Security Hole in Sendgrid - <AUTHOR> https://chunkhost.com/blog/15/huge_security_hole_in_sendgrid

<comment><USER2> Social engineering will almost always work. I don't really fault Sendgrid for this (though I could see this not working as well if you were using Amazon SES...no support to even talk to!). It sucks that they got caught with their pants down but I bet a good social engineering attempt on ChunkHost might have yielded similar results.

The lesson here is to have multiple defenses. 2 factor auth is a great start and it worked in this case.

<comment><USER3> You should fault Sendgrid as they specifically have a policy NOT to perform this change of email request (from the article).

Sendgrid can also change their systems so that phone support personnel can NOT perform this change or perform this change with approval from a supervisor.

Sendgrid being in the business they are in should also know that they are susceptible to these types of attacks and what they can lead to (many, many systems which can have password requests sent to email addresses).

<comment><USER4> I don't know... Mistakes happen. There seems to be little to gain from faulting SendGrid, but faulting SendGrid would force them to take some kind of action such as terminating the rep. I think I'd prefer the rep remain employed, because I trust they'd never make this mistake again. Also, now all the other reps know to avoid it.

EDIT: May I ask what can be gained from faulting SendGrid in this case?

<comment><USER5> I agree with you that terminating the rep is not interesting, and I think you're mistaken if you feel like that's what anyone thinks will solve this problem.

Actions SendGrid could take:

* Make it impossible for their front-line support staff to change the email address on file. If you want that -- which should be _extremely_ rare! -- you talk to a high-level manager who is competent at authenticating you.

* Send the email that says "hey, we're going to change your email address now" with a lead time to allow for the possibility that, even after your authentication, you've been conned.

* Make a phone call to the phone number on record, too.

You ask what's gained by faulting SendGrid, because you take it as a given that they will make these changes. But that's not how blame works. The blame serves a _function_ of ensuring those changes by holding them accountable for their current problems.

</comment></comment></comment></comment><comment><USER6> Another title for this submission could have been:

"Massive Security Hole in ChunkHost. Non-2FA accounts can be owned."

Because it turns out anyone with a Sendgrid Support account also effectively had _potential_ access to any account at ChunkHost not using two-factor authentication. Which is also true of thousands of other companies that are relaying their password reset emails through third party SMTP services.

SendGrid seems lame, for allowing this and for their response promising to yell more loudly at their support people, but they're an SMTP relay service not an authentication service.

<comment><USER7> That would be because sendgrid is lame.

I've recently tried to use their service to send emails, club member newsletters. I've never thought much about bulk e-mails before and I thought it was a "solved problem" by now. Sendgrid are well known so they were my first choice.

During initial testing I found both bugs in the API and missing functionality. I've worked over 20 years with IT and yet sendgrid support is easily on the top-3 list of my worst support experiences, a total waste of time.

We ended up using mailgun instead and so far it looks much better.

<comment><USER8> We looked into sendgrid and also went with mailgun. Been with them for over a year now. Originally started with their mailing list API but had enough service delay problems that we were considering switching entirely. Don't remember exactly but may have had some outages as well. Their support suggested we change to using their batch sending API instead and I'm glad we stuck with them because it's been solid for over 5 months now. (Well they did just have two issues recently, ssl cert and duplicated email sending but it didn't affect us too much.)

Overall they've been a good service provider and their tech support has always been helpful and pleasant to deal with. (I know! Crazy, right?).

</comment></comment></comment><comment><USER9> The problem is that it was technically possible, for a representative, to make this change without the proper verification. You just can't rely on humans for that.

<comment><USER10> SendGrid once went over my head and changed my account settings on behalf of a customer of mine, without even consulting me beforehand. I had a customer with a history of reporting mails as spam (activity reports he requested in a webapp). When you report a mail as spam, the address goes into a blacklist to avoid causing sender reputation issues. After the third or so time of having him ask to get the mails again, then mark one of them as spam, I told him I wouldn't be offering that feature to him any longer. He contacted SendGrid about it directly, and the SendGrid rep actually went into my account and added his address to a whitelist to bypass the blacklist, where I intended it to remain.

I thought that was just the strangest thing, and it didn't sit well with me. Accessing a customer's account when they request service is one thing, but making changes on behalf of a stranger you _know_ has no authority over that account? That was when I moved the last of my apps over to Mandrill.

</comment></comment><comment><USER5> Looks like a deeply unsatisfactory response from SendGrid. They don't even know for sure ("it appears .. pretty much confirms") that their own support staff changed the email address?

<comment><USER11> This shows why so-called PR-speak is necessary. Email like this should not be in a conversational style because it can easily be misinterpreted.

<comment><USER12> are you serious? How was it misinterpreted? It point blank says that that's what happened? Please illustrate how exactly it was manipulated to say something else?

</comment></comment></comment><comment><USER13> So what's the answer? Here's two very legitimate scenarios:

1) You sign up, enable two-factor auth, then lock yourself out (lost password and your second-factor). How do you prove to the service provider that you are you?

2) You sign up, enable two-factor auth, then Mallory claims that they locked themselves out. How does the service provider prove that Mallory is not you?

<comment><USER14> Text message or phone verification of details only you should know about the account history, payment methods, etc. As others mentioned, a waiting period during which they try to contact using any means s previously authorised for a response. Compare IP addresses and deny logins from strange countries or origins without further verification, etc. Of course, every measure and countermeasure needs to be justified, since there's an implementation and upkeep cost, but... It's possible to be "more certain," that something is legit or not.

<comment><USER13> Yep, so text messages and phone verification could really be considered a "third factor". I guess anything information you have already provided to your service provider is considered an X-factor.

</comment></comment></comment><comment><USER15> Use Amazon SES to generate your outbound emails; ensure proper IAM policies, and that you're using 2 factor auth to login to your AWS account.

<comment><USER16> Is AWS any less susceptible to Social Engineering attack of this type?

Specifically--can AWS support staff grant access to AWS accounts, and if so:

what are their criteria for doing so, and what are the policies in place to ensure those criteria are met, and how are those policies audited?

As a TechStars alum, my company was granted $50k in AWS credits, which were tied to my AWS account[1]. When I left the Company, the CEO was able to get the credits moved to a different AWS account that was company owned, without my intervention at all, even though I was the only account owner.

The fact that he could have credits moved out of the account without any kind of verification from me[2], should be cause for concern.

[1] I should have created a new Amazon account for a group email [2] Obviously the credits belong to the company; they weren't mine to use, so I would have authorized the migration.

<comment><USER17> Amazon (non-AWS) is infamous for being vulnerable to social engineering attacks. I don't know if they've changed their polices more recently but they are (or were) often the first attack vector for social engineering. If you can get access to an Amazon account you can get the last 4 digits of the user's credit card number(s). You can then use that info to reset accounts over the phone with other companies.

</comment></comment></comment><comment><USER18> What I found most interesting was they were targeted due to Bitcoin. Today _most_ services would never store credit cards themselves but rather have them stored at a secure payment gateway. So they're unlikely to be attacked to get to those cards. T

Trust me I know that CC's are getting sniffed in transit too often so I'm not saying they're 'safe'. I'm just wondering if there is something unique to Bitcoin that suddenly makes you a target as though you were known to be storing CC's data at rest onsite.

<comment><USER17> Bitcoin is like cash. It's far more valuable than credit card data.

</comment></comment><comment><USER19> Email accounts are the weak link for many things... DNS registrations, web hosting, etc. Get the email account and you have it all.

<comment><USER20> I'm coming around to thinking you should get a secret email address for your sensitive accounts. Treat the string of that email address as almost as important as the string of your password. The problem is that you do have to tell it to people who probably don't share that philosophy to the same extreme.

</comment></comment><comment><USER21> We use Sendgrid and have hundreds of thousands of customers that might be phished by this social engineering trick. It's absolutely unacceptable that such a crucial piece of infrastructure is vulnerable to such a simple trick.

I'm going to bring this up with our team and see if there's another vendor that can more reliably protect our customers.

<comment><USER22> Your logic is a bit weird.

Sendgrid just experienced this _major_ embarrassment and are currently re- training their staff to avoid it again at all costs.

And you're going to move away from them _now_?

<comment><USER21> I'll talk it over with my group. Retraining doesn't guarantee anything. It could be that this problem is endemic to the company itself.

For example, why should 1st level support have the ability to make major changes like this? It sounds like only 2nd level support, a smaller group of more highly trained support staff, should have the ability to do this. Does SendGrid have enough money/resources to split their team into 1st and 2nd level support? Would a larger company have those type of resources that would better protect my customers?

These are questions I will talk over with my team.

</comment></comment></comment><comment><USER23> It's an important lesson for all of us. I've seen a lot of privacy ignorance when it comes to support (e.g. folks handing over sensitive data after an anonymous request on Olark). We should all go an extra mile and verify the identity of the requestor.

1) If your support chat doesn't enforce authorization, always ask the requestor to send you an email. 2) Make sure the domain is correct (that's where Sendgrid screwed up). 3) Never agree on replying to a different email address than the one of the sender.

</comment><comment><USER24> BCC every message is evil, as it can be misused as in this case. SendGrid should never allow that, or at least should flag such behavior. At the minimum, they should notified account owners of this change.

<comment><USER25> The attacker got SG to change the email on file, so the notification would just be sent to him.

</comment></comment><comment><USER26> It's not a security hole, misleading title.

Should read "social engineering resulted in security breach" and guess what, this happens all the time whether sendGrid or not.

</comment><comment><USER27> My first thought was to whois chunkhost.info, which returns a clear name, email address and phone number.

Or is it that easy to register a domain with a fictitious persona?

<comment><USER28> It's that easy. You can use anything you want.

</comment></comment><comment><USER29> So what they are saying is that SendGrid should have had two-factor auth and this would have never happened.

<comment><USER30> SendGrid's policy (as stated in their first email) is that the support people shouldn't be changing account emails in this fashion. Even if SendGrid had 2 factor auth, who's to say the support guy wouldn't have just disabled that?

<comment><USER31> If their policy is that support staff should _never_ be able to change an accounts email address... why does the system let them do it?

<comment><USER29> At some point someone has direct DB access and can do this. Sure, normal support people don't but this just makes the social engineering aspect a bit more complex, not impossible.

</comment></comment></comment></comment><comment><USER32> [http://twofactorauth.org/](http://twofactorauth.org/)

</comment><comment><USER33> SMS verifications should be sent out to allow over the phone changes.

</comment><comment><USER34> Alas, the weakest part of the system is...

</comment><comment><USER35> Sendgrid seems to be its own worst enemy (Adria Richards debacle, now this).

I suggest we dub the act or state of being one's own worst enemy, being "sendgriddled."

</comment><comment><USER36> Send your emails yourself.

It's not like it is hard. At least not harder than integrating to a third party email sender.

<comment><USER37> Sending email is hard and for most people not a thing that provide them with a proper ROI, because among other things...

\- You need to make sure that your email servers IPs are not on black lists.

\- That you use DKIM properly

\- your multipart mime encoding is correct

\- bouncing e-mails are handled...

\- take care of scaling & operating the servers

\- and so on....

You can spent ( and waste ) a lot of time on this... especially if you are new to email sending..

<comment><USER38> > \- You need to make sure that your email servers IPs are not on black lists.

This alone is a huge, huge chore. Especially if you run a hosted service that allows some user-specified content in outbound email bodies. It's a lot cheaper for us to pay Mandrill to handle all of that for us, provide us excellent metrics and diagnostics, and let us know if one of our users is sending junk mail before it gets out of hand.

<comment><USER20> Even if you do _everything right_ you can still find yourself on a blacklist. Then you get to pound sand.

Blacklists suck. Not as much as spam sucks, though.

<comment><USER39> Frankly, with the amount of bullshit blacklists out there that real mail providers actually trust, I've come to detest blacklists more than spam.

<comment><USER20> Has anyone set up a blacklist full of random IPs as a joke to see how many people follow it?

<comment><USER39> Well, we _have_ been put on blacklists that the operator wanted money to "expedite" removal from. I'm assuming that blacklist was pretty much random IPs... And it did impact deliverability.</comment></comment></comment></comment></comment></comment></comment>


How to create an Amazon bestseller instantly. - <AUTHOR> http://realbusiness.co.uk/news/how-i-got-a-blank-book-to-the-top-of-the-amazon-charts Incredible story on the power of marketing. <comment><USER2> Did someone else already do this? I could have sworn I read about this in 4-Hour Work Week (not Ferris, but someone he mentions).</comment>


All in the name of Pragmatism - <AUTHOR> http://hadihariri.com/2013/06/24/all-in-the-name-of-pragmatism/

<comment><USER2> The whole history of computing is one of redefining words. Really, who cares if you call it a Unit Test or a Frisbee? You certainly don't have to know the name to come up with the concept and find it useful.

REST is an unfortunate name for a great movement - unfortunate because the original "REST" paper was the same kind of overengineered crap that REST-the- movement was a rebellion against. So now the highly paid consultants are peddling their overengineered crap and calling it "REST" and on a literal level they're right. But the solution isn't to argue about what is and isn't REST - it's to consider the actual behaviours (HTTP verbs, content types, HATEOAS) on their own merits.

I believe in using HTTP verbs to mean the things they say, but I think HATEOAS is actively harmful. Am I doing REST? Who cares!

<comment><USER3> I always wonder - is there a reason to use HTTP verbs?

It seems to me using POST to request information is better than using GET - instead of putting a url in the GET request, put it in the body of the POST (plus anything else you want).

I thing a decent JSON-based approach might be easier than bare http, which lacks things that might be needed.

<comment><AUTHOR> If you treat your endpoints as resources, and if you think of the verbs as the operations you can perform on those resources, then you have a discoverable interface. IF you limit everything to a single verb, then you have to define a series of operations...

<comment><USER3> But this isn't the only way an interface could be discoverable - what about a schema (or a good api doc for humans). This way also couples api to implementation - what if I want different verbs? Suddenly, we stray from the discoverable path.</comment></comment></comment></comment>


Show HN: Abot – Open Source Anonymous Feeback for Slack Teams - <AUTHOR> https://abot.apki.io <comment><USER2> "If you are on a Free or Standard plan your anonymity is guaranteed."

You should make it clear that you are talking about Slack plan and not abot plans.</comment>


Ask HN: How feasible is it to become proficient in several disciplines? - <AUTHOR> For example to become a professional in:<p>- back-end api development<p>- DevOps<p>- Data Engineer (big data, data science, ML, etc) <comment><USER2> It is feasible, though as with any type of specialization, you're then a "jack of all trades, master of none". Maybe a title like "Full Stack Data Engineer" would be descriptive.

You could write an OAuth API for accepting and performing analysis of datasets (model fitting / parameter estimation; classification or prediction), write a test suite, write Kubernetes YAML for a load-balanced geodistributed dev/test/prod architecture, and continuously deploy said application (from branch merges, optionally with a manual confirmation step; e.g. with GitLab CI) and still not be an actual Data Engineer.

</comment><comment><USER3> It certainly is feasible.

Become proficient in one discipline before moving onto the next one. One at a time. Use your increasing proficiency as stepping stones towards full-stack roles.

If you try to learn too many skills in parallel, you will become a jack of all trades and lose traction as newer technologies gain favor. You really will be more successful by following quality rather than quantity strategy.</comment>


Giant futuristic 'Tesla Towers' in abandoned woods near Moscow - bra-ket https://www.rt.com/news/170704-tesla-tower-lightning-russia/ <comment> bra-ket [https://en.wikipedia.org/wiki/Istra_High_Voltage_Research_Ce...](https://en.wikipedia.org/wiki/Istra_High_Voltage_Research_Center)</comment>


Of Algorithms, UAVs and Teams  - <AUTHOR> http://www.heekya.com/blog/?p=25 <comment><USER2> As a developer, i like to be left alone most of the time but too much isolation of developers in a team can wreck havoc. Its especially bad in the scenario the article discusses...

GIT and SVN are really good tools for collaboration without "persistent meetings"</comment>


The No-Brainer Issue of the Year: Let High-Skill Immigrants Stay - <AUTHOR> http://www.theatlantic.com/business/archive/2011/12/the-no-brainer-issue-of-the-year-let-high-skill-immigrants-stay/250219/#

<comment><USER3> This issue comes up a lot on hacker news. While I do stongly support a stronger emphasis on skilles immigrants, and I do believe STEM grads are valuable, I believe this article (and this genre of article in general) overlook a critical point.

I've mentioned a RAND study many times in my comments on hn. This study took a very objective look at the pay, career prospects, completion time, attrition rate, and so forth of STEM grad degrees vs the professions (MD, JD, DDS, MBA, etc). The conclusion reached was that STEM grad degrees are unappealing to young americans because they are no longer competitive with other career paths available to the "best and brightest".

So, does it make sense to specifically staple green cards to evey stem diploma when the most objective research suggests the shortage may be market driven?

I don't have a definitive answer. I think it's a complex question wothy of discussion, and not at all the no-brainer the atlantic article claims it it.

<comment><USER4> But of course the completion times and attrition rates are high. Anyone who's worked in the science academia is well aware of the fact that way too many American K-12 graduates, no matter how much they may like a STEM career, are woefully unprepared to deal with the math involved in it. The attrition rates and general unpleasantness of these majors result directly from this factor. Until K-12 math gets fixed for good, you need either some stopgap measures to fill those jobs or the inanity to graduate engineers who can't do basic math (and then drive over the bridges they design).

<comment><USER3> Unfortunately, I don't have data on failure rates in PhD programs broken down by immigrant vs non-immigrant. This data would be clouded by the fact that many "dropouts" are counted as successful MS students, not dropouts (further complicated by the fact that in some cases, this is absolutely true, the student was happier getting an MS and did make this choice!). It could also be clouded by the fact that US citizens can drop out of their STEM programs without jeopoardizing their right to reside in the US, whereas international students may face deportation if they fail or drop out and don't secure some other visa.

I do think that this last part is used - unintentionally - to manipulate international students, and is part of why the appeal of these programs has declined for people who don't need the program to gain US residency.

I would much rather see this problem resolved by empowering the immigrant to choose what field and degree path (or absence of degree path) he or she wishes to pursue than limiting their freedom. But what I can't do is pretend it isn't a factor in how abusive PhD programs can be toward their students. My first order of business in designing a better system would be to strip universities or employers of any control over an individuals immigration/residency status.

<comment><USER3> BTW, not sure if you're still following this thread, but here's some info on attrition:

www.cgsnet.org/portals/0/pdf/N_pr_PhDC_bookII.pdf

Looks like there is a statistically relevant difference in completion rates - international students tend to complete at 67% vs 54% for US citizens - <USER2> that this gap is driven by math and physical science, while humanities only has a 2% gap. So while I wouldn't say there is a vast gap, there is a relevant gap.

While 67% is much preferable 54%, keep in mind that at elite law, med, and business schools, completion rates tend to be in the high 90s.

</comment></comment></comment></comment><comment><USER5> That doesn't seem like a no-brainer. Wouldn't it be harder for skilled Americans to find jobs here if they're competing with immigrants? It's not like there aren't high-skilled jobs in other countries, where those immigrants whom we educate could get jobs.

The subtitle says _Our policy toward the world's best and brightest is currently: "Welcome! Enjoy this expensive education. Now go home!" Does that make any sense?_ But I think it makes even less sense to say to native-born Americans, "Enjoy this expensive education. Now go to Europe to get a job, because we decided to hire an Indian instead".

<comment><USER6> _It's not like there aren't high-skilled jobs in other countries, where those immigrants whom we educate could get jobs._

So it's your desire to consign the Indian would-be immigrant to a life of poverty (i.e., poorer than the bottom 5% of the US [1]) just to make sure your wage stays above $150k/year?

But as long as you are happy with me shipping jobs to India, I guess it's all good.

[1] [http://economix.blogs.nytimes.com/2011/01/31/the-haves- and-t...](http://economix.blogs.nytimes.com/2011/01/31/the-haves-and-the-have- nots/)

<comment><USER7> >So it's your desire to consign the Indian would-be immigrant to a life of poverty just to make sure your wage stays above $150k/year

The reality is that the government will make policies that favour citizens over foreigners. So yes, it may be someone's desire to cosign an Indian would- be immigrant to a life of poverty just to keep their wage stable. We're already doing that by not taking in unlimited immigrants from, say, war-torn Africa.

>But as long as you are happy with me shipping jobs to India, I guess it's all good.

Skilled immigration has nothing to do with offshoring.

<comment><USER6> _Skilled immigration has nothing to do with offshoring._

Sure it does. Both are methods of tapping into the labor pool overseas.

 _We're already doing that by not taking in unlimited immigrants from, say, war-torn Africa._

Very true. Our unwillingness to take on more refugees has resulted in thousands of people being tortured, raped and murdered. Are you advocating this policy?

<comment><USER8> Most African cultures have not completed the demographic transition. Until that happens somehow, those cultures will exceed the carrying capacity of any environment, and war over inadequate resources. With unlimited immigration, the billion in Africa would continue moving until America became equally inhospitable.

If anything, our population is already too high, verging on disposable "life is cheap" levels. We haven't learned to make a civilization that values individuals and treats them decently, except when they are scarce enough that resources are going underused (making it clear to everyone that we benefit from their presence).

</comment></comment></comment></comment></comment><comment><USER9> It's a cost issue usually disguised as a "skilled immigrant" issue. Large companies want technical workers (the new miners and factory workers) who are willing to accept a much lower wage than native workers. So when they talk about "skilled" they usually mean "skilled and willing to work for $40k/year instead of $80k/year".

Just look at how many H1B positions are advertised and how much legal but shady stuff goes on. Put ad in local paper among classifieds for "free dirt available", if any resumes are received from US citizens they are discarded (note they have to be "considered" but not accepted), and so on.

If it was just about "skills" there would be no need for this shit to go on.

[http://www.youtube.com/watch?v=TCbFEgFajGU&feature=plcp&...](http://www.youtube.com/watch?v=TCbFEgFajGU&feature=plcp&context=C301d875UDOEgsToPDskKn5dk5-5tIALOarSLcJ1JL)

<comment><USER10> you cannot hire a h1b for 40k/year, minimum prevailing wage requirement prevents you from doing so.

<comment><USER11> You can hire an H1B for 45k/year. I know because I was that H1B at one point. My previous employer gave me quick pay rises once I proved that I was capable, but not everyone is so lucky.

<comment><USER10> Was the prevailing wage where/when you were employed less than 45k?. If it was then you were not undercutting the american worker,if not your employer was doing something illegal. From personal experience hiring a H1B is anything but cheap, lawyer fees and all.

<comment><USER11> The prevailing wage was $45k.

This was for a programming role in New York City- I do not know _anyone_ that gets paid $45k. I'm unsure how they calculate prevailing wages, but I'd suggest that the formula could do with some tweaking.

<comment><USER10> i doubt prevailing wage in new york city is $45k for a programming job. Prevailing wage determination has nothing to with H1B even if that was the case.

<comment><USER11> Well, I can tell you that it was, because I have the paperwork at home which says exactly that. While the wage determination isn't part of the H1B process it still has a key role to play in it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> If the advocates of high-skill immigration are so smart, why do they keep tying high-skill immigration to massive low-skill immigration and amnesty, two issues which are big losers?

<comment><USER13> You're the only one bringing up Mexicans. So I'm not sure who you're complaining about.

They're associated, rather than "linked" because, well, they're both immigration driven by a labor shortage.

<comment><USER6> Anamax didn't bring up Mexicans, and it's not his hangup. Here is video of Obama talking about how great a startup visa is, and then tying the startup visa to comprehensive immigration reform.

[http://www.washingtonpost.com/blogs/innovations/post/obamas-...](http://www.washingtonpost.com/blogs/innovations/post/obamas- immigration-dodge/2011/07/07/gIQAyYXV2H_blog.html)

<comment><USER13> I didn't play the video but I seriously doubt that Obama used the word "amnesty".

"Low-skill immigration and amnesty" is quite clearly talking about latino immigrants. Not accusing him of being racist or anything but that's who he's talking about.

Comprehensive immigration reform is needed in some form and a startup visa is one aspect of immigration reform. So it's really not outlandish to include it when talking about the subject. I'll spare you a websters-mirriam definition of comprehensive, immigration and reform.

Sorry, the original comment just sounded like off-topic whining to me. Lots of putting words in people's mouths, very little contribution.

EDIT: And the conservative downvote brigade has arrived. I'll just call it a day here.

<comment><USER6> _So it's really not outlandish to include it when talking about the subject._

If you want the startup visa to pass, there is a very good reason to do it by itself: the startup visa is likely to pass, whereas comprehensive immigration reform is not.

 _Lots of putting words in people's mouths, very little contribution._

It contributes even less to deny his claims, which are basically correct. Obama's blueprint for immigration reform does include amnesty (you need to scroll to page 3 to find it).

[http://www.whitehouse.gov/sites/default/files/rss_viewer/imm...](http://www.whitehouse.gov/sites/default/files/rss_viewer/immigration_blueprint.pdf)

<comment><USER13> The "path to citizenship" outlined there has very little in common with what comes to mind when you say "amnesty". Read the language there, it's all about burdens on illegal immigrants and prerequisites, after which they can get in the back of the line to apply for citizenship. "Amnesty" implies something more similar to what Reagan did.

Again, nobody was talking about this at all until anamax brought it up. And Obama proposing a startup visa by itself absolutely will not pass. You know why? Because it would involve Obama proposing it. See the House Republicans refusing to pass a tax cut this week.

<comment><USER12> > Read the language there, it's all about burdens on illegal immigrants and > prerequisites, after which they can get in the back of the line to apply for > citizenship.

"back of the line"? They're starting in front of everyone who applied to immigrate, didn't get accepted, and waited until they did.

Are you really arguing that it isn't amnesty because there are some conditions?

<comment><USER13> Anything that takes over a decade to successfully execute isn't quite "amnesty" by my definition. "Amnesty" is like "Hey, you're good to go!".

Amnesty International isn't campaigning for prisoners to be released "about 10 years from now".

<comment><USER12> There's no "decade to successfully execute" - they get legal resident status immediately after "touching base" (at most).

But, you know this.

Yes, they get to wait to be eligible for citizenship, just like every other legal immigrant. Are you seriously arguing that not letting them jump that line is punishment?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> No system is going to be perfect, how can "high-skill" immigrants be evaluated with absolute certainty that they are, in-fact, highly skilled. I am sick and tired of employers in the U.S. viewing people with degrees from universities in third-world countries as if they are equal to a degree from the U.S (and thus possibly passing over US workers who may not have completed a degree program). I realize that some immigrants come here for college and that would validate their skills-sets, such as "if they graduate from the U.S. university with high grades, then they can stay and work" but it seems to me a lot of these supposedly highly skilled, supposedly "better than the average American" tech workers are people who were educated exclusively in another country and its not comparing apples to apples, in my opinion.

<comment><USER11> _I am sick and tired of employers in the U.S. viewing people with degrees from universities in third-world countries as if they are equal to a degree from the U.S_

I, on the other hand, am sick and tired of the immigration authorities questioning my degree from the UK and refusing to confirm that it is equivalent to a US degree. Hardly third-world.

But in any case, your problem is solved very easily- by firing people. At a previous job we hired a guy with a Masters from a college in New Jersey (I forget which, sadly). He was useless. We fired him. Education can get you in the door, but it can't keep you in the room.

The problem with this is that hiring immigrants is more expensive and time- consuming because of the process you have to go through. Although it sounds backwards, if it was easier to hire immigrants it would be easier to fire them when they aren't as good as they say they are.

<comment><USER14> I think that the UK is considered on-par with the US, I wasn't inferring anywhere that the UK is third-world.

<comment><USER11> Oh, I know. I was making a more general point that degree equivalency is just a giant mess.

</comment></comment></comment></comment><comment><USER15> Yeah that is a no-brainer: you have to have no brain to be against it and at the same time anybody with a brain knows it is never going to pass.

Why do you guys keep posting these articles?

</comment><comment><USER16> 1) Importing skilled immigrants is like exporting jobs because most of these people go back to their own countries, and those who stay take the place of a US citizen who could have had the job, if our education system was better and our government's policies were otherwise aligned with the welfare of its people.

2) All routine immigration should be immediately stopped, and indefinitely kept that way. Exceptions should be made only for the few, true geniuses who could definitely benefit the US in a big way.

<http://youtube.com/watch?v=9PpaoZE8oXk> NumbersUSA - Immigration by the Numbers - Part 2 of 2

<http://youtube.com/watch?v=XyTmClBU7nA> NumbersUSA - Immigration by the Numbers - Part 1 of 2

<http://NumbersUSA.com>

<comment><USER4> > immigrants [...] who stay take the place of a US citizen who could have had > the job, if our education system was better and our government's policies > were otherwise aligned with the welfare of its people. All routine > immigration should be immediately stopped, and indefinitely kept that way

Yes, and to be consistent also ban imports. Each suitcase produced abroad takes the place of one that could have been produced in the US, if the manufacturing industry was better and governmental policies were aligned with the interests of blue collar workers.

I mean, North Korea is so successful, there's no reason to not emulate their economic policies!</comment></comment>


Ask HN: How do you improve Soylent's flavor/texture? - <AUTHOR>

Soylent noob here. Just placed my order a few days back and expect to receive  v1.1 in a few weeks. However I read that Soylent tastes really bad. Any suggestions/tricks about how to make it taste better while not ruining it's nutritional balance completely ? <comment><USER2> I ordered several months ago and still waiting so I wouldn't expect to receive it in a few weeks unless you get lucky. It's actually already past the initial estimate they gave me and emailing got me a response of not being able to estimate a date of when I'll receive my order

</comment><comment><USER3> Lee Hutchinson of Ars Technica added vanilla extract (and purple food coloring) to his Soylent. If you're interested, here's the rest of the article: [http://arstechnica.com/gadgets/2013/09/ars-does-soylent- the-...](http://arstechnica.com/gadgets/2013/09/ars-does-soylent-the-finale- soylent-dreams-for-people/)

</comment><comment><USER4> I've tried eating Soylent 1.0 almost exclusively for two weeks and I really enjoyed it. I wish I could have access to more Soylent, but I live in Canada and Soylent is very rare. I used a blender to mix the Soylent and I added frozen strawberries and sometimes mangos, peaches or bananas. I also sometimes added soy milk. I am also open to try adding other ingredients to Soylent, but I would need more Soylent.

Frankly, I would easily eat it for 90%-100% of my meals. They said in a recent email that they are going to ship to Canada in March 2015...

What I like the most about it is that it's easy to prepare and when I prepare one pouch, I have enough to drink/eat for almost two days. Also, I think it tastes really good. And I love the vision of the company.

<comment><USER5> Why don't you brew your own then? [http://diy.soylent.me/](http://diy.soylent.me/)

<comment><USER4> Yes, I'm definitely considering it. But I'd rather just wait a few more months (March 2015) and finally get the official Soylent shipped.

As much as I like the taste, for me the main selling point of Soylent is that for example, I could buy 28 bags of Soylent at once and automatically get more every month. Not have to worry about buying and preparing food.

</comment></comment></comment><comment><USER6> I've been adding a couple of tablespoons of dark chocolate cocoa powder. The first couple of days, I was kind of barely choking it down, but by day 4, I woke up with a strong craving for it. Now, just over a week into it, I would classify it as mostly neutral in taste and don't mind it at all. I certainly enjoy the ease of pouring a glass from the pitcher in the fridge as opposed to making a sandwich for lunch.

By the way, it really does seem to turn out a lot better if you mix it with room temperature water as the brochure suggests, and also mixing an entire pitcher by shaking seems to come out way smoother than when I was trying to mix just a glass or when I tried to mix it in a blender.

</comment><comment><USER7> I find it amazing that people take this idiotic idea seriously. Newsflash: there has always been protein shakes. Stuff you can buy at GNC is almost certainly a lot better for you than this garbage.

<comment><USER6> Protein shakes that I'm aware of aren't attempting to provide a complete and balanced diet, they are attempting to provide a supplement.

<comment><USER8> __Meal replacement __shakes attempt to provide a complete and balanced diet.

Some examples:

[http://www.naturalhealthyconcepts.com/raw-meal-vanilla- GL2-p...](http://www.naturalhealthyconcepts.com/raw-meal-vanilla-GL2-p-garden- of-life.html?gclid=CjwKEAjw2MOhBRCq-Nr87_j- lDASJAAl4FNhcEDnyNg4qP5nV3FwFXBAD7qTP_d-X6zPVaVnRbXlKBoCDsDw_wcB)

[http://www.luckyvitamin.com/p-19447-ultimate-life-the- ultima...](http://www.luckyvitamin.com/p-19447-ultimate-life-the-ultimate- meal-30-servings-1200-g?ProductSku=68565&utm_source=googlebase&utm_medium=fpl&utm_term=UltimateLifeTheUltimateMeal30Servings1200g423oz&utm_content=68565&utm_campaign=googlebase&site=google_base&scid=scplp2949077&gclid=CjwKEAjw2MOhBRCq- Nr87_j-lDASJAAl4FNheybNT-0sDHzcme8i96UAKOR3mQN6IDmWt1QflOH0DxoCGPrw_wcB)

<comment><USER9> the first one is a soylent killer

<comment><USER10> First one looks good but how can it be a meal replacement with 0 cholesterol?

Also it's $3/serving, but each serving is 300 calories, so you'd have to eat at least 6-7 servings per day = $18-$24 per day.

</comment></comment></comment></comment></comment><comment><USER11> I would try it before worrying about fixing the taste. It really isn't that bad. Nor is it that good. It just kind of... is. Been drinking it for around three days, not exclusively, and the best I can say is that it tastes deliberately inoffensive. Which in my mind is a plus.

</comment><comment><USER12> Buy a tub of EAS chocolate protein powder. $20 for 2 lbs.

Just mix a scoop of that with some water (I do about 4oz), and then pour that mixture into your normal amount of Soylent. Mix the result and serve. Makes it much more palatable.

</comment><comment><USER13> Can this solve world hunger? I'm guessing making this as non-profit and using the labor and material in under developed countries, may be this can be produced with even lower price or even given away free. Any balanced meal that can be given away free on massive scale can potentially solve the world hunger. In fact it can change world for real. Once food problem is solved, people can live anywhere without worrying about jobs. That even might solve problem of slums and housing. Sure, one still needs sanitation and electricity and other needs like education and clothing - but food had been the most challenging of all needs.

<comment><USER14> Bananas and eggs could solve world hunger - and in fact are available and affordable to many people who you might classify as hunger. Sure, some kind of protein shake in liue of peanut butter might be a good handout in periods of starvation - but hunger is a way more complex issue than lack of physical access to calories or nutrients and there is certainly no powder or "technical fix" for the issues involved wit hhunger.</comment></comment>


Petya Ransomware: Live Counter of Ransom Dollars Paid - <AUTHOR> https://franciskim.co/petya-ransomware-live-counter-ransom-dollars-paid/ <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=14645452](https://news.ycombinator.com/item?id=14645452).

There's nothing wrong with this submission per se, but because there is already an active discussion about this topic on the front page, we had to mark it as a dupe.

Edit: actually, since you used a spam service to buy upvotes, we've banned both you and your site. This is obviously a capital offense on HN.

All: I hope everyone realizes that when you do this you leave obvious traces in the data.

<comment><AUTHOR> I disagree that it is a dupe. The purpose of the post is different.

</comment></comment><comment><USER3> We have no idea if that is the only address they are getting paid on, so this is kind of misleading.

<comment><USER4> Those who have examined the publicly available malware samples have stated this address as the only one used at the moment. It is certainly possible that an upgraded variant may use others though.

</comment></comment><comment><USER5> I mean, he's basically going to DDoS the Blockchain.info servers if too many people use this.

<comment><AUTHOR> My site would be DDoS'd first... for blockchain.info the resource required to process is negligible imo.

<comment><USER5> How so? If someone sits on your page and it's running that call every two seconds, there's little impact to your servers, but 30 hits a minute to blockchain.info.</comment></comment></comment>


Types of dark pattern - <AUTHOR> https://darkpatterns.org/types-of-dark-pattern <comment><USER2> I always wonder : are they people paid to actually ask programmers to implement that (obviously, yes) and who think that is a perfectly reasonable thing to do ? Second question : is this socially acceptable or is it just me who thinks it's despicable (hence, by egocentric generalisation, socially unacceptable)</comment>


Ask HN: Do I need a formal business plan for my side project? - <AUTHOR> I'm kicking off work on an exciting side project with a friend and I think we have a pretty solid idea of how the project can be priced and who our customer base could be at least to start.
We're bootstrapping and don't plan to seek any investors or take out loans -- right now the only expense is basically a server I already own.
In your experience is it still useful to formalize a business plan for a fairly informal side-project like this?
We hope it will become more than a side project, it's in a space we both care about and have worked in for a long time but there's no immediate expectation of growth. We aren't setting any hard deadlines for quitting our dayjobs or anything. We'd just like to create it and share it and see if it catches on.
I don't want to kill the momentum for actually building the thing in our spare time by self-imposing needless paperwork but a little voice inside me says it might be a useful exercise even if we're the only ones who see it in the end.
What do you think?
Thank you! <comment><USER2> You definitely should. I remember when I started doing serious side projects, how invaluable having a document was.

It should be living though. Start with something small, describe goals, and outlook. Put a feature checklist on it. As you work through early problems and refactors, treat it like a development blog. Include build notes.

You will probably put this down, and pick it up a few times on your journey. Make sure you leave plenty of breadcrumbs for yourself so that you can be productive each time you do.

And, should you decide to put it down for good, you'll have a nice little project history for lessons the next time you try it.

</comment><comment><USER3> might want to checkout:

[https://en.wikipedia.org/wiki/Business_Model_Canvas#/media/F...](https://en.wikipedia.org/wiki/Business_Model_Canvas#/media/File:Business_Model_Canvas.png)

A lot lighter weight but contains the right questions.

<comment><AUTHOR> That looks very helpful -- thank you!</comment></comment>


Color – Cloudflare Design - <AUTHOR> https://cloudflare.design/color/ <comment><USER2> It doesn't work for all sites.

Looks like it gets data from cssstats.com:

[https://api.cssstats.com/stats/?url=](https://api.cssstats.com/stats/?url=)

Which is not very reliable/not able to parse some CSS files/rules (as one of the comments mentioned, !important is a problem)

EDIT: cssstat.com is pretty awesome: [https://cssstats.com/stats?url=http%3A%2F%2Fmedium.com&name=...](https://cssstats.com/stats?url=http%3A%2F%2Fmedium.com&name=Medium)

</comment><comment><USER3> Looks like the site may be having traffic issues right now, it's unable to fetch my palette from some sites I work on.

Very cool service, nonetheless! I love being able to fetch the palette colors and visualize them on the page here. Looks beautiful. I'm also sort of jealous -- this is a great recruiting tool for designers.

PS: Love the export function!

<comment><USER4> It doesn't appear to be a traffic issue. It looks like it's breaking when it encounters things like "!important" in a site's CSS.

I was able to pull other sites (though maybe they're cached?) like CNN and Ycombinator</comment></comment>


Why I've Fallen in Love with the Nexus One - <AUTHOR> http://www.horsepigcow.com/2010/02/why-ive-fallen-in-love-with-the-nexus-one/ <comment><USER2> I'm a pretty happy Nexus One user. Well I was until I picked up my iPod touch again and played with it. I now have even more respect for Apple. It's the level of polish and responsiveness that blows everything else out of the water.

<comment><USER3> Same here. It's the little things. Like how menus don't have any elastic when you get to the end. I could never tell if I was at the end or if the phone froze. I'm looking forward to checking out the Desire. The hardware buttons plus Sense could be pretty nice.

</comment></comment><comment><USER4> It seems that a lot of this guy's "this is awesome" points are cloud related — the gCal integration, seamless contact info from Google — and are the main reasons I _don't_ want to move to Android.

Frankly, I think that Google already has too much of my information, and the recent Buzz debacle demonstrates that they can't really be trusted with it.

No thanks. I'd much rather sync with my local address book.

<comment><USER5> At least with android you still have the option to use different contact systems, dialers, calendars, and browsers if you choose to. Android, unlike iphone, is perfectly happy allowing to replace core functionality just about everywhere on the phone.

<comment><USER6> I have my iPhone syncing with my google contacts, google calendar and gmail. It's very easy to do and probably the top link if you google it.

<comment><USER5> Syncing != Replacing. If you were forced to sync your iPhone's contacts with MobileMo, there would be no way for you to get around that like there would be on Android. That was my point.

</comment></comment></comment></comment><comment><USER7> A lot of Android's criticisms come from the fact that people expect it to be an iPhone - they want the screens to scroll like the iPhone, they want to navigate apps using header buttons (instead of the standard back button), they want shaking to undo, they want pressing the trackball to take them home etc. It kinda understandable, as the iPhone is almost everyone's first smartphone, but still pretty silly.

If they get over their iphone-centric view, they'd find Android has many strengths. The standard buttons (home, back, menu) actually improves usability immensely, since you never have to care how a specific app wants to place its navigation elements or options etc. You know the back button will almost always take you back/cancel, you know that if you're ever in doubt, the menu button will save you etc.

I also very much appreciate the fact that the phone doesn't treat me like a dumbass. For example, while the iphone is easier to unlock the first time around (pretty hard to miss the SLIDE HERE TO UNLOCK message), it becomes stupid and annoying after awhile and takes away from the aesthetic appeal. Or the fact that the only allowed customization you can make is to re-arrange your icons, rather than making the phone YOURS and seeing what you actually want to see.

<comment><USER8> I don't feel at all that my iPhone treats me "like a dumbass". I could not have _less_ desire to change the way I unlock my phone: by about the third time I did it, it was _completely_ natural... so much so that I just had to think for a second to remember whether I have to slide to unlock each time (and I do so probably 100 times in an average day). It just "happens".

In cases where the designers can make a choice for me that's the "right" one, I'd much prefer them to just do that and remove any cognitive burden from me: I don't WANT more things to make a choice about in my life, it's complicated enough as is.

I certainly understand that other people feel differently, and I'm happy that they enjoy their Android phones. But I think our industry has labored for far too long under the assumption that everybody wants to tinker. The fact is, most people actively don't want to tinker; tinkerers are just vastly overrepresented in the group that designs these devices.

<comment><USER7> You completely missed the point of the unlock (and pretty much the rest that followed). I _WAS_ talking about the defaults. Take a look at the Nexus One and iPhone unlock screens.

[http://www.simonblog.com/wordpress/wp- content/uploads/2008/1...](http://www.simonblog.com/wordpress/wp- content/uploads/2008/11/iphone_lock_screen.jpg)

[http://www.thesearethedroids.com/wp- content/uploads/2009/12/...](http://www.thesearethedroids.com/wp- content/uploads/2009/12/nexus_one_3.png)

The nexus one is far more subtle - first time users have no obvious way of knowing they have to drag the green unlock button except for a small green dot that appears when you press. The iPhone is certainly more user-friendly here...except after that first time, it becomes annoying, whereas the N1's button remains pleasing. This isn't about _replacing_ the lock screen, its about how the _default_ works. This is one small example of how many other things work. In their endless praise of the iPhone, people are not aware (or refuse to acknowledge) the sacrifices and tradeoffs that go into making things obvious for _first_ time users.

<comment><USER8> So how is it that the N1 remains pleasing? Just because it doesn't have a "slide to unlock" caption? Gotta say, that one _really_ doesn't worry me much. And I often hand my phone to people who don't have an iPhone and appreciate that I never have to explain to them what to do.

</comment></comment></comment></comment><comment><USER9> At least there's a nice disclaimer that cues one (one who's looking for objectivity, that is) to stop reading at paragraph #1:

"That is to say, if I wasn't addicted to using every Google app out there (calendar, mail, docs, maps, etc.), the phone may not have wowed me so much, but I AM a Google girl, so it fits beautifully into my lifestyle."

<comment><USER10> She's not saying she likes it because it's _from_ Google, she's saying she likes it because it makes interacting with Google services easy. Which is entirely objective, and apparently compelling enough to switch from her iPhone.

<comment><USER9> Didn't say she was from the company. I was pointing out that she admits to being a thorough Google Fan-gal, enamored of everything the company produces. Fan-boys/gals typically aren't critical, and this article did not give me any objective insights. I read more emotional torment in it than I did concrete analysis.

Plus, what I do gather is more repulsive than attractive. Google is building a device to [ultimately] lock us into their services and devices (or make their services available solely via their devices)? This is great?

Same concern with Apple. I worry about the fans of both behemoths.

<comment><USER11> Google isn't forcing anyone to use their services on the Android. Unlike the iPhone, the app API exposes all the device functionality used by the Google- made apps, so any other company could easily build a competing ecosystem for the Android. What's more, Google doesn't even control the Android OS itself; it's completely open source.

<comment><USER10> Agreed, although I'd say that Google controls Android -- maybe not completely, but pretty thoroughly.

</comment></comment></comment></comment></comment><comment><USER12> I was in "Like" prior to the update that added multitouch to the browser, and prior to finding into Aedict, a Japanese/English dictionary app. After multitouch and Aedict, I'm in Love.

And, shameless plug: Did y'all try the free Hacker News reader app I uploaded to the Market?

[http://ifdefined.com/blog/post/A-Hacker-News-app-for- Android...](http://ifdefined.com/blog/post/A-Hacker-News-app-for-Android.aspx)

<comment><USER13> Thanks for making this! Let me know if you want any help hacking on this. [username]@gmail.com

</comment></comment><comment><USER14> I just ditched my iPhone 3G today in favor of a Droid, and I love pretty much everything she mentioned here. I already use most of Google's services (GMail in particular, but the calendar is nice too) so it's a much better fit for me.

That, and I love the multitasking, and that the notifications are (in my opinion) much more useful since I can see that I have new emails or texts without having to actually unlock the phone.

I'm also very impressed with the navigation feature. The interface on it pretty much destroys that of every other GPS I've used, whether it was a stand-alone device or an iPhone app. Quick to load, extremely accurate, and surprisingly quick to notice and reroute if you don't take a turn.

I know a lot of people like the iPhone, and it's still a nice device, but I think this is a much better choice for me; I'm a heavy Google user (and have more loyalty to Google than I do to Apple) and I wanted fewer limitations.

</comment><comment><USER15> This is offtopic: can you buy an Android phone, remove the vendor-supplied version of Android and install a fresh, straight-from-SVN version of the OS instead? If an Android phone allows that kind of flexibility, I'll really consider spending some cash on a smartphone as opposed to another cheap-ass J2ME phone.

<comment><USER16> It depends on which "an Android phone" you want to consider. Manufacturers can lock down the phone as much as they like.

The N1 however requires one simple command (which can and probably does void your warranty, depending on how nice HTC/Google feels like being) and then you can flash whatever you like.

For other phones, there's usually a nonsupported hack that will let you do the same.

</comment></comment><comment><USER17> It seems like everyone but me hates the HTC micro-trackballs. I admit I've only spent a few minutes using one, but it seemed harmless at worst, and actually struck me as a very nice input device. Maybe I just have fond memories of my first laptop, an early Powerbook.

<comment><USER18> I like the trackball too. It's great for moving the text cursor, something that's always frustrated me on the iPhone.

</comment></comment><comment><USER19> Why I Haven't Fallen In Love With The Nexus One:

no physical keyboard

<comment><USER20> I am much happier with a Droid than my wife was with a Nexus One. But I rarely use the keyboard, to be honest.

NB: I have all kinds of conflict here.

<comment><USER17> I played with a Droid in a store and the keyboard was _awful_. Every other similarly configured phone, including Motorola's own Cliq had a far superior keyboard.</comment></comment></comment>


Semaphores in Plan 9 [pdf] - <AUTHOR> https://swtch.com/semaphore.pdf

<comment><USER2> for a dead operating system Plan 9 certainly seems to be kicking, however faintly :)

<comment><USER3> One or more kicks are over here: [http://harvey-os.org/](http://harvey- os.org/) is taking the open-source Plan 9 code and getting it to compile with GCC and clang, etc. They have a userspace with APE (posix) compatibility and they almost have Google Go ported and they debug it with gdb... very much a work in progress though.

<comment><USER4> Porting Plan 9 to compile with GCC and Clang, or giving it a POSIX compatibility layer seems like missing the point; Plan 9 was notable because of all the stuff it threw out despite being familiar and widely admired, from text-only output all the way down to ANSI C.

It's an environment that demands you adapt to it, rather than vice versa. POSIX doesn't need another quirky API bolted on the side, it's already got quite enough as it is.</comment></comment></comment>


Google Chrome extension to detect unsafe passwords - <AUTHOR> https://www.wired.com/story/password-checkup-chrome-extension/ <comment><AUTHOR> _attempts to monitor passwords in a cryptographically secure and private way...

Google never learns your username and password in the process...

we don't want any sort of trackable identifier for the user that would reveal any information..._</comment>


Gartner: DBAs Aren't Part of the NoSQL Conversation - <AUTHOR> http://www.scalebase.com/gartner-dbas-arent-part-of-the-nosql-conversation/

<comment><AUTHOR> Good point - seems that Devops are the next gen DBAs

<comment><USER2> ...although with none of the grounding in _why_ ACID and data integrity are good things.

You need to know the rules to break them safely and effectively.</comment></comment>


What's killing newspapers is the same thing that killed the slide rule - <AUTHOR> http://www.slate.com/id/2206854/pagenum/all <comment><USER2> Handheld calculators?</comment>


Hotmail launches accounts you can throw away - <AUTHOR> http://news.cnet.com/8301-10805_3-20030574-75.html

<comment><USER2> I was under the impression that Hotmail _is_ accounts you can throw away.

<comment><USER3> They multiplied it then. Now we have multiple trashbins.

</comment></comment><comment><USER4> I've been using and publishing my one personal email address for over 10 (15?) years now, and I sign up o a ton of new web sites and notification lists. So far I've never been harassed by spam that I can't get rid of, and it takes me 10 seconds a day to scan through my Google Apps Gmail spam folder to look for false positives.

I just don't see the need personally for throwaway accounts, although I do use a few subaddresss with minuses in them for filtering.

Maybe I'm not a typical user, and I get why people think they need them, but in my actual experience, I've been doing fine without them.

<comment><USER5> I've had the same experience. I use mailinator occasionally, for sites that seem _really_ untrustworthy, but on the whole I use my real email and am not too bothered with spam.

</comment></comment><comment><USER6> Hotmail did something!

</comment><comment><USER7> I created <http://boog.me> specifically for that purpose, but instead of receiving spam forever, you just forget about that account and never check back.

<comment><USER8> Like mailinator.com?

They have new aliases all the time to prevent people preventing you from using mailinator email addresses.

</comment></comment><comment><USER9> A similar throwaway email forwarding service I've been using for a while is spamgourmet: <http://spamgourmet.com/>

Spamgourmet has two advatanges I can see: one is that it's dead easy to create aliases, the other is that it's small enough that noone has started an automated system to spam spamgourmet users (something that it is vulnerable to.)

<comment><USER10> Shameless self promotion: there is also my <http://tempalias.com> which doesn't require you to create an account, or even just visiting the site more than once (there is a bookmarklet).

Also, the full site is open source (node.js), so you can run your own at your own domain

</comment></comment><comment><USER11> They should launch accounts _they_ don't throw away.

</comment><comment><USER12> Anyone else see this as a royal pain in the ass? Malware developers and spammers are going to jump all over this one.

<comment><USER13> I wouldn't think so - it should be more difficult to interface with a email service like than than to use their own server software.

</comment></comment><comment><AUTHOR> Can anyone find this info on a Microsoft blog, or feature list, or something? I could only find the info on CNet.

<comment><USER14> From the Windows Live Blog:

[http://windowsteamblog.com/windows_live/b/windowslive/archiv...](http://windowsteamblog.com/windows_live/b/windowslive/archive/2011/02/03/hotmail- delivers-aliases-to-help-you-manage-and-secure-your-email-account.aspx)

</comment></comment><comment><USER15> It is possible to use different email accounts from one gmail interface as well, which I do.

<comment><USER16> Yes, but it is painful to set up things like check mail, send mail account, forwarding and filters. Google should add alias too, I hope that what hotmail do will force them to do the same.

<comment><USER17> What about email@example.com? It's pretty useful, but still people can know your real address.

</comment></comment></comment><comment><USER18> won't this make it really easy for spammers to create fake accounts on other sites?

<comment><USER19> It's still harder than a catch-all alias on a domain hosted elsewhere.

</comment></comment><comment><USER20> Would be also useful if the government would issue us multiple identities we could throw away.</comment>


Host your own Cryptonomicon's tombstone on a Raspberry PI - <AUTHOR> https://github.com/Mathieu-Desrochers/Linux-Notebook/blob/master/procedures/self-hosting.md <comment><USER2> I think the title is misleading. That's just imcomplete basic mail server stuff, missing lmtp, spam protection, dane and a valid cert.

</comment><comment><USER3> What is Cryptonomicon's tombstone? I haven't read the book</comment>


IoT Sensors Monitor a 1,400-Kilometer Canal in China - <AUTHOR> https://spectrum.ieee.org/tech-talk/telecom/internet/a-massive-iot-sensor-network-keeps-watch-over-a-1400kilometer-canal <comment><USER2> > Although some sections of the canal had access to a fiber optic internet > connection, other areas had no access and passed through remote areas with > spotty or absolutely no cellular network service. As a solution, Yang and > his team developed the so-called Smart Gateway to receive data continuously > from local sensors and then transmit it to a cloud server using whatever > signal was available at the moment. That could include fiber, Ethernet, 2G, > 3G, 4G, Wi-Fi, or Zigbee.

If you're building such a massive infrastructure project, why not just run fiber along its length?

<comment><USER3> I always wondered about that myself. I've seen people discussing what the best technology is for monitoring remote oil pipelines, should they use cell spectrum and ensure every part of the pipe is covered, cell and ensure each transmitter can connect m2m to relay messages to where coverage is, or some other tech...and no one suggested "Hey...why don't we just run fiber along the pipe?" There may have been a good reason that wasn't obvious to me...or it may have been people legitimately didn't think of it, too enamored by the idea of connectivity in a "remote" location.

<comment><USER4> I could think of a few potential reasons:

\- Maintenance: It could be very difficult to find and fix a fiber break. AFAIK, there's no easy way to determine where a break in the fiber is, you generally end up replacing the entire broken segment, which in this case could be miles.

\- Reliability: If the fiber breaks, all the upstream sensors go down. Especially since a fiber break could also mean a pipeline break, you just handicapped yourself at the most critical time.

\- Cost: Hundreds of miles of fiber, properly shielded from the elements, must cost a lot. (Of course, getting wireless signal to thousands of sensor stations would also be pricey, and I can't say how they'd compare.)

<comment><USER5> If you're interested, optical time-domain reflectometers are used to characterize fiber cables, including breaks/bends/faults/etc. Pretty standard and relatively cheap test equipment.

<comment><USER6> I was curious how accurate those are, found a datasheet for the PRO-OBL-201A ($1600, or effectively nothing compared to an oil pipeline). It's a portable "optical break detector", full blown reflectometers might have more features.

They list the maximum range as 100 Km, with accuracy of +/\- (0.8 m + 0.001% x Distance). So measuring to a break at maximum range, you'll be within 1.8 meters.

</comment></comment></comment></comment></comment><comment><USER7> It sure sounds like the definition of what is IoT has changed since the last time I checked. I always thought IoT was about attaching sensors to objects in daily life, such as in clothing, appliances, food packages, doors, etc. Building sensors along a canal to me sounds like a regular surveillance network.

The project is still innovative though.

<comment><USER8> > It sure sounds like the definition of what is IoT has changed since the last > time I checked...

It's almost like some kind of system for supervisory control and data acquisition...

<comment><USER9> IoT terminology gets used for a lot of different things, including fairly traditional SCADA. It does tend to be different in degree than historically-- more sensors, more analysis, more real-time control, but it's certainly different from wearables, SmartHome, or even the broader set of sensors that go by things like smart cities.

</comment></comment></comment><comment><USER10> Hmm, dubious claim here with the "Smart Gateway"

>> "The Smart Gateway can learn the availability of the connection to the cloud. After a successful transmission, it will follow that network next time. Otherwise, it will try another one," says Zhang.

Considering,

>> Video cameras were spaced every 500 meters along the entire structure.

And,

>> Yang and his team developed the so-called Smart Gateway to receive data continuously from local sensors and then transmit it to a cloud server using whatever signal was available at the moment. That could include fiber, Ethernet, 2G, 3G, 4G, Wi-Fi, or Zigbee.

I'd be interested to see how their network holds up when streaming video to a gateway via Zigbee or video to the cloud over 2G (or even 3G). Considering the system is supposed to go into "continuous stream" mode during a natural disaster or other emergency, I'd guess this is also when the network would collapse. Oof.

</comment><comment><USER11> Adding IOT is just shameless pandering for clicks why not add bitcoin to it :-)

I helped build similar devices (custom S100 based systems) 30 years ago at BHR group for remotely monitoring experiments at remote sites and using sensors to monitor pipelines was standard back then.

Wish I had suggested we build our own modems out of BYTE for £30 instead of paying £300 for answer and £600 for answer originate.

</comment><comment><USER12> It's an interesting project, I really wish that they would have talked more about how the system has been implemented. As in what system are they using and how close to "real time" are they getting the data? Those are a HUGE number of sensors and without even considering how they are getting the information back to any gateways, it would be a gargantuan task to build anything out that would be easily digestible my a person in a Control Room.

</comment><comment><USER13> I would have thought that with all the effort to build that canal that they would have wired it all. it would have been a great opportunity to have done so considering all the effort expended to create the canals and dams.

is there some reason this was not undertaken at the time of construction?</comment>


Timbuktu Manuscripts Not As Burned As Reported - <AUTHOR> http://www.tombouctoumanuscripts.org/blog/entry/timbuktu_update/

<comment><USER2> Ironically,

 _during the period of French colonial domination of Timbuktu (1894–1959), many manuscripts were seized and burned by the colonialists, and as a result, many families there still refuse access to researchers for fear of a new era of pillaging._

[http://www.understandingslavery.com/index.php?option=com_con...](http://www.understandingslavery.com/index.php?option=com_content&view=article&id=378&Itemid=233)

<comment><USER3> All but 3 of the aztec's books were burnt by the Spanish after they conquered Mexico.

<comment><USER2> You may actually be referring to Mayan books instead:

 _There were many such books in existence at the time of the Spanish conquest of Yucatán in the 16th century, but they were destroyed in bulk by the Conquistadors and priests soon after. In particular, all those in Yucatán were ordered destroyed by Bishop Diego de Landa in July of 1562. De Landa wrote: "We found a large number of books in these characters and, as they contained nothing in which were not to be seen as superstition and lies of the devil, we burned them all, which they (the Maya) regretted to an amazing degree, and which caused them much affliction." Such codices were primary written records of Maya civilization, together with the many inscriptions on stone monuments and stelae that survived._ [1]

As for the Aztecs, interestingly, many of their books were burned prior to the Spanish invasion:

 _Two of the primary architects of the Aztec empire were the half-brothers Tlacaelel and Montezuma I, nephews of Itzcoatl. Moctezuma I succeeded Itzcoatl as Hueyi Tlatoani in 1440. Although he was also offered the opportunity to be tlatoani, Tlacaelel preferred to operate as the power behind the throne. Tlacaelel reformed the Aztec state and religion. According to some sources, he ordered the burning of most of the extant Aztec books claiming that they contained lies. He thereupon rewrote the history of the Aztec people, thus creating a common awareness of history for the Aztecs._ [2]

In any case, there are more than 3 Aztec codices in existence now. [3]

[1]: <http://en.wikipedia.org/wiki/Maya_codices#Background>

[2]: [http://en.wikipedia.org/wiki/Aztec#Rise_of_the_Triple_Allian...](http://en.wikipedia.org/wiki/Aztec#Rise_of_the_Triple_Alliance)

[3]: <http://en.wikipedia.org/wiki/Aztec_codices>

<comment><USER3> _You may actually be referring to Mayan books instead:…_

Oh you're right, that's the one. I knew it was that area & time.

</comment></comment></comment></comment><comment><USER4> I wonder if they would be opposed to allowing Google or some other big book digitizing company to scan the manuscripts to preserve electronic copies in case of disaster?

It would do wonders as far as allowing the world to take a peek at the ancient texts, keep at least some trace of them safe in case the originals were lost, and it would be good PR if Google or somebody like that "saved" them digitally.

<comment><USER5> The manuscripts are already being digitised by the Timbouctou Manuscripts Project (the source of this article), hosted at the University of Cape Town and funded by the Ford Foundation. Those already digitised are available in their database [0], sometimes with accompanying translations.

This is part of South Africa's assistance to Mali, dating from 2001, to preserve and study the manuscripts by funding and building the new Ahmed Baba Institute building (the one damaged by rebels) with the equipment to prevent further degradation of the manuscripts and digitise them, giving Malian conservationists further training at the National Archives in Pretoria and setting up research projects.

Aside from something as drastic as the possibility of another civil war, the manuscripts are the safest they've been in years.

[0]<http://www.tombouctoumanuscripts.org/db/>

</comment></comment><comment><USER6> Its amazing there's entire groups of people who are so anti-knowledge. I don't see how you can do some introspection and not realize its a backwards stance.

<comment><USER7> Please don't be so gullible as to take the Western media's narrative without a grain of salt; The only reason for burning the manuscripts is as a provocation, that is, _because_ they are highly valued. Not to mention the fact that it now seems (As the article reveals), that the provocation (the "hoax") was mostly made by the other side.

<comment><USER5> The OP makes it clear that the manuscripts were not destroyed only because of the good work that was done to _hide_ them before and during the Ansar Dine occupation and because most had not yet been moved to the new building. Some manuscripts did not survive and were destroyed, the good news is that more were not.

Nor is Ansar Dine too noble for such destruction, as they have destroyed UNESCO World Heritage sites on religious grounds before[0] and have plainly stated that they'll destroy anything they believe to be idolatrous in their narrow religious definitions.

The Western media has many, many faults but be very careful of falling into the trap of believing that it is always correct to take the 'other' side or believe that those being portrayed as bad are being unfairly treated.

Whether you read Western news sources, alternative sources like Al-Jazeera and Russian news or (better yet) local Malian and regional African news, the clear image that emerges of Ansar Dine is that of a ruthless and cruel extremist religious group. That villages, towns and cities were welcoming _French_ troops in with cheers should tell you all you need to know about how much Ansar Dine were hated.

The situation with the MLNA is a little more complex however, so it's more than I can get into in this post.

[0][http://www.reuters.com/article/2012/07/01/us-mali-crisis- idU...](http://www.reuters.com/article/2012/07/01/us-mali-crisis- idUSBRE86008Z20120701)

</comment></comment></comment><comment><USER8> A little bit of history on book burning/banning [http://www.digitaljournal.com/article/182074/Some_History_on...](http://www.digitaljournal.com/article/182074/Some_History_on_Book_Burning)

</comment><comment><USER9> It took me a good two paragraphs to realize I was not reading about any sort of software library by the name of "Timbuktu".

</comment><comment><USER10> So it was western propaganda?

<comment><USER11> From the article, it appears to have been started by the mayor of Timbuktu --who apparently resided in a town 800 miles away. So it may have been someone's propaganda (but apparently not western in origin) or could have been misinformation (i.e. misconstrued information) or it could refer to a missing ten percent of the texts whose location is unknown.

</comment></comment><comment><USER12> Isn't "burned" a superlative?

<comment><USER13> Since you asked, insofar as the participle "burned" is functioning as an adjective here, it is in positive degree. The comparative degree would be "more burned," and the superlative degree would be "most burned."

This classification of adjectives by degree comes, of course, from Latin,

<http://www.dl.ket.org/latin2/grammar/ch34-degofadj.htm>

and English doesn't operate completely in the straitjacket of Latin grammar, but has its own very intricate grammatical rules.

[http://www.amazon.com/Cambridge-Grammar-English- Language/dp/...](http://www.amazon.com/Cambridge-Grammar-English- Language/dp/0521431468)</comment></comment>


9007199254740992 - <AUTHOR> http://www.csie.ntu.edu.tw/~b01902112/9007199254740992/ <comment><USER2> If you're using Chrome, this should save you some time:

      function step() {
          var eventObj = document.createEvent("Events");
          eventObj.initEvent("keydown", true, true);
          eventObj.which = 37 + Math.floor(Math.random(0, 1)*3);
          document.dispatchEvent(eventObj);
      }
      int = setInterval(step, 0.001);

<comment><USER3> Based on comments from the 2048 thread, I'm running a deterministic variant of this which just cycles Left, Down, Right, Down.

After an hour or so, the largest tile is 524288, 2^19: [http://i.imgur.com/Yk758sx.png](http://i.imgur.com/Yk758sx.png)

While I was writing this comment, it collapsed down to the next largest tile, 1048576, 2^20: [http://i.imgur.com/PVPCvUC.png](http://i.imgur.com/PVPCvUC.png)

<comment><USER4> And I thought I went too far with 32k...

</comment></comment></comment><comment><USER5> And the productivity goes down by the same factor.(2^53 btw )

I finally reached the 2048. :)

I think I understand now why candy crush is so popular.

> 8192.

> 16384 and I'm done. _Manually_

There needs to be a save feature.

<comment><USER6> Did you get to 16384 manually? This is what I got after (roughly) 12000 random moves:

[http://imgur.com/EnROFm9](http://imgur.com/EnROFm9)

Can any math people figure out how many years it would take to finally end this? (Not win, just lock it up).

<comment><USER7> I locked up a board manually in about 10 minutes, with intent. Someone skilled should be able to do it in less.

[http://i.imgur.com/zyqDtZi.png](http://i.imgur.com/zyqDtZi.png)

(My technique: Toggle left-right until no movement happens. Tap up. Repeat from start.)

</comment></comment></comment><comment><USER8> This is nothing but a pure button masher... just hit the keys real fast. Use a strategy of "shaking" e.g. hit left,right quickly in succession a bunch of times to fill the board followed by a "circle" e.g. up left down right a bunch of times. I really don't like hating on a HN submission, but either this game is very lame or I am missing the point entirely. :P

<comment><USER9> It's kind of absurdist humour. HN has been full of responses to the rather clever 2048 game lately -- 2048 in HTML5, 2048 in the smallest number of bytes, the 2048 AI solver, 2048 in Brainfuck, 2048 in Latin, etc etc etc. This is amusing to me because the subject line looked almost like one of those obnoxious Bitcoin transaction posts, thus bringing together HN's latest fad with its eternal obsession, in my mind at least.

Now, complete this sentence: 2048 on HN will jump the shark when someone posts...

<comment><USER10> ... [http://rwg.github.io/0/](http://rwg.github.io/0/)

<comment><USER11> Thank you.

</comment></comment></comment></comment><comment><USER12> Well, that escalated quickly

<comment><USER13> my thoughts precisely

</comment></comment><comment><USER14> Space bar resets. I didn't know that space bar resets. I am so crushed.

</comment><comment><USER15> Can we please have TwitchPlays9007199254740992?

<comment><USER16> This is even a game that Twitch would actually be GOOD at!

</comment></comment><comment><USER17> Can we apply the same AI to this and make an screen saver out of this?

</comment><comment><USER18> [http://i.imgur.com/ZafTI5T.png](http://i.imgur.com/ZafTI5T.png)

This has got to be a new record.

Used the random move setTimeout method with 4 directions, and strategically pausing to merge pieces.

EDIT 1: [http://i.imgur.com/Rt3V5kb.png](http://i.imgur.com/Rt3V5kb.png) \- Just reached 4 million.

EDIT 2: [http://i.imgur.com/QyrW3QK.png](http://i.imgur.com/QyrW3QK.png) \- 22 million: When do I stop?

<comment><USER19> It seems random with 4 directions works well more than 3.

[http://imgur.com/u0Yws7T](http://imgur.com/u0Yws7T) Here is what I ran so far with random 3 directions. V shape emerges.

</comment></comment><comment><USER20> Watch and wait :)

```

game = new GameManager(8, KeyboardInputManager, HTMLActuator, LocalScoreManager); setInterval(function (){ for(var i =0; i < 100; i++){game.move(Math.floor(Math.random()*4));}},1000)

```

</comment><comment><USER21> I find this interesting because it hooks into the obsession many gamers have with constantly increasing (large) numbers in games like diablo or other RPGs in order to feel accomplishment. The original game was significantly more clever, but had an end, and would turn off a lot of people due to it appearing difficult.

The question is if you wrapped this up as an RPG instead of a puzzle game, would people play it?

</comment><comment><USER22> After hammering on my keyboard (somewhat) coherently for a long time, I would conjecture that the board is too large. So I tried to us down and either left or right alternately and switching left and right when a position would not move anymore. At least until 8192 and ~200k points, random fluctuations seem to clear always enough stones that the board was never more than half full.

</comment><comment><USER23> Thanks to games like this and 2048, more people will start seeing and memorising powers of 2. That's definitely not a bad thing...

<comment><USER24> Yes, that'll certainly happen, but what's the use of memorizing powers of two for people not in CS?

</comment></comment><comment><USER4> This is how far I got before I got bored:

[http://imagizer.imageshack.us/v2/800x600q90/62/yhtr.jpg](http://imagizer.imageshack.us/v2/800x600q90/62/yhtr.jpg)

Done manually... took me about an hour... goddamn this game is addictive.

I'm pretty sure I could keep going if there was a save function. I never seemed to fill more than one half of the screen.

</comment><comment><USER25> I get a really strong Tetris effect[0] after playing this game. I get an urge to move all text on this page to upper right corner. Anyone else?

[0] [http://en.wikipedia.org/wiki/Tetris_effect](http://en.wikipedia.org/wiki/Tetris_effect)

<comment><USER5> It must have been a while since you played tile based games. I had a similar experience a year ago when I made a simple tetris game and tested it non-stop for a day. Since then I can't achieve the same effect. But before that I haven't played such games in years. It really shows how persistent out memory is. One day and you're good for years.

</comment></comment><comment><USER26> I'm on a laptop with 1366*768 screen; had to zoom out massively :(

</comment><comment><USER13> ok... how many years would it take to actually get the final number?

<comment><USER5> 27133559.5 years if you do 10 presses per second.

<comment><USER27> I think I won't play that any more.

</comment></comment></comment><comment><USER28> According to DynDNS it's a malware site.

www.csie.ntu.edu.tw is blocked in your Defense Plan Content Blocked

This is a known Spyware? website, which is blocked as specified in your Defense Plan?.

<comment><USER29> DynDNS is painting with an unavoidably broad brush. It's a student page at the CS department of NTU -- National Taiwan University. I'm sure the server has hosted something unsavory at some point, but this particular page is hardly threatening.

</comment></comment><comment><USER30> I guess he didn't plan on anyone actually winning: [http://i.imgur.com/sP7uz4q.png](http://i.imgur.com/sP7uz4q.png)

</comment><comment><USER31> Running this on random is actually a nice Javascript benchmarker - _e.g._ Chromium-stable runs much faster than Firefox-stable.

</comment><comment><USER32> I want to make an AI to play this. This might be a dumb question, but how would I get the input and output to and from the game?

<comment><USER33> It is a pretty simple game. I don't think it really needs an "AI" to play. A few people have already posted a few javascript solutions.

</comment></comment><comment> li-ch Strangely this feels like Diablo 2. Grind to find upgrade, which makes it harder to find the next upgrade.

</comment><comment><USER34> "I don't understand idempotence, can you explain what it is?"

"Let me show you what it's NOT."

</comment><comment><USER35> I don't see the game , just doing up,left,up,left, for ages and get points ... so ?

<comment><USER5> Long distance running is easy too, isn't it.

</comment></comment><comment><USER36> HAHAH what? Challenge accepted

</comment><comment><USER37> I finnaly did it... oh wait ! Only 9007199254738944 left

</comment><comment><USER38> My god, my god... What have you done.

</comment><comment><USER39> First ever comment since signing up.

This is diabolical.

DIABOLICAL!

</comment><comment><USER40> that game just stole 2hrs of my life.

</comment><comment><USER41> Bastards!

</comment><comment><USER42> Lame cargo cultism. Find something different to do besides just increasing the array size.

<comment><USER43> It is a joke.</comment></comment>


Learning China's Forbidden History, So They Can Censor It - <AUTHOR> https://www.nytimes.com/2019/01/02/business/china-internet-censor.html <comment><USER2> > It's easy to make mistakes. One article about Peng Liyuan, China's first > lady, mistakenly used the photo of a famous singer rumored to be linked to > another leader. It was caught by someone else before it went out, Mr. Yang > said.

I'm betting this is the lameizi (spicy girl) singer Song Zuying who was rumored to be Jiang's mistress. She is in the process of being purged as Xi is doing to many of Jiang's supporters ATM. Xi's wife is also a patriotic song singer from the same era, it makes sense young people might get confused.

</comment><comment><USER3> Winston Smith's job at the Ministry of Truth was basically this.

<comment><USER4> Which came from George Orwell working at the British Ministry of Information.

<comment><USER5> That's interesting I didn't know Orwell had a connection to the British Ministry of Information. Wikipedia seems to suggest that he didn't work there but his wife did:

>"At the outbreak of the Second World War, Orwell's wife Eileen started working in the Censorship Department of the Ministry of Information in central London, staying during the week with her family in Greenwich. Orwell also submitted his name to the Central Register for war work, but nothing transpired." \- [https://en.wikipedia.org/wiki/George_Orwell#Second_World_War...](https://en.wikipedia.org/wiki/George_Orwell#Second_World_War_and_Animal_Farm)

Wikipedia could be wrong though since any work he did for the Ministry might not have been public until recently.

<comment><USER4> Ah, my bad, I misremembered somewhat.

<comment><USER5> I'm glad you brought it up. It adds quite a bit of context to 1984.

</comment></comment></comment></comment></comment><comment><USER6> > When asked whether he had shared with family and friends what he learned at > work, such as the Tiananmen crackdown, Mr. Li vehemently said no.

> "This information is not for people outside to know," he said. "Once many > people know about it, it could generate rumors."

That seems to imply that the censors are told that the events are basically true. I'd expected them to be taught as rumors in the first place, which they have to learn to recognize as a secret code used by enemies of the state. Humans are pretty good at ignoring cognitive dissonance, but I wonder how often someone ends up spreading the "rumors" even further by simply talking about what they do at work.

</comment><comment><USER7> As a Chinese national, somehow this article does not come across as _negative_ to me. Weird.

<comment><USER8> Like the other poster, I'm curious to hear your perspective. You don't find it a bit strange that "only government-owned websites and specially approved political blogs...are allowed to post photos of top leaders."?

You also think it's better to cover up events like Tiananmen Square? It seems like it's almost entirely forgotten even though it happened only 30 years ago. My country (US) doesn't have a great human rights track record either, but at least we're allowed to talk about it.

<comment><USER9> > My country (US) doesn't have a great human rights track record either, but > at least we're allowed to talk about it.

Exactly. No country has a perfect history but by confronting past mistakes you have a chance to learn from them and hopefully support laws or norms that prevent them from happening again.

Perhaps this only applies in countries that practice democracy, where the people's awareness has a chance of translating into representation. Otherwise it's only likely to create discontent with the inability to change things (and thus unrest).

<comment><USER10> This perspective always cracks me up. The way the US does it is less brutal and obvious, but pretty much the same thing; old books are scrapped and forgotten. Formerly popular thinkers are memory holed or declared 'thought criminals' (pick your '-ist'). Their books are no longer taught in college, and the perspectives they represent are gone forever.

Present day thinkers and reporters are given the same silent treatment on mainstream media which is obviously controlled by the narrow oligarchy which controls everything else. Same treatment is happening on youtube as China is doing; non-conforming perspectives are actively sought out and removed by censorious apparatchiks. Oh yeah, and now they're also sometimes denounced as "russian agents" as well -a pack of absurd, paranoid and Orwellian nonsense which makes anything the ChiComs say look like objective common sense.

The US engages in ritual denunciation of itself for slavery and killing off the Indians. Somehow our most excellent international adventures, ridiculous military provocations, poisoning of the food chain, extractive slave economics of the native population and colonial control of half the population of the world is A-OK. For all I know, China engages in ritual denunciation of its pre-Maoist self as well. That doesn't mean they're not carefully controlling the narrative now.

<comment><USER11> My college education was pretty honest about the atrocities of the USA. I get to openly post about politics all day on facebook without any fear of reprisal. Pretty different from a country with a whole dictionary of secret codewords used to discuss politics and history. There is no 'both sides', there's just your self-pity - the people you call censorious apparatchiks are just people who don't respect your opinion. You mistake being unpopular for being persecuted, which is common for privileged engineering types like us.

<comment><USER12> The west has fiscalised its basic power relationships through a web of contracts, loans, shareholdings, bank holdings and so on. In such an environment it is easy for speech to be "free" because a change in political will rarely leads to any change in these basic instruments. Western speech, as something that rarely has any effect on power, is, like badgers and birds, free. In states like China, there is pervasive censorship, because speech still has power and power is scared of it. We should always look at censorship as an economic signal that reveals the potential power of speech in that jurisdiction. The attacks against us by the US point to a great hope, speech powerful enough to break the fiscal blockade. -Julian Assange

<comment><USER8> Can you say anything to back up the claim that "speech still has power" in China? That seems to go against what the pro-censorship commenters are saying, which is that most people in China know all the bad stuff anyway and just don't care. If that's true, it seems like words have lost all power.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> China's leaders tell the world that their citizens are all united behind the government, except for a few traitors. But the government acts like the population is so weak in its support that it could be easily provoked to revolt by exposure to uncomfortable truths.</comment>


Quantum money: toward a new quantum cryptographic protocol (2009) - <AUTHOR> http://arxiv.org/abs/0912.3825 <comment><AUTHOR> Background:

"Quantum money is a proposed design of bank notes making them impossible to forge, by using quantum physics. The idea influenced the development of quantum key distribution protocols used in quantum cryptography.

The idea was put forward in about 1970 by Stephen Wiesner, a graduate student at Columbia University, though it was rejected by a number of scientific journals, meaning that it remained unpublished until 1983."

[https://en.m.wikipedia.org/wiki/Quantum_money](https://en.m.wikipedia.org/wiki/Quantum_money)</comment>