Lead-Free Solder Is Better for You - <AUTHOR> https://www.bhencke.com/blog/2019/3/15/a-hill-to-die-on <comment><USER3> I never heeded much caution when soldering using lead solder growing up. When I got to university, the department employed a long-time soldering professional, with NASA certifications, etc. She was very knowledgeable, but visibly suffered from what I assumed was chronic heavy metal poisoning - <USER2> loss and visible skin problems. It was a pretty big wake up call for me that I needed to treat solder with more caution.

Especially for people introducing children to electronics, make sure you're using lead-free materials. If for whatever reason lead is unavoidable in a project, make sure you're using good ventilation and wash thoroughly before going around your kids after you've handled lead.

<comment><USER4> I am much into hobbyist work, like 3d printing/welding (mig/tig/stick welding/grinding), laser/CNC cutting.

I use a fume hood, I made it myself using Centrifugal fan and filters.

I thought about using scuba gear for welding, but I was worried about explosion from oxygen in case of leak?

Then I wear a respirator.

Is there anyway to respirate using a pipe placed elsewhere? Thinking about having a respirator attached to 20meter long pipe and put other end of the pipe outside to get fresh air instead of breathing the welding fumes.

<comment><USER5> _I thought about using scuba gear for welding, but I was worried about explosion from oxygen in case of leak?_

FWIW, it's way overkill, but you'd want SCBA (Self Contained Breathing Apparatus)[1] not SCUBA (Self Contained Underwater Breathing Apparatus) unless you are, indeed, underwater. Of course the technologies are similar (and can be swapped to a limited degree in a pinch) but SCBA is used when you're not underwater. Those are what firefighters use while attacking fires, or performing trench rescue / confined space rescue / etc. and handling hazardous materials calls.

Note that SCBA do not used bottled oxygen... it's just plain air, but under pressure. I'm not a diver, so I don't know as much about SCUBA, but I know they aren't using pure oxygen either, but I think there may be times when they use a mix that is slightly different from plain old atmospheric air.

An additional note: SCBA are expensive, require maintenance and need to be refilled with air. All of these things would be a challenge to using one outside of an industrial setting. The "refill with air" part is especially tricky, because you might think "I can use a regular air compressor", but you actually can't, for at least two reasons. One, the pressures needed to fully refill an SCBA tank are higher than a standard shop air compressor. Two, the air also needs to be filtered to remove any contaminants - including, for example, oil used to lubricate the pump on the compressor. As you might guess, fire departments and other SCBA users buy special compressors that are very expensive.

And unlike SCUBA, I don't know that there are many, or any, commercial shops where you can walk in and get a bottle filled. If you had a buddy on a local fire department, they might be able to get a bottle filled for you, but no guarantees. Oh, and the bottles also need hydrostatic pressure testing every few years to make sure they are safe to use.

[1]: [https://en.wikipedia.org/wiki/Self- contained_breathing_appar...](https://en.wikipedia.org/wiki/Self- contained_breathing_apparatus)

<comment><USER6> Most recreational diving is just compressed air, no added oxygen.

I wonder if, or why, SCBA gear would use different tank valves than SCUBA gear such that any dive shop couldn't fill one.

<comment><USER7> FWIW, nitrox use is pretty common among recreational divers as well, and mixed gas diving is all but a must for tech diving. 32 and 36 percent O2 are most common and up to 40 is ok without taking extra equipment precautions.

</comment></comment></comment></comment></comment><comment><USER8> After I got out of the military (in Electronics) I did a few years as a rework tech at a big telecom company soldering literally 8 hours a day. I got really good at it.

We had very little safety equipment, and used leaded exclusively. Vent hoods, but that's about it. Many people turned them off because the shake and rattle of the fans made it difficult to work on precise things like surface mount components. There was even a big CPU changing station which was effectively a molten vat of solder that you'd dip all 144 leads into to remove huge square I.C.s

This was in my early 20's, and I had that job for about 2 years. Despite perfect dental hygiene, most of my teeth had decayed and had to be crowned or replaced by the time I was 30. Most people I still talk to from that time in my life have chronic problems directly associated with lead poisoning (tooth decay is sort of loosely correlated, and I don't have any other typical symptoms into my 40s)

All of this is to say, the US Navy barely even mentioned lead safety in school, and a billion dollar (at the time) company didn't seem to care enough to train its employees, so the attitude that it's "not a big deal" was well and alive in the 90s, and I wouldn't be surprised if it still is today.

Also - Why is rosin-core solder so popular? I never used anything but raw spool solder and liquid flux. Rosin core makes a huge mess.

<comment><USER9> The older military and aviation boards we make still all use lead. Changing to lead-free requires an extensive re-certification process for each board, and no one at any level wants to do that. Which seems to create a belief that lead is manageable and okay. Interestingly, the board assembly shop still prefers lead because the boards are apparently easier to make.

Rosin-core is popular because it's a 1-step process. No need to put on the liquid, which seems to make at least the same mess.

[edit:grammar]

<comment><USER10> There are liquids that are much less messy than rosin core.

</comment></comment></comment><comment><USER11> Am I the only weirdo who prefers lead-free solders _because_ they don't flow as much?

They dry almost as soon as you take the heat off, which keeps parts from moving off their pads while it dries. And the iron doesn't seem to "pull" globs of the stuff around as much. I get really frustrated doing finicky work with leaded solders, but I'll happily do 0.5mm pitches by hand with lead-free.

Maybe it's just because I learned with the stuff?

<comment><USER12> Try 63/37 tin/lead instead of 60/40\. 63/37 alloy is eutectic, meaning its melting and solidifying temperature is the same (183C). 60/40 has a semisolid state around its melting point (~=190C).

<comment><USER13> totally agree.

I use kester 66/44 eutetic tin-lead solder on anything I care about.

It's said that light-dark auto helmets make someone a welder nearly overnight; I think that same way about eutetic solder and soldering, it makes the job so much easier that the quality of the work skyrockets.

<comment><USER14> Any idea why, if the parts don't add to 100, they don't reduce the fraction in the solder name from 66/44 to 3/2? Un-reduced portions are handy if they're percentages, but if they're not going to be percentages, why not reduce the fraction?

<comment><USER15> because you're comparing it to 63/37\. it's much easier to grok the comparison when you use the same "units".

in racing, they say to drive 10/10ths. not 1's. for the same reason.

<comment><USER16> If they don't add up to 100, and neither of the numbers matches the default, they're not the same units.

</comment></comment></comment></comment></comment></comment><comment><USER17> It's not just bad for the solderer. It will contaminate areas around your solder area (do your kids ever do a project on your workbench?) And at end of life, lead is a problem in land fill sites and in e-waste recycling.

Indians (including children) desoldering components from imported e-waste have high blood lead levels: [https://journals.lww.com/epidem/fulltext/2011/01001/High_Blo...](https://journals.lww.com/epidem/fulltext/2011/01001/High_Blood_Lead_Levels_in_E_waste_Recyclers.909.aspx)

</comment><comment><USER18> I think of woodworking as a very similar discussion. People would wear N95s when working with a shit-ton of visible particulates, but otherwise are constantly leaving their lungs unprotected. The resultant progressive loss of long function is pronounced. But try to convince woodworkers that N95s should be a de facto daily driver. "My daddy worked wood all his life and was healthy as a horse until the day he dropped dead"

<comment><USER19> I think too many people (myself included) have thought incorrect things like, "Ah, wood is natural and can't hurt you". Not that wood is any more natural than lead, or arsenic. But it doesn't _seem_ bad like inhaling smoke from things... and yet, it clearly is not good for you in the long term!

<comment><USER20> Don't forget treated wood does have arsenic...and fumes from poly, stains and varnishes can be pretty bad.

<comment><USER21> I don't believe that treated (or, "pressure treated") wood is produced with arsenic anymore.

I believe it (CCA: chromated copper arsenate) was phased out in 2003.

I still treat the cutting of, and the sawdust from, treated wood more carefully - just out of habit - but I think it is fairly benign these days _unless_ you get specially sourced wood for marine applications ... which is not what you're going to find down at the local lumber yard ...

</comment></comment></comment></comment><comment><USER22> Tin whiskers are a fact [1] and a reason why military and space applications only use leaded solder. I want my electronics to be reliable and last a long time, which is why I'll never use lead-free solder. Leaded solder is safe as long as you take basic precautions (e.g. use a fume extractor, wear gloves, don't lick the solder [2]).

[1] [https://nepp.nasa.gov/whisker/](https://nepp.nasa.gov/whisker/)

[2] [https://www.edn.com/analog-guru-jim-williams-dies-after- stro...](https://www.edn.com/analog-guru-jim-williams-dies-after-stroke/)

<comment><USER23> I wonder why new _" we will all die to tin whiskers"_ articles stopped appearing 5 years ago. It used to be a really big thing, but now even all the new military projects are RoHS without any issues.

Did not get your link to Jim Williams article. Care to elaborate?

<comment><USER24> In my (limited) exposure of products failing in the field due to whiskers, the mitigations included coating the entire board in some kind of film, and changing layout to make the board less vulnerable in the first place. Probably designers just got good enough at that to the point where it doesn't matter

<comment><USER25> Conformal coating is not related to whiskers, it's to prevent condensation damage in certain applications. Used where it is called for regardless of solder type.

<comment><USER26> Some of the linked articles in this comment section claim that conformal coatings mitigate whisker shorting because the whiskers can't pierce the coating.

</comment></comment></comment></comment></comment><comment><USER27> Wow I just realized that I did not practice good safety years ago when I used to solder stuff. Now I have p100 filters for working with solvents and de-lead soap and all that.

But that picture of the solder scourer made my brain tickle in that really uncomfortable way when you realize you f __ __d up.

Now I should go look up whether or not smoke from melting/burning diodes is really bad for you. Probably it is :(

</comment><comment><USER28> Just because you can get solders both leaded and lead-free having the same flux, does not mean that is usually the case. Your typical lead-free alloy will have a nastier flux. Is this a big effect? No.

The real reason to stick with leaded is simply that it's much, much easier to use. If you get a joint done in half the time, that's half the exposure to nasty stuff. For hobbyist stuff, it doesn't really matter. A moderately skilled operator can do the job about as quickly with either type of solder. For the really hard stuff, like fine-pitch QFNs and 0201s or worse... give me 63/37 any day. (But only if I can't have a skilled soldering technician instead!)

</comment><comment><USER29> Reminds me of the post about LED traffic lights.

"But they accumulate snow!"

Of course they do. And that's an easier problem to solve than having bulky, heavy, power-hungry lights that die quickly.

Having a little trouble soldering is an easier problem to deal with than having lead poisoning.

Personally, I'm pretty bad at soldering, so maybe it's time to finally swear off hardware projects.

<comment><USER30> How does the type of bulb used affect snow accumulation?

<comment><USER31> Incandescent bulbs produce a lot of heat, melting the snow. LEDs run fairly cool.

<comment><USER32> Powerful LEDs also run rather hot, more specifically their power circuits. My pocket size flashlight would easily run up to 100 degrees I think but it has protection built-in and steps down brightness when overheated. And it only has 1 LED and 1 lithium cell for power. So it probably would have been easy to design external radiators for traffic lights internals, with a heatpipe or similar solution. But they would be more expensive that way.

</comment></comment></comment></comment><comment><USER33> I'd spend my effort elsewhere.

Specifically, rather than fighting over which type of solder is less dangerous to inhale, I'd focus on promoting the use of solder fume extractors.

Even basic models purchasable on platforms like aliexpress, which are as you'd expect inexpensive, do make a world of a difference on exposure to fumes.

Yet most people solder without these.

</comment><comment><USER34> I'm surprised by the number of commenters who believe lead-free solder is difficult to work with. When it comes to soldering, it being easy comes down to:

1\. Using good soldering techniques and practicing a bit.

2\. Using good quality flux.

3\. Using an iron with consistent temperature control and a tip that isn't corroded.

4\. Lastly, the actual solder alloy.

<comment><USER35> I think the iron part gets overlooked a lot, cheap/old irons see a huge temperature dip when soldering. Leaded solder handles that a little better and this is what people perceive as "the difference". Once you use propper technique and a decent iron lead-free isn't worse, just different

<comment><USER36> So what's a good soldering iron for a hobbist? Is the TS-100 that was much hyped on the internet some time ago a good choice? Or the TS-80 one? Or should one go for more traditional irons?

<comment><USER37> A Hakko FX-888 or FX-888D is a good hobbyist iron if you're going to be soldering a decent amount. I have one and it's very much worth the money.

I've heard good things about the TS-100 as well but I've never tried one so I can't confirm anything about it.

<comment><USER38> I bought a Hakko FX-888D a few years ago and immediately regretted all the time I had wasted using crappy irons for a decade and a half. Suddenly, soldering worked as easily as it did on all those YouTube videos.

I solder so infrequently that it felt like spending $100 on an iron was overkill, and I couldn't have been more wrong.

<comment><USER37> Same! My first iron was a shitty radioshack one. Shelling out the $100 for a Hakko is absolutely worth it for the time and frustration savings. I actually really enjoy soldering with it because it works so smoothly.

My only regret is not getting the analog version because Hakko kinda sucks at making digital interfaces.

</comment></comment></comment></comment></comment></comment><comment><USER39> Why does it sound like so many people here literally eat lead solder.

Practice proper lab safety for chrissakes.

Wash your hands after dealing with chemicals and/or dangerous materials, such as flux or lead. Don't let your small children near it. Don't eat or drink in the lab.

The spread of the hobby through cheap dev kits and stuff has made people ignorant to the fact that, yes, these are potentially dangerous chemicals like any other, with MSDS documentation and proper handling precautions that must be taken.

You don't get lead poisoning unless you're improperly handling the stuff. Give me a break.

Arguing that "lead free solder is better for you" is absolutely terrible. That's like saying "drinking straight bleach is better for you than drinking bleach with arsenic mixed in."

None of these should even be coming into your body in any way, shape, or form and if they are, you're doing something horribly wrong.

<comment><USER40> I remember seeing somewhere a video of Steve Wozniak showing off his old soldering technique, which involved holding a length of solder in his mouth so both his hands could be free... In the days before lead free solder...

<comment><USER40> Found the video: [https://www.youtube.com/watch?v=pJif4i9NRdI](https://www.youtube.com/watch?v=pJif4i9NRdI)

See him solder @ 3:08.

</comment></comment></comment><comment><USER41> Good analysis. That said, this is one of those things where, yeah, if I soldered more than a few times a year, I'd probably worry about it. As it is, cumulatively speaking I probably breathe in more hazardous crap when I'm driving than when I'm soldering with a fan blowing the smoke away from my face.

<comment><USER42> Leaded solder just way easier to work with, unfortunately. I agree. I'll stick with it because some simple precautions make just about every "danger" involved moot.

<comment><USER28> WASH YOUR HANDS. It's the most important thing to do! Both lead and coronavirus hate it!

<comment><USER43> This and don't eat, drink or smoke in the lab. I remember my material sciences professor relating the story that blood lead levels for a certain group of pieceworkers dropped considerably when they banned smoking at the workplace.

</comment></comment></comment></comment><comment><USER44> MSDS data sheets are only intended to list the hazards associated with a particular material for an employee of a company using that material. You can't really use them to determine the relative risks of two materials. Often times a MSDS is simply wrong and no one cares enough to get it corrected. A second MSDS issued by the same manufacturer for the same material can be different than the first.

<comment><USER45> Minor point of order: They're now SDS, not MSDS. Knowing such things is a well-known hazard of being married to an environmental engineer.

<comment><USER46> since when? i was about to be a pedant and add the M...

<comment><USER45> Wikipedia says mid-2015: [https://en.wikipedia.org/wiki/Safety_data_sheet#United_State...](https://en.wikipedia.org/wiki/Safety_data_sheet#United_States)

In practice, a lot of smaller companies are still distributing MSDS rather than SDS.

</comment></comment></comment></comment><comment><USER47> Question: if you have some solder around and don't know if it's leaded... and you don't have enough practice to be able to tell the difference from the way it flows... is there an easy way to tell?

<comment><USER48> By mass is probably the easiest way - if you also have some that is known lead-free and it's 'significantly' lighter (per equal volume), the other's probably leaded. If it's close, you could probably work it out by pouring over Wikipedia and making assumptions like 'if it's leaded, it will be at minimum 30% lead'... but at that point the 'easy way to tell' is probably to replace it with known solder (assuming the goal was not to use leaded solder inadvertently).

</comment></comment><comment><USER49> This is from the perspective of a hobbyist who does _not_ do industrial quantities of soldering, but rather the occasional build or the occasional repair of a piece of old test equipment.

I use eutectic 63/37 Kester solder in several sizes for everything. With my temp controlled Weller station, it's the bee's knees for making quality joints quickly.

As far as worrying about safety, it's really down to common sense. In long time scales, the survival rate for everyone drops to zero. If you apply common sense, you can have fun while you're around and not have problems from lead solder.

Here's my "hot takes":

1) There's a reason why food and drink isn't allowed in professional labs of various kinds. Follow their example. Don't use your kitchen table as a workbench. Don't eat and drink in your work area. Don't lick solder. etc. etc.

If your living arrangement is so small that you can't separate them adequately, seek out a local hacker space or a friend who does have space.

2) Wash your hands thoroughly after soldering (and if you are doing projects with your kids, instill in them the instinct to wash their hands, too!) If I'm finding myself doing a lot of soldering/desoldering for a repair, I take frequent breaks and wash then, too. It also helps reduce mistakes.

3) At a minimum, use a desk fan to blow fumes away from your face. Better yet, invest in a fume extractor unit. I'd say the latter it's a necessity if you do a lot of soldering.

The bottom line is, choose what you prefer and what you are willing to risk using, and take appropriate precautions. Chances are, even if you eliminate lead solder from your hobby work, there's likely something equally as hazardous in your local environment that you are more systemically exposed to. Radon gas, naturally occurring drinking water contaminants (or sometimes unnaturally...), etc.

<comment><USER50> Externalities matter. Eventually that stuff is going to be handled by other people, in a year or ten or a hundred. The risk is not just to you, and is not just based on your own safety procedures.

Please stop advocating for people to use leaded solder at hackerspaces, which are generally frequented by children.

<comment><USER49> Scale matters too. As I clearly stated, I am not making electronics at industrial scales, nor am I generating large quantities of e-waste.

As for hacker spaces, why on earth would anyone in their right mind assume that it would be ok to not wash hands, eat, drink, etc in that environment _and_ let their kids work there without the same precautions, leaded solder or no?

<comment><USER50> Regardless of how you feel on the matter, I have never been to a hackerspace where people were not eating and drinking inside.

</comment></comment></comment></comment><comment><USER51> My dad used to solder a lot as a kid and I always loved the smell of it. My dads advice to me was "you probably shouldnt do that. It will slowly poison you." I dont know that it really stopped me though.. He also (still) has a mason jar full of mercury that he let my brother and I play with...

</comment><comment><USER52> as aside, took me a while ( a while ago when the internet was a much smaller place) to work out the american pronunciation of solder actually meant "solder" which is said "soul der" around these parts.

</comment><comment><USER53> It's better for you if you aren't breathing the rosin smoke which comes out in greater quantities at the higher temperature you have to use. Since there are an awful lot of people breathing rosin smoke maybe there's still a place for lead solder. (Pragmatically, vents are not very common, and few people will buy a vent when switching to lead free.) Rosin smoke is a serious danger and the number one cause of occupational asthma.

<comment><USER54> > people breathing rosin smoke maybe there's still a place for lead solder

This statement is what the author is trying to shoot down. "Thoughts that sounds safe" when in reality they aren't and hurt people along the way.

There are times when pragmatism isn't the way to go. Pragmatically, leaded gasoline was everywhere, it's too difficult to change. Pragmatically, emissions are so expensive to deal with, we shouldn't.

If you are exposed to rosin smoke, you need good ventilation, not switch to leaded solder which is what you're implying here because when you switch to solder you've got a whole host of other problems to deal with that are way worse.

For those do this regularly to gain asthma, OSHA (or equal) needs to step in.

Articles like these and activists push us towards better legislation when pragmatism does not.

<comment><USER53> > _If you are exposed to rosin smoke, you need good ventilation, not switch to > leaded solder which is what you 're implying here_

That's not what I'm trying to imply. I'm saying that you should buy a vent before you switch to lead-free because even though you need a vent or a mask for any kind of solder, your need increases when you switch. If you switch and don't buy a vent your total health might actually go down.

</comment></comment></comment><comment><USER55> Lead free solder is better for your health, that's clear. It requires new tools (solder iron) as lead free solder has a higher melting point than lead free.

In Europe lead free solder is the standard since many (10+) years, you can't get leaded solder as an option to buy.

<comment><USER56> That's nonsense, it is still very easy to get leaded solder in Europe.

<comment><USER57> Not in Sweden that's for sure. It took me a long search to find some a while back when I needed it

<comment><USER58> Wow, I was going to post some trivial links to common national shops that were full of the stuff last time I looked, but ... nothing.

It seems to be due to a EU regulation that became active March 1 2018 here in Sweden, it's no longer legal to sell metal alloys containing more than 0.3% (!) lead to individuals [1].

I had no idea, thanks!

[1]: [https://www.kemi.se/lagar-och-regler/reach- forordningen/begr...](https://www.kemi.se/lagar-och-regler/reach- forordningen/begransning/forbjudet-att-salja-lodtenn-med-bly-till- privatpersoner)

</comment></comment></comment></comment><comment><USER4> Why isn't there alternative to soldering? Laser for fusing component leads to PCB?

<comment><USER59> For mass production, most work is done with automated methods like wave soldering which spot methods like soldering irons (or lasers) can't hope to match for throughput or repeatability. The kind of hand work that's being discussed here is almost non-representative of most industry practice.

</comment></comment><comment><USER60> If Lead is terrible, thanks to getting it out of petrol, why are we still selling lead solders which will easily poison you? I have done some soldering with zero education on how to properly do it or the safety implications. I've most likely poisoned myself.

Can we not ban lead for non-certified use? Like I don't see home depot selling liquid nitrogen wily nily. Same with oxygen tanks. Isn't playing with Lead in the same ballpark?

<comment> kube-system The simple reason for the difference is that poisons are only dangerous if they end up somewhere they shouldn't be. When we put lead in gasoline, it was going everywhere in the environment, including the air. Lead which is in a large enough chunk that it doesn't spontaneously become airborne is much less likely to end up inside of a human.

Brass also contains lead, which you almost certainly have inside of your house in a few places. Even 'lead-free' brass for plumbing contains some lead. [https://en.wikipedia.org/wiki/Brass#Lead_content](https://en.wikipedia.org/wiki/Brass#Lead_content) The key is that it has to be in low enough concentrations that it doesn't end up leaving the part and ending up in dangerous amounts inside of humans.

Unless you have occupational exposure, you have most likely not even come close to poisoning yourself even if you didn't follow any safety precautions. Lead is pretty bad, but it's not something that causes issues with any amount of exposure... you body _can_ tolerate some lead exposure. A hobbyist that solders a dozen PCBs per year has a way different potential exposure than someone who solders a dozen per hour for 2000 hours per year.

> Like I don't see home depot selling liquid nitrogen wily nily. Same with > oxygen tanks.

[https://www.homedepot.com/p/Bernzomatic-1-4-oz-Oxygen-Gas- Cy...](https://www.homedepot.com/p/Bernzomatic-1-4-oz-Oxygen-Gas- Cylinder-304179/202044702)

</comment></comment><comment><USER61> Since lead is a stabilizing agent for tin whiskers has that been dealt with yet by solder manufacturers or have we just decided that early failure is acceptable?

</comment><comment><USER62> The article makes it seem like lead-free solder is indisputably healthier, but in reality the conclusion seems to be based off of just the MSDS of the products. I presume these are generated simply based on the chemical composition of the solder, but do not take into account the actual exposure that really occurs when one is soldering.

</comment><comment><USER63> Curious, what is your preferred method of dispensing the right amount of solderpaste for SMT work? I find the manual syringe technique quite difficult but perhaps I should consider a smaller tip size. I've seen people using compressed air based approaches, but these seem expensive and take a lot of desk space.

<comment><USER28> First choice: stencil. Stainless steel stencils are cheap these days and fantastic. No good for rework, though.

Second choice: manual syringe. As you've noticed, it's difficult. Some pastes are thixotropic, so shaking the tube before dispensing can help a little. Or maybe that's just my imagination.

Third choice: stick a stainless steel pick or even just a toothpick into a little pile of paste and dispense it by hand. This is surprisingly useful for those really fine-pitch pads... but it's tedious.

</comment></comment><comment><USER64> > "the same fumes"

But, they're not the same. I had to dig around a bit to verify, but melting lead creates lead fumes: [https://www.cdc.gov/niosh/topics/lead/exposure.html](https://www.cdc.gov/niosh/topics/lead/exposure.html)

You do not have to bring lead to boiling create lead fumes (aka vapor).

Here's the OSHA documentation on lead: [https://www.osha.gov/chemicaldata/chemResult.html?recNo=500](https://www.osha.gov/chemicaldata/chemResult.html?recNo=500)

They have specifications for testing lead (and other metal) content in the air from soldering operations: [https://www.osha.gov/dts/sltc/methods/inorganic/id206/id206....](https://www.osha.gov/dts/sltc/methods/inorganic/id206/id206.pdf)

</comment><comment><USER65> There are people who have been using lead solder for years who swear by it and refuse to use lead-free because it produces crappy joints. I tend to be on their side. What you need is proper filtering for air and you'll be fine.

<comment><USER66> Hey, let them have it if they want it so badly. But they should not convince younger ones that it's not a danger though!!!

</comment></comment><comment><USER67> I once read that getting rid of lead in gas made some seemingly unrelated illnesses go away over the decades.

Let's see how our lifes get better when we remove combustion engines entirely from our cities.

<comment><USER68> Not just illness. Elimination of lead is a prime suspect for the decrease of violent crime over the last 40 or so years.

</comment></comment><comment><USER69> I think Lead Solder is Ban in Europe since 2003 or around.

I remember the change, where I was not able to buy the old one. I remember that it had a slightly higher melt temperature.

Can you buy it in America?

<comment><USER25> It's not banned, it's restricted. There are still applications where it's allowed in manufacture, even in the EU.

Prototyping/R&D is excepted as well.

</comment></comment><comment><USER70> While the solders on through hole stuff come out messier, I find the goopyness of lead free solder to be superior for point to point connections.

</comment><comment><USER71> I agree that lead is unsafe. However, I'd like to point out that this new solder just doesn't flow.

<comment><USER35> Maybe your iron needs some inspection — older and less powerful irons don't manage to prevent temperature dips as effectively as new ones where the temperature sensing is integrated in the tip.

I solder lead free mostly for over a decade now and getting a good modern soldering station was hands down the best thing ever for lead free

<comment><USER71> I have a Weller WT2M. I believe that should be sufficient? Perhaps I'll review my technique.

</comment></comment></comment><comment> mark-r I still have a tiny bit of the spool of lead solder I bought in the 1980's.

</comment><comment><USER72> SN100C is finally a thing but it's really hard to give up 63/37

</comment><comment><USER73> i dont know... ive been eating a roll a week and let me tell you, i can definitely taste a difference in the lead-free solder.

</comment><comment><USER74> Okay, so this link loads up to a blank page. You have to edit the CSS and remove the "opacity: 0" to see the content. Presumably there's some Javascript in there that does this after the page has loaded.

So, talking about a hill to die on - can we please stop doing this? There was absolutely nothing else in that web page that required Javascript to be able to view the content. It was completely unnecessary to pull a trick like that.

<comment><USER75> Confirmed. You'll have to temporarily allow javascript for that. What for? Just some text. Come on, people.

</comment></comment><comment><USER76> Don't really care. Leaded solder is much easier to work with.

<comment><USER77> Wash your hands and lead is fine for hobbyists and far more people enjoyable to work with. The problem that ROHS solves is landfills full of manufactured goods not full of lead.

<comment><USER78> That's what I always figured. I do so little soldering that I doubt it wouldn't make any difference for my health. And lead based solder saves a lot of time and frustration.

</comment></comment></comment><comment><USER79> Whenever someone has difficulty soldering, and I find out they are using unleaded solder, I always give the same advice:

USE LEADED SOLDER

USE LEADED SOLDER

USE LEADED SOLDER

Lead-free solder is a disaster. Stay away from it.

<comment><USER80> This is seriously old school advice from someone who clearly hasn't done research or used modern solders. There are quite a few very good lead free alloys that are basically as good as any leaded alloy.

I use Kester K100LD and it is absolutely fantastic. Unless you really know your stuff you can't tell a difference.

Please stop giving outdated advice like this.

<comment><USER79> > There are quite a few very good lead free alloys that are basically as good > as any leaded alloy.

You know what is 100% as good as leaded solder? Actual leaded solder!

You remember that giant class-action against the Heathkit company for all the people they poisoned with leaded solder? Don't remember it? That's because it never happened!

If your soldering consists of soldering pins onto Arduino nano boards, or whipping up a prototype or two with your JLCPCB boards, you'll be fine with leaded solder.

<comment><USER80> If all you're soldering is some pins on an Arduino nano or some simple jlc prototypes then you'll also be totally fine with lead free solder. The only time I've seen a reasonable excuse to use leaded solder at home is when working with very temperature sensitive devices such as connectors with plastic in them. Even then leaded isn't /that/ much better.

</comment></comment></comment></comment><comment><USER81> I'm a little surprised someone with as solid a reputation as Ben Hencke wrote all that and didn't bother to dedicate a single solitary sentence to supporting the claim that leaded solder represents an actual threat to its user. Here I was, getting ready to point out flaws in his sources but not only doesn't he have sources he doesn't even have claims. The whole article is him disproving the myth that lead-free solder is more dangerous than leaded, which, granted, is a good point but he forgot to back up his thesis at all.

Leaded solder is not even slightly dangerous to its user unless you make a daily habit of soldering for hours and then eating without washing your hands. Leaded solder does represent an environmental threat. Fortunately most manufacturers have switched to lead-free solder and the amount of lead put into the environment by hobbyist solder is best described as "fucking infinitesimal".

<comment><USER82> Maybe you're so used to the safety warnings that you always skip them when you encounter them? Here, extracted just for you:

> Compare that to the leaded version with the same rosin formulation. This > also creates fumes that are not great to breathe (the same fumes), plus a > bunch of really bad stuff because of the lead:

> [Long list of bad stuff]

> I think most of this speaks for itself, but I'd like to point out a subtle > upgrade from P261 to P260 for the leaded stuff. It goes from "avoid" to > "don't" and I think this this is worth calling out specifically. Remember > leaded paint? The stuff we banned in '78? The primary cause of lead- > poisoning isn't eating paint chips, it is breathing lead laced paint dust. > [https://www.mayoclinic.org/diseases-conditions/lead- > poisonin...](https://www.mayoclinic.org/diseases-conditions/lead- > poisoning/symptoms-causes/syc-20354717)

> "But solder dust? 'Cmon, really? How can that even be?" I can hear someone > typing already… Have you seen one of these?

> [Picture of solder tip cleaner]

<comment><USER81> Putting aside the need of a citation or at least an explanation as to how tip cleaners create lead dust, that's a reason to use sponges with leaded solder, not a reason not to use lead solder at all.

<comment><USER82> With pathogens, my standards go the other way: I prefer proof they're not spread before using them. It is very reasonable to assume that grating metals against each other will create dust. That's what happens in a tip cleaner.

And as for the sponges, I can see very small balls of solder on them. And I would call balls smaller than I can see "dust". Should I just assume that there is a lower bound to their size? That they're not there because I can't see them?

</comment></comment></comment></comment><comment><USER83> There are a lot of different products in use which will cause health problems, if you don't take care (something that we should all have been taught). There have been some good suggestions in relation to the environmental situation to mitigate contamination.

I will add another suggestion to all of these as well. If you work with various heavy metals, you might want to consider adding beetroot to your diet on a daily basis. My father was a printer using lead type for many years. It got to the point that his health was being affected by lead poisoning. His GP told him to start eating beetroot every day. The reasoning was to stimulate the liver. Interestingly enough, his health improved and the quantity of lead in his system decreased till he was basically free of it after six months. A few years later, the printing works he was at dispensed with lead usage completely, but my father has continued to eat beetroot on a regular basis (not every day, but certainly a couple of time a week).

Now of course this is anecdotal and you can take it or leave it. But it can't hurt and for those who have a need, it may help. Of course, the beetroot mentioned is what we call beetroot in Australia, it may have some other name in other places in the world.

<comment><USER68> A fitting username if there ever was...

Seeing the replies in this thread, I'm wondering if the narrative that only incompetent people need leaded solder might not be quite powerful in convincing people. More so than any warnings about health risks.

<comment><USER16> Convincing people of what?

I openly acknowledge that I'm incompetent at soldering. Are you encouraging me to use leaded solder?

<comment><USER83> Not at all. Simply that if you have had some previous contamination, this might help clear up the problem. I said it was anecdotal but as it worked for my father, it might work for you. Why would I want to convince anyone to follow this regime? It is there for you to make a judgement call and do your own research into the matter. If it helps just one other person then it was useful. If you are not at all interested then don't investigate. That is entirely up to you.

I actually find it funny that when any kind of suggestion is made that might (notice the use of the word "might") help with some pre-existing condition, people make the immediate assumption that the person making the suggestion is then advocating to continue the activity that caused the pre-existing condition. In today's atmosphere, it almost appears that people have stopped trying to think for themselves. All I can suggest it that people stop jumping to conclusions and if something is unclear then ask some questions. Sure, there are people who are "trolls" (so to speak). But there are also many who are not.

Just yesterday, I came across a youtube comment that, in the context it was written it was meant to be sarcastic, was treated as if the the person making the comment was supporting what they were not. Essentially, there were only two of us who recognised the sarcasm, the other participants essentially treated the person as if they were an idiot. Go figure.

As far as soldering with non-lead based solder is concerned, it has been a good source for my son-in-law's repair business. The most common source of problems he has found has been the solder joints failing because of non-lead solder. He has also received quite a bit of equipment that was essentially being thrown out because of some unknown failure, which he often found boiled down again to faulty solder joints due to non-lead solder.

Is this an advocation for using lead solder? No. It is simply recognising that the processes for using non-lead solder will be a bit different. There are always consequences for changing to using different materials if the former are found to have health problems. However, I have seen that people don't always take that a change in processes is also required and so we get other problems arising.

At any rate, during this time of isolation, everyone keep safe and take the necessary precautions for the health of you and your loved ones.

<comment><USER16> Whoa, you _totally_ misread my post.

I was not asking you that question. I was not reacting to your suggestion in the slightest. I was responding just to KarlKemp's mention of convincing people about leaded solder.

<comment><USER83> Sorry that came out in not the way intended. I was simply using your post as a starting point for my comment to be to a more general audience. Your comment was nicely put and opened up the discussion for others as well. Your question was, from my perspective, a good pointed question which needed, in the general sense, to be asked.</comment></comment></comment></comment></comment></comment>


AWS now uses more bandwidth than Amazon.com - <AUTHOR> http://www.techcrunch.com/2008/01/30/amazon-earnings-call-details-web-services-use-up-more-bandwidth-than-amazoncom-the-kindle-is-a-hit/

<comment><USER2> We are extremely satisfied with EC2/S3 for our startup. The service has saved us a great deal of time we would otherwise have had to spend on the hardware side.

<comment><USER3> The great thing about the success of EC2/S3 is there are a large number of competitors coming out with similar services.

Should help to push prices down, I would stick with zon's because they have been so reliable.

</comment></comment><comment><USER4> At first it seemed like S3/EC2 was a way for Amazon to use their _spare_ capacity and CPU cycles by renting overhead out. But now, that supposed sliver is a slice > 50%? That's impressive.

</comment><comment><USER5> wow this is very surprising and impressive.

Does anyone have a list of the biggest AWS users?

</comment><comment><USER6> Now, if they would just bring SimpleDB out of closed beta so others can use it...

</comment><comment><USER7> What's interesting is that this happened during the holiday shopping season in the 4th Quarter, which is Amazon's busiest time for its own Web sites.

<comment><USER8> Probably also the busiest time for their clients too.

Long live S3.</comment></comment>


Soli in Google Pixel 4 operates at 60 GHz, not approved for launch in India - <AUTHOR> https://www.androidcentral.com/why-google-not-launching-pixel-4-4-xl-india <comment><USER2> Let's be real here. In a developing country like India, 99% of phone buyers will be getting third-party budget Android phones that's in their expected price range.

Very few people are buying flagship phones as expensive as the Pixel in the $600+ tier.</comment>


Shipments of PC Hard Drives Predicted to Drop by Nearly 50% in 2019 - <AUTHOR> https://www.anandtech.com/show/14298/shipments-of-pc-hdds-predicted-to-halve-in-2019 <comment><USER2> For clarity, this is talking about hard drives as distinct from solid state drives.

</comment><comment><USER3> Interesting, but I'd like to see more analysis of exactly why fewer hard drives would be shipping.

<comment><USER4> The article seems to make that clear. SSDs are falling in price, they offer superior performance and more and more PC sellers will be including them due to the lower prices.</comment></comment>


The Current State of Spycraft - <AUTHOR> http://online.wsj.com/article/SB10001424052748704479404575087621440351704.html?mod=WSJ_LifeStyle_LeadStoryNA

<comment><USER2> To me it seems that it's sort of a confirmation of subtext from the book "The Secret History of the Mossad".

The thesis is that the Mossad is being seriously damaged by involvement of politics. Mossad requires time to do things properly (getting the job done, covering the trails, not leaving a trail to either operatives, Israel or Mossad itself), but politicians, especially Benjamin Netanjahu required (in 90's) that Mossad perform more operations faster, or so to say "on demand" whenever he needed a PR boost. Thus leading to a couple of spectacular failures that left Mossad operatives demoralized and even got them to start talking publicly about the ways of Mossad.

Fast forward 10 years. Bibi is in charge again and Mossad blew it again. Hmm???

If this is Mossad this is a terrible failure - revealing identity of 25 agents is horrible price to pay. Just imagine what kind of tow this will be on morale of other operatives. Mossad operatives work(ed) so good because they know that the organization will take care of them, that they will be protected and that they are being appreciated (in hacker terms think MS, Google,...).

Kinda reminds me of how in IT when PHB type MBA's come around "demanding results NOW!!!11one!", engineers loose morale, start leaving and everything goes down the drain.

Edit: [http://www.thejerusalemfund.org/ht/d/ContentDetails/i/9279/p...](http://www.thejerusalemfund.org/ht/d/ContentDetails/i/9279/pid/897) \- describing the previous Netanyahues debacles.

<comment><USER3> _Just imagine what kind of tow this will be on morale of other operatives._

Inquiries for employment on the Mossad website have reached levels never before seen. Lots of young Israeli people evidently think that now is a great time to become a Mossad operative.

<comment><USER2> I believe that there are quite some parallels between world of "spycraft" and high technology.

I believe that personality traits and skill set for a successful spy are very similar to those of a top-notch hacker.

Both require an excellent all rounder with a creative spirit and strong sense for duty and loyalty. These are the kind of people, that can be relied upon to carry out their job without micromanagement.

People like that are few and far in between. And more significantly, when you start to displace them with mass produced "drones", they are the first who get the cue and they start leaving (Elves have left middle earth).

So for a final parallel - there have never been more people sought after in high-tech and the good ones have never been treated with more disrespect. Incidentally there has never been a bigger supply of crappy code/tech than today.

The difference is that business world can take such failures more easily - companies turn over and that's it.

In world of Intelligence - like the assassination attempt on Khaled Mashal - this is a failure of such magnitude that it will cost waaaay more than what was gained. Both in money and in credibility and prestige.

</comment></comment></comment><comment><USER4> It seems so very implausible to me that one of the most experienced and most revered intelligence agencies in the world would fail to recognize _security cameras_ as a viable threat to their operation. Seriously?

What seems more likely to me is that they were sending a very clear message: even with one of the most advanced surveillance and counter-intelligence networks in the world, we can still put two dozens operatives on the ground, run a complex mission with military precision, kill the target, and disappear before you know it's happened. There's nowhere you can hide from us.

<comment><USER5> Why would they jeopardize the identities of so many of their agents? Would they have bothered with disguises at all if it was intentional to be "caught"?

I don't believe an intelligence agency like that would be dumb enough to be so brazenly open. They didn't want to get caught, but they did.

I think they simply doubted the diligence on the part of the investigators. If you watched the video, you'd know how hard it would have been to put all the pieces together.

</comment></comment><comment><USER6> A great read, but... Most people says Israel did it even though nobody has a proof of the case. Israel is the usual suspect in any death of a Palestinian terrorist, and so far there has been little more than the usual suspicious. A couple of Palestinians were arrested, that seems to be it.

The author says the lesson to whomever killed that guy is that nowadays you cannot get away with it. My question is -- who exactly did not get away with it this time?

<comment><USER7> Oh, let's cut the fud.

[http://www.washingtonpost.com/wp- dyn/content/article/2010/02...](http://www.washingtonpost.com/wp- dyn/content/article/2010/02/23/AR2010022302237.html)

From Associated Press (link is to Washington Post):

      "Israel's parliamentary opposition leader on Tuesday praised the assassination of a Hamas commander in Dubai last month"

Let's think about it. This definetly caused a diplomatic blow to Israel. If they indeed didn't do it, they would have revved up their propaganda machine to the maximum denying everything. They are not, they are praising it. At this point arguing if Israel did or not is a little silly I think.

<comment><USER6> "If they indeed didn't do it, they would have revved up their propaganda machine to the maximum denying everything." This is a good argument, but I am not sure how strong it is. I can easily imagine them not doing that.

</comment></comment></comment><comment><USER8> I think that the author's point in claiming that such killings are technologically implausible is kind of shaky. Better disguises and more intelligent communication channels (select a hotspot in the city at random every time you need to send a message, encrypt the data, and bounce it around the globe for good measure. Hell, you could even use a bot net to do it so the neutral parties were oblivious).

Or you can call it part of the war on terror and blow the individual up with a remote controlled airplane.

<comment><USER9> Agreed (first part). There's certainly plenty of tech out there that would have made this more anonymous - these guys just didn't use it.

</comment></comment><comment><USER10> It should glad me that everyone seems to discuss this with objective detachment. However, I am shocked that no one cared to touch the moral core of the matter : assassination of civil or political leaders is a crime.

Can you remember the outrage when Rabin was assassinated ? Can you imagine the outrage if Palestine assassinated an Israeli statesman ? What the Mossad did is no different.

<comment><USER3> _assassination of civil or political leaders is a crime_

Taking your wording as my guide to the morality of the situation, I'll note that the Hamas person who was assassinated was not an elected political leader, but rather a gun runner and apparent assassin himself. He wasn't traveling under his real name in Dubai, it appears, nor was he traveling with a diplomatic or official (that is, government official's) passport.

<comment><USER7> Alright, here is a better 'morality guide':

       Assassinating someone is a crime.

</comment></comment></comment><comment><USER11> Robert Baer, the author of the article, is a good (and very qualified) writer on intelligence issues. His book about his experiences in the CIA, See No Evil, is one of my favorites: [http://www.amazon.com/See-No-Evil-Soldier- Terrorism/dp/14000...](http://www.amazon.com/See-No-Evil-Soldier- Terrorism/dp/140004684X/rawbjams-20)

</comment><comment><USER12> Interesting article, it also beings up the question(in my mind) how operatives can operate in a hostile environment(not necessarily hostile, just one in which they don't want to be caught).

How could US (or British for that matter) HUMINT operate in places such as PR- China (which is beginning to operate such pervasive surveillance systems) without leaving a trail. How can you be a real/digital ghost?

<comment><USER3> _How could US (or British for that matter) HUMINT operate in places such as PR-China_

By taking advantage of the pervasive corruption in China to bribe Chinese nationals ("agents") who are cross-checked for their ability to provide the U.S. or British citizens ("operatives") with information. That's how the C.I.A. has long gathered a lot of its human intelligence in a lot of countries. It doesn't always work, but neither do any other country's attempts to gather intelligence always work against the United States or Britain.

</comment></comment><comment><USER13> > ... an embarrassing blunder for Tel Aviv.

Tel Aviv is not the capital of Israel.

</comment><comment><USER14> I think the state-of-the-art is headed towards man-lethal, man-portable stealth UAVs, either using lasers or some sort of projectile weapon to assassinate targets. If you could have a much smaller team launch a small vehicle which would then pick off a target by flying silently hundreds of yards away at night? You could pick people off with a high degree of deniability.

Big teams deployed in an urban environment are just not practicable anymore.

<comment><USER15> Were it possible, a laser sniper rifle would be an intermediary step. Of course, in both these cases, deniability is difficult when you're the only one with the technology.

<comment><USER14> A sniper robot would be workable with off-the-shelf technology. You could hide it in plain sight by simply making it look like a city garbage can or a vending machine.

The problem with static, low-cost technology is ingress and egress: whatever the mission, the idea is that there are no pieces for anybody to find once it's over. Ideally the robot would move itself into position and get the heck out of dodge with a high degree of invisibility. That's why man-portable UAVs work so well. Heck, we're already using them for reconnaissance. (But you're right about the technology problems. Only a few countries could mount such an effort)</comment></comment></comment>


New Zealand Locks the Doors from the Inside - <AUTHOR> https://www.nytimes.com/2019/02/22/realestate/new-zealand-locks-the-doors-from-the-inside.html <comment><USER2> London (and to some extent, the broader UK) could do with a similar restriction - Private Eye has done several deep dives into just how much[1] of London/the country is owned by secretive / tax-haven'd corporations.

1\. "A lot". cf [https://www.globalwitness.org/en/blog/two-years-still- dark-a...](https://www.globalwitness.org/en/blog/two-years-still-dark- about-86000-anonymously-owned-uk-homes/), [https://whoownsengland.org/2017/11/14/the-companies- corporat...](https://whoownsengland.org/2017/11/14/the-companies-corporate- bodies-who-own-a-third-of-england-wales/), etc.etc.

</comment><comment><USER3> I recently read a book called Power, Inc.—published shortly after the Citizens United decision—that sheds some light on the historical forces at work here. Basically, the wealthiest private entities have become so powerful that they're able to bully and dominate all but a handful of nation-states. We're used to a straightforward, hierarchical taxonomy of power which places state actors at the top, followed by corporate actors and then individuals. That's no longer an accurate description of reality; there's a surprising amount of overlap between the supposed ranks.

With that in mind, I no longer view policies like the one adopted by NZ as inherently "nativist" or "xenophobic". Now I view them as defensive maneuvers being engaged by less powerful states against powerful private actors that operate on a global scale. That they're coming a decade or more later than they probably should have is not surprising, given that speed is not a strength of the state. I also can't help but laugh at the idea that these policies are motivated by racism.

Edit: I got the publisher of Power, Inc. mixed up with that of another book I read around the same time.</comment>


The best AI still flunks 8th grade science (2016) - <AUTHOR> https://www.wired.com/2016/02/the-best-ai-still-flunks-8th-grade-science/ <comment><USER2> The story dates back 3 years. It would be fascinating to see how AI has progressed in the interim.</comment>


Valve: Handbook for New Employees [pdf] - <AUTHOR> http://assets.sbnation.com/assets/1074301/Valve_Handbook_LowRes.pdf <comment><USER2> I've read this before. I wish I could work there, but I'm sure my resume and skills are not good enough.</comment>


I want to build a character generator for a pen and paper RPG game. Should I? - <AUTHOR>

One of my favorite pen & paper RPG games does not have online character generator. I want to build a basic one and then approach them with it as an opening for them and I to work together. If I did this and they were not open to the idea, the experience alone would be beneficial to me on a number of personal levels, from building the thing to the attempt(s) to start a business relationship in such an unconventional manner.<p>Could it work? Has there been any other projects started in a similar manner? <comment><USER2> Hell if we know.

Build the thing, scratch your itch, move on. You don't need our permission.</comment>


Zorp – Open source proxy firewall with deep protocol analysis - <AUTHOR> http://balasys.github.io/zorp/about/ <comment><USER2> Anyone running something like this in a home scenario?

I kinda thought about it but the 50-100 bucks expenditure just for curiosity seems a bit heavy

<comment><USER3> Zorp GPL is free/opensource, so unless you're looking for some of the closed source features in Zorp Professional you should be able to tinker pretty heavily.

</comment></comment><comment><USER4> First sentence mentions deep packet analysis for protocols like HTTP. But that's not really relevant anymore is it? Most modern websites will automatically redirect HTTP to HTTPS and then you can't apply deep packet analysis anymore. I can see some other fairly nice features here but not really enough to make me switch.

<comment><USER5> I guess it's terminating the HTTPS traffic and then proxying on to the respective server.

<comment><USER6> Yes, TLS offloading is there

[https://github.com/Balasys/zorp/blob/master/lib/proxyssl.cc](https://github.com/Balasys/zorp/blob/master/lib/proxyssl.cc) [https://github.com/Balasys/zorp/blob/master/lib/pyx509.cc](https://github.com/Balasys/zorp/blob/master/lib/pyx509.cc)

It's able to inspect and relay the connection as well as passing it to another proxy

[https://github.com/Balasys/zorp/blob/master/lib/proxystack.c...](https://github.com/Balasys/zorp/blob/master/lib/proxystack.cc)

</comment></comment></comment><comment><USER7> how is this different from squid proxy?

<comment><USER6> Squid is mainly a web caching proxy. Zorp is a next generation firewall.

The architecture is modular, and you can write plug-ins that analyse the structure of communications beyond packet headers: the content is inspected. The open source version includes out of the box support for inspecting HTTP, FTP, SMTP, POP3, Finger, Whois, Telnet (+TLS). But you can write plugins that couple the engine with anything, from an IDS such as Snort, Bro or Suricata, to something like nDPI or AssemblyLine.

[https://www.ntop.org/products/deep-packet- inspection/ndpi/](https://www.ntop.org/products/deep-packet-inspection/ndpi/) [https://bitbucket.org/cse- assemblyline/assemblyline](https://bitbucket.org/cse- assemblyline/assemblyline)

Based on the results of the analysis, you can choose to apply firewall rules.

<comment><USER7> squid also has redirectors and c-icap filters etc, firewall wise it uses the OS(e.g. iptables), so it's more than a proxy but it does not do packet-level- firewall as it depends on iptables.

looks like zorp is a all-in-one solution, hope i have time to play with it soon

</comment></comment></comment><comment><USER8> So why not sample via netfilter and EBPF to filter?

</comment><comment><USER9> In short: It's censorship software.

<comment><USER10> If I agree with you: Yep it sure is, and that's perfectly ethical for personal and corporate use. To businesses, they have a responsibility to filter what goes in and out of their network, in the interest of their customers and themselves.

If I don't agree with you: Do you think IP/port based firewalls are censorship? That any kind of cyber-border security is an affront to rights? If not, then how do you govern access as a private organization when everything is tcp/443 on AWS? Gotta know what it's going to.</comment></comment>


"Anonymized" data really isn't—and here's why not - <AUTHOR> http://arstechnica.com/tech-policy/news/2009/09/your-secrets-live-online-in-databases-of-ruin.ars

<comment><USER2> Hey all,

I'm one of the authors of the Netflix and social network de-anonymization papers referenced, and the author of <http://33bits.org>. I also had the pleasure of having many talks with law professor Paul Ohm over the technical aspects of his excellent paper (which another commenter has posted a link to.)

Paul's paper is a great example of people in the law community "getting it." (He happens to have a CS degree and is a hobbyist perl hacker!) We need more people like Paul, and we equally also need tech people who understand law and policy. I encourage everyone to give Paul's paper a quick read, gain awareness of the issues such why the current privacy laws are wrongheaded and what needs to be changed, and be on the look-out for ways to change things (as consumers, as tech influencers, as citizens). Cheers.

<comment><USER3> _"Impatient readers can skip to the bullet-point summary at the end."_

Have you heard of jump links? ;0)>

</comment></comment><comment><USER4> Folks interested in this subject should read this very fascinating blog:

<http://33bits.org/>

(The title comes from the factoid that 33 bits of information is enough to uniquely address any living person. After reading through a few practical examples I'm convinced: anonymity is an illusion.)

<comment><USER5> Fortunately, we can fall back on pseudonymity to some extent, as well as lying.

A close friend of mine, throughout over 5 years of college, shared one grocery store "club" card with all roommates and acquaintances, eventually totaling a couple dozen users.

The disincentives by the store to doing this, usually in the form of a bonus paid to the instant user at some predetermined spending level, were ineffective, since the group was one who would gladly pay $1 for a lottery ticket, and this was a bargain by comparison.

Personally, I routinely give bogus ZIP codes for any situation other than where I wish to receive mail.

<comment><USER6> The big grocery chain around here recently introduced a new program where shoppers get $0.10 off a gallon of gas for every $50 they spend in the store, tracked of course through their "Advantage" card. You show the card at participating stations, and they take the discount off there.

The actual savings are nominal: spend $150, fill up w/ 20 gallons (the limit), and save what, $6.00? That's only 4%!

But wow, people have become _much_ more serious about using _their own_ cards. Participation must be near 100%.

</comment></comment></comment><comment><USER7> Anonymization is in essence a cryptography problem, so any anonymization scheme should by default be considered insecure without extraordinary evidence to the contrary.

</comment><comment><USER8> When AOL released their 'anonimzed data set' I happened to be in a datacenter that had some pretty good bandwidth so I grabbed a copy before it was pulled it, even now, several years later it is amazing what you can mine in terms of data that is relevant today.

<comment><USER9> You can still find it around the interwebs, in torrent sites etc... I'm just not sure about the legality of using it for practical or academic purposes.

</comment></comment><comment><USER5> Here's the Paul Ohm paper referenced therein: [http://papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID1450006_code...](http://papers.ssrn.com/sol3/Delivery.cfm/SSRN_ID1450006_code487663.pdf?abstractid=1450006&mirid=5)

<comment><USER10> Ohm's blog on "Freedom to Tinker".

<http://www.freedom-to-tinker.com/blog/paul>

I couldn't get SSRN to cooperate; the download buttons just kept returning me to the abstract. BTW, Ohm himself admits SSRN has problems, in the comments of the post where he announces the paper.

[http://www.freedom-to-tinker.com/blog/paul/anonymization- fai...](http://www.freedom-to-tinker.com/blog/paul/anonymization-fail-privacy- law-fail)

</comment></comment><comment><USER11> I guess this is analogous to a Heisenberg principle for computer science. You either have information on a person which increases the likelihood of identification, or you can have no information at all.

</comment><comment><USER12> It's the classic tautology: if more than one person knows something, it's not a secret.</comment>


Cheat Sheets and Reference Guides for Web Professionals - <AUTHOR> http://www.webdesignerdepot.com/2009/07/30-handy-cheat-sheets-and-reference-guides-for-web-professionals/

<comment><USER2> The SEO and Usability checklists are in direct conflict, unsurprisingly.

I see very little value in this post. A certain quantity, but _very_ little quality.

Don't vote up trash like this.</comment>


No new nuclear units will be built in US due to high cost: Exelon official - <AUTHOR> https://www.spglobal.com/platts/en/market-insights/latest-news/electric-power/041218-no-new-nuclear-units-will-be-built-in-us-due-to-high-cost-exelon-official <comment><USER2> We've got to lose the steam turbine and switch to an indirect Brayton cycle if there is any chance nuclear will be competitive with natural gas.

The bad economics of the nuclear steam turbine was what drove giantism, and in turn, non-constructability. Back then the competition was the better steam conditions in coal-fired plants, but now gas turbine power plants make coal burners unaffordable.

</comment><comment><AUTHOR> If the existing nuclear units in the US can be kept operational despite the economic challenges they face, and technology can be developed to store energy generated by renewable technologies, which are currently intermittently available, "then we won't need these [new nuclear units] at that point," Von Hoene said. "And we won't build them because they'll be too expensive." ... Von Hoene's stance includes so-called small modular reactors, or SMRs, and advanced designs, he said.

"Right now, the costs on the SMRs, in part because of the size and in part because of the security that's associated with any nuclear plant, are prohibitive," Von Hoene said.

"It's possible that that would evolve over time, and we're involved in looking at that technology," Von Hoene said. "Right now they're prohibitively expensive."

</comment><comment><USER3> Insurance, NRC and NIMBY's are the biggest obstacles.

Lower pressure, molten-salt, smaller reactors like DMSR/MSRE @ ORNL and Taylor Wilson proposed with smaller, mass-manufactured reactors with scram/reprocessing pools beneath them would be superior to complex, one-of, inherently riskier, high-pressure *WR.

Disclaimer: I used to work in the nuclear industry in the US until it dried up. Our computer hostnames were based on The Simpsons' characters.

</comment><comment><USER4> Hallelujah

<comment><USER4> I've noticed that any anti-nuclear comments on HN get downvoted. Hmmm... For my pro-nuke friends, I highly recommend "Nuclear Power is Not the Answer" by Helen Caldicott. If anyone can find fault with her research, I'd like to know about it.

[https://www.amazon.com/Nuclear-Power-Answer-Helen- Caldicott/...](https://www.amazon.com/Nuclear-Power-Answer-Helen- Caldicott/dp/1595582134)</comment></comment>


New plan to remove trillion tons of carbon dioxide from the atmosphere: Bury it - <AUTHOR> https://beta.washingtonpost.com/business/2019/06/12/new-plan-remove-trillion-tons-carbon-dioxide-atmosphere-bury-it/ <comment><USER2> Some parts of antarctica get very close the freezing point of CO2 in the winter. It might not take too much energy (wind?) to encourage the atmospheric CO2 to freeze and then bury that deep in the ice sheet where the pressure would keep it solid.

</comment><comment><USER3> And WHERE do you PUT a trillion tons of stuff? It doesn't just 'magically disappear'.

Pie in the Sky thinking.

<comment><USER4> As the article explains, it's sequestered in soil through practices like no- till.

<comment><USER3> A trillion tons of _anything_ has a LOT of volume. Even assuming that we could somehow convert/compress a trillion tons of CO2 to 10 times the density of water (that is denser than solid iron would be) it would still take up 100,000,000,000 cubic metres = 100 cubic kilometres = 24 cubic miles = quite a sizable mountain</comment></comment></comment>


Designing an Authentication System: A Dialogue in Four Scenes (1988) - <AUTHOR> https://web.mit.edu/kerberos/dialogue.html <comment><USER2> Kerberos is an underrated and underused authorization protocol.

(Last time I used it) V5 was reasonably safe to use on the open Internet. It integrates well with MacOS, Linux, BSD and other Unix auth systems and also with SSH.

I never really understood why we don't see more of it in "Cloud" models, especially given how decoupled a Kerberos Principal is from the underlying Unix UID.

Rather than using SSH keys everywhere and thus having to manage .authorized_keys files all over an estate, the users can `kinit` in a terminal (even on a stock MacOS) and they're away. The credentials are managed centrally. It has service/user and delegation properties similar to oAuth and friends.

I've not looked at it with a modern and critical cryptographic eye but, for example, there is (configurable) support for not giving out the initial set of tickets (which is encrypted with the user's password) until the client has proven it knows the user's password.

Many browsers (especially on the MS platform, but definitely also Firefox on all platforms as well) can be configured to use the tickets for HTTP authentication (like BASIC or DIGEST, but using a different scheme) at configured domains. Lots of web servers and web apps are easily configurable to put the correct things in the correct environment variables or HTTP headers so integration with random web services is straightforward.

Once you've got SSH and Browsing covered with a single credential, you're well on your way to a really versatile SSO scheme.

<comment><USER3> Kerberos doesn't really scale to the Web at this time. It could, but it would be much better if we could just improve the WebPKI and make a true hierarchical PKI that mirrors the DNS. The latter can be done either by having registries and registrars operate name-constrained (possibly by convention) CAs, or by adopting DANE (DNSSEC Authenticated Network Entities).

<comment><USER4> This is a proposal that we delegate not just domain names, and not just TLS certificates, but _authentication for applications themselves_ to a tree- structured PKIs whose trunks are controlled _de jure_ by world governments.

<comment><USER5> _de jure_ the sovereign entities that you're labelling "world governments" already control everything, that's sort of the point of being a sovereign entity.

Even to the extent that there are exceptions to the rules they make, they made those exceptions too.

For example, the sovereign entities agreed centuries ago that none of them owns the open oceans but vessels that sail on those oceans shall display the flag of a sovereign entity and the entity thus flagged shall be responsible for that vessel's conduct and operation. This flag state regime proves to be problematic in certain ways in practice.

So what happened? Did some alternate power arise to challenge the sovereign entities in this regard? Nope. The European countries, annoyed by "flags of convenience" on the vessels they saw just arbitrarily instituted a new policy, under the Paris Memorandum Of Understanding. No need to "challenge" any existing rules, as sovereign entities they were entitled to just make up new ones. Vessels entering a European port needed to obey the Paris MOU rules, sometimes getting inspected and if necessary prevented from leaving until they rectified any problems to the port's satisfaction. Was that legal? It was now because sovereign entities had agreed that it was so. The new model was a big success and similar Port State Inspection rules soon followed elsewhere.

<comment><USER3> u/tptacek has made this argument a lot before. It's a fallacious argument because we can all see that when government X says JUMP, the companies they order either JUMP or EXIT, and when those companies lack an EXIT option, they always JUMP. The reason for this is that no cryptography can beat the rubber hose, and no cryptographic protocol can either.

No PKI, whether loose like WebPKI, rooted like DNSSEC (or as PKI was intended to be), or with multiple roots sharing subtrees (e.g., as DNSSEC would be if, say, Russia decided to require Russians to use Russian roots that happen to sign com and such as they are), can possibly get around the fact that the certification authorities that make it up are subject to the jurisdiction of some government. It's why we all don't want the CN NIC in our trust anchor sets, for example, or only want it if name-constrained.

There is not getting around this. So u/tptacek doesn't trust the DNS root, but so what, why should he trust any WebPKI CA at all, or all of them? Any one of them can be compromised by the end of a gun, and then all who have it in the trust anchors will be compromised too.

Sure, there's CT (certificate transparency), but there is nothing so PKIX- specific to CT that it couldn't be applied to DNSSEC, and anyways, I'm unconvinced that it's enough. There comes a point where certain governments don't even care if they leave evidence of their nasty behavior for all to see -- when push comes to shove, any government with jurisdiction over you can end your happiness and even your life. Oh? The world can see? But what can the world do for, e.g., HK? A big fat not much.

<comment><USER3> Also, DNSSEC does have one thing PKIX doesn't and can't have: QName minimization. That's where instead of sending the full domainname for any query to the root and all intermediate zones, you only ever ask each zone for its domainname + the next label of the domainname you really want.

Imagine you're a subject of interest to the U.S. government, and they're willing to risk public knowledge of their access to root keys, say, in order to spy on you. And say you're vising some site like antifa.github.io. So you ask . for io, and io for github.io, and github.io for antifa.github.io, and only at the last hop can the LEO/TLA system spying on you decide that yes, they want to MITM you there. So either they have to MITM you everywhere, or they have to MITM you only at zones they can control, and this is a decision they have to make online. That's a big deal. If they decide to MITM you when you asked for io, but you expected this so you had io's public keys, and . tells you different keys, then you've detected the espionage attempt. WebPKI can't do this. By the time some server (or MITM) sees your SNI they've also seen your DNS queries. Even if you're using DoH/DoE (which also gets you similar protection in a DNSSEC world), if the SNI is not encrypted, still, they know what to do. And so on. Let's say you're using DoH/DoE with a resolver the LEO/TLA can't control, then they could simply kick your door in and take your stuff and beat you up. Crypto can make things harder for them, but not infinitely harder. The CCP won't give a damn about leaving evidence in CT logs, for example -- maybe today they do, but when push comes to shove, forget about it.

</comment></comment></comment></comment></comment></comment><comment><USER3> Using Kerberos as originally intended, meaning that you exchange AP messages (or GSS-API security context tokens) to authenticate and set up session keys, which you then use for session protection using KRB messages (or GSS-API per- message tokens), then it turns out the vast majority of applications don't even need replay caches. The reason is simple: most application _protocols_ follow up the exchange with data that is not sensitive to replays.

Relatively few application protocols actually use Kerberos as originally intended though. Many SASL apps run over TLS and don't use Kerberos for session protection, for example, in which case you have to make sure that the server certificate PKI is as good as Kerberos (this is not a big deal in corporate networks). And HTTP/Negotiate uses Kerberos as a bearer token. There are some extensions to do channel binding of Negotiate tokens to TLS, but those are not universally easy to use because of complications to do with reverse proxies and less-than-universal client support.

Anyways the "dialogue" exposition is pretty neat and stands the test of time.

</comment><comment><USER6> Interesting, this dialogue is from 1988, and since then we're really re- invented the wheel with JWT, which by my understanding still allows for some forms of MITM and replay attacks, relying heavily on token expiration. Though I suppose the landscape has changed since most connections are now assumed encrypted.

<comment><USER7> It definitely allows replay attacks. If you manage to get someone's JWT you can impersonate them for a couple of hours before it expires, unless the website has additional identity verification measures like known IP addresses and such. As you say, connections are now all encrypted so the old prank methods of stealing peoples' tokens off university wifi networks won't work anymore. I've definitely seen JWTs show up in logs, though.

<comment><USER8> "known IP addresses and such" does not work for websites authentication and such. Mobile clients are changing IP all the time as they move between WIFIs and mobile networks.

That's one of the many limitations of kerberos. It's really not intended to work outside of a company intranet.

<comment><USER3> Uh, u/ahelwer was talking about JWT, not Kerberos.

Kerberos doesn't scale to the Internet as it stands, but used properly it's secure. The problem that u/ahelwer says JWT... Kerberos also has when used in HTTP -- as opposed to other uses of Kerberos that don't have this problem. That problem is that they are used as "bearer tokens" without any "channel binding", so if you use them over HTTP without TLS, you lose to any eavesdroppers, and if you use them over HTTPS using the WebPKI and some CA is being (ab)used to MITM you, then you lose. This isn't specific to JWT (or Kerberos) but generic to all small-b bearer token schemes.

<comment><USER8> I thought this was talking about JWT not restricting by IP specifically because Kerberos does.

Kerberos has very stringent requirements to onboard and preregister user devices, that works in limited contexts like desktop or server authentication in an intranet. JWT is intended to cover other use cases like web authentication. Their (non) limitations are simply reflections of their use cases.

</comment></comment></comment></comment></comment><comment><USER9> Posted quite a few times but a small thread from 2018 has the only previous comments: [https://news.ycombinator.com/item?id=17829319](https://news.ycombinator.com/item?id=17829319)</comment>


Bank of the Underworld (2015) - <AUTHOR> https://www.theatlantic.com/magazine/archive/2015/05/bank-of-the-underworld/389555/ <comment><USER2> >The target was a Vietnamese man named Hieu Minh Ngo. Investigators believed he was a big-time identity thief who sold packages of data known as "fullz," each of which typically included a person's name, date of birth, mother's maiden name, Social Security number, and e-mail address and password. Criminals could buy fullz from Ngo for as little as eight cents and then use them to open credit cards, take out loans, or file for bogus tax refunds. [...] He had allowed nearly 1,400 criminals to access a database containing the personal information of 200 million U.S. citizens—almost two-thirds of the population.

If two thirds of Americans have had all of that information compromised from this one incident alone, why do we use it as authentication for _anything?_ Shouldn't the SSN be replaced/assisted by a key pair?

<comment><USER3> Americans are dead-set against having a working national ID system. There are even people who are upset about the mere existence of the SSN for weird religious reasons. The British situation is even worse - proof of right of residence is required for opening a bank account, working, or renting a home, but only immigrants are made to have ID cards. Also utility bills are a valid proof of address for some reason.

No, the real problem is a liability one; loan companies should be held liable for each instance of fraud where they pursue the wrong person.

<comment><USER4> Americans not having a national ID system has nothing to do with what Americans want. It is expressly unconstitutional for the Federal government to require such a thing, only the individual States have the authority to issue IDs and the States are required to recognize these documents from other States. Again, the US is organized more like the EU than a single country.

Consequently, all Federal identification documents are strictly voluntary (like passports), which means some significant fraction of the population will never have them.

<comment><USER5> Good point.

Perhaps a PKI-based federated system should be deployed, even if adoption were on a state by state basis. I assume most states would adopt it, given the benefits we can think of ourselves.

</comment></comment></comment></comment><comment><USER6> _> Prosecutors dismissed the idea that many legitimate businesses used Liberty Reserve. After the takedown, they noted, users were encouraged to contact the U.S. Attorney's Office in Manhattan if they wanted their money back. According to prosecutors, only 35 people did so._

Was that because only 35 users were legitimate, or because the users - even if completely legitimate - were reluctant to risk potentially destroying their lives by admitting their identities to federal investigators?

<comment><USER7> I was not even aware this was possible.

My loss from the LR takedown was ~$600 and this is the first time I ever heard that any such recourse that was available.

In my personal experience, LR was easier to use and more widely accepted at the time than competing services. (namely PayPal)

This article focused a lot on the carding scene, which no doubt was heavily reliant on LR, but to paint all 1MM+ users of LR as carders is simply incorrect. As the article mentions, it was trivial to open an account (as easy as signing up for HN really) and many would do so to make a one-off payment.

</comment></comment><comment><USER8> He ended up being sentenced to 20 years: [https://www.justice.gov/usao- sdny/pr/liberty-reserve-founder...](https://www.justice.gov/usao- sdny/pr/liberty-reserve-founder-arthur-budovsky-sentenced-manhattan-federal- court-20-years)

</comment><comment><USER9> So long with the right to a lawyer and a fair trial.

>> According to Stapert, the U.S. government requested that he forfeit his fees for the case—insisting that the money Budovsky had paid him was tainted—a move that forced him to drop Budovsky as a client. (The Manhattan U.S. Attorney's Office denies that the government petitioned Stapert to forfeit the fees.) Once on U.S. soil, Budovsky was assigned a court-appointed lawyer;

<comment><USER10> Once a case is big enough for improving the reputation of prosecutors and institutions involved, they will go to any length to make it happen.

Challenging the US justice system in matters of legal (and even human) rights, more often than not, leads to dead ends.

</comment></comment><comment><USER11> > First of all, for thouse who [have] big money [stuck] in LR, dont be anxious > … thinking about the possibility to loose your money. Thats will cause > unnecessary pain. Give a good kiss your wife/girlfriend or your son if you > have. Give a time for your mind. Live your life whatever be the future of > this money … If still thinking that you have no where to run: IF we lost, (I > said IF, we have nothing concrete yet) we lost a place to KEEP money, not > the way to MAKE money. Keep that in mind. The show MUST GO on.

</comment><comment><USER12> > An agent tried opening an account with the name "Joe Bogus" and an address > of "123 Fake Main Street" in "Completely Made Up City." The agent also named > the account "ToStealEverything" and wrote that it would be used for "shady > things." He encountered no problems, and the account was soon functional.

One must assume registration was automated at this point, no? There's no shady business practice in _this_ specifically.

<comment><USER7> The issue is that financial systems are regulated and opening an account usually requires an AML / KYC process that ties you users to a personal ID.

<comment><USER12> Ah! That's what I was missing. KYC

</comment></comment></comment><comment><USER13> As the article states, Western Union is used frequently for transactions with assets that may have been gained through illegal activity (as judged per various government measurements/perspective).

And the USD is likely the greatest instrument by volume of the same types of transactions.

The transaction business will continue, as humans continue to trade for benefit. The cat and mouse game seems mostly about "authorities" overseeing and/or obtaining their share.

Again, an opportunity for p2p distributed, anonymous, and encrypted technology to allow humans to continue to trade that which they value.

Currency/money is based on trust/faith, so that would be the logical focal point.

Hypothetically, such development work would likely need to be conducted in jurisdictions that owe no allegiance to those authorities that do not wish for it to occur. Flavors of Cryptonomicon...

Fascinating.

</comment><comment><USER14> Absynthe/Master Splynter was an undercover agent at those times.

</comment><comment><USER15> I was wondering, does it make sense for "Underworld" to adopt something similar to Facebook's Libra?

Seems like a perfect fit and transaction cost would be worth it.

<comment><USER14> They already did, it's called bitcoin

<comment><USER16> Monero actually. Bitcoin is traceable.

<comment><USER12> Yes. It's usually converted back/forth between those two though, as Bitcoin is sometimes the only one accepted.

</comment></comment></comment></comment><comment><USER17> No John Wick reference? So disappointed...

</comment><comment><USER18> >Budovsky insists he didn't marry Vargas simply to get Costa Rican citizenship, which would have been illegal. Theirs was a personal relationship, he told me, without elaboration.

Lol!

I m not really how they gross 200 M USD in transactions at 1% and he is found with 2.5 M USD in his debit card.</comment>


Coronavirus: How the UK government failed to develop a contact-tracing app - <AUTHOR> https://news.sky.com/story/coronavirus-the-inside-story-of-how-government-failed-to-develop-a-contact-tracing-app-12031282 <comment><USER2> It's pretty clear the time is fast approaching for big tech to be dealt with and ideally broken up. Once this Coronavirus situation is under control I hope the EU starts this ball rolling.

<comment><USER3> Be careful what you ask for, you might get it.

"citing a statistic some believe was inaccurate: that the app's Bluetooth system, which was supposed to detect nearby phones as a way of tracking potentially risky contacts, only detected 4% of iPhones, rendering it effectively useless." Assuming the developers are telling the truth. Do you want the phone OS to let apps apps detect other people nearby? What you want is a big privacy hole, and remember that the phone OS has to to be ready. It has to allow that hole _before_ an urgent app comes along that _you_ want to use it.</comment></comment>


Show HN: QuickPages, a Free Landing Page Builder - <AUTHOR> http://quickpages.co/?ref=hn <comment><USER2> Is there a demo site we can see?

<comment><AUTHOR> Sure thing! This is what one of your users created: [http://quickpages.co/p/closedeyemedia](http://quickpages.co/p/closedeyemedia)</comment></comment>


Nitrous Oxide for Treatment-Resistant Major Depression: A Proof-of-Concept Trial - <AUTHOR> http://www.biologicalpsychiatryjournal.com/article/S0006-3223(14)00910-X/fulltext

<comment><AUTHOR> Small study, but exciting results.

"This proof-of-concept trial demonstrated that nitrous oxide has rapid and marked antidepressant effects in patients with treatment-resistant depression."</comment>


HTC bootloader policy a very big deal to a small number of users - <AUTHOR> http://reviews.cnet.com/8301-19736_7-20066896-251.html

<comment><USER2> They fail to understand that this small group is actually the first portion of the bell curve: early adopters. Our friends buy based on our recommendations.

<comment><USER3> I think the Linksys WRT54G is the greatest example of that.

Initially popular because they could run linux, I've seen countless friends and family buy the later locked down versions because it looks like the one that their tech savy friend has.

<comment><USER4> that's a dangerous example, because linksys never put much effort in this model. signaling that the early adopters or hardcore users are not a desired market.

<comment><USER5> Which is why I replaced my Linksys with a Buffalo <http://www.dd- wrt.com/wiki/index.php/Buffalo_WZR-HP-G300NH> and recommended it to my friends, some of whom have bought their own.

Linksys had really good viral marketing going with DD-WRT. Rather than exploiting it in a mutually beneficial way, they chose to spit in their customer's eye by making successive incompatible versions and charging extra for the "L" model that was nothing more than the original hackable model. I imagine they made more money short term. Today, I don't recommend Linksys to my friends, I don't see them as a stand-out brand (which they were with the WRT54G), and I don't see them as being particularly competitive in a crowded market.

Hopefully more enlightened manufacturers take heed to the Linksys saga and _don't_ make the same mistake. This seems to be the case with Buffalo and now HTC.</comment></comment></comment></comment>


Show HN: Aggregated and social-ranked tech/geek news (beta) - <AUTHOR> http://tekh.me

<comment><USER2> The DOS design is really clever, interesting, and unique. However, it's takes me back to such frustration and exhaustion that I immediately left the site. Also, it's not that easy to read anything.

</comment><comment> Ono-Sendai dat DOS aesthetic :)</comment>


The FBI Says It Can't Find Hackers to Hire Because They All Smoke Pot - <AUTHOR> http://motherboard.vice.com/read/the-fbi-cant-find-hackers-that-dont-smoke-pot <comment><USER2> So pot is good for something - keeping people from being lifelong stooges of the FBI.

</comment><comment><USER3> they can't find hackers because the FBI isn't paying crap. you too can be an "FBI Hacker" and make $65k/yr. woohoo.</comment>


Why the Nazi Party Loved Decaf Coffee - <AUTHOR> https://www.atlasobscura.com/articles/decaf-coffee-nazi-party <comment><USER2> tl;dr Germans invented decaf before WWI, Nazis liked to think they were big on public health, so promoted decaf, but also thought daily methamphetamine was healthy, so recommended eating chocolate with it in.

So, shorter: Nazis did things for what seemed to them like reasons.

I can add, Victorian English and contemporaneous Americans were little different, and similarly self-righteously deadly to minorities. But did it first.

<comment><USER3> It's really interesting how dramatically our views of mind-altering substances have evolved. I'd like reading an essay or book on the subject if anyone knows a good one. Like I have picked up bits and pieces here and there but not seen anyone attempting a coherent whole.</comment></comment>


Show HN: Simple Bootstrap 3 Form Builder - <AUTHOR> http://webnotes.github.io/bootstrap-form-builder/

<comment><USER2> This is great, although a small part of me can't help but remember that we used to be able to do this kind of thing in Visual Basic in the early 90s (and I don't doubt that someone will trump me with an example from a decade earlier at least). Plus ça change, plus c'est la même chose, I guess.

<comment><USER3> If memory serves me correctly rBase could so something similar in the late eighties.

</comment></comment><comment><USER4> Seems pretty cool - one thing I've been really wanting is a way to build up forms from within JavaScript (perhaps cached? Who knows...)

Basically I'm currently serving AngularJS partials using Django's templating, simply because django-crispy-forms (with some patches) can generate perfect bootstrap/foundation forms for me. It would be nice to move to perfectly flat templates, but having to copy/paste form elements just seems ludicrous.

There's also the added benefit that Django's forms (and Django REST's serializers) greatly simplify dealing with data gotten from HTTP requests, but still.

How do other people work with forms in their client-side apps?

</comment><comment><USER5> (Shameless plug)

My version of the same thing: [https://github.com/dobtco/formbuilder](https://github.com/dobtco/formbuilder)

<comment><USER6> That is really slick. I think I'll try using it.

Any chance of it dumping out the HTML for me? Also a email/password confirmation field would be useful.

</comment></comment><comment><USER7> Similar for Bootstrap 2 --> [http://demos.anupshinde.com/form-builder- part2/index.html](http://demos.anupshinde.com/form-builder-part2/index.html)

</comment><comment><USER8> Similar -> Bootstrap 3 Grid Builder [http://jaykanakiya.com/bootstrap-grid- builder/](http://jaykanakiya.com/bootstrap-grid-builder/)

<comment><USER9> Very cool. I would feel a lot more comfortable using it if the iMac didn't have the camera light on :)

</comment></comment><comment><USER10> Great job! Looking forward to other similar tools that people will be posting here - My FED skills are just horrendous, even with Bootstrap. Thanks for sharing!

</comment><comment><USER11> Nice proof of concept.

One bug I noticed: Accidentally clicking the submit button when trying to drag it will submit a form and cause you to lose your work.

<comment><USER12> Yep, the button is inside a form for some reason. Changing the form to a div fixes the problem.

Oddly enough, clicking the button placed in the right pane doesn't do this because it isn't inside a form. Strange that there's a form on the left but not on the right.

</comment></comment><comment><USER13> Repo: [https://github.com/webnotes/bootstrap-form- builder](https://github.com/webnotes/bootstrap-form-builder)

</comment><comment><USER14> Pretty neat, but where is the textarea?

</comment><comment><USER15> Would like to be able to edit the labels without messing with the HTML.</comment>


Music Hack Day Live from New York - <AUTHOR> http://live.musichackday.org

<comment><AUTHOR> There were 72 hacks built over the course of two days.

Check out the wiki: <http://wiki.musichackday.org/index.php?title=NYC_2011_Hacks></comment>


MalwareTech is being harassed by UK tabloid media - <AUTHOR> https://twitter.com/MalwareTechBlog/status/865937835643285506 <comment><USER2> The press always try to terrify us about the dangers of censorship and I wouldn't mind if they were doing a good job of exposing bad behaviour, but what about Jimmy Saville etc etc etc etc. Our press are horrific.</comment>


Did Putin orchestrate Russia's 9/11? - <AUTHOR> http://www.nybooks.com/articles/archives/2012/nov/22/finally-we-know-about-moscow-bombings/ <comment><USER2> Please don't rewrite the titles of articles you submit to Hacker News, unless they are misleading or linkbait.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><AUTHOR> Thanks for pointing that out to me. I'm sorry; I didn't mean to cause any trouble. I might suggest linking that from the welcome page. If it was shown, I missed it.</comment></comment>


The Baked Possum - <AUTHOR> http://www.oxfordamerican.org/magazine/item/748-baked-possum <comment><USER2> "Incidentally, a whale penis is the largest, and no discussion would be complete without mentioning the unique ability of whales. They are able to achieve erections at will, as readily as a man lifting his hand, and are the only mammal with this ability. This explains the lack of pornography marketed to whales. They simply don't need it!"

Really good writing, this is.

<comment><USER3> I like how in the last sentence the author hints his approximate age and marital situation. Genius!

</comment></comment><comment><USER4> "My nearest neighbor was Jerry Jerrell, who lived in a house he'd built with his wife. Jerry and Sherry had each been married before, and referred to themselves as "forced homebodies" because they couldn't go to town without running into an ex."

and

"[Possums] live the way I feel most of the time—a nomadic living fossil, a loner unable to tolerate company except during mating season."

really fine, fine writing (reminds me a little of Dave Eggers at his best)

i've seen a few possums before, but didn't have a recipe (until now); hopefully i'll run into one again soon.

</comment><comment><USER5> If I could find articles of this quality from the genre easily, it'd have been a significant risk for me to starve to death when reading food recipes.

</comment><comment><USER6> This will be my new go-to example of good writing. Thank you!</comment>