Turkey steps into currency warfare - <AUTHOR> http://www.hurriyetdailynews.com/n.php?n=turkey-takes-a-step-into-currency-warfare-2010-10-06

<comment><USER2> 'Speaking to the Financial Times on Oct. 5, Dominique Strauss-Kahn, chief of the International Monetary Fund, or IMF, said economies should not use exchange rates as a weapon.'

Is it a weapon, or are they preparing for something to happen to the U.S. economy?

The U.S. has just been "printing" money without it being backed by something tangible of worth, while spending like crazy without raising taxes.

The U.S.'s National Debt is somewhere around $13,554,861,000 USD and growing ( <http://www.usdebtclock.org/> <http://zfacts.com/p/gross-national-debt.html> ), and the answer we come up with is "printing" more money, spending more than we'll ever have, and borrowing even more.

A major chunk of that debt is owed to China whose economy is primarily based on producing goods for purchase by U.S. consumers. China may at the moment be unable to afford to make the U.S. pay up, but all it takes is for something to happen to the U.S. economy such that the U.S. consumers slow purchasing even more, the Targets/Walmarts start closing, and China will drop us before we have a chance to ask for more money from them.

It doesn't matter how this happened right now (politicians afraid to tax and afraid to cut spending across the board) as much as what we are going to do about it.

Turkey's currency warfare is a small issue compared to this mess, but I think it could be a signal that they know something that we haven't yet.

<comment><USER3> Your economics are just wrong. Inflation is non-existent, the markets are willing to lend to the U.S. government at all time low rates, the effects of the first stimulus are over, the economy is barely moving and is in danger of double-dipping. The correct prescription is a giant second stimulus and more quantitative easing by the Fed. The time to worry about debt was when the economy was growing (i.e. back when W was doubling the debt). Now we should worry about growth.

<comment><USER2> Inflation may be non-existant now, but you can't owe forever, otherwise the concept of debt and the money you owe is imaginary and useless. When those we owe are tired of us owing and not paying and they are able to live without us, where are we then?

Growth implies that we are making money. We aren't. Our country is bankrupt so many times over, it would be hilarious if it weren't so freakin' pathetic. Go ahead an vote Democratic if you want to focus domestic growth and large gov't, and increase debt. Go ahead and vote Republican if you want to make cuts, but then reinvest those cuts back into other programs, and increase debt. Go ahead and vote Libertarian if you are allowed to or want to write them in; they won't get anything done because there aren't enough of them, and the only ones that make it into office are going to want to play politics like everyone else. Or find out who the deficit hawks that you find in our gov't and vote for them.

<comment><USER4> As of July 28, 2010, the "Total Public Debt Outstanding" was approximately 93% of annual GDP. -- Wikipedia

It'd suck, but we could pay that off in 20 years if we cut the budget to something maintainable. Not optimal, but nowhere near your "so broke hurf durf, never pay it off".

<comment><USER5> > if we cut the budget to something maintainable

... which would be in the best interests of the country, but against the best interests of a given single politician, so it's very unlikely.

<comment><USER4> I agree, it'd be a very hard political decision. But the hurf-durf about us being beyond-broke is overblown, at least currently.

I do however agree that the trajectory we are on is going to screw us.

</comment></comment></comment></comment></comment></comment><comment><USER6> From the article, Turkish currency is increasing in value relative to the dollar, but is flat relative to the Euro. Why is that?

If it is because Turkey is increasing exports to the US, then this would indeed be "currency warfare", holding the lira down so as to maintain exports. But from a quick search, Turkey is rapidly increasing its exports to "developing nations," not to the US.

So it would seem as though the cause of the exchange rate increase is that dollar-laden speculators are suddenly investing heavily in Turkish markets (or merely Turkish currency). By buying back dollars, the Turkish government is curbing this speculation, and placing themselves in a position to profit if the speculation suddenly stops. (Albeit by selling dollars, which could be considered an aggressive move.)

From the information I have, it looks like Turkey is merely defending its currency/economy, and this sort of article may very well be a piece of propaganda meant to shame Turkey into not defending its currency.

But my information may be off, and I don't actually know much about currency markets. I'd welcome a better, more enlightening explanation.

<comment><USER7> That's because Turkey keeps their currency artificially bound to the EURO. 2 lira ~ 1 EURO.</comment></comment>


GitHub pages is now running Jekyll 3 - <AUTHOR> https://github.com/blog/2100-github-pages-now-faster-and-simpler-with-jekyll-3-0 <comment><USER2> OK, a standard dialect of Markdown.

In the beginning was RUNOFF from MIT, which originally had about the power of Markdown. More features were added, and it became nroff, then troff, the ditrofff, and macro systems were added on top of it. It became too hard to use for casual work.

Then there was TeX, which was a saner approach to what troff did. Macro systems were added on top of it. It became too hard to use for casual work.

Then there was HTML, which started out with about the power of Markdown. More features were added. It became too hard to use for casual work.

Then there was BBcode, which started out with about the power of original HTML. It didn't gain many features, and is still widely used.

Then there was Markdown, which started out with about the power of original HTML. More features were added. Macros have been added by at least five people, but haven't quite gone mainstream yet. When Markdown gets macros, it, too, will be too hard to use for casual work.

Next!

<comment><USER3> That's why I prefer ReST. More powerful syntax out of the box with a standard extension scheme so you don't end up with the mess of all the different incompatible Markdown implementations. With the internal structure exposed as an XML format (rst2xml) it is easy to transform documentation into a wide variety of formats that docutils or Sphinx don't handle directly.

<comment><USER4> A lot of that sounds good but you lost me at XML.

<comment><USER3> The XML dump exposes the parsed document structure so you aren't forced to use the usually limited output options of the native ReST or Markdown tools. Instead of generating the lackluster output from latexpdf you can transform from ReST -> Docbook -> XSL-FO -> PDF, or other targets like HTML, WordML, DocX, or ODF. Manipulating documents is what XML is really for. It gets a bad rap because it is abused so much for storing data, scripting, and other silly stuff.

</comment></comment></comment></comment><comment><USER5> I just found out about Lektor the other day. [https://www.getlektor.com/](https://www.getlektor.com/) It's like Jekyll meets WordPress, written in Python by Armin Ronacher. He's the guy who wrote the extremely popular Python microframework, Flask.

It's a static site generator with a slick React powered admin interface intended for editors (non-programmers) to use. It runs locally like any good static site generator should and runs on Windows, OSX and Linux. With the click of a save button, it'll upload your statically generated site to any ftp or rsync server you choose ;)

Took me only 2 hours to have it building a page with a nav menu, localization, and a slick admin interface even though I had never even used Python before!!

All you do is declare your models, place references to them in your templates, and it handles the rest for you automatically.

The project is still a little rough around the edges as it was only released in December, but I'm already falling in love with it and I'm really excited to see how it changes the web once it gets built out a bit more.

Non-programmer editable static sites is a huge deal!!!!

<comment><USER6> Lektor looks really cool. For the life of me I don't understand why it's only in Python 2.7 though.

<comment><USER7> Armin has historically been one of the most vocal of those critical of Python 3, and has even compared it to XHTML. He was pressured into porting Jinja2 and it cooled him on Python, if you read older posts of his. The answer should be pretty clear when you notice that Lektor fails on a print() not having parentheses (and not, say, a dependency).

Unicode in Python 3 is his problem, and there was one post I can't find on mobile where he started ranting about POSIX and Unix for some unclear reason. I can't follow him on a lot of it, as much as I respect his work, because if you read objectively it's pretty clear the reasoning is often there to support a predisposition. Meanwhile, my whole stack is Python 3 and I'm having a grand old time less the pieces where I had to sub in shittier libraries, and not a single problem Armin has ever raised about Python 3 has hit us. Not one. Most of it boils down to Unicode issues that have been issues outside of Python for 20 years.

This isn't to say Python 3 is perfect. (Far from it.)

He also often writes what I like to call the "Alex Gaynor Conclusion," which is tediously enumerating in the conclusion why you're going to call him wrong in his opinions which somewhat minimizes effectively disagreeing with him. There is a subculture of people who do this, and it mildly bugs me. Nothing against him; just an observation.

Anyway, port it and drop a patch, and I'll buy you scotch. I know better than to make any request other than that, and it's cooled _me_ on using Armin's software in general (to my disappointment; Armin's Web stack has been a trusted friend through four different employers, from Werkzeug on up, and it's a massive bummer to see Lektor confirm suspicion).

</comment></comment></comment><comment><USER8> Is there a list of new features in Jekyll 3 vs. 2? I looked at Jekyll's docs and can't seem to find anything. It has a nice guide of how to move from 2 to 3, but is there any succinct list of what new stuff you can do in 3, if anything?

edit: Actually, this looks promising: [https://jekyllrb.com/news/2015/10/26/jekyll-3-0-released/](https://jekyllrb.com/news/2015/10/26/jekyll-3-0-released/)

<comment><USER9> The incremental building of the site is big, because it was beginning to become a concern just how well you could manage a large site with many posts and contributors.

On top of that, Liquid is finally being updated to 3.0, which comes with a couple of neat features.

It's also nice to finally see an end to the Markdown discussion.

</comment></comment><comment><USER10> Absolutely love Jekyll and GitHub Pages for hosting project documentation and personal websites. Just wish GH Pages would support SSL. :(

<comment><USER11> I don't know much about GitHub Pages, but if it's only for static pages, then why do you need SSL? I mean if you're not going to be sending sensitive dynamic data. Is it so people can't snoop the contents of your pages over request/response on a network?

<comment><USER12> Google uses https as a signal of quality, and Chrome will start shaming sites that aren't:

[http://motherboard.vice.com/read/google-will-soon-shame- all-...](http://motherboard.vice.com/read/google-will-soon-shame-all-websites- that-are-unencrypted-chrome-https)

</comment></comment></comment><comment><USER13> Great news. Congratulations. If anyone is interested in learning more about Jekyll I've put together a link collection called Awesome Jekyll @ Planet Jekyll [1] - it also includes a section on the history (evolution) of GitHub Pages. Cheers. [1] [https://github.com/planetjekyll/awesome- jekyll](https://github.com/planetjekyll/awesome-jekyll)

<comment><USER14> Why are you using a README to display this list instead of GitHub Pages?

<comment><USER15> You can't easily do pull requests on a GitHub Pages static file. (You'd have to edit the source.)

<comment><USER16> They work just like any other Markdown file, and you can include a link in the rendered site to edit. See [http://ben.balter.com/2015/09/13/github-pages- edit-button/](http://ben.balter.com/2015/09/13/github-pages-edit-button/).

<comment><USER15> Ah, I am referring to the use case where the site is rendered clientside via Jekyll, then uploaded to the _x_.github.io repo. (which lets you use plugins, among other things, which is why I thought that was the more frequent use case). Not the loading-markdown-directly workflow.

</comment></comment></comment></comment></comment><comment><USER17> > Starting May 1st, 2016, GitHub Pages will only support Kramdown

Kramdown has strange behavior. [http://stackoverflow.com/questions/23751917/how-do-you- disab...](http://stackoverflow.com/questions/23751917/how-do-you-disable- tables-in-kramdown)

</comment><comment><USER18> Jekyll 3 is pretty great. If you need any help getting your site hosted, I'm working on a hosting setup that is way easier than S3 or any other option out there.

[http://www.statichosting.co](http://www.statichosting.co)

We are in private beta and are looking for people to try it out and give us feedback. We think it's great and are looking for early adopters who want an awesome static hosting experience.

<comment><USER19> Pretty cool! If you can set up some sort of integration with Travis (which itself integrates nicely with GitHub), _and_ you set up SSL, HTTP/2, good caching policies etc., you're golden.

<comment><USER18> I'll add that to the list of features.

Our focus is on simplicity and there are only two of us, so adding features in a way that fit our limited resources and vision is a bit tough.

We are working on SSL and making sure we have good caching policies by default. Travis and GitHub integration are things we haven't looked at yet, but will.

If you are looking for something right away before we have all those features, you might check out netlify. They already support a lot of those features and might be a better fit in the short term.

</comment></comment></comment><comment><USER20> Shameless plug: Once you're on Jekyll 3, check out [http://jekyllthemes.io](http://jekyllthemes.io) to upgrade your theme too.

<comment><USER13> For more (alternative) Jekyll themes see the Dr. Jekyll's Themes directory [1] it also includes a command line package manager and setup wizard. Cheers.

PS: The site is build - of course - with Jekyll and GitHub Pages ;-) and open source [2]. Did you know that you can even use git submodules with GitHub Pages? Works great.

[1] [http://drjekyllthemes.github.io](http://drjekyllthemes.github.io) [2] [https://github.com/drjekyllthemes/drjekyllthemes.github.io](https://github.com/drjekyllthemes/drjekyllthemes.github.io)

</comment></comment><comment><USER21> Hmm, I hate to be a downer but this is a bit of a disappointing announcement for a major upgrade - basically, one very minor addition and a bunch of features removed - not that they were needed/widely used, but there's nothing else to show for it. Am I missing something?

Also it's a bit unfortunate there's still no easy way to do site translation in Jekyll.

Anyway, well done on the upgrade. Love jekyll.

<comment><USER22> A lot of the Jekyll 3 changes [1] thus far are focused on making the development life easier: faster (incremental) local builds and a lighter, easier to install stack with fewer dependencies (no more native library dependencies out of the box, no more dependencies on Python and Node by default).

Correct, nothing really mind blowing if you have all of it already set up and a relatively small Jekyll site, but big news for new users (especially on Windows where the native libraries and multi-language support have been bigger hurdles) and for people with large sites both in locally developing and debugging them and also in Github deployment times.

[1] [https://jekyllrb.com/news/2015/10/26/jekyll-3-0-released/](https://jekyllrb.com/news/2015/10/26/jekyll-3-0-released/)

</comment></comment><comment><USER23> Good news. We're using Jekyll 3 at Static Website Manager [1], but we're moving to support older specific versions as well as custom Gemfiles.

[1]: [https://www.staticwebsitemanager.com](https://www.staticwebsitemanager.com)

Are there any features the community would love to see offered in a Jekyll- based CMS?

<comment><USER24> My Jekyll work flow tends to involve: Write a blog. Publish. Recognise horrid markdown bugs. Go and fix already published blog.

I appreciate there are better workflows, but as a Windows user I'm not going to install Jekyll to publish locally and test, nor is my blog big enough to justify a test environment.

The "drafts" feature basically just takes a draft and publishes it. What would really make life easier is it the drafts feature would "publish this blog, but don't update the front page to link it". I could look at it knowing the URL, and get it right first.

<comment><USER23> That's my main use case. I've got my personal blog [1] setup as a Static Website Manager repository and connected to my personal AWS S3 bucket.

Whenever I need to make a little change I can edit locally in my editor of choice, commit and push to SWM where I can preview the changes before merging to my production bucket (all without installing Jekyll locally).

If I don't have my machine, I can also just login, edit the text and then follow the same preview/merge to deploy workflow.

[1]: [http://www.theodorekimble.com](http://www.theodorekimble.com)

</comment></comment></comment><comment><USER25> Frankly, Github did a very poor job at communication this breaking change.

I only recently discovered that most of my post got broken.

Apparently it's no longer legit to use "#Title", you need to "# Title" (and god knows what else).

Linking is broken too - in Jekyll 2 there was no difference if a URL ended in "/" or not - you were just taken to the page, now this is a massive, although fixable pain (see [https://github.com/jekyll/jekyll/issues/4440](https://github.com/jekyll/jekyll/issues/4440))

As a result my site experienced 500% drop in organic search referrals from Google.

I got no single email from then announcing this change. Very unhappy with how github handled it.

</comment><comment><USER26> Shameless plug: LightPaper has some nice support for Jekyll rendering: [http://lightpaper.42squares.in/?ref=hkj](http://lightpaper.42squares.in/?ref=hkj) among other great features.

</comment><comment><USER27> With this change, Github has made Rouge the only (and mandatory?) highlighter supported. This is a problem for sites that disable Jekyll highlighting in favor of using something like highlight.js. It appears right now that there is no way to disable Rouge which is causing conflicts with my sites that use javascript highlighting.

<comment><USER13> FYI: You can disable Rouge - just set the Kramdown highlighter to nothing in the Jekyll _config.yml. That's all.

<comment><USER27> Attempting to disable the highlighter gets you a page build warning:

 _You are attempting to use the 'none' highlighter, which is currently unsupported on GitHub Pages. Your site will use 'rouge' for highlighting instead._

</comment></comment></comment><comment><USER28> Fun fact: GH Pages changed the way trailing slashes work, so all links to my site dotted around the Internet broke as soon as I made a change. I had to update all the permalinks in my post to explicitly include the trailing slash.

Thanks GH Pages!

</comment><comment><USER29> I was a little surprised to see that GitHub is essentially playing favorites with Markdown rendering engines. Is there a discussion somewhere that outlines some of the reasoning behind this pick?

<comment><USER16> > Is there a discussion somewhere that outlines some of the reasoning behind > this pick?

Yes. The decisions was actually made on the open source GitHub Pages Gem repo, based on both user feedback and actual usage stats: [https://github.com/github/pages- gem/issues/179](https://github.com/github/pages-gem/issues/179).

</comment></comment><comment><USER30> Does this mean that I can generate github pages from the Wiki pages as well? I think that would be the most needed feature.

</comment><comment><USER31> For everyone who's thinking "It would be great if Github Pages supported X", I am building [https://zammu.in/?invitation_code=HACKERNEWS](https://zammu.in/?invitation_code=HACKERNEWS) . It currently supports Middleman, Hugo, Hexo, Octopress and Jekyll. I am planning to add more to the list.

For every Git push to the master branch it builds and deploys the generated site to Github Pages.

</comment><comment><USER32> Recently tried Hugo. The speed is amazingly fast. Much much faster than jekyll.

<comment><USER13> FYI: I've put together a static site showcase called Stay Static [1] that builds the same site (w/ pages, posts and links) for easy comparision with Jekyll, Middleman, Hugo [2], etc.

Hugo is great. The Go template language is somewhat unconventional and does not yet support nested layouts (as do Jekyll, Middleman, etc.), for example. Cheers.

[1] [http://staystatic.github.io](http://staystatic.github.io) [2] [https://github.com/staystatic/hugo](https://github.com/staystatic/hugo)

<comment><USER32> nice. the theme looks good too. i think will fork it to rebuild my site.

</comment></comment></comment><comment><USER33> Slightly off topic but is RoR still the web framework of choice for developers? Could be just me but it seems most unicorns still continue to use it, even with all of the Python/Node/PHP frameworks out there.

<comment><USER34> If I were to guess I'd say no, with the majority being Node.js, then a mixture of Rails, Python, Go, and Erlang for the rest. As a note, Jekyll isn't using Rails, it's just using Ruby.

</comment></comment><comment><USER35> Figures I just switched my site to Ghost.

<comment><USER36> Ghost is a great platform, very easy to extend and you can host it for free on Openshift[1].

You can use ghost-render[2] to publish the blog as a static site if you want to stick your blog on Github Pages.

[1]: [https://github.com/openshift-quickstart/openshift-ghost- quic...](https://github.com/openshift-quickstart/openshift-ghost-quickstart)

[2]: [https://github.com/mixu/ghost-render](https://github.com/mixu/ghost- render)

</comment></comment><comment><USER37> are there any sample pages running with Jekyll 3 to see?</comment>


Ask HN: What granularity are your microservices? - <AUTHOR> I'm turning a side project into a production application, and I was wondering how other people split up their apps into different internal services, and what those services are.  I'd also like to hear about any negative consequences anyone had from their decisions on where to draw the lines.
I also have some more specific questions:
1. How do the microservices map onto the unix security model?  Does each service get its own UID?  How do you keep the user databases in sync in production?
2. How do you handle debugging these systems?
3. How do databases integrate with your architecture?  Do you use the same communications bus as the rest of the system, or do the services communicate with the database using its native protocols?  Do you treat the database server as a microservice too? <comment><USER2> Can you elaborate on why you want to split your application into multiple services? This matters, as a 'how' you split may vary based on the 'why'.

My suggestion would be to look at the existing modules in your application, and analyse the coupling and cohesion across them. If you find loosely coupled modules, with minimum dependencies of their own, then these become good candidates for services. Another consideration is to try an split around domain concepts, rather than functional concepts. For additional thoughts, take a look at this post: [http://www.nirmata.com/2015/02/microservices-five- architectu...](http://www.nirmata.com/2015/02/microservices-five- architectural-constraints/)

On your questions:

1\. With a microservices-style each service may have multiple instances. And each service instance runs as a separate process, and may be on different hosts. So, you can map each service to its own UID, or may run a group of services with the same UID based on the privileges each service requires.

2\. Debugging gets harder! It best to plan for testing each service in isolation (e.g. using mocks), or with minimal dependencies. Troubleshooting is also harder. You will need log aggregation and management. If you are running in containers, you can use services around the container to handle logs.

3\. A service should have its own database and only expose an interface to the rest of the world. Hence, you can directly use a database driver in your service.

Hope this helps.

Regards,

Jim</comment>


Tell HN: Microsoft DreamSpark - free developer/designer tools for students - <AUTHOR> https://www.dreamspark.com/Default.aspx

<comment><AUTHOR> I found this via [http://lifehacker.com/5658300/microsoft-expression- encoder-m...](http://lifehacker.com/5658300/microsoft-expression-encoder- makes-surprisingly-good-screencasts) to get a Windows-native screencast tool (I have Screenflow on the Mac side, but a lot of Blueleaf customers are on the Windows side, so I wanted to have a native tool).

If you're interested in Windows Phone, DreamSpark waives the $99 developer license fee and gives you five free submissions.

Registration was pretty painless as long as you have a .edu and a Hotmail/Xbox Live account e-mail address. Seems like a pretty decent deal.</comment>


Researcher banned on Valve's bug bounty program publishes second Steam 0-day - <AUTHOR> https://www.zdnet.com/article/researcher-publishes-second-steam-zero-day-after-getting-banned-on-valves-bug-bounty-program/ <comment><USER2> I mean, you can't have your cake and eat it too - if you claim that a particular issue is not a bug and you won't fix it, then you have no ethical grounds to say that it shouldn't be disclosed.

Responsible disclosure expects delaying public disclosure to protect the users while the vendor prepares a fix. If the vendor says that they won't fix it, then it's not only a right, but a moral duty to disclose that vulnerability to the users.

<comment><USER3> Frankly, I think HackerOne deserves a bit of blame for that. Any WONTFIX ought to be made public automatically unless there are extenuating circumstances (like the vulnerability being reported against the wrong product).

<comment><USER4> H1 itself has no WONTFIX status, FYI. A bug that's not considered to be a bug by the program will either be closed N/A or informative. Ultimately, disclosures are handled and controlled by the program, not by H1; this is both a good and bad thing (and I say that as both a HackerOne employee and a hacker on the platform -- it's a complicated issue from both sides).

<comment><USER5> It's complicated on both sides means there is politics involved. Being blunt, that sounds like a cop out to me.

This sounds to me like an edge case that H1 should address if it really wants to be taken seriously.

<comment><USER4> There is definitely politics involved, but not H1 internal. The issue is that every program handles disclosure itself, so H1 itself doesn't really have the power. That could be changed at a policy level, but I'm not sure that'll happen (or should happen, honestly; I don't really know where I land on it).

<comment><USER6> H1 could make it a proviso if using their service that rejected but reports are automatically disclosed.

<comment><USER7> 1\. The overwhelming majority of rejected H1 reports are garbage.

2\. It is not the case that all _reporters_ want their findings disclosed publicly, even if they're rejected.

3\. Reporters already retain the right to publish findings however they'd like. The worst H1 or a client can do is kick you off the platform.

4\. A bug bounty platform that mandated disclosure of any sort would lose all its customers to the platform that didn't have that mandate.

<comment><USER8> "The worst H1 or a client can do is kick you off the platform."

As a hacker on hackerone, this is not my understanding of the relationship. Generally speaking the programs give you "authorized access" under the CFAA _conditional on following the disclosure guidelines_. I don't know about for other countries, but for the US I'm pretty sure this means that breaking the guidelines means you've retroactively committed a felony.

Now seems a little questionable about if any federal prosecutor would actually take the case, but it definitely doesn't seem like a strictly civil issue to me.

Strongly agree on all other points though.

<comment><USER9> > you've retroactively committed a felony.

There is no such thing as a retroactive crime in rule of law systems. Disclosure could be a considered an offense in its own, though.

<comment><USER7> How?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I see this as an example where the system works. Valve has an incentive to pay for bugs. The researcher than has an incentive to disclose them privately. If Valve doesn't pay fairly, the bug is disclosed, Valve pays the price and is forced to fix it, and be running a scam of a bug bounty program, they've exposed themselves to more disclosures. Valve now has an incentive to fix their program either by working with this bug hunter or increasing payouts so other hunters beat him to the point. This is how the system should work. Decentralized self-regulation needs people like Valve to fuck up once in a while so that the forces at play sufficiently punish them until they improve their process.

<comment><USER11> The meta-process might work, Valve's process is still broken.

<comment><USER12> Everybody makes mistakes, lets see if they can learn from theirs. I haven't heard that they keep making this same mistake (but I could be wrong.)

<comment><USER11> This happened end of June, they should have had ample time to reach out to @viss, make amends and change their process.

<comment><USER12> follow up [https://www.gamasutra.com/view/news/349352/Valve_tweaks_bug_...](https://www.gamasutra.com/view/news/349352/Valve_tweaks_bug_bounty_program_after_mistakenly_turning_away_researchers.php)

</comment></comment></comment></comment></comment><comment><USER13> This story continues to be so sad. Steam is reprising the role of Adobe who, for quite a while, refused to acknowledge that being able to use FlashPlayer as a tool to get you something on Windows was just as bad as breaking FlashPlayer. I heard one Adobe executive say, "Hey you can use a baseball bat to bludgeon someone but that isn't the bat maker's fault is it? If they are forced to make foam bats their product is useless."

That position isn't "wrong" so much as it isn't useful in reducing risk.

<comment><USER14> You're beating a dead horse. Flash served a purpose once, and now it's reached end-of-life.

<comment><USER15> > You're beating a dead horse

With a foam bat. Just because the flash horse is dead doesn't mean it didn't deserve it's beating or can't continue to be a potent reminder of how bad Adobe was at handling security issues and why other platforms, like Steam, should learn instead of emulate.

<comment><USER16> This also has nothing to do with Flash specifically, rather as you said Adobe's policy. It could have been any software but especially for Flash.

Flash was just such a unique special target, ala PDFs and Microsoft word, there were few wide open targets from which a hacker could predictably get the user to open (whether embedded or not) on a targets machine. So it was particularly sensitive to vulnerabilities by design, where a much broader security perspective was clearly needed than most software.

</comment></comment></comment></comment><comment><USER17> Maybe it is also time to switch from the prehistoric model of "hey let's download a .exe on the web, execute it without any sandbox, and let that .exe install other .exe from thousands of other unknown sources around the world and run them without any sandbox either."

Steam or any other app should always run sandboxed with no root access, no file access, no camera access, no access to other process, etc. For most users, steam only needs a sandboxed local storage to put its game into it and a internet access (and maybe mic access), that's it.

I really hope Flatpak and something similar for Window becomes the norm, the current situation is a security and privacy disaster.

There can still be exploits of course but now you have the find a weakness both in the app + in the OS sandbox which is a whole lot harder

<comment><USER18> > prehistoric model of "hey let's download a .exe on the web, execute it > without any sandbox, and let that .exe install other .exe from thousands of > other unknown sources around the world and run them without any sandbox > either."

What year is it? To me prehistoric means buying a nice big box with a CDROM or some floppies and installing with no internet required at all. Shell exes that want to download crap is the current nightmare we are living in I thought.

<comment><USER19> See also: [https://brew.sh/](https://brew.sh/)

</comment></comment></comment><comment><USER20> The salient part seems to be that the researcher reported the first vulnerability through HackerOne and was (reportedly) told by Steam it wouldn't be fixed. He then published it after being instructed that was against the rules and was banned

<comment><USER21> I wanted to note that the researcher was not banned at HackerOne, he was only banned from reporting bugs to Valve. This is written in the article about a second vulnerability [1]

[1] [https://amonitoring.ru/article/onemore_steam_eop_0day/](https://amonitoring.ru/article/onemore_steam_eop_0day/)

</comment></comment><comment><USER22> Drama aside.

Valve...I have your software installed. It has a hole. Fix it.

This mudslinging isn't helping your PR or making me feel more secure about my steam install regardless of the details.

<comment><USER23> I agree. As a user, I do not care who is at fault much, but I do expect the platform you provide to be somewhat secure.. especially after you are told it is not.

I basically uninstalled Steam client after first 0day was found. At least with gog I don't have install galaxy. But thats a different rant..

</comment></comment><comment><USER24> My opinion, not my (HackerOne customer) employer's:

I know this will be unpopular with folks like tptacek, but I've always felt strongly that bug bounty programs offer too many perverse incentives to all parties.

More often than not it becomes a tool for companies to sweep issues like this under the rug and then use HackerOne's system to force the reporters to play ball (because they want to keep getting paid). I hate this sytem.

I'm 100% behind open, public disclosure and if it were my own product in question, I would offer bounties for _public disclosures_. That keeps everyone honest.

<comment><USER25> I agree with you from the other side. Before these programs people would disclose issues to the public. The company found out like everyone else. They would fix it immediately because they had to.

Now they can hide it for months(ever) allowing others to discover them and keeping the researchers quiet.

<comment><USER26> A normal process goes like this:

\- Researcher finds bug

\- Researcher discloses to vendor

\- Vendor fixes (or not)

\- Researcher discloses bug publically once vendor has fixed, or after X time (whichever is first)

This is roughly how Project Zero goes, and it's a good mix between giving the vendor the opportinity to fix it and deploy the update before it gets exploited.

It's very naive to assume that bugs can be fixed before others can exploit them. Bugs take time to fix, and the process takes time, especially when dealing with large enterprises.

<comment><USER27> Why is it whichever is first and not after a fixed time? I see a benefit to waiting X time regardless, because it allows more time for the patch to circulate to everyone. What is the benefit to disclosing it immediately after it is "fixed"?

<comment><USER26> It's typically not immediately after it's fixed, but usally about a week or so, to let the majority update.

The vendor can also usually request an extension, as per the Project Zero guidelines, of I believe 1 month if they confirm to be actively working on a patch.

The goal of responsible disclosure is to help the vendor and their users' be more secure, so having a policy that is balence between the two is important to let the vendor fix it, and to not let the users be possibly hacked

</comment></comment></comment></comment></comment><comment><USER28> They're arrogant and lazy. Just say thank you and fix it. I hope GOG and HumbleBundle get a nice boost in sales.

<comment><USER29> > I hope GOG and HumbleBundle get a nice boost in sales.

While there are some DRM-free games, majority of games on HumbleBundle are sold as Steam keys, so you still need Steam to launch them.

<comment><USER30> I seem to recall the HB site, in the early days, saying something to the effect of "Our promise: 100% DRM free games". They even did a bunch of bundles that donated part of the proceeds to the EFF. It's sad to see them as just another front for Steam sales.

<comment><USER31> They're owned by Ziff Davis. It's not surprising.

</comment></comment></comment></comment><comment><USER32> This sucks. We run steam on some public PCs with unprivileged accounts and we wouldn't be very happy to find that users were able to gain admin access and steal other people's passwords through a keylogger. Sigh.

<comment><USER33> That seems to me the most obvious problem use case here. How can Valve possibly think that isn't important?

<comment><USER34> because their security model is too myopic. By defining security vulnerability to be only remote code execution from within the steam client, they save themselves a tonne of work (and cost).

I can understand that perspective - steam can't spend the time to rewrite to fix the EoP/LPE issues. Their stance must be that the user has to "be careful" not to install malware or other vulnerable software, instead of fixing steam.

</comment></comment></comment><comment><USER35> This wouldn't be anywhere near as severe a problem as it is if Steam's service wasn't running as something as ridiculously privileged as NTAUTHORITY\SYSTEM.

On the plus side, reading the writeup [0] it seems unlikely that this affects the Linux client (or even if it does, it's at least limited to the current user account). So I guess Steam can continue to live on my machine for another day.

[0]: [https://amonitoring.ru/article/onemore_steam_eop_0day/](https://amonitoring.ru/article/onemore_steam_eop_0day/)

</comment><comment><USER36> I'm amused that anyone does not have a cynical view of H1. H1 is an equivalent of HR for cyber. It exists not to deal with issues or address problems, rather it exists to help companies to manage bad exposure. That's how H1's bread is buttered.

</comment><comment><USER37> Just a reminder: you can disable the Steam service and still play your games.

Some Steam features will be disabled or broken but whether or not this affects you will obviously vary depending on which ones you like to use.

</comment><comment><USER38> I wonder if this is a product of Valve's free-form company structure. If as a Valve employee, you have the autonomy to float between projects, how do you maintain a strong security team? Do they even have a dedicate security team?

<comment><USER39> I've worked with extremely competent security professionals before. Those people _love_ and are _fanatical_ about security. Based on my experience, it seems a near certainty that Valve doesn't employee even a single such person. These people raise hell if security is ignored and have a job freedom that makes typical software engineers look like panhandlers.

<comment><USER40> That is why many people hate security cybersecurity professionals: [https://thenextweb.com/security/2019/01/25/everybody- hates-c...](https://thenextweb.com/security/2019/01/25/everybody-hates- cybersecurity-professionals/)

</comment></comment></comment><comment><USER41> There's a follow-up article. [https://www.zdnet.com/article/valve-patches- recent-steam-zer...](https://www.zdnet.com/article/valve-patches-recent-steam- zero-days-calls-turning-away-researcher-a-mistake/)

</comment><comment><USER42> Since Valve stopped producing games, I wonder what their net income per employee is based on assets they own less revenue produced by third-parties through Steam.

If you look at just the assets Valve produces minus rent seeking, are they losing money?

</comment><comment><USER43> Yet another reason to switch to GOG.

</comment><comment><USER44> Valve figured out how to print money by hooking teenagers with gambling on loot boxes. They stopped having to create AAA titles, they stopped having to do anything remotely creative, and now they are a giant cancer with no value left to add. Their client is an insecure, slow, instable piece of shit and has been this way for well over a decade. I regret being a customer of theirs.

<comment><USER45> I remember listening to some of their commentary tracks where the employees talk about how their desks had wheels, there's no managers, and there's no deadlines and no stress. They also at one time had higher profit per employee than Google! [1]

Turns out that all along having no accountability in your company would result in complacency and a critical lack of production. I'm curious to see how Valve Software as a company is going to climb over this security wall they've found themselves in front of if seemingly nobody has to answer to anyone and everybody gets to do what they want in a leisurely fashion. I mean we give Chinese IoT vendors crap all day long, and it turns out Steam might be just as bad!

[1] [https://www.forbes.com/sites/stevedenning/2012/04/27/a-glimp...](https://www.forbes.com/sites/stevedenning/2012/04/27/a-glimpse- at-a-workplace-of-the-future-valve/#138f96275577)

<comment><USER46> I heard somewhere it's very stressful, toxic politics and so on. Not sure where but it's interesting to see a report to the contrary.

Personally I always thought it would be cool to work at Valve, but not anymore. I don't see them doing anything broadly relevant that doesn't involve coasting on the momentum/market share of ancient products. Their VR stuff is cool, but even there it feel like they're lagging behind e.g. Oculus in ways that matter.

<comment><USER47> Eh, every review of the index has put it head and shoulders over any rift version so far. I'm not sure if we'd consider that "lagging behind oculus"

<comment><USER46> It's a premium product, and if I were going to buy a new VR headset right now it'd be the Index, but it's not a generational leap (it's basically a Vive++) and I've lost confidence in Valve to produce such a leap, let alone to bring VR gaming to the mainstream.

I'd love to be proven wrong, because I dislike Oculus. I am simply stating my observation that Valve seems to be in decline.

</comment></comment></comment></comment></comment><comment><USER48> From what I've read, the original bug involved malware already installed on the PC using the Steam client to run other code. While I'm not a security expert in any way, that doesn't seem to me like a huge exploit. If the attack requires installing malware on the victim's computer, why not just do the evil stuff directly with that malware? If that's the case and I'm not just remembering it wrong, then I could see why Valve wouldn't want to pay up _and_ could see why this guy would go on a social media rant to slander Valve either hoping they'll pay up or just to get petty revenge.

<comment><USER45> Lets say you and your brother share a PC, but you're the admin. You both play Steam. His account has no password. I steal the laptop. I log in as him. I pop a SYSTEM shell using Steam. I reset your admin password.

" _Damn_ , you watch some weird porn."

<comment><USER49> Wouldn't you be able to do the same simply by looking at the file system without any access to admin privileges?

I'm not arguing that this vulnerability isn't one, it's a privilege escalation vulnerability, however in your situation you got physical access which is as far as I know, pretty much game over for your system.

<comment><USER50> Not if they haven't granted access to the files to you. In fact by default the files in a user's home folder (including Documents, Videos etc.) are inaccessible to other (non-privileged) users on Windows.

<comment><USER51> If they have physical access, then they don't need to boot into Windows. They could boot from a flashdrive and access any files they want.

<comment><USER45> This is true, and also why I lock down my BIOSs and set the OS as the only boot device. TRK is a bootable portable linux specifically for resetting and unlocking local admin accounts.

Encryption, however, cannot be broken without your credentials. These can be obtained from default running instance of Windows with Mimikatz if the admin credentials are still in memory from an earlier session.

<comment><USER51> Yeah, there are definitely ways of securing versus someone with physical access, but I expect most machines with a non-sandboxed steam installed probably don't have them.

This privilege escalation attack is probably never going to be used if the attacker has physical access.

</comment></comment></comment></comment></comment></comment></comment><comment><USER52> a) Program has scope that doesn't include X

b) Researcher reports vulnerability that falls under X

c) Since it's out of scope, it's closed as N/A

d) Report is locked because company doesn't want to publicly disclose a vulnerability in their system via the Hackerone platform

What's the problem here? Just go with normal vulnerability disclosure. Bug bounty programs are a two way street, and respecting the scope is part of that.

Edit: I guess the important part is that the researcher was then banned for disclosing the report. Seems reasonable, honestly. I don't agree with it, but I understand it.

<comment><USER45> Acknowledgement is one thing. Disclosure is another.

If Steam had no problem acknowledging that this functionality exists, they should have had no problem with it being disclosed. There lies the problem. In the bathroom with the needle in their arm; "...there's no problem here..." but if you swing the door open they'll still try to shut it. Because they know they're wrong.

If HackerOne isn't going to help you they have no right to hinder you. If they want to strongarm everyone into effectively the same agreement as an NDA then there literally is no point in turning vulnerabilities into HackerOne.

They seem to only exist as a cow-catcher on the locomotive of software vendors too lazy to actually fix crappy code.

"Who needs to fix code and shell out bounty if you can pinpoint and silence the researcher?"

<comment><USER4> > If HackerOne isn't going to help you they have no right to hinder you. If > they want to strongarm everyone into effectively the same agreement as an > NDA then there literally is no point in turning vulnerabilities into > HackerOne.

The article gets this part wrong: the hacker isn't banned from H1, which he says in his blog post -- "Eventually things escalated with Valve and I got banned by them on HackerOne — I can no longer participate in their vulnerability rejection program (the rest of H1 is still available though)." HackerOne is in no way punishing the hacker for his reports and/or public disclosures, for what it's worth.

(Disclosure: I am on the community team at H1, though I've had effectively zero involvement with this.)</comment></comment></comment>


AppML – JS Framework by w3schools.com - <AUTHOR> http://www.w3schools.com/appml/

<comment><AUTHOR> I just stumbled upon this little JS Framework by w3schools. I never heard of it before and it isn't hosted on github as it seems. Anyway it looks like fun. Has anyone used this lib in production? Seems they released it in February 2015 as version 2.

Source can be found here: [http://www.w3schools.com/appml/2.0.2/appml.js](http://www.w3schools.com/appml/2.0.2/appml.js)

Background info: [http://www.w3schools.com/appml/appml_history.asp](http://www.w3schools.com/appml/appml_history.asp)</comment>


Why do browsers still not have file upload progress meters? - <AUTHOR> http://michaelkimsal.com/blog/why-do-browsers-still-not-have-file-upload-progress-meters/

<comment><USER2> I'm curious about that: is it simply because there were no progress bars in the first browser to implement a file upload and everyone is now just rolling with lowered user expectations?

<comment><USER3> That would be my guess. Until I read this headline, it wasn't something that was really on my radar; and there is no reason for it.

My assumption would be that it's not on the browser team's radars either.

So, Firefox team, here's your challenge!</comment></comment>


There is a competing implementation to Apple Pay called MCX - <AUTHOR> http://www.mcx.com/

<comment><AUTHOR> Why would the merchants care about this? I don't get it. Should they not be caring more about getting paid rather than worrying about who does it? I can understand if Google or Paypal is behind this but Walmart and Target? I don't quite understand the rationale.

<comment><USER2> Maybe this is a hint: [http://www.businessweek.com/articles/2014-10-20/apple- pay-is...](http://www.businessweek.com/articles/2014-10-20/apple-pay-is-too- anonymous-for-panera-starbucks-and-other-retailers)</comment></comment>


To develop a coronavirus vaccine, synthetic biologists try to outdo nature - <AUTHOR> https://www.statnews.com/2020/03/09/coronavirus-scientists-play-legos-with-proteins-to-build-next-gen-vaccine/ <comment><USER2> The new trick is that they are able to discover the structure of molecule they need through computer simulations modeling immune system/virus.

Basically it uses Recombinant DNA technology to mass produce this. It's already being used to produce growth hormone of various kids for use in humans, swines and bovines.

Difference here is that tho, in growth hormone we know the structure of peptide already as it can be extracted from the pituitary of the cadaver

</comment><comment><USER3> What happens if the virus mutates during the development of the cure? Isn't that the real nature of viruses and the reason why we can't really cure the common cold/flu?

<comment><USER4> Coronaviruses have historically been quite stable (not an expert on this but I read this recently). More stable than the Influenza viruses at least. So we can only hope..

</comment></comment><comment><USER5> Coming at it from a different and lay angle, could a cure be devised that would be even more contageous, spreading around fast and eliminating the virus?

</comment><comment><USER6> hi I'm an idiot who knows nothing. can someone please explain the disconnect between this sentence:

> "It's all of us against the bug," said Neil King of the University of > Washington, who has been part of the hunt for a coronavirus vaccine since > 2017.

noting the "since 2017" part. and this:

> The World Health Organisation said this week it may be 18 months before a > vaccine against the coronavirus is publicly available. > [https://www.sciencealert.com/who-says-a-coronavirus- > vaccine-...](https://www.sciencealert.com/who-says-a-coronavirus-vaccine- > is-18-months-away)

The former sentence seems to suggest there is as yet no path towards a vaccine for this particular virus in that researchers have been trying without success for three years, or is this having to do with the distinction between an immediate vaccine vs. one that is more generalized?

<comment><USER7> It's the latter.

The coronavirus is also responsible for SARS and MERS. They had good luck with a vaccine for SARS but it wasn't needed anymore so they stopped. MERS is highly lethal and was something they wanted a vaccine for if it popped back up. Ideally (this is where my knowledge stops) the vaccines they were working on for other strains will be a good launching pad to make a vaccine for COVID-19.

<comment><USER8> AFAIK the closest they got to working vaccines for SARS and MERS cause lung damage from autoimmune response in each tested animal model.

The issue with these viruses is that they have a property known as Antibody Dependent Enhancement (ADE). Where normally neutralizing antibodies instead facilitate entry into your cells.

<comment><USER7> That was a big issue early on, but I think they were able to work past it before funding and interest dried up.

<comment><USER9> Didn't the SARS vaccine also cause the host to die when reinfected?

<comment><USER7> Early versions were causing even more extreme cytokine storms than the SARS virus did without the vaccine.

This shit is trial and error with some difficult to handle results when things are still in development. Which is why the idea that we'll have a safe and effective vaccine within the year is a complete pipe dream.

</comment></comment></comment></comment></comment></comment><comment><USER10> .. the photo in the article is worth a million dollars ...

<comment><USER11> a reporter once asked me to write a bunch of programming buzzwords on a whiteboard for part of a transmission, you sure this isn't the bioversion of that?

<comment><USER12> There are two photos in the article.

`dsign` refers to the one with President Trump, not the laptop displaying the protein.

Caption is "President Trump is shown a vaccine model during a tour of the National Institutes of Health's Vaccine Research Center in Bethesda, Md., on March 3. BRENDAN SMIALOWSKI/AFP VIA GETTY IMAGES"

<comment><USER11> fair enough, but why would that be worth a million? Even using the phrase in a jocular fashion - it's not that interesting of a photo.

Being pedantic if I look at his photos on Getty Images and choose something about the same quality (I didn't find the exact image) and selecting for both web and print newspaper editorial front page I'm thinking about $4000

Is it actually a million on Getty Images? Or is it worth a million as in the common vernacular usage because it is amusing or has some worthwhile quality I cannot discern?

<comment><USER12> > amusing or has some worthwhile quality I cannot discern

The President's concerned/confused/concentrating look is definitely amusing, especially given his previous skepticism/criticism of vaccines.

But among the punchlines his presidency has given us, this photo is merely a chortle.

<comment><USER11> I feel the same, hence my confusion and deciding it can't be that photo that¨s worth the money. must be the other one.

</comment></comment></comment></comment></comment></comment><comment><USER13> Cold showers help the human body fight germs. Why not? There is zero downside.

</comment><comment><USER13> I'll change that: Cold showers prime and help the human immune system. There is no downside to doing it.</comment>


From bootcamp student to bootcamp instructor - Pete-Codes https://www.nocsdegree.com/ex-bootcamp-developer-now-teaches-the-course/ <comment> Pete-Codes Author here.

I was chatting to Matt Studdert from Frontend Mentor and I found out that he now teaches at General Assembly in London where he went to learn to code. Pretty cool example of the self-taught/no degree route so thought I would interview him.</comment>


Wikileaks and Iceland MPs propose 'journalism haven' - <AUTHOR> http://news.bbc.co.uk/2/hi/technology/8504972.stm

<comment><USER2> If I were the Icelandic government I'd take a look at how much revenue attracting investigative journalists to the country would be likely to raise, and then move on to the next topic of the day.</comment>


Reading files quickly in Rust - <AUTHOR> https://boyter.org/posts/reading-files-quickly-in-rust/ <comment> star-techate Simple file I/O is such a great task to blog about as there's a long evolution of 'discovery' permitted:

1\. oh wow, syscalls are really slow. We need to get as much done as we can with as few of these as possible

2\. that's kind of annoying though, what if we had ... some kind of ... transparently buffered ... interface?

3\. woah that buffered I/O thing I discovered last time, I just found out that my C programs have been using that this whole time! what _cheaters_!

4\. hmm, even though I have 9000 CPUs each trying to process I/O from this single filesystem, I'm not getting the 9000x speedup I would expect. wait, wait. I just had a thought. try and keep up with me here. Filesystems must exist somewhere in reality, right? On some part of my macbook? What part is that?

5\. oh wow spinning disks have really weird performance characteristics

6\. oh wow it's enormously faster to read serial data _even in RAM_! Even though it has 'random-access' right in the name, random access is slower! This is going to be an epic-length blog series guys! We're rediscovering everything!</comment>


TravelersBox raises $10m to help tourists with their leftover foreign change - <AUTHOR> https://www.techinasia.com/travelersbox-series-a-funding <comment><AUTHOR> A really interesting company that enables depositing of leftover foreign currency change at airports.</comment>


Why I Left Management: the engineering technical track vs. management track - <AUTHOR> https://medium.com/code-like-a-girl/why-i-left-management-the-engineering-technical-track-vs-management-track-abef5b1d914d#.451w9v5la <comment><USER2> I've always actively avoided moving into management. I refuse to become a victim of The Peter Principle:

"In a hierarchy every employee tends to rise to his level of incompetence." \- Dr. Laurence J. Peter</comment>


Why most people's next car will be a Tesla - <AUTHOR> https://betterthansure.com/the-tesla-way-of-making-a-great-product-4e1928752de6 <comment><USER2> > By 2016, the no-compromise electric car became a reality when Tesla finally > announced the Model 3. It became as much a no brainer as an iPhone. The > alternative to a Model 3 is simply obsolete.

The hyperbole is strong here. Most people is > 50%, it will most definitely not happen, the car arena can not be compared to the smartphone arena in any way because smartphones did not exist in significant numbers.

Tesla is at best going to end up as a solid player once the replacement cycle kicks in, until then they are super fragile and could just as easily die as make it big.

Let's wait with calling out the milestones until they actually happen. For now Nissan/Renault is actually the biggest seller of EVs.

</comment><comment><USER3> lemme fix that...most people's next car will be used (pre-owned) in the US (and in Europe). Most likely it'll cost in the range of 6,000 to 16,000 USD and will definitely not be a Tesla.

That said, I want my next car to be a Tesla...the masses don't have to money to be included unfortunately.

</comment><comment><USER4> >Why most people's (in Palo Alto) next car will be a Tesla

FTFY</comment>


Microsoft sues TiVo over patent  - <AUTHOR> http://sanjose.bizjournals.com/sanjose/stories/2010/01/18/daily50.html <comment><AUTHOR> By way of Groklaw: <http://www.groklaw.net/article.php?story=2010012014205446></comment>


New tool fingerprints phone route - <AUTHOR> http://www.gatech.edu/newsroom/release.html?nid=61428 via Schneier on Security.<p>The tool is called PinDr0p, and works by analysing the various characteristic noise artifacts left in audio by the different types of voice network - cellular, VoIP etc. For instance, packet loss leaves tiny gaps in audio signals, too brief for the human ear to detect, but quite perceptible to the PinDr0p algorithms. <comment><AUTHOR> here's the article from the register. <http://www.theregister.co.uk/2010/10/06/voice_fingerprints/></comment>


The Covid Opportunity for Impossible Foods - <AUTHOR> https://www.robertyaman.com/blog/the-covid-opportunity-for-impossible-foods <comment><USER2> People aren't buying fake meat during a pandemic. The meat department was cleared out at my local grocery store during the early days but fully stocked with 20$ Lb fake ground beef.</comment>


The Affordable Care Act is flawed, why not public pricing? - <AUTHOR> Submitted this on reddit, but thought the tech-savvy might have differing opinions.
"The Affordable Care Act creates no incentive for insurance companies to reduce prices, only their margins. Why not instead create a public service that forces health care providers to lock in a price?
If health care providers were not allowed to manufacture a starting price as part of negotiation, everyone could shop for the service that suits them. Insurance would still be helpful, just like it is for normally good drivers. The masses pay into a system in case they might need it, and those with the misfortune of needing help are funded.
Medical institutions and doctors can set realistic prices, the ones that insurance companies are already negotiating. The transparency would make billing simpler and more efficient. There could be some rating system, but I doubt that belongs in a government system. But any technology company will have access to prices and could amend with ratings.
Thoughts?" <comment><USER2> Leaving private companies in charge of healthcare is pure madness. Most of the developed countries have realized this. (see [https://en.wikipedia.org/wiki/Universal_health_coverage_by_c...](https://en.wikipedia.org/wiki/Universal_health_coverage_by_country))

The reason is that healthcare is somewhere you don't want the profits to be the main goal. The goal is to make sure everyone is taken care of, at the best cost for the society. Did you know the US is the country that spends most on healthcare, and still doesn't have universal coverage? ([http://www.investopedia.com/ask/answers/020915/what- country-...](http://www.investopedia.com/ask/answers/020915/what-country- spends-most-healthcare.asp))

Therefore, public pricing is not the optimal solution. Public heath system is.

<comment><AUTHOR> Agreed.

But replacing all of the private entities involved with health care overnight is not a likely next step. It should be a goal, eventually.

<comment><USER3> > It should be a goal, eventually.

Warning: Completely tangential musing/rant...

That "eventually" word is killing me. When we leave these sorts of issues up to the forces in power, they never seem to get done. What we get instead are watered-down, doomed-to-fail, design-by-political-committee "solutions" such as the ACA.

I think we need an official roadmap. I think the public deserves a direct voice in guiding the direction of the country. At the very least, I think we need to set in stone a clear vision of what milestones we want to achieve as a nation.

My entire lifetime, our leadership has repeatedly demonstrated it is incapable of moving us in any single direction long enough and far enough to be meaningful (aside from war, perhaps). Let us choose the direction; let them work-out the implementation.

/end rant

I'm just speaking my mind. What do you all think? Is this even a "good" idea? How could we even begin to make this happen?

<comment><USER4> _I think we need an official roadmap. I think the public deserves a direct voice in guiding the direction of the country. At the very least, I think we need to set in stone a clear vision of what milestones we want to achieve as a nation.

My entire lifetime, our leadership has repeatedly demonstrated it is incapable of moving us in any single direction long enough and far enough to be meaningful (aside from war, perhaps). Let us choose the direction; let them work-out the implementation._

To some extent the back and forth you talk about is evidence that the public doesn't agree on the direction to take.

<comment><USER3> Sure, there's never going to be unanimous agreement. Put it to a vote. I'm mainly just talking about letting the public choose which issues the leaders should focus on, and holding them accountable if they don't.

<comment><USER4> How would that be different than what we have now?

I think there are things that would be incremental improvements (like having more members in the House of Representatives) and maybe better districts, but most elections have the candidates crafting a message based at least partly on what they hear from people and pretty high desire to get reelected (so they have to at least appear to follow through on their message).

There's a lot of things I see people proposing that end up boiling down to wishing that others would 'vote better'. That's a tough problem to solve.

</comment></comment></comment></comment></comment></comment><comment><USER5> "The transparency would make billing simpler and more efficient."

But the insurance companies, lobbyists and the big pharmas don't want this transparency. They make record profits only because of this non-transparency. Imagine the jobs of hundreds of medical billers, transcriptionists going away as well if this whole healthcare "thing" becomes simpler.

</comment><comment><USER6> Reading the comments below, I am guessing that most people simply don't understand the terminology you are using. Ie you have to define what are:

1\. Public service 2\. Lock in a price 3\. What are the prices (vs margins) 4\. What's a starting price

I understand your question because I get regular bills from my insurance company that say "Doctor usually charges $1,000 for the procedure you had but we have negotiated price $100, so that's what you owe, as you are still below your deductible."

<comment><AUTHOR> As I understand the current system, medical institutions negotiate different prices with every insurance company. They start high and the size of the insurance company's patient pool helps them get better price per service.

It seems weird, because it is weird. I can not think of another industry that works like this, where prices can be unknown until it goes to billing. Forcing them to fix a price and publish it to a government registry could possibly allow market forces to drive lower prices than even the largest insurance companies can negotiate.

</comment></comment><comment><USER7> I recall a very good article that said there are many problems with healthcare in the US which causes it to be as expensive as it is, rather than a single big problem. I would list them if I remembered a good number of them. One of my favorites is that the health care industry is not paid to keep people healthy, it is paid to treat people. As a result, we get lots of treatment and medicine, and not great health.

</comment><comment><USER8> If you allow the young and healthy to purchase plans at one third the price then the old and ill are going to have to pay three or more times more. How are they supposed to afford that after a lifetime of working just above minimum wage?

Without the young paying in during the early years they're going to have annual premiums of $40-50,000 as they approach their 60s.

<comment><AUTHOR> Might seem backwards, but the goal here would be to turn patients back into customers. Right now, there is no visibility for the individual into prices for services. Without it there is no competition at all to find common, realistic prices for services.

Lower prices should reduce premiums for everyone, since insurance companies have strict margins per the ACA. Lower premiums should increase those that are covered by insurance, hopefully.

<comment><USER8> Nothing wrong with turning patients into customers. Lower prices will only happen for the young and healthy. Higher prices will be the only possible future for the old and those with pre-existing conditions. The insurance companies are not going to cover a particular class at a loss. They'll just walk away, as they should.

The ACA is going away. Please don't use it as a crutch.

Lower premiums mean higher deductables. We see that now and we saw it before the ACA. Healthcare costs $18,000 per person this year regardless of how you divide the premium and deductable. Take away the young and the price goes up for everyone else. And this is with a cap in place by the ACA. Only going to get worse with the regulations removed.</comment></comment></comment>


Secret report urges treaty forcing US web firms' cooperation in data sharing - <AUTHOR> http://www.theguardian.com/world/2015/jun/02/web-firms-data-sharing-secret-treaty

<comment><AUTHOR> I'm surprised the UK government are pushing this, it would only legitimise other countries asking for the same kind of unfettered access.

<comment><USER2> I'm not because:

1) US and UK are the forefront of pushing for such laws recently first in "X Eyes" countries and then in others as well, because it's actually the NSA and the GCHQ proposing them

2) The UK is bound by the Human Rights Charter in the EU and some of the data collection and spying laws are actually _illegal_ (even if they keep going for now). Through this "international treaty" (that supposedly the EU countries would sign, too) they could probably bypass that.

<comment><AUTHOR> Well this is a government who had a manifesto pledge to abolish the Human Rights Act. And they won. So, indeed, maybe I shouldn't be surprised.

Seems very self defeating though. Data could end up being siloed in countries where the users are based so their government can decide who can see it.

</comment></comment></comment><comment><USER2> How can "legal" and "secret" be in the same sentence? If something like this passes in secret without the people's support, that's clearly an _illegitimate_ law.

</comment><comment><USER3> I have a feeling that some country is going to become significantly wealthy simply by becoming the world's data storage where data is protected from the heinous hands of our governments.

All of this is somewhat only a nuisance at the moment even though it is ever increasingly revealing real implications. Just imagine though what happens when these governments that have shown such blatant disregard for even the most fundamental legal code of our country and have essentially committed high treason against the Constitution and America's people gain access to mind reading technology even beyond what is already possible through inferences based on your online activities, and written and verbal thoughts.</comment>


Ask HN: How to protect oneself from trained sales people? - <AUTHOR> <comment><USER2> It depends...did you approach them, or was it a cold call for something you may not need?

For the first:

\- Do your research

\- Know what you need (vs what you might want)

\- Know what you can pay (conservatively, and at a maximum)

\- Don't be afraid to say no

\- Don't be afraid to ask questions

\- Never feel pressured into a transaction - go away and think/process things

For the second:

\- Don't be afraid to immediately tell them you're not interested (in fact, you should do this by default if it's something you don't need)

\- Know your finances, so that you're aware of what you can and can't afford (this might be impetus to cut off the call sooner rather than later)

\- If it's something you may need, or have looked at, the points above apply

An interesting thing I've discovered (anecdata) - salespeople are wary of engineers, because we rarely take something at face value. If you are one, make sure they know this early on (either state it, or make sure they know you know something about the domain). In the past it's done two things for me:

\- The sales person is less likely to make wild claims, and will be more careful to make statements that can be backed up

\- Often, they become less pushy, because they know they will have to work for the sale (rather than rely on emotion and ignorance)

One last comment: don't mistake courtesy for friendliness. Sales people are there to do a job. They are not your friends (you don't owe them anything), and it's the exception to the rule that they will have your best interests at heart. Keep this in mind while you're talking to them.

<comment><AUTHOR> Those where good points.

In my case it was the first. I did enough research and was very clear on the pricing and product, i improved on my negotiating as i visited 3 showrooms and then when i went to this 4th show room "don't mistake courtesy for friendliness" this happened and i ended up spending $2K more that i should have. He talked to me in a very nice way taking so much care about how i would like and i just gave into it as i was tired that day and already was shopping for the product for a month and just wanted to close the purchase.

</comment></comment><comment><USER3> You are asking about how to have a stronger frame than the sales guys, google or search reddit for psychological frame.

</comment><comment><USER4> Protect yourself in what sense?

<comment><AUTHOR> protect myself so that i don't give into their stories and end up buying something i don't want or end up buying something at a higher price than i had initially decided.

<comment><USER4> Ah.

Set yourself a price ceiling before the call.

Develop a habit of applying a skeptical attitude towards anything you hear, especially from someone you know has motive to persuade you.

Ask to be put in touch with current clients with similar use cases to yours. Ask those contacts tough questions.

Take a couple days to "sleep on it" and consider what you've heard / research / apply critical thinking before committing to a purchase.

</comment></comment></comment><comment><AUTHOR> I have decided here after any time i make any decision i am gonna construct an Yes or No question to myself 5 times and only if i say Yes 5 times i will say yes to the decision and if i say No 5 times then i will say no to the decision and if its a mix of Yes and No then i will simply delay the decision by 48 hours.

Hope it keeps me from falling for such traps in the future. Let me know how you managed to get out of such situations or if you had any tips to handle them.</comment>


The Economics of Running a Curated Newsletter - <AUTHOR> https://www.indiehackers.com/@AndrewKamphey/the-economics-of-running-a-curated-newsletter-34cf547545 <comment><USER2> I don't think he gives himself nearly enough credit here

If I could pay _net_ $137 and end up with an email subscriber list of 2.5K along with a burgeoning personal brand centered around an exciting topic I'm interested in, I'd take that any day!

Even just reading this makes me mind spin thinking of how I could replicate his success. Congrats are definitely in order

</comment><comment><AUTHOR> I think that's a great topic to discuss. Some feedback was already given at [https://www.indiehackers.com/forum/the-economics-of- running-...](https://www.indiehackers.com/forum/the-economics-of-running-a- curated-newsletter-49eb6b2a1f)

It also reminds me a great previous discussion here on HN [https://news.ycombinator.com/item?id=14616440](https://news.ycombinator.com/item?id=14616440)</comment>


Audi will replace the TT with an electric sports car - <AUTHOR> https://www.topgear.com/car-news/electric/audi-will-replace-tt-electric-sports-car <comment><USER2> I _just_ traded in my 2013 Audi TTS for a Tesla Model 3 Performance on Thursday. I would have given serious consideration to an all-electric TT (if it were actually available now and not vaguely promised for a few years from now). I much prefer the TT's form factor, hatchback, front bucket seats, steering wheel and rear visibility. It's just a better looking car that's more fun and more comfortable to drive. On the other hand, the Tesla has usable rear seats, keyless entry, a far superior entertainment system, so much less cabin noise that making a phone call is a reasonable idea, doesn't need gas (premium for the TTS), doesn't need oil changes, and accelerates _faster_.

</comment><comment><USER3> PLEASE PLEASE PLEASE call it the ET!</comment>


New android app for YouTube - best videos  - <AUTHOR> https://play.google.com/store/apps/details?id=com.andromo.dev44966.app46442 New android app for YouTube - best videos <comment><AUTHOR> I hope u like the content</comment>


Ask HN: Tech news sources/communities in spanish? - <AUTHOR> As I am learning Spanish I have been looking for good tech websites in Spanish. It can be websites like Techcrunch which have a international focus or pages that focuses on the local tech/startup-community for a spanish speaking country (f.ex Spain) or a Spanish HN. Anyone got any good recommendations? <comment><USER2> As a native Spanish speaker, I don't know of any successful tech community in Spanish. Vast majority of them just republish news from English sources with lazy translations.

So it may not be the best idea to learn Spanish this way.

With that said, I do know of two popular ones:

[https://www.xataka.com/](https://www.xataka.com/) and their network of sites (Webedia, see page footer)

News and sometimes discussion in various topics, mostly technology, hardware and random gadgets. Mostly written by Spaniards or Mexican authors, but don't expect a lot of original stuff.

[https://elrincondelc.com/foros/](https://elrincondelc.com/foros/)

Somewhat popular but small community for general programming questions.</comment>


How White Nationalism Courts Internet Nerd Culture - <AUTHOR> https://medium.com/@DeoTasDevil/how-white-nationalism-courts-internet-nerd-culture-b4ebad07863d <comment><USER2> > IQ is a pseudoscience

This is how people trying to oppose the alt right shoot themselves in the foot. Alt right intellectuals and propagandists immediately capitalize on this kind of nonsense. (The fact that the author identifies as a communist before denying the strongest predictor in psychology is somewhat telling as well and acts as free fuel.)

<comment><USER3> Is it non-sense? I've heard many times that there a hell of a lot of problems/criticisms of IQ and that it's history is intrinsically linked with eugenics and other kinds of pseudo science. Can you link me to something supporting your claim that it's " the strongest predictor in psychology" (predictor of what... I'm not sure)?

<comment><USER4> IQ is, as far as I know, a pretty strong predictor of success in life (be it financial, educational, health-wise or longevity).

</comment></comment></comment><comment><USER5> This article is pretty bad and it's kind of annoying that it (somehow) reached the top of HN. But I'll bite.

1) IQ is _not_ a pseudoscience. Admittedly, IQ is a pretty shitty test for intelligence (as it's highly culturally-biased), but calling it pseudoscience is just dumb and shows an inherent misunderstanding of what it's supposed to do. Yeah, white supremacists are idiots and use it to justify racism, but that's a different point than what the author is making.

2) Author criticizes Trump's sharing of the "black on black" statistics arguing that it's fabricated. However, some cursory research shows that it is, in fact, not as fabricated as one might believe: [https://ucr.fbi.gov/crime- in-the-u.s/2013/crime-in-the-u.s.-...](https://ucr.fbi.gov/crime-in- the-u.s/2013/crime-in-the-u.s.-2013/offenses-known-to-law- enforcement/expanded- homicide/expanded_homicide_data_table_6_murder_race_and_sex_of_vicitm_by_race_and_sex_of_offender_2013.xls)

According to the above, 90% of African American homicides were perpetrated by African Americans. This can be compared with white homicides which were perpetrated by 83% whites. Obviously, the numbers are highly skewed in the infographic shared by POTUS, but to bury your head in the sand and pretend this isn't a problem in black communities is unfair and does a great social disservice.

3) It doesn't take some kind of genius to "spot the signs" of Neo-Nazism. Swastikas are kind of a tell-tale sign.

4) "Deo is a union Millwright and a 12 year member of the Furry Fandom who spent 6 months infiltrating multiple Alt-Right and neo-Nazi online groups observing and recording how they recruited, organized, and operated." \-- laughable. "Infiltrating" = joining a few discord servers and posting on 4chan. Got it.

Completely worthless article devoid of any actual real social commentary, potential solutions, or plans of attack. Medium has been turning into a soapbox lately.

<comment><USER2> IQ tests are not culturally biased. This is a decades out of date canard. Some tests, like Raven's Progressive Matrices, don't even require the test giver and taker to share a language. IQ, as a statistic, washes out almost every other psychometric in predictive validity -- there are a staggering number of psychology papers which pointedly do not include IQ because whatever predictive power their metric purports to have is totally overridden by IQ. There are many subfields of intelligence and two major categories (fluid and crystal) so it's true that intelligence can't be defined as a single number, but this is a strawman since intelligence researchers have never said this.

<comment><USER6> Let's assume resources are also important in success and you use IQ "tests" as a way to allocate resources to candidates. Then, your biasing your results.

<comment><USER2> Yes, this is a legitimate problem because there are both genetic and environmental contributions to intelligence. We must be wary of eugenic arguments. After all, the easiest way to raise the average IQ of a society would be to kill everyone who doesn't meet a specified minimum IQ. A more politically palatable way would be to allocate resources away from those groups.

This isn't a matter of biasing results, though, because the metric validity of intelligence testing doesn't require that we play nice with making sure everyone has equal access. These are separate problems. Intelligence research is a scientific problem, and resource allocation is a political one.

We already know that environmental contributions to IQ are important, and a reasonable and moral person who is literate on intelligence research thinks that resource allocation to lower-performing people is critically important.

</comment></comment></comment></comment><comment><USER7> I don't think I've ever read anyone babbling on about white people being superior because they invented technology, that's a a new one for me honestly.

The article was pretty rambly and I have to admit I just skipped a bunch of it. My takeaway was he pretended to be a furry nazi for a while and discovered a bunch of idiots believing in idiotic shit then had to write a bunch of idiotic shit about his 'traumatic' experience listening to idiotic shit.

Furry nazis are pretty fucking hilarious though. I wonder if they realize real nazis would have executed them for their sexual attraction to cartoon animals?

<comment><USER8> >My takeaway was he pretended to be a furry nazi for a while and discovered a bunch of idiots believing in idiotic shit then had to write a bunch of idiotic shit about his 'traumatic' experience listening to idiotic shit.

She said something the nazis didn't like, then there was drama including threats against her. She didn't back down, and kept her position. She also read in some of their chats. (If they let her in or someone send her logs)

Then she posted that text about nazis trying to infiltrate nerd cultures like the Furry fandom (which she is a member of).

So, you completely missed. But at least you tried?

<comment><USER7> Nah I gotta be honest. I didn't really try at all.

</comment></comment></comment><comment><USER9> I think there should be space for all kinds of discussion, even those I don't agree with, but in this case what worried me the most was the authors claim that once a person enters a community to discuss whatever white nationalist subjects, they are told or manipulated into believing they cannot leave, or they are made to watch propaganda videos in order to stay in the group. That crosses the line from communication of ideas to coercion and cult behavior. I don't know why people don't see that they're being treated in this manipulative way, though. Even at my most lonely, I was highly suspicious and dodgy whenever any similar tactic was used on me; I preferred to be lonely.

<comment><USER2> Because a good propagandist does two things:

1\. Ground the argument in some vestige of reality (the reliance on statistics is very strong). 2\. Point out the opposing denial of reality (magical thinking, social constructionism, blank slate lunacy) in order to push the radically opposite perspective without nuance.

This is inherently isolating but also makes the adherents feel very powerful. Think pieces like this do not oppose but rather support the cause they purport to be against, since the ideological leanings of the writer are plainly obvious and their _own_ denials of reality stick out like a sore thumb.

As long as the political left is dominated by social constructionism and other lunacy, the alt-right will never be exterminated. The task ahead of us is not trivial.

<comment><USER10> Social constructionism is lunacy why?

<comment><USER2> Because it's factually wrong. Biology matters, and I'm not trying to bring in concepts like race (which is a total intellectual disaster, since the term refers to multiple concepts that mean radically different things). Many studies do not account for simple heredity, when adoption studies have already shown that traits like IQ and even personality are heritable to some degree (1). There are genetic correlations with intelligence, aggression, etc that are difficult to untangle but undeniably real.

Humans are incredibly unique animals, but you are still a biological machine and your brain is not a piece of magic pixie dust. Without getting into the free will debate, biology does not determine behavior but does influence it heavily.

Edit: I'm not denying the existence of culture or social norms. These matter, but are also undoubtedly linked to the biological machinery of the human animal. Human society is an evolutionary result (2).

Second edit: It's very easy to find evidence that the social evolution of humans is a biological process. Here is one of my favorite papers on the self- domestication of the human species (3).

1: [https://www.amazon.com/Blank-Slate-Modern-Denial- Nature/dp/0...](https://www.amazon.com/Blank-Slate-Modern-Denial- Nature/dp/0142003344)

2: [https://www.amazon.com/Before-Dawn-Recovering-History- Ancest...](https://www.amazon.com/Before-Dawn-Recovering-History- Ancestors/dp/014303832X)

3: [http://resources.seattlecentral.edu/faculty/jwhorley/Gracili...](http://resources.seattlecentral.edu/faculty/jwhorley/Gracilization.pdf)

</comment></comment></comment></comment><comment> moz-hx It's incredibly aggravating how aggressively Nazis are attempting to corrupt internet culture to espouse their hateful ideals. The original mindset that developed on the internet was about how nobody's identity IRL mattered, and what you said/did was what proved your worth. Now, a bunch of basement- dwelling Nazis are trying to turn that meritocracy into their own whites-only club? Fuck that, that's not what internet culture is about.

I strongly believe that anyone who cares about the internet and its culture of free ideas will recognize it as a place where people can be judged based on their skills and the quality of their ideas rather than their race or gender, and will harshly judge anyone who attempts to exclude others based purely on such superficial metrics.

<comment><USER11> There were white supremacists pushing holocaust denial on usenet. What actually happened is that the social places on the Internet suddenly stopped moderating themselves which let white supremacists congregate, organize and normalize.</comment></comment>


Apple's butterfly keyboard failed by prioritizing form over function - <AUTHOR> https://www.theverge.com/circuitbreaker/2020/5/27/21270299/apple-butterfly-keyboard-hardware-design-macbook-pro-physical-key-button <comment><USER2> This would be more of a discussion if we were given an inside perspective on the processes which led to this, whether there were countervoices, why they weren't heard, etc.

<comment><USER3> That would be fascinating. But Apple is so secretive, and punishes leakers, so that's pretty unlikely.

</comment></comment><comment><USER4> There's only one butterfly keyboard worth talking about.

[https://en.wikipedia.org/wiki/IBM_ThinkPad_Butterfly_keyboar...](https://en.wikipedia.org/wiki/IBM_ThinkPad_Butterfly_keyboard)

<comment><USER5> ThinkPads are an underappreciated marvel of industrial design, along with Siemens LOGO PLCs and IBM line matrix printers

<comment><USER6> Considering they're still one of the most popular lines of notebook PCs on the planet, I'd say they're about the right level of appreciated.

</comment></comment></comment><comment><USER7> Jony Ive retires and all of a sudden Apple hardware starts making more "sense". I don't think that was a coincidence. The engineers are more influential than the designers at the moment.

<comment><USER8> Read a rumor somewhere that he made the edges of the MacBook in his prototype design so sharp to the point of serious discomfort to users, but he only changed it after Steve Jobs had to ask him about it.

edit: [1] Turns out it was the first iPhone.

[1] [https://news.ycombinator.com/item?id=20437041](https://news.ycombinator.com/item?id=20437041)

<comment> core-questions There are still lines on my wrists from a previous aluminum Macbook of some variety I had.

</comment></comment></comment><comment><USER9> The day that the new keyboard was released, I walked over to the Apple store and tried it out.

I physically recoiled from it. It reminded me of the Atari 400 keyboard, a cheap membrane keyboard from the 1970s . . . not quite that bad, but still awful.

The Apple store employee who was watching me remarked on my reaction. "This keyboard feels terrible," I said, "Apple is going to lose a lot of money over it." Naturally the employee didn't care about my opinion.

Software engineers, always Cassandras.

</comment><comment><USER10> Early on it seemed like Apple took a Bauhaus-like approach to design, where the motivating principle can be summarized as "form _follows_ function". From an outsider's perspective, there's so much time spent discussing Apple's design on aesthetic merits that the focus shifted over time from making supremely functional devices to ones that signal high class and taste at the expense of more mundane concerns. Let's try to re-center the discussion on device/product design as driven first by function, and then by form.

</comment><comment><USER11> I must be in a silent minority that likes quieter keyboards with less travel. So more butterfly keyboard please...

<comment><USER12> Wasn't the problem the high failure rate though, not the actual UX?

<comment><USER13> It was controversial for the very low travel even before the reliability issues started to crop up.

</comment></comment></comment><comment><USER14> I don't actually mind the butterfly keyboard. Back in 2016 I got one of the first laptops with the it, the 12" MacBook, and I'm still using it daily. Also had a 2017 15" which I just upgraded to the new 16". Zero issues with both, and I haven't babied them at all.

While there's not a lot of key travel, it is very clicky and feels satisfying for me to type on. Individual keys are also very stable.

<comment><USER15> Not sure why you're being downvoted - my experience mirrors yours. I've just swapped from a 2018 MBP with the last (final?) iteration of the butterfly mechanism to a 2020 13" MBP with the new keyboard and in all honesty I preferred the butterfly.

</comment></comment><comment><USER16> Nonsense. The article makes several unfounded assumptions _why_ apple designed such a keyboard. The keyboard is amazing! When it works.. I myself am a victim of its astonishing unreliability, would even join a class-action lawsuit against apple. But it's purely failed implementation.

<comment><USER17> Reliability was one problem. The other was that for many of us it was uncomfortable to use. I would actually feel some pain in my hands/wrists after using this keyboard for a while. Both the older keyboard and the newer keyboard are fine for some reason.

</comment></comment><comment><USER18> I always thought people were just exaggerating about this keyboard until I got a laptop that has one. I have a MacBook Air with a keyboard I love and use for personal stuff and my current client sent me a MacBook Pro. I was excited because the specs were crazy. Until I started typing. It was so bad and weird compared to my MacBook Air. So I assume it has that hated keyboard.

<comment><USER19> I had one at work. Thankfully it wasn't my main dev machine or main laptop. Whenever I used it my typing precision took a huge hit. The lack of key travel really messed me up in terms of "did I actually activate that key?" I was perpetually missing A's in my typing.

Maybe other people were able to get used to it, but I couldn't.

</comment></comment><comment><USER20> The level of contempt for paying customers on display is nothing short of stunning. With the price premium they get, they could afford to deliver superb quality and outstanding service. Instead they pocket the difference, every time.

What is most remarkable is that the customers keep coming back anyway.

</comment><comment><USER21> Penetrating analysis. I am grateful that the journalists at The Verge have graced us with the singular insight that can only be borne from their evident engineering genius.

</comment><comment><USER22> I just want everything about the Butterly keyboard and that era of Apple to be relegated to the past.

</comment><comment><USER23> A lot of words to say nothing.

Yes it's a bad keyboard. But the interesting story is in how a company that once prioritised quality of user experience came to make that choice.

The article is a set of maybes without any new insights.

<comment><USER24> Tech journalism in a nutshell.

</comment></comment><comment><USER25> Pretty sure this is a dead horse. Must be a slow news day.

</comment><comment><USER26> Why are we rehashing this for the 1000th time??

<comment><USER27> Because it is almost unbelievable that it happened; I can barely type on mine. I have all my hardware from 10+ years ago until now to compare with. Would return this one in an instant, if possible.

<comment><USER28> My first mac computer is the 2018 MBP which features the butterfly keyboard, it started failing after about 6 months of use. My previous laptop, a dell e6230 which runs Linux, feels almost as fast, especially for Docker stuff, has a fantastic keyboard and way better battery life. Can't see myself buying any Apple product after that.

<comment><USER17> I bought a 2017 MBP and figured that surely it can't be that bad in practice.

It was, to the point where I could barely type sentences without having to correct double-letter inputs. And that's without anything failing.

Thankfully the laptop was insured and I got the 2019 16 inch model now (with the escape key and a working keyboard). Touchbar with BetterTouchTool has proven to be much more useful than I expected.

But man was this a massive fuck-up. There's no way a 2000+ product should be able to malfunction in such a fundamental way!

EDIT: also, pain. I'm pretty flexible when it comes to getting used to changes in input, so I expected to be okay with less key travel and whatnot. But a day of using the new keyboards /felt/ different. My hands/wrists would hurt. This was only with the MBP with the new keyboard. Whenever I used my old MacBook Air or even the new Magic Keyboard I had no issues.

I can't tell for sure, but while it feels a lot better, even the new 16 inch MBP leaves my fingers a bit more sore than the mushier 2013-era Air.

</comment></comment></comment></comment><comment><USER29> They failed because the testing process failed. Apple sells mass-market consumer devices: they don't set out to sell failing hardware.

</comment><comment><USER30> I think this is overstated. The butterfly keyboards were better day to day than the old style imho, and I say that as someone who had to have one replaced multiple times. It was the robustness that was an issue rather than the keyboard itself.

Apple can be accused of moving too slowly to when issues arose perhaps, but they did iterate trying to fix it and they've been very good in my experience with replacements.

Happily the new one is fantastic as far as I can tell so far.</comment>


Coca cola and butane (not mentos) - <AUTHOR> https://youtube.com/watch?v=VxvJcPToXb0

<comment><USER2> That's amazing and a bit scary. The magnetron video - where they take the magnetron out of a microwave oven (but leave it connected) and then tie it to a stick and point it at stuff with the oven (and thus magnetron) powered on is scary.

[https://youtube.com/watch?v=7Xkx7FTWERw](https://youtube.com/watch?v=7Xkx7FTWERw)

<comment><USER3> At least the trick with old CRT is fake (as one YouTube commenter noticed) - it can be clearly seen in TV screen reflection that someone throws something towards the TV just a moment before it breaks. And if you look closely at the garbage before the TV -- a gray brick appears there just a moment after the "explosion".

</comment></comment><comment><USER4> It says "propane" in the video description.

<comment><AUTHOR> Ah, you're right. In my defense, there is some butane and a butane lighter at the beginning of the video :)

Is there a way for me to update the submission title?</comment></comment>


Ask HN: Easy cloud text indexer / searcher - <AUTHOR>

Hi guys, I was pretty sure to have seen on HN some new dead-simple SaaS service to quickly send text to be indexed, and then being able to run queries via REST APIs. My idea is I need some simple indexing and searching capabilities in a demo, and I could achieve that by building a Lucene indexer and seacher, but I thought that there might be an easy cloud service already doing that. My google-fu did not bring any positive results as for now... Thanks ! <comment><USER2> A few things come to my mind/search:

\- [http://www.elasticsearch.org/](http://www.elasticsearch.org/) \- self hosted and open source but easier to setup than standalone Lucene from what I have read

\- [http://acquia.com/products-services/acquia-network/cloud- ser...](http://acquia.com/products-services/acquia-network/cloud- services/acquia-search)

\- [http://www.netaphorsearch.com/](http://www.netaphorsearch.com/)

\- [http://aws.amazon.com/cloudsearch/](http://aws.amazon.com/cloudsearch/)

\- [http://websolr.com/](http://websolr.com/)

\- [http://www.opensolr.com/](http://www.opensolr.com/)

Hope this helps

<comment><AUTHOR> Hi, I had already seen some of these, but that definitely helps ! Will check them, thanks !</comment></comment>