Poverty-Fighting Startups - <AUTHOR> https://www.fastcompany.com/40513626/these-poverty-fighting-startups-are-slaying-silicon-valleys-sacred-cows <comment><USER2> Fighting poverty is a social and political problem. It is simply a question of will. We have enough wealth on earth to provide food, clothing, and housing to every single human being. Why don't we do it? That's a political question. The technology is trivial.

>"One of my ambitions is to help our users put more food on the table," says Jimmy Chen, the founder of Propel. His company makes a mobile app called FreshEBT that helps people among the U.S.'s 43 million recipients of the electronic benefit transfer (EBT) service to stretch their food-stamp benefits as far as possible.

I read "we're here to somehow insert fees between you and your food stamp money". The self delusion of these people is incredible.

<comment><USER3> >Fighting poverty is a social and political problem. It is simply a question of will. We have enough wealth on earth to provide food, clothing, and housing to every single human being. Why don't we do it? That's a political question. The technology is trivial.

Because there is a huge and complex domain of human motivation, appreciation for hard-earned things vs. taking them for granted and so on. USSR tried doing exactly that with the planned economy and trying to distribute the wealth more or less evenly and failed miserably. Mostly because people lost motivation for achievement and started blatantly faking numbers and statistics since the connection between the results of their work and their life quality was completely lost. As someone who survived that crash, I would really hope that SV can learn from others' mistakes rather than repeating them.

<comment><USER4> > USSR tried doing exactly that with the planned economy and trying to > distribute the wealth more or less evenly and failed miserably.

Actually if you look at where they started and where they got, they did a pretty good job in raising the very poorest our of poverty, electrifying the country, and really eliminating a lot of the abject poverty that was most of the country at the time of the revolution. Changes that the former (imperial) regime seemed uninterested in making.

Even into the 1950s and even 1960s quite a lot of people, including a surprisingly large amount of US government officials, thought that there was a chance the USSR could surpass the USA. I think such people were delusional, since the signs were pretty clear at the time (I was a child at that time, but I did study the USSR in the 1980s when it was very obviously not a threat to the west).

Don't get me wrong: the USSR was founded by a bunch of bloodthirsty assholes (Lenin, Stalin, Trotsky et al) and, for various reasons developed into a, yes, evil system. I don't blame it entirely on the people involved -- I think anyone who tries to follow that model, even with good intensions (and it's not clear the Bolsheviks _had_ good intentions) is going to end up with a shitty result.

But dispassionately one thing they did accomplish was the thing you said they failed miserably at. And it's unlikely the Menshevik republicans would have pulled that off.

<comment> aaron-lebo They were successful by the late 30s (after lots of misery), but the Russian economy had been growing for a long time. I'm not sure the imperials or republicans couldn't have pulled it off, Russia had lots of natural advantages, especially after winning WW2.

GNP:

        Country 	1890 	1900 	1913 	1925 	1938
        Russia/USSR 21 180 	32 000 	52 420 	32 600 	75 964
        Germany 	26 454 	35 800 	49 760 	45 002 	77 178
        Britain 	29 441 	36 273 	44 074 	43 700 	56 103
        France 	19 758 	23 500 	27 401 	36 262 	39 284

They went from the second smallest economy in 1890 to the biggest in 1913 (imperials). The economy crashed after the revolution and bad economic experiments and then rebounded. Russia was late to the industrial revolution so a lot of that growth was just it kicking in, along with the Soviets removing anyone that got in the way. Hard to say how much can be attributed to either.

They were holding their own late into WWI and actually had an agreement to obtain Istanbul, which the Bolsheviks revoked (hard to fault them) along with all that they gave up in the separate treaty with the Germans. Imagine them sticking it out to 1918 with gains from being on the allies and the revolution averted. They would have been as well positioned as anyone in Europe.

<comment><USER5>
      The economy crashed after the revolution

The loss of the war with Japan didn't help, either.

<comment><USER6> Source?

I can't find any evidence that there was any economic significance to that war aside from loss of the fleet and human life. Bruised imperial egos for sure and likely contributing to an image of a week government, but I'm hard pressed to see how it could have had any impact on the industrial output of the country.

<comment><USER7> You could surely say that the war with Japan didn't help.

Well-known events like the Potemkin mutiny may be dismissed as not impacting industrial output, but there was a large-scale general strike which actually lead to "1905 revolution" [0]. The loss to Japan was of course only a partial factor, with bigger contributor being the overall economic downturn of early 1900's.

There were some direct impacts from this revolution. There was large-scale unrest in Kingdom of Poland (the Russian-held part of partitioned Poland). Finland (then a Grand Duchy in the Russian empire) abolished Diet of Finland in favour of a new Parliament of Finland, with universal suffrage for both men and women. And in mainland Russia, the absolute monarchy was abolished in favour of a parliamentary monarchy.

However, this was too late for the Russian empire to recover.

[0] [https://en.wikipedia.org/wiki/1905_Russian_Revolution](https://en.wikipedia.org/wiki/1905_Russian_Revolution)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Its important to know that you don't need millions of dollars to help people and do good. My salary was 145k with it I started a non profit that pays low- income earners minimum wage while they learn how to code. These people could really benefit from learning how to problem solve but they don't have the luxury to quit and join a bootcamp. With my salary, I was able to help 3 people at first but now (after getting a new job and selling my vested stocks) we are able to support 13 students.

When I visited CalWorks (local government assistance program) to see if they could help my project financially, they were really excited and agreed to refer students (who are on the poverty line) and also pay the students so I don't have to. Before we joined, the only kinds of job training they were able to offer were the likes of Amazon warehouse packaging and hotel cleaning. I hope to empower more low-income earners to have the ability to simplify complex problems and problem solve.

<comment><USER9> Are you accepting/looking for volunteers?

<comment><USER8> Yes! Please send me an email (in my profile)

</comment></comment></comment><comment><USER10> I'm not from Silicon Valley, so the only sampling I have of SV culture comes from this site[0]. From what I see, the article has a refrain that being anti- libertarian goes against the SV gain, but I see political opinions from across the political spectrum here, and my leftist opinions are often upvoted. So, while I can see _investors_ being skeptical, would the tech community as a whole be anti-welfare? I don't necessarily think so.

Regardless, that's just a nitpick about the article. I'm happy that these businesses are doing what they are doing.

[0] FWIW, the article cited a comment from here, so this place must be important enough to cite as an example of SV attitudes

<comment><USER11> I think SV culture tends to be politically extremist, or to be more accurate fundamentalist, in whatever ideology it pursues. I see more hard-line libertarians, but also more hard-line socialists, than in other subcultures.

There's a long tradition of political extremism among engineers in cultures around the world; something to do with seeing society as a system simple enough that a single human being can understand the solutions to its problems. Hayek (who I disagree with on many points) even wrote a whole essay on it, with this very lovely point:

"It is this awareness of being part of a social process, and of the manner in which individual efforts interact, which the education solely in the sciences or in technology seems so lamentably to fail to convey. It is not surprising that many of the more active minds among those so trained sooner or later react violently against the deficiencies of their education and develop a passion for imposing on society the order which they are unable to detect by the means with which they are familiar."

[https://mises.org/library/engineers-and- planners](https://mises.org/library/engineers-and-planners)

Gambetta and Hertog tried to quantify this, and found that engineers were over-represented (drastically) in Islamist terrorist networks, and (less drastically) in Western right-wing extremism; and that Western left-wing extremists tended more towards a humanities education. I've read lots of newspaper write-ups of the book, but haven't gotten my hands on a copy, so I don't know their speculation on the causes of the left-right split they observed in studies.

[https://press.princeton.edu/titles/10656.html](https://press.princeton.edu/titles/10656.html)

They also have older scholarly write-ups, which I should probably take a look at, e.g. [https://www.cambridge.org/core/journals/european-journal- of-...](https://www.cambridge.org/core/journals/european-journal-of-sociology- archives-europeennes-de-sociologie/article/why-are-there-so-many-engineers- among-islamic-radicals/91ED8BEFDE3793834667750B31575422)

EDIT: So, looked at that paper at last, and it seems the right-wing stereotype of SV people is likely true. They looked at Westerners to try to make comparisons, and while they found no overrepresentation in violent groups, they did look at surveys of political views of educated people by degree. The best data they could find was about faculty members from 1984, so keep the age and restricted subset in mind.

"The results are startling (Table 7). The proportion of engineers who declare themselves to be on the right of the political spectrum is greater than in any other disciplinary group: 57.6 % of them are either conservative or strongly conservative, as compared to 51.1 of economists, 42.5 of doctors and 33.5 % of scientists, 21.4 % of those in the humanities, and 18.6 % of the social scientists, the least right-wing of all disciplinary groups. Only 1.4 % of engineers are on the left, as opposed to 12.9 % in the social sciences and 16.7 % in law. Perhaps this is an uncanny coincidence, but the four fields at the top of the conservatism scale – engineering, economics, medicine, and science – are the same four secular fields we found at the top of our main jihadist sample."

They also cited a more recent Canadian study (1999) with similar results.

Anyway, there are many other interesting findings in that paper; highly recommended.

<comment><USER12> This is actually amazing. I always thought that this "seeing in systems" was also the cause of the lack of empathy that traditionally has been attributed to engineers (being this an unfair stereotype or not).

There are several computational paradigms that we attribute to minds (and people) that more often than not backfire, finite state machines being the most obvious one. Sometimes it works, and we discover a great mental model to live by. Sometimes it goes really wrong and it all goes the modernist way (Mies van der Rohe and co).

This leads to another nasty effect: being incapable to commiserate with the people around us. If the mind is a deterministic black box and I'm not an alcoholic because I refrain myself from drinking, how come there are alcoholics. The answer must be: they do not try hard enough. Same with poor people, obese people. If things have not happened to me, the fact that happen to other people must mean that they've brought it upon themselves.

</comment></comment></comment><comment><USER13> Propel (and bunch of other ventures) have their genesis at the Blue Ridge Labs.

Blue Ridge Labs focuses on bringing together people who are interested in product, design and engineering to go out and apply tools of empathy and discovery to understand the problems faced by low-income and socially disadvantaged Americans.

For anyone who is at crossroads in their career, I would highly recommend reaching out to @BlueRidgeLabs. I vouch for and support the sincerity of their mission.

Have questions about Blue Ridge Labs? Reach out to @cromulus. Looking to find an engineering position in NYC reach out to @FreshEBT. I am @rksio

</comment><comment><USER14> How are these startups planning to pay back the VC money? The poor don't exactly have a lot of money. Where are they going to get the money from? I am skeptical anytime a VC invests in "solving poverty".

</comment><comment><USER15> Is it... a "startup"? Do they make money? Is Propel even a for-profit company?

<comment><USER16> > _Is it... a "startup"? Do they make money? Is Propel even a for-profit > company?_

A startup is a newly established business - that is to say, just starting up.

<comment><USER17> I'm a fan of PG's view: [http://www.paulgraham.com/growth.html](http://www.paulgraham.com/growth.html)

<comment><USER16> I'll put forward that PG is using his own definition that aligns with his business. His definition differs from that of the dictionary's definition.

There's nothing wrong with that, as it helps him achieve day-to-day his goals. But, the definition is otherwise limited in that it is not correct or useful outside of direct investors who are looking for fast growing companies that want to be called startups in order to get startup funding.

</comment></comment></comment></comment><comment><USER18> If a poverty fighting startup would work it would be a huge plus for capitalism, I think.

How to get poor people at least to an average income while making some money yourself.

I'm from Germany and at least here I have the feeling that the issue is mostly missing education opportunities for older people.

Sure, the "really" poor without any job have more time on their hands, but there are probably a huge bunch of people who could work as taxi diver or waiter, who can make 1000€ a month without the need of too much education.

While you probably can mingle with the "Arbeitsagentur" (part of the public service for unemployed people) to get the people without income paid by them while you re-educate them, the much bigger part are the people who work but simply don't make enough money to have an okay life.

Also, while you have to get the second part of the people like 1000€ a month so they can do their re-education fulltime, you also have to make money yourself.

All I found today were some models, where the re-educated had to pay like 10-20% of their first income as payment later. This doesn't sound too bad, since it forces the education-company to get them ready for jobs, but on the other hand it maybe prevents people from getting good jobs? I don't really know.

The other model could be more like Mozilla does it, getting big sponsors, but then you are working for the sponsors and not for your customers anymore :/

</comment><comment><USER19> Love that this could start becoming a thing. There's a very similar incubator[1] in Chile with the same hypothesis, poor people also have problems that can be resolved through tech/startups and there are plenty of good business opportunities there.

[1]: [http://www.socialab.com](http://www.socialab.com)

</comment><comment><USER20> There's no sacred cows in this case, just groupthink.

Incidentally, Silicon Valley isn't at even typically anti-government. That bit isn't even in the groupthink even if there's a particular anti-government dogma that isn't _absent_ from the milieu.

(note: I'm not in SV or it's groupthink, I'm speaking as an observer of it)

</comment><comment><USER21> Does anyone else find it odd to make a smartphone app for EBT users? If I were broke, one of my first moves would be to go to a cheaper phone, maybe a flip- phone style.

But maybe that's what the author meant by the trade of time and convenience for cost.... I really, truly believe that money skills lead to the accumulation of wealth, and that they are acquirable (teachable) skills.

</comment><comment><USER22> Govt should go for [https://en.m.wikipedia.org/wiki/Basic_income](https://en.m.wikipedia.org/wiki/Basic_income)

Citizens can opt for [https://www.givedirectly.org/efficiency](https://www.givedirectly.org/efficiency)

</comment><comment><USER23> The greed of the rich and well-connected, is beyond belief. Capitalism has failed for a segment of the population. Democracy has failed for them.

You need money to make money. You need education, skills, connections, and health to get and maintain a job.

Have you seen the pictures of Skid Row in Los Angeles?

[http://ww2.kqed.org/news/wp- content/uploads/sites/10/2016/01...](http://ww2.kqed.org/news/wp- content/uploads/sites/10/2016/01/HomelessFoodLine-800x518.jpg)

[https://world.wng.org/sites/default/files/styles/three_col_f...](https://world.wng.org/sites/default/files/styles/three_col_full_width/public/carousel- images/SkidRow82-w.png?itok=W3O9S67-)

This is the reality on the ground in Los Angeles. There are several blocks in downtown Los Angeles, where when you step into it, it feels like you stepped into a land that time forgot. The people are destitute. They have failed at one thing or another in life, and that has brought them to this point.

And what is the result of this? It has created a micro-3rd-world-country, right in the heart of one of the richest cities in the world. Where people drive by in expensive Mercedes, BMW, and Tesla cars.

The rich don't care about this, because they will never drive through the poor parts of town. But for everyone else, it makes life miserable for all.

At some point, you just have to cut your losses with these people. They are not going to get any corporate job. They pan-handle, beg, and harass people on the streets. Society, the city, the state, and the federal government, must step in to provide a baseline for these people.

Give them a damn fake job, give them money, give them food, give them shelter. Just get them off the streets.

If society cannot do this for them, then take the next step, and go extreme. Incarcerate them. Make it illegal to be homeless. Throw them into a prison. At least that way, they will get fed, have a jumpsuit for clothing, and a warm shelter.

This is a human rights issue. And for the United States to claim that they are the greatest at human rights, then all you have to do is to look at the homeless, the underbelly of society, and see the people that has failed in society. And here, you will see the hypocrisy of a society that has no desire or inclination to help them.

</comment><comment><USER24> Poverty-fighting? They're quite literally poverty-exploiting.

<comment><USER7> The road out of poverty is through what is called "exploitation" in Marxist theory - particularly, international trade.

As British economist Joan Robinson put it :"The misery of being exploited by capitalists is nothing compared to the misery of not being exploited at all."

</comment></comment><comment><USER25> Contrary to how it sounds, you can't eat a double-byte character. This does seem to feel slightly like rent seeking on behalf of these companies.

</comment><comment><USER26> >"One of my ambitions is to help our users put more food on the table," says Jimmy Chen, the founder of Propel.

This app has some short-term benefits, but it's hard to see long-term benefits. What if every government aid program was super easy to sign-up for and instantly check whatever you need. What would change? Less taxes from all the gov workers we'd no longer need?

<comment><USER27> >This app has some short-term benefits, but it's hard to see long-term benefits. What if every government aid program was super easy to sign-up for and instantly check whatever you need. What would change? Less taxes from all the gov workers we'd no longer need?

A lot of people who could receive aid but don't have the time / ability / don't know that they could receive aid would get help? How is that not a good result?

And yes, it'd also mean that there's less effort required to find people who need help and verify them, and thus the overhead is reduced.

</comment></comment><comment><USER28> At first blush it would seem that coordinating or collaborating with cooperative government agencies might be of benefit as many of these apps seem to streamline and make processes more effective for the ultimate beneficiary of the programs. Obviously this is a benefit for both the recipient and the government organization which wants to serve its pop as well as possible.

As someone mentioned in the thread, efficiency could lead to either better benefits to the recipients of the government benefits or they could result in contraction of the government workforce.

To that latter concern we must figure out whether people are employed by the government (or companies in general) to do a job or they're there also equally as a part of a social contract to keep the most people possible in gainful employment --which if the latter is true, SV startups are an anathema by design. People for the most part aren't building startups in order to require more people to keep things running --they tend to be in business to save their customers money.

<comment><USER29> Wait til you hear about the manufacturing industry using machinery!

<comment><USER30> Please don't post unsubstantive comments here.

<comment><USER29> It's hard to identify what 'unsubstantive' might mean when it apparently doesn't include the idea that businesses are not created in order to employ people.</comment></comment></comment></comment>


Art thieves caught after Googling the stolen art pieces' author - <AUTHOR> http://www.forbes.com/sites/schifrin/2014/12/02/from-here-to-modernity-inside-billionaire-jeffrey-gundlachs-art-collection-and-how-he-caught-an-art-thief-with-google/

<comment><AUTHOR> TL,DR;

 _"I outsmarted the guy," Gundlach [the art collection owner] says about the theft. "I figured out that he was a street criminal who didn't know anything about art because of what he took, and I figured out that sooner or later he would Google the signatures of all the artists."_

 _" According to Gundlach, his Google theory led law enforcement authorities to the only other person in the area who conducted an Internet search for his grandmother's name after the heist. The thief was arrested and all of Gundlach's paintings–including Johns' "Green Target"–were recovered._</comment>


Ask HN: Why don't websites show password requirements at the login screen? - <AUTHOR> Whatever brute force hacker would already know all the password requirements.<p>But I might not remember them and the password I used for an especially stringent site. Why not just remind them of the requirements if someone got their password wrong on the first try? <comment><USER2> Hi, I'm your product manager.

I'd like you to create a login page where a user can log in using their email address and a password.

We want our users to be made to feel as if we take security seriously, so let's use the following secure password requirements that I picked up from a blog post:

* Password must be AT LEAST 6 characters (but no more than 12, because who's going to remember more than 12 characters?)

* There must be at least one number.

* There most be at least one uppercase and at least one lowercase letter.

* There should be at least one special character, but not just any special character, because we don't want things to get crazy. Only these five: &$+#%

Okay, can you code that up for me?

Wait, it'll take _how_ long?

Well, yes, I understand that you not only need to build in the validation logic but also need to build little error messages to let the user know what they've done wrong if their password doesn't meet all the requirements, plus allow time for writing tests, getting UX's rubberstamp, etc.

But I kind of need this by tomorrow afternoon. Is there anything we can consider out of scope?

<comment><USER3> My favourite are the ones where you're not allowed to use "the portion of your email address before the @" in your password. My email address is email@example.com. Fun times :D

<comment><USER4> Didn't you bring this on yourself?

I hate any requirements for passwords but why go for cornercase email?

<comment><USER5> Now you're blaming the user though. The user isn't wrong for having a valid email address.

<comment><USER4> There are degrees of valid. There is RFC valid and then there is 'common sense' valid (there are degrees of common too). Forcing yourself into barely common valid but RFC valid is user's fault.

<comment><USER5> Valid is a binary condition. Either an address is valid and you will be able to send mail to it, or it is not. That is usually the sole reason for validating an email address. If a bug in the validation logic causes an unusual email address to invalidate then the code is definitely wrong, not the user.

If the PM specifies a requirement to filter out email addresses with a single character before the @ sign, then that's a different thing. Maybe there is a business requirement to filter out people who own a domain and give themselves a single character email address? In that case it should be explicitly written into the validation logic and not done as a side effect of sloppy coding.

</comment></comment></comment></comment></comment></comment><comment><USER6> Because the ONLY requirement should really be > 8 (or more) characters. Any other requirement will generally lead to users creating passwords with predictable patterns.

[https://www.ncsc.gov.uk/guidance/password-guidance- simplifyi...](https://www.ncsc.gov.uk/guidance/password-guidance-simplifying- your-approach)

"Traditionally, organisations impose rules on the length and complexity of passwords. However, people then tend to use predictable strategies to generate passwords, so the security benefit is marginal while the user burden is high."

Edit: Adding NIST guidelines too, which say the same [https://nakedsecurity.sophos.com/2016/08/18/nists-new- passwo...](https://nakedsecurity.sophos.com/2016/08/18/nists-new-password- rules-what-you-need-to-know/)

<comment><USER7> I'm curious how far practical implementations of the NIST guidelines take the advice to preempt dictionary attacks by not letting users choose known bad choices. Of course the advice is perfectly reasonable, but when a user can't choose 'password', they will probably try 'password1' \- not really much safer against the usual password cracking software, do you check that too then? But I guess the article mentions that dilemma too. I guess it's again a tradeoff between not annoying the user and annoying the password cracker sufficiently. :)

<comment><USER8> password1 and reasonable mutations of password are probably present in the top 10000 passwords.

If that's not the case in general, a good benchmark would be 'can hashcat break this given a reasonable mutation pattern'. The zxcvbn project pretty much provides that.

</comment></comment></comment><comment><USER9> Tangential but here's another one: Why don't websites show the requirements at the _signup_ screen?

I've lost count of all the sites where I sign up and paste a long, secure password generated by my password manager. One of three things happens then.

1) The site admins are competent and my strong password is accepted.

2) The site admins are incompetent, and limit password length to a short string, possibly with certain special characters required.

3) The site admins are incompetent and should immediately be fired, because the form accepts my long, strong password, silently truncates it to a shorter length and saves that, and my correctly typed password no longer works. I've discovered this pattern repeatedly after comparing the 'forgot password' email then send with the truncated password in clear text (which is another reason they should be fired immediately) and noticing it is much shorter.

First-world problems, I know, but this annoys me and I would like to see it fixed.

<comment><USER10> Number 2 and 3 are my most common ones. I've seen bank logins capped at 8 characters. Oh and getting a mortgage... don't even get me started on mortgage company password security.

</comment></comment><comment><USER11> Another issue is that most password requirements change over time, without requiring existing passwords to be changed. There's no way to tell what the requirements were the last time the user changed their password without breaching confidentiality. Having a list of all previous requirement schemes would be a mess.

<comment><USER12> Actually, it's pretty simple - each time you login, check that the password (now cleartext, as supplied by user) is valid AND meets the current requirement. If it's valid and doesn't, push in to a change password flow with the current requirements. If you're extra careful, you can expire older passwords and require an email reset before use.

</comment></comment><comment><USER13> I used to offer b2c technical support in my local area, I did it for about 5 years. It involved lots of in-person assistance provided to non-technical folks on setting up Apple iCloud-enabled devices where the client was just too spooked or unsure about the process and needed help.

I estimate I've helped 300+ people set up iPads and iPhones, and almost all end up setting up iCloud. There are various steps to set up a new iCloud account, including security questions from a drop-down list and setting a suitably secure password.

This happened 95%+ of the time:

* iCloud prompts for (first time setup) password

* I look away, they type in a password and tap OK/Next

* I look back, iCloud responds that the password is not strong/secure enough

* I explain that Apple passwords needs to be of a certain strength, and include 1 or more capital letters, and 1 or more numbers.

* The client tries again: makes the first character (a letter) capital and tacks a `1` on the end.

<comment><USER14> I tack a '0' on to the end. Ha! Secure!

</comment></comment><comment><USER15> The first website I've noticed that does this is Expensify. See their login page here, specifically the little light bulb by the password field: [https://www.expensify.com/signin](https://www.expensify.com/signin)

Is it an intuitive, clean design? Not sure. Definitely didn't guess that the light bulb meant, "show password requirements", but at least it's an attempt.

</comment><comment><USER16> I hate websites that enforce their stupid password requirements on me. Most of them are stupid, did I say that already ? Well, you can ONLY use some special characters not any. Even worse, you CANNOT use some special characters. Ok I keep trying. My best one: paste is disabled. So I cannot copy and paste my super strong password from my password manager because apparently the genius who built it thinks that copy/paste is a bad idea. Did I mention that some password pages have a maximum length rule ? really ?

End of rant. The best password pages are those who just warn you for things like min. length (a 2 character password is definitely a bad idea).

</comment><comment><USER17> I think this is a great question and would love to hear a thoughtful, measured, non-snarky response

<comment><USER18> The hypothetical of a manager asking for the feature by the next day is pretty accurate. Besides that, it might be a product or design person that thinks the requirements would clash with the current product/design and don't want to go through another iteration.

A better answer to the problem is to not have password requirements because it's the user's responsibility to choose a secure password. If their password is compromised because it was their dog's name or "password1234" then it's their fault.

A way to engineer against brute-force hacking is to limit the number of attempted logins per username and IP. If they hit the limit then their account should be locked or their password should be automatically be reset with an email.

<comment><USER17> > it's the user's responsibility

While I agree with you on some level, this is quite contrary to the spirit of our times. Plenty of otherwise smart people have pretty dumb passwords. I'm similarly ignorant of enough things that I don't judge them as simply deserving what they get.

</comment></comment></comment><comment><USER19> None of the pages I host have any password requirements. Well, one, you have to have a password. One char is enough. Some might wonder why would you do that, but why would you force people to make complicated passwords if the site in question doesn't have anything worthwhile to steal? Like one of my sites is a tv guide, why would I want to force my users to use +8 character passwords? Pure stupidity.

</comment><comment><USER20> Reminds me of this joke:

[https://www.reddit.com/r/Jokes/comments/1v4bpa/passwords/](https://www.reddit.com/r/Jokes/comments/1v4bpa/passwords/)

</comment><comment><USER21> Password rules are dumb, but why do websites even require passwords when they require an email address and offer a "forgot my password" link? The user clicks the link, it sends a one-time login URL to the address, that login URL sets a cookie, and there you go.

If your primary email account is hacked, you're pwned in all kinds of ways that a password won't help, e.g. "forgot my password" requests. And if you don't care about others using some junk website that requires logins, you can give them a throwaway Mailinator account.

</comment><comment><USER22> UX aside, the set of requirements in place when you created your account may be different from the set of requirements that are in place at the time of login.

</comment><comment><USER23> The site's devs & testers simply never even see the invalid password screen - only automated scripts with test credentials ever interact with it. They have a completely different experience, and that affects how the site is built.

At the end of the day, making life easier for users is not a priority unless it affects the bottom line.

</comment><comment><USER24> It's visually unclean, and of dubious security use, because nobody should be trying to remember all their passwords, or using a memorable scheme that is adapted based on requirements, just big random string that meets requirements and is managed somehow.

<comment><USER25> > nobody should be trying to remember all their passwords, or using a > memorable scheme that is adapted based on requirements

I strongly disagree with this. Using a password store guarantees that it is technically possible for someone to recover a complete list of my passwords without me being aware. And means I am either storing my passwords online someone which makes it far easier for that technical breach to happen, or I am relying on a piece of hardware not failing to maintain access to my account.

Remembering a unique password for each site (that I actually care about, I can write down passwords for sites that I don't) is simply more secure. Sure the passwords will be easier to reverse if you get a hash of them then a real random string, but it would still be extremely difficult/beyond most cracking software (it's easy to increase reversing difficulty by using a long hard-to- reverse suffix shared between all your passwords), and you'd have to steal and reverse a lot of hashes to find useful patterns.

<comment><USER24> My credential management tool has ~300 credentials in it, of which I use roughly 10% frequently, there is no way for me to remember these, without creating a scheme which someone could eventually reverse given enough of my leaked credentials (so far about 15% of services I use have had breaches using weak hashes, and these tend to end up in public). Such a scheme would also have to support password rotation (for services which are breached, or which expire credentials) If I am going to store them somehow, an encrypted blob seems to handily beat pen and paper.

The only scheme I can think of that would be strong would be one that is tool- assisted and given a set of password requirements (length, allowed characters, etc.), a domain, a master key, and an incremental counter, derived keys and formed passwords on the spot, but I'd still need to remember the criteria for each site, and the counter positions, and keep those secured... so whats a few more bytes?

</comment></comment></comment><comment><USER26> I think it would be confusing, people only expect feedback on their password during registration or when updating it. Also, requirements can change but that won't invalidate passwords which were chosen with the previous requirements.

</comment><comment><USER27> I want login & signup params in meta, for password vaults to use.

Stable URLs for log in/out, regex pattern (or some such) to spec password reqs, list stock status response codes (eg success, bad email, nym already taken).

</comment><comment><USER28> Is there a database of leaked passwords somewhere? I would simply enforce that your password is not in the leaks? Probably would capture the most common 100k passwords anyway this way?

</comment><comment><USER29> I worked a place where the password requirement for the system was 3 numbers, 2 letters, 3 numbers. and you had to change it every 3 weeks.

</comment><comment><USER30> Because people who are smart enough to think of that aren't stupid enough to have silly password requirements.

</comment><comment><USER31> Counter question: why aren't we educating users to use password managers?

<comment><USER32> Who are "we"? What is a good way of educating every service user ever that password reuse can ruin their lives and that human generated passwords are weak? School? Parents?

New users are thrown into the internet and they find out they have to use an email, and are usually turned towards Gmail, and then they have to use a password. They probably already had a password on their laptops or phones, which are harder to break into because they need physical access to crack, but the new user doesn't know that people can and might remotely try to gain access to their online email service. So they use the same password they had on their laptops. Then they have to sign up for a ton of other services, so they need passwords for them as well. The easiest thing to do is to reuse your password, or slightly modify it.

If people don't know why it's bad to reuse passwords, they won't even think about getting a password manager. Yes, it is very simple and user-friendly nowadays, but it's seemingly a lot of work to change all your past passwords, and to some people it might be even scarier to hide all your passwords to all your accounts behind a single password.

I'm not very familiar with middle and high school curriculums nowadays, but I feel like security is a topic that must be included. A crazy amount of people use the internet and build their whole online personas or store a lot of their personal and important information in a very wrong and insecure way, just because there's nothing to stop them, and that's the easy way.

<comment><USER31> "We" as the community who gives them a reason to create these accounts. Whatever system that is.

> If people don't know why it's bad to reuse passwords, they won't even think > about getting a password manager. Yes, it is very simple and user-friendly > nowadays, but it's seemingly a lot of work to change all your past > passwords, and to some people it might be even scarier to hide all your > passwords to all your accounts behind a single password.

Maybe we should all make an effort then. Give them instructions on why and how to use a password manager. Before they create an account. It just a high level idea, not very well thought out.

</comment></comment></comment><comment><USER33> The requirements could have changed since the user last set their password.

</comment><comment><USER34> How does showing the requirements help the user recall the password?

<comment><USER2> I am somewhat ashamed to admit this, but I used to use a password that had a common base but was adapted to each site according to a formula. However, it did not contain any special characters. So you can bet that whenever a site indicated that special characters were necessary, I would just tack on an exclamation point to the end.

<comment><USER35> I used to do the same. I'm sure that's what thousands of others do too :)

</comment></comment></comment><comment><USER36> Probably tradition & aesthetics.

Best just to avoid goofy requirements.

</comment><comment><USER29> and don't forget preventing pasting</comment>


» The Long View on Real Estate - Blog of the Long Now - <AUTHOR> http://blog.longnow.org/02012/10/17/the-long-view-on-real-estate/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+longnow+%28The+Long+Now+Blog%29 <comment><USER2> There is a strong element of hindsight bias in these studies which should be better discounted. The Amsterdam area in question has remained consistently popular over the centuries; the chart would have looked pretty different if it had, say, fallen out of favor after one of the wars it went through. The original author admits as much:

"The thing with Herengracht is that it never fell out of favour during all these years, it was always (and still is) part of Amsterdam's most attractive real estate."

Choosing several random areas worldwide (including ones which might have been popular at one point but no longer are) and conducting this study over would be a better way to go about it in my opinion.</comment>


Ask HN: Thoughts / Experiences on SQL as an API - <AUTHOR> I have seen several examples in the past of SQL being used as an API to access systems or data in more or less powerful ways.
for example :
--- YQL - https://en.wikipedia.org/wiki/Yahoo!_Query_Language
YQL enabled to access web data and some APIs as one big virtual database. eg: "select title, link from rss where url = 'https://www.engadget.com/rss.xml';"
--- osquery - https://osquery.io/
osquery - Query your devices like a database with currently 258 tables implemented (https://osquery.io/schema/) eg: "SELECT name, path, pid FROM processes WHERE on_disk = 0;",
Do you know other similar projects that add an SQL facade on systems, datas or APIs in unexpected ways ? Do you consider that these kind of APIs are fragile or elegant ?
I tried to find a list/documentation of all the endpoints that used to be available in YQL but did not find anything that looked comprehensive to better understand the scope that it used to have. If you happen to know where to find such a list or remember some of the endpoints, I am interested.
Thanks for your time ! <comment><AUTHOR> Regarding YQL, I found this github repo - [https://github.com/yql/yql- tables](https://github.com/yql/yql-tables) that seem to describe some of the external tables that used to be available through YQL.</comment>


Getting XKeyscore Right - <AUTHOR> https://medium.com/state-of-play/f49beeaf6a9c

<comment><USER2> >It is laws, and not technical means, that prevent rampant, systemic oppression.

Which is exactly why it's so dangerous to have a secret court, with secret rulings, NSLs, and to make everything a secret in the name of national security.

>What we have learned, essentially, is that the NSA — a spy agency whose attention is focused internationally—does exactly what it is supposed to do.

It's interesting that Americans are only getting uncomfortable with mass surveillance now that they know there is a possibility it's being done to them. It's as if all foreigners should be presumed guilty and have no right to privacy or basic respect.

</comment><comment><USER3> It hardly seems sporting to complain that the Guardian's article is imperfect when the official information about surveillance consists of direct lies while testifying under oath, and people who release information through unofficial channels are charged with treason and face (literally) death or life in prison if they're caught.</comment>


What carries you up will also bring you down  - <AUTHOR> http://www.cdixon.org/?p=1492 <comment><USER2> While many of these companies are facing slowing growth, or even slight declines, I'd argue what carried them up is still making them very profitable businesses... and they'll be around for a long time.

It'd be interesting to have the discussion about flash-in-the-pan companies that truly did collapse due to their original model.</comment>


Github is Down - <AUTHOR>

From status.github.com,<p>"Site is unavailable. We're researching the issue. " <comment><USER2> It's fine now (5:31pm East Coast USA), but here's the status page...

        TODAY – MAJOR INTERRUPTION OCCURRED

        01:54 PM PST
        Heartbeat misfired and took the database offline. We're
        investigating to make sure it doesn't happen again.

        01:47 PM PST
        Site is unavailable. We're researching the issue.

</comment><comment><USER3> Fine for me, 5:03PM EST</comment>


Ask HN: How to plan the optimal route for a moving van? - <AUTHOR>

This might be a bit weird for HN, but I thought it posed a good hacker challenge :)
I'm moving from Phoenix, AZ to Seattle, WA next week. I'm driving my own 24' moving van (with car in-tow).
I'm trying to figure out what the optimal route is for this van. I want to minimize elevation changes, exposure to inclement weather, and overall driving pressure (e.g. narrow/fewer lanes, road curvature, etc).
There are the 3 primary routes one could take to make this trip:
1. I-5. (via Los Angeles) (http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=Fblh_gEdy-JR-SnLeaFQ7RIrhzGsG0o1-MdpjA%3BFX77WwIdaji3-CnBgh2LcQODgDEp8DhLJVAWYw%3BFcJp1gIdWVy1-ClVM-iTLBCQVDGa1URpRmUlEA&q=phoenix,+az+to+seattle,+wa&sll=40.446947,-117.246094&sspn=20.730412,46.538086&ie=UTF8&ll=40.513799,-117.202148&spn=20.710218,46.538086&t=h&z=5&saddr=phoenix,+az&daddr=39.5825903,-122.210198+to:seattle,+wa&via=1)  I've done this drive at least half a dozen times (in a car). Things are fine (if boring) until Northern California and Oregon, when you really start to get into a lot of elevation changes. And in northern Oregon (Portland area), I inevitably seem to get caught in a combo of rain + chewed up highway that I don't think I'd like to navigate very much in a 24' truck with car in tow.
2. I-84. (via Salt Lake City) (http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=Fblh_gEdy-JR-SnLeaFQ7RIrhzGsG0o1-MdpjA%3BFcm_bQId53NU-Skb8Pps3_RShzG650FYs2ragw%3BFcJp1gIdWVy1-ClVM-iTLBCQVDGa1URpRmUlEA&q=phoenix,+az+to+seattle,+wa&sll=37.0625,-95.677068&sspn=43.037246,93.076172&ie=UTF8&ll=40.446947,-117.246094&spn=20.730412,46.538086&t=h&z=5&saddr=phoenix,+az&daddr=40.7469536,-111.9058178+to:seattle,+wa&via=1) I've done this drive once in a car in the opposite direction. It felt flatter than drive #1, but you'd never know it judging by the terrain the route takes you over. So maybe it was my imagination?
3. US-93 and I-84 (via Las Vegas) (http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=Fblh_gEdy-JR-SnLeaFQ7RIrhzGsG0o1-MdpjA%3BFcJp1gIdWVy1-ClVM-iTLBCQVDGa1URpRmUlEA&q=phoenix,+az+to+seattle,+wa&sll=40.513799,-117.202148&sspn=20.710218,46.538086&ie=UTF8&t=h&z=5&saddr=phoenix,+az&daddr=seattle,+wa) Never done this route before. It's the default suggested Google route.
So does anyone have any heuristics or insight into what the best route for this 24' truck would be? <comment><USER2> I would go with 3. Definitely flatter than 1 and comparable to two. Not the prettiest drive but some of it's nice. You are sticking to interstates so driving pressures should be minimal.

I-5 has a lot of elevation changes, it also takes you through the most traffic..</comment>


Web 2.0 Bubble - <AUTHOR> http://blog.bincsearch.com/?p=383

<comment><USER2> "So candidates working for these companies have to be wearing a nice sized grin on their face knowing they are working for a company with clear strength and sustainability."

Assuming that what you're looking for is a steady job with no real promise of a liquidity event. I'd think that going to work for a BigCo would give you that (and probably pay you more). And probably more interesting, exciting, and look better on a resume than being employee 100+ at a startup that's battening down for "nuclear winter."</comment>


Ways to Fool the Masses Giving Performance Results on Vector Computers (1991) - <AUTHOR> http://www.johngustafson.net/fun/fool.html <comment><USER3> I'd never heard of him. He's done a lot of interesting stuff, mostly in high performance computing. From his personal page:

"Gustafson has recently finished writing a book, _The End of Error: Unum Computing_ , that presents a new approach to computer arithmetic: the unum. The universal number, or unum format, encompasses all IEEE floating-point formats as well as fixed-point and exact integer arithmetic. This approach obtains more accurate answers than floating-point arithmetic yet uses fewer bits in many cases, saving memory, bandwidth, energy, and power."

Has anybody read it?

[https://www.amazon.com/dp/1482239868](https://www.amazon.com/dp/1482239868)

<comment><USER4> Among other things he is famous for what came to be called Gustafson's law:

[http://www.johngustafson.net/pubs/pub13/amdahl.htm](http://www.johngustafson.net/pubs/pub13/amdahl.htm)

"Speedup should be measured by scaling the problem to the number of processors, not fixing problem size"

</comment></comment><comment> mark-r Too bad Seymour Cray is no longer around to pick on, or to inspire.

I was lucky enough to tour the Chippewa Falls facility early on - <USER2> number 5 of the Cray-1 was undergoing final tests before delivery.

We were lucky enough to see Seymour in his office. He pointed to a pumpkin on his desk, and declared that it was the Cray-3. His daughter had grown it, and since she knew he was already working on a Cray-2, she decided this would be the Cray-3.

</comment><comment><USER5> What's the anecdote about buying a sailboat every year a reference to?

<comment><USER6> Burning it, actually. It's a legend about how Seymour Cray would design and build a sailboat every year only to burn it afterward, so he could design a better one, or something like that.</comment></comment>


Yammer Takes Top Prize At TechCrunch50  - <AUTHOR> http://www.techcrunch.com/2008/09/10/yammer-takes-techcrunch50s-top-prize/ <comment><USER2> Last year's mint was actually revolutionary, yammer seems like a twitter clone for a small niche...is this really the best company of the thousands of start ups that submitted? There must be really a lot of crap out there if this is the most innovative startup

</comment><comment><USER3> <http://news.ycombinator.com/item?id=301030></comment>


BlackBerry to turn BBM secure-messaging system into subscription service - <AUTHOR> http://www.theglobeandmail.com/technology/blackberry-to-turn-bbm-system-into-subscription-service/article33945300/ <comment><USER2> This would have been brilliant 10 years ago. If BBM was open to non- blackberries, it could have killed WhatsApp before it began. It's weird to think of how popular Blackberries & BBM was back in the day. I was in high school in 2007, and it was cool to have a Blackberry. BBM was how people communicated with their crushes. If Blackberry had the vision, they could have preempted much of the current craze for social messaging.

Of course, hindsight is 20/20, and it's entirely possible that opening BBM up would have radically cannibalized Blackberry sales.

The article's comparison to Twilio is interesting. Twilio's market cap is 2.64B [1], while Blackberry's is 3.84B [2]. I'd bet heavily that Twilio overtakes Blackberry soon.

[1]: [https://ycharts.com/companies/TWLO/market_cap](https://ycharts.com/companies/TWLO/market_cap)

[2]: [https://ycharts.com/companies/BBRY/market_cap](https://ycharts.com/companies/BBRY/market_cap)

<comment><USER3> So many established players blew it on messaging. Microsoft could've had WhatsApp if they used their decade head-start to make Skype not suck so much. Google could've had it if they stopped rebooting their messaging strategy completely once a year and just stuck with something for a change (my vote would've been for Wave, but just pick _some_ thing). Apple could've had it with iMessage if they didn't stick to the iPhone strategy tax. None of them saw how important it would be and are now scrambling to catch up.

<comment><USER2> Also, Slack- if Lync wasn't as brutal to use, Microsoft would have stopped Slack dead.

<comment><USER4> That's like comparing manure to apples.

Lynch was an abomination to support, it was billed as a kind of a sip client and messenger combo but of course they Microsofted it. They didn't want an extension or phone number tied to it so people could only call you if you were in the same network and had the software installed.

</comment></comment></comment></comment><comment><USER5> Highlights from the article:

> BlackBerry Ltd. is preparing to turn its once-proprietary BBM secure- > messaging system into a subscription service that app developers can build > into their software to allow for seamless, encrypted communications.

> Developers who deploy the BBM SDK will be asked to generate their own > encryption keys, meaning BlackBerry will not have the ability to turn over > to law enforcement any messages sent through this system, even if compelled > by a court order.

Essentially it appears that they are turning it into a Secure Messaging As A Service so that people can quickly add messaging into their apps without requiring the infrastructure.

<comment><USER6> > Developers who deploy the BBM SDK will be asked to generate their own > encryption keys, meaning BlackBerry will not have the ability to turn over > to law enforcement any messages sent through this system, even if compelled > by a court order.

Doesn't the entire security of BBM rely only on a very short code, one which Blackberry can easily swap with a different key which they posses in practice? Very similar to Apple iMessage.

Also last time I checked their enterprise offering was essentially static Triple DES key only - is their public offering any better?

EDIT: [https://www.schneier.com/blog/archives/2016/04/blackberrys_g...](https://www.schneier.com/blog/archives/2016/04/blackberrys_glo.html)

Looks like as of last year they used a single static key for all the BBM encryption. And it's in the hands of Canadian authorities already.

Do we have any reason to believe they have or will change this? Seems completely silly to me to use something this broken.

<comment><USER7> Even a company with as many blunders as BlackBerry must know that publicly saying it can't be decrypted, when in fact it could easily be decrypted, would be a terrible blow to the product.

<comment><USER6> Yeah, seems fairly ridiculous given how much they push being a security company. Apparently hard-coded 3DES key that anyone can reverse engineer = security.

I'm tempted to pop their Android app up in IDA and see if it's really as bad as it sounds.

</comment></comment></comment></comment><comment><USER8> > _At its peak ... encrypted e-mail and messaging system was the gold standard > for security for enterprise and government customers, providing secure > access for as many as 90 million users._

Until they gave in to some government's demands and showed that they could not trusted.

This seems, to me, to be one last "hail Mary" attempt to save the company. Blackberry (RIM) was at the top of the "smartphone" industry 10-15 years ago. It's too bad they couldn't adapt and stay relevant. I'd still happily be using my 8830 if I could.

</comment><comment><USER9> For everyone on this thread saying "They should have done this years ago", they tried to. As early as 2010 some in the company knew that BBM could be huge as an independent. Then CEO Jim Balsilie spent 2011 trying to bring Mike Lazaridis (co-CEO; good decision!) and his team around the to idea of a cross- platform BBM, but they were dealing with the fallout from the BB Playbook failure around that time as well as significant PR issues due to BES server outages and public disclosure about providing the Indian and UAE governments access to BBM logs (or something like that).

Lazaridis primarily didn't want to separate hardware and software, so he focused on building BB10 to compete with iOS/Android. Ballsilie resigned from the company in 2012 after the new CEO Thorsten Heins dumped the x-platform BBM and put all their energies into the launch of the already-doomed BB10 phones in 2013.

More here: [http://www.theglobeandmail.com/report-on-business/the- inside...](http://www.theglobeandmail.com/report-on-business/the-inside-story- of-why-blackberry-is-failing/article14563602/?page=all)

A good book about the history of BB is "Losing the Signal". Covers the company up to around 2013.

</comment><comment><USER10> BaaS - backdoor as a service:

[http://www.bbc.com/news/technology-23265091](http://www.bbc.com/news/technology-23265091)

[https://motherboard.vice.com/en_us/article/rcmp- blackberry-p...](https://motherboard.vice.com/en_us/article/rcmp-blackberry- project-clemenza-global-encryption-key-canada)

</comment><comment><USER11> Hmm. Are they going to roll over and provide decryption keys for their secure service as they did previously?

</comment><comment><USER12> This is a big deal! ...although yes very late in the game. Like it or not corporate buyers like brand names. Back in the day the saying was "no gets fired for buying IBM." Blackberry has a brand in secure enterprise communication and this will sell.

</comment><comment><USER6> Headline is a bit misleading - it's subscription for developers using their API only, not for users.

</comment><comment><USER13> It is hard to trust Blackberry anymore. I had their phone and loved it until they started selling crappy phones for iphone's cost.

No matter how awesome this service might be I am worried if BB would actually last long enough to provide it.

</comment><comment><USER14> aka Signal, but more meh?

<comment><USER15> Pretty much, might as well use the Signal Server API or OMEMO depending on what your trying to do.

<comment><USER16> Except since it's paid, you'd get an SLA.

<comment><USER17> I paid for WhatsApp and didn't get an SLA

</comment></comment></comment></comment><comment><USER18> BBM is not secure. Why would anyone use it?

<comment><USER19> BBM enterprise is different.</comment></comment>


Deep Inside: A Study of 10,000 Pornstars and Their Careers - <AUTHOR> http://jonmillward.com/blog/studies/deep-inside-a-study-of-10000-porn-stars/ <comment><USER2> Honestly, I'm offended. How could any man spend such time so deep in such filth? I understand that people gotta do what they gotta do, but really: _Excel_?

<comment><USER3> Offended? It's about time somebody brought some order in to that chaotic world. He shows a lot of assumptions are actually just that: assumptions not backed up by facts. Now we know. And why would someone seeking knowlegde offend you? Were you forced at gunpoint to click the link? Or do you feel uncomfortable discussing sex-related topics? Well, most people do and thats what brings us back to those _assumptions_ other people use to create official policy.

<comment><USER4> The post you replied to is so, so short, yet you couldn't even be bothered to the end of it, preferring to react to the first few words. Scary.

However, I must thank you because I think you just demonstrated why western society is such a complete mess better than anything I have previously read or seen. A hair trigger reaction with out even bothering to consume the point, let alone understand it. And how could you understand it, you didn't even read it? The sad thing is that you're not even giving yourself a chance.

And that is leaving aside the sheer blinding irony of you criticising people for making assumptions.

<comment><USER3> What? A hariy trigger? No, not quite. I did read it, but simply didn't understand his joke. Doens't happen to me a lot but than again _English is not my main language, Dutch is_ and it's easy to misread a short joke in another language.

Like I stated: I read it as if he was upset because OP _excelled at this kind of research_.

Like the dictionary: ex·cel , ex·celled, ex·cel·ling. verb (used without object) to surpass others or be superior in some respect or area; do extremely well: to excel in math.

Do you really think I would have reached over a 1000 karma if I had a hairy trigger? Oh, well, I do find it funny you're criticising me for making assumptions.

<comment><USER5> > it's easy to misread a short joke in another language

Perhaps you should approach _reading_ other people's English with the same caution and lenience you're asking of _your_ readers?

I'll also state the obvious: your excuse lacks grammatical support. You were wrong, move on and stop making a scene.

<comment><USER3> There's no reasoning with you. I'll leave the history of all my comments here as well as my twitter updates with the same name speak for me.

<comment><USER6> I think this conversation already does...

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> This is certainly an interesting study, but I can't help being seriously disappointed by this part:

 _Sometimes when I hear people railing against porn, declaring it as the downfall of society, a poison infecting masculine minds and demeaning female ones, I wonder what kind of porn they're talking about.

[...]

So when I hear somebody claim that porn is 'degrading', I can't help but ask: which porn?_

If you think most porn isn't degrading, then you need to look a bit closer and think a little harder. I've already posted my views [1], but I'll copy & paste the relevant part here:

 _First of all, there's very little porn out there where the woman truly enjoys the experience. It's not always glaringly obvious (although we'll get back to that in the next point), but if you actually stop and look, you'll see the discomfort and/or indifference very often.

Second, a lot of porn out there focuses on and glorifies the woman's suffering, pain and degradation. Seriously, you only have to read the word "painal" once to realize that. However, if that's not enough, you might also look for the occurrences of "choke", "gag", "destroy", "slut", etc.

Third, even the porn that doesn't focus on pain teaches wrong stuff. One might get the idea that the only thing a man need do to make a woman enjoy sex is to pound her fast and hard. On top of that comes the whole issue of hygiene: the way anal is portrayed means that if you try it at home, your female partner will likely end up with an infection.

Fourth, it creates unrealistic expectations. Let's just say that gag reflex is not as easy to suppress as the porn makes you believe and that anal sex is not a matter of just sliding in any time you want.

TL;DR: No, it's not just about whether the sex if fun or boring._

Finally, I find the claim that "female porn stars dictate the type of sex they have by listing in their modelling profiles the acts they're willing to perform on camera" to be disingenuous. It propagates the idea that everything is okay and whatever isn't okay is "her fault".

[1]: <http://news.ycombinator.com/item?id=4499803>

EDIT: Since I'm obviously not trolling, I was wondering whether anyone could help explain the drive-by downvoting. I don't expect everyone to agree, but it might be nicer to have a discussion than to suppress it ;)

<comment><USER8> > Second, a lot of porn out there focuses on and glorifies the woman's > suffering, pain and degradation. Seriously, you only have to read the word > "painal" once to realize that. However, if that's not enough, you might also > look for the occurrences of "choke", "gag", "destroy", "slut", etc.

I might be mistaken here, but as far as I can tell this kind of porn is the minority. Also, isn't this 'degrading porn' meant for people who identify with the person being degraded? Whether you like it or not, the power dynamic is an integral part of human sexuality. That you see this in porn is just an effect of the phenomenon, not the cause. It's completely natural and benign. People saying that this is "wrong" and taboo are doing far more harm than good to the women and men (!) who enjoy being on that side of the power dynamic.

Secondly, porn isn't meant to be realistic. Complaining about that is just like the people complaining about violence in video games and movies. People are perfectly capable of distinguishing reality from fiction. The reason people enjoy porn is _exactly_ because it is not realistic -- it satisfies a fantasy, whether that is sex with a person who is far out of your league, or rough sex, or otherwise. The way to go here is to improve sex education, not to blame porn for not being sex education.

<comment><USER9> >I might be mistaken here, but as far as I can tell this kind of porn is the minority. Also, isn't this 'degrading porn' meant for people who identify with the person being degraded?

I've dated women (note the plural) who were into this sort of porn. I'm not a random sample, obviously, but take a look at books like _A Billion Wicked Thoughts_ and _The Evolutionary Biology of Human Female Sexuality_ , or Meredith Chivers' work: bdsm-style desires appear to be more common than is commonly depicted in the media.

<comment><USER5> I'm skeptical of your claim which implies that this type of porn is predominantly marketed to and consumed by women.

<comment><USER10> I think your misreading the comment. It's a classic case of rule 34 somewhere someone is into this crap and it you don't need a lot of customers to make money with porn. I mean being eaten by alive is a fetish vore. <http://www.urbandictionary.com/define.php?term=vore>

</comment></comment></comment></comment></comment><comment><USER11> > one thing's for sure: most women don't quit after one film—in fact, the > majority (at least 53%) do three or more.

Well, I guess that depends on how accurate the database is. To the extent that it might miss performers, it would certainly be biased towards those who have fewer credits, or whose credits are for smaller outfits.

<comment><USER12> Another confounding factor: there's a decent volume of shovelware movies that consist of non-original scenes edited together, like a mash-up tape. I would not be surprised to discover that one scene results in three credited appearances on average.

<comment><USER13> They flag compilations on iafd. Let's pretend they mentioned that in the article somewhere and I didn't just happen to know.

</comment></comment></comment><comment><USER14> I foresee sex work (so, porn , prostitution , "cam whoring") being huge business over the coming years (ok, it's already huge, but I mean even huger) and losing a lot of it's stigma.

Here in the UK where prostitution is legal there already exists websites where people can basically browse online directories for various sexual services.

Combine high employment with women realising that they can make a solid 4 figures a week by working < 8 hours a day with the male tendency to "seek variety".

It's only a matter of time before some business manages to take advantage of this on a huge scale.

<comment><USER15> As a UK resident, I had no idea prostitution was legal. Wikipedia says: In the United Kingdom, prostitution itself (the exchange of sexual services for money) is not a crime,[2] but a number of related activities, including soliciting in a public place, kerb crawling, owning or managing a brothel, pimping and pandering, are crimes.

So how exactly does prostitution work? It seems like it is effectively illegal.

<comment><USER14> AFAIK it is legal as long as the prostitute is effectively self employed (so not working for a pimp or brothel) and not selling services on the street, and of course over 18. This is where the internet comes in.

There is a certain website known for this which I will not link to here.

<comment><USER16> Nope, advertising online (or anywhere else) is illegal (offering sexual services for money). Pretty much the only time its legal is if two adults who have otherwise met come to a spontaneous agreement to have sex for money. E.g. if a friend says to me "I need £500 to pay my rent" and I say "how about I pay that for you and you have sex with me". Just to be clear, thats never happened to me. I don't have £500 spare...:)

<comment><USER14> As far as I can tell the advertising is only illegal if it is in what constitutes a "public place". IANAL but I doubt that a privately owned website would count as such and if it is illegal it doesn't appear to be enforced at all.

Women who work as prostitutes will usually pay taxes as self employed people and can actually claim advertising (as well as various other things that are best left to the imagination) back as business expenses.

<comment><USER16> A privately owned website that is generally available to the public most certainly does constitute a public place (in the same way that standing in a pub saying "who fancies a shag for £50" wouldn't get you off the hook. If you're soliciting TO the public, it doesn't matter where you are "standing".

Escorts pay tax and deduct expenses for the "Escorting" work they do, not the sex. If they declare the income as income for sex, the police quickly come knocking to arrest you for "living off immoral earnings" (a few have done so in the past as a "protest").

<comment><USER14> It is only an offence to live off the immoral earnings of others, not your own.

"Public place" includes any highway and any other premises or place to which at the material time the public have or are permitted to havea ccess, whether on payment or otherwise ".

I wouldn't think a website constitutes a "place" under such a definition. Otherwise posting a picture of your genitals on a website could be viewed as indecent exposure, though IANAL.

<comment><USER17> Yeah, one sex worker rights activists described the approach politicians take to prostitution as "they don't criminalise us, they just criminalise everyone around us". So if a woman dares to have sex for money whilst living with a partner or with a teenage kid over about 12-14, their partner or kid can be arrested for living on immoral earnings. (Some other countries are even worse; apparently in Sweden landlords risk being arrested if they don't kick out sex workers renting from them upon discovering their line of work because it's illegal to make money from them full stop.)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> I would be really interested to see statistics about the differences to the rest of society. On maps of e.g. the birthplace/hair/color/... I'd be more interested in the deviation from national averages.

A lot of people are born in big cities, so a lot of pornstars will be born in big cities. I'd be interested to see which cities have a disproportionally low/high number.

Even with the hair color, I'm wondering what the deviation from the national averages looks like.

p.s. obligatory xkcd: <http://xkcd.com/1138/>

<comment><USER19> On the xkcd thing, meh. If your users map is similar to a population map, then it means you're appealing to a broad slice of the population. If it's centred in one area, that means you're not appealing outside that area. There's nothing wrong with such a map if it's interpreted correctly.

<comment><USER20> > If your users map is similar to a population map, then it means you're > appealing to a broad slice of the population.

Er, no, it just means there's no geographic component to your appeal within the limits of the map. Could be a very narrow slice, but even distributed in population.

<comment><USER19> I think we mean the same thing, but are describing it differently. Certainly what you're mentioning is information in itself, not 'no information'.

Of course, this doesn't mean it shouldn't be a pet peeve, just that being a peeve doesn't mean it's actually wrong or misleading, just that it's annoying to the... erm... 'peevee'?

</comment></comment></comment></comment><comment><USER21> As always, the regional heat map is useless... [http://jonmillward.com/blog/wp- content/uploads/2013/02/porn-...](http://jonmillward.com/blog/wp- content/uploads/2013/02/porn-star-birth-places-large.png)

Luckily there is a relevant xkcd: <http://xkcd.com/1138/>

<comment><USER22> I'm surprised more people aren't working on alternate heatmap visualizations, it doesn't seem like an incredibly hard problem to me.

<comment><USER23> It is a hard problem. You could, for instance, divide by population to get a rate instead of an absolute number -- but then rural areas would have all the hotspots. Why? Because in areas with small samples, you're bound to get more variation and noise, so all the extremes will occur in areas where there are few people.

There are ways to adjust for that, but basically, you can't win:

[http://www.stat.columbia.edu/~gelman/research/published/allm...](http://www.stat.columbia.edu/~gelman/research/published/allmaps.pdf)

</comment></comment></comment><comment><USER24> I would love this level of study of bankers. 10,000 bankers and their careers. HSBC drug cartel bankers get extra points.

[http://www.rollingstone.com/politics/news/gangster- bankers-t...](http://www.rollingstone.com/politics/news/gangster-bankers-too- big-to-jail-20130214?link=mostpopular1)

</comment><comment><USER25> This guys other articles are really good too. He has a couple on escorts that are really interesting. The article he has on the last words of inmates being put to death is absolutely fascinating and incredibly saddening.

</comment><comment><USER26> >> If you think that's bad, you haven't heard the half of it. Another reviewer mentioned being able to taste the dry saliva of a previous punter on the escort's nipple while he sucked it

O...M...G...

Edit: there is something, levelling, and humanising about the sheer unexpectedness of this. Plus no showering in between clients, nope going back to OMG

</comment><comment><USER27> Text-only Google cache version:

[http://webcache.googleusercontent.com/search?q=cache:http://...](http://webcache.googleusercontent.com/search?q=cache:http://jonmillward.com/blog/studies/deep- inside-a-study-of-10000-porn-stars/&hl=en&tbo=d&strip=1)

</comment><comment><USER28> Cool analytical approach to an interesting data set. I wish there was a better way to see income for films, how they enter the business, and where do they end up after. I realize this is in practice and for privacy reasons this is nearly impossible to get.

</comment><comment><USER29> Interesting. But I think there might be porn even outside the U.S., who knew?

</comment><comment><USER30> So....can we get that data for download?

<comment><USER31> > An expanded report of this article that covers the methodologies and full > results of the analysis will be available for free very soon. If you're a > journalist or blogger and would like early access to the PDF, or if you'd > like to go on the list of people who will receive it by email, please > contact me via this form.

For this and the sidebar, I'd guess he's an analyst for hire - sharing the raw data would let people scoop him. If you want the data, you can always scrape the IAFD yourself...

</comment></comment><comment><USER32> Unnecessarily evocative title

</comment><comment><USER33> It gives me a 404. Damn!

</comment><comment><USER34> Getting 404 and "Powered By LiteSpeed Web Server".. what's this?

<comment><USER35> Quite reminiscing to last time when a guy put the vagina-hacking link on HN...every time when something about porn posted here, the website would be DoS'ed in hours, almost without exception...perhaps next time we should at least have the courtesy to notify the author to mirror the site before we link it on HN...

</comment></comment><comment><USER36> Useless but in parts well designed work of an addict.

</comment><comment><USER37> Deep inside, heu heu heu...</comment>


Ask HN: Halloween Costume Ideas - <AUTHOR>

Trying to think of a witty halloween costume idea, any funny/witty/pithy/punny ideas? <comment><USER2> You could get two other friends and be rock, paper, scissors. Then go around battling each other with character driven dialog. For example, if you're rock and you fight paper and lose, you would scream, "Why does this keep happening?! What does he have that I don't have?!?!"</comment>


Implementing map / reduce functions using PHP 5.3's lambdas - <AUTHOR> http://www.recessframework.org/page/map-reduce-anonymous-functions-lambdas-php

<comment><USER2> And they say Perl is executable line noise...

<comment><USER3> What? If anything, people have criticized PHP on being too verbose, and this article tends to continue in that trend.

Still, I loved it. It took a second to "get" what he was doing with all that recursion, and then I fell even more in love it it. I can't wait to start mucking about with all that stuff.</comment></comment>


Show HN: Automate Multiple RSS Feeds in Mailchimp Newsletters - <AUTHOR> https://fliprss.com <comment><AUTHOR> We've just launched the public beta of FlipRSS and would welcome any feedback on the website, brand and product.

It's been a fun 4 week project based on the needs of a client and it's been great to ship beta.</comment>


"Screw it, I'll make my own" – The story of a new programming language - <AUTHOR> http://breuleux.net/blog/my-own-language.html <comment><USER2> Quite Interesting.</comment>