Either way, poetry doesn't really establish or disprove anything.

\---

Edit: For those like me who are searching for patterns among the chaos of human group behavior, I suggest the books "Moral Mazes" and "Games People Play"

<comment><USER4> He puts a lot of work trying to weasel out a theory based on a caricuturized comedy.

It reminded me of some ideas from socionics though, mainly how strengths and weaknesses create relationship types

[http://www.socionics.com/rel/rel.htm](http://www.socionics.com/rel/rel.htm)

<comment><USER5> That wasn't how I understood it. Rather, my impression is that the theory is not _based on_ the comedy, but is rather explained using the language and situations of the comedy.

</comment></comment></comment></comment><comment><USER6> When I chanced upon Ribbonfarm a few years back, I was super impressed and in fact, invested many hours of my life to watch 'The Office'.

In hindsight, I was bit of an idiot. I fell for spruced-up language that was clearly trying to mask the absence of serious content or thought. A few good ideas, sure, but they're mostly common-sensical and could've been delivered in an easier manner.

<comment><USER7> Many important concepts start as unknown, and then once explained in great detail, seem plainly obvious. It took a lot of reasoning to convince people that in fact zero is a number (but zero doesn't exist!) and now it's taken for granted.

<comment><USER6> Sure but I don't even think that the ideas on Ribbonfarm are extremely radical (definitely not the same as 'zero is a number')

</comment></comment></comment><comment><USER8> The main problem about this is that the author is basing his arguments on a show. A show written by writers who might even read the same pop-psych. Then he goes to reason from this show, into real-life. It's arguing from fictional evidence. If some of the actors behaves in a completely different way one week because there's a writer's strike or something, does it invalidate his theories?

IRL nobody behaves like people from The Show so any theory with this as the only basis is worthless.

</comment><comment><USER9> I feel that most of this article is not understandable without having watched the office. There were a few nuggets of insight though, but the rest is lost in references to a show i've never seen.

</comment><comment><USER10> > If you've ever poked fun at a French-quoting pedant..

Is the implication that someone who speaks French is "more developed"? It doesn't seem to me that speaking French represents a more sophisticated argument - it's just another, different language.

<comment><USER11> your comment on the surface seems right but let's be real, languages are created (or evolved in the case of natural languages) to suit a purpose. The Eskimos have 50 different words for snow, so when conversing about snow I'd say using the Eskimo language makes you much more intelligent or at least more articulate... now I'd also image that the amount of content that went into evolving a language differs from language to language and given this obvious fact some are more "smart" than others ... now I am not on the side of any one language, just making an observation.

<comment><USER10> The basis of your observation isn't True:

[https://www.buzzfeed.com/tomchivers/no-the-inuit-dont- have-1...](https://www.buzzfeed.com/tomchivers/no-the-inuit-dont- have-100-words-for-snow)

However, even if there were a language that specialised in snow, that's an entirely different thing to one language being 'smarter' than another. In this case, why would French be any more evolved in general than English?

<comment><USER11> One good link deserves another. [https://www.washingtonpost.com/national/health- science/there...](https://www.washingtonpost.com/national/health- science/there-really-are-50-eskimo-words-for- snow/2013/01/14/e0e3f4e0-59a0-11e2-beee-6e38f5215402_story.html?utm_term=.0ff0107504ae) The point I was trying to make is the same. Some languages are more descriptive about a given domain in a shorter space and thus can convey an idea in vastly less time than another language. Now you could do some hand waiving and say we use prefixes and suffixes all the time and you could make up words till the end of time but the important fact here is that people speaking a given language actually USE those words, because of their need to be descriptive within a given domain, and WITHIN that domain I'd say they are smarter by my definition of smart. More articulate, more succinct, more versed (within a given domain), and more experienced. Every profession has it's own language, and rightly so, because time is precious and we need to convey meaning quickly. Words created and collected for a given purpose are still words, just look at a medical dictionary.

</comment></comment></comment></comment><comment><USER12> Are these the words from the robot voice in "portal"? The cake is a lie.

</comment><comment><USER13> Y A W N

</comment><comment><USER14> This starts with:

        [..] the archetypes that inhabit
        organizations (Sociopaths, Losers, Clueless)

...which is quite clueless itself, and mean-spirited to boot. I guess it plays well with the libertarian every-man-for-himself fantasy.

<comment><USER15> Isn't the whole thing an over extended joke based on The Office?

<comment><USER16> That was my interpretation of the whole series. The author however, seems to be dead serious about it, like he discovered true meaning of life.

<comment><USER17> He maintains that attitude deliberately (it's part of the joke).</comment></comment></comment></comment>


Show HN: Image to Text OCR menu bar app for macOS – simple drag image to get txt - <AUTHOR> https://apps.apple.com/us/app/image-text-ocr-scanner/id1495787023?ls=1&mt=12 <comment><AUTHOR> OP Developer here! I have made this app free till Jan 31st so HN crowd can try it out.

This is my first macOS app (I have past iOS and Android experience). I often needed to get tons of text from images and memes and the current offerings were too complex for such a simple task. A lot of the offerings also needed the image to be sent to third party servers.

My app is very simple and 100% private - all processing is done using built in macOS libraries and no data is ever sent to any server for processing. Everything happens on device.

Simply drag any image into the menu bar icon and it will open the text in a text editor. It can also show the EXIF data of the image. There is a setting to enable "fast" mode which is useful if your image isn't using fancy fonts and has good lighting.

Please feel free to ask me any questions & provide feedback if you have!

<comment><USER2> Hi, I normally use Google Keep for this. Is the latest macOS really required for your app?

<comment><AUTHOR> Yes, the vision library which does the OCR work only comes with the latest MacOS unfortunately.</comment></comment></comment>


A Bitcoin Credit Card Treated Like Visa By Merchants - <AUTHOR> http://TokenCreditCard.myinstapage.com

<comment><USER2> Sorry, this seems really suspicious (myinstapage?) and un-professional (stock images galore). A lot of people (read: majority) have trust issues in the Bitcoin world.</comment>


Millions of Bank Confidential files on Google due to 13 Root servers breach - <AUTHOR> https://medium.com/@cloudstories2017/millions-of-banking-confidential-files-exposed-all-over-google-due-to-13-root-server-dns-databreach-531d85ef42d3 <comment><USER2> Wow all the banks data will be available in the Darkweb ......</comment>


Swift 5: start your engines - <AUTHOR> https://lists.swift.org/pipermail/swift-evolution/Week-of-Mon-20170807/038645.html <comment><USER2> One of the problems I find with Swift is that Apple doesn't go back and properly update their sample code at developer.apple.com. They have examples that will not build. If you search you can find folks that have patch sets, but they really need to fix the examples.

<comment><USER3> I don't think that matters. The iOS Swift community is large enough that there's lots of example code. I've got almost 7000 urls in my database of Swift blogs:

[http://www.h4labs.com/dev/ios/swift.html?age=90](http://www.h4labs.com/dev/ios/swift.html?age=90) \- Last 90 days

Take a look at a weekly view: [http://www.h4labs.com/dev/ios/swift.html?week=0](http://www.h4labs.com/dev/ios/swift.html?week=0)

Most topics get sufficient coverage. If you don't mind paying a small monthly fee, Ray Wenderlich's site has lots of tutorials that are well maintained. Plenty of free examples too:

[https://www.raywenderlich.com](https://www.raywenderlich.com)

Another pay site that is be useful if you want to come up to speed quickly is [http://nsscreencast.com](http://nsscreencast.com)

<comment><USER4> Great URL's, also a number free iOS app examples and resources on this youtube channel (Lets Build That App) as well [https://www.youtube.com/channel/UCuP2vJ6kRutQBfRmdcI92mA](https://www.youtube.com/channel/UCuP2vJ6kRutQBfRmdcI92mA)

<comment><USER5> Seconded on Lets Build That App. Found about it last week, and bought the subscription asap - was impressed with the quality.

However, I was an iOS dev 3-4 years ago and wanted to learn swift - so, it was a pretty smooth upgrade for me. I think whoever wants to learn iOS dev might be better off learn the basics more thoroughly and then come back to this course.

</comment></comment></comment></comment><comment><USER6> And just today I was contemplating writing my first native iOS and macOS app... I was looking at the options and decided to go native with Swift. I have never written Objective-C app and never used x-code for dev. But I have ~10 years of dev experience, mostly Java and Python on the backend and front end dev exp mostly with Angular. Some Android, and a little from <input_random_tech_here> because I like to experiment.

So, my question is. How hard and enjoyable is for someone like me to write not very complex native iOS/macOS app in Swift starting from scratch? Best resource to start with?

<comment><USER7> Hardest part isn't the language. Swift is among the best languages you can get today. IOS sdk, on the other hand, has become a bit of a mess, due largely to the pace at which the field is moving ( although not as bad as android).

Stanford courses are the best you can find online for free. [https://youtu.be/HitSIzPM_6E](https://youtu.be/HitSIzPM_6E)

<comment><USER8> I concur. The Android SDK seems to violate SOLID principles and fails to capitalize on OOP at all.

<comment> trevor-e The Android framework is honestly a huge pain to develop with. I switched over to iOS development a year ago and am much happier. It feels almost impossible to get Activity/Fragment life cycles correct for simple things. And anything View related has to pass around a God Context object.

</comment></comment></comment></comment><comment> ainar-g Maybe someone will explain this to me. Does Swift use this confusing "rapid release" versioning? Does Swift 4 break backwards compatibility with Swift 3?

In my company people are looking for a language to rewrite some legacy Objective-C to. Swift is often discarded as "unstable" because of these major version bumps. Compare this to Go, which, seven or so years after the initial release is still 1.x and still doesn't break code.

I just don't get breaking the language so often. Do people enjoy rewriting code?

<comment><USER9> Swift 3 was a major backwards-incompatible change. It came with an automatic migration tool, but the tool only kind of worked.

Swift 4 is a much smaller change. There are backwards-incompatible standard library changes, but not on the scope of Swift 3. Again, it comes with an automatic migration tool. I haven't tried it myself, but I'm optimistic that it will work much better, both because they've had a year to fix what went wrong the first time, and because the changes are much much smaller.

But Xcode 9 also supports Swift 3.2, which is the same language as Swift 3.1 with some miscellaneous bugs fixed and with the iOS 11 / macOS High Sierra SDKs. Your Swift 3.1 code will likely run under Swift 3.2 with no changes, and any changes that are necessary are going to be strictly due to SDK changes rather than language changes.

Xcode 9 also supports mixing Swift 3.2 and Swift 4 modules. You can have your application written in Swift 3.2 and use a library written in Swift 4, or vice versa. This means you have a full year to migrate to Swift 4 (since I assume Xcode 10 will drop Swift 3.2 support, though this is pure speculation).

<comment><USER10> My biggest issue would be compiled libaries. I come from c++ so updating and recompiling all the libs would be a huge pain. How is it in Swift?

<comment><USER9> The major goal of Swift 5 is ABI stability. Until then, libraries written in Swift do have to be recompiled with each new version of the compiler.

</comment></comment></comment></comment><comment><USER11> I wish more effort were being made to make it a first class citizen on non- Apple platforms. With the popularity it has enjoyed, it could easily challenge the likes of Go, Python or even Java for server side programming.

<comment><USER12> [https://github.com/vapor/vapor](https://github.com/vapor/vapor)

<comment><USER13> With a name like 'vapor', I thought this was some sort of joke. But this looks like fun! [https://vapor.codes](https://vapor.codes). An example from that page:

      import Vapor

      let drop = try Droplet()

      drop.get("hello") { req in
          return "Hello, world."
      }

      try drop.run()

<comment><USER14> Hey, I'm using Vapor (in production). It's really great to work with and moving fast - feels like the early days of rails. There's a real technical advantage to having the brevity of swift (like ruby) but with the type checking of the compiler. I actually migrated this app from Node.js and it's faster and easier in almost every way (notably lack of 3rd party libraries).

</comment></comment></comment></comment><comment><USER15> Can someone with Swift experience comment on the status of Swift on non-Apple platforms? Is it being used outside of the Apple ecosystem? How is the tooling, deployment, availability/support, etc.

<comment><USER16> Victim of trying it the first week it came out, having to call down into C for anything POSIX, and giving up. If you don't have POSIX bindings, don't call yourself v 1.0.

<comment><USER17> What exactly do you mean "call down into C"? You should be able to call C functions directly from Swift, albeit with UnsafePointer and the like.

<comment> ainar-g I assume, they mean that you don't need to have C at all. See how Go for example doesn't require C on most platforms to make syscalls (IIRC, the exceptions are Windows and Solaris).

<comment><USER17> So, based on this[1] they've just wrapped the calls with their own…not sure if there are any real benefits here.

[1]: [https://golang.org/src/syscall/syscall_linux.go](https://golang.org/src/syscall/syscall_linux.go)

</comment></comment></comment></comment></comment><comment><USER18> Since things at Tesla haven't worked out, I hope Lattner eventually returns to Apple.

Not that the Swift team is in a bad shape without him, it's just that it's nice to have an amazingly smart guy behind an open source language that many of us use (and that number that will probably only grow).

<comment><USER19> There are tons of amazingly-smart people working on Swift at Apple right now

</comment></comment><comment><USER20> Swift developers, how is the evolution of the programming language now? does it still have backwards compatibility issues or things are more stable now (and will be with this new proposals)?

<comment><USER17> The Swift 3->4 migration was not bad, actually–just a couple of small changes to source here and there. With ABI stability I think we'll see the adoption of Swift for libraries and frameworks increase significantly.

</comment></comment><comment><USER7> About concurrency : does anyone know of a language that would let you tag portions of a codebase in some way, and declare something like "all those methods should execute in the same thread". Those declarations would then be checked by the compiler.

That would be a first step toward agent like concurrency, but it would be general enough to apply to other types of concurrency models.

<comment><USER21> Ugh, makes me think of COM

[https://msdn.microsoft.com/en- us/library/windows/desktop/ms6...](https://msdn.microsoft.com/en- us/library/windows/desktop/ms680112\(v=vs.85\).aspx)

<comment><USER22> This is different. COM apartments were a _runtime_ mechanism to magically _make_ the code to run on a single thread (or on multiple but specific threads for MTA), by introducing object proxies that "transparently" marshaled calls.

</comment></comment></comment><comment><USER23> Concurrency finally, it has taken forever. Is there any built-in support now? Server side Swift is lacking this big time.

<comment><USER24> It doesn't cover everything, but libdispatch is available on both Darwin and Linux, with a "Swift-ified" API.

<comment><USER23> I am not a Swift expert, can you explain your point. How would that situation compare to say programming in Go where there is built-in support for channels, and concurrency?

</comment></comment></comment><comment> real-hacker The only complaint about swift programming is: they keep changing the programming interfaces, so if I import a third-party code file written with earlier versions of Swift, I have to go through the errors of 'obsolete APIs', updating the function signatures. The changes are automated by Xcode, but it is still a hassle.

I am totally OK with introducing new features of Swift language. But changing the API function signatures (even multiple times) seems totally unnecessary, and reflects the API designers' obsession of naming conventions.

</comment><comment><USER25> Tangential question- I'm in the UK and I am keen to become a iOS developer (I'm currently a senior .NET developer in a large firm). Are there enough opportunities remaining in iOS development as a contractor / creator of ('enterprise') apps to make a living? I would be very grateful if anyone could share any advice / personal experience.

</comment><comment><USER26> > the Core Team felt that we could strike a balance with not diluting > attention from ABI stability while still enabling a broader range of > proposals compared to Swift 4 by __requiring that all proposals have an > implementation __before they are officially reviewed by the Core Team.

Good. They are effectively saying 'Talk is cheap, show me the code'

</comment><comment><USER27> Great to see chris still contributing - [https://lists.swift.org/pipermail/swift-evolution/Week-of- Mo...](https://lists.swift.org/pipermail/swift-evolution/Week-of- Mon-20170807/038662.html)

</comment><comment><USER28> Anyone else doing what swift will do: Inlines the standard library, but distributes it separately. Does not makes sense to me at all.

</comment><comment><USER29> I'm sticking with Objective-C. A much better language than Swift, even at version 5.

</comment><comment><USER30> Fixing the ABI might be interesting for interoperation with other programming languages

</comment><comment><USER31> I'd rather build hybrid apps. Fix your IDE.</comment>


Is Nefertiti in Tut's Tomb? - <AUTHOR> http://www.newyorker.com/news/amy-davidson/is-nefertiti-in-tuts-tomb?intcid=mod-latest

<comment><USER2> I don't know if there are any egyptologists on HN, but I'm curious to hear what the state of egyptian archaeology is following the revolution and change of cabinet. In particular, the removal of Zahi Hawass and the issue of safety.

<comment><USER3> Not an egyptologist, but I did just get back from Egypt recently, so here's some anecdotal evidence. Even during the hottest summer months, there was still activity happening at dig sites. This is usually when all the digs shut down, so I would assume that there would be even more activity during the winter months. There were still occasional restoration projects (even got to spend a few minutes helping one), but they were few and far between. Many had completely halted, probably as a result of Zahi Hawass's ousting and the evaporation of tourist funds. On the other hand, a lot of the expeditions are funded by outside universities, and they bring several jobs to local Egyptians. Because of the perceived security issues, many tourists are staying away from Egypt, which is crippling many people's ability to make a living, and the government's ability to focus on cultural work. Several people I spoke with were once making a good living in the tourism industry, but have since turned to trying to find work with expeditions when they can. Unfortunately, there are a lot more people out of work than there are jobs.

The security situation is interesting. My wife and I were alone for two weeks, and felt perfectly safe. The government knows that tourism and archeology/egyptology bring jobs and dollars, so they focus their police presence on protecting those areas. Sure enough, there are police and military everywhere. However, if you watch them closely, you will see that they are not operating in top condition. I'm not sure if fatigue or inexperience contributes to this, but you can see it. Guards waving people through checkpoints without searching them at all, weapons being left far out of reach, soldiers sleeping on guard, etc. There was one attack on a checkpoint near us while we were there, resulting in the death of two police officers. That didn't seem to have an affect on the rest of the security force. A few days after we left, there was an attack in Luxor directed at tourists. I'm not sure, but my guess is this was a wakeup call for them. Thankfully the attack largely failed, but I'm sure it's caused massive harm to an already hurting economy.

</comment></comment><comment><USER4> Link to the highres images: [http://www.highres.factum- arte.org/Tutankhamun/](http://www.highres.factum-arte.org/Tutankhamun/)

Click on the up arrow at the bottom edge to choose which wall to view.

<comment><USER5> Sorry, but I do not see the door outlines. Not even in the black/white images.

</comment></comment><comment><USER6> Why can't they just use ground penetrating radar to determine the existence of other chambers?

<comment><USER7> That's a good question. I was wondering the same thing myself. Best guess based on preliminary googling is "The principal disadvantage of GPR is that it is severely limited by less-than-ideal environmental conditions. Fine-grained sediments (clays and silts) are often problematic because their high electrical conductivity causes loss of signal strength; rocky or heterogeneous sediments scatter the GPR signal, weakening the useful signal while increasing extraneous noise."

<comment><USER8> Also, as I understand it, it's not particularly easy to interpret the results beyond "there is something there."

</comment></comment></comment><comment><USER9> Dig from the other that wont destroy the artifacts?

<comment><USER10> That will most likely destroy the paintings is the new room (if it exists). Digging in from below might work, you want to finance it?

</comment></comment><comment><USER11> "Ancient astronaut theorists say yes"

Sometime in season 1 or 6 I think. The one where Akhenaten is an alien. But not the one where the pyramids are microwave lasers.

<comment><USER12> Pyramids never were microwave lasers. They're landing sites for Ha'taks, alien starships, coincidentally also pyramid-shaped. Learn your history!

<comment><USER13> I believe the landers were _Cheops_ -class warships, not the Ha'taks?

<comment><USER12> Checked the sources[0] and you seem to be right. I guess I was mislead by Teal'c.

[0] - [http://stargate.wikia.com/wiki/Cheops_class_warship#Notes](http://stargate.wikia.com/wiki/Cheops_class_warship#Notes)

</comment></comment></comment></comment><comment><USER14> Americans have long had an interest / obsession with King Tut. Here's a silly little thing Steve Martin did about him circa 1979: [https://www.youtube.com/watch?v=P1Hr9VPnMNc](https://www.youtube.com/watch?v=P1Hr9VPnMNc)

<comment><USER15> And, for good measure, Philip Glass's "Akhnaten" (1983)

[https://www.youtube.com/watch?v=XENvMGyy4J8](https://www.youtube.com/watch?v=XENvMGyy4J8)</comment></comment>


Introducing Backup and Sync for Google Photos and Google Drive - <AUTHOR> https://www.blog.google/products/photos/introducing-backup-and-sync-google-photos-and-google-drive/ <comment><USER2> What surprises me most is the fact that there seems to be very little interest in meta syncing. I have far more files to store than there is capacity on my SSD, and yet, most of the cloud storage providers seem to offer only full or selective sync capabilities.

What I would _like_ to have is the ability to browse my _entire_ file repository and "pin" certain files to make sure I can have the most critical stuff offline, while other files would be streamed when I need them.

I kind of hoped that SpaceMonkey (now Vivint Smart Drive) would be the answer for me and have one sitting right here. It's a a pretty cool device in theory, but in practice, it is extremely slow, backed by a company that could not care less about the product it has acquired.

Then there is Dropbox Smart Sync. This seems promising, but only is available for business users. I don't have any experiences with it.

Still looking for one single product to this right. Am I the only one frustrated with this?

<comment><USER3> I think Microsoft rolled this out as standard for OneDrive in a version of Windows (8? 8.1?), only to revert the change due to customer confusion.

<comment><USER4> It's supposed to come back (improved) with the Fall Creators Update though. I can see how many users would get confused by it but hopefully this time it'll be more intuitive.

</comment></comment></comment><comment><USER5> This is confusing in so many ways

1\. They give no mention of how this handles existing installs of Google Drive or Google Photos Backup.

2\. The application has the exact same name for Google Photos and Google Drive. Do I need to download and install both? I tried that, but couldn't move the second to my applications directory without overwriting the first. Looking at the downloads they're the same size, so I'm guessing they're the same, but that begs the question, why the two download links in the blog?

3\. Where will photos be saved? I save mine in Google Drive, and choose the option to sync to Google Photos. Will they be stored directly on Google Photos? Because I'd rather keep them on Drive.

I'm still a huge fan of both products, and hope that this cleans up a number of integration issues between both services, but this announcement feels like it wasn't thought through at all.

<comment><USER6> 1\. If you have Google Drive for PC/Mac installed, it will update it to Backup and Sync.

2\. The difference in the two endpoints are the defaults selected during the setup wizard (which you can change from either). The Photos versions is geared more towards Photos users and the Drive users more towards Drive.

3\. They are saved in Drive, and are synced to Photos. However if you delete in either Drive or Photos cloud, it will affect the other. Whether it is deleted from your hard drive depends on what you have selected in the deletion settings portion.

<comment><USER7> How does that work given that a google Photos has different pricing for compressed photos?

<comment><USER8> It utilizes similar pricing for photos and videos.

You can elect to upload Photos/Videos in High Quality (which does not consume quota).

</comment></comment></comment></comment><comment><USER9> This is so confusing. What's that? A replacement, an addition? Will this clutter up my photos? It's like an invitation to: Try it out to find out what it really does and if it clutters up your photo stream... deal with it.

Update: oh the blog actually writes it is an replacement. Great... now I don't know if this works in any way with Insync in parallel :(

<comment><USER10> That happened to me the first time I checked the option to sync my Drive photos to Google Photos a couple of years ago. I had random work and school related graphics and photos jammed into my Photos library for a looooong time (and there was no "undo").

</comment></comment><comment><USER11> If only Google Drive's app actually worked reliably (see the discussion from the day before yesterday: [https://news.ycombinator.com/item?id=14732023](https://news.ycombinator.com/item?id=14732023) \-- "It's been 191 days since Google Drive worked for me") this might be worth trying out.

Since they can't even reliably sync the Drive folders they _claim_ they can, who would trust their "backup" of the _rest_ of the system?

<comment><USER12> Just like the discussion in that post, that user is such a far out edge case that it's just flat out disingenuous to say that the Google Drive app doesn't work reliably. It's not perfect, but it works for 99.9% of the people using it. 700,000 files at more than 2TB is not the typical use case for Google Drive.

<comment><USER11> The backup case is of the same scale as the original poster's situation.

My team found it unreliable for much smaller directories as well. 6 people, 6 independently unhappy with it. It was only on a conference call when we realized we were looking at different copies of files that we all complained of the same symptoms. Anecdote rather than data, I admit, but it's disturbing that each of us silently assumed we were the only ones having trouble.

(FWIW we stuck to google for realtime shared docs, but moved to DB for general file storage, including spreadsheets and presentations)

</comment></comment></comment><comment><USER13> I really hope this update will sort out the lack of meta data regarding which photos the Photo app compressed during upload. Even with the "Original" option set, the Android app would silently(!) switch to the compressed form, then happily tell you to delete the originals to save space(!!). I now have a random mix of photos both on Drive, Photos and copied over USB to my HDD but haven't found the time to unpick this schmozzle. I'm a paying customer.

</comment><comment><USER14> <sarcasm>Maybe one day soon we'll see an official Linux client.</sarcasm>

<comment><USER15> Ok but which Linux? Ubuntu? Fedora? Mint? etc... Which desktop should they integrate with? Gnome? KDE?

I suppose they could go the Steam route and only support Ubuntu, but then that would be Ubuntu support, not really Linux support. It would be nice to have at least some support on Linux for sure, but unfortunately deciding to support Linux isn't an answer to a question, it's opening a whole extra big bag full of knotty questions.

Until that issue gets sorted out in Linux land, providing first class Linux support in any professional, commercial grade application or service is going to be problematic.

<comment><USER16> Insync is a Google Drive client that has been "providing first class Linux support in any professional, commercial grade application" for years. Also, what do desktop environments have to do with Google Drive clients?

</comment></comment></comment><comment><USER17> I've already been doing this by pointing "My Documents" to ~/Google Drive/Documents, so I guess this just simplifies the process for everyone else.

(I mean, Drive already has versioning, so this adds... an explicit form of versioning?)

Oh, and where's our Linux client?! Gnome's Drive support is _awful_. It just locks up Nautilus half the time.

</comment><comment><USER18> Still, no linux client.

<comment><USER19> I am mystified as to why Google keeps ignoring Linux especially for Drive. Don't a non-trivial number of Google employees run Linux? It also rules out Drive for company wide deployment if any of the people are using Linux, since they will be excluded.

That is one thing Dropbox at least gets right.

<comment><USER20> Linux marketshare is around 1.5%, and I'd speculate those choosing Linux tend to be less willing to trust google/the cloud with their data than average.

It's just not worth it when the best-case outcome is indistinguishable from a rounding error,

<comment><USER19> You are talking about individual deployments where plain market share is reasonable. I'm talking about group deployments where multiple people need to work together. In that case the solution has to work for everyone.

</comment></comment></comment></comment><comment><USER21> Can someone explain what this adds over Google Drive? More importantly, is it taking anything away? The blog post sure didn't provide that necessary info.

<comment><USER22> If it's backup, it should _not_ work the same way: deletions should not be synced for example.

<comment><USER8> You can elect not to sync deletions in the new application.

</comment></comment></comment><comment><USER23> Because Google Photos does not have an Android TV app, I periodically do a full Google Takeout to pull all my images so that I may rsync newer ones over to my NAS so that they appear in Plex and my wife can then view them on the Google TV.

Can you stop reinventing things that already exist, and perhaps fix things that are real customer pain points.

Like not being able to view Photos on an Android TV, like not being able to use Google Drive or even this new Backup and Sync on Linux... or the big one, the fact that GSuite accounts are crippled and the majority of new products cannot be used by those with GSuite accounts or can only be used in a severely crippled way.

<comment><USER24> It's not going to be easy to just put Google Photos on Android TV. Android TV has no concept of accounts or privacy so the only way it could really work right now is to either open up the entire user's photos to anyone currently using the TV or invent some sort of hard to use scheme such as only displaying photos "tagged" a certain way as public/tv which most people probably won't do. Or they could ask for a PIN each time which is annoying.

Solving that issue is going to take a re-work of the Android TV user experience. A lot of apps have this problem such as Drive, Dropbox, Docs, etc. There's no current way to have an app with personal data be usable on a public device like a TV.

>or the big one, the fact that GSuite accounts are crippled and the majority of new products cannot be used by those with GSuite accounts or can only be used in a severely crippled way.

You have to remember that GSuite, as an app for businesses and education, has a lot more restraints and big hairy legal and ethical issues for every single feature than the consumer versions of the apps. Each thing Google makes needs to be looked at from a very different angle and lots of decisions have to be made for it to be made available for business use. The use cases are very different. Money is handled differently. Lots of access controls need to be created for admins in each app available in GSuite. It's not a trivial amount of work.

<comment><USER25> Can you cast photos from the Photos app in your phone?

<comment><USER24> Yes. Which makes sense because you are actively sharing them and can end the display whenever you want. No privacy issues.

<comment><USER25> Sounds like the appropriate solution for OP's use case of the wife looking at them on the TV.

</comment></comment></comment></comment></comment><comment><USER26> My current workflow for backing up photos on Linux is:

1\. Copy photos from memory card to a NAS. 2\. Upload the photos to Google drive using skicka.

I've got a script to simplify this, so in reality the workflow just consists of inserting the memory card and running the script. The photos then appear in Google Photos fairly quickly afterwards. I use this for both jpg and nef. I've been pretty impressed with how good Photos is at handling nef files.

Skicka: [https://github.com/google/skicka](https://github.com/google/skicka)

</comment><comment><USER27> I bought some extra space from Google for photos (which I have backed up in many places), my credit card didn't work for some reason, and they immediately downgraded my account to the free tier, with no warning.

It might have been because there were actually no files taking up the extra space, but losing all my pictures because my CC didn't work and they don't have their $1.99 or being paranoid that that might happen is not worth it.

<comment><USER28> The behavior in this case is that new uploads are blocked but your existing files remain.

[https://support.google.com/drive/answer/2736362?hl=en](https://support.google.com/drive/answer/2736362?hl=en) "If you cancel your storage plan or when your storage plan expires, your storage limits will reset to the free levels for each product at the end of your billing cycle. Everything in Google Drive, Google Photos, and Gmail will still be accessible, but you won't be able to create or add anything new over the free storage limit. If you reach or exceed the free storage limit"

<comment><USER27> Ah, that would make me a lot more confident.

Don't a lot of people archive terabytes of stuff and just leave after 1 month, though?

<comment><USER29> Gmail would refuse to recieve mail until you either free up space or upgrade. They share the same storage space.

</comment></comment></comment></comment><comment><USER30> >You probably keep your most important files and photos in different places—your computer, your phone, various SD cards, and that digital camera you use from time to time. It can be a challenge to keep all these things safe, backed up, and organized, so today we're introducing Backup and Sync. It's a simpler, speedier and more reliable way to protect the files and photos that mean the most to you. This new tool replaces the existing Google Photos desktop uploader and Drive for Mac/PC.

This actually describe the problem a lot of people have without providing a solution. Uploading, Syncing doesn't fix this. How are we going to sort and manage all these files that are scattered in difference medium in the first place? Do we Copy all of them to our PC / Mac? And then Manually sort through all these files, before uploading to Google Cloud?

What if my 256/ 512 GB SSD couldn't fit all these files I have laying around? How am i support to sort through all these files over the last decade if i dont have them stored in the first place?

</comment><comment><USER31> My biggest problem with Google Drive is its pricing. Why is your 1TB $100/year, when pretty much every major competitor charges $60?

$100/yr would buy me 5TB with Microsoft OneDrive.

Even Apple, which usually has crazy margins on everything, gives you 2TB for $10/month.

<comment><USER32> If that extra $40 a year causes them to not shut it down so fast, I'm all for it :)

</comment></comment><comment><USER33> For anyone running the macOS high Sierra beta, don't install this yet. I installed it, but it refuses to sync anything on (1) an APFS drive or (2) a network share. The error dialog says it requires HFS+.

</comment><comment><USER34> Why is Photos still not a public API?

I'm happy to pay for the storage but I need a Linux client. I'd write one myself with a song in my heart, but Google keeps obfuscating this stuff for no good reason.

</comment><comment><USER27> I wonder, how reliable is mounting a regular server via a sshfs connection? I sometime do it to edit static websites and it works.

</comment><comment><USER35> Does it still not count photos above a certain megapixel count towards the free space?

</comment><comment><USER36> Let's not kid ourselves. This is Google trying to fill up your account so you will purchase extra space sooner.

<comment><USER20> Are you insinuating their storage offers are offers for storage? That sounds like quite the conspiracy.

</comment></comment><comment><USER37> > Backup and Sync is an app for Mac and PC that backs up files and photos > safely in Google Drive and Google Photos, so they're no longer trapped on > your computer and other devices.

Yeah, they only become trapped on Google's servers.

</comment><comment><USER38> I dont get what's new here or am i confused?

I have used many services over the years, OneDrive from Microsoft, Google Drive / Photo sync thing, dropbox, Amazon storage, etc.

Honestly being that I work at Microsoft I am obviously going to have a bias a bit, but this stuff is not about my work its about my life and how to stay synced across my Windows Phone, Windows 10 devices (i have a few), my iPhone, my iPad, etc. and the best way i have found to do all of that is with OneDrive.

Hold on, i know what you're thinking that im just picking my companies product, but honestly i tried them all, a lot over the years and OneDrive just does a great job, has first class apps for iOS, Android, Windows and powerful Web UI for when i just need to jump in and find something.

Also you get 5 gigs for free with OneDrive. Move up to 50GB and its $1.99/mo.

On top of that I use an Office 365 subscription for my personal life (custom domain/email) and again i get a ton more storage through that.

Really worth giving it a try!

[https://onedrive.live.com/about/en- us/plans/](https://onedrive.live.com/about/en-us/plans/)

<comment><USER39> I won't trust OneDrive after they cancelled their unlimited plans. Yes, I understand it's unrealistic for such a thing to exist but Microsoft offered it anyway, then took it away when people actually used it.

Plus having it forced on me through Windows makes me instantly hate it.</comment></comment>


Google Transparency Report Shows Rising Trend of Government Surveillance - <AUTHOR> https://www.eff.org/deeplinks/2012/11/google-transparency-report-shows-rising-trend-government-surveillance <comment><USER2> Hmmmm....sometimes I read these I feel like a sheep, as if I am supposed to become indignant upon command, which sadly I usually do.

Yet to be honest I am more saddened by the ignorance of my fellow countrymen then of the governments increasing distrust and oppression. Large groups of people in power tend to like to stay in power and will do anything to accomplish it. This has been proven time and time again throughout history. All hail "corporate feudalism"!</comment>


How the Potato Changed the World (2011) - <AUTHOR> http://www.smithsonianmag.com/history/how-the-potato-changed-the-world-108470605/?all

<comment><USER2> I never thought I'd be quite as fascinated with potatoes...</comment>


Ask HN: Which products can be used for controlling command level access in Linux - <AUTHOR> I was able to find some products like "CyberArk" which provides some of this functionality but wanted to know what all products are there which are used by the enterprises all over. <comment><USER2> Your search term would be [https://en.wikipedia.org/wiki/Mandatory_access_control](https://en.wikipedia.org/wiki/Mandatory_access_control)

and anything (for Linux) listed there.

</comment><comment><USER3> Assign people to different groups and update group level permissions using chmod for the files that you want differential access for

</comment><comment><USER4> sudo?

<comment><AUTHOR> I want users to have different privileges and they should be able to access only certain commands depending on the permission level.

<comment><USER5> That's exactly what sudo does.</comment></comment></comment>


Decentralised Decision Making with Initiative Circles - mashooq-badar http://codurance.com/2016/05/13/initiative-circles/ <comment><AUTHOR> Question: do you have C-level employees? What's their role in decision making? How are salaries set? Is the space of "decentralization" circumscribed to labor? I.e. are you just forcing more work on employees and not compensating them for it?

</comment><comment><USER2> This seems totally impractical to me.

</comment><comment><USER3> Sounds a bit like sociocracy, consensus for cities.

</comment><comment><USER4> Sounds a lot like communism.</comment>