Ask HN: My team's been invited to San Francisco, I'm still working on my degree - <AUTHOR>

I'm based in Sheffield, UK, in my 3rd year of my 4 year physics degree. I've been working on a software product with a small group of friends over the course of a few hackathons and it's very quickly gained some attention - we were offered free accommodation and mentoring in S.F. for three months (food & plane flights would be covered by us), as well as other similar offers in London (from a business who is interested in the product). I'm amazed by these offerers, given the product is still in the mockup phase.
The team, who have completed their degrees is ecstatic and planning to go at this full time starting asap. Since we have no money between us we'd have to take on paid work whilst building enough money to survive the 3 months in S.F.
I'm keen on trying to take a year out of uni, leaving sometime before christmas or after January - if it can be arranged with the university, but everyone who I ask seems to think this is a terrible idea. (Not least because I would be stuck with a visitors visa if I didn't have a degree). It's possible take a year out starting in the summer, but the team are quite opposed to this plan.
By staying at university am I passing up a really rare opportunity? Success or fail, would employers view this as a positive move or a reckless one? <comment><USER2> First of all, whether you are at Uni or Hallam, from a University of Sheffield Alumnus: Congratulations, it sounds like you're doing well :)

It's hard to say, really. If the university lets you take a bit of time out after January, that seems like the best thing to do - less risk, and you can still finish your degree if it doesn't work out there. It would be a shame to have to wait until summer, but on the other hand, if that is the only thing you can do it would be a real shame to pass up your degree after going so far, unless you are _completely_ sure that this is what you want.

Ultimately, that's what it is about: if you want to finish your degree, you finish it and let your friends go over there somehow for three months, while you help them out remotely. If at the end of that, there's potential for more than just mentorship and free accommodation, then reconsider.

But, if this product you've developed is something you are really, really keen on and think has a very bright future it could be the right thing to do.

Finally, make sure that whatever you do, you're doing it for the right reasons. Giving up your degree in the UK is a big sacrifice to go to SF for three months just to have fun and experience life in Silicon Valley. Going to London may not be as glamorous but I assure you, there's plenty of fun stuff to do down here and lots of clever people who you could work with.

Best of luck with your decision. Please, tell us more about the product as soon as you can :)

<comment><AUTHOR> Thanks basicallydan :), it's great to see find someone else from Sheffield on HN.

That's a good way of framing it - I was hung up on the amount of time that would be need to be spent just to be able to support ourselves for 3 months in S.F., but staying at uni for this year and working remotely over the summer - whilst the others are in S.F. would mean I could determine if the project has potential without risking the degree.

Edit: I've just spotted your front page post - its very inspring! I couldn't wish you better luck

<comment><USER2> Thanks, haxiomic.

I hope my comment helped. It's good to take a step back and look at this in the grand scheme of things - there is no need to panic :) Best of luck with it all!

</comment></comment></comment><comment><USER3> 1\. Unless the offer is from an absolutely top known incubator, VC or other org, do research on the institution. Make sure the offer is really as good as you think. Most of all, make sure the mentoring and connections are really as good as you think. Everybody and their grandmother is an incubator in the valley these days so check up on their reputation.

2\. Verify you can in fact work legally on anything other than what you came to the US for. Short term visas are quite restrictive and if you are here with a visitor's visa, then you for sure can't make an income.

</comment><comment><USER4> It really depends on who is offering the mentoring. "Free housing and mentoring" doesn't sound that compelling unless it's someone you're convinced will add significant value to your company through mentoring. Which should then make you question - why are they offering it for free?

</comment><comment><USER5> I finished my engineering degree after taking 2 years off. All companies are looking for is you have the degree. people do internships all the time, really not much different. Industry experience looks good on a resume. Jusr make sure you have a chunk of the company.</comment>


Why is data stored on a NAND chip irretrievable if cracked? - <AUTHOR> https://electronics.stackexchange.com/questions/106474/why-is-data-stored-on-a-nand-chip-irretrievable-if-cracked <comment><USER2> The DOD has equipment and processes to do this. The hardware and know how are the big costs, so maybe it costs $100m for the capability and $100k every time they need to do it. It is generally impossible for normal people or organizations to have so much value on one chip for them to incur the cost of the investment.</comment>


Ways to save American education - <AUTHOR> http://www.washingtonpost.com/local/education/5-ways-to-save-american-education/2011/12/14/gIQAlwbeuO_story.html

<comment><AUTHOR> I think a suggestion that could tie into Marc Tucker's suggestion "raise teacher compensation significantly" is to take administrative steps, state by state, district by district, and school by school, to make sure that the inevitable churn in the staffing of schools, as teachers move or cease working as teachers, churns out the worst teachers and keeps in the best teachers. A thoughtful researcher who has been looking at education policy reform even longer than Tucker suggests that it would be possible each year, year after year after year, to persuade the bottom 5 percent of teachers to seek other occupations,

[http://edpro.stanford.edu/hanushek/admin/pages/files/uploads...](http://edpro.stanford.edu/hanushek/admin/pages/files/uploads/Hanushek%202009%20CNTP%20ch%208.pdf)

and that the cumulative effect of this reform over time would raise United States student achievement to the peak level reached by any country. This would also, it seems to me, do much to add to the social respect enjoyed by teachers and would probably improve public support for public schools in general.

<comment><USER2> Wouldn't the increased competition fomented by increased wages take care of this naturally and organically?

<comment><USER3> Absolutely. Churning the bottom 5% would be an exercise in destruction, low morale, and worsening a bad situation. Get quality in the front door rather than trying to shuffle people out the back.

<comment><USER2> It seems likely to also organically change teachers' unions for the better, too. Unions filled with better and more motivated teachers will want policies that protect better and more motivated teachers.

As it is now unions filled with bad teachers* will favor policies that protect bad teachers. Vicious cycle.

* Not that most or even many teachers are bad, but the bad ones are probably the most afraid for their jobs, and therefore most active in union politics.

</comment></comment></comment></comment><comment><USER4> The one thing I always wonder about these stories is if they are true why haven't we in the United States been surpassed? The first time I remember hearing about Finland's education system was 5th grade yet I'm in my early 30s and Finland hasn't moved up much. They still has a much lower GDP per Capita. I can't remember the last time I heard of a major breakthrough coming out of Finland. Other than Nokia I can't think of any other worldwide companies founded in Finland.

I don't mean to bash Finland which is a truly amazing place (no sarcasm, it really is). But at the same time a big problem in education is the scale tends to get clouded. No Child Left Behind's epic failure is a testament to that. Isn't it at least possible that Finish schools also "teach to the test" especially considering they test their students so rarely?

Before we increase class size, abandon charter schools and slow down efforts to integrate more technology into classrooms in favor of higher teacher salaries I'd like to see much more research done in this area.

<comment><AUTHOR> _The one thing I always wonder about these stories is if they are true why haven't we in the United States been surpassed?_

The United States has been surpassed in economic growth rate by many countries. The United States continues to gain by admitting as immigrants many highly capable persons who received their primary and secondary educations in other countries, and there are whole industries in the United States where much of the innovation and high quality comes from people with educational backgrounds like that.

</comment></comment><comment><USER5> I don't think the US education system is as bad as everyone says. I think the metric that we use to judge our system against other countries is not accurate. The US has had a high level of economic activity and innovation for decades. I think that points to a strong education system.

I think recent attempts to make our system more like Asian systems (more homework, more testing...) will do more harm than good.

There is progress to be made, but I think trying to mimic other countries education systems is the wrong approach.

<comment><AUTHOR> _The US has had a high level of economic activity and innovation for decades. I think that points to a strong education system._

There is no denying that the United States is a largely prosperous, innovative, and peaceful place. This was true of the United States before school attendance was compulsory in any state, when many states made no effort generally to fund schools for all learners, and it is still true today. This is a legacy of founders of the United States who themselves largely learned without a public school system.

<http://learninfreedom.org/Founders_free.html>

Today, the United States still benefits economically in comparison to other countries because of a more honest and transparent system of governance and business regulation

[http://www.transparency.org/policy_research/surveys_indices/...](http://www.transparency.org/policy_research/surveys_indices/cpi/2010)

and because of general freedom in United States society.

<http://www.freedomhouse.org/template.cfm?page=15>

While K-12 schooling continues to be one of the top three state budget line items in many states (it is number one in mine) there will be legitimate concern about whether those hundreds of billions of dollars a year

<http://nces.ed.gov/fastfacts/display.asp?id=66>

are being spent with the best effect they can. Having lived in another country for six years (and having brought up children there during the second of two three-year stays), and knowing many first-generation immigrants, I don't think it goes beyond the facts to say that the United States has a thing or two it could learn from administration of public schools in other countries, just as those other countries could in several cases learn from United States governance. It's best for all countries all around the world to be open to information first learned in some other country.

</comment></comment><comment><USER6> The US education system benefited for a long period where many incredibly smart women had career options basically limited to teaching and nursing. As equality improved, some of the brightest prospective teachers instead became doctors, scientists, and engineers. This decrease in teacher quality is resulting in a more "assembly line" style of education, where each step is fully structured. I have seen anecdotal evidence of highly qualified teachers exiting the workforce because the structure of the work has become unfulfilling.

I suspect there are also incentives for top performers to move out of education and into administration.

</comment><comment><USER7> I'm a Brit here to say that any assertion about the state of American education ought to include consideration of _video games_ , many of which come from the US.

Games are, after all, highly educational. They represent an environment with three attributes:

(1) choice, (2) rapid feedback, (3) safety (you don't get punished for making mistakes, academic or social).

Note that all of these are crucial in the business of making and correcting errors, which is what learning is all about.

</comment><comment><USER8> Where does he come up with the percent chances of these passing? Is this just assigning a number to whatever the author feels like inorder to fake some sense of credibility?

</comment><comment><USER9> 6\. Allow students significantly more self- and group-led teaching; especially with the rise in video lectures (a la Khan Academy, etc).

7\. Have bright students from higher grades teach bright students from lower grades.

8\. Embrace, rather than try to diminish, the natural bell curve of student performance and abilities--let students fall behind, and teach them the most critical skills before everything else. Who cares if you can recite the Gettysburg Address if you can't do basic reading an arithmetic. Let students get ahead; and don't burden them with arbitrary amounts of homework simply because they can do it faster; shove hard-to-learn things down their eager minds.

<comment><USER10> Regarding #7: Why? I would have absolutely hated that in school. How does having a kid who's good at Algebra teaching a younger kid who's not so good at Algebra help the kid who's good at all?

If he's already good at it, teaching it shouldn't help him that much, and now he's wasted time he could be using to learn more things himself (see your own #6).

<comment><USER11> > _I would have absolutely hated that in school._

Agreed. I was the smart kid on the high school football team, so I was tasked by the coach to tutor some of my lesser-performing teammates and it was an absolutely miserable experience.

<comment><USER9> Right; but what if you were tasked with spending time with 'the smart kid' from 3 years below you? That is an entirely different experience.

I would not want smart kids wasting their time with dull kids; but smart older kids imparting their wisdom on smart younger kids (where it won't be wasted)

</comment></comment></comment></comment><comment><USER12> Terrible recommendations.</comment>


New Yorkers are massively coworking in the aftermath of Sandy - <AUTHOR> http://coworfing.tumblr.com/post/34788227621/new-yorkers-are-massively-coworfing-in-the-aftermath-of

<comment><USER2> It reminds me of this guy from Germany who told us that nomad workers are only abusing other people places...</comment>


Ask HN: Social Networks as Informational Hunger Companions 2 - <AUTHOR>

Social networks strive to unite and connect us, but they pay no attention to the fact that we are different. The newly made services like Medium.com (from the founders of Twitter) and Branch.com try to resolve this issue, but their future is obscure yet. The most popular topics we share with each other refer to the entertainment sphere (and we have already developed a need for them). It refers to the personal experience of a trip abroad, of a book read, of a film you watched and music you listened to.
Internet, with its readiness to provide advice, is a bad assistant. Firstly, it is too abundant (and it is going to be even more abundant), secondly, it cannot determine what is good and bad for a concrete user. Ratings and toplists are compiled by the people we don't know, and all points of view weigh equally. Of course, you can write your friends or call them and ask what you can watch or read, but this is not always equally efficient, and often hard to accomplish.
It would have been convenient to store valuable reviews, received at various times, in one place. You feel like looking at bookshelves with films of your friends or people whose opinion is important for you. The same refers to trips: it is easier to go where your friends have been. It is easier to choose your route, and it gives you an opportunity to learn about tricky things (like visa issue procedures, transport in this country, etc).
Describing his or her personal experience, the user can look at himself or herself, at his development from the outside, to see an adequate projection of a real Myself on the net, to reach beyond the cycles of the virtual world (generated by the infinite exchange of reposts and "likes").
This helps the user develop a healthy awareness of oneself in respect to the virtual world when Internet is just an information exchange channel, and not life proper.
I am Fyodor Zima, and we are making the fmbf.org project. We need feedback. <comment><AUTHOR> start: <http://news.ycombinator.com/item?id=4423673></comment>


Ask HN: A botnet may be attacking our site right now, how should we respond? - <AUTHOR> It seems like our ecommerce site is under attack from a botnet, causing our site to go down. We're receiving 50-100 requests per second (far surpasses normal traffic). Some requests are for outdated URLs not even normally accessible from the site.
Here's IP data related to requests: https://gist.github.com/panabee/9595411. Can post more if more is needed for diagnosis.
Questions:
1) How do we confirm if the site is under attack?
2) If the site is under attack, how can we ward off the attack and prevent future ones?
3) We seem to have a ton of sleeping MySQL connections that continue to crop up even after we try killing them. Is this symptomatic of a botnet attack?
We appreciate any help or guidance anyone can offer.
Thanks! <comment><USER3> First step: get in touch with your hosting provider. They're better at this than you are, and may have suggestions or knobs they can twiddle on their end.

You might just be getting crawled by an overly aggressive search engine, by the way. (Probably not one of the big guys.) From your perspective that is isomorphic to being hit with a botnet, but the nice thing about that is the search engine won't attempt to get around the mitigation steps you put in place. (Well, typically.)

<comment><AUTHOR> Thanks. We spent half the day with them and are awaiting a confirmation from their network guys that this is, indeed, a botnet attack. Unfortunately, the network guys aren't in until the morning -- only the general support people are -- prompting the post on HN. So much for the 24/7 support they claim ...

We also suspect it might be an aggressive search engine. Our next step is to pull some IP data. If it turns out to be a search engine, what can we do beyond editing robots.txt?

If it's not a search engine, how can we confirm a botnet attack ourselves. We don't want to wait for these network guys to wake up and drink their morning coffee.

Thanks again!

<comment><USER3> robots.txt is purely advisory and many of the people who code a crawler which could get in a state where it hits you hundreds of times a minute might not be great about actually respecting it. If it is a crawler, though, it is probably operating from a single C block, likely on AWS or what have you. You'd probably just drop them at the firewall. Simple, no fuss.

I'm not a sysadmin, and I have nothing but respect for you and your team with the following recommendation: if it isn't obviously how to implement "drop that C block at the firewall" then find yourself a competent contract sysadmin, pay him for one hour of work today, then pay him for 10 hours of work over the next few weeks beefing up your infrastructure. It will be cheap at the price.

If you're absolutely determined to do it yourself the magic word is "iptables" and may God have mercy on your soul, because iptables is the most obtuse piece of software I've ever had the misfortune of trying to configure.

In the alternative, if you're actually facing a botnet, the expected behavior is lots of requests from widely distributed IPs. You'd be able to verify this with your access logs (which record IPs and timestamps) and a 10 or 20 line shell script to put a histogram of unique requests per IP. If it's a few requests from thousands of IPs per hour, then you have a bit of a challenge to address it on your end of things. My first totally-not-a-sysadmin advice would be to dial down dynamic content within the app for non-logged-in users and start aggressively caching pages, which might or might not be enough for you to weather the storm.

Best of luck and skill.

<comment><AUTHOR> ok thanks for the suggestions! one other data point: we seem to have a ton of sleeping mysql connections that continue to crop up even after we try killing them. is this symptomatic of a botnet attack?

<comment><USER4> If you're really actually in a bind, drop me a line (email's in profile). I'll give you a hand.

If you're looking for advice on how to mitigate this yourself:

\- apachetop is a useful tool for this sort of thing, and since the activity is occurring on a single site, it should be easy to use. (Assuming of course you use apache.)

\- If it's an actual botnet, you'll need to pick some honeypot URLs -- links that regular customers aren't hitting but the botnet is -- and then use something like Fail2Ban to pipe accesses to those URLs into iptables bans.

\- If it's a crawler, it should be from a limited set of IPs and a quick iptables rule addition will fix you up. For reference, here are two easy-to- use rules:

        iptables -A INPUT -s <source_ip_address> -j DROP

        iptables -A INPUT -m iprange --src-range <source_ip_range> -j DROP

The first rule will add a "drop" command to your INPUT table for any traffic coming from <source_ip_address>. The second rule will allow you to quickly drop a range of IP addresses; <source_ip_range> should look something like "10.0.0.1-10.0.1.255", and "iprange" is a literal.

<comment><USER5> Just wanted to say: that honeypot URL -> fail2ban idea is awesome. Thanks for sharing.

<comment><USER6> Just be careful not to ban Googlebot. It's pretty good at following new links.

<comment><USER5> Good point. It seems the bot is also good at minding robots.txt so that might be an option. Could also have the honeypot script to do a quick whois on the ip before passing along to fail2ban.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> _> 1) How do we confirm if the site is under attack?_

It _could_ be some kind of attack, but it's so weak it barely qualifies. 50-100 requests is so low it's probably a search engine spider or a log- spamming bot. If request rates like these bring your site down, you have a serious software problem. You really should be able to handle at least a few hundred requests per second, especially if they're bogus requests going to non-existent URLs.

 _> 2) If the site is under attack, how can we ward off the attack and prevent future ones?_

If this was a real attack, you'd be dealing with thousands of requests per second and a real spike in data volume.

As a basic protection against things like these, get behind a reverse proxy _right now_. Cloudflare offers a good free plan, but it doesn't include SSL. I've had a good experience with X4B as a DDoS-protection reverse proxy recently. Their plans start at a few bucks per month, check them out.

 _> 3) We seem to have a ton of sleeping MySQL connections that continue to crop up even after we try killing them. Is this symptomatic of a botnet attack?_

This question can't be meaningfully answered without knowing more about your setup. Generally, sleeping connections are fine - most web servers create a persistent connection pool. What's "a ton" in this case?

I think the only really valuable advice to give here is: hire someone to review your setup, your software, to make some changes, and above all to give you a meaningful briefing. Contacting your provider isn't going to help.

<comment><AUTHOR> Agreed, the site is terribly antiquated and poorly coded. I helped to clean some of the code, but there is regrettably still a lot of ugly, ugly, heinous, ugly, ugly code. There are definite issues that require addressing.

If this helps with diagnosis, here's IP data related to requests: [https://gist.github.com/panabee/9595411](https://gist.github.com/panabee/9595411). Can post more if more is needed.

Thanks so much for your help!

<comment><USER7> It looks more like an attempt at spamming, but without the full log entries (containing the referrer and the destination URL) it's impossible to be sure. In the end it doesn't really matter though.

Anyway, you have identified the main issue: some more code cleanup is in order. If you want to do this yourself: keep in mind that elegance in code is not the primary goal, runtime behavior is. Make sure you cache your results as much as possible, eliminate unnecessary DB calls.

On the sysadmin side, assuming your app is PHP the following is mandatory: make sure you're using PHP-FPM, and enable APC or Opcache. Optionally, consider installing Memcached and start using it from the app to cache data that is expensive to generate. If you're running on Apache, switch to Nginx.

Finally: reverse proxy service. They'll filter out most malicious requests for you. When the day comes where you experience a real attack, you'll have no chance of keeping the server up without using such a service.

</comment></comment></comment><comment><USER4> I took a quick look at the IP data you just released. Extracted IPs then unique-sorted them and took a few random samples. Everything was Eastern Europe, Russia, or Nigeria. There are some broadband IPs and some pppoe (!) IPs in there too, which might explain why it's not a very heavy attack.

There are 500+ IPs listed. I've permabanned a few million IPs on my servers, and I bet there's some overlap. Gimme a sec to see if I can put together a quick script for you.

</comment><comment><USER8> I'm surprised I haven't heard it mentioned yet, but Varnish can ward off an awful lot of request floods. If these pages aren't changing frequently (particularly if they are outdated or shouldn't be accessible), then Varnish should be able to cache and respond with them trivially. This will take a tremendous amount of load off of your actual app servers.

Additionally, Varnish has ACLs which make it possible to reject requests based on whatever patterns you choose (source IP, request structure, etc). While it puts you into an arms race, if you can identify a pattern in the bad traffic, you can short-circuit it before it ever becomes an actual problem. Black- holing poorly-behaved clients is very easy, and can let you absorb very high request concurrency with extremely little effort.

Varnish also makes it very easy to locate URLs and IPs being used in these sorts of things, via varnishtop and varnishlog. For example, `varnishlog -i RxURL` gets you a constantly-updated list of the URLs being hit most frequently, or `varnishlog -i SessionOpen` will get you a list of the most common client IPs. With that kind of information, doing reactive filtering becomes very easy.

</comment><comment><USER9> 50-100 requests per second doesn't sound like an attack (or at least not a very scary one, depending on request size...), more like a crawler or prefetcher gone haywire.

Anyway, best way to figure out what's going on, is to generate a distinct list of IPs originating the bad traffic from your logs, and block those addresses at your firewall. If this doesn't stop the strange requests in 15 minutes or so, you may want to get some expert help.

Your hosting provider may be able to be of some assistance here, but that greatly depends on their level of clue: many budget providers will just drop you at the first sign of denial-of-service related trouble, so do keep that in mind.

Signing up for a specialized service like Cloudflare is probably your best bet, and should be pretty affordable as well (their web site lists their business plan with "advanced denial of service attack mitigation" as $200/month, and they suggest that if you call them they can have you protected pretty much immediately).

<comment><AUTHOR> thanks for the suggestion! we're using singlehop ... definitely not a budget hosting provider. these requests have been ongoing since yesterday morning (~36 hours). we looked at cloudflare earlier today. do you have experience with them? does the solution really work?

<comment><USER10> Cloudflare's plans that include DDoS protection are as good or better than typical hosting resellers. May not know enough about your site to make the decisions a good datacenter team could though. On the up-side Cloudflare really is there 24/7.

Unfortunately the advanced DDoS support is only in their upper $$ plans. Might be worth it to keep your site revenue going though.

</comment></comment></comment><comment><USER11> To answer your first question, like people said already, pull a log from your servers with the IP's. If it is a lot of different IP addresses then that is a good sign of a DDOS attack of some kind. If it is a lot of requests from the same IP address or only a few IP addresses it probably is a search engine or something like which is causing the problem. You can also look up the IP addresses by simply Googling them to see who owns the IP.

To fight off the attack immediately I would recommend switching your DNS over to CloudFlare's Pro or Business plan (that depends a lot though on your site's current configuration, the size of your budget, etc.) with certain settings, then configuring Sucuri CloudProxy with CloudFlare, and lastly implementing some additional security for your server on Single Hop.

In terms of preventing future ones, you basically want to be proactive as possible in terms of preventing them, but that won't stop everything. The configuration I recommended above should be pretty good for most sites, but you might want to consider other DDOS mitigation companies as well and you could need something completely different depending on your business etc. Then you want to have a plan and several other things in place in case it was to get past the infrastructure you implemented to prevent it, so you can minimize the downtime you have etc.

It is hard to tell whether that is a possible issue just based on the information you gave in terms of the sleeping MySQL connections.

Lastly, depending on what the issue exactly is, it probably would be a good idea to make your site as static as possible, but that is difficult to do since your site is down right now. Once you get the site back up though and stable, you might consider doing this for a little bit. Lastly, having a separate site that you can deploy in the event of an attack is a good idea as well.

If you want more help, shoot me an email at firstname.lastname@example.com. I hope that helped and you get this solved quickly.

</comment><comment><USER12> What does your stack look like? If you're running a ruby app, check out rack- attack: [https://github.com/kickstarter/rack- attack](https://github.com/kickstarter/rack-attack)

It was created by kickstarter to fend off these kind of attacks.

</comment><comment><USER13> You could always try to improve the performance of your server and database configuration to handle 50-100 requests per second, and render the attack useless.

A. Check the number of connections per IP. If any have an unusually high number, block them.

B. Why is your site down? Database can't keep up? If so, why not, is it something simple like indexes not setup correctly?

C. Did you actually check the load on your server? Double check it's actually being overloaded, and you don't have a configuration issue with server connections set too low, while your hardware is practically idling.

D. How many pages are being accessed by the _attack_? Would you be able to cache them?

E. Check server logs, and see if you can identify anything that separates these requests from your typical traffic.

</comment><comment><USER14> My only advice is to hire a consultant who can give you some advice. If your site is getting taken out by 50-100 requests per second (that is a very low number), you have some basic structural flaws.

A few hours of time from a developer experienced with scaling will save you a lot of grief. Specifically, it sounds like you need a caching strategy (probably for all layers of your app, including the database).

Super-general overview: Use memcached in front of your DB. Use a reverse proxy like Varnish and/or a CDN in front of your entire site. I don't want to make the obvious guess that this is a PHP site, but if it is, make sure you are using apc or xcache as well.

</comment><comment><USER15> cloudflare.com? - I believe you could get everything swapped over to their DNS and start benefiting from their ability to ward off attackers within a couple of hours.

<comment><AUTHOR> we looked at them earlier today. do you have experience with them?

<comment><USER16> They're reputable. HN itself uses Cloudflare.

<comment><USER17> I am from CloudFlare. If you need help getting setup feel free to email me (dane AT cloudflare.com).

</comment></comment></comment></comment><comment><USER18> While running one of the largest free hosting providers we had many of these smaller attacks; usually some netstat & iptables incantations will ward them off. Something like

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

will show how many connections per IP for instance; with smaller attacks, usually, to actually make a dent in your webserver, the attackers will open many connections per IP. That helps you identify the 'bad' IPs. As someone else said; a lot of them are from eastern EU/Russia; you can use that information to be a bit more sure about what makes a bad IP a bad IP before you block it. Also check the Agent strings; often they all have the same Agent which is another way to filter.

We used to have tons of scripts running to try to identify the 'enemies'; in the end the simplest thing was the best; block everything with a lot of connections and open them up 24 hours later.

</comment><comment><USER19> As others have noted, it may not even be a malicious, targeted attack - <USER2> the side effect of other spamming or careless crawling/scraping. Reviewing your full logs, and comparing current traffic/behavior with 'normal' periods, may help further characterize what's happening.

There's a presentation called "Running At 99 Percent: Surviving an Application DoS" by Ryan Huber that may be helpful. (Slides and video from a number of conference presentations can be found via a search on that title.) It highlights some of the ways even a trickle of the wrong kind of app-specific traffic can be enough to bottleneck weak points in your app... and talks about mitigation ideas, both as a matter of good design and emergency request- filtering via server-side tools.

</comment><comment><USER20> I wonder if this could be related to someone trying to mass-scrape you to get to your data cheap ... So instead of having to do tons of domain queries themselves, instead they use you to make the queries and just scrape the results into a large database. At least a 100 to 1 savings.

</comment><comment><USER21> Have you checked your webserver logs for funny looking http requests?

Have you considered that you're being SQLMapped by someone using the Tor Network?

( [http://sqlmap.org](http://sqlmap.org) )

</comment><comment><USER22> 100 requests per second does not sound like a botnet attack. If it were you probably wouldn't be able to access your servers on their public interfaces for all the traffic.

</comment><comment><USER23> something that low it could just be a spam program testing to see if you have certain pages available. for instance some programs look for "signup.php" or "register.html" and if = exists will proceed with a registration bot.

contact your host. sounds like normal normal shit.

</comment><comment><USER24> Can you tell us the site URL so we can take a look ?

<comment><AUTHOR> sure, but the site is down. :) do you have an email? don't want people to think we're doing this for free publicity...

<comment><USER24> Oh.Yeh, you really shouldn't post it in here becasue it might cause it to get DDOSed by HN traffic.

</comment></comment></comment><comment><USER25> shutdown servers. go outside. frustrate attackers by don't caring.</comment>


Some obvious things about Internet reputation systems - <AUTHOR> http://tomslee.net/2013/09/some-obvious-things-about-internet-reputation-systems.html

<comment><USER2> Great to see Slee's stuff posted here.</comment>


Some Employees Chafe as Google's New Internal Rules Take Hold - <AUTHOR> https://www.bloomberg.com/news/articles/2019-11-01/some-employees-chafe-as-google-s-new-internal-rules-take-hold <comment><USER2> Is this really a new rule? I know Google sells itself as having a strong culture of openness, and it used to be even more open than today. But it's hard to believe it was ever acceptable to attack other employees by name or publicly demand that they should be fired.

<comment><USER3> Believe it. People were mercilessly mocked for making unpopular or disingenuous statements. When GCP hired an Oracle executive, he faced immense criticism purely on the basis of his reputation. And none of this was moderated in the past

<comment><USER4> This is the level of discourse you get from people who reverse binary trees all day.

<comment><USER5> People are downvoting this comment because they are missing the clever jab at the hiring process.

<comment><USER6> How can you be so sure?

</comment></comment></comment></comment></comment><comment><USER7> Regardless of the issues, a job at a company in the USA is at the discretion of the employer. I can't understand actively taking part in anything that makes oneself as an employee marked as a pain in upper management's ass and getting on the list "most likely to be riffed first in the next economic downturn."

</comment><comment><USER8> _During times of universal deceit, telling the truth becomes a revolutionary act._

\- George Orwell

</comment><comment><USER9> Technology and governance (interesting that we use 'program' in both contexts) are excellent insofar as they enhance our liberty.

If they gadgetry advances the "be your own President" concept, it is useful.

David Wheeler famously said: "All problems in computer science can be solved by another level of indirection."

But all of that indirection implies more bureaucratic policy, state (or State, depending on whether it's technology or governance) and an encroachment on individuality in the name of a single, narrow vision.

Topics such as corporate policy, voting, transportation, and medical gadgets get at the trade-offs involved in maximally automating and extinguishing the entropy from everyone at the expense of individual liberty.

PREDICTION: these over-managed efforts become Towers of Babel, as is human, and promptly collapse, as is human. The effect of technology may be to support a higher tower and shallower collapse, but the tension between the individual and the group is the only consistency.

</comment><comment><USER10> I hope they wouldn't accept that applying extra-legal pressure on tax collectors is ok. Or pressuring people who craft talking points for raising taxes. The situation would get a lot uglier than a few grumpy voices at Google.

This is a silly position, and presumably the number of employees involved is very small. It isn't like he is going to be involved in border policy issues while working at Google.

</comment><comment><USER11> Diversity of thought is important.

Making silly stands against people with opposing political views will eventually prove short-sighted. It's always best to assume good intent and treat people as you'd want to be treated.

<comment><USER12> "Diversity of political thought" is not important to a technology company. I love how the right tries to paint themselves as victims using this statement.

<comment><USER13> The main benefit of diversity is that it causes people to fight each other instead of fighting those in power. Upper management at Google has a real problem of the lowly workers organizing protests and pressuring management to change, forcing more diversity would fix this. Then they could finally become Microsoft where nobody raises an eyebrow when they help China spy on their citizens, take on military contracts or hire republican politicians.

By the way, you might not have noticed but the measures described in this article are intended to achieve just that, as it mostly silences the loud left within Google when they try to push back.

<comment><USER8> Right/left is the best divide-and-conquer wedge issue found so far, exploited by media corporatists to atomize people further from each other in the name of money, while the real division is between the have-way-too-muches and the have-little-or-nones.

</comment></comment></comment></comment><comment><USER14> [http://archive.is/XkqVl](http://archive.is/XkqVl)

</comment><comment><USER15> Posting memes critical of the company you work for is banned? Bruh

<comment><USER16> Well for like 20 years they've allowed it and they've done pretty well. Actually it's a way people can privately (within the company) vent about confidential things and reach others who feel the same way. If they can't vent when some middle manager makes a bad call, or some exec agrees to aid some murderous government's surveillance, what will they do instead? Stage more walk outs? Leak to the press? Unionize?

</comment></comment><comment><USER17> The employees "chafe" because they're prevented from personally attacking and name-calling coworkers? Pretty much every workplace has similar rules.

<comment><USER18> Framing the issue like that is incredibly unproductive. It's a more complicated topic than that.

Anyone can create a strawman like that and easily set it alight. What takes real insight is actually understanding the issue, why sides of it are unhappy, and how to address it reasonably.

<comment><USER19> Responding like that is incredibly unproductive. It's a more complicated topic than that.

Anyone can create a strawman like that and easily set it alight. What takes real insight is actually understanding the issue, why sides of it are unhappy, and how to address it reasonably.

Do you see how unactionable this comment is? When you're responding to an idea or post you don't agree with, try to explain why and offer an alternative idea. Yes, you're not obligated to do this in general, but IF you're going to post why not make it constructive and informative?

</comment></comment></comment><comment><USER20> >"some employees say the new rules smack of censorship."

Wait, wait, haven't I heard that companies by definition can't be accused of censorship because they "are not the government" when people protested Google's censorship in YouTube and its search arm?

But, but now that the shoe is on the other foot, yeah it's censorship! Good one.

<comment><USER21> People don't claim companies can't censor things. They claim that you can't have your first amendment rights violated by a private organization. Censorship would be part of a first amendment violation, but the two are not equivalent

<comment><USER22> > People don't claim companies can't censor things.

I did a quick search because I recalled seeing that in the past. It's certainly not the prevailing consensus, but people do make that claim.

[https://news.ycombinator.com/item?id=18676417](https://news.ycombinator.com/item?id=18676417) [https://news.ycombinator.com/item?id=19929107](https://news.ycombinator.com/item?id=19929107) [https://news.ycombinator.com/item?id=9967543](https://news.ycombinator.com/item?id=9967543) [https://news.ycombinator.com/item?id=2500298](https://news.ycombinator.com/item?id=2500298)

</comment></comment></comment><comment><USER23> I want to go meta here for a sec: Why does it seem like publications are tripping over each other to publish another article on complaints by Google employees? And why do I keep clicking on them? The complaints, by the way, are almost always about some decision made by people far above their pay grade. Are all Google employees expected to share in and guide all corporate decisions now? It's weird. I'm aware of zero companies that size, that do that.

<comment><USER24> You're seeing it more often because employees are talking to the press more often about internal politics. It's published because Google is famous and powerful enough that stuff that happens at Google is newsworthy by default.

</comment></comment><comment><USER25> _Karan Bhatia, Google's global policy chief, told employees in a staff meeting last week that Taylor wasn't involved in the Trump administration's policy of separating children from their parents at the U.S. southern border. But on Oct. 28, BuzzFeed News published emails showing that Taylor had in fact shaped talking points for Nielsen on the administration's detention of migrant children._

Shaping talking points is quite different than crafting policy. Did no one on the Google message boards recognize that?

</comment><comment><USER26> I know the posted title is generally preferred when linking articles but in this case I think the title doesn't accurately describe the article. I clicked not really realizing what the article was about.

The gist is Google is imposing new internal rules to restrict harsh or personal criticism of other employees, in this case to prevent employees from criticizing an executive hire who was involved in the Trump Department of Homeland Security. I gather the controversy is related to DHS's involvement in child separation at the border. A secondary controversy involves internal employee criticism of presumed anti-unionization efforts because removed from company message boards.

Maybe go with: "Google Employees critical of moderation designed to restrict internal dissent"?

<comment><USER27> Your suggested title is more misleading than the current title. Not allowing employees to personally attack other employees isn't restricting internal dissent. Employees are free to voice their dissent all they want as long as they keep it professional. Posting memes and trolling another person is unprofessional and childish, and would likely get you written up or even fired at practically every company in existence. The fact this was ever deemed acceptable in the first place is actually the more shocking news.

</comment></comment><comment><USER28> So now the censorship they have on Youtube is basically taken internally. Maybe now they'll see from experience what the consequences are of censorship.

<comment><USER27> If your definition of censorship is not allowing employees to use company time and resources to make personal attacks against other employees, then every single company in existence engages in censorship. The fact this article is even news shows how ridiculous things have gotten.

<comment><USER28> My definition of censorship is suppression of any kind of speech.</comment></comment></comment>


Biology simulation with LTspice - <AUTHOR> https://hackaday.io/project/553-biology-simulation-with-ltspice <comment><USER2> I like very much the idea to create and use analog computers even if the only one I had met was my slide rule.

In this case the goal is to make students "feel" with their hands, brain and perhaps guts what are genes and protein expression, as they are here physical entities that can be seen, their production could be measured by a multimeter, etc..

Bruce Land sets the bar very high. Bravo!</comment>


Kim Dotcom's back with a new 50GB free storage service: Mega - <AUTHOR> http://www.zdnet.com/kim-dotcoms-back-with-a-new-50gb-free-storage-service-mega-7000010043/ <comment><USER2> Assuming this actually works, it's an attempt to execute the plan in cryptonomicon -- secure data storage immune to government inspection.

Dropbox could, of course, have implemented something similar if it weren't trying to do deduplication. Assuming you are doing deduplication, it would be neat to be able to -- say -- insert a DVD into your dropbox-based DVD ripper and discover the operation had completed instantly...

</comment><comment><USER3> At least they miserably failed load testing etc. Site was practically completely down for the first 24 hours. At least in EU area. They also failed to send emails about their service being opened (they did collect addresses etc.) So I would say they failed on multiple fronts.

<comment><USER4> That's one definition of a failure, but it could just as well be a definition of a raging success.

If more people want to buy tickets to a concert than number of available seats, is the concert then a failure?

<comment><USER5> If the resultant crowd cancels the concert for everybody? Yeah, probably.

</comment></comment></comment><comment><USER6> Oh really? So this is not the same as the ten posts before were about?

<comment><USER7> Did you say the same about the links related to Aaron Swartz?

</comment></comment><comment><USER8> I think everyone is expecting MPAA&friends (FBI, ICE, etc) to watch Mega. But there isn't much they can do about it when it comes to private sharing, so from that point of view it's a lot more secure than Google Drive, Dropbox, Rapidshare, etc.

As for public sharing, nothing has really changed, because you need to give your password for the file to be accessible, and it's possible MPAA&friends will look into the more high-profile ones by using the passwords, and demand them to be taken down.

<comment><USER9> Do they disguise metadata as well? File size, name, and directory layout would be more than enough to identify particular files (or at least enough to obtain a warrant to force mega to push trojan client software).

I'm sure they've considered this but if someone has seen an article or post analyzing the client side encryption I'd love to read it.

<comment><USER10> Yep. They don't even know the file names.

</comment></comment></comment><comment><USER11> So has anybody been able to actually use Megaconz (i love the ironic name, btw)? My 70kb image upload's been pending for hours and the ENTIRE site is unusable while an upload is pending. I could have flew the fucking jpeg to New Zealand already. I guess i can speculate that the thing is either getting slammed with traffic or the release didn't go well.

<comment><USER12> I don't think it's an ironic name, to be honest. .co.nz is just a New Zealand TLD.

</comment></comment><comment><USER13> > "That said, Mega's also claims that their service saves room on its over- > burdened servers by keeping a single copy of identical files How do they do > that if they don't know their users' password? Good question. We don't know > the answer."

Can anyone shed some light on how this might be possible, given the files are encrypted?

<comment><USER14> We've kinda been over this ad nauseam. It may be convergent encryption.

<comment><USER15> what is convergent encryption?

<comment><USER16> Really?

(<https://en.wikipedia.org/wiki/Convergent_encryption>)

([http://www.hnsearch.com/search#request/all&q=convergent+...](http://www.hnsearch.com/search#request/all&q=convergent+encryption&sortby=score+desc))

etc etc.

Do you have a more specific question, because there are people on HN who can answer it.

<comment><USER17> Since the same plaintext produces the same ciphertext with different passwords dosn't it expand the search space for a possible attacker?

</comment></comment></comment></comment></comment><comment><USER18> > That said, Mega's also claims that their service saves room on its over- > burdened servers by keeping a single copy of identical files How do they do > that if they don't know their users' password? Good question. We don't know > the answer.

How can they do this and still keep information about the file unavailable?

<comment><USER19> Googled for encrypted de-duplication: <http://www.ssrc.ucsc.edu/Papers/storer- storagess08.pdf>

</comment></comment><comment><USER20> This shows up in the JS console when trying to do anything non-cachable:

POST <https://eu.api.mega.co.nz/cs?id=01234567> 500 (Server Too Busy)

</comment><comment><USER21> Has anyone got something uploaded? I'm curious how the downloading actually works. Do they still use the original monetization scheme, i.e. pay to get faster transfer?

</comment><comment><USER22> That image they got on their site, that appears while the app is loading, with the cloud and the gears is practically the same one that stripe has on their website.

<comment><USER23> That comment you got there is practically the same as in the previous Mega thread: <http://news.ycombinator.com/item?id=5084753>

</comment></comment><comment><USER24> It's still completely broken for me. I'm getting 500 Server Too Busy even on the initial load. When it loaded before, I couldn't upload anything.

</comment><comment><USER25> MegaUpload, with a new skin? Seems like the same general business.

<comment><USER26> Not at all, there's built-in protection against the type of takedown that occurred last time.</comment></comment>


Who Killed California? - <AUTHOR> http://www.nationalaffairs.com/publications/detail/who-killed-california <comment><USER2> California is too big. It really needs to be broken up into more meaningful pieces. The various regions are so widely disparate that there is very little common ground for them to be in the same state.

In some regards, CA is a microcosm of the troubles the US is going through. But at least the federal government doesn't have their hands tied as badly as CA does with the incessant ballot initiatives and super-majority needed to pass budgets. Letting Enron write the "energy deregulation law" was supremely stupid and is one reason for the blackouts and tens of billions of dollars in debt.

<comment><USER3> > But at least the federal government doesn't have their hands tied as badly > as CA does with the incessant ballot initiatives and super-majority needed > to pass budgets.

Add Proposition 13 to the list of the ways that California's hands are tied.

[http://en.wikipedia.org/wiki/California_Proposition_13_%2819...](http://en.wikipedia.org/wiki/California_Proposition_13_%281978%29)

</comment></comment><comment><USER4> Obligatory joke. It was The Terminator.

</comment><comment><USER5> Howard Jarvis.

<comment><USER6> The Democratic Party has controlled the legislature for several decades now, and the governor's mansion for much of that time. God forbid they take a little of the blame.</comment></comment>


28 co-sponsors to overturn #NetNeutrality vote - <AUTHOR> https://twitter.com/freepressaction/status/944248516712501253 <comment><USER2> It doesn't matter how many cosponsors you have if the bill is never brought to a vote

<comment><USER3> Call your senator. The NRA uses this tactic successfully. There's no reason why Internet users can't do the same.</comment></comment>


Flickr goes creative for SOPA blackout - <AUTHOR> http://techcrunch.com/2012/01/18/flickr-joins-sopa-protest-lets-users-black-out-photos/

<comment><USER2> The approach is particularly creative: drive home the feeling of censorship by allowing some users to "censor" other users.

</comment><comment><USER3> I wish they had followed through strongly on this. There's a hard-to-miss link that lets you opt-out of having your photos censored, and if you're visiting a blacked-out photo flickr gives the anti-PIPA spiel and presents a button to "show it anyway." If they were trying to demonstrate what SOPA/PIPA would make the internet like, shouldn't they just bite the bullet and make these photo black-outs permanent for a day? The idea is great but its implementation is pretty weak, it won't actually get people worked up.

<comment><USER4> You better not darken my photos if I'm paying for the service.

<comment><USER5> Just think how you'll feel if the SOPA or PIPA bills pass and there is no "Show my website anyway" button... 'Cause you can say that all you want, but if one of these bills pass and if the idiots deem it necessary, your content will get "darkened" regardless of how much money you paid to host it somewhere (maybe not the same way flickr is doing it, but still... to the same point).

I think everyones photos shouldn't be exempt, including the whitehouse photos! This is just a small taste of what is possible.

<comment><USER4> It certainly highlights one downside of using a paid-for shared service over your own self-hosted version. Flickr could be blocked due to another user, whereas my own hosting can only be blocked due to me

<comment><USER6> If an accuser makes a mistake and you're unreachable for 5 days, your own self-hosted version could be blocked.

</comment></comment></comment></comment></comment><comment><USER6> "Update 9:27am January 18, 2012: We removed the 10 limit, you can darken to your dark heart's dark desire."

<http://blog.flickr.net/en/2012/01/18/pipa-sopa/>

</comment><comment><USER7> All these positive comments are surprising. I find this to be a very bad idea. Flickr is a service (unlike HN) that some people depend on, and that some people _pay for_. So Flickr is saying that, even if I pay for their service, they might deny it to me, at the whims of other users?

Flickr is showing themselves to be untrustworthy -- and possibly in breach of contract. I would suggest not relying on them.

<comment><USER8> Isn't there an opt-out mechanism so that your photos won't be darkened? I assume they put this in here because there are professional photographers on the site.

<comment><USER7> Well, that's nice. But still, having told them I want a service, and having paid for it, I am now required to notify them that I still want to get the service that I already paid them for?

<comment><USER9> These sites believe that they face an existential crisis due to this proposed legislation. Slightly impacting the service today to save it for the long term is clearly worth the tradeoff, if it's necessary.

<comment><USER7> Well, I guess a number of people disagree with me. And I can accept that (although I still disagree). But I think I should point out that "worth the tradeoff" is not the issue I'm talking about. For example, suppose I pay for something at a store, but the store refuses to give it to me, because they're protesting something. We can certainly ask whether the store's policy is "worth the tradeoff", but is that really the question we _should_ be asking?

<comment><USER10> But that's not at all like the situation at hand. They're not refusing anything — it's only for one day, and if you don't want to participate, you don't have to. What you are complaining about is a minor inconvenience at worst.

</comment></comment></comment></comment></comment></comment><comment><USER11> To bad the Whitehouse photo-stream is exempted.

<http://www.flickr.com/photos/whitehouse/>

<comment><USER12> The photos are darkened for me.

<comment><USER13> Must've been a temporary mistake. The whitehouse's flickr account is definitely opted-out. None of their photos are darkened.

<comment><USER14> At least all the photos on the first page of the photostream are darkened for me. Here's a screenshot of the first picture: [http://dl.dropbox.com/u/24903613/ss/flickr-whitehouse- sopa.p...](http://dl.dropbox.com/u/24903613/ss/flickr-whitehouse-sopa.png)

Are you located outside the U.S.? It could also be possible that it changed in the last few hours.

</comment></comment></comment></comment><comment><USER15> My biggest complaint is that it's not easy to automate blacking out every photo of every SOPA supporter.

It is, but it involves YQL, API keys and more time than I want to dedicate.

</comment><comment><USER16> I like this feature.

I changed my Gravatar, g+, and FB images to black squares today to solicit whys from my networks.

</comment><comment><USER17> The wording on this was confusing enough that I thought Flickr was claiming I'd opted-in to black out my photos.

</comment><comment><USER18> We are no doubt pissing off Congress to no end. I wonder what the approval rating of Congress will become after this stunt? 5%? 2%?

<comment><USER19> Do you really think 95% of the population either already disapproves of the Congress or has been on the internet today and ran into a darkened site and thought about the issue?

<comment><USER20> Congressional support is something like 13.3% with 83% disapproval.

[http://www.realclearpolitics.com/epolls/other/congressional_...](http://www.realclearpolitics.com/epolls/other/congressional_job_approval-903.html)

HuffPo has a funny take on that, saying that more people approve of "Porn, Polygamy, BP Oil Spill, 'U.S. Going Communist'" than of Congress.

So no it's probably not unreasonable to suppose that somewhat less than half (12/27) of the ~27% people who approve of or are neutral to Congress saw a darkened site and thought about the issue. I know that I got questioned about it at work by the less technical folks.</comment></comment></comment>


Why Tokens Are Eating the World - <AUTHOR> https://vinnylingham.com/why-tokens-are-eating-the-world-b4174235c87b <comment><USER2> Can't imagine a world where every service that you use have its own coin. It feels like a nightmare keeping track of conversion rates.

<comment><USER3> AI assistant would do that for you.

</comment></comment><comment><USER4> Please, no.

At least someone didn't suggest Bancor as a "plausible example".</comment>


Amazon smartphone reportedly in production, set to go on sale in mid-2013 - <AUTHOR> http://9to5mac.com/2012/12/17/amazon-smartphone-reportedly-in-production-set-to-go-on-sale-in-mid-2013/

<comment><USER2> By all accounts Amazon makes something like the 4th best tablets but they have managed a solid second place sales showing because of their dedicated distribution channel, heavy marketing, loyal and affluent base and reputation for customer service.

It will be interesting to see if they can carry this over as strongly to phones because the distribution is heavily dependent on carrier stores. Even the iphone, which is widely available from Apple's website and retail shops as well as Wal-Mart/Target/etc and Amazon itself, still relies on carrier stores for something like 65% of it's sales in the US.

Amazon is either going to settle for low numbers with 90%+ of their distribution through Amazon itself or ... they will be competing hard against Samsung to get promoted at carrier stores. I hope it's the latter because Jeff Bezos is very smart and knows that 4th place hardware and special offers aren't going to cut it against the summer flavor of the Galaxy S.

<comment><USER3> It is so incredibly depressing to watch Amazon blow an amazing opportunity with shitty software. They can outsell anyone, but the Kindle Fire OS work is dreadful -- if they could manage to build a competitive UI then they could probably march way ahead of Android-proper on browser usage metrics (as well as whatever they use internally to measure engagement). They seem to spend a huge amount on Kindle Fire, they're competitive with Barnes & Noble but not Google or Apple.

I'm betting that most of the Kindle Fires that Amazon do sell end up "in desk drawers" and don't drive many further sales for them -- and it's entirely because the software is so awkward to use (the first Kindle Fire was pretty clunky in industrial design, and the new ones aren't wonderful but at least they're competitive excepting the hard-to-use power switch).

<comment><USER4> >It is so incredibly depressing to watch Amazon blow an amazing opportunity with shitty software.

They also seem to habitually make unforced design flaws. I have a third- generation Kindle (I think), which works well enough, but the Kindle Paperwhite looks attractive. But it only allows flipping pages through a finger swipe; there is no dedicated button.

That's a recipe for a screen covered with finger prints and schmutz. On my current Kindle, I probably use "page forward" about 49 times for every one time I hit any other button. A single, discreet "page forward" button would be a huge UI win. When I played with one in a Staples, this was an obvious flaw—so obvious that I sent an e-mail to email@example.com to tell them as much.

An iPad or iPhone are much more general devices, but a Kindle is mostly for reading. Leaving this obvious, easy button off the Kindle is really annoying, and I think it's symptomatic of Amazon's a) Apple envy, which b) leads them to make design decisions that try to ape Apple without necessarily doing it well, or without recognizing what problems Apple is trying to solve and what problems Amazon is, or should be, trying to solve.

<comment><USER5> > But it only allows flipping pages through a finger swipe; there is no > dedicated button.

While true that there is no dedicated button, a tap will turn the page. Your thumb doesn't have to leave the frame/casing to initiate a page turn.

</comment></comment></comment></comment><comment><USER6> I would like a phone with an e-ink display (like the non-Fire Kindles).

I assume battery life would be quite impressive.

<comment><USER7> I have one of these:

<http://en.wikipedia.org/wiki/Motorola_Fone#F3>

Solid as a rock, ridiculous battery life and dirt cheap :)

<comment><USER6> How long have you gone on a single charge?

<comment><USER8> I used to be able to get about two weeks.

</comment></comment></comment></comment><comment><USER9> I don't have high hopes for the first generation of any Amazon product. The original e-ink Kindle was expensive, slow, ugly, and had an extremely limited range of books. The original Kindle Fire was slow and buggy too.

In saying that, Amazon could very well be the best company in the whole industry when it comes to iterating and improving. The current e-ink Kindles are pretty extraordinary products. When Amazon commits to building a product, they don't just give up if the first few attempts don't pan out, unlike some of their competitors (I'm looking at you Microsoft Zune).

<comment><USER10> The original Kindle was priced competitively for its day. It was better than all of the other e-readers of its time in almost every regard, and in the most important aspect, book selection, it wiped the floor of the competition.

<comment><USER11> I'm pretty sure it was mainly screen cost driving the price.

</comment></comment></comment><comment><USER12> Having bought a Kindle Fire HD (nice hardware, fairly disappointing software), I agree that it's impossible that Amazon isn't about to make a phone. That's where they're going; everything they want people to do on a Kindle Fire could be done on a phone, that you have with you at all times.

If it's really cheap ($100 doesn't seem impossible since the HD is only $200) it could work.

I still find the restricted and zoned app shop not very exciting. I rooted the Kindle Fire HD, but even then, many apps from the Google Play Store are said to be "non compatible" with the version of Android on the Kindle. (They are actually compatible if you export the APK and import it on the Kindle, but it's a fairly complex process to just install apps!)

</comment><comment><USER13> I don't see how they will differentiate themselves. Kindle Fire was the first $200 android tablet, their new version is super cheap and comes with a $50/year data plan. But with phones? They can't compete on price (already many free recent-generation Android phones out there), they won't compete on quality (Amazon is all about making things accessible price-wise).

Seems to be the only possible thing they could do vis-a-vis a Kindle Phone would be to sell it with an incredible wireless plan -- which I can see them doing. $50/month, 2Gb data, free data for all Amazon media? Watch Amazon Prime Videos without using your data?

<comment><USER14> That would be despicably ingenious. Would you rather watch that movie on netflix and kill your data cap, or watch as many as you want on amazon?

At what point to anti-competitive regulatory bodies have to step in?

It's almost as if the carriers handed their customers to amazon on a silver platter at that point.

<comment><USER15> Well there goes Net Neutrality...

</comment></comment></comment><comment><USER16> This story is _extremely_ thinly sourced. Unnamed "industry sources" quoted in a publication I've never heard of that, according to its homepage, is being shuttered for good in two weeks.

</comment><comment><USER17> Is it just me or are Amazon starting to look like 'omni consumer products' these days?

Diversification yes but jumping on every bandwagon...

<comment><USER18> Wait, you think a film studio was too much...

<comment><USER3> If they start a nuclear reactor business then GE will really be in trouble!

<comment><USER18> No, then they won't pay ANY taxes. They'll just reprocess the fuel and build some nuclear weapons.

</comment></comment></comment></comment><comment><USER19> An Amazon phone is only interesting if it can do something interesting with phone plan pricing, but with all the strides that have been made in prepaid phone plans, Amazon could really do something interesting.

A $200 phone with a $10, $20, or $30 plan would probably do well. They could resell AT&T, T-Mobile, Sprint, or even Verizon like Straight Talk, Net 10, and Virgin Mobile USA so.

Prepaid is starting to hit a much more mainstream audience with smartphones, so Amazon could time this really well.</comment>


Gimme Shelter – The Cost of Living in the Bay Area - <AUTHOR> https://harpers.org/archive/2019/12/gimme-shelter-ghost-ship-fire-san-francisco/ <comment><USER2> I'm tired of people complaining without offering solutions. I almost got through a third of this article before I realized that the author was going to spend the entire article throwing a pity parade without discussing any solutions.

We already realize housing prices are sky high and many people are suffering.</comment>


Facebook is the Jurassic Park of startups. - <AUTHOR> https://plus.google.com/u/0/104242490157097583591/posts/8crBZxg3qnB

<comment><USER2> Is "hacker-idealist" the paleontologese for "sociopath"?</comment>


Voices from the Incas' past - <AUTHOR> https://news.harvard.edu/gazette/story/2017/08/a-students-mines-voices-from-the-incan-past/ <comment><USER2> Aside -- I was a little confused, I'd only ever seen it spelled "Quipu" before. I assumed it was a Spanish or Portuguese word and shouldn't need to be transliterated (thus the multiple spellings). It's not -- it's a word from the native Peruvians and therefore does need transliteration.

From the wikipedia article [1]:

> Quipu is the Spanish spelling and the most common spelling in > English.[citation needed] Khipu (pronounced [ˈkʰipu], plural: khipukuna) is > the word for "knot" in Cusco Quechua; the kh is an aspirated k. In most > Quechua varieties, the term is kipu.

[1] [https://en.wikipedia.org/wiki/Quipu](https://en.wikipedia.org/wiki/Quipu)

</comment><comment><USER3> > These ropes were unique because their existence affirmed a written census > the Spanish had recorded in 1670

That would scream "Rosetta stone" to any archaeologist :-)

</comment><comment><USER4> Can anyone find the original paper referenced here? Searching the journal's archive and Google scholar isn't turning it up.

<comment> ar-jan Article says it's due in January.

</comment></comment><comment><USER5> No example? :/</comment>


The Global Implications of "Re-education" Technologies in Northwest China - <AUTHOR> https://cgpolicy.org/articles/the-global-implications-of-re-education-technologies-in-northwest-china/ <comment><USER2> I am amazed that this isn't a bigger political issue for discussion leading into the U.S. election.

This is truly horrifying stuff. Anyone who tries to equivocate this with what is happening in the United States is not only wrong but morally bankrupt. This isn't even in the same ballpark as GITMO or illegal immigrant detention. This is orders of magnitude bigger and far more disturbingly intrusive and arbitrary.

We have to do more to show China that this is not OK.

<comment><USER3> Gitmo was part of a larger war on terror, including the invasion of Iraq and Afghanistan, which is estimated to have caused millions of deaths. Torture and arbitrary detainment have been widespread. One of the very few flagrant criminals to face prosecution in these war crimes was recently pardoned.

<comment><USER4> "War on terror" was the marketing term the government used. "war for enhanced funding for military contractors" would be a better name.

<comment><USER5> Naming things in insulting ways to make them look worse generally isn't better, even if the insults are true.

<comment><USER4> Naming things with false claims to make them look better is worse.

</comment></comment></comment></comment></comment><comment><USER6> Between cheap GPS and facial recognition tracking people is basically free now. The technology will come to the rest of the world by virtue of simple economics.

It raises an interesting question of what types of political dissent will even be possible in this century. The incumbent advantage to the police is huge.

Something I've noticed is that since around the turn of the century is it is now technically possible for governments to enforce all laws. That wasn't the case even as recently as the 90s.

<comment><USER7> [https://en.m.wikipedia.org/wiki/Exit,_Voice,_and_Loyalty](https://en.m.wikipedia.org/wiki/Exit,_Voice,_and_Loyalty)

I remember taking a class where the professor claimed the framework above as the basis for understanding interactions between people and their governments. People ultimately have two actions they can take, to use their voice/dissent, or leave the country.

In a world where dissent isn't possible, leaving will be the only response to poor governance. How seriously a government takes emigration will also depend on the people emigrating as a highly skilled engineer is far more valuable to the national economy and military than a fast food cashier, and this would skew political influence away from one person one voice towards one dollar one voice even more. In the event even leaving isn't possible due to an emigration ban, the only response may be to refuse to work on new technologies and let the country stagnate economically until the government is weak enough where dissent/rebellion is possible again.

At the end of the day, power games form the foundation for most large-scale human interactions, and you only have power over someone if you can give them something they want, or do something to them they don't want. Governments want their people to not rebel and overthrow them, and to be economically and technologically productive so they don't fall behind and get conquered. In a world where rebellion isn't possible, not giving governments the economic production they want is the only way to exercise power.

<comment><USER8> "In a world where rebellion isn't possible, not giving governments the economic production they want is the only way to exercise power."

Made me think of "Atlas Shrugged" [https://en.wikipedia.org/wiki/Atlas_Shrugged](https://en.wikipedia.org/wiki/Atlas_Shrugged)

</comment></comment></comment><comment><USER9> Important piece, every American/western HN reader should read.

The relationship between the policies and practices described here and those created by the US post 9/11 is alluded to but not sufficiently explored.

Also insufficiently explored, and I say this with trepidation, having no knowledge or background in the actual conflict in these territories, is the extent to which the practices described here, enabled by tech, are framed by authorities with power as "more humane" than the alternative without technology, which would likely be extermination.

<comment> john-shaffer I don't think the alternative would be extermination, as the CCP has been very consistent at using the politically incorrect for slave labor.

The reasoning is given at [1]:

> Mao Zedong's order given in 1957 in one of his speeches, in which Mao > explained why political prisoners must not be executed:

> 1st: If one was executed, then more would have to be executed for the same > crime later on for equality, and it would difficult to spare the lives of > future prisoners who committed the same crime, because justice system would > be criticized as unequal, giving preferential treatments

> 2nd: Wrong people and even innocent people might be executed by mistake

> 3rd: Executing prisoners could mean the vanishing of evidence

> 4th: When prisoners were executed, it could not increase production output, > could not improve scientific research, could not strengthen national > defense, and could not liberate Taiwan

> 5th: You (the Communist regime) would be accused of excessive killings

[1] [https://en.wikipedia.org/wiki/Qincheng_Prison#Labour](https://en.wikipedia.org/wiki/Qincheng_Prison#Labour)

Tracking down the source hit a dead end because I can't justify spending $44 for a speech from 1957. So this quote may not be accurate, but it is pretty consistent with the CCP's behavior.

<comment><USER10> Much of "The Selected Work of Mao Zedong" is freely available online at [1]. Looking through the speeches readily available, I can't find any 1957 speech containing the content quoted above.

It looks the the only English language reference to the texted quoted above originates from a single Wikipedia edit from 2007 [2]. Neither the articles on "Re-education through labor" nor "Laogai" reference this quote.

It is my belief that this is likely a specious quotation. Mao likely did not say the text quoted.

[1] [https://www.marxists.org/reference/archive/mao/selected- work...](https://www.marxists.org/reference/archive/mao/selected-works/date- index.htm#1950) [2] [https://en.wikipedia.org/w/index.php?title=Qincheng_Prison&o...](https://en.wikipedia.org/w/index.php?title=Qincheng_Prison&oldid=156815119)

<comment> john-shaffer Thank you for the references and the analysis! That's very helpful.

</comment></comment></comment></comment><comment><USER11> What's the best way to support the fight against this? Boycott the companies linked to the labor from these camps? Boycott all Made in China goods?

</comment><comment><USER12> The disturbing thing is how these technologies which could be used to benefit all of us are being used by the CCP (China Communist Party) to perfect the vision of Hitler, Stalin, Mao, and others to completely crush individuality. All aspects of an individual's life can now be monitored, controlled, and punished.

<comment><USER13> I wonder how that impact the structure of society going forward. It's one to use the technology, it's another to lead to the collapse of society.

</comment></comment><comment><USER14> This is genocide happening in real time. Systematic reduction and elimination of a people and culture. Technology can really be a Pandora's box of sorts.

</comment><comment><USER15> "center for global policy" sounds like some globalist lobby.

<comment><USER16> I'm not sure if you're aware but globalist is an anti Semite dog whistle for "the Jews trying to control the world" and has been for decades.

Some background -

[https://www.theatlantic.com/politics/archive/2018/03/the- ori...](https://www.theatlantic.com/politics/archive/2018/03/the-origins-of- the-globalist-slur/555479/)

<comment> john-shaffer That reasoning is absurd. Obama talked about being "on the right side of history." Does that make him a Stalinist, just because Stalinists used that phrase 75 years earlier? I don't think so.

"Globalism" is a legitimate term used by proponents, critics, and neutral parties. It is not a dog whistle.</comment></comment></comment>


Mimic: Abusing Unicode to create tragedy - <AUTHOR> https://github.com/reinderien/mimic <comment><USER2> This is the third time this has been posted recently.

<comment><USER3> That's fine, though, if the story is good and hasn't had significant attention yet. Otherwise too many good stories languish.

[https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)</comment></comment>


Remote First: Why Isn't Every Company Boundaryless - <AUTHOR> https://readwrite.com/2020/02/07/remote-first-why-isnt-every-company-boundaryless/ <comment><AUTHOR> Authorities like Sam Altman of Y-Combinator, Angel List's Naval Ravikant, Twitter CEO, Jack Dorsey, and Bill Gurley, GP at Benchmark Capital, believe boundaryless companies built by remote-distributed teams are the future of work. So why isn't every company remote-first?</comment>


Ask HN: Android Mp3/Media Player? - <AUTHOR>

Is there a Android equivalent to a Ipod Touch? As far as I have found, the only comparable option would be to buy a Android based smartphone. <comment><USER2> Look at the new Archos low-end. The 43 might be it: [http://carrypad.com/2010/09/06/archos-43-hands-on- overview-v...](http://carrypad.com/2010/09/06/archos-43-hands-on-overview- videos-gallery/)

NO Google apps, tho.</comment>


Beastly Android will batter Apple's iOS beauty - <AUTHOR> http://www.theregister.co.uk/2011/01/05/android_beats_apple/ <comment><USER3> This article states claims that it doesn't back up with any evidence. For example:

"The biggest reason for this consumer adoption is the robust developer adoption Android has engendered."

Really? So says an Android developer. Imagine that.

What about the fact that there are many different Android powered smartphones, available through many different carriers, available in a wide variety of hardware configurations (with/without keyboard, etc).

I don't have any proof to show that this is the driving factor behind Android's growth, but it sounds just as plausible to me. The problem comes when you state it as fact without any supporting evidence.

<comment><USER4> I'm not sure about that reason either, and I'm an Android developer. From what I seem to be observing, the adoption comes from something more mundane - <USER2> price points. Android offers a "good enough" mobile experience for substantial cost savings. In India, for example (where phones are usually sold unlocked and carrier-discounted units are unheard of) iPhone 4 sells for nearly $800, and the highest-end Android phones sell for $500. Nearly $300 difference. Even iPhone 3GS is around $700. That's something you can't ignore, especially in a price-sensitive mobile market like India. I think this will continue to be a big part of the reason for Android adoption, unless Apple gets worried about something as unimportant as the world's largest but maybe least profitable (given how competitive it is) mobile market :)

<comment><USER3> My point wasn't specifically to posit my own reason for Android growth, but to point out that it is irresponsible journalism to state an interviewee's opinion as fact :)

Also, I agree with your "good price points" ideas. Price is a major driving factor for the majority of consumers.</comment></comment></comment>


Usable hardware thrown away due to no software updates, let's talk about it - <AUTHOR> https://kastoestoramadus.github.io/os/2018/08/22/short-time-support-against-ecology.html <comment><USER2> PostmarketOS aims to deal with this very problem, [https://postmarketos.org](https://postmarketos.org)</comment>


JavaScript Zero: real JavaScript, and zero side-channel attacks - <AUTHOR> https://blog.acolyer.org/2018/03/13/javascript-zero-real-javascript-and-zero-side-channel-attacks/ <comment><USER2> The idea is an extension to let users opt into javascript features that allow for side-channel attacks. Here's the source code:

[https://github.com/IAIK/ChromeZero](https://github.com/IAIK/ChromeZero)

Note this closed issue from karthikbhargavan pointing out some of the ways a malicious page could get access to unprotected javascript features:

[https://github.com/IAIK/ChromeZero/issues/2](https://github.com/IAIK/ChromeZero/issues/2)

misc0110 suggests those are implementation details, but I'm a little skeptical -- I bet it's pretty dang hard for a Chrome extension to close off every way to get access to a given function in javascript.

So I think it's probably best to look at this as a user interface testbed -- basically a test of how annoying or effective it would be if browsers asked users to opt into these things, and which set of policies would be least annoying for the maximum protection. I suppose it also sets a ceiling on the performance impact, but it's not obvious the impact would be the same if the same rules were set at the browser level.

<comment><USER3> The disclaimer in that issue seems pretty clear - yes, this can be bypassed, this is not production ready, this is proof of concept. They explain that they could attain 'first runner' status in Chrome but ultimately the protection belongs built into the browser.

</comment></comment><comment><USER4> What's the use case for this? Is this for crypto sensitive code or password matching that is vulnerable to timing attacks and such? Or is this for avoiding things like Spectre in a more general sense?

<comment><USER5> The latter. It's for guarding against malicious JavaScript discovering secrets. In practice, the browser should have this sort of protection built in.</comment></comment>


Interactive Data Scrolling in the Terminal - <AUTHOR> https://github.com/baogorek/datascroller <comment><AUTHOR> I just released Version 1.1.0 of the datascroller package for Python, the first version that automatically fits the portion of the data set to the terminal window. See it in action here [on YouTube]([https://www.youtube.com/watch?v=mewJAcurJPg](https://www.youtube.com/watch?v=mewJAcurJPg)). Even if you're not a Python user, you can still benefit from the `scroll` binary to quickly skim CSV files while in the terminal. Hope you like it.</comment>


Ask HN: Does YC have a "lowest age limit"? - <AUTHOR>

Does YC have a "lowest age limit"? If so, where does the boundary stand? What age is the youngest YC founder to date?<p>Any info would be really helpful, thanks! <comment><USER2> Technically no, but IANAL and pg & co might say x age is too young, finish school, we are not Peter Thiel, etc.

Youngest founder to date is Gross from Greplin (last winter YC cycle I believe).

<comment><AUTHOR> Okay thanks. If you don't mind me asking, what age do you believe x to be?

<comment><USER2> Really, you don't "need" YC to build your own startup...

This is personal, but I've been running of side projects/webapps that make decent revenue from ads and (in one case) a freemium pricing model.

I'm all of 17 this year and have been doing this for about 4 years now...

YC is only nice because it gives you (1) Lots of investor and public interest via TC and other blog articles. (2) Great advice, tips, and help via pg, harj, jessica, and the rest of the gang as well as the (pretty large now) alumni network of successful YC-funded startups.

YC admits teams that have no product yet to those with several years of experience in their market. It's going to be a bit more competitive now that everyone knows about them plus the whole big-money-addon deal by Yuri Milner, but if you have the skills and believe you have a good MVP to pitch to YC...fly on over to Silicon Valley.

Again, IANAL so there are probably plenty of stake-holders rights things to deal with if you're not of the age of majority and other little things that might be a barrier, but I'm waiting to hear what pg and others with more experience have to say on the matter.

 _tl;dr 18._

<comment><AUTHOR> I'm in pretty much the same boat as you, I have been running projects for a while to pay my way through school and I understand that to start a startup we don't NEED YC, the point is we WANT YC onboard.

I have (or will have in a couple of days) another two founders on the small team working on the project and they are both significantly older than me, so hopefully that could help towards solving a few of the legal issues, the question is, would pg/harj/jessica and co. accept a young founder in a team of older founders?

</comment></comment></comment></comment><comment><USER3> Wouldn't you have to be 18 to enter into a contract with YC?

<comment><AUTHOR> I didn't think of that. The age of majority over here in the UK is only 16, I never thought to check if the US age was higher.

</comment></comment><comment><USER4> We're in the W11 batch, and on record as the youngest YC has accepted. I'm 18, and my cofounder is 17 (he hasn't graduated high school yet, which Ron Conway loved!)

<comment><AUTHOR> Okay, thats pretty encouraging :) You're the guys running minomonsters aren't you? Hows it going? I had a wander around the site a couple of days ago and its looking incredible!

</comment></comment><comment><USER5> You should follow the instructions listed on YC (<http://ycombinator.com/apply.html>) and email email@example.com.</comment>


Differential Expression Patterns of Non-Symbiotic Hemoglobins in Sugar Beet - <AUTHOR> http://pcp.oxfordjournals.org/content/55/4/834.full

<comment><AUTHOR> tl;dr: sugar beets might be a great ingredient for a blood substitute.</comment>


Shot in the arm for WP7 - <AUTHOR> http://www.webjives.org/shot-in-the-arm-for-wp7

<comment><USER2> Shot in the head, more like it. IDC has this prediction _wrong_.

The Nokia deal will kill Microsoft relationships with every other manufacturer. Won't Apple outsell Nokia in smartphones?</comment>


Towards Stealthy Manipulation of Road Navigation Systems [pdf] - <AUTHOR> https://people.cs.vt.edu/gangwang/sec18-gps.pdf <comment><USER2> Discussed 4 days ago:

[https://news.ycombinator.com/item?id=17539465](https://news.ycombinator.com/item?id=17539465)

<comment><USER3> For those that come after, the link is to the discussion of the news article, whereas this thread is the paper and actually a pretty interesting read

</comment></comment><comment><USER4> Critical sat-nav guided systems should not rely on unprotected satellite navigation alone. You need complementary systems.

There already exists Wide Area Augmentation System (WAAS) and European Geostationary Navigation Overlay Service (EGNOS). They augment GPS, GNSS and Golnass and provide accuracy, integrity, and availability. They are used in aviation.

EU's GNSS has PRS (Public Regulated Service). It is authenticated and can be used in sensitive applications for civilian uses. US has GPS modes that are protected but they seem to be only for military.

\---

ps. Many road navigation systems already have accelerometers in them. Relatively easy counter against road routing spoofing is to detect turns and directions. System could flash a warning that something is wrong if crude INS is not matching GPS signal. There are spoofing techniques that fool integrated GPS/INS but they are hard or impossible to use in roads.

</comment><comment><USER5> From their price list it looks like they decided to buy a Chinese clone HackRF instead of a HackRF One from greatscottgadgets or a distributor.

>All the components are available off-the-shelf. The total cost is about 223 US Dollars ($175+$35+$10+$3).

</comment><comment><USER6> Solution: rely on your own NI to detect that you are being mis-routed.

Then, reconsider the choice. Pretty sure the whole point of individual autonomy is life. Every bit we delegate is at our own peril.</comment>


White riot - <AUTHOR> http://www.vox.com/2016/9/19/12933072/far-right-white-riot-trump-brexit <comment><AUTHOR> The title doesn't do the article justice. It's an attempt to figure out how modern politics happened, and it's convincing.</comment>