Ask HN: What's the actual fallout been from the Cloudflare bug? - <AUTHOR> So I understand what happened with the Cloudflare bug, that https POST request content was leaked into HTML documents on the same or other servers and some of it was cached by search engines or malicious foreign powers. Whenever something like this happens the HN community whips up into a frenzy with people coming out of the woodwork that appear to be experts saying that "this is the end" and "this is so bad, we're f*cked".
Meanwhile - none of my friends in the
"real world" (outside the HN bubble) seem to be affected by this at all. I have a client that's a Cloudflare customer and they got an email saying they just weren't affected. And I haven't seen any huge leaks or items in the press about some terrible hack or theft that has brought someone or a corporate "down".
Should we always take news like this with a grain of salt? When can we tell when an attack like this is a fundamental undermining of the entire internet infrastructure, an attack that will cripple a few major companies, or just an issue that revealed some data but was mostly just overblown? Would love to hear some opinions! <comment><USER2> The trouble with this sort of bug is that we'll likely never know.

Some people's accounts will be compromised, and nobody will know if it's been due to fishing, insecure passwords, or an information leak such as the Cloudflare bug, or an undisclosed or undiscovered breach somewhere.

The more responsible Cloudflare customers have invalidated existing sessions; that's much less hassle than forcing a password reset, and since session tokens are transmitted in every request, a leaked token is much more likely than a leaked password.

<comment><USER3> > nobody will know if it's been due to fishing, insecure passwords, or an > information leak such as the Cloudflare bug, or an undisclosed or > undiscovered breach somewhere

"Not measurable over the background noise" is a pretty workable definition of "no fallout".

<comment><USER4> The problem is that you can't magically measure it separately from the background noise. It becomes _part_ of the background noise.

Lacking tools to measure an effect doesn't mean it has no effect.

</comment></comment></comment><comment><USER5> An information leak is an information leak : we still fail to realise that it's something that's happening daily. There's no drama in it.

Criminals are taking advantage of opportunities like this every day, still no one cares too much about it (HN bubble & friends excluded).

Things like this may have a strong impact or not in the press/popularity circus, but in this particular case it seems they promptly monitored the situation (thanks to their competent staff).

What most surprises me is that their highly competent staff is thoughtlessly violating one of the security principles in sw : SECURITY BY ISOLATION .

No one (no matter how able you are) can write absolutely bug-free algorithms : even when dealing with formal verified software you can still attack the assumptions.

Security by correctness is a laudable effort, but computing customers data with a single process is not sane. I'm aware they're doing this for performance reasons, but a well implemented isolation layer would have prevented this (even while dealing with a bug like that).

Their architecture is vulnerable.

<comment><USER6> > What most surprises me is that their highly competent staff is thoughtlessly > violating one of the security principles in sw : SECURITY BY ISOLATION .

I don't think this is really true, but I'm open to hearing your thoughts on this. There was a bug in their HTML parser which caused unrelated memory to be dumped to the process. Their SSL termination servers were isolated elsewhere which is why SSL keys weren't dumped into public caches.

Where would you like them to draw the isolation boundary? Per function? Per rule? Per service? From what I understand, these processes were a part of a single service, but not every request was using each type of rule.

Even if they'd only had customers using their html parser isolated on separate servers, other customers would have been affected even if their HTML was perfectly valid according to the parser.

<comment><USER7> I think the implication is that the isolation should be _per customer_ , each being allocated their own parsing process, isolated from the other customers.

That's roughly what we do, though we run an hosted version of an open source webapp, not a CDN. It's more expensive resource-wise (particularly RAM), but it has meant that we were immune to 90%+ of the security bugs discovered in the platform.

<comment><USER6> Sure, that's a valid question to ask. But imagine you have 1,000,000 customers. Now you have to calculate and manage scaling groups for 1,000,000 customers * number of services. The resourcing costs alone would be outlandish, not to mention trying to independently scale each customer. Perhaps container systems would make this easier, but do they have better memory isolation? Is it possible for a container process to overrun into another containers memory without an exploit in the container system?

<comment><USER7> A container is a process with some extra isolation (namespaces), they certainly can't overrun into each other without an exploit.

Why would the costs be outlandish? We offer that and we're fairly cheap. Since the cost is mostly fixed per customer, it should scale linearly.

As for scaling, they already have to do that, by pointing different requests at different servers depending on their load, etc.

<comment><USER6> Assuming for a minute that containers aren't in play, then the isolation model becomes that of a server/vm with the associated overhead of each. To make this easier we'll assume there's only a single service, even though we know this to be untrue.

If there are 1M customers that's a minimum of 1M servers. Some customers are obviously larger and would need more. There's also HA. Let's conservatively call it 2.5M servers.

At an absolute bare minimum we'd need to allocate 2.5M GB of ram and 2.5M vCPU. That's a huge amount of resources.

If you could reliably fit 10000 Small customers on a single server at 32gb ram and 8 cpus you can already start to see how many resources can be saved.

Without customer isolation you've got the entire cluster to handle load spikes and HA. With isolation you have to have scheduling monitoring each of the 1M clusters and scaling appropriately by anticipating demand.

Scaling a service is way easier than scaling customers within a service or many services.

<comment><USER7> _Assuming for a minute that containers aren 't in play, then the isolation model becomes that of a server/vm with the associated overhead of each._

Why? There's nothing magical about a container, it's literally just a cgroup of Linux processes. You don't have to use them to get the memory isolation we're talking about - uncontained processes get it too.

That's what we do: one process per client, uncontained, just running on a different system user.

But in any case, sure, use containers, I'm certainly not opposed to them.

<comment><USER8> That really isn't practical given the number of datacentres CF are in * the number of free customers they have.

Perhaps for some tier of paid customer.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> As I understand it -- somebody please correct me if I have this wrong -- the thing about Cloudbleed is that there isn't necessarily any relationship between the site whose page is cached and the site whose credentials appear in that cached page. So the only way to know that a particular site didn't have credentials leaked is to search all the caches of all the search engines on the Internet.

So, as perlgeek says, we'll probably never know specifically what the impact was.

<comment><USER10> Or if they're not a Cloudflare customer.

<comment><USER11> Or if they have never been visited by some webproxy Cloudflare customer.

</comment></comment></comment><comment><USER12> I think Google freaked out to the Nth degree because it's quite likely that cached data is probably stored in a system that doesn't have [m]any security restrictions attached to it, and... well, there are >72k people. You're _going_ to find well-meaning "what happens if I... OOPS" types (for any definition of "OOPS"), along with (ostensibly equally well-meaning) "hey, an OAuth token that actually works! Let's see _just how far_ we can take this..." people... and then some that aren't just interested in fun engineering challenges, if you get what I mean.

I have no idea what Google employees have access to. I've always wondered whether they can hand-code their own MapReduce syntax over Google's actual Web index (I could find SO MANY THINGS if that were possible!). I wouldn't be surprised if the cache data <-> index were accessible to everyone who's been around for >6 months, so they can tinker with it.

But I guess the only reason I'm able to type this is that I haven't signed The Large Book Of NDAs (I presume it's large).

<comment><USER13> First NDA: Don't talk about NDAs

Second NDA: If it's not published on a Google domain, you have to make as abstract as it gets

<comment><USER12> A couple of relevant things I just thought of:

\- [http://www.goldsborough.me/google/internship/2016/11/18/01-5...](http://www.goldsborough.me/google/internship/2016/11/18/01-57-54-my_google_internship_/) \- has some interesting tidbits; for example, I would _not_ mind a visit to the Google Store :)

\- [https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_crea...](https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_creators_of_athlon_radeon_and_other/) \- The last paragraph in this recent AMD AMA was a real "OH I get it now" eyeopener for me about NDAs and not announcing stuff AOT; tangentially related

</comment></comment></comment><comment><USER14> For a remarkably level-headed take on the fallout, I recommend listening to the latest episode of Risky Business [0]. The interview with Troy Hunt gives a calm, informed and above all well reasoned baseline for response.

0: [https://risky.biz/RB445](https://risky.biz/RB445)

</comment><comment><USER15> I think part of the disconnect is that this issue is a big deal for tech professionals, but barely noticeable for everyone else.

By the nature of the bug, the likelihood of any particular individual having any meaningful exploitable information exposed to somebody in a position to exploit it is astronomically low. So most ordinary people are ignoring it, and justifiably so.

If you're responsible for security for a site that sends traffic through CloudFare, then it's a very big deal for you. You'd better be quick on the trigger to see and react to this stuff, and you'll have to mass-reset sessions at the very least, and possibly reconsider whether you really want to be terminating SSL at CloudFare. Exactly because, while not much has probably been exposed, you will never be able to be sure what was exposed to anyone from random hackers to the whole world, via search engine caches. So a broad reaction is justified.

And of course people who like tech but aren't actually responsible for any sites being served through CloudFare tend to react the most. Even though it's not a big deal if you're already doing all of the standard security precautions, like different passwords everywhere and 2-factor authentication on anything important.

</comment><comment><USER16> Old saying don't believe everything you hear, and only believe half what you read. Most news and blog outlets are horrible for information. Either they redigest someone else information, spin it to be more interesting, or just jump on the hype train. Their are few blogs and news outlets that actually have experts worth listening to. When the news/blog outlets heard whatsapp had a technique flaw by a security expert they jump on it like a fresh piece of meat. Whatsapp didn't have any security flaws or implementation flaws, but that didn't matter. The news/blogs didn't even understand it they were just jacked for some revenue from ads for this fresh piece of meat. It did so much harm to the people that use it for security reasons and to the company. But that didn't matter it is all about getting you to download a piece of javascript to tell some company you may have notice there ad that was place on someones website. News is dead. Bloggers only care about traffic. Experts are either paid to be used and abused or don't have a big enough audience to be heard.

</comment><comment><USER17> I would welcome if this incident shone light on possible Cloudflare alternatives. For example, it should be technically doable for DDoS protection service to only initially verify user is not a bot, and then merely tunnel unchanged SSL traffic directly between server and client. Does anyone do this?

<comment> grey-area Another model which might work - don't take over customer dns, issue ephemeral tokens ( say 30 mins) for each ip classifying risk. Then the client site determines whether to drop connections, no tunnelling required.

<comment><USER18> You still need to make a connection to drop it. You can DDOS just by making a lot of connections.

</comment></comment></comment><comment><USER19> Cloudflare should count its blessings. If not for Google the fall-out would have been a _lot_ larger.

So even if the sky didn't fall that's no reason to pretend this wasn't a big deal.

</comment><comment><USER20> The way you know it's real is when you call up cloudflare's top customers and ask if they would switch to the competition the answer was a resounding yes. That's how I know it's not based on a HN bubble

<comment><USER21> I can't parse the tense here to determine if you or others did this already?

</comment></comment><comment><USER22> > "this is the end" and "this is so bad, we're f*cked"

End of what? It will just give rise to slightly more secure, improved services (maybe be the same providers, maybe by competitors, but definitely financed and implemented by the same people).

> And I haven't seen any huge leaks or items in the press about some terrible > hack or theft that has brought someone or a corporate "down".

Look at the Sony/PSN breach; there has been zero accountability, and it has not hurt the PS4 launch at all. Consumers just don't give a shit.

</comment><comment><USER23> I think you're misinterpreting the comments about the scale of the leak. The risk that a concrete compromise would occur as a result was always pretty small.

The bigger thing was the grandiose scale, the impact on administrators in having to rotate a significant number of credentials, and the hit to CloudFlare's reputation. A bug where you randomly dump random data without regard to its sensitivity or origin (i.e., data from completely unrelated sites could've been included in the dump), and have no way to tell what actually leaked, is the worst kind of privacy bug there is, precisely _because_ it's impossible to triage. No one can ever know everything that actually got out.

CloudFlare is now a major piece of internet infrastructure. It's impossible to know that _anything_ sent through a CloudFlare server between Sept 2016 and Feb 2017 wasn't accidentally publicly leaked, and worse, non-trivial quantities of this data were being accidentally saved permanently in search indexes. Surely some bad actors have saved such results in their own private indexes as well.

When CloudFlare says "your site was probably unaffected", they're making a guess, because they have no way to actually tell. They're just assuming that based on the volume of requests your CloudFlare endpoint receives and the volume of requests made to endpoints that exhibited this bug, content from your site _probably_ didn't get out. But there's no way to know.

If we take that seriously, it requires us to consider _everything_ that went through a CloudFlare server as potentially publicized and preserved in the public record (including usually-transparent unique identifiers like session cookies/tokens). We then have to assume that an adversary obtained any and all such data, and respond as best as we can to preclude the possibility of that adversary exploiting the leaked secrets to harm our and/or our company's interests.

Of course, the flip side of the sheer scale of this, and the fact that the bug was relatively rare and that there was no way to control what content it dumped, is that it's very unlikely any of _your data specifically_ actually got leaked.

If you and/or your company are OK with crossing your fingers and hoping this won't affect you, there is probably a 99.something-something-something% chance you'd be right. Most people have responded by resetting tokens/passwords for anything that uses CloudFlare, since that's relatively low-impact and most people were probably overdue for a credential recycle anyway, and have left it at that.

This does clearly illustrate that the internet has a few _de-facto_ junction points, which would be very high-value for an attacker. That's worth keeping in mind.

</comment><comment><USER24> Aside from being a black eye on Cloudflare, I don't see this issue being of much consequence. I have yet to see one real-world example of a screenshot or link to a cache of data of leaked data (sensitive or not). If anyone has an example, please share. As others have mentioned, the real fear is of what could have leaked, not what did leak.

<comment><USER25> There were a couple of examples of leaked data. Session stuff, API keys, cookies, oauth tokens, and so forth.

Uber: [http://securityaffairs.co/wordpress/wp- content/uploads/2017/...](http://securityaffairs.co/wordpress/wp- content/uploads/2017/02/Cloudbleed.jpg)

Fitbit: [http://cdn.iphoneincanada.ca/wp- content/uploads/2017/02/clou...](http://cdn.iphoneincanada.ca/wp- content/uploads/2017/02/cloudflare-coding-error-spills-sensitive-data- showcase_image-9-a-9742.jpg)

OkCupid: [https://trtpost-wpengine.netdna- ssl.com/files/2017/02/cloudb...](https://trtpost-wpengine.netdna- ssl.com/files/2017/02/cloudbleed-okcupid.png)

Oauth data: [https://pbs.twimg.com/media/C5ZCRtMVMAEs0ca.png](https://pbs.twimg.com/media/C5ZCRtMVMAEs0ca.png)

Or were you asking about some consolidated treasure trove?

The real risk, to me, is that someone noticed this before Tavis did. They could have created a site with the right parameters and then scraped it for weeks. Cloudflare only had logs for 10 days of the multi-month exposure window, so they have no idea if someone did this or not.

</comment></comment><comment><USER26> I deleted my subscription and account with 23andme. I have a few friends and colleagues who acted similarly with other sites.

<comment><USER27> Why delete your account and why 23andme specifically?

</comment></comment><comment><USER28> My guess: For criminals, the cost of finding the needle in the haystack is just not worth it - it's easier to phish fresh credentials than to hope that you'll find some in some hard-to-crawl archived data set. So we won't see anything there.

Realistically, this will probably only be exploited by intelligence agencies who have the means of collecting all the data and motivation to do so, and maybe not even them (because they have better ways too). If they do exploit it, the nature of intelligence agencies, of course, means that you typically won't notice any direct impact.

The reason why this caused such a big panic is that while the likelihood of your password being compromised is small, it could have hit anything, and by conventional wisdom, any password/key that _may_ have been exposed, even if the likelihood is small, needs to be considered compromised. Hence, "OMG everything is compromised".

Another reason was probably that it was a really scary wake-up call demonstrating the risks of centralized services. Cloudflare is a Single Point of Failure for a lot of security, but that is easy to push aside until you see it failing.

Realistically (and I'm going to get a lot of flak for saying this) the correct way to handle it is to rotate extremely high-value credentials (think Bitcoin exchangs, administrative access to major services, ...), reset sessions if you're hosting your website on Cloudflare (since session tokens are much more likely to leak than passwords, and the cost of forcing users to re-auth is small especially if your sessions expire regularly anyways), and then call it a day.

In particular, keep in mind that for high-value services, you're hopefully already using 2FA, so even if an attacker did get your password through this, they probably don't have your 2FA token (although Kraken, a Bitcoin exchange, pointed out to their customers that they should re-setup 2FA if originally set up during the vulnerable timeframe, since the key used to derive the 2FA could be compromised).

</comment><comment><USER29> On the non technical side - A LOT of multiple people's time inside our small NFP org inspecting logs, rolling passwords, keys etc, expiring sessions and communicating with clients.

</comment><comment><USER30> Sometimes those of us who live in the pure, mathematical world of software forget that the real world is more resillient than that.

People's passwords, identities, and bank and credit card details will have been leaked. Identity theft and other fraud will happen as a result of this. But we have systems in place for dealing with it, and ultimately life will go on. I've had fraudulent charges on my bank account; it was a serious inconvenience at the time, but it wasn't life-changingly bad.

</comment><comment><USER31> This won't necessarily be a popular opinion, but I remember when everyday there were negative blog posts and stories about Apple and the new MacBook Pros. It seemed like every developer got on their Medium and wrote a blistering post. It you just read the internet and HN you'd think the world at Apple was crumbling down.

Yet since $AAPL released the new MacBook Pro (Oct 27th '16), their stock is up 24%, with a breakout record Q1. Let's not forget that the entire market has been in an epic bull run since Trump took office, so perhaps that is a factor.

Source ($AAPL vs Dow Jones and S&P since Oct 27th): [https://www.google.com/finance?chdnp=0&chdd=0&chds=1&chdv=0&...](https://www.google.com/finance?chdnp=0&chdd=0&chds=1&chdv=0&chvs=Linear&chdeh=0&chfdeh=0&chdet=1488770247096&chddm=34017&chls=IntervalBasedLine&cmpto=INDEXSP:.INX;INDEXDJX:.DJI&cmptdms=0;0&q=NASDAQ:AAPL&&fct=big&ei=xdS8WNmON4L-jAHth67oBw)

Don't believe what you see on HN all the time. People here are incredibly intelligent for the most part, but there is frankly lots of disconnect from reality. In my opinion lots of conspiracy theorists, purest, and some social justice warriors pushing agendas.

My opinion... But I think we can bundle GitLab, CloudFlare, and Uber into categories of will be just fine.

<comment><USER32> Didn't AAPL's earnings only hit 'record' levels because they added a week to the quarter?

[http://www.theverge.com/2017/2/1/14468090/apple-q4-2016-earn...](http://www.theverge.com/2017/2/1/14468090/apple-q4-2016-earnings- extra-week)

Otherwise it would have been a down quarter, no?

<comment><USER31> The verge? I'd say probably want to get your financial news from Wall Street Journal, CNBC, or established trusted sources.

<comment><USER32> [http://daringfireball.net/linked/2017/02/03/14-week- quarter](http://daringfireball.net/linked/2017/02/03/14-week-quarter)

</comment></comment></comment></comment><comment><USER33> namecheap use cloudflare, and didn't email their customers (including me) telling them that they may want to change their password...

I have now transferred every single one of my domains away from namecheap

I also installed the following extension, and now watch what I put into cloudflare pages: [https://chrome.google.com/webstore/detail/claire/fgbpcgddpmj...](https://chrome.google.com/webstore/detail/claire/fgbpcgddpmjmamlibbaobboigaijnmkl)

<comment><USER34> What do you mean by "Namecheap uses Cloudflare"? The authoritative DNS for namecheap.com is Verisign.

</comment></comment><comment><USER35> Netki sent me an email that they think they might be affected, so they strongly recommend to change password.

</comment><comment><USER36> Well for me, the fallout has been the pain in the ass task of changing all my passwords.

</comment><comment><USER37> Does anyone here (startup) use ddos protection ?

<comment><USER38> I run a few medium sized side projects (x-xxx million pv/month). I can never use a per-GB-cost CDN solution, and all of my sites require protection up to L7.

<comment><USER24> Your response doesn't make much sense to me, sorry. Why can you never use a per-GB-cost CDN solution? Is it because you deliver your content via SSL and don't want to share your SSL keys? Is it because you can't afford the potential CDN delivery costs? Is it because your projects don't benefit from CDN caching? Also, I am not sure what point you are trying to make about layer 7 protection. If you need layer 7 protection, get a WAF.

<comment><USER38> I need DDoS protection because they get hit nearly daily (esports/gaming related; this is par for the course in this vertical).

I can't pay per GB because of the DDoS protection portion - the last time I used AWS/Cloudfront the skids just wget looped on a hundred thousand threads in the most expensive per-GB region. Cloudflare is basically the only "CDN" that I can feasibly use for even just images. I'm happy to pay, but unmetered only.

I deliver via SSL but there is close to no PII, I don't mind that much about the MITM factor.

Lower layer protection against volumetric floods is needed (standard attacks, all UDP needs to be dropped as high up as possible), but also L7 protection is needed - not vulns/XSS/SQLi/etc, but we're talking bursts of 10m-20m+ req/s to whatever the most expensive endpoint is (usually search), registration attempts, if any third party APIs are used, the intent is to exhaust as many calls as possible or deny service in the end.

I have a stupid amount of nginx and custom lua rules + redis trying to clean up whatever gets passed through, things like "if IP has shown over 40 different user agents in the last 2 minutes, drop it as high up as possible, ideally before it enters my network" and "if this user agent contains Chrome but the request headers don't accept sdch then this is an flood".

The commercial/for-profit larger sites in this group are behind Akamai and Distil. Both of these cost $comedy.

This level of bullshit is fairly normal for video games.

</comment></comment></comment></comment><comment><USER39> Hopefully the fallout is that Cloudflare gets its act together.

Even if your friends know 100% that they can't possibly have been negatively affected by tons of private information being dumped all over the internet, I'm not sure how such anecdotal evidence is any more instructive than a HN "bubble".

Even if nobody at all ended up negatively affected in any serious way, I don't see why people shouldn't remark on the potential effects of such a fiasco when it happens. Was anyone really predicting "the end"?

<comment><USER39> Weird how this post seems to have annoyed some people.

</comment></comment><comment><USER40> > Should we always take news like this with a grain of salt?

Yes.

Except this fear is part of our income source like the TSA, except they are more like 100% IT is a bit less.</comment>


Steve Jobs's Worst Design Decisions?  - <AUTHOR> http://blogs.wsj.com/ideas-market/2011/08/29/steve-jobss-worst-design-decisions/ <comment><USER2> I always found it highly annoying that you had to almost completely disassemble the Power Mac 7100 (and related models) in order to add RAM.

</comment><comment><USER3> 1) G4 Cube.

2) Using a MO drive on the first NeXT box.</comment>


Rotating an image with OpenCV and Python - <AUTHOR> http://john.freml.in/opencv-rotation

<comment><USER2> > from skimage.transform import rotate

> rotate(image, angle, resize=True)

Also, scikit-image provides a nice interface for geometric transformations: `SimilarityTransform`, `AffineTransform`, `ProjectiveTransform`, `PolynomialTransform`.</comment>


Electric drive spooks Japan auto executives - <AUTHOR> https://www.ft.com/content/fd6ee5bc-b00d-11e6-9c37-5787335499a0 <comment><USER2> If there is even a 10-20% chance of electric being the next big thing, Toyota's lack of investment might deliver another Sony-sized lesson...

I don't see how Toyota CANNOT take this seriously, if nothing else than as a giant hedge.</comment>


Google wants to patent splitting the restaurant bill - <AUTHOR> http://news.cnet.com/8301-17852_3-57606226-71/google-wants-to-patent-splitting-the-restaurant-bill/ <comment><USER2> Some other prior art:

Splitwise: [http://splitwise.com](http://splitwise.com) (I'm the CEO) Billmonk (acquired by Billpin) [http://billpin.com](http://billpin.com)

or see this Quora thread for tons more: [https://www.quora.com/What-are-some- replacements-for-BillMon...](https://www.quora.com/What-are-some-replacements- for-BillMonk-social-billing)

Jon

</comment><comment><USER3> prior art :) - [http://hitchhikers.wikia.com/wiki/Bistromatics](http://hitchhikers.wikia.com/wiki/Bistromatics)

</comment><comment><USER4> Google as patent troll. Fancy that.</comment>


The IT Salary 'Wave': Skills, Salaries, and the Coming Reckoning - <AUTHOR> http://switchon.eaton.com/plug/article.aspx/the-it-salary-wave-skills-salaries-and-the-co?utm_source=End_User_Outbrain&utm_medium=Content_Distribuition&utm_campaign=Plug&utm_content=The-IT-Salary-?Wave?-Skills-Salaries-and

<comment><USER2> What a misanalysis!

Those "top skills" closely mirror the size of the departments which are hiring for them. Of course "service desk" is in demand, they need a lot of people. Am I going to rush out and brush up on my call handling skills? Nope, I don't want to work on the service desk right now.

They could at least have looked at growth trends by area, rather than just size.

</comment><comment><USER3> It seems strange that they talk about 2.3% raises. 2.3% may be the mean, but it's probably not the median or mode.

Very few people actually get 2.3% raises. The good people do a lot better. The less skilled folks get downsized, replaced with cheaper resources and forced to get pay cuts.</comment>


Greatest Ideas in History  - <AUTHOR> http://www.digitaltonto.com/2012/the-7-greatest-ideas-in-history/

<comment><USER2> The explanation of Godel's incompleteness theorem is extremely bad in this post. It simply states that a logical system that is consistent can't prove everything, and if it ever does prove everything it can only do so by being inconsistent. Likewise, a logical system cannot be used to prove it's own consistency. Basically it just means if you want to prove that a logical system is consistent, you need to use a more powerful logical system, and you can't formulate a consistent logical system that proves everything. It has absolutely goddamned nothing to do with failing, unless you consider a logical system only succeeding when it has proven everything in the universe, including its own consistency, which is just silly. We don't NEED to do that. His theorem is of extreme importence in proofs and mathematics, because it means that one can't prove that math is consistent using math, but it has nothing to do with computer programs /crashing/. That is a gross misinterpretation.

It's made worse because all computer programs COULD crash simply because they are implemented on imperfect devices. But this has nothing to do with Godel's theorem, it has to do with physical limitations. Saying Godel's theorem proves all programs eventually crash is like saying Einstein's relativity is why time moves slower when you're bored.

</comment><comment><USER3> I'm a bit disappointed that none of Keynes ideas were present, and there are good contenders:

* Unemployment is a involuntary, but there are solutions to it. * Economic crises can be significantly mitigated and avoided with regulation. * Forcing a heavy reparations burden on Germany will undermine peace.

They replaced the previous set of ideas that were more about assigning blame (crises are a retribution for mistakes and should be allowed to continue, unemployment is voluntary and Germany must pay).

Without his influence, the world will be a much different place. Much more than the WWW which is simply one of many possible layers on the Internet.

</comment><comment><USER4> > every logical system will fail and every computer program will crash

that's bullshit.

</comment><comment><USER5> We had some really good ideas before history too, like trade, agriculture, sailing, and animal domestication.

</comment><comment><USER6> > Not since Aristotle has such an important theory sprung forth from one man, > seemingly out of thin air

I'm skeptical. Not to make light of the formalization of information theory, but it seems he was generalizing the idea that you can communicate arbitrary information using code. As inspirations for this generalization, he was able to draw upon several existing examples of such systems, including Hollerith's punch card system that had been around for half a century by that point.</comment>


Ask HN: How do you restore a laptop? - <AUTHOR>

My dev laptop just gave me the blue screen of death, and it's taking quite a while to restore everything and get back to work.
What or How do you guys do to restore laptop? The whole process is taking quite awhile, especially since I did not backup some of the files daily. :(
I can totally understand relate to Chromium OS, login and I can get back to work. <comment><USER2> First, before you start, take a backup of the laptop. If you make a mistake during your rebuild, you could lose your drive contents.

For Windows, the best way is to have an image based backup solution like Acronis, Symantec Backup Exec System Recovery, or just the Windows Backup built into Windows Vista, or Windows 7. This will restore a working copy of the OS from a time when it was previously working. If this is not possible, you'll most likely be in for a reinstall.

When you've reinstalled your OS, make sure you implement an automatic backup solution, so that you don't have to think about doing that backup each day. For your files, consider a solution like Dropbox, this will keep a version tracked copy of your files off your computer that will be easy to restore. Depending on your choice of dev tools, and how much you've customized them, it may be worth exporting a copy of the settings to your Dropbox.

This may not all help for this particular rebuild, but it can significantly lessen the pain if you ever have to do this again. Good luck!

<comment><AUTHOR> I guess that's no way to backup server configuration/setup, a lot part of my effort comes from reinstall the server, configuring the mySQL, ROR, etc. Possible to automatic backup those too?

<comment><USER2> Version control like Git or other would be best for your Rails stuff. The apps should contain your DB schema. As far as your MySQL, you should be able to configure it to dump its backups into your Dropbox if you have enough space.

When you get your imaging set up, it will let you roll back to a point in time, so the server should come back.

</comment></comment></comment><comment><USER3> If you do end up having to reinstall, use <http://ninite.com/> to do a bulk install of some common apps.</comment>


Benefits of a daily diary and topic journals - <AUTHOR> https://sivers.org/dj <comment><USER2> I bullet journal for organization of my day to day life. I've picked up calligraphy. There's something about taking 15 to 20 minutes a day to just focus on the nib gliding across the paper that's very calming for my mind. Often times I'll just write down phrases or words in calligraphy that are said during meetings as my form of journaling. I find that it helps me focus and gives me a sense of enjoyment for almost every meeting where I'm a more passive participant.

I also use markdown, which feels "close enough" to plaintext and as of now vscode for organizing digital notes. I absolutely agree with the whole "thoughts on" approach and have using tagging to group knowledge in my notes. I wrote a little plugin for vscode that helps you with organizing your notes without having to worry about file structure: [https://marketplace.visualstudio.com/items?itemName=vscode-n...](https://marketplace.visualstudio.com/items?itemName=vscode- nested-tags.vscode-nested-tags).

As for the psychological impacts. Having a journal to help empty my mind has been extremely helpful in managing my anxiety. If I ever find myself thinking too much about work I just turn towards my journal and empty it on to the pages. I find myself less likely to dwell if the thoughts are on paper or captured elsewhere. I think that it helps with acceptance as often times I say to myself, "It'll be there tomorrow." once it's out of my head.

</comment><comment><USER3> hate to be yet another shill but i spent about 20 hours learning emacs org mode basics and came up with mostly the same setup:

\- .org files are plaintext, easily backup-able

\- what he has in categories, i have in tags for easy consumption across a few files (reflections.org akin to his); this is important to track multiple things e.g. sex + romance easily

\- doing a daily/weekly debrief really showed me how slowly i was moving on allegedly important things, so it exposed that i have an integrity issue right smack in the face and caused me to set observable goals and reflect on pass/failure

highly recommended either via his method or org mode though

<comment><USER4> I have some difficulty justifying the organizational effort involved in this. I've yet to come across a compelling feature of Org mode over, say, a bunch of unstructured text files. It seems like the main benefit is to be able to write blog posts about it.

My journal, for years, has been a word document with dates at the top of each entry, and I've yet to come across something I wanted to do that couldn't be handled by this system.

<comment><USER3> tags (metadata) for items aren't available in either word documents or plain text documents. a couple keystrokes filters down on tags in org mode. this is a huge value add - think searching photos or bookmarks with/without tags - this can't be done easily in word/plaintext

there's no comparison between navigation/searching in word documents vs. emacs. that may be fine for a mostly write setup, but i'm actively interrogating and reviewing my items - this isn't easily with 1 huge word file, or multiple word files per date, or whatever setup you have.

<comment><USER4> > tags (metadata) for items aren't available in either word documents or plain > text documents. a couple keystrokes filters down on tags in org mode. this > is a huge value add - think searching photos or bookmarks with/without tags > - this can't be done easily in word/plaintext

Sure it can. If I embed images in a document file along with the text, then Ctrl+F lets me search for that text, which makes it easy to find adjacent images. I tend not to put a lot of images in there, but in practice this works fairly well for the images I do include.

You're also only looking at the benefits of your strategy, without looking at the costs. The cost is, you have to tag things. My strategy works without me tagging anything. I wouldn't be surprised if you can find things slightly faster, but I would be _very_ surprised if this time savings outweighed the time spent tagging.

If it's fun for you to tag things then it's not a cost, so I'm certainly not criticizing anyone using Org mode. Do what you enjoy. I'm just saying it's more of an aesthetic choice than a productivity choice.

This is similar to the various "blog like a hacker" tools out there such as Jekyll or Haunt. People cite all these supposed benefits like version controlling your posts and whatnot, but ultimately the vast majority of successful blogs, including the "hacker" ones, use Wordpress, Blogspot, or something similar.

The underlying point I'm making is that the temptation with highly flexible tools is to spend all your time tinkering with configuration for the tool, rather than doing the thing the tool is intended to do. Some people can avoid that temptation, but I'm not really one of those people.

(Random aside: my file is actually an Open Document Format file (.odt) not a Word Document. It originally was a Word Document, but hasn't been for years, so I'm not sure why I wrote that.)

</comment></comment></comment></comment><comment><USER5> I've journaled on and off for years. It's incredibly stressful for me. Most of what I write is unbearably stupid. It's excrutiatig to see how dumb I am. I tried to turn lemons into lemonade, and decided to keep a "what did I learn" journal, but it was even worse. Maybe journaling isn't for everyone.

<comment><USER6> I'd love to hear more about your experience, especially about what happened exactly with that "what did I learn" journal. I'm on the same boat.

Instead of trying be introspective about my life, I've started to write down facts: I did so-and-so and this is why it worked, or why it didn't work. And what was my emotional reaction. That definitely yields less stupid sounding journals.

</comment></comment><comment><USER7> I've tried to keep a daily journal of sorts so many times in so many different formats. The one that I seem able to stick to the most is specifically for software development. It's just a markdown file with a top level bulleted list, one entry per day, and a sublist for the things I did that day.

I'm not super consistent with it, but this post is making me want to put more effort into it. As Derek says, I'm not writing for me _today_ , I'm writing for _future_ me.

</comment><comment><USER8> I'm a total believer in this. I tried for years to keep a journal and nothing ever stuck. Since 2010, though, I've been using services like OhLife and DailyDiary that send me an email prompt every night and I just reply with a few sentences. I then dump these to text files and backup periodically. I can also attach photos and store those. This has been sustainable and archival and I'll be coming up on a decade of daily use soon. It's dead simple. I have little to no infrastructure or tools to maintain and (re)learn, plus the reminders keep me going.</comment>


30-plus years of HyperCard, the missing link to the Web (2012) - <AUTHOR> https://arstechnica.com/gadgets/2019/05/25-years-of-hypercard-the-missing-link-to-the-web/ <comment><USER2> That was cool to learn that Myst was a Hypercard deck frontended with beautiful graphics and music. My later to become wife loved the game.

I bought a non-Apple hypercardish environment that ran on Windows 3.1 . It was my 2d year of law school and one of my professors was a huge tech advocate and for 2 credits she let me develop an interactive Will generator to produce Forida-compliant wills with all the bells and whistles the new T&E statutes allowed at the time such as an accompanying document that didn't need all of the execution formalities to dispose of certain kinds of tangible personal property, so long as the document was referenced in a properly-executed Will.

I hope educational institutions are still encouraging young people today to leverage their nerdishness into non-nerdy careers if that's what they want. As for me I did my 15 years practicing law and I'm glad to be back letting my geek flag fly although for heaven's sake people, enough with the ageism. Yall be my age soon enough if you're fortunate.

<comment><USER3> > I bought a non-Apple hypercardish environment that ran on Windows 3.1 .

Out of curiosity, was that Asymetrix ToolBook? The original was neat and very HyperCard-ish, although for some reason they pushed later versions as an e-learning application even though there wasn't anything specific about it (e.g. some people used it to make multimedia CDs). And last time i checked it, even decades later, it has bugs that existed ever since the first version.

<comment><USER4> Another HyperCard-like system was HyperNeWS - which was built on Sun's NeWS windowing system and was incredible because of the beautiful PostScript based graphics of NeWS.

</comment></comment></comment><comment><USER5> I feel like we got a "true successor to HyperCard" 20 years ago, in the form of Lotus Notes. It was essentially "HyperCard decks shareable via email, with each deck backed by its own automatically-allocated Firebase-like document DB co-hosted on the author's email server."

(And, further, each email client had its own client cert, which it used for 1. code-signing decks it had authored, and 2. signing API requests to the DB server when the deck makes them. So every deck, and every request, would always have a "verified" email address associated with it.)

Essentially, it was the set of functionality provided by Google Sheets + Google Forms (and a bit more), without any web stuff being involved.

Obviously, it became a cesspit of badly-made, overly-interlinked Intranet apps, but this was more to do with the target market of non-IT enterprises—it was no different than what such organizations did with Excel.

I'd really love to see what a system very much similar to Lotus Notes, given a fresh coat of paint, and targeted _to consumers_ , would be used for today. An app anyone could open up and make a little DB-backed interactive experience, then either push it to an in-app inbox of their friends [where it could then be re-shared further, virally] or onto a cloud service others could browse within the app.

<comment><USER6> > _I feel like we got a "true successor to HyperCard" 20 years ago, in the > form of Lotus Notes._

Setting aside that Lotus Notes preceded HyperCard, I'm still missing the connection. Notes seemed to be presented as an enterprise-y workflow tool, while HyperCard was more of a "bicycle for the mind" toy (which I mean in the best-possible sense).

<comment><USER5> Disregarding the UX, Lotus Notes is just a viewer for HyperCard-stack equivalent app-documents. (There's no reason they couldn't have _been_ HyperCard stacks, other than, as you said, the earliest versions of Notes coming first.) Lotus Notes _with a different UX_ would be more obviously just "HyperCard++."

</comment></comment></comment><comment><USER7> If anyone wants to see what HyperCard was like to use or fancies a nostalgia trip, ViperCard is a web recreation: [https://www.vipercard.net](https://www.vipercard.net)

</comment><comment><USER8> Hypercard...just that name brings back a flood of almost forgotten memories that harken back to the 1990-1991. At that time, unless your parents were rich or you sold drugs or something, you couldn't afford to pay the $5/hr that The Source or Compuserve charged, so of course, you called your local BBSs.

I was deeply involved with BBS software development at the time, and after 2 years of futzing with ANSI graphics, the whole BBS community was looking for a new terminal paradigm, something that would (finally!) allows us to display pictures (porn?), change fonts, and even stream video (oh, the raw _ambition_ ).

Back then, your modem dialer was also your software terminal (yeah, makes perfect sense right?). Soft terminals emulated popular-but-limited UNIX-based hard terminals like VT52 or VT100 etc. Remember, software used to be EXPENSIVE because, of course, memory was expensive!

Oh yeah, Hypercard...so I remember discussing the problem with my partner, Tim Stark, and the folks at Galacticomm, the BBS company we worked with. Someone mentioned Hypercard as an almost ideal paradigm for building a frontend that allowed for hot-linking of text, graphics, and sound.

We actually built basic hypercard functionality into our flagship product, Magisearch, that I still contend was one of the very first online search engines ever created for general purpose online searching. We quickly realized that since we already had the indexes built for all the documents, or pages, we could quickly scan the returned text and highlight any already indexed words and "link" them.

Then one day, a true programming genius (I unfortunately cannot remember his name this morning, and thats a shame because he deserves full credit for his efforts) dropped a floppy on my desk and said "run it"...and up came a hybrid dialer/BROWSER!

This guy had done it!! I can't remember what he called the product, but I'll never forget the date...January 19th, 1993...my mom's birthday. Our BBSes were finally going to have rich text capabilities...hyperstacks!

And then came January 23rd and I product I DO remember the name of, Mosaic, dropped, signalling the end for BBS's and my software business.

</comment><comment><USER9> Back in the day, I made a hypercard deck, including a soundtrack made from a highly processed flute riff, as a "brochure" for my consultancy. I handed it out on 3.5 inch disks in place of business cards. For someone like me who was not a multimedia production expert, it was miles beyond anything else one could do using tools on a personal computer. It still compares favorably to most site-builders in terms of a balance between simplicity and programmability.

</comment><comment><USER10> I did my 4th grade assignment on the human heart in a hypercard stack instead of the giant piece of cardboard with pictures and text..

Had it animate, and had sounds that I recorded.. everything.

This was 1991-1992...

I got a fail.. the Teacher wanted me to "print it out and put it on cardboard".

I eventually got a good mark.. but that's another story

<comment><USER11> "but that's another story"

I'm guessing you hacked the school computer, changed your grade and lowered the number days absent on a day you faked sick and went on kooky adventures with your friends.

</comment></comment><comment><USER12> HyperCard and Logo on Mac introduced me to computer programming when I was 8 years old.

</comment><comment><USER13> My company produces what is a spiritual successor to hypercard on the web + mobile.

[https://tiled.co/](https://tiled.co/)

</comment><comment><USER14> My first programming class in highschool was with hypercard. I'm not sure we actually learned anything outside of playing might and magic.

Saw an indie dev working on a horror game using the hypercard aesthetic over at: [http://www.wohgame.com/](http://www.wohgame.com/) It scratches that nostalgic itch.

</comment><comment><USER15> I have never been a hypercard user but everything I have seen/read about it suggests that it would be a great replacement for my Evernote use case (accessible anywhere personal database of stuff). I have looked at some re- implementations but lack of Linux and/or mobile device (Android) support have ruled out the ones I have seen.

<comment><USER16> I'm making something that seems to fit in that description. Hopefully I will release it... some day (one man shop).

</comment></comment><comment><USER17> Back then I used Hypercard to design UIs, made it really easy to prototype stuff so that product people could understand. I think Hypercard is Bill Atkinson's biggest gift to humanity (even more so than Quickdraw).

</comment><comment><USER18> I often wonder how much work it would be to turn emacs into a hypercard system.

<comment><USER19> shuouldn't it be the other way around? An hypercard system implemented as an Emacs mode.

</comment></comment><comment><USER20> I will always upvote anything Hypercard.</comment>


Reduce memory fragmentation with a ML powered memory allocator [pdf] - <AUTHOR> https://storage.googleapis.com/pub-tools-public-publication-data/pdf/cb7b7a938ac6d313a2b5f07612093b5c52093f51.pdf <comment><USER2> So basically advanced tracing GC allocation algorithms for C++, but lets not call it like that, as we might scare the crowd away.</comment>


The Death Penalty, Nearing Its End - <AUTHOR> http://www.nytimes.com/2016/10/24/opinion/the-death-penalty-nearing-its-end.html?emc=edit_th_20161024&nl=todaysheadlines&nlid=72261283&_r=0&mtrref=undefined&gwh=0A9C9128E84D7F663F086244B72709C7&gwt=pay&assetType=opinion <comment><USER2> Article 3 of the universal declaration of human rights from 1948 (which the US voted for):

 _Everyone has the right to life, liberty and security of person._

Now, obviously we as a society cannot always guarantee these three things for all people, since criminals infringe on the rights of others and thus human rights are violated daily. In order to prevent this we choose to infringe on the liberty of criminals (by imprisoning them), in order to prevent their (greater) infringement on others. But since it is possible this way to prevent their infringement, by limiting only their liberty, there is no way to justify killing them instead, taking away not just some, but all of their liberty along with their life and their security. Yes, in order to enforce the human rights we must (somewhat ironically) infringe on them ourselves, but we cannot justify performing a bigger infringement than is absolutely necessary.

<comment><USER3> The problem is America in particular views prison as punishment, because of its puritan roots and culture a large part of the country sees punishment as both an effective correctional technique and a deterrent when the evidence for decades has consistently shown neither hold.

Which is part of the problem with the "abolish the death penalty" movement. The opposition was raised and impressed upon how prison is not for the security of society as a whole but for the punishment of the criminal. Except the later never works, and if you frame your law enforcement around that you end up violating a gross amount of human rights just like parents who think punishments are the optimal way to raise children most of the time end up abusing their kids.

<comment><USER4> What would you suggest as punishment for murder then?

<comment><USER5> Life in prison without the option of parole. Or, if the murder was caused by something like a psychotic episode or drug withdrawal, therapy in a closed facility.

<comment><USER4> So a free get therapy card?

I don't mean to be asshole. It's just that the general moral decay from these things is the absolute worst that can happen. Most people don't think about it with all the focus in the current criminals and victims. Not the future of society.

In my understanding the future of society is exactly why there is penal code in the first place.

<comment><USER6> If you would think about it a bit more, then it is possible that you would realize that therapy is more beneficial for the society in general than for the inmate.

There would be many things to say, but I would be already incredibly happy if you would realize importance of this small aspect.

<comment><USER4> Therapy would be most beneficial to the society, if you don't need to commit a crime to get it.

<comment><USER7> With proper healthcare it ought to be free anyway, so the "cost" to society is the same. Why would it matter if your diagnosis came during a trial?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> As a matter of interest, I wrote the most up-voted answer on Skeptics.SE, in response to the question of whether the death penalty is an effective deterrent, here: [http://skeptics.stackexchange.com/a/6164/1792](http://skeptics.stackexchange.com/a/6164/1792)

tl;dr: there's no evidence to suggest it is effective, and much evidence to the contrary.

<comment><USER9> I suppose the assumption you make is that the death penalty is meant as a deterrent. My world-view is that the death penalty is a form of punishment for serious crime. It is not meant as a deterrent, not meant as some "lesson" for others. And I, personally, see no problem with it as a form of penalty to be payed by some. (I also reject Blackstone's formulation)

<comment><USER10> If you see no problem, how do you propose to revive those killed because trial went wrong and an innocent man was sentenced?

<comment><USER11> The vast majority of trials are absolutely fair and this "what if?" argument is thrown up too often as an emotional argument, even in the cases of truly cruel and heinous crimes. I've been on a murder jury, and if anything the system is biased towards not convicting (as it should be).

<comment><USER12>
      > The vast majority of trials

You skirt the question. It said "those killed because trial went wrong and an innocent man was sentenced". So it asked exactly about those that you exclude.

<comment><USER9> >If you see no problem, how do you propose to revive those killed because trial went wrong and an innocent man was sentenced?

I don't. They are dead. They got unlucky. I reject the idea that we can't have capital punishment because sometimes the outcome of a trial is wrong. If you think this is a real problem then quantify it. Put down exactly what the percentage is (i.e. out of every X trials how many "go wrong" as you say). Then we can talk about a feasible upper bound. To say "If the percentage of people wrongly convicted is > 0% then we can never have a death penalty" is too idealistic. If it's 10% then it's obviously too high. Now we have a lower bound and an upper bound and can have a debate about what is an acceptable number of innocents dying. (again, 0 is infeasible).

> One person is one person too many!

This is the Blackstone principle. As I have said in the first post, I reject this. We both seem to disagree on a "first principle".

<comment><USER12>
      > Put down exactly what the percentage is.

That statement makes no sense at all! There _have_ been proven cases (headlines about people freed from death row more than once in the last few years; and no, that's not a sign that "the system works", quite the opposite), so there is no question that they exist. Asking the obviously impossible and completely unconnected question "how many _exactly_ " makes no sense, what would that achieve, even if it were possible?

One person is one person too many!

I am all for weighing risk or cost vs. benefit, but what would be the benefit of killing people, apart from "revenge feeling"? Also paart from costs, because the death penalty AFAIK is _very_ costly to the US taxpayer and I've read actually more expensive than life in prison.

So zero benefit against killing even one innocent person.

I'm not even someone who is dead set against killing.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Polling in California's Proposition 62, which would end the death penalty, is, perhaps unsurprisingly, uncertain, though offering some hope for its abolition:

[http://www.mercurynews.com/2016/09/21/polls-voters-favor- leg...](http://www.mercurynews.com/2016/09/21/polls-voters-favor-legalizing- pot-outlawing-capital-punishment/)

"Proposition 62, which would replace the death penalty with lifetime imprisonment without parole, has a tougher road to passage, according to the Field Poll, done in conjunction with UC Berkeley's Institute of Government Studies.

The measure, which faces a competing state initiative, has the support of 48 percent of likely voters, while 37 percent oppose it and 15 percent are undecided. The pollsters cautioned, however, that a nearly identical proposition four years ago enjoyed a similar lead before being defeated by an electorate that wasn't ready to soften sentences for some of the state's most violent criminals."

</comment><comment><USER14> When its gone I'll miss the justice it provided because of its controversy.

We already know that Y% of death penalty cases are overturned before the victim is killed due to judicial misconduct and Y% is ridiculously large. We can assume that whatever the percentage of justice system failure is for mere life or mere 20 yrs w/o parole, its much higher than Y% due to having less attention paid to it.

The end result of getting rid of the death penalty is we'll be stuck living with (100-Y)% of really bad people, which is an inherent bad for all of us, and we'll have far more than Y% serving life and 20 yrs and so on unjustly and unexamined because those aren't death penalty cases anymore.

You can't seriously claim the people overturning unjust death penalty cases are going to transition to overturning unjust 20 yr cases.

Obviously some fraction of the (100-Y)% of those deserving the death penalty today will find a way to cause more human suffering years after they'd be dead if the penalty existed.

The net result, paradoxically, of getting rid of state killing of people, will be more total human suffering due to massive increase in false imprisonment at lesser sentences and obvious increase in number of victims of the worst of the bad guys because the worst of the bad guys won't be dead.

There are also weird cultural double standards issues, where its great and patriotic to kill brown people on the other side of the planet, but not here. Why does the dirt they stand on matter more than the flesh they're made of?

<comment><USER15> > We already know that Y% is ridiculously large.

That premise for the rest of the argument warrants more evidence than a non- backed vox populi.

Apart from that, it also failed to consider the percentage of executed people that were indeed innocent.

<comment><USER16> It's an easily findable number: _" Those sentenced to death are almost three times as likely to see their death sentence overturned on appeal and to be resentenced to a lesser penalty than they are to be executed."_

[https://www.washingtonpost.com/news/monkey- cage/wp/2015/03/1...](https://www.washingtonpost.com/news/monkey- cage/wp/2015/03/17/most-death-penalty-sentences-are-overturned-heres-why-that- matters/)

<comment><USER15> Why would that make it "ridiculously large"?

<comment><USER16> 75% isn't very large?

</comment></comment></comment></comment></comment><comment><USER17> I wrote this in response to a comment that was deleted, but I'll leave it here as it's my favourite criticism of the death penalty:

I like to give this as a counter [1] (from Franquins "Idées Noires", which shamefully I still don't think have been translated to English).

The text reads roughly (my French is rusty):

"The law is clear: Anyone who intentionally kills another loses his head. Let the executioner do his job."

"Over here my friend."

"And so a good deed is done."

"Sorry, but the law is clear: Anyone who intentionally kills another ..."

[1] [http://www.funeraire-info.fr/journee-contre-la-peine-de- mort...](http://www.funeraire-info.fr/journee-contre-la-peine-de-mort-une- autre-idee-noire-5288/)

<comment><USER18> I don't get why that's a great argument rather than a silly word game. It's legal for the State to do plenty of stuff that it's not legal for private citizens to do.

This is at best an argument against having poorly-thought-out laws like "Anyone who intentionally kills another loses his head", not one against the death penalty in general.

<comment><USER19> I agree. Humanity has been distinguishing between "murder" and "killing" for millennia. It is sophistry to obtain a pre-concluded end result to pretend otherwise.

I say this not because I'm pro-death-penalty; I say it because it's a terrible anti-death-penalty argument. There's much better arguments than such word play so simple a child can see through it.

(Cards on the table: My personal position is that, actually, I'm OK with the death penalty in situations where a society can not afford to keep the murderer alive, or the society does not have a reasonably expectation of being able to keep the murderer from murdering again. But I do not merely mean "the society would be inconvenienced", I mean, the normal state through history is that the society literally can not afford to feed a murderer or have a realistic expectation of holding them; a tribe 5,000 years ago of 100 people literally can not afford it. However, in the 21st century, every major civilized society in which we might even be having this debate is very far away from that problem, having both abundant resources to feed and house them, and very realistic expectations that they can indeed keep them away from innocents. Prison breaks today are big news, and still don't happen all that often.)

<comment><USER17> It is intended to make you think about _why_ an execution is different.

For starters, if we accept state sanctioned killings, then any argument that a life is inviolable goes out the window. With capital punishment, the state is saying that taking lives can be acceptable.

> Humanity has been distinguishing between "murder" and "killing" for > millennia

Yes, and a major distinguishing factor has tended to be premeditation and intent. An execution is of a nature that would fit in the worst category of murder if it wasn't for the fact that it was ordered by the state.

An execution has all the hallmarks of something that would tick every possible mark of a particularly heinous murder otherwise. Yet even when we _know_ that innocent people get executed too, it is tolerated when carried out by a state.

<comment><USER19> "then any argument that a life is inviolable goes out the window."

Very few people argue that. Even fewer people who are pro-capital-punishment would argue that, for obvious reasons. An argument that only convinces those who already agree isn't even an argument.

"An execution has all the hallmarks of something that would tick every possible mark of a particularly heinous murder otherwise."

No, it doesn't. You're just doubling down on the sophism. Again, let me emphasize that if anything, I'm angry that this is a _bad argument_ against capital punishment, not as a defense of capital punishment. Everyone from philosophers to the man on the street have understood the differences between cold-blooded murder, murder in the heat of passion, execution, warfare, and self-defense for millennia. Nobody who is capable of making those distinctions is going to be convinced to see all killing as equal, when even the man on the street considers it a rather unsophisticated position.

See also why the animal rights argument that "if it's wrong to murder people for premeditated reasons it should be wrong to kill animals to eat them" hasn't gotten any significant traction. Appealing to people to deliberately dumb down their morality for that to work isn't a good argument, especially when, again, it's not even that sophisticated a difference we're talking about here. We're not into weird Latin terms, reading 19th century existential philosophy, or even arguing what "begging the question" _technically_ means, we're talking stuff that your average 12 year old could explain.

<comment><USER20> So what is the distinction? I mean that as a genuine question - Vidarh's position seems to be that the death penalty is intentionally taking a life, and shouldn't have a different moral standing to murder.

The response seems to be that that's a bad argument, they don't really believe that there's no distinction, and it would be stupid to believe that.

If I don't see a distinction of moral significance between the death penalty and, say, the CEO of a company deciding to painlessly execute one of their reports that they discover has gotten away with serious embezzling for multiple years, scorn doesn't help me understand the distinction someone else does see.

</comment></comment></comment></comment></comment></comment><comment><USER21> Life without parole is way crueler and inhumane punishment. We either need penal colonies or the ability of the prisoners to request and be granted euthanasia.

<comment><USER22> Or we could try, oh, you know, prisons that aren't torture to be in even for a few days.

It's kind of a radical new thing for humanity that we now have the means to provide lives, even meaningful ones, to people who prove themselves too dangerous to live in open society. We should at least give it a try.

<comment><USER23> 5 star hotel treatments for lifers seems a little bit silly. Why should they live as Kings after what they did to their victims?

<comment><USER22> So vengeance is what you're after. I can understand and even respect that.

The question you might be asking is why the "bleeding hearts" like me aren't. For me at least, that would be because I believe that culpability for actions is a continuum. Hell, I even think _sentience_ is a continuum. At some point, criminal tendencies cross a blurry line from willful malfeasance into mental disability. Because I can't reliably determine this point and I don't trust those passing judgment not to let their prejudices and biases influence their thirst for vengeance, I prefer a system that uses extra caution.

We have the material resources to provide meaningful lives to these individuals for their entire natural lives. Not "5 star" accommodations mind you, but far from the hellish gulags we have now.

Lashing out in deadly anger feels _awesome_ , I freely admit. But how many are on life sentences for no less?

<comment><USER23> I was referring to those in there for life (to protect society).

I don't see it as 'vengeance' if they aren't pampered. There is a broad range between gulag and the Hilton.

That being said, those who in short-term should have some environment suited for rehabilitation, which probably includes learning that "wow jail sucks, i will remember that next time before I punch someone". Obviously they should be given the chance for education and employment, but the latest Playstation games might not be a necessity.

</comment></comment></comment></comment></comment><comment><USER4> One thing to remember when talking about criminal punishment. It's not for the criminal and its not for the victim. It's society acting for its own sake.

What matters is that crime is not profitable in any situation. Punishment is there to reap away any profitability, but nothing more.

Murder gets you life in prison and I think that is justified. But it opens a problem here. Once you do one murder, second, third and fourth only increase your risk of getting caught. The punishment stays the same. There is specific case where death penalty would make some sense. If you are caught on the act. Killing witnesses should get you worse punishment than the original murder. But this gets tricky very quickly on many occasions.

<comment><USER24> Caught in the act isn't a clear cut thing. Witnesses have been known to be wrong. In fact, identification of people you don't know is a very tricky thing. I read an article recently about a man in AZ that was identified _twice_ as the perp in robberies, and even though he had an alibi for both, the prosecutor ruined his life (lost job, drained bank account, divorce). The problem was, he looked amazingly like the perp (there was video).

Had he not had a job with video showing he was there, he would most certainly have been convicted of those to robberies.

If this had been a capital murder case, he could have been convicted on eyewitness testimony. Wrongly.

<comment><USER4> Yes it's tricky.

But it's also quite nasty that in some police sieges the perpetrator has absolutely nothing to lose anymore, except his life. So if he kills several policemen and manages to escape, it's still good deal. If that doesn't look likely, surrender and get the exact same life in prison you would have gotten anyhow.

Knowing this dynamic, the police is incentive to use sharpshooters early in the situation. Which is essentially death penalty without due process.

<comment><USER25> Google tells me that the average time on death row is ~15 years. I'm not sure the average criminal weighs the difference between life or 15 years when contemplating murder. I also believe that sentencing for crimes are compounded in the US - so you might get 15 years for each murder, 10 years for robbing a bank with a weapon, 5 years for robbery, 5 years for using a weapon in a crime etc - effectively a "life" sentence.

Also, is being shot by a sharpshooter the death penalty without due process or a reasonable effort to preserve the lives of innocent people who may be involved?

<comment><USER4> To me 15 years for murder sounds low. Even for Nordic country standards.

My understanding is that the ~15 years is because the convicts try everything to get the sentence repelled. Which signals that "death sentence" is really something they consider lot worse than being in prison.

There has been research that humans are unable to accurately discern more than 3 years into future. I don't think 15 vs. 30 vs. 45 years makes much difference. But 20 years vs. lethal injection, there is obvious difference in the quality of the punishment.

>Also, is being shot by a sharpshooter the death penalty without due process or a reasonable effort to preserve the lives of innocent people who may be involved?

You could claim that any death penalty is exactly that. No matter which position you take, the best situation in either case would be the perpetrator turning in and getting that due process.</comment></comment></comment></comment></comment>


Why New Yorkers will be sipping bone broth in coffee cups this winter - <AUTHOR> http://wellandgood.com/2014/11/05/why-new-yorkers-will-be-sipping-bone-broth-in-coffee-cups-this-winter/

<comment><USER2> Bone broth is really good, and it's also very easy to make if you aren't a New Yorker or don't want to pay $4 for a small cup. Put a bunch of bones in the slow cooker; add some water and vinegar; let 'er rip. That's it. It leaches out all of the minerals and stuff from the bones.

<comment><USER3> Sounds a bit like a standard beef stock really. If it really is that, here is my current favorite recipe: [https://www.ming.com/food-and- wine/recipes/season-1/master-m...](https://www.ming.com/food-and- wine/recipes/season-1/master-meat-broth.htm)

But chicken stock (with leftover bones from a roast chicken), and pork stock are also great bases for a good soup.

Which is really what this is: he is selling soup.

</comment></comment><comment><USER4> $7 for a large serving is absurd. Bone broth is the easiest thing to make, and it's made from the scraps you normally throw away. Only in New York would (and could) someone charge so much for this.

<comment><USER5> ... and maybe San Francisco.</comment></comment>


Rely your web startup on Rackspace Cloud? Think again - <AUTHOR> http://bencheng.net/rely-your-web-startup-on-rackspace-cloud-thin

<comment><USER2> I'm thinking Rackspace might well have been in the right on this one. If the customer was in fact phishing, Rackspace was well within their rights to shut down the account. It's really up to the application creator to prevent that abuse.

That said, it's good to have a reminder of the risks of outsourcing your hosting. I still think the tradeoff is worth it for experimental products where you don't want to invest too much upfront.

<comment><USER3> I agree. Hosting providers usually reserve the right to shutdown your server if it has been hacked, and phishing is often more directly harmful to people.

<comment><USER4> Agree. This wasn't a simple DMCA issue-- phishing is an active, criminal activity. Even one hour notice is generous.

<comment><USER5> Taking the contents of the article on faith, I think the point was that their customers were abusing the startup's service for phishing.

This would be analogous to, for example, AWS taking reddit offline because a user posted a phising link.

Nearly every web business which lets people put information on the web that others can see will face abuse issues at some point or the other - and cutting off a business and its legitimate customers because of one client misusing the service does not inspire confidence.

</comment></comment></comment></comment><comment><USER6> This may sound contrived and sarcastic, but I assure you it is not.

Try your best to get Robert Scoble's attention on this. Rackspace has tasked him with being an evangelist primarily focused on startups and bringing them into the Rackspace services. It's my understanding that things like this should be his primary concern.

I could be mistaken, but I'm used to that.

<http://twitter.com/malbiniak/status/22672201225>

<comment><USER7> Your middle paragraph is reasonable and a good idea. What's with the first and third?

<comment><USER6> first - didn't want to come off as "complain and your problem will be fixed." i never anticipated having it called reasonable.

third - second paragraph is my interpretation of a conversation i had with some people from rackspace and it could be wrong.

also, hello from minneapolis.

</comment></comment></comment><comment><USER8> What is missing from this article (and comments so far) is a more comprehensive analysis of available options.

If I lease a server from linode or AWS or theplanet or serverbeach or ${your favorite hosting provider}, would the situation be any different? I understand the article's author frustration with Rackspace, but it's a single data point hence hardly enough to be a basis for an intelligent choice of hosting provider.

I'm not even sure if I sympathise with him. You can argue whether 1 hour notice before disabling a server is enough or not but there is an obvious conflict of interest.

The interest of the person hosting server, who can potentially be a phisher himself, is for the site to stay up as long as possible.

The interest of the public is served by terminating the server as quickly as possible.

<comment><USER9> Your last two lines sum up the problem nicely.

Everywhere, the more you pay, the more effort they will put in to helping you clean up your messes rather than shutting you down right away, which makes sense, because helping you clean up your mess is an expensive business to be in.

<comment><USER10> Which doesn't explain Rackpace's behavior, considering their premium cost for "fanatical" support.

Perhaps Rackspace cares more about it's shareholders than customers?

<comment><USER9> I could be mistaken, but I think that the rackspace cloud is their cut-rate product which comes with less support.

<comment><USER10> [http://www.rackspacecloud.com/cloud_hosting_products/servers...](http://www.rackspacecloud.com/cloud_hosting_products/servers/support)

"We talk AND we listen. We're big fans of transparency and feedback. Technology works so much better combined with a bit of humanity."

</comment></comment></comment></comment></comment><comment><USER11> I am really not a fan of all the defending RackSpace here. They pulled the plug unreasonably without proper notification.

If you're going to pull the plug or even thinking about it... email simply isn't going to cut it. You need someone to call the owner and make contact to explain what's going on or how to resolve it. I've had my servers compromised, I've had phishing content setup before, I have never had the plug pulled. I've had hosts contact me, give me appropriate amounts of time to handle it and some of them even offered to help secure my box or look into how it got compromised in the first place.

</comment><comment><USER12> All this talk about how Rackspace should be treating startups make me think, "Why?"

I understand startups may not have the personel to react as fast as a larger company with dedicated personel, and I understand that there might be a very large percentage of startups on Rackspace which might account for a nice chunk of revenue.

But what makes startups different from my personal website or a larger corporation? If Rackspace receives a complaint about a phishing site hosted on their servers, they should do what they can to correct that, regardless of which client is using the server that has the phishing attack. The startup should get the same treatment from Rackspace as the large corporation and the guy with some simple homepage.

<comment><AUTHOR> It is like asking why we need special facilities in building for the disables. Why didn't we treat everybody the same and don't provide any special facilities for disable?

I do think that site owner of any scale IS responsible to abuse complains, but the scale of the company do make a different. The influence and harmfulness of a fake shop in Amazon is not same as a fake shop in a very-small-online-shop. Thus people expect Amazon to take action instantly.

A start-up is not possibile to react as fast as large company, so why shouldn't we give them a reasonable time for them to do their job?

<comment><USER13> The people being phished don't care how big you are or how fast you can respond. What would _they_ consider a reasonable time?

<comment><USER10> If the people being phished know they are being phished, then why are they allowing this?

</comment></comment></comment></comment><comment><USER14> Welcome to the joys and sorrows of hosting user-generated content. If this makes you feel better,rackspace is just your first problem. You'll also find soon enough that abuses can get your domain blacklisted in chrome, firefox, and for opendns users.

</comment><comment><USER15> What _should_ happen here is this...

When a server is 'shut down' for phishing or spam, a firewall blocks all incoming/outgoing except for traffic to/from a pre-determined IP address along with the notice that the server is being quarantined.

Site owner/admin can then access the server, perform any investigations or deletions necessary, notify data center, then data center opens traffic again.

Alternatively, something like a web-based shell allowing access, but all other traffic denied, would be acceptable.

I've had servers shut down for 'abuse' which was one complaint from someone at 1am local time for me. I supposedly got a call from xxxxxx at 2 am, notifying me that action would be taken, and my server was taken offline at 3am. I wasn't awake until 7am, and couldn't get things resolved until about 10am. I was told I needed to 'rectify the situation', but how can I do that when access to the server is blocked? It's a ridiculous execution of policy, and only serves to heighten everyone's frustration. A private web-shell or single IP in the firewall to allow access would resolve most of the ill-feelings site owners caught in this situation have had.

<comment><USER9> My policy is that I shut down the server, I create a fresh server for the user and then I attach the old disk read-only to that server, in case the user needs to retrieve data.

The problem is that there is no way to 'clean up' after a break in without booting from trusted media. Otherwise, there is no way to know if you have closed all the backdoors the attacker left.

</comment></comment><comment><USER16> We had a similar problem with another vps provider. Some php script was remotely exploited and sending spam. They disabled the VPS. Our website and email was down for 24 hours. They enabled the VPS the next day for us to look at it. What's worse I was asked to reinstall the VPS and it took me some convincing for them to enable it so I get my data from the server.

Lesson learned? I think you should never have any operations where you don't have full control. This still holds true but it was a bit ironic because to have full control I ran everything on the VPS, effectively transferring full control to the VPS provider! It was the single point of failure.

Now I will transfer each different service to a different provider. Email to rackspace, websites to a host, git services to github and so on.

</comment><comment><USER17> Post is lacking information on whether the site was actually a phishing site and who (or which entity) submitted a complaint.

I think verification of the legitimacy of a complaint should be a critical step before disabling a site, otherwise you're prone to DoS.

It would also be good to know what steps the complainant took. Did s/he try to contact Pandaform, or immediately go to Rackspace as the owner of the IP?

Without knowing whether the complaint was legitimate, and what steps Rackspace took to verify this (or not) its tough to say whether their actions were appropriate.

<comment><USER10> Their actions are inappropriate.

The majority of commentors here assume guilty until proven innocent.

In fact, the author of the article has still been unable to identify the "phishing" form. Was there even really a phishing form?

With all this anti-phishing technology built into modern browsers, why is it Rackspace's responsibility to "protect" users from "alleged" phishing sites?

For copyright, we have the DMCA (for better or worse). Perhaps we need some similar sort of due process for hosting providers or cloud providers.

Most appalling is Rackspace's lack of transparency in handling this.

Pandaform was never contacted by the complainant. The complainant only contacted Rackspace. Rackspace assumed, without investigation, the complaint was legitimate and gave the guy notice via email.

Also, the real rub, is the fact the Rackspace would terminate his account if he got a second complaint.

So, it is not necessary to have an actual phishing form on his site to have his Rackspace hosting terminated. Someone simply needs to allege this to Rackspace, and his account and data will be gone forever.

That is fanatical? Again, I cannot recommend Rackspace.

</comment></comment><comment><USER9> this will happen at any responsible web host. If you are hosting phishing sites, expect to get taken down. This trickles up. if you run a hosting company, and you get enough complaints that you don't deal with, then yeah, you will get shut down or asked to leave.

That said, I think especially for higher-priced services, a phone call would be nice. (Note: I don't call my customers, though this is a policy I've considered implementing.) I'd be interested in what other people think about other notification systems.

<comment><USER18> I don't think the issue is that he was hosting an active phishing site. The main issue here is the amount of time he was given to fix the problem was too small. You think Rackspace's upstreams would shut the pipes down if there were a bunch of phishing sites that set up shop? Doubtful. Usually they only get involved when there is a MASSIVE DDoS.

<comment><USER9> Well, from my experience in industry, big providers of bandwidth do apply pressure (up to and including the threat of disconnect) to large hosting companies in an effort to get them to clean up their act, even when it comes to things like spamming and phishing that are less outright destructive to the network than DDoS activity. You are right that a million dollar customer will get a lot more slack than a twenty dollar user... but, uh, to me that should be expected. Dealing with abuse is very expensive. Some places I've worked that has been the majority of support costs.

</comment></comment></comment><comment><USER19> Rackspace (and others) need to call their clients on the phone in these situations. They feel it is so important that it must be taken care of in one hour, yet they use email. Not exactly fair to the client....

<comment><USER9> Isn't the rackspace cloud their cut-rate service? would they have called if it was a slicehost (premium price) customer?

Still, I think it is a good idea, and one I ought to implement in my own service. The problem is that we all hate dealing with the phone, but that sounds to me like a lazy answer.

On the other hand, really, if you are an abuse problem, honestly, I don't want you as a customer.

<comment><USER20> Slicehost doesn't have phone support last I checked.

</comment></comment></comment><comment><USER21> imo the biggest mistake here was in PandaForm trusting all of its user- generated content.

It seems like they should have been doing some sort of verification of the UGC. Alternately, if they really wanted to go with a fully laissez-faire no- security-checks approach, they shouldn't have picked a hosting company (in this case, Rackspace) that requires customers to sign an agreement that has strict anti-phishing rules.

</comment><comment><USER10> I second this. Not a fan of Rackspace.

Some may argue having your own hardware is more expensive to maintain, but there is a definite advantage to controlling your physical hardware.

Rackspace is helpful until you have a real problem, and you are left to fend for yourself.

</comment><comment><USER22> How was this construed as "phishing"?

Did the customer simply set up a form that asks for a user's email address? because if so that describes tons of other services out there... e.g. Wufoo, Google Documents (but I guess they are not hosted on Rackspace!)

<comment><USER23> FYI, my phishing form @wufoo: <http://rickmak.wufoo.com/forms/phishing/>

Look professional? ;) Similar form on pandaform will make pandaform shutdown entirely.

<comment><USER22> it looks like it got taken down. what was it?

</comment></comment></comment><comment><USER18> Good to know I wasn't wrong when I switched to Linode (From Rackspace). While phishing and spam is damaging, owners need more than 1-2 hours sometimes, especially when they are in a different part of the world.

</comment><comment><USER24> Oy. This comes the day after I moved all of my sites to Rackspace Cloud.

<comment><USER25> Oh no, get as far away as you can!

Check out Linode or SoftLayer.

</comment></comment><comment><USER26> @matrix, I think overall direction is correct, Rackspace should try their best to notify their customer if they received complaints. However the ridiculous point of this case is totally shutting down all servers of a startup in just 1 hour, which is really horrible. Instead I believe they should at least give 12 - 24 hours for a startup to react and investigate before taking down all their services?

Is that really on the same direction that they want to serve startups?

<comment><USER27> > they should at least give 12 - 24 hours for > a startup to react and > investigate

By which time the phisher has already done the damage and moved on.

</comment></comment><comment><USER28> I wonder if this abuse monitoring service can be outsourced somehow. Pay a team of people around the world to monitor the abuse email address and hand them the kill switch for so they can respond immediately to take down one account only instead of the hosting provider taking down the whole server.

</comment><comment><USER29> Linode isn't really any better. I sent an email campaign to an optin list from campaignmonitor - someone (1 person out of 1000) reported spam.

Campaignmonitor asked us what was going on - while this is debatable they may have been damaged from the complaing

But even linode asked us about it, just because the website where people signed up was on a linode hosting.

1 complain, nothing to do with hosting a part that the link is the here, and they asked us if there was something wrong.

I wonder if you can just blast a spam email with a competitor website (hosted on linode) inside and get him offline...

</comment><comment><USER30> To be fair, a service the size of Rackspace Cloud is bound to screw up at least a few times.

Then again, no one ever got fired for switching to Linode.

<comment><USER31> First of all, what is up with Linode's London datacenter? I barely press enter on commands and they've already been carried out. Seriously, it installs packages before the text from the server reaches me, and I get 15 ms latency on it (the SSH echo feels faster than my local PC).

Is it just me, or are their other datacenters slower than their London one? It might be the latency, as I was actually _in_ London, but the one I have in Georgia doesn't seem to have that fast disk accesses... Bottom line, though, the London datacenter is just time-traveling fast.</comment></comment>


From Darts to Bodies, New Study Reveals 5,000 Years of Violence in Central CA - <AUTHOR> http://westerndigs.org/from-stone-darts-to-dismembered-bodies-new-study-reveals-5000-years-of-violence-in-central-california/ <comment><USER2> Wow, something like 11% of buried people appear to have been killed violently! I wonder if that was also representative of the common way of dying or just that soldiers were more often buried than grandmothers.

Sounds like the Europeans ultimately saved them from themselves. After doing their own bit of violence too of course.

<comment><USER3> Besides the obvious racism overtone[1], basing an argument for something that happened from 1942 onwards all over the Americas, on some findings about a specific small part of the US, 5000 years ago, is not really scientific...

[1] The whites that "saved" them by taking their land, forcing them to "sign" their land off with bloody wars, putting them in concentration camps, and lots of even worse things...

</comment></comment><comment><USER4> CA disambiguation: California.

</comment><comment><USER5> Go figure; a mass killing prior to the introduction of firearms.

<comment><USER3> The snark would be relevant if people argued that mass killings didn't occur before the introduction of firearms -- as opposed to arguing that mass shootings didn't occur...

Or perhaps it's not obvious enough that this ancient mass killing didn't happen by a single guy armed with some bone shaped into an axe or something, but it was something a large group of people did to another (e.g. hostages caught in a war).

One would think that a 16-year old kid trying to mass kill his school mates with a knife would not get very far...

(Or one could just check the homicide and mass shooting rates in ANY western country with a ban on private firearms and see that they are many times smaller).

</comment></comment><comment><USER3> Straight Outta Bakersfield!</comment>


Usury and the collapse of empires - <AUTHOR> http://lemire.me/blog/archives/2011/08/09/usury-and-the-collapse-of-empires/

<comment><USER2> "But can anyone convince me that credit card companies produce wealth by charging exorbitant interests to people who use the money to buy beer and chips?"

How using my credit card to buy beer and chips produces wealth:

1) My rewards program immediately reduces the price by 1%.

2) If the chips are moldy and the vendor won't let me return them, I can cancel the payment.

3) I pay no interest. The credit card bill is paid in full every month.

<comment><USER3> He's not talking about you, then.

<quote>Economists who expect people to be rational won't believe in usury. Surely, people borrow money to be better off. Yet the average credit card debt per household is over $15,000 in the USA (and it grows all the time, of course). Does anyone believe that these $15,000 are invested in highly profitable ventures? (They would need to be highly profitable since credit cards often charge over 15% for loans.)</quote>

<comment><USER4> I take issue with that $15,000 number. According to:

<http://www.indexcreditcards.com/creditcarddebt/>

revolving consumer debt (of which credit card debt is a large but strict subset) was only $7400 per household in November 2010 and I doubt it's doubled since then.

Indeed, <http://www.federalreserve.gov/releases/g19/Current/> suggests it has gone down somewhat since then.

Still crazy high, of course. I can imagine how an emergency situation _might_ cause someone to have to spend more money on a credit card than they have in their savings account. I can't imagine how the _average_ person manages to get into that situation, though.

<comment><USER5> I worked at a credit counseling service in high school (circa 1995), and numbers in that range would not surprise me at all. This is a navy town, and I couldn't count the number of young enlisted sailors that would come in with wife, kids and over $50k in unsecured credit card debt. Also, it mostly wasn't on normal credit cards. They would typically have a card for a dozen or more different retailers (e.g. Sears, Express, Limited, Target, etc.) all maxed out.

</comment></comment></comment></comment><comment><USER6> _Yet the average credit card debt per household is over $15,000 in the USA (and it grows all the time, of course). Does anyone believe that these $15,000 are invested in highly profitable ventures?_

Who is the author to ignore the values and priorities of the rest of the public? It seems that he wants everyone to live by his own standards.

If the people borrowing this money believe that they're getting greater value than they are costing themselves, then they are in fact making themselves better off.

The author doesn't see that they're better off, either because he doesn't understand their values, or he's simply not looking at them as individual people but a monolothic heap of people. But either way, he's ignoring the evidence of their own actions.

<comment><USER7> While there may be merit in the idea that consumer debt makes people happier or even is in their best interests, I'm not sure that "the evidence of their own actions" is sufficient to persuade me. Not far from where I live I can find people selling themselves to starngers for crack money. I observe people smoking cigarettes.

People do things that are I believe are harmful to their own interests, and I stop short of embarcing an amorality where aiding and abetting them for my own gain is right since they have free will and make their own choices.

The do believe they are better off. I think I understand their values. I do not ignore their priorities. But that doesn't mean I always agree with them. Crack addicts and smokers, that is. I don't have as rigid a belief about credit card debt, I'm just pointing out that "Evidence of their own actions, values, and priorities" does not persuade me in and of itself.

</comment></comment><comment><USER8> Great, another gold bug.</comment>


Fast Chrome bookmarks navigation - <AUTHOR> https://github.com/ahmadassaf/Booklight <comment><USER2> Curious why you don't use the google stars extension and do keyword search vs. directory navigation?</comment>


Lenovo releases first Fedora Linux ThinkPad laptop - <AUTHOR> https://www.zdnet.com/article/lenovo-releases-first-fedora-linux-thinkpad-laptop/ <comment><USER2> > I've used laptops with Ultra High Definition (UHD), aka 4K, with 3840x2160 > resolution, and I've found the text to be painfully small.

Where are you all getting this from? Win10, KDE scale without any problems for quite a while.

</comment><comment><USER3> Too bad article forgot to mention battery life. I'd expect minimal system with manufacturer supported Linux drivers to achieve really good times</comment>