BlackBerry Billionaire Has the N.H.L. Buzzing - <AUTHOR> http://www.nytimes.com/2009/05/10/sports/hockey/10coyotes.html?_r=1&ref=sports

<comment><USER2> Balsillie is quite the hokey nut. When I was at RIM, the co-op committee would organize these talks where senior people would talk about what they do, how they got there etc. They were all pretty interesting, except Balsillie's talk, which involved hokey.

Anyway, I'm no hokey fan, but the politics behind this are actually pretty interesting. The NHL commisioner has been in power for a long time and runs the league with a heavy hand, and his primary push over his time has been trying to expand the game to the southern US, which involved moving teams from places like Quebec City and Winnipeg to Phoenix and Nashville. Of course, there is no base for hockey there and so a lot of these teams have very poor attendance and lose lots of money. Due to revenue-sharing, more successful teams have to pay for the loses for less-successful teams, which irritates lots of team owners, who are also governors of the NHL.

Now, Balsillie comes along and tries to buy a team. First The Penguins, then the Predators. The first time he balks after some last-minute addenda to the contract, while the second time he is judged to be too brash and not respectful enough of the established order.

Now comes this attempt. Clearly the Coyotes are a failure of a business - amongst the lowest sales in the league, massive financial loses every year. In order to survive, Bettman must convince team owners (who must approve any move within the league) that his southern strategy is worth perusing, that Balsillie would be an irresponsible and undesirable owner, and that they must keep subsidising the Coyotes for the good of everyone. Balsillie, OTOH, is using three strategies: first bankrupcy court to where he picks up the Coyotes by offering a very good price for a very bad business, second a lawsuit that alleges the NHL promotes anti-competitive practises (trying to keep Hamilton from getting a team, since its close to Toronto and Buffalo) and lastly, appealing to other team owners' business sense, his this move would make the league better off financially.

<comment><USER3> I've worked in the league offices of Major League Soccer. While it's not one of the big four, all the high executives are from one of the big four.

Balsillie has a number of issues: first, Hamilton's clearly in both the Leaf and Sabre territories. Second, the arena in Arizona is brand new and better than anything in Ontario by a wide margin. Third, even if they were going to move the team, Kansas City has a new arena that's perfect for hockey as well. Fourth, moving a team back to Canada doesn't help get the NHL back on ESPN (which is apparently their "Master Plan" to rebuild the league in the States).

Lookit, as a sports fan, I'm in favor of putting teams where fans want them and can afford them. (i.e. the Jacksonville NFL team is a mistake of incredible proportions.) In particular, it makes more sense for the Coyotes to end up in Hamilton than any of the other teams in the NHL (maybe the Preds). But it's not just Bettman's ego that's keeping a team here in the States. There are all sorts of structural issues at play as well. And we haven't even gotten into the "Balsillie is the Mark Cuban of hockey" argument.

<comment><USER4> For outsiders of the region, Hamilton is basically a suburb of Toronto. Certainly it is it's own place, but it's fair to say there's a lot of back- and-forth between the two, ie. commuting and fan loyalty. It's also a hour away from Buffalo, so there are ties there as well. They question is, what effect does giving this area a new team have on the league overall. Obviously there are fans there, but these fans are already probably going to games in Toronto and Buffalo. Are they expecting to make fans in the area? That seems unlikely. So you are cutting into the bases of 2 other teams in the league for what?

<comment><USER5> There are multitudes of under-served fans in the region. Yes they go to Sabres and Leafs games. But the Leafs have the longest waiting list and the highest prices of any team (all while serving up a very sub-par on ice product). Tickets are largely locked up by corporate season ticket holders and the "regular fan" has enormous difficulty obtaining an over-priced ticket. Hockey is, by far, the number one sport. There would be no need whatsoever to create new fans. The existing market would buy anything and everything a new team would be selling.

<comment><USER3> See, you're thinking from the _fans'_ perspective. That's just about the last thing anyone at the NHL is thinking about. If they let in a Hamilton team, the NHL would be sued _so fast_ by both the Maple Leafs and Sabres. (Yes, franchisees can sue their franchisor.) Territory rights are golden to sports franchises - it's their one sustainable asset, even more valuable than their logo/brand.

Again, the $750 million payment to Glendale, the KC arena, and the desire to be on ESPN are all issues that would have to be resolved _before_ we even get to a territorial rights fight. Balsillie is hoping that bankruptcy court solves these issues - and court certainly does help him overcome these actors - but they're huge, huge issues.

<comment><USER5> I was just addressing a single issue raised in the prior comment. I was not offering an opinion on the merits of a move or other issues (from any perspective). Of course there are other issues.

(It is not guaranteed the Leafs would sue. NHL territory rights have never been tested in court and it is probably to everyone's benefit that they never are - in order to ensure that value is maintained).

</comment></comment></comment></comment></comment></comment><comment><USER6> I dunno how a little email gadget made him billions.

His research centre is the exciting thing, not the NHL.</comment>


HN: Place to run a competition for developers? - <AUTHOR>

Does anybody know of a site where I could run a competition for developers?
The general idea is to spur interest in an API by offering prize incentives to people who build new apps and services.
Rather than building a resource for this myself I thought it would be neat if I could find a place already set up for it. Any ideas? <comment><USER2> Hi, I'm the founder of Coderloop.com, a programming competition platform. Our platform is able to test user submitted programs against a problem spec. We also support specs that require the user to write a program that interacts with an HTTP server (an example here <http://www.coderloop.com/puzzles/islands> ). If you are interested we can build some puzzles dedicated to your API. :)

<comment><AUTHOR> Interesting, thanks.

The scope for my contest would be more loosely based than solving a specific problem criteria, although that could be an added fun twist! I anticipate people would build apps for phones, plugins for other software, services to help users, etc. Many companies run competitions of this nature, e.g. Twilio.

I could run off some ideas for what's needed if you'd be interested in expanding Coderloop to support a contest like this?</comment></comment>


BitTorrent Developers Introduce Comcast Busting Encryption - <AUTHOR> http://torrentfreak.com/bittorrent-devs-introduce-comcast-busting-encryption-080215/

<comment><USER2> This is a good step, but probably only a temporary fix. They basically encrypt client-tracker communications to prevent filter software sniffing peer addresses, which are then immediately disconnected. Unfortunately, BitTorrent traffic has a fairly obvious signature (compared to most internet traffic) which is vulnerable to traffic analysis. Even with encryption it could probably easily be detected and throttled.

Disguising BitTorrent traffic to look like other normal traffic might work, though I'm not sure how.

I have no sympathy for Comcast or other large US telecoms. Supposedly these guys were given _huge_ tax breaks ($200 BILLION) in return for developing the infrastructure for high speed (~45Mbps) internet to homes... but that infrastructure was never built. There's a book called "The $200 Billion Broadband Scandal" (though I haven't read it.)

Just because Comcast oversells their capacity it doesn't give them the right to arbitrarily filter some of my traffic. I'm supposed to give them money and they're supposed to give me a connection to the internet at the speed they advertise.

Part of me hopes they take it this far and either get a class action lawsuit brought against their asses, or piss people off enough to get some net neutrality legislation passed.

Whew, sorry for that rant...

<comment><USER3> BitTorrent and similar protocols have many legitimate uses. I believe the film and music industry plan was merely to search for matching bitstrings of the form <MP3_header><known_copyrighted_payload> and subsequent known bitstrings. Even the lamest private key encryption defeats such matching.

Regarding oversold bandwidth, it has happened since the advent of 33kb/s modems, got worse with 56kb/s modems and has become farsical with broadband.

</comment></comment><comment><USER3> A few days ago, I noted that encryption would be developed ( <http://news.ycombinator.com/item?id=114609> ).</comment>


How I Taught Third Graders Binary Numbers - <AUTHOR> http://www.exploringbinary.com/how-i-taught-third-graders-binary-numbers/

<comment><USER2> There are some interesting ideas in this post. I teach binary numeral notation, and then arithmetic with that notation, to third graders each year as part of the math classes I teach in my town. One of my favorite resources is the book Algebra by Gelfand and Shen,

<http://www.amazon.com/Algebra-Israel-M-Gelfand/dp/0817636773>

which includes problems in representing numbers in binary notation and doing arithmetic with binary notation that are very approachable to young learners. (The problems are also very good review for undergraduate math majors

<http://www.ocf.berkeley.edu/~abhishek/chicmath.htm>

and help adults think more deeply about mathematics, which is why I like teaching with this book as a source of lesson topics.)

Edit after seeing other comment: I also mention to the children in my classes the Babylonian numerals,

[http://www-groups.dcs.st-and.ac.uk/~history/HistTopics/Babyl...](http://www- groups.dcs.st-and.ac.uk/~history/HistTopics/Babylonian_numerals.html)

in which the implicit base is base sixty. The link shown here mentions speculation from ancient Greece that that base was chosen because it has many different prime factors. That Babylonian system of numerals, whatever its origin, appears to be related to historical relics such as counting sixty minutes in an hour or 360 degrees of arc in a circle.

</comment><comment><USER3> A slight variation that I read years ago using only the socratic method (the teacher only asked probing questions) to teach third graders binary arithmetic. Interesting how he weaved aliens into it.

<http://www.garlikov.com/Soc_Meth.html>

Edit: If I'd read to the bottom - I would have seen the author also references the above post.

<comment><USER4> The socratic method seems to be more effective and intuitive. I was about to paste the same reference.

</comment></comment><comment><USER5> Maybe overly pedantic, but I don't like [http://www.exploringbinary.com/wp- content/uploads/27.decimal...](http://www.exploringbinary.com/wp- content/uploads/27.decimal.png)

For the tens you're counting lines of blocks, and for the ones you're counting blocks, so it doesn't match up. Maybe if the ones were lined horizontally so you're still counting vertical lines, they just happen to be 1 block tall instead of 10 blocks tall.

<comment><USER6> yes. this confused the heck out of me. the units need to be horizontal, or (when using physical objects) the multiples could be piled on top of each other. as it is, it's just misleading.

</comment></comment><comment><USER7> There was a cool computer game called the Zoombinis that we used to play at home. One of the puzzles taught binary arithmetic using strange characters that had two expressions. There's a picture here:

<http://www.computingwithkids.com/column/20011026.asp>

The addition went up to 15 I think. You had to aim the pinballs at the group that would 'overflow' and jump in the river.

There were some very challenging puzzles in the Zoombinis titles - but they were teaching the conceptual foundations and encouraging intuition, not focussing on the terminology and modern applications.

Edit: a more useful link, with educational context and a larger picture, is this, although it's in French:

[http://la-rochelle-ecole-barthelemy-profit.pagesperso-orange...](http://la- rochelle-ecole-barthelemy-profit.pagesperso-orange.fr/Zoombinis2/page3.htm)

<comment><USER8> Man, Zoombinis, those were the days. A few friends and I all "played" it in our elementary days; however I am convinced that the lessons I learned there about binary numbers, problem solving, and spacial and mathematical efficiency stick with me to this day.

As was written in this article, many students apart from CS never fully understand number bases, which is unfortunate. I applaud this attempt and others (Zoombinis, etc) to teach some of these basic concepts at an early age.

</comment></comment><comment><USER9> I love how you showed them three different ways. Brilliant. Research shows that kind of patterning repetition in learning is key.

</comment><comment><USER10> I think such engaging and visual teaching methods are far more etching on the mind. Great post.

</comment><comment><USER11> He could have also mentioned the old babylonians and their base 12 system. We still have an extra word for 12 (a dozen) and it explains our strange counting of time (2 _12 hours in a day, 5_ 12 in an hour or minute).

</comment><comment><USER12> Great idea for a site, so simple and yet so deep.</comment>


Show HN: Finch.io – tweak design on any live website - <AUTHOR> https://finch.io <comment><USER2> Really impressed with this! This would be invaluable for people who can't use dev tooling. Great website design as well.

</comment><comment><USER3> Nice landing page. I personally find I can mostly just do this stuff with css and the inspector. It's not difficult enough to justify paying money for a prettier sol'n.

<comment><USER4> Same here, but for lots of designers I think this could be really helpful.

</comment></comment><comment><USER5> Reminded me of the days when I used DreamWeaver. Hated when it used to muck around my HTML code.</comment>


Tall Buildings of the Last Fifty Years - <AUTHOR> https://ctbuh2019.com/other-info/50-influential-buildings/ <comment><USER2> CTBUH have an interesting set of skyscraper data[0] that's worth perusing, if you are willing to register (or block certain elements..)

Also, interesting piece of trivia: the voluntary demolition of buildings taller than 200m is unprecedented.[1][2] The first of these buildings to be built was the Metropolitan Life Tower,[3] completed in 1909, which is still standing today.

[0]: [https://www.skyscrapercenter.com/](https://www.skyscrapercenter.com/)

[1]: 9/11 and the destruction of the WTC towers being the implied involuntary demolition.

[2]: [https://pursuit.unimelb.edu.au/articles/praising- squareness-...](https://pursuit.unimelb.edu.au/articles/praising-squareness- the-heritage-of-skyscrapers)

[3]: [https://en.wikipedia.org/wiki/Metropolitan_Life_Insurance_Co...](https://en.wikipedia.org/wiki/Metropolitan_Life_Insurance_Company_Tower)

<comment><USER3> > voluntary demolition of buildings taller than 200m is unprecedented

Any insight into why is it so?

<comment><USER4> Do you normally destroy things worth millions of dollars that still can do their basic function (house offices)?

<comment><USER3> Well office buildings get torn down routinely; I would expect there to be a separate reason why 200m+ ones are not.

<comment><USER5> The higher/bigger the building, the bigger you need to replace it with, thus it's a much bigger investment, than finding a lot with a smaller building on it.

As a sibling post a bit up mentioned JP Morgan's 270 Park Av. building 215m and it's getting replaced, because in this case it wasn't easier to "just find a lot with a smaller building", which is probably very rare and rather recent (though once there were multi-storey buildings in place of every skyscraper in Manhattan) solution.

</comment></comment></comment></comment></comment><comment><USER6> > The design strategy of the Leadenhall Building centers around its lobby's > elevation above the ground plane, creating a

... three storey climb up the fire escape from the basement if you arrive by bicycle!

Architects love this building, but there are too many little facepalms that come with actually working in it.

<comment><USER7> Shouldn't there be an elevator?

<comment><USER6> The main lifts don't reach the basement because of the elevated lobby nonsense. There is one small lift which does go down there, but it's a service lift for the whole building, so it could be busy elsewhere when you want it.

My pass won't operate it anyway; you have to be specially authorized, and when I asked, our office manager didn't know how to do that.

</comment></comment></comment><comment><USER8> > At the time of their completion [1973], the Twin Towers —the original 1 > World Trade Center, at 1,368 feet (417 m); and 2 World Trade Center, at > 1,362 feet (415.1 m)—were the tallest buildings in the world.

It seems odd that there's no overt mention.

<comment><USER9> The ones listed seem to have something novel about them, like a new method of construction or a unique design.

Was there anything like that for the WTC, or was it "just" tallest?

<comment><USER10> The framed-tube structure of the original Twin Towers was pretty novel at the time. It allowed the building to have wide open floor plans without the need to have a grid of support beams everywhere like most other skyscrapers up until then. It also likely would not have collapsed if built the traditional way. Then again most modern skyscrapers are built more like the original WTC and less like the Empire State Building, so it's not really a design flaw.

The visual design of the towers was also striking in it's minimalism, and quite controversial too. I think people got used to them but after they were first opened many saw them as a blight on the skyline. IMO, I prefer the old towers to the new, not that the new one is particularly ugly or anything. They were kinda like the Pyramids of skyscrapers; just build a shape, as big and tall as you can. Maybe if 9/11 never happened a future civilization would have called them "The Rectangles".

<comment><USER11> The 208' square floorplan resulted in a slender monolith. With other construction methods, they may have toppled, rather than collapsed within the tube. That may have resulted in even more death and destruction.

The development of the World Trade Center destroyed "Radio Row". Possibly more of the electronics industry would have stayed in the New York area had than not happened. "The Death of New York's Radio Row" [https://www.qcwa.org/radio- row.htm](https://www.qcwa.org/radio-row.htm)

<comment><USER10> > The 208' square floorplan resulted in a slender monolith. With other > construction methods, they may have toppled, rather than collapsed within > the tube. That may have resulted in even more death and destruction.

I guess we'll never know, so I'm just theory crafting, but the structure above impact on the South Tower did topple to a pretty extreme angle before falling straight down:

[https://i.pinimg.com/originals/07/3d/04/073d041d28159fc6f376...](https://i.pinimg.com/originals/07/3d/04/073d041d28159fc6f376aae70d6eded3.jpg)

I suppose for a concrete grid structure like Empire State Building, it might have slid off and fell to the ground without collapsing the structure below. Not really sure if that would be any worse, or better.

The only way to get it to topple like you'd expect a tree would when chopped down is for the airplane impact to be much lower on the structure. That would not have been possible of course because of all the other buildings in the way, but it was I believe the intention of the 1993 WTC bombing.

<comment><USER11> Interesting photo, thanks. I was thinking that the top would buckle at the point of impact and fall sideways.

Compared with the B-25 collision with the Empire State Building, the B-767s are over 10 times heavier, were moving more than twice as fast, and the WTC has half the cross section of the Empire State. Plus, the fuel load of the 767s is comparably greater and causes a greater fire. [https://en.wikipedia.org/wiki/1945_Empire_State_Building_B-2...](https://en.wikipedia.org/wiki/1945_Empire_State_Building_B-25_crash)

</comment></comment></comment></comment></comment></comment><comment><USER12> Really enjoyed this. Another interesting building is this hotel in North Korea: [https://en.m.wikipedia.org/wiki/Ryugyong_Hotel](https://en.m.wikipedia.org/wiki/Ryugyong_Hotel)

I guess it doesn't get much attention due to its location...

<comment><USER13> I suspect the author(s) limited the selections to completed, occupied buildings, as that hotel is "the tallest unoccupied building in the world". If buildings in progress were on the list, I would have also expected to see Jedda Tower. [1]

[1] [https://en.wikipedia.org/wiki/Jeddah_Tower](https://en.wikipedia.org/wiki/Jeddah_Tower)

</comment></comment><comment><USER14> Great to see 1 Bligh St, Sydney in the list. It's a fantastic building on the inside with the central attrium going right to the roof.

While a lot of people seem to hate it, I actually like 1 William St in Brisbane.

</comment><comment><USER15> The cookie notice obscures the page and cannot be made to go away without JS.

<comment><USER16> I have js disabled, and the page shows no notices and the article renders fine.</comment></comment>


Non-repudiation and the joy of knowing you've been hacked - <AUTHOR> http://blog.authy.com/repudiation

<comment><USER3> I think the author is missing the real problem. Why is there a single "admin" account at all? Why don't users log in with their "normal" user accounts, and then use some kind of authenticated, audited privilege escalation (like sudo, for example) to perform tasks that require administrative privileges?

<comment><USER4> Seriously. I almost stopped reading after this bit...

'specially for infrastructure accounts (if your company uses SSH, chances are you have one Unix Login that all your admins/employees share). Which makes non-repudiation harder.'

Chances are???? What credible sys admin would ever do something like that...?

<comment><USER5> Oftentimes, the decisions admins make are determined by the needs of management of fellow employees.

I have on frequent occasions mouthed words along these lines: "It's a bad idea to do it that way, but I can see how it would be much cheaper, efficient or easier to teach employees, so I will tell you the best way to do this bad thing."

You can carefully set up the best security possible, but the instant that a client or bigwig is waiting on something because of it, credentials will be shared and you or other employees may be ordered to share them.

It's just how it is.

</comment></comment></comment><comment><USER6> > Which brings us to shared accounts. Having worked with hundreds of companies > over the past couple of years, we've learned that shared accounts are > ubiquitous, specially for infrastructure accounts (if your company uses SSH, > chances are you have one Unix Login that all your admins/employees share). > Which makes non-repudiation harder.

I've seen this first hand at a number of large companies for both unix accounts and (even more so) with database accounts. After some period of time (varies from 1 month to 1 year) everybody who worked on an application would have the database credentials of the application and would use them to diagnose app issues. New members of the team for an app would be given all the credentials too as "it's the only way to get things done...".

It wouldn't start out that way as things would be "locked down" at first but _every_ app ended up like that. Add to this that folks tend not to ever rotate their application database passwords for fear of breaking something and you've got a ton of people with the same access credentials and no way to distinguish them. People would join/leave the group (or even the company) that managed an app and would forever have access to all the databases for the app[1].

This is one of the problems that we're solving with JackDB[2]( _disclosure: I 'm the founder_). It allows you to share data sources without sharing passwords. User's authenticate as themselves and the server proxies the database connection for them. All executed commands (SQL, etc) are added to an audit trail and since you can tie actions to actual users you know who made changes, who queried customer records etc. Similarly since access is done _per user_ you can selectively grant/revoke access to user's without asking them to "forget" old credentials.

[1]: Yes firewalls can block things as well but if you're still an employee somewhere then you can probably get passed the internal firewall by tunneling through some other server you have access to.

[2]: [http://www.jackdb.com/home.html](http://www.jackdb.com/home.html)

<comment><USER7> I think the core issue behind this is the complexity of managing SSH keys across your infrastructure. Have a look at [https://bastio.com](https://bastio.com)

JackDB: I like that the service keeps an audit trail on database transactions transparently, it is a big thing for companies that have to be compliant to a set of standards (i.e., health sector, financial sector, etc.) Good job!

<comment><USER6> Thanks. I've previously worked in technology in the financial services industry so a lot of the ideas for auditing/compliance come from meeting the expectations of that market. Our logic is that if it's seamless enough for them to use it and satisfies their compliance requirements, it should be good for most other industries as well.

Regarding SSH, it has the advantage that you can ( _and should!_ ) have multiple authorized keys for the same account. For example for the bastion host to connect to our VPC of servers we use individual SSH keys tied to the same proxy account. Databases generally don't allow that type of access.

Some allow using client certificates to login (which nobody uses). Some allow integration with external LDAP/AD (which very few use). The vast majority uses standard username/password based authentication that _hopefully_ is going over SSL (seriously go and check ... for most DBs by default it's sent over plaintext).

Some places try to have per user database accounts (possible tied to AD/LDAP) but that usually devolves to the same app password sharing as the privileges aren't kept in sync or it's just too much of a pain to provision vs just giving someone the app password.

<comment><USER7> I couldn't agree more; client certs are too much work and come at a non- trivial maintenance cost, same goes for AD/LDAP. So JackDB also acts as authentication provisioning front-end for a DBMS so users don't have to do that themselves and suffer the maintenance cost/overhead. Interesting.

I'm curious, your VPC bastion; how do you make managing SSH keys scalable given that setup? And why not separate accounts which in fact help with keeping sane logs of who did what, and distribute the risk of compromise across several accounts?

<comment><USER6> > So JackDB also acts as authentication provisioning front-end for a DBMS so > users don't have to do that themselves and suffer the maintenance > cost/overhead.

Yep. Couple of mouse clicks and a user no longer has access to one or more data sources (grants are role based). Similar effort for provisioning new users.

If the level of effort for a secure system is on par with emailing a password to a co-worker then people will actually use it. Plus with JackDB nobody other than the system admin even has the DB passwords so a normal user can't even send an email out if they wanted to.

> I'm curious, your VPC bastion; how do you make managing SSH keys scalable > given that setup? And why not separate accounts which in fact help with > keeping sane logs of who did what, and distribute the risk of compromise > across several accounts?

At the moment things work for us as we're a very small team. Obviously something more scalable would be needed once you have a large number of people involved. The single proxy account is for convenience. That way the SSH keys to log into the other servers (accessible only through the bastion) can be shared. All servers (bastion included) log the public keys used to connect so we do have a trail of who/what/when. It would just be a bit more involved to filter it. Given our relatively small size it feels like a good tradeoff of security and convenience.

As we grow it's definitely something to (repeatedly) revisit, as is true about any security procedures.

</comment></comment></comment></comment></comment><comment><USER8> The idea that a serious compromise will present a clear path back to a specific ssh key that got used by the attackers and that you'll possibly be able to stop it just by turning off that key is pretty laughable. But then again, so is protecting your core infrastructure with 1.5 factor android soft tokens. Google isn't even willing to make it sound like especially strong protection for your gmail account. How much for a CAC style pki infrastructure? Hard to believe it's more than $50-$100/seat for a small organization. If you're worried about figuring out which employee got his phone dropped after your whole backend got molested perhaps an actual security posture would be more suitable.

<comment><USER9> It's by far the most accessible two-factor authentication method, and not as insecure you're making it out to be.

<comment><USER8> What percentage of those android phones would you say are upgraded to a level where they don't have any publicly announced cve's against them that allow for rce or close enough? Like 5 or 10 percent? I agree that it's better than a single secret, but how does a soft toekn count as "something you have" if it can be stolen from your phone and not end up "missing"? My google auth secret continued to work without a hiccup after apple repaired and wiped my phone and i restored from their cloud backup service. That's not too bad for keeping my voice mail private, but it's a pretty weak protection for sudoers on boxes that are pretty much critical to your company existing.

</comment></comment></comment><comment><USER10> Why do so many people need access to this 'admin' account. Is this an infrastructure problem? I'm struck by the idea the author is discussing how to properly share access to a single account on an OS that was conceived as multiuser.

</comment><comment><USER11> "if your company uses SSH, chances are you have one Unix Login that all your admins/employees share"

Is that really common? I've never seen it.

<comment><USER12> We released Authy-SSH last september and this was by far the biggest feature request. You will be shockingly surprised if you knew the names of the companies that not only share unix accounts (which is very common) but were actually sharing Two-Factor Authentication keys.

</comment></comment><comment><USER13> Does obtaining the original Google authenticator QR code actually let you impersonate the authenticator? I was hoping it was a one-time shared secret only used for the authenticator to identify itself to the server for bootstrapping purposes and that a used QR code would be worthless.

<comment><USER9> Yes it does. The QR code just contains the TOTP key and title.

Send it to the email account that will be protected by two-factor authentication using the key, and it won't really matter.

<comment><USER14> > Send it to the email account that will be protected by two-factor > authentication using the key, and it won't really matter.

Unless, of course, the email is intercepted in transit.

If your email is being sent in the clear, it doesn't matter whether or not you use SSL and/or two-factor authentication to connect to your server - the email has been compromised long before.

<comment><USER9> >> Send it to the email account that will be protected by two-factor authentication using the key, and it won't really matter.

> Unless, of course, the email is intercepted in transit.

> If your email is being sent in the clear, it doesn't matter whether or not > you use SSL and/or two-factor authentication to connect to your server - <USER2> > email has been compromised long before.

This isn't really as big of an issue as people make it out to be. TLS is fairly prevalent for MTAs.

Anyway, I assumed this was describing a scenario where a sysadmin/IT guy sends a QR code to another employee, in which case it is all internal.

</comment></comment></comment></comment><comment><USER15> Doesn't non-repudiation mean the opposite of what he is saying? I.e. isn't "being able to proof where something comes from or who did what" just repudiation?

<comment><USER16> > isn't "being able to proof where something comes from or who did what" just > repudiation?

No, "repudiation" is (in the relevant sense) _denying_ responsibility for sending data or some other action. Non-repudiation is the property of a system that prevents (or, at least, makes more difficult) repudiation.

<comment><USER15> ah

</comment></comment></comment><comment><USER17> How should we store passwords? IAM is clearly a big industry for big companies, but lots of people have the problem. There has to be a simple solution?</comment>


Is it time to give BP some competition? - <AUTHOR>

its time a bounty was offered for getting this spewing oil well shut down. BP has failed. They ought to be made to offer $100 million bounty to whoever shuts down that well first.
surely there is someone out there that knows how to do this or who has the will to forge a new solution. an underwater "Red Adair", if you will.
what do you think?  Are there smarter people out there?  Or is this idea half-backed? <comment><USER2> Half-baked due to the fact that there's only one site in play. You can't let someone else try their hand without pulling BP off the job.

It's also hard to imagine anyone wanting to try given the nearly unlimited liability they'd take on. Lets suppose they tried and had no effect. Someone, many ones almost certainly, would claim they made it worse just to have another deep pocket to sue. And only companies with deep pockets have the means to do the work.

To end, has anyone made a credible claim that BP has not yet been successful because they've been incompetent vs. the problem is very hard? Frankly, if you have energy to spare WRT to this, you'd be better off lobbying the Administration to OK the permit(s) Louisiana needs to dredge sand to (re?)build the barrier islands they need in front of the vulnerable marches that oil is now washing ashore on.

That's not a hard real world problem, that's just getting some people to say "Yes" in finite time.

</comment><comment><USER3> What makes you think BP isn't the best organization to do this? It definitely has the motivation and experience, so I don't see what else you want from them.</comment>


Mozilla says a new Firefox security bug is under active attack - <AUTHOR> https://techcrunch.com/2020/01/10/firefox-security-bug-zero-day/ <comment><USER2> Previous discussion: [https://news.ycombinator.com/item?id=21995055](https://news.ycombinator.com/item?id=21995055)

</comment><comment><USER3> A warning and a fix within two days of releasing the affected version. I appreciate this team's transparency and priorities.

<comment><USER4> Well, it also affected 68 ESR which was released in July, so detection wasn't that fast.

<comment><USER5> And it likely existed many years before that but these were the only 2 active versions to get a patch.

</comment></comment></comment><comment><USER6> Can anyone confirm if 73.0b3 includes the same fix?

Their "what's new" link in the beta's About window doesn't track with the beta release cycle. There's no revision listed, so I think the notes are for 73.0b1 still? At any rate, there's no mention of any security fixes.

[https://www.mozilla.org/en- US/firefox/73.0beta/releasenotes/](https://www.mozilla.org/en- US/firefox/73.0beta/releasenotes/)

<comment><USER6> I don't know my way around Firefox's source control at all, but I tried to do some digging. My first thought was to look through the changelogs on recent release tags, but there's no mention of the CVE that I can find in any of them.

I did find these changes in 72 which look related to the bug:

[https://hg.mozilla.org/releases/mozilla- release/rev/8260da04...](https://hg.mozilla.org/releases/mozilla- release/rev/8260da04c9b13f7c0e9cc6984a75e689b5fcb8c8)

And poking at one of those referenced files in the beta channel looks like it has the same changes:

[https://hg.mozilla.org/releases/mozilla- beta/file/tip/js/src...](https://hg.mozilla.org/releases/mozilla- beta/file/tip/js/src/jit/MIR.h)

So I think we're good on beta channel?

<comment><USER7> Even security fixes run the Nightly -> Beta -> Release gauntlet, so yes, Beta is fixed.

</comment></comment></comment><comment><USER8> > The vulnerability, found by Chinese security company Qihoo 360...

Isn't this the same company that was just being roasted for having spyware installed in Samsung phones?

<comment><USER9> Just because they ship spyware doesn't mean they want _other people_ spying on their customers or setting up botnets...

Alternately, who knows whether they found this exploit a while back and only went public once they discovered someone else was using it?

<comment><USER10> Or they sat on it and released it to distract from the bad press they got. Everything is possible.

</comment></comment></comment><comment><USER11> It looks like if you are running OpenBSD you probably want to be on -current or using the esr package. [https://undeadly.org/cgi?action=article;sid=20200109141600](https://undeadly.org/cgi?action=article;sid=20200109141600)

</comment><comment><USER12> Use noscript. It's possibly one of the best add-ons out there now.

<comment><USER13> Unfortunately there are too many sites that refuse to work without javascript, so any security benefits is negligible because it's very easy to be social engineered into enabling javascript.

<comment><USER14> You can get most to work by whitelisting one domain while keeping the cesspool of trackers off your computer. If it still doesn't work there are better things in life to spend time on than somebody's poorly constructed website.

<comment><USER12> This is what I do and I 100% agree about lazy people that aren't willing to make a halfway decent website. I'm not that old, but sometimes I just want a website with text. I don't need autoplaying videos with a billion slideshow images and shown how fantasmagical your company is.

</comment></comment></comment></comment><comment><USER15> Is this any different from the bug that was patched in 72.0.1 already?

<comment><USER16> No, it's the same bug. From the article: "... advising users to update to Firefox 72.0.1, which fixes the vulnerability".

</comment></comment><comment><USER17> > But researchers found that the bug could allow malicious JavaScript to run > outside of the browser on the host computer.

The phrasing may unfortunately mislead the less technical readers of their audience.

JavaScript always runs "on the host computer", this should be described as a sandbox escape.

<comment><USER18> I'd say "allowing the code to run on the host computer" is way less confusing for the less technical people than "allowing the code to run outside the sandbox". Most people have absolutely no idea what sandboxing means.

<comment><USER17> IHMO lying / being vague is never good when trying to educate someone. Non- technical people are not dumb and can understand what a sandbox is.

<comment><USER19> How would they know what it is if nobody explains it to them? It's not like the term is obvious.

<comment><USER20> Not knowing something is better than "knowing" something false.

<comment><USER21> Whats is false in this case?

<comment><USER20> [https://news.ycombinator.com/item?id=22011910](https://news.ycombinator.com/item?id=22011910)

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> A chain is as strong as its weakest link. Firefox's privacy characteristics are as strong as its security track record.

</comment><comment><USER23> Firefox is creepy AF. I was just listening to "Diamond Ned Flanders" by MadeinTYO on Apple Music, and when I open Firefox the "suggested article" on the front page is about Ned Flanders. That's some Facebook type shit right there. Uninstalled.

<comment><USER24> If it makes you feel any better, I've the same article on mine with no previous Flanders activity.

<comment><USER25> Yeah but they knew you were going to read this comment obviously.

<comment><USER24> Time travel confirmed.

<comment><USER26> Provided by Quantum Entanglement Advertising. You want it now because we sold it to you later.</comment></comment></comment></comment></comment>


World's Best Programmer Announced - <AUTHOR> http://tpgblog.com/2009/04/14/worlds-best-programmer-respect/

<comment><USER2> This wishy-washy, rambling piece disrespects the reader.</comment>


Writing Eloquent JavaScript Without CoffeeScript - <AUTHOR> http://oscargodson.com/#!/article/55075016 <comment><USER2> Just to clear one thing up -- Oscar writes:

        > The examples on the CoffeeScript site are purposely written
        > to be ugly to make CoffeeScript look even prettier.

... not at all. The side-by-side examples on CoffeeScript.org are showing you _the compiled output_. The point is to demonstrate -- although it's certainly far from perfect -- how CoffeeScript features can be compiled into clean JavaScript. Really, our goal is to make the JS look as nice as possible.

<comment><AUTHOR> This kind of clarification is exactly why I posted this link. It's great to clear the air in one respect and at the same time ask the question, "is there something on the CS site needing change to avoid this confusion?"

<comment><USER3> My problem is that I want a comparison of syntax so I can see exactly how Coffeescript is an improvement over the equivalent Javascript.

When I visit the site and I see a table with CoffeeScript on one side and Javascript on the other, my brain sees just enough to verify that the expected elements are all there before it says, "Yep - there is the comparison you wanted".

So while it does clearly state that the JavaScript is the output of the tool, my brain has already decided that it is exactly what I was expecting, and it takes me a second to re-adjust my thoughts.

Ironically, if the output looked less "normal" I probably wouldn't have the same problem, but it is formatted nicely and is good enough that subconsciously my brain tells me "equivalent syntax" and not "compiler output".

<comment><USER4> My problem is that I don't find the javascript on the main comparison page to be all that bad.

It doesn't do enough to warrant learning the abstraction syntax.

</comment></comment></comment></comment><comment><USER5> I don't want to sound like an asshole and I'm saying nothing about the author, but in my personal experience I found lining up variables or =s was something I worried about when I first started programming.

Now my mind's eye just totally skips variable declaration when visually code parsing, variable declaration is meaningless drivel that exists only to stop typos (a good purpose).

I had an opinion on the layout of them back then because I wasn't a good enough programmer yet to have an opinion on anything else, I had opinions on things that didn't matter because those were the only things I actually understood well.

Also, again in my personal experience, it's much better to declare them just before you use them for future maintenance, having 4 or 5 declarations at the same time is something I do so rarely now. If you start faffing around laying them out, you're going to be tempted to put them all together.

<comment><USER6> You should remember that you are not the only person that is going to be trying to read that code (unless it is a personal project, of course). Good layout helps _other people_ read, understand and debug your code at a later date (as well as _you_ at a later date, when you've long since moved on to other pojects in terms of active development work).

Also with Javascript's function-scoped variables and the fact it will let you declare them more than once in a given scope (the second and subsequent decleration being taken as either a NOOP or a basic assignemtn (if there is assignment with the decleration), declaring variables at the point of first use can be dangerous as it is easy, especially if you are messing around in global scope (which is to be availaded generally, but can't always be), to create hard to diagnose bugs due to variable values being clobbered because the same name is used elsewhere.

</comment></comment><comment><USER7> As someone who writes JS every day, ignoring the fact that I think most of these paradigms are terribly ugly (though the comma placement is acceptable for cleaner diffs), I expected this post to be about actually getting things done eloquently without CoffeeScript. What I got was a blog post about how ternary operators can be written on multiple lines.

<comment><USER8> My thoughts exactly

</comment></comment><comment><USER9> Oscar, when your code itself is making little frowny faces at you after you write it, something has gone wrong.

      x == 1
      ? alert(x)
      :(
         alert('Error'),
         x = 1,
         alert('All Fixed!')
      );

<comment><USER10> Does javascript guarantee a particular order of expression evaluation when there aren't any sequence points?

Alerting 'All Fixed' and afterwards 'Error' seems like it'd be just as valid an interpretation of the code.

Edited to add: Actually, I think the comma operator does do that, so no bad. Though the code is still unsightly...

</comment></comment><comment><USER11> The bit on the comma operator may be used in many other places, and I've seen it result in quite elegant code, particularly in small function bodies. Its use in the ternary here may be questionable, but in any case a good JS dev should know when it is appropriate.

My only gripe is with placement of commas in object literals and variable declarations which has become so common over the past three or four years.

      var x = 1
      ,   y = 2;

or

      var x = 1
         ,y = 2

or

      {
           k: 1
          ,k2: 2
      }

Are terribly unsightly, and do not in any way benefit the maintainer. It's just now you have to worry about the first line rather than the last one.

</comment><comment><USER12> It should be pointed out that "var a = a || someDefault;" can bite you when 0, "", or null are valid values for a. The empty string in particular can be surprising here at times.

<comment><USER2> Totally -- I think that 0 (which is a perfectly valid value for a number to be) bites people doing lazy initialization all the time.

For this reason, CoffeeScript provides the existential operator, which asks: does this variable exist? (Is it not null or undefined?) You can use it in the same places you would use "||", as well as some others:

        # In place of `||`
        result = answer ? default

        # Does `object.value` exist?
        if object.value?

        # Lazy initialize the speed of the car:
        car.speed ?= 60

        # Give me the value of `length`, only if `object` exists.
        length = jsonResponse.list.object?.length

<comment><USER12> I still haven't gone over to CoffeeScript. But I must admit Those are some compelling examples. ?= is especially nice (I miss ||= from Ruby)

</comment></comment></comment><comment><USER13> _JavaScript can be pretty too and the examples on the CoffeeScript site are purposely written to be ugly to make CoffeeScript look even prettier._

I'm not sure how many times this will have to be clarified, but the JS code on the CoffeeScript site are not examples, but the compiled JS. Even so, it's in many cases prettier than Oscar Godson's "eloquent" JS, IMHO.

</comment><comment><USER14> I really don't understand the point of the blog post.

So Javascript can be formatted to look kind of like CoffeeScript?

While I agree that Javascript is often misunderstood, to me his formatting of Javascript is making things much worse, in terms of maintenance (yeah...let's all line up equal signs...).

I personally DO NOT write CoffeeScript but I think the difference between CoffeeScript and Javascript goes beyond formatting. Writing CoffeeScript seems to me to be a syntactic improvement and eliminates some of the need to really learn Javascript (which I think takes quite a bit of effort)

</comment><comment><USER15> He's got to be trolling. Multiline ternary operators aren't in my book better than an if block.

He also completely misses the point about javascript's global-by-default variables and how easy it is to introduce them with typos, properly building classes, etc.

<comment><USER16> > He also completely misses the point about javascript's global-by-default > variables and how easy it is to introduce them with typos

Using strict mode will avoid these kinds of mistakes.

</comment></comment><comment><USER17> This is satire, right? ... right? Please?

</comment><comment><USER18> I guess from MPOV, "eloquent" formatting shouldn't change based on the size of the content... ie the difference between standard indenting and tab-aligning commas vertically. There's nothing eloquent about stepping through a dozen lines of code, tabbing each out, because a value was added that's a little longer than the rest..

</comment><comment><USER19> He makes a great point in favor of CoffeeScript: making your JavaScript look nice takes much more work without CS. The fact that he is lining up the multi- line string line breaks says loads about how CS will more easily make your JavaScript look good. How many times have you tried to line up your equals signs or colons only to then later add a longer key or var name that required you to further tab over your = or : to keep things lined up.

But feel free to correct me if I'm wrong, but I doubt vanity is the primary reason people are using CS. My number one favorite feature is the list comprehension, and if it didn't have that, I might not be bothering with it.

</comment><comment><USER20> Using the ternary operator is more "eloquent" than conditionals? That's true iff "eloquent" means terse in terms of number of characters, but I find if(...){} much more readable.

<comment><USER21> For the sake of a productive discussion, two of the things mentioned about converting ifs to ternaries _could_ be used to create better code.

The ternery operator has some readability problems, but it is an _expression_ , not a statement. Turning statements into expressions is powerful, which is why CoffeeScript's if/then compiles into an expression. Too bad this wan't mentioned.

Likewise, the comma operator allows JavaScript programmers to use a block of consecutive statements as an expression, something the author points out when explaining how to use ternaries in place of if statements.

The notion that you can use a sequence of statements as an expression without having to resort to a "let" form (function () { ...; ...; ...; return foo; })() is another underused construct that can make for improved JavaScript.

Put the two ideas together, and yes you can express a multi-line if statement with shorter keywords, but more importantly you have an if expression without having to wrap it in a function and encumber it with return statements.

I'm sorry that idea wasn't given more attention. If you aren't using JavaScript directly, this pattern may be useful in a more functional, expression-oriented style of programming.

</comment></comment><comment><USER22> There are some real problems with these "eloquent" styles.

They work only in a monospaced font. I code in a proportional font, and none of the column alignment tricks will look right when I view the code.

Even if you like to code in a monospaced font, there's no reason to write code that becomes hard to read in a proportional font. It's very easy to write code that is perfectly readable in both monospaced and proportional fonts: you merely forgo these column alignment tricks.

Also, this style of code is a pain to maintain. If you add a variable with a longer name, you have to go up and down adding spaces in front of all the other = signs.

And I find it hard to read even in a monospaced font, e.g.

        var i                       = 123
        ,   j                       = 456
        ,   k                       = 789
        ,   aMuchLongerVariableName = 'foo';

Matching up the initializer values for i, j, and k means my eye has to scan way across a sea of whitespace and hopefully remember which line is which when I get there.

Finally, the example with the escaped newlines all in a vertical column does not do at all what he expects! All those extra spaces become part of the string.

<comment><USER11> > I code in a proportional font, and none of the column alignment tricks will > look right when I view the code.

That's really your problem. If you think people will stop aligning things in their code because you are in the tiny minority that use proportional fonts, you're crazy.

> Matching up the initializer values for i, j, and k means my eye has to scan > way across a sea of whitespace and hopefully remember which line is which > when I get there.

Nobody's actually going to do what you just showed in real code. Instead, it would look like this:

      var i = 123,
          j = 456,
          k = 789,
          aMuchLongerVariableName = 'foo';

And still look quite good.

> Finally, the example with the escaped newlines all in a vertical column does > not do at all what he expects! All those extra spaces become part of the > string.

Absolutely, but if you are putting HTML in that string (a while other discussion there) 99% of the time the whitespace will not matter. And for all the other cases, this is no different from multiline string behavior in Python and other languages.

</comment></comment><comment><USER23> So it's not just me, then. IMO, writing `someThing ||= {}` is much more eloquent than `var someThing = someThing || {}`.

The first point he raises is a valid argument; CoffeeScript's intro does uglify the JS a _little_ to make its point. But it doesn't take much.

> _...merely inaccurate due to a lack of knowledge on JavaScript..._

Kinda think the _opposite_ idea was how CoffeeScript came into being, amirite? It was written to make JavaScript look AND act better. It wasn't developed by people that had no idea how to use JavaScript, and it certainly isn't used exclusively by people who don't know how to use JavaScript, too.

<comment><USER24> I must agree whole heartedly. I feel the author looks at the first few examples on the coffeescript page. Can I see an eloquent example of list comprehension or nested functions?

</comment></comment><comment><USER25> "CoffeeScript has been getting a lot of press and that's not a bad thing, but it's giving JavaScript a bad wrap.".replace(' wrap', ' rap')

</comment><comment><USER26> I have to admit that I'm resisting CoffeeScript. It looks interesting but for me it seems like just an extra step for something that isn't bothering me. I'd rather write code that's a little more verbose than to have to "remote control" it via another syntax. Am I missing the boat?

<comment><USER27> Not really. It's not usually mentioned but CoffeeScript loses a lot of its supposed elegance when you try to do things like chaining. Especially chaining a function that takes a function as an argument. To achieve better looking chaining you'll talk yourself into not using anonymous functions. tldr: whitespace significant languages do not do chaining very elegantly.

Other than that CoffeeScript is pretty cool.

<comment><USER2> ... not so much. A big part of the point of having a minimal function literal, `->` instead of `function(){}`, is that using anonymous functions is a bit more pleasant in any context -- including chaining.

        list.map((num) ->
          num * 2
        ).map((doubled) ->
          doubled + 5
        )

... instead of:

        list.map(function(num) {
          return num * 2;
        }).map(function(doubled) {
          return doubled + 5;
        });

It's not a huge difference. But, by the same token, it's certainly not a reason to avoid the use of anonymous functions.

<comment><USER27> CoffeeScript is always going to be less verbose than JavaScript, but in the context of a full code file having some functions with parentheses and some without isn't a pleasant consistent experience in my book.

Another thing CoffeeScript handles unelegantly is two anonymous functions (very common when a function needs an onsuccess and an onerror):

      api.get(
        ->
          # Success here.
        ->
          # Failure here.
      )

The benefit of curlies is you get a consistent experience and don't have to go to Stackoverflow to find out when you need commas or parentheses and when you don't.

</comment></comment></comment></comment><comment><USER28> Putting alerts in what should be a vaguely mathematical/functional construct seems very, very wrong.

</comment><comment><USER29> most of that made me feel sick

<comment><USER30> Yeah, it was sort of short and newbie-friendly, but it probably helped some people. I wish that it would have gone into more detail to explain how each of those tricks works so readers could learn why those operators work the way they do. For example, he called using a logical "OR" a " _var = var || value_ way of setting variables."

He should have gone into more detail to explain how ||'s work, how you can have more than just 1 of them, the order in which they are evaluated if you do have more than 1, etc.

</comment></comment><comment><USER31> The style decisions used in this article do not adhere that well to Crockford's style guide "JS: The Good Parts" and generally not that JSLint friendly.

</comment><comment><USER32> I can't stand how people assert CoffeeScript looks good compared to JavaScript, as if it's some universally accepted opinion.

</comment><comment><USER33> I'm not sure, but somehow he made some of those examples look less eloquent then their "ugly" counterpart.

</comment><comment><USER34> This page shows no content on kindle webbrowser.

<comment><USER35> It took my browser 20 seconds to render the text. I've no idea why he would load static content dynamically.

<comment><USER36> Looks lite it's been pulled in from his Posterous blog. Bizarre way of doing it… why not just link to the posterous blog post?</comment></comment></comment>


Soccer team demands teen's arrest for finding unannounced images online - <AUTHOR> http://boingboing.net/2012/04/19/norwich-city-soccer-team-deman.html

<comment><USER2> Don't worry. IP and IP protections are good, and won't be abused. This is obviously a case of a punk kid being bad -- I mean really, who looks for info on things they like in publicly accessibly places? I'll tell you who, only hoodlums and miscreants. What's next? Punks noticing buildings before they are finished? Thugs seeing window displays before the store opens?

/snark

</comment><comment><USER3> When will companies (and soccer teams) learn that this is not how you treat your customers (or fans).

</comment><comment><USER4> Team hires incompetent web developers. Attacks fan when those developers publicly expose elements of an upcoming redesign and the fan notes this.

In the UK, accusation is now coming to approximate formal indictment. And it's always the individual end user who is considered to be at fault.

Too bad the team and potentially the web developers probably won't be sued for slander. Perhaps a hefty judgment against them would make them think twice, next time.</comment>


Demo Days compared: Seattle TechStars VS San Francisco AngelPad - <AUTHOR> http://blog.shopobot.com/demo-days-compared-seattle-techstars-vs-san-f

<comment><USER2> I was at the Techstar's demo day. I felt the length of the pitch was perfect. Long enough to have some depth, succinct enough to keep the audience interested. 2 minute pitch at AngelPad sounds really short. It would be hard for design centric companies like smorepages.com to convey interest under 2 minutes.

<comment><USER3> (founder of design centric kout.me here)

It was definitely interesting.

The exercise of condensing our entire pitch down to 120 seconds was worthwhile. We could very quickly explain what we do, where we're going, and how we'redoing. Elevator pitches were a snap.

The best aspect of it was that it gave us more time to speak to investors afterwards. Most stayed in the room and we had an opportunity to have amazing conversations (and collect business cards) from those that might be a better fit...rather than broadcast to everybody.

That said, having never been through a 7m presentation, I can't compare against that directly. Just providing my own perspective.

When we first heard of the two minute rule, we were in disbelief. But at the end, somehow it miraculously worked.

</comment></comment><comment><USER4> Seattle obviously has a lot of tech talent so I can see some great startups coming onto the scene there.

This got me thinking. Are there any thematic differences in the kinds of startups popping up there? For instance, we are seeing lots of fashion startups in NY as compared to SF. What about Seattle?

<comment><USER5> A lot of commerce/ad startups (Amazon influence?) and a lot of LeadGen stuff (AllStarDirectories influence and several key investors up here seem to like that style of business). Plenty of B2B.

There's a fair bit of gaming DNA here (Valve, BigFish, PopCap) but strangely few gaming startups (there are a few). Lots of mobile stuff (notably Swype).

I'd say it's pretty all-over-the-map.

<comment><USER6> I'd say that Seattle has plenty of gaming startups, they just don't seek VC money. The VC money for games is primarily (exclusively?) in social games which a lot of devs aren't interested in.

</comment></comment></comment><comment><AUTHOR> I was really surprised to hear time spent explaining that "Angel investing is a great opportunity!" In SF the investors know that it's a great business and are only worried about finding the right teams.

A question for founders in other cities: do you have to try to sell the idea of "being an investor in a startup", or do you just need to sell yourself?

<comment><USER7> I'd never sell the idea of investing in a startup. It's an area that should be left to sophisticated investors. It's not like investing in a laundromat or an apartment building.

</comment></comment><comment><USER8> A 7m pitch for TechStars... 2m for AngelPad. What about YC?

<comment><USER9> Back in YC S'08 pitches were between 5-6m. Now with so many teams I believe they're around 2m.

<comment><AUTHOR> AP had 12 teams demoing, and TS had 10. How many teams at YC?

<comment><USER9> Back in '08 there were around 21 teams, now I believe there are around 60 teams.

</comment></comment></comment></comment><comment><USER10> Scuttlebutt from the Seattle network says valuations are lousy there as compared to the bay area. Did you happen to notice anything either confirming or contradicting that?</comment>


Why I am Switching to a Paid Email Newsletter - <AUTHOR> http://savemefrombschool.com/2010/07/why-i-am-switching-to-a-paid-email-newsletter/

<comment><USER2> The goal of getting 9000 readers to sign up for a newsletter which costs $2 a month is certainly ambitious.

The concept reminds me of [http://www.kk.org/thetechnium/archives/2008/03/1000_true_fan...](http://www.kk.org/thetechnium/archives/2008/03/1000_true_fans.php) where it's postulated that to survive as an artist, you would need a 1000 true fans.

<comment><USER3> She was referencing 9000 subscribers as what it would take to equal Daring Fireball's ad-generated revenue ($234,000 USD annual according the article). Amanda said she only expects her offering to top out at "maybe a few hundred" subscribers.

Still ambitious, in my opinion.</comment></comment>


Does meditation boost your creativity? - <AUTHOR> http://blog.lift.do/does-meditation-boost-your-creativity/

<comment><USER2> I've often wondered this and experimented myself with meditation from time to time. I do have a little ritual I do before I start coding that helps me reach _the zone_ , that is basically a small meditation:

1\. I close my eyes and try to think of nothing except what I'm about to do. 2\. I focus on my breathing. 3\. I envision myself coding with everything going smoothly, I'm in the zone.

I do this for a few minutes and try to maintain my focus, seeing myself coding with a big smile on my face. Then I get to work. It helps on days where distractions are especially tough and my mind seems like a huge mess.

<comment><AUTHOR> Interesting technique. It mirrors with what Colzato recommends about short meditation sessions before a meeting. There's something about sitting quietly before the work that "shifts" your mind into the right state.

The problem I think many of us who work in large, open-space offices, will encounter is finding the right place to do just that.

<comment><USER2> I actually learned this from a sports trainer, a skydiver specifically, who recommended the book _Mental Training for Skydiving and Life_. When I used to skydive I would use techniques outlined in that book to prep myself. It was basically all about envisioning success and driving all other thoughts out of your mind. Athletes do this before an event. It actually goes into more thorough techniques where you "rewind" and "fast-forward" your visions of success. It's the whole "what the mind believes it can achieve" and helps you get into the zone.

I agree about the work spaces, it's can be hard to get a moment by yourself, let alone one where you can close your eyes for a few minutes without being disturbed. In those cases I end up putting on my head phones and doing it anyway. I probably look like a weirdo :D</comment></comment></comment>


How to hide faces and scrub metadata when you photograph a protest - <AUTHOR> https://www.theverge.com/21281897/how-to-hide-faces-scrub-metadata-photograph-video-protest <comment><USER2> At what point does this become self-defeating? The government already knows who's who, no redacted footage will cover anyones tracks, this just erases history. Or does this imply it is strictly for illegl activity? If your face is public, its public.

Faces are what make you emphathise. Do you see any dramatic anonymized photos in the news changing hearts?</comment>


Transforming an accumulating mundane recursive fn into a tail-recursive fn - <AUTHOR> http://blog.fogus.me/2011/03/08/transforming-an-accumulating-mundane-recursive-fn-to-a-tail-recursive-fn-with-clojure/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+clojure+%28Planet+Clojure%29&utm_content=Twitter <comment><USER2> In Haskell, the decision gets more complicated. It's one of the few functional languages, where you often want to avoid tail-recursion.

<comment><USER3> Maybe you're thinking of `foldl`, which happens to be tail-recursive. The reason it's avoided is because it can unnecessarily eat up O(n) space due to laziness. The issue is avoided by using the strict (and also tail-recursive) `foldl'`.

<comment><USER2> Yes. Or depending on what kind of result your fold should produce, you may be better server with foldr, which actually benefits from lazyness.</comment></comment></comment>


How Obamacare Could Unlock Job Opportunities - <AUTHOR> http://www.nytimes.com/2014/02/23/magazine/how-obamacare-could-unlock-job-opportunities.html <comment><USER2> As someone in my 20s, when theoretically I can afford the risk of entrepreneurship (no financial or familial obligations), Obamacare would make it harder for me. I looked at getting health insurance when I was unemployeed, it was reasonable. Now the cost for me has doubled for comparable coverage. That would make it harder for me to afford living expenses while I trying to be an entrepreneur.

Also, just based on the title:

Perhaps one day there will be Professional Healthcare Navigators. People you actually pay a fee to so they can find you a plan that will save you thousands or more a year. Just like professional tax return preparers once the tax code/law got too crazy.

<comment><USER3>
      ...just like professional tax return preparers once the tax code/law got too crazy.

<grin>I love unintended consequences.</grin> What you mention is an important knock-on effect. There will be entrepreneurial jobs created that are new because of this. There was a _NY Times_ story on HN recently [can't find it now] about medical scribes: assistants who follow around physicians all day and update the electronic health care record-keeping systems. They free doctors from data entry so the doctors can doctor patients. My PhD thesis was originally about classified information in the intelligence community---but you know what? It's not about that at all; it's about health care records privacy, and insurance companies acting _just like_ competing national intelligence agencies---and the same security controls work in both situations.

You think NSA has a file on you? Wait until you see what kind of privacy violations that Aetna, Kaiser Permanente, and Protective can get up to. There are new companies to be started in this area.

Edit: explain what medical scribes do

</comment></comment><comment><USER3> This is an extremely important point; "job lock" has been acting as a brake on the US economy since at least 2007--8, maybe earlier, and the outlawing of "pre-existing condition" redlining practices by insurance companies benefits the vanguard of Gen X at least as much as millennials gain. Have you ever _tried_ purchasing health insurance as a individual? The difference between last year and this year is stark.

<comment><USER4> No kidding-- this year it's 30% more expensive, at least for me.

<comment><USER3> Mine (individual purchased, for a family of three) increased slightly, from about $850/month to $880/month, but the cost for office visits went down and the cost of prescription drugs went __WAY __down.</comment></comment></comment>


How I stole $145 from Google and didn't get caught - <AUTHOR> https://hatmer.github.io/2017/Google/ <comment><USER2> > we can use a multi-IP cluster deployment script to process the dataset > faster and without getting caught by the IP filters

Admitting to violating a ToS _with quantifiable damages_ is generally not a smart idea.

<comment><AUTHOR> I agree. It was for a research project. I would be happy to pay the $145 plus interest if Google would like to bill me.</comment></comment>


Facebook introducing GIFs in some pages and posts - <AUTHOR> http://techcrunch.com/2015/08/20/facebook-gif-ads/

<comment><AUTHOR> can their reluctance be because of things like this [https://github.com/videlalvaro/gifsockets](https://github.com/videlalvaro/gifsockets)</comment>


OnionView, a graphical depiction of the Tor network - <AUTHOR> https://onionview.com/?relaytype=0 <comment><USER2> There are surprising number of exit nodes running on Windows 7. Home subscribers on DSL and cable connections. Isn't that rather "suicidal"?

I assumed that nearly all would be running on Linux in data centres somewhere.

</comment><comment><USER3> An exit relay in Greenland...

</comment><comment><USER4> Url changed from [http://www.wired.com/2015/09/mapping-tors-anonymity- network-...](http://www.wired.com/2015/09/mapping-tors-anonymity-network- spread-around-world), which points to this.</comment>


How much does a responsive web design cost? - <AUTHOR> http://bradfrostweb.com/blog/web/how-much-does-a-responsive-web-design-cost/

<comment><USER2> Some notes of guidance from a recent recode and redesign (which included making the site responsive / mobile web friendly) of a site with a medium- sized code base. YMMV.

1) Test multiple versions as you go. If you're targeting, let's say, three widths (320px, 321-999px, 1000+px), whenever you make a change, test it in all three. It can be frustrating at first, but it can save you a lot of trouble later.

2) Use a service like BrowserStack, which will relieve you from having to possess each piece of hardware/browser combo and from running (sometimes slow) device emus/sims locally. Extremely handy, and will probably save you a lot of time and annoyance.

3) Keep in mind device orientation. What looks just fine in landscape may look squished in portrait, and what looks just fine in portrait may look like it's lost in the big empty in landscape. Percentages may be your new best friend in responsive-land, but you still may need to tweak anyway.

4) Think about places where the direct handling of mobile gestures make sense. Things like slideshows and such work well here. Touchable (requires jQuery) is helpful here for a low-impact solution: <https://github.com/dotmaster/Touchable-jQuery-Plugin/>

5) Remember that things like the "hover" event don't work (yet/ever) on touch platforms, so if you were relying on that to signal something, you'll need to change your signal to something clearer for that environment.

6) Think carefully through interactive elements, especially ones that rely on 3rd parties. Your map-based application will likely need a bunch of work. Your giant sidebar widget for showing the latest posts on FaceTweet+ might need to go.

7) Mercy for those on 3G (or worse.) Not every person is going to be on a nice quick Wi-Fi connection, so think carefully about which files (images and scripts, mostly) you'll need and how you'll load them. The responsive image battles are still simmering, so you do have some choices to make, all of which involve at least some degree of ugly hackery (multiple sizes with server-side selection? Demand-loading via AJAX/AHAH?) Same goes for extra JS - are you really going that fancy animation or 500k bottom bar?

8) Ads. If you've got 3rd party advertisers/sponsors, you probably want to check if they have appropriately sized ads for you. Both scaled and down and scrollbar-forcing ads are no fun at all.

9) Navigation. Fat footer? Starbucks-style expandable list menu? Both? Other?

10) Fingers! 8px between elements rule-of-thumb is a good starting point. It may look great, but if people are tapping the wrong things constantly, they'll get annoyed.

HTH

</comment><comment><USER3> For a web developer creating a website these days by himself it's starting to get daunting, there's so much things you need to consider that you really need to start working with other people if you want to get your project running in a fair small amount of time and have a solid project.

Today you need to consider: responsive design,javascript frameworks, css frameworks, LESS, websockets, nosql vs rdbms, server-side frameworks, good quality design, good UX, cross-browsing etc..etc..

Back in the old days we didn't consider or even thought of half of this, not that it was better, obviously not, but most of us learned gradually. I would hate to be a programmer and have to start learning all of this from scratch :X , the entry barrier is much higher now, it's sad.

On the other hand, mobile apps don't have all this fat around, you can easily build an app by just using the APIs and focus on design and UX

<comment><USER4> You're glossing over the fact that for mobile apps you need to develop a separate app for each of the major mobile platforms out there, using a different toolset, process, and language for each one. Surely that's no less daunting than dealing with browser compatibility as a web developer.

</comment></comment><comment><USER5> I can't stress enough the truth in what he says about ongoing maintenance costs being higher when launching a site with separate codebases for different screen sizes. This is really what sells responsive sites in my opinion: Focus.

Have two versions of your site? When you integrate a new feature you have two sets of problems. Two sets of tests. Two sets of, well... everything.

This is almost doubly so when it comes to content strategy. With two versions of a site it's often been my experience that one or the other (usually mobile, but I expect that to change) starts to count as little more than an afterthought and tends to degrade over time. A single responsive codebase really forces a lot of tough content questions to be asked and allows a simpler path for those problems to be solved.

This isn't to say that you shouldn't do what's best for the project. A somewhat hybrid example is what NPR has done with their native / web app ecosystem. Their content is often being pulled from a single data store and brought into different presentation layers (native mobile apps on devices, HTML on the web) as needed.

<comment><USER6> "A single responsive codebase really forces a lot of tough content questions to be asked and allows a simpler path for those problems to be solved."

Sounds like approaching the problem from the wrong direction. The primary ingredient of a site is the content. The content informs the design. The moment the design forces the content is the moment the design fails to be a design, and probably becomes decoration.

If the content is conducive to a responsive design, by all means consider a responsive design. But if the content isn't conducive, don't force it into a responsive design.

</comment></comment><comment><USER7> How many other people played with the width of their browser immediately upon following the link?

</comment><comment><USER8> Interestingly, we asked a related question during Customer Development for our startup:

Will You Pay for a Responsive Redesign? - [http://blog.roveb.com/post/15394363841/will-you-pay-for-a- re...](http://blog.roveb.com/post/15394363841/will-you-pay-for-a-responsive- redesign)

<comment><USER9> From your post "Update 17 Jan 2012: Of the top 100 sites most visited on the internet, 71 of them have content specifically designed for mobile devices." \-- I feel like websites with extremely large budgets (top 100) would currently be best served by mobile specific sites because they don't have to worry as much about the costs of updating/testing multiple different sites that most others do.

That being said, as the number of different mobiles devices quickly rises it will soon become near impossible to maintain a mobile site specific to every device.

</comment></comment><comment><USER10> One thing I wished the article addressed was the usability of responsive sites vs. dedicated mobile sites. In the majority of cases, I find dedicated mobile sites more user friendly on smaller (smartphone-like) devices than most responsive desktop sites.

<comment><USER11> The trade off, is, well, now you need a dedicated mobile site. Subsequent changes to your codebase suddenly require twice the effort, since you're changing two different sites.

<comment><USER12> No, every change to a responsive site can break other resolutions/media queries without your knowing. Or do you routinely view your site on an iphone, Android, ipad, Kindle, netbook, laptop, and 30" monitor?

You're claiming responsive comes for free, or is no harder than purely non- responsive. Definitely not true.

</comment></comment></comment><comment><USER13> Responsive design means that the flight to themes/frameworks will only increase. The effort to develop & test is doubled and relying on a foundation is no longer a "nice to have".</comment>


Wireless carriers reportedly surprised by Apple's iMessage feature - <AUTHOR> http://www.appleinsider.com/articles/11/06/06/wireless_carriers_reportedly_surprised_by_apples_imessage_feature.html <comment><USER2> Now this is the BIG HIT !!! Americans send more messages than overall facebook & twitter status updates daily !!!

So who said apple cannot go social ? Android, do something !</comment>


Andrew Wyeth, His Critics, and Small Town Mud - <AUTHOR> http://the-easel.com/essays/easel-essay-andrew-wyeth-his-critics-and-small-town-mud/ <comment><USER2> I've always thought that Andrew Wyeth's paintings were more troubling than comforting. I know nothing of the man and his politics, but to me there has always been a pensive sadness to the work.

I love the classic Mad Men scene that describes nostalgia as "the pain of an old wound" [1]. That's the most apt description I've encountered and I think much more of what we are dealing with in Wyeth's paintings.

[1] [https://vimeo.com/20736616](https://vimeo.com/20736616)

</comment><comment><USER3> My granddad met Andrew Wyeth and is good friends with his son Jamie, who's also a painter. There were a lot of famous artists involved in NASA's art program in the 70's [0].

> "Why Do Critics Still Hate Andrew Wyeth?"

At least from what I've been told it's because he and his family became really wealthy (I've seen the Ferraris). And he mostly rejected the whole art scene in NYC. Glad that that's pretty consistent with the article.

[0] [https://en.wikipedia.org/wiki/Jamie_Wyeth#.22Eyewitness_to_S...](https://en.wikipedia.org/wiki/Jamie_Wyeth#.22Eyewitness_to_Space.22)

<comment><USER4> I think the article is saying that it's about his politics and theoretical stance rather than wealth. You can be wealthy and popular in the art world.

I can't speak to this case in particular but there's usually inside knowledge involved in art world assessments. The work might look good but if you've met the artist and he/she is an idiot, or they disdain every living and dead artist you like... Well, it's difficult to sustain a positive critical opinion.

That might sound irrational, but I think it's justifiable as a result of the fact that people and human relationships are more complex and important than artifacts.

</comment></comment><comment><USER5> _Christina 's World_ hangs in MOMA, not far from many of the most famous paintings on the planet.

It's not out of place; I found it striking. See if you agree.

You owe yourself a few hours on the 5th floor of MOMA in NYC, it's great.

</comment><comment><USER6> That isn't just a dead deer. It's half a winter's worth of meat.

<comment><USER7> That's the beauty of art isn't it - it's open to interpretation. It is interesting that you see it that way. My knee-jerk reaction to feel intensely sad for the deer but it is informed by my background as a vegetarian born in a warm climate.

The painting tells me a lot about myself and my biases.

<comment><USER6> I've never known a hunter who enjoyed killing, or sought to inflict suffering; indeed the primary standard of skill, especially with a rifle, is that one's prey drop on the spot, and should death not be immediate, one uses one's knife to deliver a _coup de grace_. This has been the way of all the hunters I've ever known, and in the rural side of my family there've been many.

I don't mean to make it sound like some sort of spiritual thing; it is not possible to have helped clean a carcass and still romanticize the practice of hunting. I explain it to substantiate this statement: the deer immortalized in that painting almost certainly died quickly, cleanly, and with a minimum of fear and pain. Of all the creatures likely to predate upon a quadruped herbivore, humans are the only ones who worry at all about that sort of thing, much less consider such outcomes worth effort to produce.

It speaks well of your kindness to sorrow at the death of a deer, and I don't mean to suggest that you shouldn't. But there are nuances here which are easy to overlook absent direct experience, and having seen them much closer to than many, I thought I'd take the time to explain a bit, in the hope that it might be of some little value to you.

</comment></comment></comment><comment><USER8> Thank you for posting this, I hadn't thought about AW for years. It is an interesting angle.

</comment><comment><USER7> Anybody interested in Andrew Wyeth (and general appreciation of illustration as art) should check out David Apatoff's blog - Illustration Art.

Blog - [http://illustrationart.blogspot.in](http://illustrationart.blogspot.in)

His post on the passing of Andrew Wyeth - [http://illustrationart.blogspot.in/2009/01/andrew-wyeth- abst...](http://illustrationart.blogspot.in/2009/01/andrew-wyeth-abstract- painter.html)

</comment><comment><USER9> I always preferred the father, N.C. Wyeth. He did some fantastic paintings for illustrated editions of classic literature.

If you're ever in Rockland, Maine, the Farnsworth Museum[1] has an extensive collection of works by the Wyeths.

[1] [http://www.farnsworthmuseum.org/](http://www.farnsworthmuseum.org/)

</comment><comment><USER10> I've loved Andrew Wyeth's work since an exhibit of it came through our small town art museum. I wondered at the time how that tiny, unprestigious spot could attract works of such quality. I guess I know now.

It's unfortunate that there aren't high quality reproductions of many of his works.</comment>