Heliogen targets 1500°C solar thermal - <AUTHOR> https://www.vox.com/science-and-health/2019/11/19/20970252/climate-change-solar-heat-heliogen-csp <comment><USER2> [https://en.wikipedia.org/wiki/Odeillo_solar_furnace](https://en.wikipedia.org/wiki/Odeillo_solar_furnace)

"started operating in 1970", "Temperatures above 3,500 °C (6,330 °F) can be obtained in a few seconds".

See also [https://en.wikipedia.org/wiki/Solar_furnace](https://en.wikipedia.org/wiki/Solar_furnace)

Not dismissing this press release, but at least some scale of progress should be used to compare against. Or state where the economical/industrial/regulatory innovation stands.

<comment><USER3> Here's a better article which explains the advantages over traditional CSP.

[https://www.vox.com/platform/amp/science-and- health/2019/11/...](https://www.vox.com/platform/amp/science-and- health/2019/11/19/20970252/climate-change-solar-heat-heliogen-csp)

TL;DR Traditional CSP is aligned once, Heliogen aligns continuously. This allows them to correct for individual panel changes in warping, settling, weather, dust, etc. This approach also allows them to use cheaper hardware.

<comment><USER4> Well... no.

Motors and circuitry on each mirror instead of a simple screw drive are certainly not making the setup cheaper

It smells to me like a second Solindra in making

<comment><USER3> You didn't bother to read the article.

> Rather than assembling large, complicated, curved heliostats (mirrors) on > site, eSolar used small, flat, prefabricated heliostats of only about a > square meter. They were cheaper, faster and easier to set up, more modular, > and easier to replace.

> Gross's key insight was that he could replace a lot of the material and > labor involved in CSP with computing power. (Or, he could replace stuff with > intelligence.) Rather than make bigger, more complicated mirrors, he made > small, simple ones and controlled them with software, so they stayed aligned > more precisely and produced more power.

<comment><USER4> > You didn't bother to read the article.

I did, their entire premise is invalid. They are either very bad at math, or engineering, or both.

The metal part, screw drive, and simple pulleys and etc are nor hard, nor expensive. Saying it otherwise is purest bs.

The limits of precision of theodolite are more than enough position for precise initial reference.

Existing solar thermal farms were not designed for generation of process heat in mind to begin with, so them saying that they suck at that because of their "design" is a PR trick.

Existing thermochemical processes are profitable enough to burn oil for them, and if one minds anything cheaper, they will first consider CHP colocation before thinking of anything as weird as this.

<comment><USER5> The precisely curved mirrors are expensive, and likely dominate the BOM.

And tanks to economy of scales, electronic systems are now often cheaper than mechanical ones.

</comment></comment></comment></comment></comment></comment><comment><USER6> Bill Gross, Heliogen's current CEO previously founded eSolar. eSolar proposed using an array of Heliostaticly controlled mirrors to direct light toward a solar cell: [https://en.wikipedia.org/wiki/ESolar](https://en.wikipedia.org/wiki/ESolar) So... that part of the eSolar approach is carrying over into Heliogen.

Last time this was posted the "AI" component of the play was less clear... But with an array of mirrors, in particular being to generate heat in some volume I guess a more complex feedback/control system may be required.

<comment><USER7> What exactly do you need AI for except for buzzwording? It is not as if the sun/earth trajectory or rotation speed is random. You can precalc with ease at every point which is the best position for each mirror.

<comment><USER8> The difficult problem is not knowing where the sun is but knowing where the ground is. Since all the panels are separate structures not on a single rigid slab, ground "settling" can tilt them fractionally in unpredictable ways.

It sounds like what they have is machine vision as a novel input into a conventional control loop. For one panel at a time, wiggle it about and look how the light spot changes. Find the local maximum for tightest spot. That's now "locked" in the PLL sense and should stay locked for days or weeks.

<comment><USER9> From my comfy armchair, with zero experience in this field, it seems like you could use star tracking to very accurately predict the angle of the sun (since the sun is effectively fixed in position relative to the background stars over the timescales you'd care about). Spotting the target is a little harder, but the same measurement could be made by sticking some reflectors in known positions around the target.

I'm sure there are tons of considerations that aren't occurring to me (for instance, thermal expansion likely contributes substantially to making it a moving target (literally)), but I really don't see where "AI" comes into it...

<comment><USER10> Figuring out the sun's location is the easiest part of the problem. The hard part is that each mirror is a big, floppy slab that moves with wind, temperature, gear backlash, mechanical wear, rain/hail, and ground settling.

The so-called "AI" here is really just a clever way to use closed-loop control so that the above factors don't matter much.

(Side note: A large amount of "AI" these days just amounts to changing open- loop mechanisms to closed-loop, often by using computer vision as the state sensor. 3D printers, for example could become much more precise with no mechanical improvements if they did this. Probably some have already done so.)

</comment></comment></comment></comment></comment><comment><USER11> I think the point of calculating using imaging vs a model that requires layout and flat land etc is this would be cheaper to build. You have to build one collection tower/ target, and the mirrors can aim themselves. This greatly reduces the grading, measurement etc and makes installing on existing land without needing to flatten at all, or to some crazy tolerance, much easier. I can see this used in rolling hills, with less impact etc possible.

</comment><comment><USER12> Very skeptical that this is a practical means to supply 1500C to an industrial process. Do they plan on piping heat via liquid metal, or what? Do you shutdown on cloudy days and sen everyone home?

<comment><USER13> Just store some molten salt in a really big thermos

<comment><USER14> Since thermal energy is only lost at boundaries, the larger the amount you have, the smaller the net surface area per unit of volume.

This is how you can store huge blocks of ice well into the summer (e.g. [https://en.wikipedia.org/wiki/Ice_house_(building)](https://en.wikipedia.org/wiki/Ice_house_\(building\))), but also how a giant underground mass of molten salt that's not in physical contact with the surrounding ground could store a lot of heat for a long time.

<comment><USER15> > Since thermal energy is only lost at boundaries, the larger the amount you > have, the smaller the net surface area per unit of volume.

You do need to do the initial melting work though. It took two months for Crescent Dunes to melt its 32 tons of salt.

</comment></comment></comment></comment><comment><USER16> I'd love to see something like this put into use for smelting titanium. We really need to start embracing it as a building material as it doesn't corrode or break down like wood, steel, aluminum does...plus it's light and strong which would allow moving houses and vehicles made from it much less energy intensive. It would be great to invest the energy into building materials that can last instead of continuously having to fight corrosion.

</comment><comment><USER17> I wonder who Heliogen hired to do their PR. Must be a really good (or expensive) campaign. There is nothing new in high temperatures and the AI part is pure buzzwords.

<comment><USER18> I imagine that being able to throw around the name Bill Gates is as big an advantage as a good PR firm.

</comment></comment><comment><USER19> Inertia must be incredibly strong. Otherwise, why did it take so long to come up with something that strikingly simple? The last time someone allegedly had an idea like that was around 212 B.C., in the defense of Syracuse.

<comment><USER20> Because of oil lobby mostly. The idea is nothing new, it was just easier to burn oil instead of building new industry from ground up and going against all existing oil companies.

<comment><USER21> That "oil lobby" conspiracy theory is such nonsense. There are several developed countries with minimal oil reserves and no domestic oil companies. If alternative energy industries were really practical before then those countries would have built it.

</comment></comment></comment><comment><USER22> Another similar project in the mojave desert incinerates 6000 birds a year [1]. I wonder, how they handle that..

[1] [https://www.sciencealert.com/this-solar-plant- accidentally-i...](https://www.sciencealert.com/this-solar-plant-accidentally- incinerates-up-to-6-000-birds-a-year)

<comment><USER23> Is 6000 birds a year a lot? It's a serious question, I have no idea what fraction of birds in the area that is.

Is it comparable to the normal fluctuation in bird mortality in the area or is it so large that it has a disturbing effect on the population?

Of course fewer bird deaths would be good, and zero would be better.

But these bird deaths are noticed because of where they occur. What is the 'background' level, the death rate in the same place without the solar plant?

The Ivanpah installation is on a known migration route, presumably most other such installations will cause fewer bird deaths simply by not being on such a heavily used route. The article was a bit light on background information and I don't know how to find it.

<comment><USER24> I recall seeing a chart one day that showed bird deaths by source. Death by domestic cats were magnitudes higher than any other source.

<comment><USER25> The Mojave desert wilderness areas are not overrun with domestic cats.

6000 sounds like a lot to me. I have five acres near joshua tree, and while there is wild life the only stuff that seems to be abundant are some rodents, rabbits, and reptiles. It's a fragile ecosystem. There used to be tortoises supposedly, but the roads wiped them out.

<comment><USER24> The devils advocate view is that climate change will kill them all, so what's really that bad about 6000 birds?

<comment><USER25> It's not like this is the only method for harnessing the sun's energy.

PV fields for example don't cook the local fauna.</comment></comment></comment></comment></comment></comment>


Popular Chinese iOS apps compromised in malware attack - <AUTHOR> https://zh.greatfire.org/blog/2015/sep/popular-chinese-ios-apps-compromised-unprecedented-malware-attack <comment><USER3> Remember the NSA's infamous "I hunt sysadmins" [1].

Software engineers, ops people, and sysadmins at big tech companies with interesting data are high-value targets. If you can can run code on production infrastructure or a large install base, you should assume you are being actively, personally targeted by multiple advanced persistent threats, including at least one state intelligence agency, and adjust your OPSEC accordingly.

They want into your infrastructure, and the easiest way into your infrastructure may well be your SSH key.

What's paranoid for the general public is a pretty good idea for you.

[1] [https://theintercept.com/2014/03/20/inside-nsa-secret- effort...](https://theintercept.com/2014/03/20/inside-nsa-secret-efforts-hunt- hack-system-administrators/p)

<comment><USER4> To give some practically implementable advice, what you should do is run anything that parses untrusted input in a virtual machine or physically separate machine.

This means you should browse the web, read e-mail and read any Office/PDF/whatever files sent to you in a virtual machine that doesn't have access to anything more than strictly needed.

The reason is that most desktop software and OS kernels are not written with total security against NSA-like adversaries in mind, and as a result often have exploits that completely compromise the system. While they can still provide reasonable security against random attackers, they cannot provide any significant security against organizations (such as intelligence agencies) who can offer millions of dollars for exclusive access to unpatched exploits and MITM any connection.

You can install Qubes [[https://www.qubes-os.org](https://www.qubes-os.org)] if you want a system that makes it more convenient and secure to use virtual machines this way (and you trust its authors to not have backdoored it).

Furthermore, you should only install software from official sources and when you install software, you should make sure to check its digital signature or hash (from a separate virtual machine, since the one you are browsing with is potentially compromised as discussed above)

If you don't already have a trusted signing key stored on your machine, you should download the file itself or something guaranteeing its integrity if available (signing key, HTTPS certificate, file hash) from multiple Internet connections, such as a residential ISP, mobile ISP and multiple instances of Tor and make sure the downloaded data is the same. This is very likely to foil a targeted attack specifically designed to give a special trojaned version of the file or a replaced signing key under the attacker's control.

Of course it's impossible to defend against the original authors of the software being malicious or compromised themselves, or against an attack designed to give everyone maliciously altered software when you don't have a trusted key/certificate, but those are more likely to be discovered. Even if the downloaded software is malicious, if you are separating software by virtual machine as described above, the damage will be limited to the virtual machine the software runs in.

There are a lot of other things to consider, such as defending from physically targeted attacks (e.g. someone breaking in your home and installing a keylogger) if you are not anonymous and keeping your anonymity if you are.

<comment><USER5> Congratulations, you just described a security compliance program that's smaller than DFARS 252.204-7012, COBIT, PCI-DSS, HIPAA/HITECH, CLOUD SECURITY MATRIX, SANS CRITICAL CONTROLS, SOX, FEDRAMP/FISMA, and ISO 27001.

I keep reading (IMO nonsense) that best practices like those compliance frameworks aren't enough (mostly coming from Josh Corman). However, breaches are the on the rise and only 10% of the IT industry is goes through this thorough cleansing process.

Security Compliance forces you to go through that cleansing. This isn't a compliance burden, its just thorough hygiene.

Key Rotation process, Log Review process, Change control process, etc are examples of things in Compliance Frameworks.

Even the Chinese government is demanding that US Tech firms go through one of the above compliance programs.

[http://www.nytimes.com/2015/09/17/technology/china-tries- to-...](http://www.nytimes.com/2015/09/17/technology/china-tries-to-extract- pledge-of-compliance-from-us-tech-firms.html)

Sysadmins continuously foo foo that compliance is not security.

They foo foo on it because they're self-compliant - doing security processes right the first time around. Therefore those self-compliant sysadmins are already security competent and don't need to adhere to an external set of security compliance standards.

<comment><USER4> Well, for starters those standards don't seem to be targeted to individuals, and often the goal seems to be to just allow someone to say "I'm compliant with XXX" rather than telling them how to be secure.

The practical advice they give is in the form of obvious generalities ("setup your firewalls", "update your OS") without any concrete details on how to best do that or even a discussion on which attacks are prevented and which aren't

Threat model discussions, advice on choosing which threats you can realistically defend against, theoretical principles and talk about possible attacks also seem to be non-existent.

<comment><USER5> >The practical advice they give is in the form of obvious generalities ("setup your firewalls", "update your OS") without any concrete details on how to best do that

I hope you're not suggesting that security compliance isn't necessary because of the time-consuming external research involved. Sure its a usability problem but does that mean we should throw it out and just stick with Penetration Testing, Intrusion Detection Systems, and Risk Assessments? A security guy actually told me that just doing Pentesting, Risk Assessments, and IDS was good enough.

Personally, I believe the rest of the world doesn't have a reasonable alternative except for going through a thorough cleansing process of security compliance. That's why its been my mission to take out the guesswork from security compliance frameworks like DFARS 252.204-7012, COBIT, PCI-DSS, HIPAA, FEDRAMP/FISMA, ISO 27001/2.

However, I understand that these Compliance Frameworks might not be for you. It seems like you're already self-compliant with your security processes and you're so security-competent that you're doing things right the first time around.

<comment><USER3> It seems that organizations where security is a compliance-driven process are barely concerned or not concerned at all about security breaches, only regulators.

Some of those processes are a fucking joke. The HIPAA technical safeguards include nothing particularly interesting; the hard part is the paperwork and legal ass-covering. Some PCI-DSS "auditors" are nothing more than salespeople who bought Nessus or similar and charge $10k/pop to run it, slap a logo on its report, and email it to you. Security regulations that businesses at large actually seem to care about have _nothing at all_ to do with secure software engineering, just checking boxes like "have a firewall" and "have a password policy" and "have a network security policy" as if producing an endless trail of Word documents will make you less vulnerable.

<comment><USER5> >Some of those processes are a fucking joke.

superuser2: you're telling me that having a process for firewall changes or rotating your keys is a joke? What other process is a fucking joke? System Hardening? Log review? Source code analysis? Updating your network diagrams? Physical access monitoring? These are all processes (and more) that compliance says you should do.

You bitch about word documents when I bet you've never even gone through a __thorough __compliance process.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> The internet in China is so bad _developers at Tencent_ download _Xcode_ from random links on Chinese Dropbox? Pathetic.

<comment><USER7> It's bad when crossing the border. Rumor says it's due to traffic analysis by the GFW. I cannot find any source to prove or disprove that though.

<comment><USER8> The internet being bad is done on purpose. They don't have to make it shit with the traffic analysis, since internal traffic has traffic analysis too. They do it to keep china's internet an internal, more easily controllable intranet.

<comment><USER9> I think it has more to do with lack of competition in the ISP market. In most places, there's only one fixed line broadband provider, so there's incentive to increase speeds (as people will pay to get better quality streaming video on multiple devices) but none to improve peering with overseas networks.

</comment></comment></comment></comment><comment><AUTHOR> Tencent security team just posted a write-up on this issue on its blog. [http://security.tencent.com/index.php/blog/msg/96](http://security.tencent.com/index.php/blog/msg/96)

Here's the English translation:

\---

Sep 12 - When we were tracking down a bug, we discovered that there was suspicious encrypted traffic sent from one/some app(s) to one/some particular domain(s) when the app(s) was/were launched or closed. Front-end security team immediately followed the issue.

Sep 13 - Tencent product team released an updated version of the app(s). We notified CNCERT of the issue.

Sep 14 - CNCERT issued a pre-warning on its website. [1]

Sep 16 - We discovered that 76 of the top 5000 apps on App Store were infected. We notified Apple and most of the app vendors of the infected apps of the issue.

Sep 17 - Palo Alto Networks also discovered the issue and published a report of their preliminary findings[2], and so did Ali mobile security team[3].

Analysis

1\. Infected apps send the following information to attackers' servers: app name, app version, iOS version, locale, device type, country code, IDFV. The domain used is icloud-analysis.com. We also discovered three other domains that are not used.

2\. Attackers can identify every infected iOS device and issue commands to be executed via the openURL API.

3\. Attackers can invoke a customized alert box on infected iOS devices, showing whatever they want.

4\. The malicious remote control module itself is vulnerable to MiTM attack.

It should be noted that multiple versions of the remote control module are discovered, some of which do not have the capability described in (2) and (3).

[1] [http://www.cert.org.cn/publish/main/12/2015/2015091415282115...](http://www.cert.org.cn/publish/main/12/2015/20150914152821158428128/20150914152821158428128_.html)

[2] [http://researchcenter.paloaltonetworks.com/2015/09/novel- mal...](http://researchcenter.paloaltonetworks.com/2015/09/novel-malware- xcodeghost-modifies-xcode-infects-apple-ios-apps-and-hits-app-store/)

[3] [http://drops.wooyun.org/news/8864](http://drops.wooyun.org/news/8864) (Chinese)

</comment><comment><USER10> The WeChat team posted a public bulletin 24 hours ago saying that their was no leaked user info and that the issue only affects WeChat 6.2.5 users on iOS and that newer versions are not affected. An English version was published several hours afterwards and can be found here: [http://blog.wechat.com/2015/09/19/fixed-security-flaw-in- wec...](http://blog.wechat.com/2015/09/19/fixed-security-flaw-in- wechat-v6-2-5-for-ios/)

Fixed Security Flaw in WeChat 6.2.5 for iOS

A security flaw, caused by an external malware, was recently discovered affecting iOS users only on WeChat version 6.2.5. This flaw has been repaired and will not affect users who install or upgrade WeChat version 6.2.6 or greater, currently available on the iOS App Store. Here are some important points about the situation.

1\. The flaw, described in recent media reports, only affects WeChat v6.2.5 for iOS. Newer versions of WeChat (versions 6.2.6 or greater) are not affected.

2\. A preliminary investigation into the flaw has revealed that there has been no theft and leakage of users' information or money, but the WeChat team will continue to closely monitor the situation. 3\. The WeChat tech team has extensive experience combating attempts to hack our systems. Once the security flaw was discovered, the team immediately took steps to secure against any theft of user information. 4\. Users who encounter any issues can contact the team by leaving feedback in the "WeChat Team" WeChat account.

The WeChat Team September 18, 2015

<comment><USER11> The statement is controversy.

It said WeChat 6.2.5 has been affected. But it also said no leaked user info. If it was affected, how do you know there is no leaking? if the flaw doesn't theft anything? what does it do? a joke?

<comment><USER12> Maybe a proof of concept? ;) [https://twitter.com/bitinn/status/644941027023818753](https://twitter.com/bitinn/status/644941027023818753)

</comment></comment></comment><comment><USER13> It's amazing how widespread this is, perhaps the biggest malware infection ever in sheer number of devices affected? The Xcode attack vector is evil genius.

So all these apps are transmitting user data (basic device information) to 'icloud-analysis.com' and no one notices for how long?

I wish there were better tools to monitor outbound traffic from our own devices, but I guess it's just too overwhelming how many different places our data is sent in an average day of browsing.

<comment><USER14> The best tool I've found so far is MITMProxy [1]. It lets you snoop all your HTTP(s) traffic from your iPhone. You just have to keep it running on your PC (or server, if you want) and set the HTTP Proxy settings accordingly. Then you have to install a CA certificate (that has been locally created and is only known by you). It is pretty interesting what data your phone is sending. Of course, you could simply trick this tool by not using HTTPS (and send it over FTP or a custom protocol instead) but it is a good start.

[1] [https://mitmproxy.org/](https://mitmproxy.org/)

</comment></comment><comment><USER15> Really?

So the developers of wechat had their xcode infected by something and now an unauthorized tracker is on the ios wechat app?!

Wechat with about 500 mio users! Probably running on about 90% of Chinese- owned iPhones.

I would like to see some independent confirmation of that.

<comment><USER16> It's true and if you read Chinese, it is already all over the Internet.

On twitter, most of them are under #XcodeGhost[0].

Besides, the (alleged) author has put the source code on github[1].

0\. [https://twitter.com/hashtag/XcodeGhost?src=hash](https://twitter.com/hashtag/XcodeGhost?src=hash)

1\. [https://github.com/XcodeGhostSource/XcodeGhost](https://github.com/XcodeGhostSource/XcodeGhost)

Update 1: Add the source code of XcodeGhost

<comment><USER15> I don't read Chinese but this reads very sensational. For example it says not to download WeChat at all while its sources seem to say it is only an older version that is affected.

The sources seems to be tweet-like forum postings.

Think about it. If Facebook had their releases infected by a virus - <USER2> would be needed to convince the world?

It would either require Facebook to officially acknowledge it or have someone do an explicit reproducable analysis of a release.

I.e. this particular version 6.23 of Messenger, signed by Facebook, that you can download here, does sends user information, under these circumstances, to this address which it is clearly not a part of Facebook but belongs to this malicious compiler virus.

<comment><USER15> I can now see that the developers of WeChat Tencent have acknowledge that a release of theirs has been infected:

[http://security.tencent.com/index.php/blog/msg/96](http://security.tencent.com/index.php/blog/msg/96)

Wrt. to this github:

[https://github.com/XcodeGhostSource/XcodeGhost](https://github.com/XcodeGhostSource/XcodeGhost)

As far as I can see what this code does is that it sends some basic user information to an external website and it may popup an alert window or open Safari or other apps based on the response of that external website.

It is not a compiler virus and there is nothing on how you can modify an XCode release to add the above into other developers' apps.

<comment><USER17> >It is not a compiler virus

Nobody said it was. Modifying a compiler to inject XcodeGhost is simple assembly work. Almost anyone could figure it out in an afternoon.

Multiple independent security organizations are reporting that the modified XCode release was shared via a filesharing site in China. That is how so many Chinese iOS developers came across it.

The version of XcodeGhost on github is a harmless version posted by the original author. The actual compiled code being found in the wild has malicious abilities not found in the code in that GitHub repo.

</comment></comment></comment></comment></comment><comment><AUTHOR> @XcodeGhostSource on GitHub claims to be the author of the malware and open- sourced it and apologizes.

"XcodeGhost" Source: [https://github.com/XcodeGhostSource/XcodeGhost](https://github.com/XcodeGhostSource/XcodeGhost)

<comment><USER18> What I am interested in is the authenticity of this source. Could it be a "modified" source with the personal-info-tracking code removed? Any confirmation on this?

</comment></comment><comment><USER18> Update: it may be able to steal iCloud passwords:

[http://researchcenter.paloaltonetworks.com/2015/09/update- xc...](http://researchcenter.paloaltonetworks.com/2015/09/update-xcodeghost- attacker-can-phish-passwords-and-open-urls-though-infected-apps/)

<comment><USER19> That's crazy!

</comment></comment><comment><USER20> Is there any new information on how the attack works?

Was it something that's injected at compile time (the Xcode building the app store version was compromised for all these apps?)? Was it just files added to the project if anyone on the team used the compromised Xcode?

</comment><comment><USER21> A Chinese coworker sent me this link this morning, but HN said it had already been submitted (but I couldn't find it): [http://researchcenter.paloaltonetworks.com/2015/09/novel- mal...](http://researchcenter.paloaltonetworks.com/2015/09/novel-malware- xcodeghost-modifies-xcode-infects-apple-ios-apps-and-hits-app-store/)

If you're going to target developers, I'd think their keychain contents would be valuable too. Grab their Apple account credentials and their signing credentials. Have Xcode phone home, and custom craft a payload for their app.

</comment><comment><USER22> _> If you are an iOS developer, however, a lot can be done to secure your development system:... Separate your development system with your everyday system. Development systems should be used solely for development and not for browsing random sites. If physical separation presents too much of a problem for developers, at the very least, a dedicated user account for development should be used._

I'm not an application developer, but I haven't seen this recommended before and it sounds a bit extreme. Is it a standard, recommended best practice for development environments that must sign code?

<comment><USER23> It's often good practice to have a dedicated build server responsible for producing your release builds and owning the release key. That machine should be kept as secure as possible, along with your source control server.

However, isolating machines used solely for _development_ is not common. A leaked development key is typically not very useful. The resulting code is usually not run anywhere other than the developer's own hardware.

(A compromised dev machine in this scenario could still be used to push malicious code to source control, which would be bad. So it's still good to keep security in mind. But at least that's potentially detectable compared to a compromised compiler. This is also where mandatory code review prior to commit can be useful.)

</comment></comment><comment><USER24> Think only Chinese iOS Apps are affected? Think again, because your favorite app might just be outsourced to Chinese developers.

Apps like Mercury, WinZip, PDFReader are reported to be affected by this Xcode trojan (have been taken down by Apple).

[http://researchcenter.paloaltonetworks.com/2015/09/malware-x...](http://researchcenter.paloaltonetworks.com/2015/09/malware- xcodeghost-infects-39-ios-apps-including-wechat-affecting-hundreds-of- millions-of-users/)

<comment><USER25> IOS now is the most dangerous platform...

<comment><USER26> Not by a large margin.

First of all, it's not the platform. There wasn't some vulnerability found in iOS that made this possible.

It's caused by pirated infected third party XCode downloads. If you use third party Visual Studio or Eclipse/Idea for Android development, you can get the same exact issues.

Second, apps run in a sandbox in iOS anyway, so those infected apps can't do much besides giving you ads and data about their usage.

Thirds, that's like 100 apps in the list, mostly all made in China, and all by people with infected, non-official XCode.

Contrast with malware in Android landm which amounts to 97% of mobile malware: [http://www.forbes.com/sites/gordonkelly/2014/03/24/report-97...](http://www.forbes.com/sites/gordonkelly/2014/03/24/report-97-of- mobile-malware-is-on-android-this-is-the-easy-way-you-stay-safe/)

<comment><USER11> Thanks for correcting me. I am wondering if IOS could add a new feature to detect bad apps.

For example IOS could give an operation history summary for each App. The list could be something like this:

APP1:

Photo ---- read ? times write ? times

Contact ---- ...

sms ---- ...

device ID ---- ...

APP2:

Photo ---- read ? times write ? times

Contact ---- ...

sms ---- ...

device ID ---- ...

customer can turn on/off this feature.

I believe if IOS have this feature, it will be much easier for IOS user to find out the bad APP.

<comment><USER26> > _I am wondering if IOS could add a new feature to detect bad apps._

I think Apple can add such as a step into their build process (IIRC, with the new XCode 7 there's the option to submit a kind of bytecode to be built on Apple's servers depending on the target architecture etc).

Another thing they could do is enable some kind of "Little Snitch"-like network connection that a user can enable for apps. This way the user can be informed for any "mysterious" external connections going on.

</comment></comment></comment></comment></comment><comment><USER27> Downloading apps from App Store is very slow in China and sometimes you can't even open App Store successfully. It's not Apple's fault (but Apple should do something to solve it). The real cause is the gov and GFW. Many developers use XunLei(Thunder, a p2p downloading tool) to accelerate downloading. I used it too when I was in Shanghai China. After I moved to Hong Kong, I always download directly from App Store and the downloading speed is about 5MB/s.

<comment><USER28> What can Apple reliably do without exposing the source code and attribution (with signig) of every file used to generate the app, run inside a signed environment on a locked down computer?

Please. This is the GFW.

<comment><USER29> I think that at least Apple could put the Xcode binary files onto a CDN inside China. I'm trying to download Xcode 7.0 from the App Store today, and it's still hanging after a few hours.

<comment><USER28> And when that CDN has a hiccup dozens of iOS developers go elsewhere.

Also, this is by no means an Xcode problem only. It potentially affects every piece of software and even code rehosted from github. Does that copy of that library developed on github, mirrored on Baidu, contain a backdoor?

</comment></comment></comment></comment><comment><USER30> I'm trying to figure out if the version of WeChat I have installed is compromised. I haven't been able to find any specifics about versions of any of the apps. Does anyone have more info?

<comment><USER31> According to Tencent, only 6.2.5 is compromised. If you updated to 6.2.6 you should be fine.

</comment></comment><comment><USER18> I find it interesting that the source code on GitHub was committed by 2 different users with the same user name XcodeGhostSource, one for the code and one for the README.md. Are these two separate persons? Or maybe the one for the code was committed before using the same email to register GitHub account?

[https://github.com/XcodeGhostSource/XcodeGhost/commits/maste...](https://github.com/XcodeGhostSource/XcodeGhost/commits/master)

<comment><USER32> Different email address it seems.

[https://github.com/XcodeGhostSource/XcodeGhost/commit/e5b527...](https://github.com/XcodeGhostSource/XcodeGhost/commit/e5b5273286916072cc25491fd187c64ba305427d.patch)

[https://github.com/XcodeGhostSource/XcodeGhost/commit/014f78...](https://github.com/XcodeGhostSource/XcodeGhost/commit/014f78d56644c2f64f479b93ea60556b58f72aad.patch)

<comment><USER18> Wow. I didn't know you could track down the email address using commit information. Now this guy is exposed in terms of the online identity.

</comment></comment></comment><comment><USER33> A Chinese resource about XcodeGhost [http://mp.weixin.qq.com/s?__biz=MzAxMzE2Mjc2Ng==&mid=2118455...](http://mp.weixin.qq.com/s?__biz=MzAxMzE2Mjc2Ng==&mid=211845527&idx=1&sn=a1c17d8ebff2e907bf603c07e3cf67f9&scene=1&srcid=0918WqYcCOw1fstx72SHogUP)

</comment><comment><USER34> Honestly... what's the difference between this kind of malware and the data- mining performed on websites, OSes (Windows 10, Android, iOS..), cellular companies, government backdoors, etal..? It's sickening (and criminal) that it's gotten to the point it has.

<comment><USER35> Did you read the article? This isn't a company intentionally mining user data, which is usually not criminal, as the EULA would have allowed those companies to do so. This is developers downloading Xcode from third-party sources, which are compromised and would inject third-party code to iOS apps sending analytics to a third-party server, without knowledge of the original developer.

<comment><USER36> What sort of analytics? Apple has blocked most of them. Why not just create some flashlight apps?

<comment><USER37> According to the posted source (if that's the actual one) it is just basic stuff.

But being able to inject code like that, as the article describes, could present fake login windows and whatnot for phishing attacks.

</comment></comment></comment></comment><comment><USER38> Can't believe anyone would download FREE software from any other than the original author. This screams for that kind of attack!

</comment><comment><USER25> Is it possible that developer outside China download the infected Xcode? if so, it will be critical issue.

<comment><USER39> Surely you can.

</comment></comment><comment><USER40> Makes me wonder if any other tool chains / compilers have already been co- opted in the wild.

</comment><comment><USER41> How about the other Chinese IOS APP?

</comment><comment><USER42> obviously to monitor and crush dissent

</comment><comment><USER43> oh!!!!!!!!!

</comment><comment><USER44> What about Android? Can the same scheme happen to Eclipse and affect Android apps, too?

Now, do we all switch to Windows phones?

<comment><USER45> Because Google is not available in China, so most of Android developers in big companies know how to cross the GFW, after crossing the CDN of Google will make the download very fast. So I think Android apps may be less effected under this situation.

<comment><USER46> wrong most of the time Google is accessible in China, different from several years ago

</comment></comment></comment><comment><USER47> > The compromised version of Xcode was hosted on Baidu Pan. It is unlikely > that Baidu was aware of the compromised version of Xcode.

I'm sorry, but at this point I no longer think "it is unlikely" Baidu was unaware. I find it too coincidental based on the simple fact that they were also involved with the DDoS attack on GitHub earlier this year.

<comment><USER9> "Baidu Yun" is an online file locker (like Dropbox) with a generous free quota. You can create a shareable link for a file with a single click. Why would you think someone at Baidu would have knowledge of a particular file a user shared on that service?

Separately, you bring up Baidu's "involvement" in the DDoS attack on GitHub. I remember reading that this was achieved using a man-in-the-middle attack on customers of Baidu's analytics product, which would not need Baidu's cooperation: [http://www.netresec.com/?page=Blog&month=2015-03&post=China%...](http://www.netresec.com/?page=Blog&month=2015-03&post=China%27s-Man- on-the-Side-Attack-on-GitHub)</comment></comment>


CSS grid garden - <AUTHOR> http://cssgridgarden.com/#en <comment><USER2> This makes me sad. Not because I don't like grid. But because two weeks ago I found out that a very senior person in the company has a computer running IE11, and will not let IT upgrade her machine.

She recently discovered that one of the company's web sites doesn't look right in IE11, and shit ran downhill into my lap. I checked the logs, and yep... she's the only IE11 machine to hit any of the web sites in a year.

I spent a day and a half downgrading the site from CSS grid to Flexbox only to discover that once I found an old machine in a closet that has IE11 on it that I could test with that IE11 doesn't fully support Flexbox, either!

Solution: Each building on campus has its own IP address. Connections from her building get a table version.

<comment><USER3> Interested to hear what flexbox features were unsupported? I've been in a same kind of situation but was able to support everything on "IE version" of the app by using flexbox.

<comment><USER4> Most of flexbox is supported in IE11, but some "defaults" are not the same as other browsers --> see the known issues tab if you're interested, most of the time it works but when it doesn't it's frustrating [https://caniuse.com/#feat=flexbox](https://caniuse.com/#feat=flexbox)

</comment></comment></comment><comment><USER5> This couldn't be more timely. I was just thinking maybe a day or so ago "It's probably about time I sit down and learn CSS grids." Love the format, thanks for sharing!

</comment><comment><USER6> From 2017: [https://news.ycombinator.com/item?id=14041367](https://news.ycombinator.com/item?id=14041367)

<comment><USER7> Nice job! I had a strange feeling I had seen this before.

That being said, I love the concept. Fun way to get some practice in!

</comment></comment><comment><USER8> Curious as to why CSS Grid chose to start at 1-index rather than zero, and why the end column is one more than the position of the column that actually stops.

<comment><USER9> Maybe designers don't have a culture of counting from 0 like programmers do?

<comment><USER10> Programmers don't count from 0. Its just in many languages it makes sense like in C where an arrays name is actually a pointer to the first element and the index says how many positions to move away from it so foo[0] is the pointer to the first element and then move 0 spaces away.

The tradition of starting at 0 just got carried on to everything because having a standard is better than having to memorize what everything uses

<comment><USER11> There are good reasons to start counting at 0 beyond convention. Dijkstra wrote a small essay on the topic in 1982 called "Why numbering should start at zero."

[http://www.cs.utexas.edu/users/EWD/transcriptions/EWD08xx/EW...](http://www.cs.utexas.edu/users/EWD/transcriptions/EWD08xx/EWD831.html)

<comment><USER12> As someone that started programming in languages that count from 1, I kind of disagree with that essay.

Specially when dealing with Algol derived languages, where the indexes can be specified in a flexible way.

</comment></comment></comment></comment></comment><comment><USER13> Is there a more legible version of this that's not grey on oh-so-slightly lighter grey?

I'd love to use it but I was looking at the grey box for about 3 minutes before I realized there was text in there.

<comment><USER14> You can use your browser's inspector to change the CSS for the background and/or text color of the box. There aren't any page loads between exercises, so it'll stay changed as you progress.

</comment></comment><comment><USER15> Attempting to use grid-column-end: -1 works visually in the watering example, but won't let me move forward.

EDIT: Oh, I see. -3 worked.

<comment><USER16> nice. couldn't proceed till i read your comment.

</comment></comment><comment><USER17> start counting at 1 instead of zero, ok, its valid.

column-end means really "end+1", why?

problem: when you go from left-to-right: column-start-3,column-end-5: means column #3 is included

when you go from right-to-left: column-start-3,column-end-1: means column #3 is NOT included

So if you read "column-start-3" you don't know if column#3 is included or not, it depends on column-end.

"column-start-3,column-end-5" should include column 3, 4 AND 5

This is from level 10:

>For example, grid-column: 2 / 4; will set the grid item to start on the 2nd vertical grid line and end on the 4th grid line.

What's the correct interpretation of "start on 2nd and end on the 4th"? shouldn't the 4th be included?

<comment><USER18> I believe it's talking about the vertical lines, not the column space between them. So the "+1" is because it's talking about the rightmost edge of what you're calling a "column".

here's an image that may explain better. I numbered the vertical edges, start is green, end is red.

[https://imgur.com/a/xCplwAt](https://imgur.com/a/xCplwAt)

</comment></comment><comment><USER19> This is definitely helping my understanding of the grid system, thanks to the author!

The only thing I would suggest is to add some explanations, maybe some mnemonic aids and such. I'd be happy to help.

</comment><comment><USER20> Flex seems more flexible to me than CSS Grid.

<comment><USER21> They actually made another game to learn flexbox [https://flexboxfroggy.com/](https://flexboxfroggy.com/)

<comment><USER22> This is how I've learned enough flexbox to get by, and it was a total blast

</comment></comment></comment><comment><USER23> I played CSS Diner in 2014. [https://flukeout.github.io/](https://flukeout.github.io/)

Grid Garden copied the concept.

</comment><comment><USER24> I'm stuck at level 21. This didn't work:

grid-template-columns: repeat (8, 12.5%);

Am I doing something wrong or is it a bug?

<comment><USER25> That's what works for me, maybe take the space off after "repeat"

</comment></comment><comment><USER26> When is project G coming out? Been waiting forever to play that one

</comment><comment><USER27> This would make for an interesting interview test for a front-end developer.

<comment><USER8> I feel like interviewing on something that is both extremely new and easily google-able is not the best idea.

</comment></comment><comment><USER28> Dupe detector not working as always [https://news.ycombinator.com/item?id=18751976](https://news.ycombinator.com/item?id=18751976)

Also you should check out [http://flexboxfroggy.com/](http://flexboxfroggy.com/)

<comment><USER6> On HN it doesn't count as a dupe if the story hasn't had significant attention in the last year or so. This is in the FAQ: [https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html).

More explanation at [https://news.ycombinator.com/item?id=16403654](https://news.ycombinator.com/item?id=16403654) and [https://news.ycombinator.com/item?id=16344002](https://news.ycombinator.com/item?id=16344002).

</comment></comment><comment><USER29> There's no mainstream browser that doesn't suck (ie, they're all walled gardens) that supports CSS grid. Plus the other 4 billion people on Earth not in modern countries.

<comment><USER30> Use CSS grid with Flexbox for fallback.

I create my mobile version of pages with Flexbox, so if the user's browser doesn't support it, they see the full featured mobile view. Progressive enhancement.

<comment><USER31> Curious how you manage this. Do you use feature detection and then apply a class to <body>?

<comment><USER32> Not OP, but it is usually done by using support tags:

[https://developer.mozilla.org/en- US/docs/Web/CSS/@supports](https://developer.mozilla.org/en- US/docs/Web/CSS/@supports)

You'd write two versions, one for browsers which do support grid and one for the ones which don't.

Jen Simmons has written excellent tutorials on doing fallbacks and explaining how we can use css grids nowadays: [https://hacks.mozilla.org/2016/08/using- feature-queries-in-c...](https://hacks.mozilla.org/2016/08/using-feature- queries-in-css/)

And also has a YouTube channel where she explains a lot on how to deal with css grid in the wild: [https://www.youtube.com/channel/UC7TizprGknbDalbHplROtag](https://www.youtube.com/channel/UC7TizprGknbDalbHplROtag)</comment></comment></comment></comment>


Why Japanese Whisky Is So Good and So Hard to Find - <AUTHOR> http://roadsandkingdoms.com/2018/japanese-whisky-good-hard-find/ <comment><USER2> 11-12 years ago, Santa Margherita Pinot Grigio used to be $9.99 a bottle.

It was a very good wine for cheap and wine hipsters loved it.

Then after a string of stellar reviews in different wine media outlets it became hard to find at $20-30+ a bottle.

The price, coupled with the scarcity and good reviews made it even more sought after. So production was increased.

Now it is easy to find for $18 a bottle.

Because it is now popular, and relatively expensive, wine hipsters turn their nose up at it.

Snobs will claim for days that the ramp up in production has led to quality differences to something they tasted a decade ago, with absolutely no way of supporting that claim.

I imagine the same thing happens with whisky, except whisky production is harder to increase due to aging requirements.

I'm 100% sure that if Japanese distilleries find some way of increasing production and availability, whisky snobs will wave their hands and say "oh they ruined it", even if every objective means of evaluating it shows it to be spectrometrically, molecularly, and even atomically identical in every way to whiskeys back when they were rare.

<comment><USER3> We should not underestimate the social and "hype" aspects of enjoying something. I enjoy things a lot more when I'm primed to enjoy them. It's sort of like the placebo effect for enjoyment. I'm much more charitable with a film made by a director who is well regarded than by an unknown, for better or worse. I suppose you can go the opposite way and only like things other people turn their noses at, but that's a bit misanthropic.

<comment><USER4> And the exclusivity factor. Whether a hidden vacation spot, restaurant, food, or under-appreciated spirit. Even a paid app from an indie dev gets is often more loved than the same app from mega corp would even if given away free.

Also why every large brewer has a bunch of "micro" brew labels with the big corp name nowhere in sight.

A Japanese friend gave me a bottle of Suntory about 10 years ago and it was my favorite whisky to share and talk about with others precisely because so unknown. It was also very tasty.

<comment><USER5> It's one of the main brands you can buy in any Japanese supermarket. It's also quite good value for money.

</comment></comment></comment></comment><comment><USER6> I'm a Scotch/whisky nerd going on 10 years now. Particularly obsessed with anything from Islay. 50+ bottle collection, mostly easy-to-find stuff but there are a few rare expressions in there (Ardbeg 2009 Committee Release Supernova is probably the most unobtainable). I'm a drinker, not a collector, everything has been opened and consumed at least partially.

With that out there, I don't get the buzz over Japanese whisky. I've got several solid, highly reviewed expressions, including the 2013 sherried Yamazaki that Jim Murray put on the map. I've done several blind tasting with friends, some of whom are afficionados and some of whom are not, and that Yamazaki never comes out on top. If I do a sherry-finished flight more often than not the sherried Kilchoman finishes first or second, with the Yamazki usually beating the Glenmorangie Lasanta and not much else. Laphroaig PX either wins or comes second to the Kilchoman.

Japanese whisky is good and they're consistently making the best whisky that's not coming from the island. But (IMO, of course, this is completely non- objective) the best expressions are still coming from Scotland.

<comment><USER7> hey! I have some scotch questions if you don't mind. I really love Lagavulin 8 + 16, Bunnahabhain 12, and Talisker 10. Less relevant I think McAllan 18 is good and Balvenie 21 as well. What should I try that is similar to these?

Every scotch I tried that is less than about ~45-50 USD I really hated, is there anything good that is cheap?

<comment><USER8> You are getting a lot of far too convoluted answers. The simple one is the Ardbeg Corryvreckan. It checks the value box easily - at nigh-60% alcohol, you can practically make two bottles of booze out of it by adding water. Taste and smell? On consumption, it removes your ability to taste and smell anything else making it incomparable and thus, the best whisky by default. Free bonus - The Corryvreckan sounds a character from a bad TV adaptation of a bad Neil Gaiman novel.

Also it will get you way drunk.

<comment><USER9> I like all the Ardbegs, particularly An Oa which is creamy, the 10 year which is refreshing (if any Islay can be called refreshing), and Uigeadail which is more caramel sweet than the others. These are all big peaty whisky.

Corryvreckan ... is more so. Tasting notes: refinery, bed fire, shipwreck. The distiller must have been out for a pint or five with the other distillers on the island ragging him about "too much, over the top" and decided to show them what "over the top" really was. Worth a try and good in its own way, but not for everyday.

<comment><USER8> _decided to show them what "over the top" really was._

That is exactly what happened. "Did you say Glugglugvulin? Cory is IN. THE. HOUSE."

</comment></comment></comment></comment></comment><comment><USER10> On the contrary, in Chicago, which admittedly has a pretty outstanding retail market for whiskey, it has never been easier to buy Japanese whiskey. Nikka Coffey Grain and even the Nikka Single Malts show up on the shelves at Binneys, our neighborhood liquor chain.

What is probably true is that it's harder to get _Yamazaki_. Yamazaki had a moment last year (I think?) when its Sherried Single Malt was named "best whiskey in the world". One reason why whiskey enthusiasts hate this "best whiskey in the world" nonsense is that it instantly turns brands into collector items, which get hoarded for trade and resale value instead of consumed by people who actually like whiskey.

But, whatever. Yamazaki was fine, but there's lots of good Japanese whiskey, and in the no-age-statement era of single malts, it has never been easier to get your hands on wine-casked whiskey expressions. It's a golden age. Enjoy it!

<comment><USER11> Same experience in Oakland. It has never been easier to find Japanese whiskey. In fact all kinds of spirits have been having a renaissance around here; you can get anything from anywhere including many local spirits. That's on top of the craft beer tidal wave.

<comment><USER12> > Same experience in Oakland.

Umami Mart on Broadway now has a really great selection of Japanese whiskey! They also have some super weird Japanese beers.

> That's on top of the craft beer tidal wave.

Ghosttown brewing in West Oakland shreds (and they have an amazing taco truck staffed by the nicest old ladies in the world)!

I've been a bit underwhelmed by the other breweries in Oakland. :( Federation's beers tend to be a bit skunky while OPBC's taste like water. Rose's and Temescal are merely ok. Woods' beers are awesome, but I'm pretty sure they are based in San Francisco.

<comment><USER11> Yeah I don't know if there's all that many craft beers _in_ Oakland, but the state is just crawling with them.

</comment></comment></comment></comment><comment><USER13> I miss being able to pickup Yamazaki 12 for $65. That said, while I like Japanese Whiskey I find it more novelty than quality. It's a great conversation piece for those not familiar with whiskey but I don't think it's some kind of Nectar of the Eastern God's...

I do regret not purchasing the bottle of Yamazaki 18 I saw in a store a few years back tho. Impossible to find nowadays.

<comment><USER14> Funny enough that's the one enormous benefit of having a state run liquor market in Oregon. I can search all liquor stores inventory and see that a store nearby has Yamazaki 18 for $249.95. Is it worth that price?

<comment><USER10> No, it is not. $250 will get you a _profoundly_ good bottle of Scotch, or a Buffalo Antique with enough left over to spare for a GlenDronach 15.

I bought an Yamazaki 18 a couple years ago and liked it, but I've had $70 bottles of Scotch since then that were far more memorable.

</comment></comment></comment><comment><USER15> Correct title, "Why Japanese Whiskey is so Trendy and Hard to Find"

Japanese whiskey hasn't changed meaningfully in decades yet it's become scarce (even in Japan) in the last few years. Yes it's good, but it's not magically distinctive as these instant aficionados suggest.

<comment><USER16> To see how trendy Japanese Whiskey is, I did a Google search with keyword "Why Japanese Whiskey is..." and there are at least a dozen articles from different media writing the same thing as this OP's article.

<comment><USER17> Google Trends has some interesting data on this one, not only did it seemingly come up for almost no interest but it's popular in the "hip" states: [https://trends.google.com/trends/explore?date=all&geo=US&q=j...](https://trends.google.com/trends/explore?date=all&geo=US&q=japanese%20whiskey)

<comment><USER18> More like popular in the more affluent states. That map is eerily similar to a map of GDP per capita by state.

</comment></comment></comment></comment><comment><USER19> The real reason: Chinese tourists buying anything that is "popular" and "good", go to any places in Japan and it's overran and ruined by them. Lot's of articles on that (google chinese tourist hibiki, plenty of results, including ft.com articles)

<comment><USER20> Your tone makes it sound like this is something terrible. Why shouldn't Chinese people have just as much right as anyone else to buy things they want, if they have the money for it?

<comment><USER19> Try to guess why they are called locusts.

<comment><USER21> Funnily enough I was just reading, locust is apparently a reference to the evils of capitalism. From Bloomberg [1],

> Within hours of Heinrich Hiesinger stepping down as ThyssenKrupp AG chief > executive last week amid pressure from activist investors, the talk turned > to "locusts," Germany's catch-all term for the evils of Anglo-Saxon > capitalism.

[1] [https://www.bloomberg.com/view/articles/2018-07-10/hedge- fun...](https://www.bloomberg.com/view/articles/2018-07-10/hedge-fund-locusts- aren-t-the-cause-of-germany-s-ills)

<comment><USER19> It's more a reference to what is going on in HK (infamous ads from 2012...) and nearby countries. Baby formula is one example or straining the overall health care.

</comment></comment></comment></comment></comment><comment><USER22> How do people get into whiskey, anyway?

My few contacts looked like this:

* About 15 years ago I visited a friend who was studying in Edinburgh. She didn't know too much about it, but got into drinking it now and then, and she showed me two or three types. I liked them, although the only thing I can differentiate is peat or no peat, more or less. And she told me that it's okay to put water in it. Blew my mind!

* Around the same time, three of my friends got into whiskey. A lot. I sometimes tasted a bit when I was at their home. Two of them (a couple) fell into that hole and are now proud owners of many, many bottles, club memberships of Scottish distilleries, special glasses, holiday trips to a dozen distilleries, magazine subscriptions, everything.

* Whenever I hear whiskey fans talk about the drink, I hear wine talk. "It's a bit like freshly mowed grass from the south side of the hill, and a lot of bananas afterwards" or stuff like that. It turns me off, but it seems to be obligatory to talk like that.

* Two years ago I was at a pretty renowned whiskey bar/store: lots of different whiskeys, very expensive ones behind a fence, the owner also travelling to whiskey fairs. I asked the waitress to recommend one, for a total beginner. She had no clue about what the bar had to offer and said "maybe try the offer of the day?". Probably a temporary worker, but still...

* A year ago I met my friends again when I came back home. There was a small whisky fair (think: fifteen stores/importers from around Germany, and I think Austria as well). That was the worst anti-PR you could imagine. First of all, again nobody could recommend something for a beginner and maybe explain why they recommended this or that. They just shoved something towards me. When I even dared to ask, because this whole affair was so embarassingly snobbish. I was cringing hard when my friend was "debating" the finer points of Gaelic pronunciation with an importer. Or when another importer didn't want to tell where the (brandlabelled?) whisky was from, instead doing a little quiz ("There is a creek where distillery X is located, and if you follow it upstream, there are Y other distilleries. It's the one with no letter "C" and a yearly output of less than Z litres" or something like that). This was simply a bunch of nerds showing how much smarter they were than their counterpart.

* So far I'm very rarely buying something, and if I do, it's from the supermarket, and for mixed drinks. Jim Beam, usually. Hate me!

<comment><USER10> I guess I can hate you for mixing perfectly good Jim Beam into soda or whatever, but other than that, what's the problem?

For American whiskey, just drink lots of cheap whiskey and figure out what you like and don't like. Buy some Heaven Hill and some Knob Creek --- which is aged Jim Beam --- and see if you have a preference between the two; if you like the Knob Creek more, you like a little rye, and if you like the Heaven Hill, explored wheated bourbon.

For Scotch, try Springbank (Campbelltown), Aberlour A'bunadh (Speyside), and Bowmore (Islay). See which you like best.

If you're at a point where you have a particular kind of bourbon you like (high-rye or wheated or whatever) and a particular kind of Scotch you like (low peat or lots of sherry or whatever), then, I've got bad news for you: relative to the population, you are officially "into whiskey". :)

Start cheap and stay cheap as long as you can. Get to a point where if you're spending more than $30 for American whiskey or $60 for Scotch, you know exactly where the money is going and why you're spending it. I think that's the antidote to becoming a vanity whiskey weirdo.

<comment><USER8> _and Bowmore (Islay)._

Dyed-in-the-acrylic sock-hater.

</comment></comment></comment><comment><USER23> I have a strong skepticism towards aged spirits of any kind due to the traditionalist nature of their production, as well as due to the inherent biases involved in anything food or drink (e.g. wine tasting [1]). Aging is solely a factor of temperature, pressure, and time. Rum aged in the Bahamas ages quicker (by years) than that aged in cooler climates. Likewise, spirits aged at, say, 0C will age very slow, if at all. It's like making tea, where you can steep in cold water, but hot water expedites the process significantly. So why don't any of these spirit producers use a heated pressure chamber with some wood thrown in to "age" their spirits in hours instead of years? The answer is because many countries impose regulatory mandates that for X spirit to be labeled as such, it must be aged a minimum Y time. This minimum can be years for some spirits. Thus producers are forced to age traditionally regardless of the efficiency of their process. And you can't sell your pressure-aged spirit as "120 Years" despite the chemical processes involved being identical to traditional aging. Consumers might also perceive such process as of lesser quality. It's a sham, and the value of supposed quality spirits is artificially inflated by their arbitrary and involved production process, as well as by consumer bias.

[1] [https://en.wikipedia.org/wiki/Blind_wine_tasting](https://en.wikipedia.org/wiki/Blind_wine_tasting)

<comment><USER24> Bufalo Trace runs a ton of experimental runs of their Whiskey where they change all manner of variables. You can pretty routinely find vertical or horizontal tastings of their stuff to see what factors matter most to you.

The one I've found that seems to have the most flavor changes for the least amount of 'bad outcomes' is smaller casks. But even that you can fairly easily pick out once you've started finding your favorite flavor profiles.

Other distillers do the opposite, Makers Mark for instance is famous for moving casks all over their rick houses to account for the differences in heat/pressure/etc to get a more consistent flavor.

Lots of micro distillers are using 'modern' processes to get different flavors out of their production.

Thats a long way of saying, I disagree with you about it being rare for companies to mess with their production processes. Its quite common and the stigma against it is going away, not being reinforced.

<comment><USER23> I don't doubt that many producers aim to improve their process and flavor profile and aim to modernize. But how can they when something like Scotch must be aged 3 years in wood to be sold as such? That is, you can replicate the traditional Scotch aging process in a pressure chamber in a matter of days, and it tastes similar, and the chemical profile is similar, but you cannot sell it as Scotch unless you stick it in a wooden barrel for years. It's arbitrary and ridiculous.

But the article linked in the OP describes traditionalism. Nothing is stopping these Japanese distillers from innovating and expediting the aging process. So really, those low-stocks are artificially inflated in value.

Here is an interesting article [1]: _We put the distillate into a pressure capable stainless steel tank and then we cut up the wood from the barrel into measured segments. We control for size and shape and surface area and moisture content and weight. Once Cleveland's spirit is in the tank, the pressure is ratcheted up and then plunged down to a near vacuum. Supposedly, the process is similar to what happens when the temperature fluctuates in a rickhouse. Although "essentially, we're squeezing that wood much like a sponge," Lix says. "We pull a tremendous amount of flavor in a short time." "By the traditionalists, we're considered heretics and what we're doing is sacrilege," Lix continues. "We've been called the number one most hated bourbon distillery among old-school whiskey drinkers."_

Not only do these modern processes face regulatory restrictions in the market, they face backlash from the consumers themselves. I wouldn't be surprised if in a blind tasting, such pressure-aged spirits would fare favorably, but not if their brand and process was known. There is too much biased involved for me to appreciate any part of this industry and it as a hobby.

[1] [https://arstechnica.com/science/2016/07/the-scientific- arms-...](https://arstechnica.com/science/2016/07/the-scientific-arms-race-to- age-our-whiskey/)

<comment><USER10> The trend in Scotch is strongly towards no-age-statement (NAS) expressions. If they could reproduce aging in an Oloroso butt using pressure treatment, Diageo would already be doing it. Scotch tends to be aged for at least 10 years; the economics are such that even if they could just mix in pressure-aged distillate to cut down the aggregate ratio of aging years/liters, they'd be doing that, and still relating an "average age" over 10 years (which is roughly what they claim for NAS single-malt now). But they do not. They don't even do it for blends, where the distillates aren't even ostensibly traceable.

Is it possible that some technological approach will allow for radically accelerated aging of Scotch? I sure hope so!

Is your subtext --- that all Scotch is basically the same product regardless of how it's aged simply because someone has managed to extract phenylated esters from chunks of wood --- valid? No, it obviously is not.

</comment></comment></comment></comment><comment><USER25> Interesting, but whiskey advice from a fellow who drinks all of his in _highballs_?

<comment><USER26> Cut the guy some slack, this is a passion project of his. His day-job is writing for videogaming blog Kotaku: [https://kinja.com/brianashcraft](https://kinja.com/brianashcraft)

</comment></comment><comment><USER27> Much like Pappy Van Winkle, its popular now because its popular. People want what they can't have.

Good whiskey takes a while to mature (the lowest PVW ages for 15 years) so if there is a spike in demand, producers cannot react quickly.

<comment><USER10> Unlike Pappy van Winkle, Yamazaki is really quite good. 2 of the three Pappy bottles I've had tasted like grass clippings, and the 3rd was pretty unremarkable.

Also, careful with the aging comparisons. Single malt whiskey routinely ages for over a decade and the really expensive stuff for significantly longer than that. But Pappy is a bourbon, and it is unusual for bourbons to age for 15 years, not because it's expensive but because it's often counterproductive. I think? several of the Buffalo Trace Antiques are even no-age-statement.

<comment><USER24> I stopped drinking Van Winkle a while ago when the price to quality ratio when sideways. That said, claiming it isn't good is a stretch. Its _very_ good whiskey. Just not much better than a load of other _very_ good whiskey. That said, when I was drinking it, I preferred the 12 year to all the other expressions.

The sweet spot for bourbon seems to be in that 8-12 year market. Unfortunately that stuff is basically the hardest to sell these days. It used to be that a 6 year bourbon was fairly easy to find (VOB for instance used to do that at bottom shelf prices). But now thats treated like an antique. While if you have 12 year old barrels sitting around it makes sense to hold them until they are into ridiculous ages for the collector market.

<comment><USER10> We had at the old office a 15 and a 20, and they both tasted like grass clippings. Not hay, not tobacco, just fresh, slightly sour cut grass. I think that's how it's supposed to taste.

I've had a 23 in a glass and liked it fine, but I've had vanity whiskey that completely blew my head off --- Thomas Handy, Stagg, Booker's Rye --- and the Pappy wasn't one of them.

<comment><USER24> I mean, I've had vanity Laphroag that only tasted of wood fire. Doesn't make it not good. I certainly wouldn't pay for it but I'm not saying its bad whiskey.

<comment><USER10> I'm like 90% sure they make Laphroaig by distilling ground up burnt swamp frogs. I'm comfortable saying it's bad.

(I'm off to Michigan this weekend and my plan is to spend a fixed % of the price of the beach house we rented on whiskey, so this stuff is very top-of- mind for me right now. Had this thread not occurred, I'm like 90% sure I'd have gotten talked into buying Kavelan, so it's already a major win.)

<comment><USER24> Try some of the micro distillers up and down the state of Michigan. Then judge 'bad' vs 'good' whiskey.

At the end of the day, not liking something and not believing it is appropriate value are different than 'this stuff is broken'. Which seems to be the state of lots of micro distilleries.

[edit] also, i didnt want to imply I didn't like the Kavalan only that _everyones_ whiskey guy is selling that stuff in Chicago right now. I havent actually tried it, mostly cause i blew my budget on mezcal a while back.

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> I really, really don't understand the expensive alcohol hobby. For those of you that do, is it more about finding and trying cool stuff? Because I can completely relate to that. I just feel like expensive alcohol is so transient, and can't provide the same experience that the equivalently priced food could.

<comment><USER29> Actually at least in my experience the people into expensive alcohol tend to like collecting it, which I find odd. I'm into food and I enjoy food with my friends who are also into food (note I said food, it doesn't have to be expensive, just good). My friends who are into expensive alcohol like having huge stocks of expensive alcohol that they rarely or never drink because it's expensive. Doesn't sound like much fun.

<comment><USER30> Unlike alcohol, food is generally perishable. Plus a (responsible) alcohol connoisseur's consumption is more strictly throttled by his body.

<comment><USER29> It's not stock in a public company or money in your IRA, it's alcohol, drink up & enjoy!

</comment></comment></comment></comment><comment><USER31> My friends were involved in popularizing this on the west coast, worked for and with Yamazaki. This is a misleading title. The article says nothing about why it's "so good." Only why it is hard to find. At best it mentions that "People see Japanese whisky as a super premium product." But this is pure perception. The "goodness" is assumed. Rarity itself is proof positive.

I am not saying anything about the actual quality of Japanese whisky here (I happen to like much of it). But I will note that the concepts of "good" in the spirits world are very much influenced by subtle and not so subtle signals like this article title, brand ambassadors, good stories, exclusivity, "authenticity", etc.

<comment><USER32> It seems like the article highlights the non-traditional things Japanese whisky makers are doing (e.g. using woods other than oak in their barrels).

In other words, the Japanese whisky makers are successfully innovating and exercising more creativity than most American and European whisky makers. And it seems to be paying off in terms of flavor.

</comment></comment><comment><USER33> >If it's summertime and I'm eating Osaka's soul food, then I'll order a highball. If I'm in a restaurant, I'll order a proper highball in a glass, but if I'm at the supermarket and we're going to make takoyaki at home, then I'll just buy it in the can. Canned highballs are one of the great cheap drinking pleasures of Japan.

I've wondered about this: anybody know if the highball-in-a-can is really whiskey or a kind of shochu?

<comment><USER34> I've consumed my fair share and wish so desperately that those would come stateside. Based on taste I'd be pretty sure it's whiskey. Also, the english language suntory site states that they are whiskey.

[https://www.suntory.com/brands/cannedkakuhighball/](https://www.suntory.com/brands/cannedkakuhighball/)

</comment></comment><comment><USER35> I lucked out and found a bottle of Hibiki 17 for very cheap last year, and stocked some bottles of Yamazaki 12, when the stocking situation started looking bad, but the actual discontinuation made me really sad, as those are 2 of my favourite whisky :(

</comment><comment><USER36> Tip: if you happen to be in Boston or New Hampshire the state run store in South Nashua, New Hampshire[1] typically has a fair amount of Japanese brands in stock. I have a relative from Connecticut that is a whisky enthusiast and every time he visits he stocks up since he can't find them down there.

Obviously not the ridiculously expensive ones but still hard to come by. I wouldn't even know they were hard to come by if my relative hadn't told me.

[1] [https://goo.gl/maps/crkqY9Z1KgK2](https://goo.gl/maps/crkqY9Z1KgK2)

</comment><comment><USER37> For relaxing times, make it Suntory time.

EDIT: According to several articles, this Bill Murray bit from _Lost in Translation_ is partially responsible for creating the current run on Japanese whiskey. Small world.

</comment><comment><USER38> Wabi in Venice Beach had a good selection when I was there. My biggest gripe with all (non American) whiskey is price. Kind of hard to experiment when you are looking at $20+ a glass.

</comment><comment><USER39> The reason it's hard to find is because the sherry cask Yamazaki won best whiskey of the year a few years ago. It was a limited batch so everyone started buying everything Japanese. The sherry cask that won used to go for ~150/bottle. Now it's $3k. Now I'm priced out of all of my favorite whiskies. Fuck you, hipsters!@

</comment><comment><USER40> TLDR: It takes a really long time to make Whiskey. It recently became more popular and production is taking a long time to ramp up to meet the demand.

This results in price increases that reflect the increase in _scarcity_ more than an increase in _quality_.

Followers of Rick and Morty and the McDonald's sauce debacle will be familiar with the concept.

</comment><comment><USER41> I stayed in a hotel in Kobe a couple of years ago. The room had mini bottles of Yamazaki in it, and it turned out they were free, and replenished every day! Neecdless to say, my wife and I took full advantage...

</comment><comment><USER42> Can anyone explain what is going on in the first image at the top of the screen where there appears to be a barrel being rolled through fire?

<comment><USER27> It looks like they are charring the barrel

[https://www.angelsenvy.com/guide/whiskey-history/why- charrin...](https://www.angelsenvy.com/guide/whiskey-history/why-charring- barrels-matters/)

> People have suggested that the inside of barrels were originally burnt to > remove the leftover flavors of goods previously stored within, which sounds > reasonable enough ... So why do barrel coopers still char the interior? ... > Charring the wood actually primes the wood, which impacts the spirit's > flavor in several important ways that have nothing to do with smokiness ... > charring essentially opens the wood up, making it easier for bourbon to > extract flavors.

<comment><USER10> Ironically, it's a little unlikely that Yamazaki barrels are charred. American whiskey is aged in new oak, which is charred or toasted both to standardize quality and also to bring out caramel and vanilla notes from the wood. But single malt scotch is generally aged in used barrels and the barrels are selected in part for the characteristics of what was aged in them before, which is why the "best whiskey in the world" Yamazaki 18 Sherry Cask costs so much. Charring is what you do, in Scotland, to an exhausted cask; it's also something Scotch distillers work to mitigate in ex-bourbon casks.

<comment><USER43> The photo looks like it's of a cask firing at Ariake Sangyo [0], which manufactures barrels for a variety of uses. About 10 percent of their barrels go to domestic whiskey producers, and the rest to shochu. Yamazaki has their own cooperage, so that barrel isn't going to them.

However, Yamazaki does use a variety of different barrels, including wine casks for finishing, sherry casks, mizunara (Japanese oak) casks, new American white oak puncheons, hogsheads made of used barrels, and ex-bourbon barrels. AFAIK they use a variety of char levels on the barrels they produce in house and on re-chars.

[0] [http://www.ariakesangyo.co.jp/](http://www.ariakesangyo.co.jp/), mis- captioned as a distillery here: [https://www.masterofmalt.com/blog/post/qa- brian-ashcraft-aut...](https://www.masterofmalt.com/blog/post/qa-brian- ashcraft-author-of-japanese-whisky-the-ultimate-guide-to-the-worlds-most- desirable-spirit.aspx)

</comment></comment></comment></comment><comment><USER44> I love whisky, particularly scotch. Japanese whisky is... fine. It's boring. I like the strength of the peaty Islay whiskies.

</comment><comment><USER45> Last time I drank Japanese Whiskey it ended in a sleep waking incident and urinating on my flatmates feet.

I tend to avoid it now.

<comment><USER46> You mean the last time you drank a bottle of whiskey by yourself right?

</comment></comment><comment><USER47> Is Japanese Whiskey hard to find? I've seen it everywhere from Hawaii to the Netherlands.

</comment><comment> rm_-rf_slash I've had Japanese whiskey in the past, and honestly, nothing made me think "Wow! If someone served me this without telling me what it is, I could tell it's Japanese in a heartbeat!"

I mean it was good but not groundbreaking compared to other whiskies. Like drinking prosecco instead of champagne. I think it just is a matter of personal preference.

<comment><USER10> It's not supposed to taste "Japanese". It's supposed to taste good. Japanese people are fiends for whiskey (it's one of their endearing cultural quirks), and they are good at making it.

The interesting thing about Japanese whiskey is that they tend to produce single malts or blends of single malt, just like Scotland, but their palates are more American than Scottish. American whiskey is almost all bourbon and rye --- lots of corn, lots of rye, not a lot of barley. Japanese whiskey, like Scotch, is all malted barley --- but no smoke, no iodine, no salt.

You can sort of think of the Japanese whiskey industry as the single-malt partner to the American whiskey industry, maybe the same way Ireland is the non-malted partner to Scotland.

</comment></comment><comment><USER48> Unorthodox opinion but here it goes: people like to pretend they know a lot about wines and whiskeys and that they have skills to identify and taste them but they're just being pretentious or don't know where to spend money. As long as the wine comes from an old caste and the whiskey follow strict procedures it's all the same thing. People want to look sophisticated but when blindfolded then can't even distinguish between red and white wine if they're at same temperature.

Same thing for musical instruments. It's all branding, marketing hype for hipsters and some sort of placebo effect.

<comment><USER49> "People want to look sophisticated but when blindfolded then can't even distinguish between red and white wine if they're at same temperature." I hope you're exaggerating here!

I largely agree, the best wines I've every had came out of a box. I read about a bunch of wine critics who did some blind tests and chose a discount wine over much more expensive ones.

Frankly if you get a half decent drink and put whatever effort you would have put into getting a better one into having a good time with good people you're on to a winner.

<comment><USER50> re: red vs white wine, Nope! Not exaggerating!

Several studies have shown wine is crazy subjective, and both novices and experts have been fooled before by changing the colors (dye) and bottles. Most people also have trouble blindfolded unless they are particularly experienced.

<comment><USER51> I don't really buy this, I'm an amateur wine snob at best, and blindfolded I had absolutely no trouble telling apart white wines and red wines. In fact, no one at my table of 4, the other 3 having less knowledge of wine than I do, had any trouble whatsoever with red v. white, and all of us were close to right with region or grape variety. The only kicker was a rose champagne which everyone thought was a prosecco.

<comment><USER52> From what I've read in this thread, I infer that the study involved _telling_ blindfolded people that white was red, or vice versa, and people were induced to rationalize their perceptions. The classic Asch conformity experiments[1] did not prove people can't tell the length of lines, did they?

[1][https://en.wikipedia.org/wiki/Asch_conformity_experiments](https://en.wikipedia.org/wiki/Asch_conformity_experiments)</comment></comment></comment></comment></comment>


Eve Evolved: Analysing Eve's New Economic Reports - <AUTHOR> http://massivelyop.com/2016/03/06/eve-evolved-analysing-eves-new-economic-reports/ <comment><USER2> Eve's player-based economy is really badass, to the point that they have an economist on staff to generate reports like these. CCP found a great way to combat RMT (real money trading) rampant in MMOs where you buy in-game currency with real-world money with the introduction of PLEX (aka Pilot License).

Basically, you can pay ~$15 for an in-game PLEX, which when "used" adds 30 days of game-time to your account subscription. But this is an in-game item just like any other, which means it can be bought and sold in the in-game markets for the in-game currency (ISK).

Hence, it gives a legitimate way to purchase in-game currency with real-world money, without inflating the economy (because no ISK is generated and added to the economy at any time during this transaction, it simply changes hands until the item is "used" and therefore destroyed). In addition, it allows dedicated players that are cash-strapped an avenue to play for free by using currency acquired in-game to fund their subscription.

It also had the side-effect of giving an approximation of what the virtual exchange rate is between dollars and ISK, which makes for very attractive headlines when larger ships and assets get destroyed in the game.

<comment><USER3> _Eve 's player-based economy is really badass, to the point that they have an economist on staff to generate reports like these._

I just read somewhere that their economist left in 2014.

<comment><USER4> His name:

Eyjolfur Gudmundsson

Rector at University of Akureyri

IcelandComputer Games

Current: University of Akureyri

Previous: CCP

[https://is.linkedin.com/in/dreyjog](https://is.linkedin.com/in/dreyjog)

\----- Dr. EyjoG felt an itch to apply some of the lessons he'd learned at Eve to the world of higher ed. So when Akureyri advertised for a new president in 2014, he once more found himself jumping industries.

[http://web.uri.edu/quadangles/the-virtual- economist/](http://web.uri.edu/quadangles/the-virtual-economist/)

<comment><USER5> See also: Yanis Varoufakis

[http://www.ibtimes.co.in/valve-economist-yanis-varoufakis- ap...](http://www.ibtimes.co.in/valve-economist-yanis-varoufakis-appointed- finance-minister-greece-621689)

<comment><USER6> Notably he went from being an in-house economist for Valve Software to being the Greece's minister of finance.

</comment></comment></comment></comment></comment><comment><AUTHOR> "At the end of February 2016, the total liquid ISK in the EVE Online economy was 948.043 trillion ISK (equivalent to $16.45 million using PLEX conversion)."

find this fact mind boggling!

<comment><USER3> Meh. It's a by-product of the typical hyperinflation you get when you try to devise an economy where everyone gets to print as much money as they care to. (Which is what MMO grinding for cash basically amounts to.) Their trying to peg ISK to real world money through PLEX is a typical strategy to try and counteract this, which also typically kind-of works, but only typically kind- of.

[https://www.youtube.com/watch?v=sumZLwFXJqE](https://www.youtube.com/watch?v=sumZLwFXJqE)

My solution for this will be "first-principles." Quite simply, I'm not going to let players print money.

<comment><USER7> Rather than avoiding printing money, I'd suggest considering using feedback loops to try to control the economy.

One of the core problems with a simulated economy is that it can't ever really be a real economy as long as it has significant chunks of the economic transactions coming from programs rather than people. There's always a border between the humans and the machines, and I think a lot of the silliness of MMO economies comes from that border, and the way it can be exploited, rather than the economic issues themselves.

For instance, in the real world, there is no such thing as a fixed price. You can't wake up one day, harvest a bushel of apples, and take it down to the fruit stand down the street to sell for $5, regardless of all other economic conditions. That bends the economy. In the real world, you can't buy an unbounded number of apples for $10 a bushel. That bends the economy. In the real world, if you sell a bushel of apples, it doesn't essentially disappear from the Prime Material Plane, it has to be transported to someone else who wants it, without destroying the apples, before they go bad. That bends the economy.

The inaccuracies are fundamentally unfixable in some sense, but they could probably be mitigated by trying to put in a feedback loop where things get more expensive as more people buy them, and get cheaper as fewer people buy them. If done correctly, this would also prevent the problem where you have to explicitly create and manage sinks; you let the economy figure out the sinks for you.

It would also almost certainly be dynamically unstable, with some things being under- or over-priced all the time in various cycle... but this can be seen as advantage for a game as much as it can be seen as a disadvantage. Some very clever thinking might even let you exert some control over the cycles and do things like try to ensure they don't all end up in sync (i.e., consider the equations for simple harmonic motion and how you can affect the "k" constant for different commodities).

The other thing I'd consider would be implementing storage fees (which themselves float) to prevent hoarding and gathering excessive wealth, probably structured as a progressive tax, too. Or at the very least, make it a knob you can crank and tell people it may change on a day-by-day basis.

<comment><USER8> If you're talking about fixed prices in EVE's economy, you possibly don't understand it very well. There are very few fixed prices in EVE, most of which are things like skill books which by necessity have to be generated by the game systems. Or commodities, which have no real use outside of buying and selling for some small profit.

All useful items in the game are sold to other players, and the price changes over time based on supply and demand, or other traders just being cutthroat about selling their items. I made a decent chunk of money by putting up buy orders for items to get from actual players, and then selling those items to actual players for several hundred percent markup. (that was just how the price was at the time) Occasionally a single item could become entirely worthless to sell because other traders would get into price wars to make sure their items sold first by modifying their sell price down by a small amount. Or buy price up by a small amount.

Recently there was a large war, and the price of a lot of the popular ships went up because the large alliances were buying large amounts of them. Possibly the price of manufactured items went up by some amount as well due to minerals becoming more scarce from alliances consuming huge amounts of them to fuel their war.

All that is to say: you don't sell apples for $5 every time ;) Though the price of certain base goods, such as a common mineral, might only vary by +- 0.10 of an ISK in general.

</comment></comment></comment></comment><comment><USER3> _While the majority of EVE players are content to run missions or smash spaceships together for fun and profit_

When I was playing Eve Online, ships didn't have collisions with anything but force field bubbles. (Planets were nothing but really huge force field bubbles. (Tower) You could still skillfully terminate a warp to get to the center of one, however. I never figured out how to exploit that.)

<comment><USER9> [https://www.youtube.com/watch?v=N8K18S_RNEQ](https://www.youtube.com/watch?v=N8K18S_RNEQ)

This video shows how grid bombing was done, sadly i don't play EVE anymore it's a great game lots of different Players/groups

<comment><USER3> There were too many meta-exploits in Eve. My alliance lost our player constructed station because we kept on having the server crash underneath us when we were clearly winning a battle to take down an enemy's tower. After the 3rd time that happens, it's harder to get people to the battle.</comment></comment></comment>


Show HN: Kaput.io – hot takes on systems - <AUTHOR> http://kaput.io/ <comment><USER2> Ok, what are we looking at? Could you add some context?</comment>


Ask HN: Anybody interested in obtaining jqueryin.com? - <AUTHOR>

I've had the domain since 2009 and used it as my stomping grounds for technical blog posting. I no longer blog on the domain and it's going to waste so I figured I'd put it up for auction on Flippa. I'd love to see it go to someone that can show it some love; namely an HNer. <comment><AUTHOR> Link(s):

<http://www.jqueryin.com>

[https://flippa.com/2877708-established-pr3-web- development-b...](https://flippa.com/2877708-established-pr3-web-development- blog-4k-uniques-per-month)</comment>


Why I Think Google Fiber Should Come To Ann Arbor - <AUTHOR> http://augiehill.com/blog/a2fiber

<comment><USER2> Whether Google Fiber ends up coming to Ann Arbor, keep fighting for the cause! A municipal effort could do much the same of what Google is doing. At the very least, it often scares companies into offering more competitive service!

</comment><comment><USER3> Google Fiber: Faster than Denard Robinson? OK, almost as fast.</comment>


Ask HN: What is the best way to hire/find someone to write a biography? - <AUTHOR> Want to get a biography written for someone, Not someone famous , just a normal person with a great personal story.<p>Any thoughts on how to hire and how much does it normally cost ? <comment><USER2> Tough one. I don't have direct experience of writing a biography for someone else, but as a writer, I would guess it would be quite expensive. It depends though. If the background history is already compiled, and there's perhaps a rough draft showing sequence of events, the price could be a lot lower. I would imagine it would be a few thousand.

If you have some spare time you could also hire a writing coach and get them to help you write it.

</comment><comment><USER3> Having had local newspapers write about close family members of mine, I'd encourage you to reach out to freelance journalists and see if they'd be interested. They may do it for less compensation in exchange for the exclusivity of the story, and they typically bring other skills to the table that are useful when telling a person's story (interviewing people, basic investigation, etc).

This is my general advice without knowing the details of what you're after.</comment>


Etiquette is a bullshit code written by aristocrats - <AUTHOR> https://melmagazine.com/en-us/story/etiquette-is-a-bullshit-code-written-by-wealthy-aristocrats-so-keep-your-elbows-on-the-table-fellow-peasants <comment><USER2> Hah, it's funny, I just had an opportunity to confirm the utility of manners on the subway this morning. There was a creepy guy staring at people, looking for god knows what kind of victim, but certainly set on causing trouble. The situation drove home that the old advice that it's impolite to stare has, at times, at deeper sognificance and purpose than simple étiqueté. In this case staring, in combination with other signfifiers is one of the signs others pick up on web trying to determine whether or not you're a stable human being. On the other side, staring at someone who is deranged or looking for victims can put you in a lot of danger as it's essentially an open invitation for them to mess with you.

So, certainly, a great deal of manners are simply class signifiers, but some of them also have utility in other situations. They sometimes not only signal class but also convey your degree of general approachability/sociability to another person.

Even the innocuous ones can have subtle effects. For example, putting your elbows on the table may naturally inch your body into a position in which you're leaning in more toward the conversation, which in some situations can be a bad signal and seem overly eager or aggressive—of course in some situations the same gesture can convey a deep interest the discussion. Leaning back with one's hands off the table can instead convey a respectable openness to discussion, or, in certain situations, disinterest. It all depends. I don't think the rules of etiquette have to be hard and fast all the time. They're better used as helpful reminders about how our subtle or even unconscious gestures contribute to a conversation.

</comment><comment><USER3> The article was exhausting (unless you're into stuff like the history of table manners going back to the Victorian era) so I'll save you having to read it for the final paragraph which sums up the opinion nicely:

> _Really, what the average person would consider "good" table manners these > days boils down to common sense: Chewing with your mouth open is, and always > will be gauche. But the more specific etiquette practices — the rules for > how to hold your utensils or scoop up your soup — are no longer uniform, and > therefore, mistakes are less likely to be met with the same bougie judgement > they would have been a century ago._

</comment><comment><USER4> Why is it trendy to use expletives these days? It's not big or clever.

<comment><USER5> It's an attempt to write an attention grabbing headline which has grown painfully cliched.

<comment><USER4> Not just that, second paragraph in drops the F word.

</comment></comment></comment><comment><USER6> I have to admit I skimmed this article, but the aristocrats had a purpose for the rules and regulations. If you're at a very long table in a very long hall with 20 other people, it's difficult to see, much less hear or join in with the conversation of the other guests. Making a bunch of noise, getting in people's way, spilling things all over the table, mixing up whose drinking glass or knife this is, etc could cause annoying disruptions, not to mention made dining less gross.

</comment><comment> grayed-down Class is dead and buried especially in America, and this article was clearly written by one of its grave diggers.

</comment><comment><USER7> Group nouns (eg "a murder of crows" or "a flobble of jelly") also started out as a differentiation between the aristocrats and uneducated masses:

> Even in their original context of medieval venery, the terms were of the > nature of kennings, intended as a mark of erudition of the gentlemen able to > use them correctly rather than for practical communication.

[https://en.wikipedia.org/wiki/Collective_noun#cite_ref-11](https://en.wikipedia.org/wiki/Collective_noun#cite_ref-11)

<comment><USER8> I first came across that Lipton citation through [https://en.wikipedia.org/wiki/Talk:List_of_English_terms_of_...](https://en.wikipedia.org/wiki/Talk:List_of_English_terms_of_venery,_by_animal#Parliament_of_Owls) , which quotes "Narrative and learning to teach: implications for teacher- education curriculum" saying:

> Lipton discovered that such collections are quite old, dating from the > mid-15th century. These days teacher educators would probably curricularize > this material as word-play, perhaps a motivating introduction to poetry. > Along these lines, for example, Griffin recently invented 'a brace of > orthodontists'. But in the 15th century the educative purpose was much more > sober. Such lists were a valuable resource to provide a gentleman with the > means of social acceptability and to spare him the embarrassment of some > blunder at table---of referring, for example, to a bunch or flock of owls > when the proper term is a parliament of owls. In such incidents, 'those who > are wiser may have the laugh of you, and we who love you may be shamed', a > quote from a novel by Arthur Conan Doyle in which a young man is being > schooled in the proper terminology to avoid embarrassment (Lipton 1993: 1).

</comment></comment><comment><USER9> An amusing diversion apparently penned by an author not on the in.</comment>