Why maps have north at the top - <AUTHOR> https://kiwihellenist.blogspot.com/2019/07/why-maps-have-north-at-top.html <comment><USER2> More about map orientation in different cultures at [http://www.bbc.com/future/story/20160614-maps-have-north- at-...](http://www.bbc.com/future/story/20160614-maps-have-north-at-the-top- but-it-couldve-been-different)</comment>


The booming Y generation - <AUTHOR> http://www.usatoday.com/money/workplace/2005-11-06-gen-y_x.htm

<comment><USER2> Wow. There's a whole generation with a new explanation.

Casual dress.

</comment><comment><USER3> Brilliant, I feel like it's describing me to a T.

</comment><comment><USER4> what's with the 2005 articles?</comment>


How to blow up a server in one mouse click - <AUTHOR> http://scripting.com/stories/2010/10/06/howToBlowUpAServerInOneMou.html <comment><USER2> The server is running on EC2. As far as I can tell, EC2 does not have a virtual console interface or any other way to rescue a server that blocks all network connections with a firewall.

</comment><comment><USER3> Virtual machines run on physical machines. Physical machines can have stuff plugged into them and can probably run a VM app.

It's a hassle, sure, but if you're hosting this elsewhere chances are this isn't the first time this has happened, and if you're hosting it yourself then problem solved.

</comment><comment><USER4> Why would you have to completely re-provision a machine just because you turned the firewall on?

I'm guessing maybe this is a VM?

Either way, I tend to prefer hardware firewalls over software firewalls for this reason ESPECIALLY on Windows. With a "real" firewall, you can generally maintain a connection to the firewall (if you've set it up right), and that way if you firewall off the wrong port and need to reverse something you can still do so.

<comment><USER5> Isn't that what he says?

"And this is a completely virtual machine, there's no keyboard, no big red switch, no physical reality with which to fix this."

<comment><USER4> Oops, yeah. I missed the "virtual" part. That's what I get for reading/commenting while on a conference call and working on a remote desktop session...

</comment></comment></comment><comment><USER5> I think changing firewall rules remotely is _one of those things_ where it pays to be extra-careful, and then make sure you have access to the console (or physical access) for when you inevitably mess it up and lock yourself out.

</comment><comment><USER6> What? How does he not have access to a serial console or something?

</comment><comment><USER7> If you can get a command prompt, you can just run:

netsh firewall set opmode disable

Tragedy averted.

</comment><comment><USER8> Why couldn't he reach port 5337 if the firewall was turned off? Doesn't make sense.

<comment><USER9> True. Maybe he assumed that when the firewall was off, everything was blocked (forgetting about the remote desktop).

<comment><AUTHOR> It's a good question why 5337 wasn't accessible, but it wasn't.

That's why I was clicking around looking for reasons when the OS asked this question (which I answered too quickly without thinking).

No matter, I've already provisioned a new server to take its place, and terminated the old one.</comment></comment></comment>


Need to turn my life around - <AUTHOR>

I am very serious about this post.
I am 30 now, left my job in May.
I have 1.6 million dollars.
I have no idea what to do with my life.
I am stuck at home, stressed out every day, probably very depressed, can't seem to stick with any positive habits that I start.
I get very overwhelmed with thinking about how I'm 30, and it may be until I'm 40 until I can start adding value to the world again.
I also think, surely there must be a shortcut for someone who already has this kind of money, but I have asked around so much, I think I'm on my own.
I have always enjoyed reading through this website, and I am an entrepreneur by heart, but I just have never actually done anything.  I shoot everything down before I do it.  Not scalable, too small, someone else has done it, I'm not smart enough to do that, etc...
This is probably such a stupid way to approach such a question, but I have been 'stuck' for 7 months now, and I am getting worse.
Suicide crosses my mind daily, but I'm not thinking about doing it, I just mention it because that's how hopeless I feel.
I feel like I'm going to burn through my money at some point, or the market will crash, and I will be done.
I have always had big dreams, but when I'm faced with actually doing them, it seems too big.  Too grandiose.
I need something.  If you can give me anything, I don't care what it is, I need some kind of direction to get started.  I am ready and willing to do anything, because my other options are not looking too good.
Sorry for the depressing post, but if I do become successful, I will be paying it forward in a big way to the people here.  You guys are special, and have already helped me get to this point, which was a big step from where I was.  I know that sounds funny, but I was on a one way track to nowhere.  Now I have some sort of direction, but I need more.  I need to get out of being stuck. <comment><USER2> Start by volunteering.

If an idea of where to do that just popped into your head, do that. Otherwise, Google for the closest religious organization to your house and head over there. In person, right now. It doesn't matter if you're religious, most of them do generally humanitarian work. Tell them that you're trying to get involved in the community and ask to join the next available event.

We talk about changing the world, often through the application of extremely abstract skills to fairly abstract problems, but it sounds like what you need is tangible feedback about the impact of your work, and a warm flesh-and-blood community to be part of. This comic is a poignant example of how unfulfilling abstract work can be, even if it's important: <http://www.smbc- comics.com/?id=2305>

Here's the thing - you do not have to do this one-on-one stuff for very long. This is just a step to open you up to the world at large, and create a tangible sense of progress. Soon, I'm sure you'll notice some way to make a slightly bigger difference, because you've been surrounded by important problems, big and small. You'll do that, and see how you could expand it, and do that. You will be doing more and more generally powerful good, but it will be grounded in your tangible experience.

After that, just keep focusing on your next mountain, even if you've heard stories that someone once climbed Everest. Just keep moving.

Finally, please PLEASE find someone to talk to if you think you're feeling depressed. If it turns out that you're not clinically depressed, great! If you are, getting help is incredibly important. Getting back in action is worth every penny that it will cost, both from the prospective of your well being and ability to contribute to society.

</comment><comment><USER3> So many things one could say... I actually just watched a movie called "Happy" earlier today, watch that (it's on Netflix) and report back. You have a tremendous opportunity to make a positive impact in this world, heck I'm sure you already have in many ways. Cheer up : ) "I say, follow your bliss and don't be afraid, and doors will open where you didn't know they were going to be."</comment>


Arch or FreeBSD - <AUTHOR> Which has a better networking stack. For large files freebsd does (Netflix uses them). What about a web crawler? Still Freebsd or doesn't matter? Can't find anything online comparing network stacks nd performance.<p>Thanks <comment><USER2> You are not going to find any appreciable difference. Any obvious perf improvements have already been ported from one to the other.</comment>


The McDonald's Quotient - <AUTHOR> http://www.themacro.com/articles/2015/12/the-mcdonalds-quotient/ <comment><USER2> I agree totally - there are very valuable insights one can gain in any "unskilled" labor context that will serve them well throughout the career: time discipline, customer/public relations, personnel management (if you become a manager) and its pitfalls, inventory, having one's limits tested, having one's _patience_ tested, having one's _sanity_ tested...

When I was in high school, most of my peers had such jobs. Nowadays, most college students (or even recent _graduates_ ) I know have little or no wage work experience. It's not a good thing, IMHO, and not just because it worsens student debt.</comment>


Randomness Is a Hard Challenge for Computers - <AUTHOR> https://www.kkhaydarov.com/random-and-pseudorandom-numbers/ <comment><USER2> The pizza in the article looks horrible. But random.

I don't see why the author states randomness is a hard problem then proceeds to show various ways of creating it via imagery. Lava lamps also work. [https://en.m.wikipedia.org/wiki/Lavarand](https://en.m.wikipedia.org/wiki/Lavarand)

<comment><USER3> Because they never explain or explore the particular qualitative definition of randomness that is difficult: unpredictability. Computers do indeed suck at this, which is why you need to attach specialized devices to feed it unpredictable bits.

Random is an overloaded term. You can algorithmically generate statistically random distributions which are nevertheless easy to predict given some previous state. That form of randomness is useful for many things, but lethal in cryptographic systems. Moreover, proving that some distribution is unpredictable--and that this unpredictability is preserved within the larger system--is _really_ difficult.

To be even more technical, there are different ways to categorize unpredictability: quantum, thermodynamic, mechanical, computational, etc. The former relate more to how you physically generate unpredictable states from physical phenomena while the latter relate more to qualitative degrees of unpredictability. A thermodynamic generator may only be mechanically unpredictable (i.e. unpredictable because it's impractical or perhaps impossible to capture the necessary state needed to predict the next sequence), or it could be unpredictable in the quantum sense (there exists no state that you could ever capture sufficient to usefully predict the next element in the sequence), depending on how you model the fundamental physics. These distinctions matter when you want to analyze the consequences of, e.g., using a real-time video feed of a lavalamp to feed a CSPRNG.</comment></comment>


Ask HN: Best FOSS and/or Linux Blogs - <AUTHOR> I'm a little bored with my usual sites and was wondering if the HN community could recommend some good sites that have new content daily or at least every couple of days? Reddit subs are cool too. Thanks in advance. <comment><USER2> get a vpn and then google different linux seaches from different countries, brings back stuff ya probably never saw</comment>


I abused 2FA to maintain persistence after a password change - <AUTHOR> https://medium.com/@lukeberner/7e3f455b71a1 <comment><USER2> I think this attack is slightly overrated by the other commenters (and those that say it defeats 2FA are wrong).

Here is the scenario he posted:

      > An Attacker enables 2FA in Victim's account.
      > In another browser, Attacker waits indefinitely in the 2FA input page (Image 1).
      > Attacker disables 2FA.
      > The Victim regains access to the account (changing password & resetting sessions)
      > Then the Attacker could input a valid 2FA code and have access again to the account, without knowing the current password.

So to summarize:

\- The attacker needs the password of an account that is _not protected by 2FA_.

\- It allows the attacker to stay connected after a password change (usually, when a password change occurs, it logs out the user of all platforms).

In fact, 2FA protects you from this vulnerability : just activate it for your account and you are not vulnerable to this attack (the attacker cannot connect to your account in the first place, since he doesn't control 2FA tokens).

Moreover, if your account doesn't have 2FA and someone finds out your password, well I think you are already deep in trouble (the attacker could do many more things, since he's already connected).

So this attack is still a big deal (the user can't disconnect you) but it doesn't break 2FA security at all. It just adds a vulnerability to accounts that don't have 2FA enabled.

<comment><USER3>
      > (usually, when a password change occurs, it logs out the user of all platforms).

That is what seems to be broken by this attack. You are not properly logged out when all sessions are closed, and you can manage to login without knowing the current password.

No, it does not break 2FA. No, it does not work if you have 2FA enabled.

<comment><USER4> I mean, it may well work if you have 2FA enabled (it depends on whether you can set up two different 2FA options and force the login provider to use the stale one) -- but you do have to hijack someone's account which is indeed considerably harder if they have 2FA enabled.

Security can roughly be described as "the inability to do something surprising, measured in dollars." The surprising thing here is that under some circumstances you might feel like you have "reclaimed your account" (by disabling their 2FA method and resetting your password) only to find out that you have not (because an authentication session dependent on the stale method and password is still "live in the system" and can be used to log in to your account). The distinctive thing is that this can be done for the low low price of just keeping a website open in a spare tab, but it requires a previous vulnerability to have paid the high price of hijacking the account in the first place.

What's interesting is that these sorts of it-makes-surprising-things-a-lot- more-surprising scenarios is that there are kind of two different equally- valid measurements of their security implications, one high and one low. In a total-cost-of-attack sense, yeah, you have to incur the cost to hijack the account in the first place and this means that if they're doing things right this is an "expensive" attack and therefore the service is still secure. But in a marginal-cost-of-adding-this-attack sense, this is a very cheap attack and points to the login flow having a deep security vulnerability. So it's contextual whether the system is secure or not.

That of course probably won't be news to anyone who works in security, I suppose -- they are used to security not being a monolithic thing that everything is easily classified as yes or no. (Like, if you have seen the different attacks on hash functions you already can appreciate "is this secure?" depends on what you're trying to do with it -- and that's bog- standard everyone-in-appsec-knows-that knowledge.)

</comment></comment></comment><comment><USER5> Instagram: "[the attack] seems unlikely to happen commonly, making this more of a theoretical attack. The protection in this case is to not allow someone to steal your password"

LOL

Isn't the whole point of MFA to protect the theft of the one of the authentication tokens? and the password is the most likely to be stolen / compromised imho.

<comment><USER2> If you activate MFA, you are not vulnerable to this attack (see my top-level comment)

<comment><USER6> The point is that if Instagram thinks that people getting their passwords stolen is an important enough problem to offer MFA, then an abuse of MFA that only affects people who have their passwords stolen should be an equally important problem.

<comment><USER7> Not necessarily.

Instagram knows that people password spray its service regularly and that many popular accounts are often targeted for takeover by scammers. This is a common problem for them and happens regularly They also know what those threat actors do once they get an account.

I'm betting this scenario isn't one they see happening after an account is compromised or is easy to detect etc, and for those reasons the risk is different. How likely a vulnerability is to be exploited plays an important part in deciding the risk it carries.

</comment></comment></comment></comment><comment><USER8> Interesting but far from an account compromise on it's own. You still need to know the user's password in the first place and, I believe, you can't repeat the attack once they change their password. So if they change their password a second time or enable MFA themselves you're blocked permanently. So it allows for a existing attack to be prolonged one time and possibly makes it harder for a user to realize they're still compromised.

I can see some value in a targeted attack on an individual although only if they don't respond by turning on MFA themselves.

</comment><comment><USER9> I've noticed that multiple sites that have two factor enabled give you the option to add a device, but not list or remove existing ones (without wiping them all).

At a glance, Google does not seem to enable you to do this, but might actually do it behind the scenes anyways.

<comment><USER5> I've seen some companies (Cloudflare springs to mind) which requires a support ticket to disable MFA on a user's account. It's a little tedious but does add an extra hoop for an attacker to jump through.

</comment></comment><comment><AUTHOR> I am wondering, why Instagram and MS did not react and fix this issue. And I am wondering, what one can do, if "forced" to use these two.

IG I am using privately, with my FB login. That works with a dedicated email address and password. So ok - one could hack that and do stuff. Well bad, but ok. But MS? I am forced to use it in the company setting I am in. What to do to secure this more?

<comment><USER10> Enable 2FA yourself. That way if the attacker manages to get your original password, they won't be able to login and enable 2FA themselves.

<comment><AUTHOR> Thanks. Didn't read that right in my OP

</comment></comment></comment><comment><USER11> > The protection in this case is to not allow someone to steal your password

Im sorry, but what?

"Oh you got stabbed? Well, next time, dont"

<comment><USER12> If they trust so blindly in the security of the password, why even have 2FA?

<comment><USER13> 'All relevant cool sites are expected to have 2FA'

Twitter would be very criticised if they didn't have it.

<comment><USER12> So 2FA as PR rather than actual security.

<comment><USER14> You'll realize how much this is true when you see how many people will lambast you for not implementing 2FA vs the handful of people who will actually use it once you implement it.

It's like when McDonalds caved and started offering salads. The people saying McDonalds made you fat were happy, yet nobody actually orders salads from McDonalds.

</comment></comment></comment></comment></comment><comment><USER15> An easier and more reliable, way to get persistence is to add an app code...

</comment><comment><USER16> One of the most useless hacks I've ever seen

</comment><comment><USER17> So - like with compromised hardware - if an accounts get hacked, better throw it away.

If you have any data in there, it might have been compromised anyway.

</comment><comment><USER18> tldr: An attacker that compromised an account can maintain access even after user changes password. Exploit vector uses 2FA.

imo not a big deal as a prerequisite is a breached account which is game over already.</comment>


Djata: A Django REST Data API App - <AUTHOR> http://github.com/fastsoft/djata

<comment><USER2> There's also Piston: <http://bitbucket.org/jespern/django-piston/wiki/Home>

</comment><comment><USER3> From my first impressions this looks like another REST API that does the same thing to every kind of model you have based on the HTTP request you make (create new row, delete row, etc.). However, sometimes when I get a DELETE I want to remove an attribute or something app specific rather than the row. I really enjoy the unfortunately now defunct django-rest-interface <http://code.google.com/p/django-rest-interface/>. Simple and does exactly what I need it to do.

<comment><USER4> someone is carrying the torch

<http://code.google.com/p/django-rest/>

</comment></comment><comment><USER5> That's a mouth full.</comment>


Google Alerts -- Are you using it to monitor mentions of your startup yet? - <AUTHOR> http://www.google.com/alerts I've found Google Alerts to be invaluable in monitoring mentions of the projects I work on. If you're not using it yet you probably should be. <comment><USER2> Yes. I have dozens of monitors setup. We have a lot of competitors, though I only really pay attention to the top two. But I don't mention any of what I learn to my co-founder (who does most of the core development), because I don't want our product to be driven too much by what competitors do. We have hundreds of customers ourselves...and they probably know what they want as well as anybody.

Anyway, it's easy to get side-tracked by outside stuff...so pay attention to your market, but not too much.

</comment><comment><USER3> I set it up after my site was mentioned on Mashable, I really like it.

</comment><comment><USER4> ...and mentions of your competition. ...and mentions of your space//industry as well</comment>


Having Frequent Diarrhea as a Child Shapes Your Adult Mate Choice - <AUTHOR> http://blogs.scientificamerican.com/bering-in-mind/2014/08/12/this-queasy-love-how-having-frequent-diarrhea-as-a-child-shapes-your-adult-mate-choice/

<comment><USER2> This is one of the worst-written articles I have ever encountered - I feel like I'm trapped in an elevator with an annoying 12 year old. Scientific American continues its long sad decline into tabloid dreck.

What actually matters:

 _The hypothesis for de Barra and his colleagues' study was therefore pretty clear-cut. Adults who are sickly in childhood grow up to prefer opposite-sex faces displaying exaggerated sex-typical features: testosterone-forged faces in men, that's to say, and ultra-feminine faces in women._

They used a longitudinal study from Bangladesh where diarrhea is closely monitored because it's a leading cause of mortality in children as the source data and found that people who suffered badly from illness as children developed a strong preference for hypertypical gender features compared to a control group. Diarrhea was selected as a proxy for childhood malaise because of its commonality.

<comment><USER3> I thought the part informing us that men cannot be inseminated was particularly educational and reflects the high levels of experimental research being conducted on behalf of this fine publication.

Though it does perhaps lack a certain rigor, as surely there is nothing to stop men being inseminated. It is merely that they are unable to then become pregnant after insemination, as other visitors to this planet can surely attest from their long running experiments on unlucky country folk. Which will no doubt be the subject of next months exciting issue.

<comment><USER2> Exactly. I have a chip on my shoulder abot this because up to about 15 years ago SA used to be incredibly good- a solid digest of non-specialist science education for about $100 year. I would happily have paid more, I considered the time and dollar cost involved well worth it for the intellectual exercise it provided.

Then they went downmarket in search of a circulation boost and it's been in decline ever since. I stopped reading the month I noticed that I had consumed the new issue in 3 hours rather than the usual 6, and took out an issue from a few months earlier to compare - turned out that they increased the font size and line spacing to produce a magazine with the same number of pages and the same price but about 30% less text. I hope an asteroid lands on their offices and reduces them to a smoking crater in the ground.

<comment><USER3> I stopped bothering with it ever since they cut the amateur scientist column.

I remember they used to cover stuff like sonoluminescence in there - [http://techmind.org/sl/](http://techmind.org/sl/) \- it was awesome.

Let me know if you ever want help working out candidate asteroids and how to achieve the required trajectory adjustments.

just found this though :) - [https://archive.org/details/TheAmateurScientist](https://archive.org/details/TheAmateurScientist)

<comment><USER2> Good finds! Feel free to drop me a line via (same name) at gmail - nice to find a fellow spirit.</comment></comment></comment></comment></comment>


World held hostage by hit-or-miss Covid-19 tests - <AUTHOR> https://asiatimes.com/2020/04/how-accurate-are-coronavirus-tests/ <comment><AUTHOR> > The meaning of a test result for a person depends not only on the accuracy > of the test, but also on the estimated risk of disease before testing. This > was described mathematically by Thomas Bayes and later explained by > Siddhartha Mukherjee as the law that "a strong intuition is much more > powerful than a weak test."</comment>


Ego Depletion - We may have an exhaustible amount of self-control, concentration - <AUTHOR> http://188.8.131.52/wiki/Ego_Depletion

<comment><USER2> Considerable discussion from 800 days ago:

<http://news.ycombinator.com/item?id=848839>

There are many other times that this has been discussed here on HN, but with no means of having cross-referenced them, they are a pain to find, and thus we repeat the same discussion with the same points again.

For those of you who are tired of hearing/reading me saying these sorts of things, this is absolutely the last time. I only wish I had the skill, background and time to implement some of the obvious solutions that would make HN a useful resource, as well as a source of new links, articles and discussions.

</comment><comment><AUTHOR> In case we reach the exhaustible amount of bandwidth: <http://www.mediafire.com/?v92bxi1m82uz4mz> [PDF screenshot]</comment>


I just subscribed to 60 blogs via RSS and maybe you should, too - <AUTHOR> http://meshedsociety.com/i-just-subscribed-to-60-blogs-via-rss-and-maybe-you-should-too/ <comment><USER2> This is the exact same path I'm heading down. I had hundreds of feeds in Google Reader and am slowly reconstructing my news sources after outsourcing to social media or a few blogs. What i would love now is a service that merges similar stories into bundles. I wonder if something could be made that can bundle opposite positions on an issue as well.

<comment><AUTHOR> "I wonder if something could be made that can bundle opposite positions on an issue as well"

This is a very interesting idea!</comment></comment>


Darpa Contract Awarded to Verify Blockchain-Based Integrity Monitoring System - <AUTHOR> http://guardti.me/2ciE3wp <comment><USER2> Guardtime is set of tooling around a FIPS 140 timestamping appliance. Systems on the network submit hashes of their logs to the time stamping. Assuming the appliance remains secure, you can go back in the event of compromise and prove that your logs are unaltered up to a certain point.

It's amazing that they seem to have built a $50 -$100 million dollar business here.

<comment><USER3> >> "Assuming the appliance remains secure"

Makes me wonder what mathematics would prove this, or if it's assumed to be out of scope, and if so, what else is out of scope too.

<comment><USER4> I'm pretty sure the Guardtime product is a Merkle tree of timestamps. I'm also pretty sure whatever protocol they use to maintain it would _not_ be immediately recognized as a "blockchain" protocol. Of course the protocol can be modeled and checked. The question is why does anyone think that this activity can apply to "blockchains" in general. But, welcome to the world of industrial research funding.

<comment><USER5> (I work for Guardtime; I'm happy to answer any questions.) Some online resources might not make it very clear, but the KSI blockchain is indeed a blockchain; for example, new blocks are released periodically (1 block per second on average), and the new blocks contain hashes of the previous blocks, among other things. Then, blocks get distributed around so that users can verify their data against these blocks, etc.

<comment><USER4> Most people associate "blockchains" with a protocol by which the "blocks" are inserted. Usually these things revolve around proof-of-work, proof-of-stake, proof-of-space, fairness criteria, etc. I think everyone gets that the Guardtime product is hashtree. From a formal verification perspective, the critical behavior is probably in the protocol, and most likely not the implementation of the datastructure or database.

<comment><USER5> One way to look at it is that KSI is a proof of stake blockchain where the stakeholders are (mostly) fixed. Often people would call that a private blockchain (or a consortium blockchain), to use the terminology from the following article:

[https://blog.ethereum.org/2015/08/07/on-public-and- private-b...](https://blog.ethereum.org/2015/08/07/on-public-and-private- blockchains/)

<comment><USER6> Thanks for that clarification! It is a great pleasure to talk with an knowledgeable person like you.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> It's cool that Galois got this contract. They're a very nice Haskell shop out of Seattle responsible for projects like Copilot and Cryptol.

<comment><USER8> Out of Portland, actually.

<comment><USER7> Yep, sorry about that!

</comment></comment></comment><comment><USER9> As far as I can tell from the article, they are using the same kind of technology which prevents people from falsifying their account balance on Bitcoin to prevent intruders from covering their tracks in a secure computer system.

<comment><USER10> Specifically, it's a Merkle tree. From what I can tell they're not using anything else relating to "blockchains".

<comment><USER11> The signature for your data that has been signed is a chain of hashes which is used to calculate back to the merkle root.

Wikipedia defintion of blockchain[1]

> A blockchain consists of blocks that hold batches of valid transactions. > Each block includes the hash of the prior block in the blockchain, linking > the two. The linked blocks form a chain

[1] [https://en.wikipedia.org/wiki/Blockchain_(database)](https://en.wikipedia.org/wiki/Blockchain_\(database\))

<comment> vertex-four The very next paragraph describes blockchain databases as peer-to-peer protocols with some form of scoring algorithm to decide which blocks are part of the chain.

<comment><USER12> This has now been answered by someone from the team

</comment></comment></comment></comment></comment><comment><USER13> I worked as a contractor for guardtime, and they're a great company, it looks like they are continuing to do great work in this area.

</comment><comment><USER6> For those who are interested in an underpinnings of KSI: [https://eprint.iacr.org/2014/321.pdf](https://eprint.iacr.org/2014/321.pdf)

</comment><comment><USER14> They keep using the word 'block chain'. Is that the same idea as the bitcoin blockchain?

<comment> TD-Linux No. The point of the Bitcoin blockchain is to provide ordering of transactions without a centralized timestamping service. This is a centralized timestamping service.

<comment><USER5> (I work for Guardtime.) KSI verification is meant to be decentralised; that is, no single (centralised) entity should have the ability to, for example, create fake timestamps. You can deploy KSI in various ways, so there can be, for example, one entity who controls access to the blockchain (but for example they still cannot fake any evidence).

<comment> TD-Linux Right, it appears you can have multiple physical tamper-protected boxes that agree with each other, which makes it federated, but not decentralized.

<comment><USER5> I tend to subscribe to the definitions laid out in the following article:

[https://blog.ethereum.org/2015/08/07/on-public-and- private-b...](https://blog.ethereum.org/2015/08/07/on-public-and-private- blockchains/)

</comment></comment></comment></comment></comment><comment><USER3> With something as important as blockchain verification, you would think DARPA would stop investing in private intellectual property.

<comment><USER15> Why is blockchain 'important' to Darpa? Because you are rooting for bitcoin or for some other non-specific to you reason?

edit: Updated question to be more clear of intention

<comment><USER3> The blockchain is critical current & future technology, it's future is independent of Bitcoin's future.

Bitcoin is the first implementation of a blockchain system, but it's a technology, not Bitcoin.

All major log systems will be based on it; governments, banks, military, voting systems, etc.

Highly suggest reading the Wikipedia entry on Blockchain to learn more and think about how you might use it too: [https://en.m.wikipedia.org/wiki/Blockchain_(database)](https://en.m.wikipedia.org/wiki/Blockchain_\(database\))

<comment><USER16> I'm a blockchain blockhead. Any more suggested reading?

Really basic like a) how will my debit card debit my money buying DD coffee?

If I create another book can I "get blockchain" (so to speak) to protect my work? Thus, I will need to make the right choice to be covered under a blockchain or not?

At 50000 ft I get the significance I think. I just cant even come close to explaining it.

<comment><USER17> I recommend "Mastering Bitcoin" by Andreas M. Antonopoulos. It provides great detail on how the Bitcoin network actually works, including the cryptography you need. Work through that and you'll know how blockchain payments work and have a good idea of how the technology can be applied to other areas.

It's available from O'Reily: [http://shop.oreilly.com/product/0636920032281.do](http://shop.oreilly.com/product/0636920032281.do)

</comment></comment></comment></comment></comment><comment><USER18> Quote: "Galois is a leader in formal verification, a technique that goes beyond testing and evaluation to provide mathematical assurances that a system works only as intended in all cases."

Wait -- _mathematical assurances that a system works only as intended in all cases_? That's not possible. It pretends that the Turing Halting problem[1] is soluble.

Not that this claim is at all uncommon. I regularly see similar claims about software validation, by people who either do not know, or who don't want to acknowledge, that this problem cannot be solved in the general case.

1\. [https://en.wikipedia.org/wiki/Halting_problem](https://en.wikipedia.org/wiki/Halting_problem) : "Alan Turing proved in 1936 that a general algorithm to solve the halting problem for all possible program-input pairs cannot exist."

<comment><USER19> Real computers are finite state machines, not Turing machines.

<comment><USER20> Correct but not relevant. No formal verification technique takes advantage of the fact that the computer has "only" 8 GB or RAM and 1 TB of disk space as its tape (~ 2^2^43 states).</comment></comment></comment>


Ask HN: Seeking Freelance iOS Developer - <AUTHOR>

Attempting to create a local advertising web app. The current version can be seen here: scatteralpha.appspot.com
The website is still a work in progress and improving every day.
Need your help with the iPhone app.
You will be building an engaging and beautiful iPhone app. The backend for the mobile app was created in parallel to the web app and is ready to go. You would be able to test it before you take on the project.
100% of your focus would be on UX and UI of the app.
I estimate the project to take 3-4 weeks (before you blast this estimate to kingdom come, lets talk)
We will agree on a very specific feature set. I ensure you that we will remain extremely focussed on those specific set of features and ensure (jointly) that there is no scope-creep.
Would love to discuss more, if you are interested. <comment><AUTHOR> Just adding a link to the companion site to make it easy to click: scatteralpha.appspot.com [Please think of the web front-end as an very early draft version!]

</comment><comment><USER2> Speak to this guy. Tell him i referred you

[http://z-prototype.com/](http://z-prototype.com/)

<comment><USER2> oops. scratch that. i didnt realise your reqmnt was UX/UI based.</comment></comment>


Problem for Bezos: Mall Becoming Cheaper Than Amazon - <AUTHOR> http://finance.yahoo.com/news/problem-for-bezos--mall-becoming-cheaper-than-amazon-160737573.html

<comment><USER2> Some things are cheaper off Amazon, yes. But for many people, myself included, it's far easier (and sometimes cheaper in the end) to buy from Amazon anyway, because the stores that sell them may be very far away from where we live. I'd rather pay $5 more and get it in two days than drive 50 to 150 miles each way to a store.

</comment><comment><USER3> This seems incredibly anecdotal. A box of thirty items from one store in one unknown city picked by an analyst trying to prove something, and all of a sudden Amazon is dead?

On top of that... they didn't factor in time, gas costs, convenience, etc</comment>


DTrace in the zone - <AUTHOR> http://dtrace.org/blogs/bmc/2012/06/07/dtrace-in-the-zone/

<comment><USER2> The most interesting thing to me was this statement halfway through:

 _Given this, the name of the subroutine was obvious: it had to be getf() — the Unix routine that does exactly this in the kernel, and has since Fourth Edition Unix, circa 1973. (Aside: one of the reasons I love illumos is because of this heritage: compare the block comment above the Seventh Edition implementation of getf() to that above getf() currently in illumos — yes, we still have comments written by Ken!)_

<comment><USER3> It may seem anachronistic or iconoclastic, but I appreciate this about the BSDs, as well. I love old code that's still doing the right thing.

I sure hope illumos can survive as a sustainable project. OpenSolaris was a gift. Oracle taketh away. It will be a struggle.

</comment></comment><comment><USER4> Troubleshooting with Dtrace specifically the Solaris variants (since Solaris contains the most probes) teaches you a lot of general Unix internals that usually only dedicated kernel/User land programmers would know.</comment>


Ask HN: How do you push your code to your server? - <AUTHOR> Most people write code on localhost then push to servers after testing. How do you do the second part? I've heard of git push, rsync, ftp, etc. I also know some people who just edit the code directly on the server over ssh.<p>What do you do? And how often do you push out code-- every few lines, or every hundred lines, etc.? <comment><USER2> I have built a custom tool Dploy(screenshots here[1]) for exactly this purpose. It's built using ASP.NET MVC.

To deploy a project (or a deployable, as I call it), you push to BitBucket. The latest changeset is then pulled using a post-commit hook.

Then it's just a matter of opening the Web GUI and press a button to do the actual deploy.

All manual steps are effectively removed. If the build/copy/whatever fails, nothing will break (hopefully).

Functions currently supported: * Real time output (using web sockets)

* Support for console applications, web applications (using IIS) and NServiceBus endpoints

* Run arbitrary post-deploy commands

* Show diffs so you know what you deploy

* Email notifications

* and more..

Planned functions: * Running tests

* Git support (currently Mercurial only)

* Arbitrary Windows services

* Special post-deploy commands depending on if you deploy up or down

* Deploy to other machines (local only at the moment)

It's not open source at the moment but i would love to do that. If someone want to help out, hit me up (nyquist [.] alexander @ gmail [.] com).

[1] [http://imgur.com/a/tIRr9](http://imgur.com/a/tIRr9)

</comment><comment><USER3> A similar question: how soon can you see results from a code change?

Another question: does pushing code interrupt the app?

I'm slightly embarrassed to say I hack on the server when I can, because it lets me have feedback quickly after a fix. It also helps stay focused; coding in a sandbox is boring by comparison.

</comment><comment><USER4> git push staging master

or git push staging dev:master

>just edit the code directly on the server over ssh.

Don't do that unless it is a _horrible bug fix. Like a security vuln you need to push immediately_. Take the extra time to put it into dev or whatever and then push / upload it to wherever.

>I've heard of git push, rsync, ftp, etc.

This really depends on what I'm doing. Obviously if I'm pushing to Heroku it is Git, but I also help out some local folk with the website about their farm fresh eggs. For the latter it is just FTP, because nothing more is necessary. (I I guess I do use a static site generator similar to [http://jekyllrb.com/](http://jekyllrb.com/))

</comment><comment><USER5> Github for source control. Codeship for testing, packaging, push to S3. Bash for pulling the releases from S3 and deploying them. This is all done with a help of SBT. I haven't been able to find something that replaces Bash but open to ideas.

</comment><comment><USER6> This is just for my personal site (wordpress), and probably isn't relevant for a webapp at scale:

a fabric script + git/Github

I develop on localhost and use a python script (with fabric) to manage deployment with git

>>fab git_commit: changes all the Wordpress url references in the database from localhost to production url, dumps the database, uses sed to replace localhost with production url in a few other files, and runs git commit.

>>fab deploy: pushes local repo to private Github repository, runs git pull on production server, and updates the production database from the database dump in the repo.

</comment><comment><USER7> We do everything on localhost with git. We keep a master (server) and develop (ready to push to master) and with develop we branch it off into different major features i.e. feature/login, etc. Once the branches are ready we push them into develop to bug test and when all's good we push the changes to master. We only push to master when the code has been somewhat significantly changed like adding a new feature or fixing bugs.

</comment><comment><USER8> say /var/www/html is where the code is served from.

Active symlink is maintained to the proper build which comes from (say hudson/jenkins)

Say the current symlink is /var/www/html -> build.v5

Below commands illustrate the sequence of the deployment via ssh for the next build number 6 (which can even be a no-op build)

tar jcf build.v6.tar.bz2 build.v6

scp build.v6.tar.bz2 prod-server:/var/www/

ssh prod-server 'VER=6; cd /var/www && tar jxf build.v$VER.tar.bz2 && ln -sf html build.v$VER && sudo service httpd reload'

Similar logic is followed with the help of git/etc. Idea is to 'keep versions' of your code. so that if things get messed up you can rollback quickly. Most people don't think of rollback, until it bites them really bad !

</comment><comment><USER9> You can try Secure Copy (scp) from your terminal. It uses ssh for data transfer and provides the same authentication and same level of security as ssh. Also, it transfers files and directories.

Examples at : [http://www.computerhope.com/unix/scp.htm](http://www.computerhope.com/unix/scp.htm)

</comment><comment><USER10> I use Dropbox to push data to my VPS.

BTW I edit code remotely using Vim + Netrw + SSH tunnel [http://motyar.github.io/14/vim_fast_remote.html](http://motyar.github.io/14/vim_fast_remote.html)

</comment><comment><USER11> I've got a few different approaches for deployments.

For static sites, which are built from templates, or by hand, I just deploy via rsync. This is nice and efficient, and is carried out over SSH which allows me to be secure in-transit and avoid having to enter passwords.

For dynamic applications I've tended to write simple recipes via fabric ([http://fabfile.org/](http://fabfile.org/)) which allows me to bundle up the local state of a repository, transfer it over SSH, and run a few commands.

For some things in the middle I use git pushes to different environments, but I'm trying to move away from that and into more scripted deployment via ansible, fabric, slaughter, etc.

</comment><comment><USER12> >I also know some people who just edit the code directly on the server over ssh.

I've edited js directly over sftp sometimes. But it was for a service for which the choices were ftp or a web editor which I refuse to use, on test pages. For Wordpress I have local installs of each site and a development install just for plugins, and I usually keep a backup on bitbucket and a test deploy on pagodabox.

>And how often do you push out code-- every few lines, or every hundred lines, etc.?

Not very often. Some of my personal projects can go months without so much as a look.

</comment><comment><USER13> I use Apple Script to produce builds for Android, iOS, and Server war files. For server SCP works really well and simple - I have intentionally not added in the Apple Script to transmit server builds.

</comment><comment><USER14> I wrote a small laravel deployment app where it will run a set of instruction when triggered. So from my localhost I will run git push origin -- master. Once pushed, I run php artisan command:deploy [app-name] [branch].

</comment><comment><USER15> We use Chef scripts for both app deployment and server spin-up. Fairly heavy investment at the start to build all the recipes, but it pays off big time in time saved later on.

</comment><comment><USER16> Code local, merge working branch into dev/master on github, deploy to dev/prod using deployhq.

I make a deploy whenever I deem a feature to be complete, rather than just basing it on line count.

</comment><comment><USER17> I sftp a .war file to a remote deployment directory. Old app gets undeployed, new app gets deployed.

</comment><comment><USER18> If possible git pull or svn updat on server, otherwise ftp or scp or war deployment via browser

</comment><comment><USER19> Here's what I do

1\. Develop locally, use Github/Bitbucket for version control

2\. ssh into my vps and use git pull

3\. Configure things like api secrets (ssh + vim)

If there is a bug that needs to be fixed, go back to local, fix, push, ssh, pull, deploy

[update] Formatting changes

<comment><USER15> We did something like this earlier on (we use Chef for deployment now). I just wanted to point out that if you're using git pull as your deployment tool, make sure you use git pull --ff-only. You don't want to have to figure out merge conflicts _in production_.

</comment></comment><comment><USER20> Capistrano

<comment><USER21> Surprised this isn't a more popular response.

Vagrant/Puppet for local development

* this way every developer has an identical dev environment.

Git for code versioning - Github/Bitbucket for repo hosting

* each feature has a branch, then we use pull requests for review/merging into staging branch.

* when features are LGTM and tested, pull request to merge into production branch

Capistrano with multi-staging to deploy to staging and production servers

* every developer can deploy to staging

* only a few developers can deploy to production.</comment></comment>


Students advised to falsely claim to be racial minorities for college admissions - <AUTHOR> https://www.marketwatch.com/story/students-were-advised-to-falsely-claim-to-be-racial-minorities-in-college-admissions-scandal-2019-05-18 <comment><USER2> Should be noted that calling yourself asian is also disadvantageous so it's not all minorities.

<comment><USER3> For those unaware, a group of Asian Americans is suing Harvard[1] for discriminative admission practices. Similar allegations have been made against UC Berkley and other UC's as well.

1 - [https://www.nbcnews.com/news/asian-america/harvard- announces...](https://www.nbcnews.com/news/asian-america/harvard-announces- high-admittance-asian-americans-judge-weighs-affirmative-action-n990051)

</comment></comment><comment><USER4> If it worked for Rachel Dolezal, it would be unfair to deny the same strategy to students.

<comment><USER5> And for Elizabeth Warren.

</comment></comment><comment><USER6> Why not have a DNA test to determine ethnicity for college admissions?

<comment><AUTHOR> What if I don't feel comfortable sharing my DNA?

<comment><USER6> I'm sure there are plenty of educational opportunities outside the USA.

<comment><AUTHOR> I am a USA taxpayer and registered voter.

</comment></comment></comment></comment><comment><USER7> With this open secret, most know the reality when walking around Harvard and Ivy League.

If current trends continue based on self reported race in college admissions... In the future most "white" people in Ivy League will be the following: mixed race (mainly half or 3/4 asian), middle eastern (arab/israeli/Iranian), or light skinned Indians. The rest are legacy WASPs.

Most Hispanic people will be white people with a Hispanic name like Beto o'rourke. Most blacks will be from the Caribbean/African princes/non Slave descended blacks like Obama/Kamala Harris. The asian quota will be reserved for rich Chinese intl students. Native Americans will be Elizabeth warrens.

So really most Americans get shafted here by affirmative action. Protestant whites, slave descended blacks, asian Americans, non white hispanics and actual native Americans.

To protest this, whenever I am asked for any race I always randomly put down a different race even if my last name obviously shows what race I am.

<comment><USER8> Beto O'Rourke? The Ancient Order of Hibernians would like a word with you.

<comment><USER7> That's the point lol. His first name is Robert but he goes by Beto to appear Hispanic to appeal to Latino voters in Texas.</comment></comment></comment>


Simple Wi-Fi Yagi (2014) - <AUTHOR> http://ham-radio.com/k6sti/wifiyagi.htm <comment><USER2> This makes the antenna more directional. It increases the range in one direction while decreasing it in every other direction, so I'm not sure how well this would work for most people without relocating the router/AP.

That being said, it's a clever bit of engineering.

<comment><USER3> My current (rental) place has the router and AP in one corner of the apartment, so signal strength at the other end is terrible. Is there a better (cheap but effective) option than this?

<comment><AUTHOR> You can try adding a parabolic (or circular) reflector: [http://www.freeantennas.com/projects/template/](http://www.freeantennas.com/projects/template/)

As with the original link, the antenna is directional (and since it's a reflector, probably even more directional), so you lose out on flexibility. It'll be quite good if you don't plan on moving the other point, though.

</comment></comment></comment><comment><USER4> What is the legality of this? I have a vague suspicion that operating a device like this would violate some FCC regulations.

<comment><USER5> FCC regulations (afaik) only apply to the power output of the device, modifying the antenna like this shouldn't change the power output.

<comment><USER6> FCC regulates EIRP, which is output+antenna gain. For this to be strictly legal you would need to adjust the power down until the EIRP is within the legal limit. Actually to be strictly legal I think it would need to be type excepted by the FCC.

That being said if you're using this in your home/office on a legal channel it would be _really_ difficult to even tell from outside you were using it and almost certainly not worth the FCCs time to even try to watch for it. It's not _that_ much extra gain over the stock antenna.

<comment><USER7> To be fair, the FCC regulates both EIRP (4 W / 36 dBm) and max transmit power (1 W / 30 dBm). E.g. you can't just have a 34 dBm transmitter hooked up to a 2 dBi dipole.

</comment></comment></comment></comment><comment><USER8> So this makes the router sends a stronger signal, farther. But how does this help if my laptop still has the same wifi adapter and can't send a strong signal back?

<comment><USER9> It also makes the antenna more sensitive in the direction its pointing. The elements make the antenna more directional, sort of focusing the energy. This increases the transmit side by concentrating the energy into a smaller area, but the same effect also helps it collect more energy.

The trade-off is worse performance perpendicular to the extra elements.

</comment></comment><comment><USER10> I am wondering if antenna calculations are applicable for all types of routers. If not, how can I adapt it to my own setup?

<comment><USER11> itll be applicable for any 2.4ghz, 50 ohm radio

<comment> fake-name Not really. It's only really applicable to any router that uses a dipole antenna.

Pragmatically, this means it's only really an option on routers with external whip antennas. Lots of routers have internal antennas, at which point you're going to have problems attaching the thing. Also, if the internal antennas aren't dipoles, it's not an option at all without significant redesign.

<comment><USER12> > dipole antenna

Erm, looks like a monopole antenna to me. The rest of your post looks correct otherwise.

</comment></comment></comment></comment><comment><USER13> As an electronics student, are there any resources I could use to learn the basics of RF (antennas, etc)?

<comment><USER14> You might start at the ARRL's Antennas page [0] and consider the ARRL Antenna Book [1]. Most of that is aimed at amateur radio in particular but the theory is the same.

There's tons of free and/or open-source software (of varying quality) for modeling antennas and such as well.

[0]: [http://www.arrl.org/antennas](http://www.arrl.org/antennas)

[1]: [https://www.arrl.org/shop/ARRL-Antenna-Book-23rd- Softcover-E...](https://www.arrl.org/shop/ARRL-Antenna-Book-23rd-Softcover- Edition/?page=1)

<comment><USER15> And/or find a local ham radio club.

[http://www.arrl.org/find-a-club](http://www.arrl.org/find-a-club)

</comment></comment></comment><comment><USER16> if my router has 3 antennas, is there any point to installing it only on one of them? my intuition that's based on exactly no RF experience whatsoever tells me that it'll do more harm than good. (case is weak 5GHz signal in the corner of a house.)

<comment><USER17> Depends. Some routers have multiple antennas because there are multiple transceivers inside it, and some technologies (i.e. MU-MIMO in 802.11AC) will most likely react strangely having one of their antenna modified. In the end, it would probably make your performance even worse.

</comment></comment><comment><USER18> Basic antenna question: I thought with Yagis the elements where connected together, is that not the case? As they seem to be held just by plastic.

<comment><USER19> No, Yagis have a single driven element like a dipole, and you have longer elements behind the driven element (reflectors), and shorter elements in front (directors I think?).

<comment><USER18> Interesting, thanks!

</comment></comment></comment><comment><USER20> Could something like this have any impact on a bluetooth antenna?

<comment><USER21> Certainly, though the output power is quite a bit less (20dBm for WiFi vs 4 dBm for typical bluetooth).

[http://www.tomsguide.com/us/how-to-bluesniper- pt1,review-408...](http://www.tomsguide.com/us/how-to-bluesniper- pt1,review-408-4.html)

</comment></comment><comment><USER22> interestingly, the antenna optimizer (AO) software uses genetic algorithm to find the right the antenna topology, therefore, this antenna is not designed, it's evolved. more details can be found here: [https://en.wikipedia.org/wiki/Evolved_antenna](https://en.wikipedia.org/wiki/Evolved_antenna)

</comment><comment><USER23> I wonder what this will do for my 20DBi external wifi adapter.. I can already connect to networks over 600 meters away from my 13th floor apartment..</comment>


Russia Tests 27-Mach Hypersonic Nuclear Glider - <AUTHOR> https://www.npr.org/2018/12/27/680467756/russia-will-deploy-new-hypersonic-missile-systems-in-2019-putin-says <comment><USER2> A 3,000 mile long trail of diffuse atmospheric radioactive contamination produced by the white-hot nuclear powered solid-state scramjet engine, followed by a crash of the spent nuclear fuel into Kamchatka. The crash site will have to be off-limits for millennia, increasingly leaching into the groundwater there with every rain storm and blowing about every dry season.

<comment><USER3> I think it's conventionally fuelled, just can carry a nuclear warhead.

</comment></comment><comment><USER4> Is this something like

[https://en.wikipedia.org/wiki/Boeing_X-37](https://en.wikipedia.org/wiki/Boeing_X-37)

just a suborbital variant that carries a warhead?

</comment><comment><USER5> Is it odd that the control room is completely empty except the leadership?

<comment><USER6> That is the "control room" for the entire country when in conflict, not for the missile itself. Thankfully they aren't in a direct war where it needs to be filled.

</comment></comment><comment><USER7> 767mph is not 20x the speed of sound anywhere in earth's atmosphere

<comment><USER8> I think the author meant speed of sound, not the missile, is 767 mph.

</comment></comment><comment><USER9> So Russia ays they were forced to develop it after Trump withdrew from the nuclear treaty. 2 months is some impressive R&D time, huh?

<comment><USER10> > "Putin says Russia was forced to develop the Avangard after the U.S. > withdrew from the Anti-Ballistic Missile Treaty in 2002,"

2002 - 16 yrs</comment></comment>


Ask HN: What sites do you consider good but are under the radar? - <AUTHOR> <comment><USER2> [https://yarchive.net/](https://yarchive.net/) for general knowledge by people who (somewhat) know what they're doing, [http://zipcpu.com/](http://zipcpu.com/) for digital design</comment>


Cancer Is Contagious Among Clams. What About Us? - <AUTHOR> http://www.nytimes.com/2016/06/28/science/contagious-cancer-clams.html?_r=0 <comment><USER2> No mentioning of HPV, which is contagious and some types of which cause cancer?

(SciHub has the linked Nature article, BTW)</comment>


The Verge on Build 2015 - <AUTHOR> http://www.jamesbaxter.me/the-verge-on-build-2015/

<comment><USER2> I don't doubt they'll have a completely different tone when WWDC rolls around. I've pretty much lost all faith in the Verge's ability to be impartial and report on events in an unbiased way.

<comment><USER3> True that, TheVerge => Apple fanbo _i_ s.</comment></comment>


Startup Weekend is coming to Melbourne - <AUTHOR> http://melbourne.startupweekend.org/2010/11/10/startup-weekend-new-event/

<comment><AUTHOR> Only of value to people in Melbourne: Fri May 6, 2011 6pm to Sun May 8, 2011 9pm, Sensis HQ, the schedule ~ <http://melbourne.startupweekend.org/event/>

<comment><USER2> "10:00pm – .... You may stay and work as late as the venue will allow."

Is there free beer provided after 10pm?</comment></comment>


Show HN: FBP editor for music/vfx with [three, tone, tensorflow].js nodes - <AUTHOR> https://kousun12.github.io/eternal/ <comment><USER2> The author is suspected to be on drugs. For sane people, this is basically a modular audio synthesizer plus visualizations.

(I'm not here to judge, but the readme does say: "transcriptions of a mental representation for your bio-minds" ... )

A lot like Max/MSP.

<comment><USER3> Comparing this to the other sorts of post that typically make it to the front page of HN, how can you be so sure that we are the sane ones?

edit: _kousun12_ : Love it!

</comment></comment><comment><USER4> On Ubuntu both Firefox and chromium I encounter issues with the shortcuts (The navigator catch them instead of the page). I'm only able to load examples with chrome (using shortcut alt+e). The shortcut menu doesn't open with Firefox. In chrome, the visualization is not working but the sound is. In Firefox the visualization is kind of working but the sound isn't. Interesting sound synthesizer with a gnu radio vibe.

<comment><USER5> For me, Firefox on Debian, the only working shortcut is the Menu (which is not actually a menu in the normal UI sense, more like a menu in a restaurant). Shortcuts are always difficult with web apps. For this reason, I would always add an actual clickable menu to web apps.

</comment></comment><comment><USER6> In Firefox, Ctrl-K selects the address bar, and doesn't trigger the "New Node" action.

<comment><USER7> You can't even bring up the help menu in many keyboard layouts, as '?' tends to be available via the shift key...

</comment></comment><comment><USER8> On iOS the leftmost 25px or so is clipped, horizontal scroll doesn't do anything despite the indicator, and vertical scrolling feels gross.

</comment><comment><AUTHOR> The github page: [https://github.com/kousun12/eternal](https://github.com/kousun12/eternal)

</comment><comment><USER9> Looks really nice! Cool ideas on the component API as well.

Just a question, did you consider using the FBP graph JSON format (schema in [https://github.com/flowbased/fbp/blob/master/schema/graph.js...](https://github.com/flowbased/fbp/blob/master/schema/graph.json)), as that would enable interoperability better?

<comment><AUTHOR> yes, i definitely looked at noflo and thought it was a really awesome effort. my intentions with this had less to do with any sort of utility than it did with trying to reflect a specific aesthetic i had in mind. thinking that i'd want more control, i made my own type / serialization scheme as i went

</comment></comment><comment><USER10> It would be awesome if it came preloaded with a design.

option+e load the design chooser.

How do I pan/zoom the design surface?

How do I hide the node graph so I can see the thing being rendered?

<comment><AUTHOR> thanks for the feedback

there are deep links to the examples in the github page, if that's what you mean pan / zoom isn't super well supported, sorry. i've just been using my browser's zoom in / out if you open the help menu, there's a key combo (cmd + shift + v) to hide / show the graph

<comment><USER11> This looks very cool. The nodes and graphs show and hide as designed on Firefox iOS. Browser zoom is fine.

[https://kousun12.github.io/eternal/?e=nude%2C+eternally](https://kousun12.github.io/eternal/?e=nude%2C+eternally)

Is there sound to toggle on and off? I hear none. Sound will make time spent digging in much better.

</comment></comment></comment><comment><USER12> Seems like when I load another example, it gets stacked on top of the currently playing example.

(Chrome, OSX)</comment>


Our Commitment to the Facebook Community - <AUTHOR> https://blog.facebook.com/blog.php?post=10150378701937131

<comment><USER2> Lengthy post on privacy and all people want is a dislike button. Well, they are the product...</comment>


New Strain of HIV - <AUTHOR> http://news.bbc.co.uk/2/hi/health/8175379.stm

<comment><USER2> The patient allegedly had no contact with bush meat, but got it from someone who did. Am I the only one concerned that sooner or later an entirely different virus will come out of bush meat and that one will be airborne? It's pure luck HIV is not easily transmissible and Ebola kills too quickly.

<comment><USER3> I'm sure you're not the only one but what is there that we can really do about it? Worrying about it seems somewhat counterproductive - though with nasty bugs like H1N1 (and its future mutations), SARS and some form of avian flu, I have bought a few boxes of N95 face masks and hand sanitizers just in case. Some days I figure it's excessively paranoid, on others, I figure that an insurance policy for something catastrophic that costs under 50 bucks is a pretty good deal.

<comment><USER4> N95 masks are made to protect others, as in surgeons wearing them to protect those they operate on. Not the other way round.

<comment><USER3> Apparently, according to the CDC, it works both ways. <http://www.cdc.gov/ncidod/sars/respirators.htm> \- N95 respirators were the only masks recommended by the CDC to mitigate the risk from SARS

<comment><USER5> Yes, and in the 50s, school desks where "recommended" as safety bunkers for kids in case of a soviet nuclear attack.

Government safety prescriptions are often panaceas, but they serve the purpose of making the masses feel like everything is under control be calm.

<comment><USER6> Do you have a better recommendation?

<comment><USER7> I thought that we were meant to lie down or put a paper bag over our head or something.

<comment><USER5> HHGTG references go ungotten around here it seems.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Alas, it is becoming safer to make war than love! (Slogan for the new millennium?)

<comment><USER9> Condoms don't protect you from missiles or even a (prehistoric) knife.</comment></comment>


Under No Circumstances Should You Not Solve A Real Problem - <AUTHOR> http://www.thefailingpoint.com/2009/08/buildingproduct/not-solve-a-real-problem/

<comment><USER2> Under no circumstances should you use a double negative for emphasis. It has the opposite effect.

</comment><comment><USER3> Maybe I have fortunate circumstances, but I have never had this problem. Why? I have customers. And they have desires. Lots of them.

It's true, they may not articulate their desires real well and they may never envision "the next big thing", but when you start hearing the same things over and over again, it's a pretty good bet you're solving a real problem.

</comment><comment><USER4> Why do most of the articles in the series start with "...Not"?</comment>


Why Tinder's Pricing Strategy Makes Sense - <AUTHOR> http://www.priceintelligently.com/blog/why-tinders-charging-older-users-more-and-why-it-makes-perfect-sense

<comment><USER2> Cool post. (Author here).

Let me know if you have any questions on this. We ended up finding that most users would potentially pay more (at least in the US).

The only issue is: Is this "price discrimination" from a legal perspective or not since they're clearly pricing differently based on age?

<comment><AUTHOR> How did you guys ascertain the reservation price of the customers? Has anyone really ever been persecuted for price discrimination? (that term also confuses a lot of people.) Student and senior citizen pricing at the movies is clearly the same strategy yet no one sues AMC theaters.

</comment></comment><comment><USER3> I do think the question of price discrimination is a really interesting one. Why hasn't anyone been successful suing for that? Why is Tinder being so obvious about it, do their lawyers no something we don't, or are they just that much more risk tolerant?

<comment><AUTHOR> Movie theaters, theme parks, etc have all been using price discrimination based on age for years and never been prosecuted. I don't think Tinder's lawyers are afraid. They know it will cost a bit of bad press initially, but long term has little risk.</comment></comment>


Experiments in emotion- and empathy-like behavior in insects - <AUTHOR> http://brainblogger.com/2015/06/26/do-insects-have-emotions-and-empathy/ <comment><USER2> Has anyone replicated [http://topdocumentaryfilms.com/the-secret-life-of- plants/](http://topdocumentaryfilms.com/the-secret-life-of-plants/) with public data? I'd like to see a recording of the plants "feeling" pain

</comment><comment><USER3> The vegans were right all along.</comment>


The Secret of Success: Suck Less - <AUTHOR> http://www.codesimplicity.com/post/suck-less/

<comment><USER2> I wonder if the crashing software he mentioned towards the end of essay was amaroK.

<comment><USER2> "Hahaha, it wasn't."</comment></comment>


Google's DMCA Takedown Notice for App They Wanted to Publish First... - <AUTHOR> http://www.calebjkeith.com/mobile/article/article.htm

<comment><USER2> Tell us what you believe is infringing about the application: Application is using our G+ logo and also our GOOGLE+ name as the application name.

Seems pretty legit. If it didn't use the official logo and a name like Publisher for Google+, it might not be infringing. Such a title would indicate that the app works with Google+ and not necessarily that it is sanctioned by Google as the "Google+ Publisher" name seems to indicate.</comment>


The $8M Replacement for a $20 Dollar Fan (2013) - <AUTHOR> http://workforcesolutions.stlcc.edu/2013/making-lean-stick-8-million-dollar-fan/ <comment><USER2> This is an urban legend or folk tale or whatever you want to call it. I've seen this exact same story before only it was a soap factory in Japan or something like that. It's presents a good lesson but isn't a true story at least this re telling of it isn't.

<comment><USER3> There's a similar anecdote out there, also involving toothpaste. In this one the toothpaste company spends millions on a new marketing campaign to sell more toothpaste and then someone suggests that they make the hole in the tube bigger so people use more.

<comment><USER4> A real example of this would be Alka-Seltzer(dissolvable antacid/pain medicine). An ad showed two tablets in the glass, and they saw a large increase in sales. Nowadays they simply come in packets of two.

[https://en.wikipedia.org/wiki/Alka- Seltzer#Marketing](https://en.wikipedia.org/wiki/Alka-Seltzer#Marketing) [http://www.snopes.com/business/genius/alka- seltzer.asp](http://www.snopes.com/business/genius/alka-seltzer.asp)

</comment></comment></comment><comment><USER5> Apparently it needed the $8M replacement for a $20 webserver

<comment><USER6> The maintenance guy already spent $20 and fixed the issue. Why spend $20 more to fix something that isn't broken? You'll take on webserver maintenance with that, so a webserver doesn't really cost $20.

Anytime you want to replace a simple analog solution with a complex digital solution, your costs aren't 1to1.

<comment><USER7> I think the point the parent was making was that the website was down. ;)

<comment><USER6> HA! Thank you. That had gone right over my head :)

</comment></comment></comment></comment><comment><USER8> See, if they would have spent $10Mil and also had a swivel arm that pushes the box off and restarts the machine, Bart would never have had to selfishly innovate and you'd have the architecture at most companies.

</comment><comment><USER9> Snopes calls this a "Legend."

[http://www.snopes.com/business/genius/innovate.asp](http://www.snopes.com/business/genius/innovate.asp)

</comment><comment><USER10> See also, the space pen:

[https://www.scientificamerican.com/article/fact-or- fiction-n...](https://www.scientificamerican.com/article/fact-or-fiction-nasa- spen/)

Which in fact did happen and is (in my opinion) a far more interesting story in this vein.

</comment><comment><USER11> I used to work with a consultant who was a bit of a maverick and would regularly get dismissed from his clients after he ignored all the top brass and immediately went to talk to the people on the floor to find out what was really going on. Nearly every time his radical solutions and reports, which made sense, would just get filed in a drawer because they got rid of middle management. He didn't care if they implemented his ideas. He'd just move on to the next.

</comment><comment><USER12> In "Surly you're joking my Feynman" there is the story of RF talking to the painter who teaches him to mix paints, and the colours you need to get make yellow. Turns out you should talk to the person who's been mixing paints all their working life.

Isn't there a similar story after the challenger accident where he talks to the maintenance people on the ground?

</comment><comment><USER13> Shouldn't the title be the other way around... $20 Fan replaces a $8M process

</comment><comment><USER14> "The service is unavailable."

<comment><USER15> Google Cache version: [https://webcache.googleusercontent.com/search?q=cache:http:/...](https://webcache.googleusercontent.com/search?q=cache:http://workforcesolutions.stlcc.edu/2013/making- lean-stick-8-million-dollar-fan/&num=1&strip=1&vwsrc=0)

</comment></comment><comment><USER16> The fan doesn't ensure quality. It is possible for an empty tube not to get blown off.

<comment><USER17> But then the 8mil solution would catch it.

<comment><USER16> Exactly but it takes the bite out of this anecdote, which is that the $8m solution is unnecessary because there is a $20 solution.

</comment></comment></comment><comment><USER18> Let me guess, it was hard to get to it

</comment><comment><USER19> The story is obviously intended to teach a lesson and not a real piece of truth. But the lesson is real, and we've all seen it in action.

Product people want to push products. Management wants to manage. Engineers want to engineer. Nothing about any of this is inherently bad, but putting these three motivations together in a vacuum can have this effect.

This is all, in my opinion, an example of resume driven development. Everyone wants to build themselves up. In a competitive market, you have to. For product people that means delivering products, for management people that means managing problems and finding successful solutions, for engineers that means engineering cool shit that works.

We are strongly motivated to behave this way.

The point of the parable is that these motivations don't necessarily lead to the optimal solutions. And that the difference between the highly productized, well-managed, elegantly engineered solution and the quick fix is often not large.

But there's a strong reaction against boring solutions. Boring solutions don't get you the next gig. Boring solutions don't impress anyone. Boring solutions don't make your resume pop.

This is a grossly exaggerated example, of course, but that's how parables work. I'm kind of surprised by how many of the comments are missing the point.

This tendency to over-engineer, over-productize, and over-manage is everywhere in the tech industry. We do it everywhere. Not to start a flame war, but I'm Looking at you, new JavaScript framework flavor of the month. I'm looking at you, infrastructure platforms and noSQL solutions.

The thing that we don't seem to be able to accept is that the vast majority of the problems we solve day in and day out at our startup companies and our big big companies are very straightforward and boring problems, for which there already exists a boring solution.

This is more specifically true of web development than native dev work or embedded systems, and there are obvious places where this is entirely untrue. Cutting edge research in theoretical comp sci, embedded systems, AI, and cryptography.

And I say this as a web developer, not one of the other interesting things I mentioned above: most of what we do is and should be boring. They are simple interfaces to data. A very few of them—-maybe .01%—have to actually deal with scale.

I know I sound like a grumpy old man, but that's increasingly what I feel like.

One of my most recent projects reflects this so closely that it's not even funny. We had a project without enough time, we wanted to bring in a vendor to deliver a system-wide platform. Vendor couldn't deliver on time, so we had to do something else.

My solution took a day to prototype and another few days to deploy. It was boring as fuck. No one would be even remotely impressed with the implementation. It was a boring problem with a boring solution. But it solved the problem, and we were free to move on to something else.

If we want parables like this to go away and stop offending us because they aren't literally true, we (especially us web developers) need to stop pretending that we are so special. Product and Management should also do the same thing.

Most problems are boring, and they deserve boring solutions. Yeah, I know that doesn't help your resume or mine, but you don't get paid by a company to bump your resume. You and I get paid to solve mostly boring problems. Until we are willing to admit that to ourselves and each other, this parable is going to remain relevant.

</comment><comment><USER20> The core of the article (See full version for the extra commentary):

A toothpaste factory had a problem. They sometimes shipped empty toothpaste boxes without the tube inside. This challenged their perceived quality with the buyers and distributors. Understanding how important the relationship with them was, the CEO of the company assembled his top people. They decided to hire an external engineering company to solve their empty boxes problem. The project followed the usual process: budget and project sponsor allocated, RFP, and third-parties selected. Six months (and $8 million) later they had a fantastic solution – on time, on budget, and high quality. Everyone in the project was pleased.

They solved the problem by using a high-tech precision scale that would sound a bell and flash lights whenever a toothpaste box weighed less than it should. The line would stop, someone would walk over, remove the defective box, and then press another button to re-start the line. As a result of the new package monitoring process, no empty boxes were being shipped out of the factory.

With no more customer complaints, the CEO felt the $8 million was well spent. He then reviewed the line statistics report and discovered the number of empty boxes picked up by the scale in the first week was consistent with projections, however, the next three weeks were zero! The estimated rate should have been at least a dozen boxes a day. He had the engineers check the equipment; they verified the report as accurate.

Puzzled, the CEO traveled down to the factory, viewed the part of the line where the precision scale was installed, and observed just ahead of the new $8 million dollar solution sat a $20 desk fan blowing the empty boxes off the belt and into a bin. He asked the line supervisor what that was about.

"Oh, that," the supervisor replied, "Bert, the kid from maintenance, put it there because he was tired of walking over to restart the line every time the bell rang."

<comment><USER21> $8M still seems high for a scale.

<comment><USER22> 100 000 for the scale, 7 900 000 for knowing where to put the scale.

<comment><USER21> 100,000 still seems high. Clearly I'm in the wrong industry. I should be fleecing enterprise businesses instead.

<comment><USER23> Let me introduce you to a thing called Java!

</comment></comment></comment></comment></comment><comment><USER24> The $8M Replacement for a 20 Dollar Dollar Fan</comment>


How much do software engineers make outside of the United States? - <AUTHOR> Do hackers outside of the US have an above average lifestyle? <comment><USER2> In the city I am in Brazil, I've seen companies that offer from R$2,500 to R$4,500 per month gross (plus the legally required one month's bonus per year), plus other random forms of compensation.

Factoring in taxes and union dues (mandatory one day's wage per month go to the union) at USD 1.00=BRL 1.75 it comes out to US$14,000 to US$29,000 net. Some fudging is involved because the exchange rates fluctuate, and I'm not sure exactly about taxes (max marginal tax rate is 27%, plus random other "social" taxes plus union dues)

Wages may be higher in bigger cities such as Sao Paulo, but the rent is also higher.

Rent in the city I am in may come out to, I dunno, US$500/month rent in a reasonably nearby nice area. I've seen ads for rooms for US$285 taped to streetlights.

Overall its not bad, especially since companies will often pay a lunch per diem that is enough to stuff your face at a pay by the pound buffet and are legally required to pay for your bus fare to get to work.

This is for nice jobs where everything is done by the book. There are some pretty lousy jobs where nobody follows the rules and the pay is awful but I suspect that they are rare for computer programmers as opposed to say construction workers or janitors.

As a lifestyle it compares favorably in some ways to paying 50% of gross in taxes on a US$100,000 1099 contract job in New York City that involves commuting over an hour from some s---hole in New Jersey. Been there, done both.

</comment><comment><USER3> I think this might partially answer the question: <http://www.worldsalaries.org/computerprogrammer.shtml>

compared with list like this: [http://en.wikipedia.org/wiki/List_of_countries_by_average_wa...](http://en.wikipedia.org/wiki/List_of_countries_by_average_wage)

</comment><comment><USER4> It depends on what you define as above average. The minimum wage here in the UK is £5.93 an hour, so just under £12,000 a year (roughly $18.5k).

The 'average' wage in the UK is somewhere around £24k-£26k (roughly $37k-$40k).

For developers I'd say graduates start out at around £25k-£30k (roughly $38.5k-$46k) and the wages start to middle out at around £35k-£50k(roughly $54k-$77k) depending on your experience and seniority.

So in terms of 'above average' I'd say yes when in comparison to the rest of the population, but only by a marginal amount. There are extreme cases in the development sphere though - many developers who work in Finance will probably earn a lot more than those working in a more 'average' development job.

</comment><comment><USER5> Australia (salaries converted to US$), for a developer who can actually program

Graduate $45,000

2-5 years experience: $65-$80,000

Highest salary for pure programming: $110,000

A lot of development here is done contract basis. Rates range from $40/hour to $100+/hour. Most good programmers with 2-5 years experience in a language in demand (say Java or C#) get $60-80/hour.

Specialist skills & good negotiating will get you more, bad negotiation or career planning will get you in a dead end position and you'll get less.

</comment><comment><USER6> Mexico. From 10K to 30K usd per year. Then substract ~30% in tax. 50K if it is a very very senior job.

Life is a lot cheaper though. Still, engineering isn't very well paid back there, and options to work on something awesome are way more limited. Most options are consulting, business apps, or move outside to work for a cool company.

</comment><comment><USER7> Here in Costa Rica it varies a lot between working for government or private companies, but a good salary for software development .NET, Java etc with experience is around USD $2500 per month, entry level or recently graduated around 1500-2000$ per month.

</comment><comment><USER8> In India you stand to make between USD10k to USD12k annually if you go to work for a sweatshop (HCL, Infosys, TCS) straight out of college. This, I believe, is the lower limit. No idea about the upper limit.

</comment><comment><USER9> In Singapore, it start from 25,223.88 USD provided if you are a degree graduate. It varies a lot depending whether you work in a MNC or SME.

</comment><comment><USER10> Here in Bolivia - South America, Software Engineers make between 10,000 and 12,000 $us. annually

</comment><comment><USER11> In France, senior software engineers usually make between €50,000 & €60,000.</comment>


Imperial College report on Covid-19 that led to the extreme measures in US - <AUTHOR> https://threadreaderapp.com/thread/1239975682643357696.html <comment><USER2> Landmark report not because it's likely to be accurate, but it scared the UK (and perhaps the US) into action from the high mortality figures based on the latest Italian data.

However, let's look at how the report underestimates the effectiveness of interventions:

Case isolation in the home: Reduces non-household contacts by 75% and assumes 70% of households comply : so only reduces non-household contacts by 52%

Voluntary home quarantine: Reduces community contacts by 75% but assumes only 50% of household complies.

Social Distancing: "Reduce contacts by 50% in workplaces, increase household contacts by 25% and reduce other contacts by 75%. Assume 75% compliance with policy."

Social distancing of entire population: "All households reduce contact outside household, school or workplace by 75%. School contact rates unchanged, workplace contact rates reduced by 25%. Household contact rates assumed to increase by 25%."

Closure of schools and universities: "Closure of all schools, 25% of universities remain open. Household contact rates for student families increase by 50% during closure. Contacts in the community increase by 25% during closure. "

25%, 50%, 75%... Where did they come up with these figures??

<comment><USER3> _> School contact rates unchanged_

I'm in a country with mandatory social distancing, and parents are still having school cricket and soccer matches in the local park. The parents are all clustered together watching.

They think their children are "immune".

</comment></comment><comment><USER4> "extreme measures" \- the term used before the pandemic.

"insufficient measures" \- the term used after the pandemic.

</comment><comment><USER5> Tyler Cowen had a great take calling out the tradeoff implied by this paper, raising the question of if a 18m total lockdown (the upper bound of the recommendation in this paper) is even a reasonable thing from a society/utilitarian perspective.

[https://marginalrevolution.com/marginalrevolution/2020/03/he...](https://marginalrevolution.com/marginalrevolution/2020/03/herd- immunity-time-consistency-and-the-epidemic-yoyo.html)

 _Alternatively, let's say we start off being really strict with shutdowns, quarantines, and social distancing. Super-strict, everything closed. For how long can we tolerate the bankruptcies, the unemployment, and the cabin fever? At what point do the small businesspeople, one way or another, violate the orders and resume some form of commercial activity? What about "mitigation fatigue"?

Again, I fear we might switch course and, again, end up with the worst of both worlds. We would take a big hit to gdp but not really stop the spread of the virus.

I also can imagine that we keep switching back and forth. The epidemic yoyo. Because in fact we find none of the scenarios tolerable. Because they are not._

<comment><USER6> I've been thinking about it two ways:

1\. We could forecast a projected cost to the global markets, vs. the number of lives saved, and put a price to each life saved. Every healthcare conversation has avoided doing this, so maybe this pandemic will force the conversation.

2\. We shelter in place, take the hit to the market, and use the opportunity to learn a lot about our impact on the environment, ourselves, and how we can possibly change as societies to make things better for everybody.

</comment></comment><comment><USER7> In the pdf report there is a nice table at the bottom of page 5.

Not only is the CFR lower than I had anticipated, but it made me realize that a hospital trip doesn't immediately imply intensive care.

For instance a 35 year old has 3.2% chance of going to hospital, and then 5% chance of ending up in the ICU when going to hospital.

Can I multiply these together to get 0.16% chance of ending up in the ICU once infected, or is that too simplistic :)

<comment><USER8> That seems way less dangerous to young people than I'm otherwise seeing reported, and this is the report that's apparently so extreme it got the UK and US to finally do something.

What with all the people who are obese, smoke heavily, have asthma, immune compromised, etc I would have assumed 0.16% of people find themselves in the ICU if they get a cold.

<comment><USER9> Italy reported today that 99% of the COVID-19 deaths in Italy had a preexisting condition.

If you're healthy you (probably) don't have anything to worry about, but if you're diabetic, smoking, have hypertension or other normally manageable conditions, you're (maybe) at risk.

And to all the healthy people who seems to think they're immune. You probably won't die from it, but someone in your close family may very well die because you didn't take it seriously.

</comment></comment></comment><comment><USER10> I'm not qualified to properly challenge any of this, but it looks like all of these models use one estimate of the IFR ("mortality rate"). This paper is the basis for their 0.9% number: [https://www.medrxiv.org/content/10.1101/2020.03.09.20033357v...](https://www.medrxiv.org/content/10.1101/2020.03.09.20033357v1)

If that estimate is wrong, all of the numbers in the models would be wrong too. Strange that they tried a range of numbers for infectiousness but only one basically educated guess for IFR.

<comment><USER11> Could be just what they had. I thought we all thought the IFR was higher, in which case the Central point of it all being urgent is perhaps understated you think?

<comment><USER10> I _definitely_ do not think that the true IFR is higher. But again, I'm not a doctor and this is not medical advice.

<comment><USER12> Based on the data here: [https://www.worldometers.info/coronavirus/](https://www.worldometers.info/coronavirus/)

The current death rate of closed cases is 9%. I guess the expectation is that it falls once we develop a vaccine?

<comment><USER13> Most infections never turn into "cases", which is why the IFR (Infection Fatality Rate) is a lot lower than the CFR (Case Fatality Rate). How much lower is _very, very_ hard to say.

Also note that there's no strict definition for how to calculate the CFR, so you'll see conflicting numbers even for the same area/country.

</comment></comment></comment></comment></comment><comment><USER14> I am wondering - coronavirus (the usual one) is associated with common cold; we don't have any vaccine against it nor do we actually understand the common cold itself; moreover, COVID-19 has a similar genomic packing as HIV/Ebola, two diseases we don't have vaccines for either. I am wondering if it is just wishful thinking we get a COVID-19 vaccine anytime soon (i.e. in the next decade). Are there any reasons to be optimistic?

Also, regarding herd immunity - we aren't immune against flu, is there any reason to think we could develop (long-term) immunity to COVID-19?

<comment><USER15> > we aren't immune against flu, is there any reason to think we could develop > (long-term) immunity to COVID-19?

Spanish flu became less lethal in subsequent generations[1]. Helps with the survivability of the virus if it doesn't kill the host. So, the strains with less lethality win out.

We don't need to be immune for the situation to resolve. Simply co-evolving with the virus is sufficient

[1] [https://demystifyingscience.com/blog/2020/3/4/patriarch- of-p...](https://demystifyingscience.com/blog/2020/3/4/patriarch-of-pandemics)

<comment><USER16> Flu's evolve and there's feedback from the behavior of the humans they infect. So if they make you feel like crap you are less likely to spread the infection. So that results in a less aggressive infection out competing a similar but more aggressive infection, doubly so since the immune system will like cross react between the two.

However with COVID19 the infection seems quite adept at spreading before the symptoms show, so there's going to be less of a feedback loop. Might even be the opposite since a serious infection means visiting the doctors office, in many cases more than once, and finally escalating to the emergency room. COVID19 seems especially adept at infecting nurses, doctors, ambulance drivers, and EMTs.

</comment></comment></comment><comment><USER17> I really wonder what future historians will say about this hysteria and the economic damage it causes.

1) _80% of Americans would get the disease_ That sounds scary (big number!!). But I'm getting tired of the constant reporting of each and every _infection_. What is really relevant is infections _of at-risk groups_. Most infections, _nothing happens_!

2) _8-15% of all Americans over 70 would die._ Newsflash: Old people tend to die more often than young people. What is the all-cause i.e. normal mortality rate of the elderly. One number I saw cited: all-cause mortality of 83/84 yo's in the US ~7 percent. Case mortality rate i.e. _with_ infection in Korea among 80+ yo's: 7.4 percent. What am I missing here? Are the reported covid mortality rates all normalized by all-cause mortality and they report only real "excess" deaths or are they lumping everything together? This would be so mind-numbingly stupid, I really hope I'm wrong about this!

3) _0.9% of them would die._ That's the unconditional number, all age cohorts aggregated. Split them up and the number is clearly skewed by the large number of the elderly (and see 2 above). Now factor in that testing outside Korea, Taiwan etc. is really bad and focused on symptomatic cases. Common estimate of how high are the true numbers of infected is around one order of magnitude. Let's assume the official stats are off by a factor of ten. Let's further assume that young people (say, below 65) are "more social" or mobile than elderly and thus likelier to get infected. That means a) the undercount is dominated by younger people and b) the mortality rates are off by more than ten. At what point are we getting to mortality rates of common influenza?

4) There are basically two ways to die from the virus: a) immune system overwhelmed by virus or b) immune system overreacts. Younger, healthy people ( < 65 yo) seem to die more from b. Now look into _who_ are the victims in this cohort and it turns out mostly medical professionals. Due to lack of preparation and equipment, those medical professionals are exposed to disproportionately higher or even extreme quantities of the virus. This seems consistent with b. Also, it means that the mortality rates of younger, healthy people is skewed by counting medical- and non-medical people together.

In sum, I think this is a total overreaction and panic that causes huge economic damage (which has a big human cost, in terms of lives lost, as well make no mistake) for what may turn out to be basically nothing.

What am I missing?

[EDIT: I'd prefer we focus on the at-risk groups (elderly and pre-existing conditions like obesity, cardiovascular diseases, diabetes, etc) instead of just blanket- _everybody_. Isolate the at-risk groups until vaccine and/or medication are developed and let everyone else basically develop herd immunity until then. Increase testing. And basically use this as a call for more general health measures, not just virus panic. The immune system depends on sleep, nutrition, mental health/hormone balance, etc. With the panic and the economic crash induced by it, all these factors are becoming negative instead of positive factors for most people now.]

<comment><USER18> The numbers above don't hold much under scrutiny.

The "herd immunity" approach is a dangerous gamble, as one of the big unknowns is "How long is the immunity after recovery from COVID-19" \-- it can be anything between 0 (no immunity) and infinity (immunity for life). If acquired immunity holds for less than the time required for a vaccine to be widely available, "herd immunity" will quickly become a massacre. The first wave will knock off the medical system (even if somehow everyone over 60 is protected), ensuring that the second wave will be devastating.

I much rather prefer the South Korea/Singapore/Japan alternative to the UK one.

The race is to arrest the exponential curve, somehow, at any temporary cost, for if we don't we can't apply the working options for COVID-19 response from Japan, South Korea, and Singapore.

<comment><USER17> > _The numbers above don't hold much under scrutiny._

Can you tell me which exactly and indicate why?

<comment><USER19> [https://www.theguardian.com/commentisfree/2020/mar/15/uk- cov...](https://www.theguardian.com/commentisfree/2020/mar/15/uk- covid-19-strategy-questions-unanswered-coronavirus-outbreak)

[https://www.theguardian.com/politics/health](https://www.theguardian.com/politics/health)

<comment><USER20> Curious about which numbers do not hold. Can you tell specifically? - a news article tends to cite a lot of numbers - And given the situation, can you also mention the original sources?

</comment></comment></comment></comment></comment><comment><USER21> Here's a scenario I'm curious about. Chickenpox parties for young and healthy people who are then isolated. Use heavy suppression to make sure there are ventilators available for them should they be needed.

My gut feeling is that this could create herd immunity at small cost.

<comment><USER22> I see a possible problem with the idea:

> Chickenpox parties for young and healthy people who are then isolated.

Sign here to be given coronavirus and locked away for a month...

<comment><USER21> If you don't sign you are to practice social distancing for a year meaning you will be excluded from most of society. How's that for an incentive? You see that is what the article proposes _everyone_ should do.</comment></comment></comment>


Show HN: SproutUp brings passionate people together to create awesome things - <AUTHOR> http://www.sproutup.co

<comment><USER2> You misuse the "Show HN:" tag to lead people to your home page... which then doesn't even load on Chrome?</comment>


Show HN: – OpenReporting: Financial reporting tool - <AUTHOR> http://openreporting.com

<comment><AUTHOR> Hi HN,

For the past few months, we were working on a financial transparency tool for governments and non-profits. I left my job to make this software a reality. I and a couple of my friends have worked hard to get this working and we need some serious review from experts on this. Please take a look and give us feedback.

Elevator Pitch: Allow organizations to publish financial information online.

Looking for honest, brutal feedback. Thank you for your time!

\</comment><comment></comment><comment>----

Clickable links:

Website - [http://openreporting.com](http://openreporting.com)

Demo report - [http://sampleorg.openreporting.com/Report/Category-198-Yearl...](http://sampleorg.openreporting.com/Report/Category-198-Yearly)</comment>


Is there a HN API that allows you to post comments/stories too (not just read)? - <AUTHOR> Basically, I want to create a web-based HN App which both fetches the user's posts/comments & allows them to post them.
I know that the standard APIs available on Github (Firebase) and Algolia are good but they are read-only. Do you know of any other API which has a POST/PUT interface for posting comments too?
On the play-store, I found this app authored by another dude, wonder how he's able to do it?
https://play.google.com/store/apps/details?id=io.github.hidroh.materialistic
(The front-page of the app says, "Public APIs are provided by Hacker News, Algolia and Readability.") <comment><USER2> Have you tried to inspect the network traffic while making a post, and reverse engineer from there?</comment>