The Internet Needs a Better Way to Handle Money. This Startup Has the Key - <AUTHOR> http://www.wired.com/2014/07/the-startup-that-wants-to-change-the-language-of-online-payments/

<comment><USER2> Econ 101: favorable transactions that would otherwise happen don't in the face of transaction costs. This fact of life plagues the web, because there are a lot of potential transactions that are, individually, only worth a few cents to the user. Advertising is the backbone of the web, I think not because users like it so much, but because it's a way to monetize clicks a few cents at a time. There is, for the time being, no practical alternative for these sorts of micro-transactions.

I think the holy grail of reducing transaction costs and friction for online payments is allowing better monetization strategies for the web. Imagine going to a website and having it auto-bill an account for a few cents per page view, instead of being greeted with a pop-over ad that's impossible to dismiss on a mobile device without accidentally clicking through. This is the big value of Stripe and its ilk. Not just reducing the cost of accepting payments (which has the economic effect of just shifting revenue away from payment processors to merchants), but enabling valuable transactions that wouldn't have happened before.

<comment><USER3> This idea is certainly compelling from some perspectives but isn't there a lot of evidence that most people hate being nickel and dimed (which is literally what this proposal is) and in basically every instance have preferred purchasing goods in bundles?

<comment><USER2> The psychological aspect is definitely a hurdle, and can be viewed as a transaction cost in itself. I wonder if there's any practical ways to reduce it.

<comment><USER3> There might be, but I'm not optimistic.

</comment></comment></comment></comment><comment><USER4> So, this article is talking alot about tech and not so much about the bureaucracy that is involved getting paid online.

I'm building a marketplace, airbnb, model, and have applied to braintree, the process has taken 10 days and counting, so far they have asked for the following documents.

\- Copy of my passport,

\- Company registration papers

\- Bank account statement,

\- Buisness plan,

\- Terms of service,

\- Privacy Policy

(Physical address and phone on website, apperently a requirement from VISA/Mastercard)

How does Stripe solve this problem? I have never needed to provide a business plan when embedding a YouTube Video.

Note, I'm in a country where Braintree's Marketplace offering (or Stripes, or Balanced) is not available. So I'm doing the payouts to the service providers myself.

</comment><comment><USER5> easy integration is cool, obviously, but 2.9% + .30 is the same price as paypal. businesses ultimately don't care about how easy it is to integrate but how much it costs.

<comment><USER6> > businesses ultimately don't care about how easy it is to integrate but how > much it costs.

For many large-scale businesses, the ongoing cost of a higher rate will overwhelm the startup costs of building it and you will be correct.

But that is not the only sort of business in the world. For many tiny businesses the startup costs exceed their available funds -- they would pay ANY rate so long as the profit from the new customers it brings exceeds the cost to existing customers.

For some startup companies, the savings in integration (both of dollars and more significantly savings of time) is a short-term cost to be minimized even if it means a larger cost in processing fees to be shouldered next month or next year. After all, if we don't get a demo out the door there won't BE a next month or next year.

And 2.9% + 0.30 really isn't all that high. It's high enough to hurt, but not high enough to drive away customers. For some, this amount really makes a difference and they can do better, but don't fall into the trap of assuming that EVERYONE is like that.</comment></comment>


How to Get a Full-Time Remote Job (7-Day Email Course) - <AUTHOR> http://robertgibb.me/free-remote-job-course/ <comment><AUTHOR> Hey all!

I just returned from traveling for 7 months. I met so many people who were amazed about what I was doing (working while traveling). They literally had no idea that remote work and digital nomadism was a thing. When they found out from me though, they wanted it. This excited me that they were amped about the idea, but I had no scalable way to show everyone how to get a remote job.

So when I got back home I wrote down everything I knew about getting a remote job. I looked for the commonalities in the approaches I used to get three remote jobs in my career. The end result was a 7-day email course: [http://robertgibb.me/free-remote-job-course/](http://robertgibb.me/free- remote-job-course/). I'm not selling anything here. I just chose email as a format because Mailchimp is free (for a while) and each lesson takes about a day to complete, especially if you already have a busy schedule. I felt that sending time-based emails would help keep people on track.

However, if you don't want to get the lessons dripped to you via email, you can check out all 7 lessons in this public Google Folder: [https://drive.google.com/drive/folders/0B6BahD3pAp2ySURBSGlD...](https://drive.google.com/drive/folders/0B6BahD3pAp2ySURBSGlDZFFPRWc)

I don't care how this information gets out there, I just know it needs to get out there. There are people who are on the brink of major depressions and breakdowns because of their shitty cubicle jobs. (I used to be one of them.) I wish someone would have sent me actionable information like this when I was fed up with my office job years ago.</comment>


Misconfigured Jira instances exposed data of hundreds of Fortune 500 companies - <AUTHOR> https://medium.com/@logicbomb_1/one-misconfig-jira-to-leak-them-all-including-nasa-and-hundreds-of-fortune-500-companies-a70957ef03c7 <comment><USER2> This issue arises because, if the site allows any public sharing, the "create filter" UI gives team members the option to share a new filter with "Everyone", which sounds like an org-local scope but is in fact a public/non- logged-in scope. The org-level scope is called, "Open", and is not part of this UI. Sigh.

To prevent this issue as a site admin on Jira cloud, go to:

        Jira Settings -> System -> General Configuration

and disable "Allow users to share dashboards and filters with the public." This doesn't affect existing filters, which you have to manually fix.

In true Jira fashion, if you try to reassign a filter _after_ flipping this setting, it will deny the operation and ask you to edit the ACL, which there is no convenient admin UI to do.

Jira is a disaster of UX.

<comment><USER3> I admit I have mostly avoided using it, so a question:

> Jira is a disaster of UX.

Jira is trying to be all things to all people. It seems to me to be based on a sort of shared illusion, namely that when people talk about work getting done they are talking about the same thing, when in fact they're often talking about wildly different processes, different philosophies. I think that sort of illusion guarantees a UX mess, because it's trying to cover up/accommodate too many different things. Is Jira a UX disaster because of just that? Or is it bad on top of that?

And I worry that makes no sense, so by analogy let's imagine that somebody sold a "transport solution". This sounds great, because transportation is a universal need. But in reality transport solutions include shoes, scooters, bikes, motorcycles, cars, buses, trains, and airplanes. So this "transport solution" comes with a great mess of wheels, gears, shafts, etc, etc, plus reams of Ikea-style instructions for putting pieces together. It's universal, but also guaranteed to be a pain in the ass for any actual specific use.

<comment><USER2> Don't mean to create a pile-on, but since you asked, yeah I should explain my barb:

        Is Jira a UX disaster because of just that?
        Or is it bad on top of that?

My opinion - it's both.

The product has a ton of permutations, as you said, which makes stuff like this happen: Customers who never in the world imagined public issue tracking, suddenly bit by a feature they didn't even know existed. Conversely I'm sure there are shops, who love this feature, for whom the distinction between "Everyone" and "Open" was always obvious. I don't envy the team building / supporting the product across all that; I don't know how I'd do it.

But there are also endemic, continuously-poor design choices large and small. Unannounced and hard to disable major changes to the UI are the standard, and large. I'll give you one example of the small: Recently, unannounced, the issue comment UI started auto-correcting the _capitalization_ of Atlassian product names in the comment box. Type "JIRA", get "Jira". In _my_ words in _my_ issue tracker. (Yes, it was the js app, not the browser). It just always seems so user hostile.

Net net, to me it's an aging hydra of a product with ongoing missteps. I'd take good design and limited features over what you get here, at least with out heavy investment and expertise.

<comment><USER4> I tend to agree Jira is a bit of a mess, but the responsbility needs to be shared with the users.

\- Why buy a complicated mess? \- Why let a random Scrum Master / Product Owner manage it? \- Why don't we think we need to protect an IT system we buy like an IT system?

Many of the reasons engineers hate Jira are specifically related it being a complicated mess that is hard to use and admin. So if management would listen to engineer about IT systems, maybe this wouldn't happen?

Another possibility is we actually did a risk assessment and what we put in Jira isn't of sufficent risk for us to care, so actually IT doesn't need to be involved because we're not super worried about it leaking.

There are likely worlds of both involved.

My own pet hate is just that it's too slow and often configured in a convoluted way that makes me spend too much time in it.

</comment></comment></comment></comment><comment><USER5> JIRA is for people who like to do more planning of work than actual real work. See also: meeting moths.

It's commonly used by technical managers who have no skills to contribute but need to justify themselves as important so they will spend countless hours setting up complex workflows, tweaking forms and starring at pointless "burndown" charts describing work they have absolutely no clue about.

JIRA also generates an enormous amount of automated email which is further exploited by these folks to advertise to others in the company that they are doing work.

When you interview some place, pay attention if they have a culture ruled by JIRA. If they do, and you like to get real work done, do not work there. It may be possible some use JIRA as a tool but the risk is far too high to take.

<comment><USER6> I wish I could upvote you twice. Exactly describes my experience and it is soul sucking. It gets so bad that the work-planners actually succeed in creating faux importance and are valued more (and value themselves more) than the actual workers.

<comment><USER7> I upvoted on your behalf !

</comment></comment></comment><comment><USER8> <insert joke about how nobody wants to suffer through anyone else's Jira anyway>

Seriously though, this isn't good. Not because of this hack specifically but because of the greater problem of which this is a symptom. Software these days is really hard to configure and get right, so lots of big companies just offshore things like this as they don't want to deal with it with FTEs. Then the budget for maintenance gets deprioritized and cut as a whole for all these little systems that keep projects humming along. Probably just as many misconfigured wikis, git servers, etc through a rats nest of different VPNs and providers. It gets really expensive really fast to host these things right and in a way where accessibility for valid folks is still reasonable.

</comment><comment><USER9> I think we are at the point of risk where the volume of discoverable information is so great that the parties at "risk" are needles in the haystack. There may be some analytical value in combing the available data, but if a specific target were interesting, they are probably already compromised.

In a way, it is to say that few organizations have especially interesting information. The few that do can be compromised with social approaches. So exposures such as these are becoming less and less embarrassing. Every organization is dysfunctional to some degree, and every org has some communications that (especially taken out of context) might raise eyebrows; but that is life, and that is what happens when you gather numbers of people in one place.

Point is, stories like these are useful for adding to a corporate checklist of exposure safety, but they aren't worth much else (unless of course the org holds secrets that could hugely disrupt the world).

<comment><USER10> This very much depends on specific threats, opponents, risks, and the interactions of these: your (perceived, actual) threat model.

Some years back as a member of a third-party services provider I had to sit through the e-learning session of a very large financial services provider. The course (tediously boring, natch) established three tiers of information importance, with the highest being _not_ consumer information, but the organisation's own marketing and product plans.

Which is precisely what you're going to find in a Jira or equivalent project planning trove.

The risks of a lawful competitor running across this are ... reasonably low in many, though not all cases (see the Waymo smart car case for risks involved), though there are certainly cases of corporate espionage.

And petty criminals are somewhat unlikely to see much use from this.

But, to draw from recent HN posts: the ability to specificaly target developers to drop malicious payloads, for foreign governments to exfiltrate technologies or identify individuals to target for enhanced surveillance, to blackmail, to thwart or confuse plans, etc., all exist.

Information _of itself_ is not power, but information with both the impunity to acquire it and the ability to act on it most certainly is.

And that's where Jira-class risks are significant.

</comment></comment><comment><USER11> The author of this Medium post also posted about this back in January[1] so the issue hasn't been resolved since then?

[1] [https://medium.com/@logicbomb_1/bugbounty-nasa-internal- user...](https://medium.com/@logicbomb_1/bugbounty-nasa-internal-user-and- project-details-are-out-2f2e3580421b)

<comment><USER12> Don't worry about it, I'm sure it's in the backlog

<comment><USER13> You joke, but looks like:

[https://jira.atlassian.com/browse/JRACLOUD-18076](https://jira.atlassian.com/browse/JRACLOUD-18076)

[https://jira.atlassian.com/browse/JRACLOUD-36896](https://jira.atlassian.com/browse/JRACLOUD-36896)

<comment><USER14> > Created: 24/Jul/2009 5:42 AM

</comment></comment></comment></comment><comment><USER15> This issue was originally published back in 2016.

[https://medium.flatstack.com/misconfig-in-jira-for- accessing...](https://medium.flatstack.com/misconfig-in-jira-for-accessing- internal-information-of-any-company-2f54827a1cc5)

</comment><comment><USER16> Worse is that these are cached by Google so any admin seeking to clean up this mess sure has their work cut out for them.

<comment><USER17> You can ask for cache deletion at [https://www.google.com/webmasters/tools/removals?pli=1](https://www.google.com/webmasters/tools/removals?pli=1), I've just done it yesterday and today the caches are marked as deleted/refreshed.

</comment></comment><comment><USER18> TL;DR:

> by default the visibility is set to "All users" and "Everyone" respectively, > which instead of sharing with everyone of the organizations (which people > think and interpret), it share them publically [sic]

To test if you are vulnerable, check whether you can publicly load one of these URIs on your domain:

        https://jira.example.com/secure/popups/UserPickerBrowser.jspa
        https://jira.example.com/secure/ManageFilters.jspa?filterView=popular
        https://jira.example.com/secure/ConfigurePortalPages!default.jspa?view=popular

To find these sites, Google one of these queries:

        inurl:/UserPickerBrowser.jspa -intitle:Login -intitle:Log
        inurl:/ManageFilters.jspa?filterView=popular AND ( intext:All users OR intext:Shared with the public OR intext:Public )

<comment><USER19> It gets worse. You can modify those permissions, but every single Jira page that involves a permission check (and they get pretty granular) involves a nontrivial query to the user DB (which might, itself, involve a query to a backend like LDAP) to determine if you can do a thing or, critically, see the UI element to do the thing.

Best guidance when I was running Jiras were to restrict access at the network if at all possible, and don't use permissions any more than strictly necessary unless you like 5-10 seconds per page load. In other words, if only your developers need to see your Jira, don't grant only your developer group permissions, set it to "everyone" and lock everyone else out at the firewall.

<comment><USER20> We run massive JIRA instances with very granular permissions using multiple custom authorization backends (LDAP/Kerberos/in-house stuff), and it doesn't seem to add much of a delay.

<comment><USER19> Hm. Perhaps they took some time and worked on the performance then. It was ungodly slow a couple years back, and relaxing permissions led to a _significant_ performance boost.

<comment><USER13> They've been touting performance increases for a while now

[https://confluence.atlassian.com/jirasoftware/jira- software-...](https://confluence.atlassian.com/jirasoftware/jira- software-8-0-x-release-notes-957981626.html#JiraSoftware8.0.xreleasenotes- performance)

</comment></comment></comment></comment></comment><comment><USER21> I wonder how many self-hosted GitLab instances are configured with the same assumption in mind

<comment><USER22> That can hardly be blamed on GitLab though. The setting to make something public is clearly named "public", and the description is:

> The project can be accessed without any authentication.

Meanwhile, Jira almost seems to aim for misunderstanding.

<comment><USER10> There's specifying authentication and there's specifying routability. These may not be clearly distinguished to admins.

</comment></comment></comment><comment><USER23> If this had been another s3 bucket on AWS we would be blaming amazon. Here we don't blame jira/atlassian. Why do we do this? (Honest question)

<comment><USER24> When you setup an S3 bucket the permissions are pretty explicit. The issue here is the UI is confusing (arguably it's wrong but I digress) and is related to a configuration that you'd have to hunt for. It's not an obvious permission that you can easily know it should be changed unless you have experience with it (whereas S3 it's listed right there when you created it and by default it's pretty private).

<comment><USER25> It didn't used to be. When you set up a bucket with public read access, you might also decide to give other people on your team write access to the bucket. AWS conveniently provided an All Users option for this.

Except it wasn't "All Users in your AWS account", it literally meant ALL USERS of AWS. Disaster. This led to the same problems as this Jira issue.

AWS changed it so that's no longer an option. Atlassian should do the same.

</comment></comment></comment><comment><USER26> I mean.. why aren't they using a vpn and restricting external access at the firewall?

<comment><USER27> Because (in theory) the Atlassian stack is sufficiently hardened and can be safely run over the public internet.

The idea that everything must be behind a VPN at all times and you must hit the exact same login form twice to do anything is silly and why most office staff love off-prem services.

<comment><USER28> It's not everything, it's services that are only used internally (which might or might not be the case for Jira depending on the use case).

There's no two login forms anyway if your IT doesn't want it to be, on one hand VPNs are usually not accessed on demand during the work day and on the other hand all Jira versions I'm aware of can be integrated with some form of SSO anyway if you feel like it. Offices are usually internal and wouldn't have to deal with a VPN anyway.

<comment><USER27> The problem is that my fellow IT people define "only used internally" to mean "only used by employees" instead of "only useful to someone physically at our office."

Protect your VPN with SSO and then protect your service with the same SSO is incredibly common and perfectly demonstrates, in my view, the stupidity of VPNs.

The VPN added NOTHING to your your authentication or authorization.

If you're going to fully check a users credentials at the VPN where users are in a totally untrusted domain and fully check them again at the service then clearly your internal network is also being considered an untrusted domain -- which I think should be the case -- but then all the VPN does is move users from one untrusted domain to another. Why is the VPN there?

I think offices would actually be more secure if services like this were only accessible externally (doesn't have to be literally, just philosophically no reason to route out and back in your WAN). Instead of connecting to a VPN and having access to the internal network where there's probably a lot of surface area exposed the external only model means that you're only connected to the single service you authenticated to.

<comment><USER28> I don't think I get this argumentation. VPNs are easy to use these days so there's no "physically at our office" angle imho. The VPN adds a zone that the client can trust (which should not entail your whole internal network being exposed to it but I've never seen that anywhere to be quite honest). They get their Windows/AV/whatnot updates from that, connect to the services they need on the road.

Simultaneously the VPN shields said services in a managable way, though that's more of a on-premise vs. cloud discussion I feel like, with the VPN being the way to get access to the on-premise stuff if you do not happen to be in the office. Maybe I'm missing your alternative? VPNs have some upsides over, say, a reverse proxy for that use case (weird sales clients for example that talk TCP, not HTTPS) in the setups I've seen.

It also prevents exposure to the exact scenario we see in this very thread. Finding public instances of popular software is easy, enabling drive-by exposure to vulnerabilities. Putting them behind a proxy/VPN at least provides a hurdle for non-targeted attacks from my point of view.

</comment></comment></comment></comment></comment><comment><USER29> Google is taking that search string as evidence of suspicious activity, fwiw.

<comment><USER30> It's like a house alarm that tells the burglar "Hey you seem shady. But you can come in if you promise you're a good guy."

<comment><USER29> Except the homeowner doesn't own the alarm. It's more like a mapmaker allowing access to the index of the map, which a clever person happened to figure out revealed where some houses with broken locks are. And the mapmaker has the decency to say "hey, let's see if this visitor is at least human" before allowing you to proceed from the index to the map itself.

Ok, now the mapmaker has solid evidence that this human is doing something shady.

Human, you are on notice.

</comment></comment></comment><comment><USER31> Was it necessary to leave the names in the screenshot?

</comment><comment><USER32> So, in the documentation, "all" was very unclear. Users guessed that "all" meant all in the company while it mean all in the whole world!

So, wildly ambiguous, unclear, dangerous product documentation.

Could clear that up by being really clear and explicit about "all in the world", "all in the company", "all in a particular project", etc. and then lots of very clear examples.

But it was easier just to have some check box, icon, etc. described as "all".

In current computing, such documentation nonsense is usually resolved by the usual way of making sense of a computer user interface, _experimentation_ , or use the TIFO method (try it and find out), or throw the options and combinations of options over and over against a wall to see which ones appear to stick, or do the usual, my usual description, "mud wrestling", all due to bad documentation.

It is as if the software were designed and written by people who thought that a check box with "all" was _all_ there was to the work.

Well, in this case the TIFO experimentation involved hundreds of Fortune 500 companies and many other organizations, small to the largest, around the world.

It is as if the documentation writers were inarticulate and essentially illiterate.

So, Xerox PARC thought that some buttons, say, as on a microwave oven, would be sufficient for controlling lots of Xerox office machines. Then the computer industry, with _graphical user interfaces_ thought that nearly all of computing could also have such a user interface. Nope: Commonly even makers of microwave ovens have well written users guides. The many millions of Web site user interfaces are generally much more complicated to control than a microwave oven and also need good _DOCUMENTATION_ , e.g., much more then cryptic, not a chapter, paragraph, or sentence, not with examples, clear definitions, etc., but just a word or two from a _roll over_. And often there is just an icon, can't pronounce it, can't spell it, can't type it in text, can't send it in e-mail, can't look it up in a dictionary or with a search engine -- which takes us back to pictographs before the Roman alphabet. That situation, in technical language, is a bummer; more clearly a disaster as the OP shows.

IMHO, a good candidate for the biggest bottleneck in the future of computing is the quite general lack of good technical documentation.

E.g., two weeks ago I signed up with a different Internet access provider (ISP). They promised me I could have up to five e-mail addresses. Sooo, I tried to get a second address for the alpha test I plan for my project (Web site -- no icons!). It took 14 hours of my time and nearly that much time with third level technical support. With decent documentation, I could have done all the work in about 10 minutes. But, three days ago their Internet service quit in my neighborhood. Their efforts to reset my equipment (cable modem, IP router, WiFi connection) make my connection from before the outage work no longer. The fix took a day and a half, about 30 hours of my time, and about 15 hours on their third and fourth level technical support. With decent technical documentation, I could have fixed the problem myself in 10 minutes. And I have MANY other such examples. Several hours or days instead of a few minutes -- HUGE bottleneck to progress.

I say again: One of the worst bottlenecks in the future of computing is the lack of decent technical documentation, in a natural language, e.g., English, and mostly in text. No joke, guys. Icons, check boxes, radio buttons, text boxes, pull downs, pop ups, roll overs, etc., are NOT and can never be good natural language technical documentation.

TIFO on world-class issues is a huge disaster waiting to happen.

<comment><USER33> I'm all for good documentation, because not everyone learns in the same way, and if you have a product as broadly used as Jira, I think its user base deserves it. But in the basis it's just an inefficient, after the fact attempt to mitigate poor UI/UX. Which could EASILY have been clearer about the access rules, and they could (should) have defaulted to a more restrictive setting. First of all to protect users against the clearly more damaging of the two extremes (too restrictive versus not restrictive enough) but also because it better fits Jira's nominal use case.

<comment><USER32> Yup: Their "all" was a high powered, loaded gun, cocked, no safety, hair trigger, ready to go off at any time.

</comment></comment></comment><comment> ga-vu Kinda hard to take his word when all the images are blurred in 90% of their surface.... lol

You could have uploaded an image of my router's dashboard and I wouldn't have known what I was looking at

<comment><USER34> Well he is in both Halls of fame(United Nations and European government)

<comment><USER35> And I also just verified by checking myself against some known Jira dashboards and searching for some of the search queries he provided... I'm not sure what there isn't to trust when he tells you exactly how to verify the information.</comment></comment></comment>


CVE-2016-2384: arbitrary code execution due to a bug in usb-midi linux driver - <AUTHOR> https://xairy.github.io/blog/2016/cve-2016-2384 <comment><USER2> Short version: A bug in a Linux USB device driver can be caused to take over a Linux machine by plugging in a malicious USB device. An attacker would either use a custom USB dongle, or a programmable device with a USB connection such as a cell phone.

There's a narrow problem here, which is the bug in the device driver. That'll be fixed of course, now that it's gotten attention. But fixing this bug will not solve the problem, because there is a truly enormous number of different USB device drivers, most of which are poorly audited, run in kernel space, and correspond to unusual hardware. The _real_ problem is that plugging in a device can cause any obscure device driver to load, without user confirmation. So for example, someone can plug in a cell phone, and the cell phone can claim to be an obscure kind of printer that no one has seen since the 90s, and the system will go ahead and load that device driver.

The solution is to require user confirmation before accepting any USB device that hasn't been seen before. Just a simple popup: You have connected [type of device], Ok/Cancel. The only tricky part is input devices like keyboards and mice, where this could create a chicken-and-egg problem with the confirmation prompt. (And devices pretending to be keyboards can be dangerous; they can type commands). Fortunately, there is a solution, albeit one which will take some programming work: accept keyboard input from keyboards that have either been confirmed by a prompt _or_ have typed the user's login password. (Since some "keyboards" are actually things like barcode scanners).

<comment><USER3> Another solution is to not compile drivers that you don't need, and to take minimizing kernel attack space as seriously as running a firewall. It should, in my opinion, be routine to run a reduced kernel in production, however most of the industry appears to use stock kernels from a few major vendors. The likes of CoreOS are probably helping here. Keep it up.

<comment><USER4> For a server-ish machine, disabling module autoloading is fairly straightforward: set /proc/sys/kernel/modprobe to /bin/false. (You can also do something fancier like [https://scripts.mit.edu/trac/browser/trunk/server/fedora/con...](https://scripts.mit.edu/trac/browser/trunk/server/fedora/config/etc/scripts/modprobe) to report what the process is.)

This is also useful to disable modprobing obscure networking protocols just by an unprivileged process calling socket(SOCK_STREAM, AF_FULLOFBUGS, 0), which was a fruitful source of exploits at least a few years back.

However, for most server machines, if an attacker can plug a malicious USB device into your machine, something has already gone very wrong. (And for a good chunk of servers these days, they don't even have USB because they're VMs.) The primary threat model for this sort of thing seems to be laptops that are briefly left unattended and locked, or "Hey, can I charge my phone off your laptop."

For the unattended-and-locked case, perhaps you could block module autoloading until the user has logged back in. It's roughly similar to the approach Apple takes with Thunderbolt, I believe.

<comment><USER3> My point was not just to disable modules, but to disable all kinds of unrequired kernel functionality. Recall recent vulnerabilities such as BPF JIT spraying, etc.

<comment><USER4> Yeah, a hardened kernel is great and I'm glad to see distros building kernels just for security-sensitive server applications.

However, setting kernel.modprobe to /bin/false is extremely high-impact in reduction of attack surface compared to how much effort it is (one line in /etc/sysctl.d/); you can keep running a full-featured distribution kernel, even one from Fedora or Ubuntu that's simultaneously intended for desktop use.

</comment></comment></comment></comment></comment><comment> odeke-em Video demo right here [https://www.youtube.com/watch?v=lfl1NJn1nvo](https://www.youtube.com/watch?v=lfl1NJn1nvo)

</comment><comment><USER5> This is an excellent writeup, IMO. It's a clear demonstration of how use after free can be so dangerous.

</comment><comment><USER6> I recall hearing recently that Chrome has access to midi devices ...

<comment><USER7> Fortunately it cannot connect malicious USB dongles. Yet.</comment></comment>


macOS app to open the current directory in Terminal, iTerm, Hyper or Alacritty - <AUTHOR> https://github.com/Ji4n1ng/OpenInTerminal <comment><USER2> Right clicking in a Finder window should allow you to open a "New iTerm2 Window Here" if you are an iTerm user.</comment>


Hurricane Sandy donation sign on Apple home page - <AUTHOR> http://www.apple.com/#sandy

<comment><AUTHOR> I can't follow the link because I don't have iTunes installed on my work computer, but I find this really interesting because I can't remember ever seeing something like this on the Apple home page</comment>


Who Needs Git When You Have ZFS? - <AUTHOR> http://zef.me/blog/6023/who-needs-git-when-you-got-zfs <comment><USER2> ZFS is excellent for database development! Create a snapshot before you try something that mess up your data and instantly restore it! If your development database is a few gigabytes, this will save you a lot of time.

<comment><USER3> Except you'll lose all the data since you created the snapshot... You've been able to do this for years on Linux with LVM anyway.

<comment><USER4> I don't think you read the comment thoroughly. This is the point.

Also, the discussion is centered around ZFS, there's no reason to bring up LVM. Everyone knows there's many ways to skin this cat and it doesn't make anyone appear any smarter because they know of one way.

<comment><USER3> My point is that it's not really a great way of 'backing' up a database because typically you want the transactions after you've made the change as well.

</comment></comment></comment></comment><comment><USER5> > Who needs Git?

> Notably missing is support for merging

So, it's almost like a car except it's missing its wheels

No, it's not like Git

<comment><USER6> I really don't think the article was seriously suggesting what you think it was; showing similarities between different types of tools (usually a more familiar one and a less familiar one) is meant to be illustrative

<comment><USER7> "I really don't think the article was seriously suggesting what you think it was"

Then maybe it shouldn't have a purposefully click-baitingly title suggesting it does...

<comment><USER8> >> I really don't think the article was seriously suggesting what you think it was

> Then maybe it shouldn't have a purposefully click-baitingly title suggesting > it does

I normally hate clickbait, and yet I liked this article and its headline. Maybe because the tone was self-deprecating, like me getting on a bicycle and saying, "Look out, Tour de France!"

Actually, it's like a fish getting on a bicycle and jokingly saying, "Look out, Tour de France." Maybe the fish isn't anywhere near good enough on a bike to compete in the Tour de France, but still, it's a fish on a bicycle.

In the same way, Git will run circles around ZFS as a source-code version- control system. On the other hand, it's way cool that ZFS can even do some of these things, because after all it's just a filesystem.

</comment></comment></comment></comment><comment><USER9> I've been working with virtual machines in production and development for well over a decade now and a lot of what works via ZFS in this article works very similarly to how it would work we used AWS or VMware style snapshots. In fact, ZFS snapshots are only so helpful if you make complicated changes across multiple ZFS volumes, for example, that require some more transactional style rollbacks. In such scenarios, it may be easier to just perform an instance- level rollback.

One problem that didn't really occur to me before I became more ops-side was that administrators would want to heavily restrict / remove users' (read: developers and even other sysadmins) abilities to create snapshots in the first place. Why would you remove self-service temporary backups and avoid a lot of backup restoration requests? I didn't realize that other engineers could be careless and keep dozens or even hundreds of snapshots over time that gobble up expensive storage resources (SANs are _not_ cheap regardless of manufacturer) and slow down I/O transactions over time. That was why so many of my customers deploying stuff like VMware Lab Manager and vCloud Director demanded the ability to remove access to snapshot features.

As a result of the typical usage where user abuse of a very powerful feature threw things for a loop, the typical organizational structure and siloization of these environments means that nowadays SAN-side LUN snapshots are used more often than from the VM layer (the same administrators that manage VMware environments typically have rights to the SANs). Using ZFS like this is a developer-side reaction to me, but duplication of trying to solve the same problem when technical solutions have existed and are viable is exasperating.

<comment><USER10> VMware snapshots are _NOT_ like ZFS snapshots. VMWare snapshots are extremely heavy an will have massive performance impact if left around for an extended period of time for any I/O sensitive VM. ZFS snapshots are essentially 0-overhead from a performance perspective, and function in a very different manner.

<comment><USER9> I'm aware of how both work (I had a VCP410 cert and happily run ZFS with many snapshots on rotation at home), but IMO the uses are similar enough for the purposes explored in the article despite the significant differences in practice and felt that a traditional alternative should be mentioned. Additionally, VMware-based snapshots can be performed SAN-side and integrated with VAAI that can expect similar performance overhead as a ZFS snapshot and still support a lot of options with trade-offs and features. The compulsory indirections that happen in the traditional VMware snapshot implementation with the on-disk block map appears designed for storage compatibility (much like the design of VMFS in itself, including with that whole file-based mutex system) primarily rather than performance not to mention the support for memory persistence / quiescing with the guest OS, which ZFS snapshots do not support. In contrast, ZFS has _all_ the metadata to quickly examine block time or other rich metadata to accelerate read and write indirection of blocks optimally. It's not clear if a SAN can accelerate ZFS using OSes in the way that they can accelerate VMware storage but I'm curious of the potential.

On the other hand, recursive snapshots in ZFS are really slick and can achieve 90%+ of what people typically want from VMware-based snapshots when it comes to any non-Windows OS if there's a little room for not needing to care about indirect changes required in rollbacks.

<comment><USER10> ...just no. VAAI snapshot integration with VMWare is only for NAS platforms, not SAN - VMFS doesn't even come into the picture. Not to mention it's intended for View for rapid cloning, and not as a backup feature.

</comment></comment></comment></comment><comment><USER11> > Notably missing is support for merging, which ZFS does not have direct > support for as far as I'm aware.

So, no replacement. Merge and Branch are the major features of git. The bigger the project the bigger the need for these. I know some projects where people work full time as merge conflict resolvers. Without git that would require a whole team instead of a person.

<comment><USER12> "Of course, I'm not seriously suggesting you'd ditch a 'proper' version control system, but it gives a good sense of what's possible at the file system level."

<comment><USER11> That's what the title says in big letters at the top though.

</comment></comment></comment><comment><USER13> > _Notably missing is support for merging, which ZFS does not have direct > support for as far as I 'm aware._

That insight is critical, especially now that we are heading towards Dropbox Infinite, IPFS, Ceph and so many other non-centralized file systems.

Syncing is not a solved problem at all yet. Advances can bring the same revolution as 3-way merging did to SCMs, previously dominated by file-locking mechanisms.

<comment><USER14> What was that replicated filesystem back in the 90s that promised to be the next NFS, but with disconnected operation and merging when you came back online? Coda, that's right. I had such high hopes for it in my move to using a laptop as my primary machine, but never got it working despite several attempts at it. Admittedly they weren't more than a couple hours at a given time...

</comment></comment><comment><USER15> ZFS doesn't have history in that way; snapshots are far too coarse. HAMMER, for example, is closer to what you want if you're going to replace git with a FS.

[https://www.dragonflybsd.org/hammer/](https://www.dragonflybsd.org/hammer/)

</comment><comment><USER16> If you look past the attention-grabbing headline, this shows some pretty cool stuff with ZFS, using source versioning as an analogy to explain what would otherwise be quite abstract when it comes to filesystems. The only thing I knew about ZFS was the name, this helped me see some of its impressive features.

Of course, I'll take reliability & stability over fancy features any day, but I'm glad there's active development in this area, and look forward to seeing these features mature. They could contribute to some interesting simplifications.

<comment><USER17> > I'll take reliability & stability over fancy features any day

That is why people use ZFS and OpenZFS, they are battle tested and very mature.

</comment></comment><comment><USER18> "Oracle's (previously Sun's) next-generation file system"

That's why you need to stick with Git.

<comment><USER19> What does Oracle have to do with anything? This is FUD.

<comment><USER20> It is certainly not FUD, see [https://www.eff.org/cases/oracle-v- google](https://www.eff.org/cases/oracle-v-google)

The point is, Oracle have decided to sue once over usage of something they bought and may do so again in the future.

<comment><USER13> Exactly.

The legal situation of Google's use of Java APIs was always a tiny bit murky, but it was super-clear-cut compared to the use of ZFS-on-Linux.

<comment><USER21> Oracle sued over Google reimplementing code that was under the GPL (OpenJDK) under the Apache 2.0 license (Apache Harmony). Google recently switched to the GPL code because of it. In the case of ZoL, the code is derived from the original code and is under the original license. The idea that ZoL is somehow more at risk is pure FUD.

<comment><USER13> My understanding is that the risk is mostly the other way around: it infringes Linux' GPL license (see [https://sfconservancy.org/blog/2016/feb/25/zfs-and- linux/](https://sfconservancy.org/blog/2016/feb/25/zfs-and-linux/)). Would Oracle have grounds to sue as a Linux copyright holder? They have successfully made API copyrightable, so they clearly have competent lawyers.

<comment><USER21> There are a few people who think that. There are plenty of others who do not. Those in charge of reviewing licensing in Linux distributions that have adopted it are generally of the opinion that it is okay, especially those in charge of Sabayon and Ubuntu. Gentoo came to similar conclusions long before them (>4 years before Ubuntu) and ships it in binary form on the LiveDVD. At this point, there are at least a few dozen distributions that have adopted ZFS in some form or another.

Here is a legal opinion on the matter:

[https://www.softwarefreedom.org/resources/2016/linux- kernel-...](https://www.softwarefreedom.org/resources/2016/linux-kernel- cddl.html)

<comment><USER19> I don't see how anyone could read that and come away thinking that ZFS-on- Linux isn't kosher. Given as simple as it is to compile zfs.ko in the Ubuntu live environment, I'd bet money that's Canonical's backup plan should a literal interpretation of the kernel's license become a legal reality.

And here's to hoping that ZFS becomes so widespread that Oracle themselves end up redistributing it in their version of Linux, like they did with DTrace.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> "Using ZFS as a replacement of Git for is probably not a good idea..."

Of course not.

</comment><comment><USER23> To play devil's advocate, sometimes Git is abused to store things that aren't code, and ZFS (or similar) might actually be a better fit in those situations.

Somebody further down mentions art assets. Also potentially relevant are document repositories.

ZFS isn't very easy to use for a lay person, but that's really only a "Time Machine"-esque front-end away.

</comment><comment><USER24> Ubuntu 16.04 comes with ZFS preinstalled and ready to use.

Well, you need to install the user package 'zfsutils-linux' and you are ready to go.

The kernel modules for ZFS are already in the default kernel and are loaded automatically when you create a volume.

</comment><comment><USER25> I have a FreeBSD server in my home office that has a big ZFS raidz volume that I use for shared file storage, and it's really, really awesome. The snapshots are especially great because they greatly reduce the fear of screwing something up. I once wanted to run a de-dupe script on several hundred gigabytes of photos, but I was afraid it would go awry, so I snapshotted first, knowing I could roll back in a few keystrokes. (Granted, this wouldn't help much if the script had caused some problem that wasn't immediately apparent. And yes, I have backups of all of that stuff elsewhere, but doing a restore from backup is a lot more work than rolling back a snapshot.)

</comment><comment><USER26> Strange there's no mention of FreeBSD's excellent ZFS implementation

<comment><USER27> Yes, _and_ the article casually implies that ZFS totally works not only on Linux but also on OS X[1], which is... a stretch.

I check on it every year or so, but my impression is that ZFS on Mac is still so far behind where ZFS is on FreeBSD and (more recently) Linux, that it isn't really clear whether ZFS will _ever_ work reasonably on the Mac.

(I would love to hear experiences of people actually using it on OS X, though! I may be out of date.)

[1]: [https://openzfsonosx.org](https://openzfsonosx.org)

</comment></comment><comment><USER28> How production ready is ZFS on Ubuntu (Debian?) ? Is there any risk of Oracle fighting back open source zfs as for Java with Google and Android ?

<comment><USER24> ZFS is under the CDDL while Java is not under the CDDL.

CDDL is an open-source licence just as the GPL.

<comment><USER29> > CDDL is an open-source licence just as the GPL

But incompatible with the GPL, which mostly explains the current situation of ZFS on Linux.

<comment><USER30> It's the GPL that's incompatible with the CDDL and not the other way around, which is an important distinction. Other than other GPL variants and BSD and MIT style licenses, the GPL has restrictions which make it pretty much incompatible with everything.

<comment><USER31> I don't get how the word "incompatible" can be understood as anything other than both license has aspects which makes combining them impossible. But owell, lets see what the license text actually say:

 _Any Covered Software that You distribute or otherwise make available in Executable form must also be made available in Source Code form and that Source Code form must be distributed only under the terms of this License. The Modifications that You create or to which You contribute are governed by the terms of this License._

If you distribute source code, _this license_ means that you must use _this license_. You can't use _some other license_ , as its not compatible with the distributor deciding what license to use. CDDL license require that any source code distribution use CDDL as its license, and it is incompatible with any other license that has similar condition. CDDL is incompatible with GPL because GPL has similar conditions as CDDL.

If we were to make an identical copy of the CDDL license and call it CDDLv2, those two identical twins would be incompatible with each other. Software under CDDLv1 would not be permitted to be combined with software under CDDLv2 and distributed as source code.

<comment><USER32> Actually, the CDDL allows the person who wrote the License (Sun, now Oracle) to release a new version of the license that implicitly updates the license for all projects using the old license (It's like the "or any later version" thing with the GPL, but I'm fairly sure it's not optional with CDDL). Which is why people are asking why Oracle doesn't just release CDDL 2.0 that is GPL compatible.

<comment><USER21> New CDDL code outside of Oracle is under CDDLv1 only to prevent them from doing as they please with the license terms.

<comment><USER32> But ZFS is not under that other license (which might be called CDDLv1, but that's confusing). I don't get why new software uses the CDDL over the MPL if you want "file based copyleft". If you want copyleft, just use the GPL.

<comment><USER21> Not much new software uses the CDDL. Fans of CDDL software typically opt for BSD or Apache licenses.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER33> Three year old article teaches slightly outdated techniques and basic ZFS usage on linux by way of specious comparisons to GIT.

I guess it wasn't a half bad resource when it came out, but these days there's got to be better blog posts about this, right?

EDIT: Not that I'm bitter; I love zfs. I mainly wonder how something so old ended up here.

<comment><USER34> I very much appreciated this article and shared it with coworkers who also found it helpful. I can understand the desire to only read the latest news, but I've learned a lot of stuff in my life that was useful but only new to me. The key benefit to this article was the comparison of ZFS to something I am familiar with: Git. My wild guess is that other non-filesystem geeks like me liked this article for similar reasons and upvoted despite its age.

Edit: Perhaps the ZFS to Git comparison is itself novel? I would like to read about other filesystem features (any file system) from this perspective because I think I would learn a lot.

</comment></comment><comment><USER14> I'm tempted to write an article: Who Needs ZFS When You Got Git, but the title IS the article.

Don't get me wrong, I looove ZFS, and from a quick scan this article looks like a good intro to ZFS, particularly for someone familiar with git.

<comment><USER35> Author is not actually suggesting replacing your version control with ZFS. From the first paragraph:

> Of course, I'm not seriously suggesting you'd ditch a "proper" version > control system, but it gives a good sense of what's possible at the file > system level.

<comment><USER36> So the title is click-bait, then? I almost read the article, but in the 342 milliseconds between thinking that and reaching for the mouse, I came up with three reasons the topic alluded to in the title would be a dumb idea. And it turns out that's not what the article is about anyway.

<comment><USER35> Good work, you avoided learning a thing! :hooray emoji:

</comment></comment></comment></comment><comment><USER37> This blog post was one of the most inspirational pieces that led us to founding Pachyderm (pachyderm.io). We offer git-like semantics for data, including branches, and in a distributed system so it scales to petabytes.

</comment><comment><USER38> ZFS and other advanced versioned/copy-on-write filesystems are really cool and useful but it's not a source code management tool.

E.g. the examples show branching but not merging.

On the other hand, this might be useful for storing binary large files that are not really diffable and mergeable, and thus a bad fit for Git. However, the typical use case for this is art assets in games, which means that it's the artists and designers who are the target audience. Git is often said to be too difficult for non-programmers, and ZFS or BTRFS is definitely not easier.

</comment><comment><USER39> Weird title as Git and ZFS are used for completely different reasons but I love ZFS as well and the article highlighted some of the finer details which was great.

</comment><comment><USER40> An important difference is that While both rely on Merkel DAGs git uses content addressing while ZFS doesn't (physical addresses impact hash too).

Relatedly, ZFS's memory management relies on the assumption that a forked filesystem and its sibling will monotonically alias less data as either is modified. This allows it to avoid tracing and ref-counting alike, but makes implementing merging or `cp --reflink` difficult.

</comment><comment><USER41> Are there any beginner resources for learning about file systems? Would be smart / harmful to reformat my whole macbook ssd to ZFS?

<comment><USER6> I don't think you can use ZFS as a boot volume on Macs (and only on Linux with caveats).

<comment><USER42> The limiting factor is the bootloader. Mac firmware can read HFS+ natively, find the bootloader, which in turn recognizes HFSX, Apple RAID, and Apple Core Storage. I doubt any of the previous ZFS support exists in the current bootloader.

Unlike linux where there's a separate /boot, OS X doesn't really separate boot from root file systems. So how you'd boot XNU from HFS+ and transition to a separate ZFS root fs isn't obvious to me from the existing documentation.

</comment></comment></comment><comment><USER43> This article gave me some confidence in finally trying to boot Arch Linux on ZFS. This will either make my life very easy or very hard.

</comment><comment><USER44> Well.. I get the funny side of the comparison , they're two different things..

</comment><comment><USER45> I've been reading that ZFS was "almost ready for use" in Linux for years, how stable is it for production now, anybody here using it, any good/bad comments or tips? (using CentOS 7 at the moment)

<comment><USER46> To give you an idea, it just shipped baked into Ubuntu 16.04, the latest Long Term Support (LTS) version.

[https://insights.ubuntu.com/2016/02/16/zfs-is-the-fs-for- con...](https://insights.ubuntu.com/2016/02/16/zfs-is-the-fs-for-containers- in-ubuntu-16-04/)

</comment></comment><comment><USER6> Anyone here think that a "ZFS in the cloud" that anyone could inexpensively export a ZFS snapshot (or volume) to would potentially be a business model (offsite backups, etc.)?

<comment><USER47> rsync.net does: [http://www.rsync.net/products/zfsintro.html](http://www.rsync.net/products/zfsintro.html)

<comment><USER6> Ah, I think I've even come across this in the past and forgot about it!

Is $60/TB/month competitive?

</comment></comment></comment><comment><USER48> More like git-annex and git LFS.

ZFS can be good cms choice for large binary files.

</comment><comment><USER49> ZFS is very powerful indeed; I've been using ZFS to share a data partition between OS X and Ubuntu. The versioning capabilities the OP mentions has a lot of potential.

</comment><comment><USER50> Branches and tags are just snapshots and clones? This actually looks more like Subversion than git, together with the challenges with managing merges that this model brings.

</comment><comment><USER51> I like ZFS a lot, but it's no replacement for Git. Snapshots are really handy for a lot of things, but not for a group of developers collaborating over some source code.

<comment><USER52> Did you read the article?

        "Of course, I'm not seriously suggesting you'd ditch a "proper" version control system

</comment></comment><comment><USER53> Almost all of what they're saying the benefit here isn't ZFS specific and could be done (for example) with Volume Shadow Copies on Windows servers as well

</comment><comment><USER26> Strange he doesn't mention FreeBSD's ZFS implementation.

</comment><comment><USER54> It looks like ZFS which came from BSD systems will be/is the next big thing in Linux, not Ubuntu on Windows which gets more hype...

<comment><USER55> ZFS (not ZSF) came from Solaris, not BSD.

</comment></comment><comment><USER32> I personally feel that we should all hop off the ZFS (on Linux) hype train and consider a few points. Currently ZoL is being developed by two people, and it works by creating a translation layer into the Linux kernel API. The bug list is enormous (much bigger than btrfs), and there isn't enough experience with the codebase by Linux kernel developers. That's ignoring the potential legal issues. No other ZFS port has these problems.

On the other hand, if you want a supported filesystem with many of the same features as ZFS, there's btrfs. It alleviates all of the problems with the ZoL port. And there's no fear of Oracle lawsuits.

<comment><USER21> There are far more than 2 people here:

[https://github.com/zfsonlinux/zfs/commits/master](https://github.com/zfsonlinux/zfs/commits/master)

I will admit that my contribution activity has been low as of late, but it will pick up again soon. As for the bug list, that is because basically all distribution problems get sent there and duplicates are not closed until it is proven that they are duplicates. There is no such transparency with other filesystems' bug tracking. Redhat receives plenty of bug reports through Fedora that they happily close if not solved by EOL.

As for btrfs, one of the btrfs developers claimed that ZFS has 5 times the development resources of btrfs:

[https://news.ycombinator.com/item?id=11749477](https://news.ycombinator.com/item?id=11749477)

As for lawsuit fears, the fact is that using any software at all puts you at risk of a lawsuit. Whether or not the plaintiff has a legitimate case is a separate matter. However, if we consider the prospect of Oracle having a case against those using btrfs or ZFS, btrfs would be at higher risk. The CDDL provides an implicit patent grant while the GPLv2 does not. Any ZFS patents that are applicable to btrfs that Oracle accquired from Sun could be used against those using btrfs. The repercussions for Oracle would be huge, but if we are discussing about the potential for legal issues with Oracle, then btrfs is at the greatest risk.

From what I know of the internals of the two, btrfs has far more problems. This shows some of the problems on an enterprise distribution:

[https://news.ycombinator.com/item?id=11749010](https://news.ycombinator.com/item?id=11749010)

The idea that performance can be so horrible that the system might as well have deadlocked is a severe problem. The ENOSPC issues from internal fragmentation is another severe problem. Then there is the lack of backports. I could continue, but I see no need.</comment></comment>


Former Exec: Match.com Treats LGBT Users "Dismissively" - <AUTHOR> http://techli.com/2012/07/former-exec-match-com-treats-lgbt-users-dismissively/

<comment><USER2> I have no objection to the website operator wanting to cater only to people who want serious relationships, but calling flings and hook-ups "smut", with the implication that people who engage in such activities are "smut-makers", is extremely unprofessional and disrespectful, to say the least of it.

In addition, there are many people who are open-minded about casual sex but want serious relationships, perhaps with someone who shares their values on sexuality, but these people will have been turned away (as well as their not- so-open-minded friends who think the operator has no right to be a jerk toward their friends), thus reducing the usefulness of the website altogether, not only for those who have such values, but for anyone who might have otherwise found a good match with them or their friends.

In general, promoting your business as inclusive and caring while tarnishing the reputation of your previous employers and insulting other people have done no wrong to you is more than a little hypocritical.</comment>


Freenode sucks - <AUTHOR> http://bramcohen.livejournal.com/72298.html <comment><USER3> "<bramm> and I hope you realize that you just completely pissed off one of the most well known and respected people in the whole open source community"

Funny thing about respect, is it takes a while to build up and can be lost in a heartbeat.

edit: what's interesting is how respectful the freenode admin was throughout this whole transcript. If anything, kudos to freenode.

<comment><USER4> While it's true that Cohen acts like a bit of a douche, I think his point is rock solid. 60 days expiration for lack of use is ridiculous. And the admin he spoke to may have stayed polite, but his glib refusal to do anything to solve an obvious problem, while endlessly reciting some BS rules out of some FAQ somewhere as if they were unbreakable laws of physics, is a terribly attitude and reminds me of the most disinterested, cynical bureaucrats I've ever had to deal with.

And for what it's worth, I respect Cohen no less for what he said. I respect him for his deeds, not for his kind and humble soul. If reading a few lines of IRC logs, that he himself posted, is enough to make him lose your respect - <USER2> would question whether that respect really meant anything in the first place.

<comment><USER5> In addition to their deeds, I respect people for kind and humble souls. I can understand being upset about the situation (and I agree with you that his point is rock solid, the 60 day expiration is ridiculous), but the fact that he 1) made the claim that he was famous, and 2) having had the time to calm down and reread the conversation, thought there was nothing wrong with what he said and posted it to his blog, makes me lose repect for him.

</comment></comment></comment><comment><AUTHOR> For future reference, a good way to handle this would be:

"The #bittorrent channel on Freenode has been getting trolled hard lately and I no longer have access to it due to the following policies that I think suck: <insert policies>. After talking to a Freenode support member, they refuse to budge on these so I have moved #bittorrent to irc.bittorrent.com, please join us there!"

Wrong way to handle it:

Paste the transcript of you smacking a Freenode volunteer around with your 10 foot long e-peen.

<comment><USER6> Even better way (IMO) to handle it: Register a new nick, ask a Freenode support member to give him OP-access to #bittorrent. Ban trolls - have lunch.

<comment><USER7> Except the FreeNode channel registration process takes months or years (I'm not entirely sure it works at all for already claimed channels, even if the prior claimant has no relation to the project, and there is no doubt of the claims of the new person attempting to register). You'll starve to death if you plan to have lunch _after_ ops are obtained.

</comment></comment></comment><comment><USER7> So, I'm not "one of the most well known and respected people in the whole open source community" and I'm not as socially inept as Bram, but I, too, had some issues getting things done on FreeNode, and I sympathize with his frustration.

The #webmin channel had been claimed by someone unrelated to the project, and who we had no prior contact with; it wasn't a hostile thing, but they hadn't logged in for months, weren't dealing with trolls and had opened access to the topic to everyone (so the topic was being abused for all sorts of ridiculous stuff). We were unable to contact the person directly, so I tried taking over ownership of the channel through the official means. After a year of just waiting (because I'd been warned it was a _very_ slow process, and I don't spend a lot of time in IRC these days), I chimed in on the operators channel, and spoke with a couple of folks. All were nice, friendly folks, but weren't able or willing to do anything about solving our problems with the channel. I believe in the end I was told that our application would be brought to the front of the queue because of the ongoing problems, and how long we'd been waiting. I don't know what, if anything, happened with that; it was at least 8 months ago. I never heard anything about it, anyway, and the last time I logged in, I don't think we had ops on #webmin.

So, Bram is a bit of a douche. This is pretty well-known; anyone that has ever met him or interacted with him knows that socially he is inept (and Asperger's gets bandied about as the reason, though I don't think that really accounts for lack of online social graces). I look past it because intellectually he's brilliant, and ethically he seems solid, so two out of three aint bad; in short, he means well, but he can be mean about it. Even in terms of helping people, within the limits of his social graces, he is generous with his time in helping folks use and understand his code. We all have our flaws, and the FreeNode processes and policies and lack of staff to deal appropriately with those process and policies can frustrate someone with the patience of Job. Bram definitely does not have the patience of Job.

So, to sum up: A 60 day expiry on accounts is idiotic. The official channel registration process, while well-meaning, is baroque and seems to leave a lot of channels in a lurch of having no operator or an abusive operator for months or years. Bram is kind of an asshole. But we still like FreeNode and we still like Bram.

<comment><USER8> Look up Asperger's.

<comment><USER7> I'm familiar with the term. It's my understanding that face-to-face communications are the most impacted areas of human interaction for folks with this condition, and that online communications are easier for them, because they're on mostly equal footing with the folks they're talking to (no one can see anybodies facial expressions on the net, and so only the words themselves matter). It's one of the reasons so many of them find their way into computing and other fields that don't require direct human interaction. With Bram's intelligence, I'm certain he would be capable of effectively simulating normal human interactions online (and I've spoken to him online and he seemed perfectly normal, though he probably wasn't in a frustrated mental state at the time). He could have chosen to approach things with more civility, regardless of whether he has Asperger's or some other condition that makes human interaction in the real world difficult. The loosely realtime nature of IRC allows time for thinking over what you're saying, considering the implications, and thinking through how it will appear to others.

In short, I'm saying that I don't think Bram should get (or would be right to expect) a pass for being an asshole to a volunteer on FreeNode, regardless of whether he has Asperger's or not. Being an asshole isn't OK, even if you have a condition that makes it easier to be one without noticing. It just means you need to be more mindful of your behavior, since it's no one else's job to do it for you.

<comment><USER8> While some people with Asperger's experience problems with face to face communications and have an easier time dealing with people online, that's a sweeping statement.

I know Bram and I don't think he would care if I said that face to face communication is not a problem for him. In my time speaking with Bram both face to face and online, his primary characteristic per Asperger's has been a near complete lack of social fear.

Most humans get nervous in certain social situations. Bram does not. This will certainly cause problems when faced with someone that social might wield power, as an administrator, and Bram my have to pay for his lack of decorum in these situations.

I'm not excusing Bram's behavior. There is no need to excuse it. It has happened and he will pay whatever price is exacted. I'm simply explaining it.

</comment></comment></comment></comment><comment><USER9> I'm particularly fond of this exchange in the comments:

3ricj: It's still just a damn IRC nick. register a new one and ask an channel op to give you rights to the channel. Problem solved. Don't abuse volunteer support people due to inflated self-importance. It's tacky.

Bram: If you'd spent the two minutes necessary to read the conversation you'd know there is no fucking channel op, because I was the only one. Stop being an ass.

Unfortunately Bram, there is only one person being an ass...

</comment><comment><USER10> I'd like to clarify a few points around my post.

The reason I posted the log verbatim, me being pissed off and all, is that I wanted to make very clear that I was accurately representing official freenode policy, and that requesting help through support leads nowhere. My gripe is with freenode policy, which is asinine, not with the particular person I spoke to, who was merely being useless and patronizing.

The reason I got pissed wasn't because of the nick loss, which I find mildly annoying, but because channel ops got blown away, causing me to have to deal with this bullshit instead of just giving ops to someone else.

Yes I can be blunt. If you value the superficial affectation of politeness over the essential point of what someone is saying, you can shove it. I don't appreciate people saying that I'm this way because of asperger's, it just causes other people to whine that they're being oppressed because they can't criticize me. The whole line of argument is stupid. People are free to criticize me for not being polite, and I'm free to respond that they're being petty and superficial.

The whole 'it's free so you can't complain' argument is bullshit. There are plenty of free things which are of negative value to society because they suck up or distract resources which could be working on a much better alternative. I've provided lots of support for free stuff myself, both via employees and directly, and never have I claimed that a problem won't be fixed because the person airing a legitimate gripe hasn't gone through arbitrary bureaucratic processes, or that the person complaining should implement it themselves because they're a programmer, or refused to acknowledge that some pain a user experienced through no fault of their own really was unfortunate. And I always prioritize up users who matter and problems which need immediate fixing. That's the way you run things if you actually care about providing a valuable service.

<comment><USER11> You were a total douche about it. The other guy was actually a bit polite and helpful.

>People are free to criticize me for not being polite, and I'm free to respond that they're being petty and superficial.

This is you not getting it, possibly because you have Aspergers.

edit: Actually, fuck that. You're functional enough to understand what you're doing.

<comment><USER12> I didn't have any opinion of him as a person (yes I appreciate his work), until I saw him spouting off about being important. Now I have a negative opinion of his personality.

The whole aspergers thing is based on a self-diagnosis and the only reason he wouldn't get diagnosed is out of fear not having it.

P.S. Somebody stole my nick, where can I cry about it?

<comment><USER13> ``P.S. Somebody stole my nick, where can I cry about it?''

Please learn to read. He is complaining about a policy he wasn't warned about, a policy that _doesn't_ involve warning the user of upcoming expiry, and finally, that doesn't in any way seem to take into account channel ownership.

It's a bad protocol. That's all.

</comment></comment></comment></comment><comment><USER14> While I agree that he was being a complete jerk to the volunteer, there is some truth to this. Freenode has a policy of reserving the "main" channel namespace (only one hash like #bittorrent or #wikipedia) to officially registered groups. This process is carried out by filling out a long form and waiting for approval. Due to lack of volunteers willing and able to clear out the queue, it takes maybe half a year at minimum. It's nice that Freenode has a system for officially registering groups, but they really should not be actively enforcing rules relying on that if they have no plans to reliably process the gigantic queue.

</comment><comment><USER15> I have to say Freenode came of rather well here. Bram... not so much. :P

 _< bramm> and I hope you realize that you just completely pissed off one of the most well known and respected people in the whole open source community_

Sounds like he's possibly completely pissed off a large portion of the Open Source community :)

<comment><USER16> Indeed. Bram has written some good software, but he's no more important than the thousands of other people that have written good software that I use everyday.

</comment></comment><comment><USER17> If you read the comments one reason FreeNode is in disarray is because Rob Levin who ran the site died in a bicycling accident a few years ago.

In fact the chaos and drama at FreeNode might be the real story here.

[http://bramcohen.livejournal.com/72298.html?thread=1000554#t...](http://bramcohen.livejournal.com/72298.html?thread=1000554#t1000554)

Fragglet writes (in the comments):

"This shouldn't be surprising to anyone with any experience of Freenode. Freenode is a perfect example of how open source projects tend to acquire the personality of their founder. In the case of Freenode, that founder was Rob Levin, famous for his online begging over wallops and for being completely incompetent in general. Levin's incompetence, begging and dictatorial style where he branded everyone who disagreed with him a "troll" gradually alienated all the sensible and technically skilled people from the network staff until the only people left were his equally incompetent sycophantic underlings.

"When Levin died several years ago as a result of his own stupidity (riding a bike without a helmet), they took over. I haven't heard of mquin before but it looks like the cycle continues.

"Your best option is to close the Freenode channel and move to OFTC, the staff of which consist mostly of the sensible and technically skilled people who left Freenode."

Here are some links with more details,

<http://www.theregister.co.uk/2003/01/29/buy_a_piece_of_net/>

[http://antisec.wordpress.com/2006/06/27/eyeballing-rob- levin...](http://antisec.wordpress.com/2006/06/27/eyeballing-rob-levin/)

</comment><comment><USER18> Although I've only seen a part of a presumably actual conversation (haven't tried to confirm it using other sources) I do find the attitude shown by Bram Cohen to be something I would not have expected from 'one of the most well known and respected people in the whole open source community'. It actually saddens me to see an open source programming 'role model' of mine behave like a spoiled child

I do understand the frustration surrounding the policies, yet I also understand Freenode which is offering a free, gratis service. A more humble approach would probably have yielded a quicker result and IMHO was more appropriate.

ps: If Bram Cohen is not really happy with Freenode, he, as 'one of the most well known and respected people in the whole open source community' probably has other options to create a #bittorrent irc channel according his wishes.

<comment><AUTHOR> The source for the transcript is Bram Cohen's official blog.

</comment></comment><comment><USER19> A better title would have been 'Bram Cohen loses Freenode nick, complains' as generally articles here take the title from the link where possible and try not to editorialize when it isn't.

...but it would probably be better still if Internet drama was kept as far away from HN as possible.

<comment><AUTHOR> On the contrary, I find stuff like this highly interesting and consider myself a hacker. I found the comments between Calacanis and Aaron Wall the most awesome stuff I read on Hacker News in the past week, to be honest, and the way I found those was by looking at the HN top rated comments.

It would be interesting to hear other hacker's feelings before we decide what is best for the community.

</comment></comment><comment><USER20> I can't believe he thinks it's a good idea to post this conversation. Apparently he's not aware that several of his lines are straight parodies of the Bad Guy in popular entertainment.

</comment><comment><USER21> Bram Cohen's Aspergers is well-publicized ([http://www.businessweek.com/magazine/content/08_43/b41050468...](http://www.businessweek.com/magazine/content/08_43/b4105046863317.htm)) and essential context for anything you read about/by him.

<comment><USER22> "Cohen never sought a formal diagnosis but turned his considerable attention to the matter"

Self-diagnosis. Are you fucking kidding me?

Just because you were picked on in highschool and are a huge pain in the ass to work with, doesn't mean you have Aspergers.

Guess what, Bram Cohen's probably just an asshole who writes good software.

<comment><USER21> Watch any of his talks or speak to anyone who has ever worked with him.

It's not just about being rude but genuinely not understanding the socially correct behaviour to his own detriment.

Exhibit A: not realizing that it is a bad idea to post a chat transcript of you dressing down a volunteer to a free service.

<comment><USER23> Not understanding social contract is not necessarily Asperger's. Also, exhibit A could also be seen as not caring, there is no proof that he did not realize.

</comment></comment></comment></comment><comment><USER24> 6 months? That's pretty lame, and I'd be a bit peeved as well. Having to go through that entire process of re-registering, etc, just to get an account back and admin'ing that group? I'm glad this isn't a global policy on email addresses or website registrations!

<comment><USER25> Actually, it's 60 days.

<comment><USER26> If you become a supporter and give a donation for the service, you can keep your nick even if you don't log in. So, instead of complaining about a free service, he could have made a tax-deductible donation and not had any of these problems. Alas, lots of "could haves" in this whole episode.

</comment></comment></comment><comment><USER27> The difference between being an asshole and an Aspie is clear; assholes are completely resistant to hearing about a better way to handle something, and Aspies, go "gee, that didn't occur to me, and I was just looking at it this way, but next time I'll try that." I know Bram pretty well, and when something doesn't work, he listens to his friend's suggestions and tries to add them to his social algorithm. Maybe he doesn't do this too publicly, but would you? In casual everyday life he never throws around status, when he meets people he doesn't say anything other than, "I'm a programmer" if asked. He really usually gets embarrassed by recognition and tries to downplay it. However, I think we've all behaved less than humbly when pushed to our boiling point. The trigger is frequently just the straw that breaks the camel's back, and we all can get pissy. It doesn't meet my high spiritual standards for myself when I lose my temper, but it happens. Jeff18 who posted an actually good suggestion on how to handle this situation, would be really good working with Aspies. That is exactly what they need, and what teachers spend most of their time doing with AS children, modeling different solutions. It was very helpful.

</comment><comment><USER28> There is a lesson Bram needs to learn. If you wish to avoid being considered a 'douche' you have to better optimise your statements to undermine your oponent and remove their credibility. He could have posted a factual account of his unpleasant experiences with Freenode that included a sincere warning to any other organisers of official projects. Instead he overemphasised the importance of showing both sides of the story.

If you are going to be negative then it is important to do it well and do it ruthlessly. Don't try to be fair or direct. Play to the crowd and ruthlessly take the moral high ground or it will be taken from you, as is the case here. It is a little ironic but if Bram had been more of a Machiavellian 'meanie' then he would not have been been labeled a 'meanie'. Some of the posts here provide good advice on ways he could have done that.

It seems clear that Bram's misfortune warrants a warning for all potential users of the Freenode servers. Hopefully this is not missed due to Bram's neglect of political expediency.

</comment><comment><USER29> Why not just do what Shaquille O'Neal did for Twitter?

<http://twitter.com/THE_REAL_SHAQ>

Look Bram, you can even yell in your nick too!

        /nick THE_REAL_BRAM
        /join #bittorrent
        /privmsg #bittorrent :Trolls, please stop. It's me, Bram.

</comment><comment><USER25> If anything, this just goes to show the quality support you get from Freenode volunteer admins.

You act like a douche, you should be treated like a douche; "essential context" of suffering from Asperger syndrome or otherwise.

</comment><comment><USER30> Taking a step back as an impartial observer,

(1) Sure, Freenode's policy can be improved, because a significant amt. of users think it is a bit stifling. The admins need to figure out how to engage the users.

(2) In this situation, there are solutions more optimal than douche-baggery. If he wanted his nick back, being nice increases his odds. Bram can use a class in negotations 101.

OK - Let's move on with our lives now, don't you need to prepare for the 3/3/2010 YC deadline? If you are bored - there are plenty of single founders looking for co-founder.

</comment><comment><USER31> Asperger and 'being a meanie' can sometimes be confused. I know Bram's diagnosis isn't official but it seems obvious to most that meet him that's he's a little different.

Edit: Okay I just RTFA and Bram does seem very douchy. If I was the admin I would have handed his ass to him 1/4 of the way through the conversation when he threw his first insult.

And I would have invited him to make a stink in public ... just spell my name right.

<comment><USER32> We're all a little different. That doesn't give him a free pass to be an ass, IMO.

Edit re: your edit - lol! :P

</comment></comment><comment><USER32> Interesting.... _logs into Freenode_ Yay! My nick is still registered. I don't think I've logged in for over a year.

</comment><comment><USER33> There was a problem and someone not solving it - to many this is the douchery.

Jobsworth.

I would be honoured to have Bram Cohen ask me for some help and given his heroic efforts on behalf of the network I would go above and beyond.

Seems Bram just camly stated the facts and the sysop just kept replying rules trump all.

Ashbergers Mashbergers for IRC this is probably the most dainty little flame ever.

PS Bram Cohen rules teh internets</comment>


Gretl: Gnu Regression, Econometrics and Time-series Library - <AUTHOR> http://gretl.sourceforge.net/

<comment><AUTHOR> Just came across this little beauty. It already has datasets for many Econometric texts. Seems like the community of econometrics educators are throwing their weight behind this. Let's hope it becomes the next R.</comment>


Linux for Nebies: How to Install and Use Nano Text Editor - <AUTHOR> https://www.hostinger.com/tutorials/how-to-install-and-use-nano-text-editor <comment><USER2> Won't somebody think of the 'Nebies'?!

</comment><comment><USER3> Nice! Thanks!</comment>


Why People Are Mad at the Airline Bailout - <AUTHOR> https://www.youtube.com/watch?v=x-DNaDlSqBQ <comment><USER2> Would people be as mad if the airlines had paid dividends (like utilities or many established non-growth companies)? I (not a financial expert) looked at their 10-Ks, and it looked like they are prohibited from paying dividends because of their loan agreements.

And yeah, they did borrow money for capex like buying airplanes and maintenance facilities, but they also operate at like a 10% profit margin. With low interest rates that seems kind of reasonable?

I get that using taxpayer money to maintain airlines is unfair, but the bailout (grant) money is contingent upon the airlines maintaining flight routes that they would otherwise shutdown (non-hub airport). The Sec. of Transportation is saying that those routes are critical infrastructure to be able to ship supplies to those places. (Ok she works for Trump, and has worked for Bush & Regan and is married to Mitch McConnell, not sure if that's relevant). But prima facie I don't see what's wrong with saying small towns should have access to medical equipment now, nor for the government paying for it.

The bailout loan money I don't think they really need. Delta and United were both able to borrow $2B each from the banks, and they have plenty of airplanes to use as collateral for more loans. But the bailout loan money is also contingent upon the airlines not having any other access to capital.

I'm just saying the airlines now do not look like the banks did in 2008. They were all profitable from basic operations (flying passengers), and were not over-leveraged in speculative deals (they borrowed to buy airplanes). Delta and United each ended 2019 with over $4.5B cash, and over $2B of easily accessible credit. Their operating costs are like $3.5B/month, and that's running at full capacity w/ no oil war. I'm not a businessperson, but I wouldn't really expect most of my local restaurants (or individuals!) to have enough cash to last two months with zero income.

Anyways, that's all based on looking at their SEC filings. Full disclosure I bought some shares (also is there some moral argument against business owners taking profit from their earnings?), but that also means I'd be really interested if anyone has a good counter-argument.</comment>


The Collapse of a $40 Million Nutrition Science Crusade - <AUTHOR> https://www.wired.com/story/how-a-dollar40-million-nutrition-science-crusade-fell-apart/ <comment><USER2> We've reverted the title from the submitted "Gary Taubes's Low Carb Clinical Studies Were a Failure" to that of the article. Submitters: when you editorialize like this, users (rightfully) flag and moan and it just makes everything worse. Please don't do it.

</comment><comment><USER3> You are editorializing with the headline.

<comment><USER4> Yep. This is what's going on here, nothing in the article about the actual studies failing.

This title is analogous to saying "Amazon is imploding" as a result of the Fire Phone's failure to launch.

</comment></comment><comment><USER5> The article doesn't say what the HN headline says, or at least, not in the way that most people reading the headline would interpret it.

<comment><USER6> " _By August of 2014 the EBC researchers had preliminary results on their 17 volunteers: The data showed "no significant difference" in energy expenditure. That didn't mean it was a failure; to the researchers, they had succeeded in verifying the methodology before using it in an even bigger, longer study._

" _But when Hall presented the pilot's results in-person to representatives from NuSI at a meeting in Bethesda in September, they were not so rosy- eyed.... "From my perspective, the pilot was a failure for several reasons," says Taubes._ "

Then, there's

" _The fourth and largest [NuSI-backed study], conducted at Stanford, randomized 600 overweight-to-obese subjects into low-fat versus low-carb diets for a year and looked at whether or not their weight loss could be explained by their metabolism or their DNA. Published this February in JAMA, the study found no differences between the two diets and no meaningful relationship between weight loss and insulin secretion. The most significant finding was that it's hard to stick to a diet for a whole year._ "

The rest of the story may not describe the failure of studies.

" _As the remaining researchers continued to clash with NuSI over the summer about the second phase, the pilot results were finally published in the American Journal of Clinical Nutrition in July. They received a lot of media attention, in no small part because Hall said the pilot, along with another study he'd conducted previously, "basically falsify" the theory that sugar makes people fat. By the end of the summer the Arnold Foundation had decided not to fund the second phase of the study._ "

</comment></comment><comment><USER7> > NuSI wanted to see the data, and began providing extensive critiques once > they had it.

That's good, but I'm supposed to be suspicious, right?

<comment><USER8> Yes, I think so, but the article is somewhat unclear. It mentions "NuSI would have no control over the pilot study's design, operation, or reporting. He could build the study he wanted." But a couple of sentences later mentions that "The EBC researchers met with NuSI quarterly to finalize the study's design and clinical procedures."

Assuming I'm reading between the lines correctly, I'm interpreting the sloppy writing there to mean that the study was to be done independently by EBC and the _type /style_ of study was something EBC got to design, but the that specifics of the design were signed off by both EBC and NUSI. _If_ that interpretation is correct, it makes NuSI then critiquing it a bit shady given they had already signed off on the design as being good before the study started and now when it didn't provide the results they wanted they suddenly had problems with the design.

To their credit, it doesn't look like they interfered with the reporting of result though.

</comment></comment><comment><AUTHOR> It's interesting to hear him talk more humbly..

"Taubes sounds tired. "I say this to my wife all the time: 'Maybe I'm a quack.' All quacks are sure they're right. Isn't that the defining characteristic of a quack? But the fact is that we funded four studies and the three randomized trials were highly successful operationally."

<comment><USER7> Nah, that's his typical analytical style. The wired reporter would have you believe otherwise, because--well, I don't know.

</comment></comment><comment><USER9> Actual article title: "The Collapse of a $40 Million Nutrition Science Crusade"

</comment><comment><USER10> Whenever low carb gets popular, industry is threatened and spins up some FUD as illustrated in this talk 'Undoing Atkins: A Cautionary Tale' [https://www.youtube.com/watch?v=jIegMp5cWBY](https://www.youtube.com/watch?v=jIegMp5cWBY)

Keto sub is really growing fast, up 400k this year [http://redditmetrics.com/r/keto](http://redditmetrics.com/r/keto)

<comment><USER11> > Keto sub is really growing fast

"We know that people can maintain an unshakeable faith in any proposition, however absurd, when they are sustained by a community of like-minded believers." \- Daniel Kahneman

<comment><USER12> So no subs that are popular are based on fact?

<comment><USER11> "A lot of people believing something does not make it true" is not equivalent to "A lot of people believing something makes it untrue."

</comment></comment></comment></comment><comment><USER13> Bad headline. Here's the important paragraph:

> Taubes says the fundraising trip to Zurich went well, though he won't share > specifics. It could just be the jet lag, or it could be the mental burden of > having to sing for his supper, but Taubes sounds tired. "I say this to my > wife all the time: 'Maybe I'm a quack.' All quacks are sure they're right. > Isn't that the defining characteristic of a quack? But the fact is that we > funded four studies and the three randomized trials were highly successful > operationally. One of these has been published in a top journal with > interesting results and I remain hopeful that we will soon see if the last > two studies will move some needles. Our convictions have gotten us this far, > and despite some disappointments these questions still seem vitally > important to test."

The article basically says the team fell apart and the original donations got closed down because of this. Doesn't actually talk much about the studies themselves.

<comment><USER14> Actually, it does. In the process of trying to get the study participants to a baseline by feeding them a 4 week "control diet", they all lost weight before they even got to the low-carb diet.

The theory that calories from sugar produces more weight gain than the same number of calories from any other source (veggies, meat, etc.) still hasn't been proven. But, I think the idea that calories from sugar are less filling, and therefore promote over-eating is pretty established.

> The EBC's pilot project would lock 17 overweight men inside metabolic wards > for two months, feeding them precisely formulated meals and pricking and > prodding to see what happened to their bodies on a low-carb diet.

> The data showed "no significant difference" in energy expenditure.

> Taubes in particular had issues with many of the study's designs, which fed > participants a "standard American diet" for four weeks before switching them > to an extremely low-carb, or ketogenic, regimen with the same amount of > calories. It was supposed to get them to a stable weight, or energy balance, > to establish a baseline before going keto. But the subjects all lost weight > even before they started cutting out carbs. Taubes contended that was > because the standard diet didn't have enough refined sugary beverages to > depict average American consumption.

</comment></comment><comment><USER15> I don't know how anyone could read this whole article word-for-word. It's so light in information density but also without a story-telling feel.

Anecdote: I have been ketogenic (usually <20g/day, almost always <30g/day) for a few months now. I measure my urinary ketone levels to verify I am in ketosis. This difference is astounding. I have higher peak energy, higher average energy, sleep better, lower peak hungriness, lower average hungriness, the ability to skip meals without feeling starving, and am losing weight. And it's cheaper. The only negative is actually significant: it's much more work. Hours of picking recepies, crosschecking ingredients that we have vs what we need to buy, shopping, cooking, and cleaning the many dishes generated.

I strongly encourage everyone to do it.

<comment><USER4> Just rolled into day 6 of a fast.

Between fasting and a ketogenic diet I've managed to lose 80 lbs and keep it off for more than a year. It was much faster and easier than any other method of weight loss I'd tried in the past, and the results have been easier to maintain.

<comment><USER15> > I've managed to lose 80 lbs and keep it off for more than a year.

Hell yeah!

> easier to maintain.

I've never done any other diet, but I've found keto to be self regulating because eating cheat meals like pizza makes me feel like _garbage_. I suppose eating healthy carbs like apples might be doable, but I'm honestly not even interested

</comment></comment></comment><comment><USER16> The movement might be reclassified as 'The Flintstones' LARPing</comment>


Putting Tesla into climate change perspective - <AUTHOR> https://www.axios.com/putting-elon-musks-tesla-into-climate-change-perspective--21cd7121-e809-4099-981e-27a60906c85d.html <comment><USER2> Not to mention the amount of water and energy used to mine Lithium for its batteries</comment>


Amazon to launch its own Android phone - <AUTHOR> http://www.androidpolice.com/2011/04/01/exclusive-amazon-to-introduce-4-3-inch-dual-core-blaze-smartphone-this-summer-leak-pictures/

<comment><USER2> Mirasol?

Solar panels?

I guess it was still April 1st in some parts of the world when this was posted.

</comment><comment><USER3> I feel sad reading stuff on April 1st knowing its not true. Life could've been so much more interesting

</comment><comment><USER4> I couldn't believe how many hits I was getting for this from Google. I was _sure_ it had to be the real thing...then I realized that pretty much every page was copy & pasted from Android Police...

It's the _afternoon_ of April 2nd where I am already!

</comment><comment><USER5> I would rather liked them launching their own Android tablet.

<comment><USER6> I would rather like we didn't keep linking april fools articles of other sites here, as though they were real.

<comment><USER5> Yeah. Too many of them, it makes for a very disturbing noise, which ceases to be funny very quickly. Also, I was misled. It's already April 2 in my timezone.

</comment></comment></comment><comment><USER7> this had me looking into mirasol panels which seem to be a cool tech at first glance, but they do not look very bright without direct sunlight. hope they can improve them as 6x lower power consumption is great for mobile devices.

</comment><comment><AUTHOR> How.. could.. I.. be.. so.. gullible? I really really believed this (I am the OP)

<comment><USER8> See the update at the bottom of the post now.

</comment></comment><comment><USER9> CALLED IT. They're doing it for sure. Next big company.

<comment><USER6> >Next big company.

They're not already?

And making an android device is what would finally push them over the edge?

<comment><USER9> Next player next to: Apple, Microsoft, and Google. They're small compared to those 3 giants and Amazon is going to enter their MKT cap territory by 2020 in my opinion.</comment></comment></comment>


Google Cloud Acquires Aloomas - <AUTHOR> https://cloud.google.com/blog/topics/inside-google-cloud/google-announces-intent-to-acquire-alooma-to-simplify-cloud-migration <comment><USER2> Respective blog post by Alooma: [https://www.alooma.com/blog/alooma-plans-to- join-google-clou...](https://www.alooma.com/blog/alooma-plans-to-join-google- cloud)</comment>


Scala Macros - <AUTHOR> http://scalamacros.org/index.html <comment><USER2> Previous HN discussion: <http://news.ycombinator.com/item?id=3215210>

</comment><comment><USER3> any info on hygiene?</comment>