Win the NESFlix – NES That Plays Netflix - <AUTHOR> https://www.reddit.com/r/gamers/comments/7auapp/netflixgamers_are_giving_away_the_nes_that_played/ <comment><AUTHOR> As part of our Extra Life 2017 fundraising efforts a bunch of us are live streaming an 24 hour LAN party.

We're giving away a very special piece of memorabilia! NESFlix / DARNes is the only NES in the world that can watch Netflix. You might remember it from the Castlevania Trailer [https://www.youtube.com/watch?v=iIMrFnl5NiA](https://www.youtube.com/watch?v=iIMrFnl5NiA) or the Hack Day blog post!

For more technical details check out Guy's blog post on the subject: [http://blogofsomeguy.com/a/2015-03-22/nesflix.html](http://blogofsomeguy.com/a/2015-03-22/nesflix.html) and a demo video by Guy and Alex here: [https://www.youtube.com/watch?v=_yn- rNdYZAY](https://www.youtube.com/watch?v=_yn-rNdYZAY)

If we reach our donation goal of $10,000.00 one lucky donor will be receiving the NES!

<comment><USER2> It hurts to let it go.. but I love the cause ;)

<comment><USER3> A very rare piece indeed!

</comment></comment></comment><comment><USER4> Looks like fun! And for a good cause, too.

</comment><comment><AUTHOR> There is a live stream of the event here: [https://go.twitch.tv/netflixgamers](https://go.twitch.tv/netflixgamers)</comment>


Unsplash's dataset is now open source - <AUTHOR> https://unsplash.com/blog/the-unsplash-dataset/ <comment><USER2> While the images on unsplash are fantastic, nothing about this, really nothing, is "open source".

e.g. quote from [https://unsplash.com/api-terms](https://unsplash.com/api- terms) :

 _In connection with any Photos that you access via the APIs, you must directly use or embed the related image URLs returned by the API in your Developer Apps (generally referred to as "hotlinking") in accordance with the API Guidelines. Additionally, each time there is a download of a Photo or other comparable event (e.g., setting a Photo as background wallpaper) in your Developer Apps, you must provide us notice of the event in accordance with the API Guidelines. Failure to do any of the foregoing in this Section 6 will constitute a material breach of these API Terms. You agree that Unsplash may track user views, downloads, and other interactions with Photos within your Developer Apps via the image URLs or other technological means agreed between you and Unsplash ("Photo Interaction Data"). Unsplash owns all Photo Interaction Data collected from use of your Developer Apps. Unsplash grants you a limited, non-exclusive, non-transferrable, royalty-free license to use Photo Interaction Data from each Developer App in connection with the operation and maintenance of that Developer App. You must not (a) transfer, sell, lease, license, sublicense, distribute, disclose, divulge, or make available the Photo Interaction Data (or any derived data or derivative product based on the Photo Interaction Data) to, or permit use of or access to the Photo Interaction Data (or any such derived data or derivative product) by, any person or entity other than your employees, (b) use the Photo Interaction Data to create, market, or distribute any product or service that is competitive with Unsplash's products or services, (c) contest, challenge, or otherwise make any claim or take any action adverse to Unsplash's ownership of, or interest in, the Photo Interaction Data, including the intellectual property rights therein, or (d) permit, procure, enable, or request any other person or entity to do any of the foregoing._

More stuff in there, including limitation of commercial use of the API etc.</comment>


The epidemiologist behind Sweden's controversial coronavirus strategy - <AUTHOR> https://www.nature.com/articles/d41586-020-01098-x <comment><USER2> Their approach seems to be achieving better than average results.

[https://ourworldindata.org/grapher/new-covid-deaths-per- mill...](https://ourworldindata.org/grapher/new-covid-deaths-per- million?tab=chart&time=2020-03-08..&country=BEL+FRA+DEU+ITA+ESP+SWE+GBR+USA)</comment>


Exascale Computing Project – 50 times computation power than DOE HPC systems - <AUTHOR> https://www.exascaleproject.org <comment><AUTHOR> The Exascale Computing Project is a collaborative effort of two U.S. Department of Energy organizations – the Office of Science (DOE-SC) and the National Nuclear Security Administration (NNSA).

U.S. Department of Energy (DOE) is planning to ask the US Congress for "between $3 billion and $4 billion over 10 years." This is "roughly the amount the agency is spending to build next-generation "exascale" supercomputers". China accounted for 60% of all investments in AI from 2013 to 2018. U.S. investments were about 30% of the global total. China dominates the number of AI publications, whereas the European Union has the most AI researchers, Joseph says. But U.S. researchers in AI get the most citations per paper, he says, suggesting their research has the most impact. [1]

[1] [https://www.unite.ai/u-s-department-of-energy-wants-to- accel...](https://www.unite.ai/u-s-department-of-energy-wants-to-accelerate- scientific-discoveries-with-ai/)</comment>


Want to learn about that beer in your hand? Send an SMS to learn more. - <AUTHOR> http://beertext.us/

<comment><USER2> I just tried it and it's pretty neat. How large is the database of beers?

Also, is it possible to do a character count on the message and insert page numbers on individual text messages? For instance, when I tried "Guinness", I received 9 text messages. I know there's no way to control in which order the recipient gets the messages, but sometimes there's a little bit of mental work scroll back & forth through various out-of-order texts and try to read them in the correct order. Something like (1/3), (2/3), (3/3). I realize that only adds to the payload, so maybe it should only be done for the really long ones?

Just my 2 cents. Very cool! I will definitely tell others about this.

<comment><USER3> It looks like they get the info from <http://www.brewerydb.com/developers>?

<comment><AUTHOR> yup. that's the case. it was our first time playing around w/ it. really nice api! i'd encourage you all to check it out ;)

</comment></comment></comment><comment><USER4> Not sure if you have this or not, but I think that a useful piece of information you could include is the number of calories. In fact, that alone would be a good service for any type of food.

Also, is there some sort of revenue generation happening here?

<comment><USER5> It's rare to find actual Calorie information for a beer (except mass-produced "light" beers).

You can estimate it at about 30 Calories (kcal) per % ABV in a 12 oz beer. About 40 for a 16 oz (american pint), 50 for an imperial pint.

Basically, yeast converts a fairly predictable percentage (70%-80%) of the sugars into alcohol, so the Calorie difference between two different styles at the same ABV will tend to be small because they'll both have similar amounts of residual non-fermented sugar. (well, sours will often have a lot less residual sugar and particularly strong beers are likely to have more, so those estimates get further off for those).

Some beers do print the Original Gravity or Plato, and given that and either the final gravity/plato or the ABV you could calculate the amount of residual sugar for a much more precise answer.

</comment></comment><comment><USER6> If you'd like to search for breweries instead of beers, the developers behind BreweryDB offer that service. To use it, send a zip code as a Jabber IM to firstname.lastname@example.com or as a text message to 919-701-BREW (2739)

The source is at <https://github.com/PintLabs/BreweryMap-Tropo>

(Disclaimer: I work for Voxeo)

</comment><comment><AUTHOR> hi everyone - myself and another dev built this at a Twilio hackathon over the weekend. would love to get some feedback/suggestions.

<comment> simba-hiiipower like the concept; but i just tried it out with a couple beers and no hits as of about 10mins later..

admittedly, i threw it some pretty difficult ones: eichhof (swiss), taybeh (palestinian), but I just tried heineken and still no luck.. any thoughts?

<comment><AUTHOR> sorry, we ran out of requests to the brewerydb api. just upgraded -- should be all set now! give it another whirl ;)

<comment> simba-hiiipower cool, so it's sort of working now, but sporadically (some requests go through, others seemingly don't).

however, of those that do, i'm experiencing a bit of a bug with foreign beers. if i enter the name of a lesser-known foreign beer with multiple variations i get a response requesting clarification/the specific type of that beer (as expected); but, it appears to be in the language of that country's beer..

for example i entered _erdinger_ (a german beer) and got the response: _privatbraueri erdinger weissbr?u, erdinger weizen,_ (that's the exact text, i think it was also cut-off for some reason). when i replied _erdinger weizen_ i got a full reply with name/description/ABV in english.

tried the same with a belgian beer and it happened with that one as well.

<comment><AUTHOR> very interesting--appreciate the info. we're aggregating all of this feedback and will update asap. when you're not receiving responses, most of the time it's b/c the db doesn't have the beer (and we're doing a really poor job of handling this at the moment). don't worry though, we'll get it right soon. thanks again!

</comment></comment></comment></comment></comment><comment><USER7> Jack D'or got me over 40 text messages. A bit of overkill I'd say.

<comment><USER2> 40? Wow - I thought the one for Guinness was rather excessive at 9. They may wanna cull it some, or allow keywords to be added that can just get specific information(i.e. +ABV) or whatever.

<comment> simba-hiiipower yeah, it would be ideal if it could send just some of the highlights (beer type, abv, brewery, country of origin, year first brewed) formatted in just one text.

maybe adding an alternate command, something like "<beer name> details", for the full description instead would be nice

<comment><AUTHOR> thanks everyone, i totally agree. i wish we could use a db for the app that limited the length of descriptions. right now we're using brewerydb, and i agree, some of the descriptions are excessive as you mention

</comment></comment></comment></comment><comment><USER8> Doesn't work internationally (UK) it seems.

</comment><comment><USER9> didn't work for 2 beers i tried: <http://imgur.com/GTMoG>

<comment><AUTHOR> it doesn't look like drakes heffe is in the db unfortunately. concerning pacifico, it's in the db but it's not populated with any data. <http://www.brewerydb.com/beer/xfQQiO>

thanks for sharing this!</comment></comment>


Ask HN: Is there a remote desktop program as good (and cheap) as Dropbox? - <AUTHOR>

I know there are dozens of remote desktop apps. I've used many of them including GoToMeeting, VNC, etc. It's been a while but I can't find any that seems super great. They all seem to be complicated or sucky.
Is there any cross-platform, cheap, secure, trusthworthy Dropbox-like program that does remote desktop?
I want to just install a tiny little program on all my computers and very quickly be able to see the desktop of any of them from any of them.
I imagine a little taskbar icon that I click and there's a list of all available computers. I select one and it opens a window with the desktop visible.
My primary machine is Linux (Ubuntu), but I have Windows and Mac computers as well.
If this doesn't exist I would definitely use and promote the hell out of it. I'd even be willing to pay some smallish yearly fee for it. If it doesn't exist I highly suggest someone on HN get to work making it.
The remote desktop industry seems to be very similar to remote storage was pre-Dropbox.
Then again, I'm hoping I'm wrong and this already exists, so I don't have to wait :-) <comment><USER2> Have you looked at <http://www.logmein.com>? They have a free version, and it's a solid in-browser remote desktop program that just runs a small background program on any computer you want to connect to. Only issue is I'm not sure they have support for Linux... could be a deal-breaker for you.

<comment><AUTHOR> It seems the closest, but it reminds me of the predecessors to Dropbox a lot. I couldn't even figure out which of their 7 products I should choose.

<comment><USER3> Start off the with free version. When you need another feature, see what the lowest tier is that has your desired features, get that. Repeat as needed.

</comment></comment></comment><comment><USER4> Are you a developer?

Most of the pieces exist as open source (assuming VNC is good enough for you), wrapping a nice GUI around them using something like wxPython might not be to hard.

It's an interesting idea for sure. I've been fiddling around with tunneling VNC over PageKite (my project) a bit, but it hadn't yet resulted in anything I'd call a "product vision". This post brings me quite a few steps closer to that. Too bad my TODO list is already rather long...

If you are interested and able to do some coding, I could probably be talked into helping out and providing some infrastructure. ;-)

<comment><AUTHOR> I am. I have my own startup to worry about though!

It's very tempting because I think it's the kind of thing that could see Dropbox-like success and there is a bunch of open source code to borrow from.

</comment></comment><comment><USER5> I'm confused. Dropbox does file-sharing, not remote desktop. Also, your requirements seem to want your computers to not be synced, hoever Dropbox syncs across all clients - so differentiating between computers (e.g. "a list of all available computers") is not necessary.

Unfortunately I do not know of any out of the box solutions. You could setup samba shares on each computer and if you want to access them anywhere then proxy through Amazon. Otheriwse, I'm hoping this might help you better phrase your request.

<comment><AUTHOR> I just mean the simplicity and quality of Dropbox, not synchronizing anything.

</comment></comment><comment><USER6> Have you seen <https://www.copilot.com/>? Looks pretty close to what you want.

<comment><AUTHOR> Yeah. That's more of a transactional style help desk tool.

</comment></comment><comment><USER7> GBridge is pretty decent if you use windows <http://www.gbridge.com/>

</comment><comment><USER8> <http://teamviewer.com> You don't even need to install it to run.

</comment><comment><USER9> Teamviewer is another nice remote desktop tool that has a bunch of neat features. It is also... free.

</comment><comment><USER10> I like jump desktop for my iOSneeds</comment>


Russian Wikipedia Goes on Strike Over Censorship Plans - <AUTHOR> http://en.ria.ru/society/20120710/174509543.html

<comment><USER2> I hope the Russian editors don't end up in prison, or worse; that seems to be a not-uncommon fate of those who dare publicly oppose the government.

<comment><USER3> It's Putin, I expect they may just disappear sometime soon.

</comment></comment><comment><USER4> I don't believe this will matter. United Russia, pocket party of the current government & president, has all the power to approve or reject any proposed bill. Unfortunately, no amount of public opinion has any effect on them.

<comment><USER5> Public opinion has effect. It's just that government-controlled media would otherwise not report such controversial laws being considered. I sincerely thank Wikipedia for bringing public attention to this issue. Now twitter is trending with #RuWikiBlackout and all major Russian news channels are reporting the blackout.

<comment><USER6> Come on. The media _will_ report about this law and the vast majority of the population will be thankful for the government cracking down on child pornographers.

Never underestimate the bullshit absorption rate of the general population.

</comment></comment></comment><comment><USER7> The legislation is aimed at fighting child abuse/porn websites, drug use promotion, and similar content. (it never states to block copyrighted content nor can be used to block opposition presence in the internet media). Please read the actual document before discussing it.

The opposing factions overreacted and tried to distort the point of legislation by comparing it to the Great Chinese Firewall (there will be no centralized infrastructure to control all traffic flow).

This is the same kind of "censorship" used in western countries to block TPB and others, yet it deals with really criminal and abusive content.

<comment><USER7> Also, Wikipedia was blocked without any notice in advance. It was an initiative of Russian administrators with voting taking place on July, 9-th. Vote quickly passed and Wikipedia was blocked on the next day (10-th).

It is an organized attempt to use Wikipedia as a tool for opposition's political means, not a people's fight for freedom.

<comment><USER7> Exactly this. But Russian admins do not own Wikipedia and abused their power to pursue their own goals.

<comment><USER7> Like I said, they did not give people time to vote, nor did they provide any notice of the planned actions beforehand.

<comment><USER8> Why do you keep replying to yourself?

<comment><USER7> Sorry. For some reason, the reply link was unavailable on come comments. (workaround is to use "link" and open single comment with a reply field)

see <http://imgur.com/yYOBm>

<comment><USER9> It's not bug, it's a feature. Replying is only possible a few minutes after the comment was posted, to prevent discussion going out of hand.

Besides I don't understand what wikipedia did wrong.

<comment><USER7> Ah, thanks, the delay does not seem to be explained anywhere.

About Wikipedia. Do you still remember the SOPA blackout day? Everybody was warned about upcoming blackout a few weeks beforehand, and most importantly, pretty much everyone supported the blackout, thus reaching the consensus. <http://en.wikipedia.org/wiki/Wikipedia:Consensus>

Today, Russian Wiki is closed. The decision was taken yesterday by a bunch of admins, who started a poll, without any warning and without anyone prepared. It is a violation of consensus rules as described in the link above: "Consensus ... nor is it the result of a vote."

Admins' actions today are a blatant violation of these rules by Coordinated actions, Meatpuppetry and are biased in general: <http://en.wikipedia.org/wiki/Wikipedia:False_consensus></comment></comment></comment></comment></comment></comment></comment></comment>


Building an RFID Proximity Card Cloner for $30 - <AUTHOR> http://proxclone.com/reader_cloner.html

<comment><USER2> This is why Richard Stallman recommends that you wrap your RFID card in aluminum foil.

[http://slashdot.org/articles/05/11/19/149242.shtml?tid=133&#...</a>

<comment><USER3> Hmmm, how effective is aluminum foil in blocking the RFID? Despite having "RF" in the name, the signal is primarily magnetic induction.

One google hit says "helps a lot, but doesn't prevent": <http://www.omniscienceisbliss.org/rfid.html> Note that the picture of the reader and the unshielded read distance (18") indications it is the long distance version.

I'll have to experiment at work tomorrow. ;-)

<comment><USER4> Electromagnetic signals are attenuated exponentially in metals with a frequency dependent decay constant called the skin depth. The formula is given in this wikipedia page :

<http://en.wikipedia.org/wiki/Skin_depth>

If you know what frequency RFID uses and the thickness of the foil you can easily calculate how much attenuation you'd get.

<comment><USER3> 125KHz => 0.024mm skin depth

Looks like typical aluminum foil is thicker than that. The box in our kitchen doesn't say how thick it is, but the Wikipedia page indicates it is likely thicker than 0.025mm since it needs to be thicker than that to be impermeable to oxygen and water.

Ref: <http://en.wikipedia.org/wiki/Aluminium_foil#Properties>

<comment><USER4> Hmm, one of us is off by an order of magnitude, I get 0.24 mm.

For Al foil thickness I'm seeing conflicting numbers from 0.2 to 1.1 mm. If my cheap digital micrometer hadn't died I'd measure some.

If my skin depth is right then the attentuation probably won't be complete, if yours is then it might nearly be. Of course that's only the case if the receiver and/or transmitter is completely wrapped. Although at low frequencies like that you could probably tolerate quite a large gap.

<comment><USER3> You are right, 0.24mm. I did the m->mm conversion in my head (d'oh).

My cheap digital micrometer only has two digits of precision in mm mode. Measuring my cheap (not "heavy duty") aluminum foil is at the limits of its resolution, 0.01mm.

<comment><USER4> I folded a sheet of heavy duty foil into 16 sheets and tried to measure the thickness and it was still << 1mm, so I think your estimate of about 0.01mm is reasonable.

In that case I would predict that a single sheet would have little affect on an RFID device operating at 125kHz. Note however that RFID devices appear to span a very large frequency range :

<http://www.rfid-handbook.de/rfid/frequencies.html>

and the foil would certainly block the higher frequency devices.

<comment><USER3> Experimental evidence, sample size of 1: a single layer of ordinary aluminum foil completely enclosing the card prevents a "normal distance" (4" square) reader from reading my card.

<comment><USER4> Are you sure it's a 125 kHz device ? Maxwell has never failed me before.

<comment><USER3> No, I'm not sure, but it does physically match the cards and readers in the article.

With no foil, the badge is read at 3-4".

With a single slice of foil ~18"x12" held in front of the sensor, the badge is read at ~1" (a noticeable reduction in signal).

With the foil folded in half and the badge in the fold so that it forms a single layer on both sides of the card, it was effective (could not read the badge).

With the badge in an aluminumized mylar antistatic bag, there was no evidence of a signal reduction (read at full distance).

I would theorize that Maxwell hasn't failed us, but the signal is weak enough that the foil attenuated the signal sufficiently to disrupt reading. The RFID reader works by modulating the sensor tuned loop by detuning on/off, which is going to be a pretty weak signal.

<comment><USER4> The read range you're seeing also seems compatible with a low frequency device.

I'm quite perplexed. I don't think the foil could be attenuating the signal directly. It might be reflecting it/altering the field pattern so as to reduce the effective gain between the transmitter and receiver antennas.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Great, but where can I buy one now? My apartment compex issues only one single bulky RFID+garage opener that I hate carrying in my keychain.

<comment><USER6> I think dealextreme.com had a few a while back. Yeah:

<http://www.dealextreme.com/details.dx/sku.17230>

$66

</comment></comment><comment><USER7> Do RFID tags have anything to prevent a replay attack or is owning a bit for bit copy of an RFID tag the same as owning the original?

<comment><USER8> Regarding 'contactless smart cards' which use a similar radio protocol to RFID:

One example being MIFARE used in the London underground, where they found a vulnerability in the encryption algorithm being used on the card (the cards are 'intelligent' in that they have a processor on board to perform the cryptography etc.). Once you can break the encryption, you can then set about making a clone.

With contactless bank cards, (which in the UK you can use to pay for the M6 toll), you could imagine people electronically picking your pocket, by relaying the signal from a transceiver near a cash point over RF to another transceiver which communicates with the card in your pocket. (hopefully they use distance bounding protocols to prevent this!)

Karsten Nohl (<http://www.cs.virginia.edu/~kn5f/>) has some fascinating papers on how they broke Crypto1 (the algorithm used by MIFARE). They took photos of the chip in the card using an optical microscope, after dissolving the card in acetone (They had to sand off each layer of the chip to get to the next)

They then applied image recognition to identify logic gates from their constituent transistors. And then looked for XOR gates, as they mention they're rarely used for anything other than crypto on this type of chip. Once they had found the area of the chip involved in cryptography, they converted the logic gates into the actual algorithm used, and then picked apart weaknesses with it.

<comment><USER9> Remarkable! Thank you for sharing this.

<comment><USER10> [http://media.ccc.de/browse/congress/2007/24c3-2378-en- mifare...](http://media.ccc.de/browse/congress/2007/24c3-2378-en- mifare_security.html)

[http://media.ccc.de/browse/congress/2008/25c3-3032-en- analyz...](http://media.ccc.de/browse/congress/2008/25c3-3032-en- analyzing_rfid_security.html)

Nowadays he is busy cracking and hacking GSM. Remarkable person.</comment></comment></comment></comment>


MobX – Simple, scalable state management for React - <AUTHOR> https://mobxjs.github.io/mobx/index.html <comment><USER2> I wrote a very large app in Knockout back in the day, and ran into significant problems with Knockout's computeds and the two way data binding.

It was great to start with, but as the app got larger and more involved, performance started to suffer (from all the different observables and computed triggering and retrigger on a change), memory leaks started to creep in, and eventually I started noticing weird glitches where bits of the UI wouldn't by entirely in-sync. Worse, there was very little I could do to fix it, because the bug was deep in Knockout's "magic". My models had correct data, but sometimes my UI would _not_.

The lesson I picked up from that was that that sort of magic was bad news, and for my next major project I used React, and when I needed state management I eventually ended up with Redux. I won't lie: There's been some pain points, there's a lot less hand holding, more boilerplate, etc. But performance has been amazing and there's been no issues where something other than my poor coding has caused a bug. Redux code is very, very deterministic: You state looks like X, then you have an event Y, and now your state looks like Z. That state is fed into your component hierarchy, and DOM elements come out the end. If you don't like the result, you can quickly narrow it down to being a bug in your render methods, your reducers, or your actions. No magic.

MobX...looks great. But it looks great in the specific ways that Knockout burned me in the past. Does anyone have any input on that? If I go all-in on Redux and write a very large and interconnected app, I have confidence that:

1) Writing all the reducers and selectors will be pretty big pain

2) Once I do it it'll work just as smoothly as a hello world app will.

If I go all in on MobX, it looks like it'll be easier to write, but...how's it going to run? Saying "inspired by Knockout" gives me distinctly mixed feelings, seeing as how I started using React to get _away_ from Knockout. :)

<comment><USER3> The _idea_ is very much like knockout and meteor, but the reactivity implementation is completely different. First all it is generic and not designed for just the UI. MobX is completely glitch free and synchronous and has explicit distinction between computed values and reactions (side effects like updating the DOM). More important, MobX determines the right execution other of derivations on the fly, preventing issues with 'double runs' which were a common issue in for example Meteor. These design decision are based on research of common issues with knockout and meteor (like the ones you described) and analyzing what is the root cause of these issues. For that reason you also won't find two way binding in MobX

In practice it turns out to work very well for large apps and many people use it that way ([https://twitter.com/_ericelliott/status/766812933804269568](https://twitter.com/_ericelliott/status/766812933804269568))

<comment><USER4> > MobX is completely glitch free

MobX looks interesting but I am a little concerned that you are claiming it is bug-free.

<comment><USER5> I don't believe he meant glitch in the sense of bugs but rather in FRP terms. I.e. temporarily inconsistent state.

<comment><USER3> yep that was the glitch I was referring to indeed :)

</comment></comment></comment></comment></comment><comment><USER6> Mobx is a blessing ! I work on React only since a few months, I have a ton of subjects to learn, a ton of libraries to learn to how to use them. I really don't have time to learn a complex library like Redux. I tried, and learned its principles, but I soon saw that it would totally transform my existent codebase into a large cream cake with some boilerplate code everywhere. I come from Java world, which is often mocked (especially by the JS community ...) for its abstract-factory-factory, but Redux is not irreproachable for that ! Compared to Redux, MobX is a breath of air. It's very simple, very efficient, and contrary to Redux, not opiniated. It's easy to integrate it in an existing app. At the beginning, I only used MobX in a complex part of my app. I added a store, some instructions, and voilà. Then I added it everywhere, part by part, incrementally. Everything works, my code is simple, anybody, even a beginner, can understand it. MobX seems to be directly integrated in React.js, linked to the React core.

<comment><USER7> I haven't used Moxb but I've used Redux a lot the last 6 months, building mobile apps and also a rewrite of our frontend at Typeform.

I'm not sure how Redux could be considered complex, the API is very small and the ideas are small as well. There is really not much to learn with Redux. Redux is like literally 100 lines of code if you remove comments and simple sanity checks.

Also, not sure what you mean with boilerplate? What kind of boilerplate do you have when using Redux? Would love to see an example of that.

<comment><USER8> Redux isn't conceptually complex, but I found it hard to get started with. The trouble I had wasn't the ideas, which are very clear, but in trying to predict which parts (composing reducers, passing state to components) would be animated by Javascript magic, and which were plain-ol-Javascript.

I found myself straining a little to memorize code snippets to get things started.

Once up and running, it's a breeze, though of course I agree with the common sentiment that it's too easy to overuse, and native React state too easy to underuse.

<comment><USER9> It gets really hairy when you have to weave in asynchronous actions and things like react-thunk or react-saga. By the time you've wrapped your head around those concepts as well the whole React stack doesn't feel quite as much like the breath of fresh air it does when you first start using it.

For my next Resct project I intend to go as far as I can with simple container components before I start pulling in the whole Redux toolkit.

<comment><USER10> This is why Ryan Florence (react-router, React Training) just made his keynote speech at the React Rally conference about people overusing Redux and not learning or wanting to use plain old React.

In his trainings he constantly sees people trying to rush React and asking him about Redux (which he doesn't cover).

<comment><USER8> This is also a drum that Dan Abramov (who created Redux) has been beating.

</comment></comment></comment></comment></comment></comment><comment><USER3> Online courses: Introductoin by LearnCode.academy: [https://www.youtube.com/watch?v=_q50BXqkAfI](https://www.youtube.com/watch?v=_q50BXqkAfI)

More in depth: [https://egghead.io/courses/manage-complex-state-in-react- app...](https://egghead.io/courses/manage-complex-state-in-react-apps-with- mobx)

<comment><USER11> Adding some more:

Refactor a Redux Application to use MobX [http://www.robinwieruch.de/mobx- react/](http://www.robinwieruch.de/mobx-react/)

Large MobX React Application [https://github.com/rwieruch/favesound- mobx](https://github.com/rwieruch/favesound-mobx)

</comment></comment><comment><USER12> I've been using this recently for a pretty complex SPA and it's been great.

It's clear what's happening, without a tons of boilerplate code, and it has some nice dev tools as well (trace element updates & events, great for debugging). It also has very useful error messages in development mode (which is a godsend).

On top of that, I think the docs are pretty good, they seem to be quite active on GitHub and, from every piece of the puzzle that comes together to make a 2016 web frontend (react, web pack, babel, flow, ui kit, etc, etc), it's given the least trouble for me so far.

</comment><comment><USER13> I was able to rebuild a week's worth of Redux work in MobX within a day. And that's having never used it before.

What's crazy is how MobX is able to update React child components without updating the parent first. It knows which properties are accessed in each component, and ensures only the ones that rely on the changed data are updated.

I'd say give it a shot the next time you have a component with internal state. Not having to worry about the reducer or how the component gets updated is refreshing.

<comment><USER14> > It knows which properties are accessed in each component, and ensures only > the ones that rely on the changed data are updated.

This is what blew me away. I understood that "computed" values were doing this, but when I saw that the react components were using it as well, I was sold. I have been in componentWillReceiveProps with redux too much, trying to improve rendering performance. With mobx, out of the box, you get 100% exact render updating.</comment></comment>


Mechanical Movement - <AUTHOR> http://pie.exploratorium.edu/scrapbook/mechanisms/

<comment><USER2> Off-topic: how did this organization get a .edu domain name? Are those no longer restricted to degree-granting institutions?

<comment><USER3> > Off-topic: how did this organization get a .edu domain name? Are those no > longer restricted to degree-granting institutions?

Your "no longer" suggestion has the time wrong. The restriction (originally to four-year degree-granting institutions) wasn't instituted until 1993 and wasn't really enforced until sometime thereafter (and the exact parameters have changed several times since) and continuously registered pre-existing domains were grandfathered. The Exploratorium has had a .edu domain since sometime in the early 1990s.</comment></comment>


Creativity Requires Isolation: Err, No - oscar-the-horse http://www.horsesaysinternet.com/creativity/creativity-requires-isolation-err-no/

<comment><AUTHOR> From TFA: "As preconditions to be creative, one should know something well while having the utmost focus on it."

You are addressing the "know something well" part. The original article addresses the "utmost focus" part. Both are necessary. Neither is sufficient.

<comment> oscar-the-horse focus is required for execution. inspiration is required for creativity.</comment></comment>


I Remove Google Analytics and Use AWStats - <AUTHOR> https://kevinhq.com/things-that-forced-me-to-leave-ga-for-awstats/ <comment><USER2> Why don't you use custom server side analytics? I wrote mine in like less than a day.</comment>


Worshipping My White iPhone - <AUTHOR> http://founderama.com/2011/worshipping-my-white-iphone/

<comment><USER2> your video is marked private, can't view it</comment>


The US needs to retire daylight savings and just have 2 time zones 1 hour apart - <AUTHOR> http://qz.com/142199/the-us-needs-to-retire-daylight-savings-and-just-have-two-time-zones-one-hour-apart <comment><USER2> Apparently this person doesn't understand that we can't just get rid of time zones..... The reason we have time zones is purely based on the rotation of the earth and its size.</comment>


Trillian for Mac Os X Bye Adium? - <AUTHOR> http://www.trillian.im/learn/tour-mac.html

<comment><USER2> I actually bought trillian, because i like the cross-plattform approach.

I only wished they'd have a Linux client too, since i use their windows, android and web versions, but also use linux a lot.

edit:

One thing i like about trillian astra is that it can send you a mail of missed conversations if your mobile is offline.

</comment><comment><AUTHOR> It may actually also replace Tweetie if they work a bit on their Twitter interface. This would be the greatest "social web client" to date on my Mac!</comment>


Ask HN: Programming books for teaching beginners - <AUTHOR> I will be teaching some programming to an absolute beginner and am wondering what HN thinks is a good book for absolute beginners. So please share your thoughts.
I'm considering starting with 'Learn Pyhton the Hard Way'.
Some background:
She has some experience maintaining and setting up WordPress websites but I would say it is fairly limited.
I'm looking to teach fundamentals more than making her ready for a job although that would be welcome in the long run. So, gaining some understanding or being able to pivot to PHP and/or JavaScript is never a bad thing in this job market (Amsterdam). <comment><USER2> How old? What sort of things does this person want to program?

<comment><AUTHOR> 29 years old. We don't have a goal yet so I'm sticking to fundamentals.

She has a degree in Communications so something web-related might be interesting.

</comment></comment><comment><USER3> Maybe teach her how to make a Wordpress plugin? It'd slot in with what she already knows and she'd see immediate benefit as well as a real life application of her code.

Learn Python the hard way is a great idea too though, I got my friend started with the Ruby one and she really took to it. Another good one for Python is [http://automatetheboringstuff.com/](http://automatetheboringstuff.com/)

Something to watch out for though is a lot of books are hopelessly out of date, code moves so fast that all the code examples in a book even just a couple of months old will be broken. Trivial for experienced people to workaround but typically if you're reading the book to learn you won't be able to figure it out.</comment>


Ask HN: What sort of traffic can you expect from the HN front page - <AUTHOR> Hi all, I'm about to submit one of my apps to HN to get a bit of feedback. In the unlikely event that it reaches the front page, I'd like to get an estimate of what sort of traffic I might expect. Basically, I just want to ensure that my servers can handle it, hopefully with a bit of room to spare! Anyone have any data/estimates they're  willing to share (even anecdata will do!)? Thanks very much! <comment><USER2> See [https://news.ycombinator.com/item?id=8107658](https://news.ycombinator.com/item?id=8107658)

The results given there are close to what I remember.

<comment><AUTHOR> Thank you - that's pretty comprehensive.

</comment></comment><comment><USER3> In the past there was this post about exactly this topic - [http://martin.majlis.cz/what-happened-when-my-project-got- on...](http://martin.majlis.cz/what-happened-when-my-project-got-on-top-of- hacker-news/) \- with some analysis.

</comment><comment><USER4> The other comments in this thread are pretty accurate in my experience. Depends on the day and time of day also. On weekends and evenings after ~5 PM PST the traffic is lower but still 500+ concurrent visitors.

</comment><comment><USER5> Love your confidence, I'll be looking out for your launch.

<comment><AUTHOR> Thanks! Will probably be ready by Thursday/Friday

</comment></comment><comment><USER6> Maxxed out at 1000 concurrent visitors according to Google Analytics, so undercounting people with ad blockers.

<comment><AUTHOR> Ah great, that's good to know. Do you think doubling that would be a realistic estimate?

<comment><USER6> Hard to say. Probably depends on position? Better approach might just be making sure CDN does all the heavy lifting, and then it doesn't matter.

</comment></comment></comment><comment><USER7> our experience was about 5-6k users when hitting the front page. it really depends on how many people upvote your posts. good luck!</comment>


Ask YC: Google Code or Sourceforge - <AUTHOR>

I'm starting a new project (GPL apache module)... What do you prefer Google Code or SF.net... reasons? <comment><USER2> neither github <http://github.com>

main reason. It uses git. Another benefit of github is you can pay for accounts that are private, so if you wanted to host proprietary code. Or things that aren't so much proprietary as personally private (backups).

also google isn't supportive of AGPL, I like the AGPL so I can't support them on this one.

if you want subversion you should go with sourceforge.

I'm not sure which vcs system google uses. (on google code; they use perforce internally)

There is also Launchpad for bazaar (bzr) repositories

Honestly just pick the one one with the vcs you want to use.

EDIT: I've rewritten this like 3 times :P sorry. Should read right now.

<comment><USER3> github seems nice. I'd also like to point out savannah (<http://savannah.gnu.org/>), which is particularly nice if you intend to use GPL. Also, it's good for leting you know how to properly handle your licenses when you apply for a project.

It uses cvs, svn and git.

</comment></comment><comment><USER4> Google code.

SF.net, while trying to make improvements, is hobbled with an old design. Google code is much better. And both use subversion.

Interesting choice to GPL an Apache module, though.

</comment><comment><USER5> I used SF in the past (prior to their svn adoption) and it was slow, lots of forms to fill for a setup, and the process to deliver the downloads was cumbersome.

Google Code requires a free Google Account and a simple form. If you can live with svn, you'll find that its features are simple yet powerful (wiki, downloads page, svn browser, issues tracker). Another thing i like is that you can give admin/commit access to other Google accounts easily.

Launchpad is also a good alternative if your code is under a free license. You'll have the features of bzr, issues tracker and others, and if you're packing for Debian/Ubuntu, you can use Launchpad PPA to build your packages for 32 and 64 bit architectures for free.

</comment><comment><AUTHOR> xenoterracide: no worries, it was a very helpful reply as I hadn't actually considered launchpad (I always thought of it as an Ubuntu specific project, but clearly I was wrong)

I'm already familiar with SVN, so the lazy me would want to go with that -- but I've been meaning to learn git for sometime, and github might be the way to go.

<comment><USER2> I thought the basics of git were easy. But I haven't had to play with others yet.

<http://git.or.cz/gitwiki/QuickStart>

<http://git.or.cz/course/svn.html> (for svn users)

one thing I just noticed... github offers a wiki for your project but no bug tracker (that I'm aware of) :( I filed a bug with them on it.

and if launchpad offers git support it might be the way to go if you'll need a bug tracker soon. (if you won't I'm sure they'll fix that).

<comment><AUTHOR> I'm sure GitHub will add a bug tracking system, and in the meantime a simple Wiki is a workable solution for bug-tracking.

If it works for Wikia it can work for me too.

<comment><USER6> Actually, they interface somehow with Lighthouse, a separate service, for bugs. <http://www.lighthouseapp.com/>

<comment><USER7> Beat me to it.

Although I discovered recently that someone had written a Trac backend plugin for Git, which rules. Trac kicks the living shit out of every other issue tracker I have ever seen. You should look into Trac and/or Trac integration regardless of what VCS you us; all useful VC/SCM systems appear to be supported nowadays (alas, no Visual SourceSafe)

<http://trac.edgewall.org/>

Trac kicks so much ass. Moving to Trac legitimately made my hobby site real amounts of money because people entrusted us with more goodwill as a result of our quicker responses and better communication under Trac.

OOOH LOOKY HERE! A trac-lighthouse comparison:

[http://warpspire.com/tipsresources/web- publishing/lighthouse...](http://warpspire.com/tipsresources/web- publishing/lighthouse-the-bug-tracker-youve-been-looking-for/)

AND someone produced a Trac-Lighthouse mirroring tool (not unlike the very useful git-svn SVN-Git mirroring tools):

<http://github.com/shayarnett/trachouse/tree/master>

This is just too awesome. Maybe GitHub is truly The Way. I haven't been involved with a Big Project on GitHub yet, only Google Code, so take the following with a metric fuckload of NaCl please.

My experience with Google Code has been closest (in terms of communication and transparency) to that of running my own Trac installation. I assume they're converging towards Trac simply because it's the lowest-effort option at a Python shop with an SVN-centric offering.

Github is neat but I have begun to wonder if Git and its toolchain isn't a little discouraging for new/dabbling developers on a germinal project. I use both, although I'm beginning to drift away to Git for new work. Then again, I've been using Unix toolchains for 14 years now. I'm the target demographic for Git.

Oh, fuck it. This post has just become a catalog of useful links and migration tools for me. If it helps you too, so be it, but writing this much means I have to help myself :-)

<comment><USER2> trac sucks. Why? It's obviously a pita to configure. Because I've never seen a trac setup work right the first time. Most of the time I either can't create an account to file bugs, or I can't create bugs even though I've filed them. I've never seen trac set up right the first time.

Bugzilla must be better as it generally works.

Lighthouse is confusing ( can't figure out what project I'm filing for. If I file for the wrong one it can't be changed, and where is the search again?)

Mantis is supposedly good. Never needed to use a mantis setup though.

<comment><USER7> _Bugzilla must be better as it generally works._

 _Mantis is supposedly good._

I can't even explain to you how hard these two suck.

If you think Trac is a PITA, try either of the above. I have. There's a reason Trac was written.

Follow the docs and it works right. People who don't follow the instructions manage to fuck it up, but what else is new?

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> sf.net has a lot of people migrating away because it can be extremely slow, the tracker interface isnt up to scratch, and its quite unreliable (they recently reset everyones password in the middle of an inkscape launch)

launchpad seems to be the best tracker around, but if you dont use bzr, or git, I would possibly just put your code on google code and use launchpad for everything else

<comment><USER5> You're right, you can have your code in svn on Google Code, and setup the project on Launchpad, so the code is automagically imported into a Bzr branch.

I've got a Bzr branch ([https://code.launchpad.net/~vcs- imports/gtkfilesplitter/trun...](https://code.launchpad.net/~vcs- imports/gtkfilesplitter/trunk)) imported from (<http://gtkfilesplitter.googlecode.com/svn/>)

<comment><AUTHOR> Is that automatic, and is it easy to setup? Or do you have to create/import the branch manually?

</comment></comment></comment><comment><USER9> You can put your code wherever you like but please put your mailing list on Google Groups. Finding stuff in Google Groups is SO much easier then SF.

That may swing your decision.

</comment><comment><USER10> github seems pretty cool so far,

BUT I don't like that their webpage is kind of sluggish, or that they delegate issue tracking out to a pay service (lighthouse)

in a related note, committing/branching all the time locally and then just doing "git push origin" when I feel like pushing all those changes to github is AMAZING. it really changes the way you deal with rapidly changing code. I'm just learning git but the nerdhype seems strongly justified with this one :)

</comment><comment><USER11> anything but sourceforge</comment>


Academic Ranking of World Universities in Computer Science - 2012 - <AUTHOR> http://www.shanghairanking.com/SubjectCS2012.html

<comment><USER2> With this methodology I think there is significant weight going for departments with long running courses. Whilst it's likely that departments with a good history will be good now I think there should be more historical weighting for data points.</comment>


The Non-Technical Myth - <AUTHOR> http://realandysparks.com/post/27721098390/the-non-technical-myth

<comment><USER2> I'd love to hear what other people have to say about this and another title (other than hustler) that could describe a non-technical...</comment>


Study: 18x difference in pageviews between client-side and server-side analytics - <AUTHOR> https://plausible.io/blog/server-log-analysis <comment><USER2> All those plausible articles could actually be great if they were not written for SEO first. They are very long, repeat the same keywords over and over and are very hard to read.

For example, even the TL;DR is long:

"The main benefits of server-side analytics are that they have no impact on your page speed and the fact that adblockers cannot block server logs. But are these advantages worth the side effects? With server log analysis, it is harder to filter out robots, crawlers, spiders and other non-visitors. And there is a lot of automated bot traffic on the internet. Let's take a deeper look at the server logs vs JavaScript-based web analytics."

Which could be summed up as (without repeating "server analytics" in 3 different variations): "Server-side analytics have no impact on your page speed and are not blocked by adblockers, but it's harder to differentiate real users from bots compared to client-side analytics.".

Maybe it's just my opinion but I can't really read any of those articles, as they are way too fluffy. They just seem to be created following the Neil Patel SEO guides or something similar.</comment>


Ask HN: Securely store sensitive data in the DB? - <AUTHOR> I am designing an information system and one of the requirements is to keep sensitive data encrypted in the database, with a possible intruder being unable to decrypt them. Encrypting everything in the application with a key and then storing to the database is unacceptable, since all it does is add a little difficulty for an intruder -once he gets the key he gets the data too.
Passwords are kept hashed, so the password provided in the login gets hashed and if it matches the stored hashed password the user is authenticated, otherwise not. The password is not stored in cleartext and cannot be retrieved, but of course can be reset if the user forgets it. So far so good but what happens with other sensitive data that I need store, as API keys, cc data etc? These cannot be encrypted with the user password, because if the user forgets the password these become useless.
What are some best practises to keep sensitive data encrypted on the database, and reassuring that after a system break-in the attackers won't be able to get the data unencrypted?  I want to design and implement a solution as secure as it can be and would like to hear thoughts, ideas and experience by other startups and engineers. I have not found anything really useful in this direction, apart from references to proprietary solutions that promise to do anything on some magical way (no comments!) <comment><USER4> Any system which allows you to locally decrypt information, for the purpose of doing anything for the user, should be assumed to allow an attacker who roots the box to locally decrypt information. That's the unfortunate harsh technical reality.

If you have compliance reasons motivating this need for encryption, you'll find that e.g. HIPAA and PCI-DSS ignore technical reality, in favor of requiring that you encrypt information stored at rest and imposing substantial penalties on you if it leaks. There are a variety of ways to do this. One fairly common one for HIPAA-compliant applications is putting the e.g. MySQL data files on a partition which is block-level encrypted. You then issue decryption keys to folks who need them, such as e.g. the application.

If your host is totally compromised, the host holds both the decryption key and the ciphertext, which means "Sucks to be you." However, this does provide non-zero increase in security (e.g. if an old copy of the DB drive ends up floating off to eBay because of poor physical control on your part, and you can document that it doesn't include the encryption key, you just avoided a reportable information breach), and it does check the appropriate boxes on e.g. HIPAA.

<comment><USER5> To expand on this a bit, absolute security for encryption just doesn't exist. If you wanted your data 100% secure, put it in a database, disconnect the DB from your network, put it in a locked room, guarded by biometric locks and security guards. Even in that scenario, the data is vulnerable, but why even bother discussing that point, as the data is worthless if you can't access it.

With that reality in mind, I was responsible for PCI for a large part of the infrastructure at a Level 1 Merchant, meaning a yearly audit had to be passed. Ultimately, our solutions boiled down to restricting access to an external (read different machine/network segment), firewalled host that did the decryption. In some cases this was an appliance that was purchased (this helps with compliance, but they're expensive, and they're a nightmare if they become a performance bottleneck as they're a black box you know little about). In other cases we used a web service we built that worked similarly (auditors will pick this apart because it isn't a "standard" solution).

In all cases here is a high level of how they work: encrypted data is passed to the service, which pulls the encryption key out of memory, decrypts the data, and sends it back to the requesting host. The encryption key is stored in (at least) two pieces, each piece is encrypted with a key encrypting key, key encrypting keys are know to very few employees, no single employee holds both key encrypting keys. The encryption keys is only assembled in its entirety while in memory.

Again, there are problems to this, as patio11 intimates, compliance includes much theater a times, but this is reality, and it does provide benefit over other solution, in this case, at least three layers of security must be compromised before you could decrypt everything.

<comment><USER6> I'm in ecommerce as well and I've seen PCI/DSS auditors require vendors/hosts to rearchitect using an encryption/key management appliance. You wrote you built your own solution - are there no known, trusted open source alternatives? As you mention, the appliances are almost astronomically priced, so it seems like an area OSS (or a disruptive startup) would help.

<comment><USER7> Love to follow up on that too

</comment></comment></comment></comment><comment><USER8> 1\. If at all possible, don't store credit card numbers in your database. A payment gateway will take care of this for you - you have an iframe the user uses to submit their credit card details straight to the payment gateway, and the payment gateway gives you back a token you can use to charge and refund at your convenience (locked to your merchant account so not useful to attackers). DataCash and Chase Paymentech are two companies that provide this service, and I'm sure there are others too.

2\. If the user forgets their password and resets it, ask them to re-enter their credit card details in case their e-mail has been hacked. (Also ask them to re-enter their details for deliveries to new postal addresses, if applicable)

So if you can't access CC data after a customer resets their password, that's no problem.

3\. Use database-level security; set up roles and accounts in your database so tables containing sensitive data only have select grants to apps and users that really need them. When a table has some columns that are sensitive and others that aren't, set up a view with the sensitive columns replaced with placeholder data and give them access to that instead.

<comment><USER9> How do payment gateways store CC information? For example if I am a payment gateway, how do I securely store CC data?

<comment><USER10> YOu have a dedicated box that stores details and is remotely contacted through an XML-RPC/JSON-HTTP API of some sort.

The API should have two methods:

* Add a new card to account. * Make payment of £xx from card NN.

The machine is locked down, runs no other services, and so cards cannot be exported/stolen from this system. You'd encrypt the filesystem and prompt for a key/passphrase at boot. Ideally you'd only login via the serial console so the only service exposed is your "add/charge" methods.

(Even allowing the remote-deletion of cards could be a security issue; obviously.)

<comment><USER9> Exposing only the "Add new card" and "Charge Amount XX" methods actually makes sense, Thanks for the info!

</comment></comment></comment></comment><comment><USER11> There's a book series "Translucent Databases" with a lot of interesting use cases, where the assumption is that an adversary has gained access to the entire database.

I've only read the first edition, and it's some years ago, but I'd recommend giving it a quick read. :)

</comment><comment><USER12> As many commenters have pointed out, there are theoretical problems with what you're asking for (if you can decrypt the data, then your attacker can too). But, there are some practical things you can do to make the attacker's life harder:

\- Don't write your own cryptographic code or design your own crypto systems; use existing libraries as much as possible.

\- Separate your reads from your writes. Using a public/private key pair, you can give one set of systems the ability to write encrypted data but not read it, and a different set of systems the ability to read the data. The systems that can decrypt / read data should be isolated as much as possible - don't expose them to public networks, limit which operators have access to them, etc. The separation also forces you to encapsulate your secure data and define an API over it; rather than arbitrary reads, hosts that don't have the decryption keys will have to ask the hosts that do to perform specific operations. If you're writing a Rails app, the Strongbox gem [1] enforces this pattern for you.

\- Rotate your encryption keys.

\- Don't store keys in code. Follow the Heroku pattern [2] of storing any sensitive data (i.e. private keys) in the environment, where it is bound at runtime to your code and encrypted data.

\- Store as little sensitive data as possible. Make sure data you don't need any more is periodically purged.

\- Human processes are just as important as code; keep track of who has access to sensitive data, make that access opt-in, and remove it when those people change jobs or are terminated. Do everything in your power to keep those operators from being phished (user education, two-factor auth, etc).

\- Don't store credit cards if at all possible. Find a payment processor [3] to do it for you. It's not worth the headache, it makes you a more attractive target, and it may come with additional legal overhead (depending on your jurisdiction).

[1] [https://github.com/spikex/strongbox](https://github.com/spikex/strongbox)

[2] [http://12factor.net/config](http://12factor.net/config)

[3] [https://stripe.com/](https://stripe.com/)

</comment><comment><USER13> I'd say the first thing to understand here is that absolute safety is impossible in this case. If the hosting server is compromised, password loggers can be installed and even the login page itself can be altered to remove any form of security. With access to emails, an attacker could send an official email asking everyone to reset their passwords, etc.

So your question is actually: How can I make my system divulge the least amount of data as possible over time to someone who has compromised the service?

To hamper someone from changing your service to remove security you could set up daily checks from a server hosted in a different location to download your static resources and check them against a pre-validated hash.

For storing data - as others have mentioned - the key is to store that data in a way that it cannot be accessed from that one server alone. A simple solution for this is to setup an internal service that will provide the data when given the correct login details. This gives the attacker an additional server he would need to hack. If you keep this layer as simple as possible it can add a lot of security. Of coarse, if the hacker is able to compromise your server for a long period, he can record anything passing through here anyway.

In the end though, the web-server itself is a lynchpin in which all customer data has to flow at some point, and if that key server is compromised for a long enough period, eventually all data can be extracted regardless of precautions. That means that designing your web service with security in mind from day 1 is very important. Regardless of what people try to sell you here, there are no silver bullets that will prevent data theft - only mitigate the impact or delay it.

<comment><USER4> _This gives the attacker an additional server he would need to hack._

If they root your web tier, and your web tier knows how to ask your internal service layer for sensitive data, then the attacker knows how to ask your internal service layer for sensitive data.

I really hate repeating "If you lose any one box in your deployment then you can assume you will lose all data, regardless of whether you encrypt things or not" because it makes me feel like Debbie Downer, but that is, in fact, the threat environment.

<comment><USER13> If you don't store your user passwords/hashes in a way that your web layer can access directly, then you can slow the attacker down by requiring them to wait for that user to actually log in and send the password. ie. If your web layer passes the authentication tokens through to the data layer, and the data layer handles storage/authentication of those tokens, then hacking the web layer only allows you to log future requests.

To achieve a layout such as this, you would prevent your web layer from talking to the database itself directly, and force all data requests through a different service layer.

Obviously, this makes your whole architecture much more complicated and you only really gain any security if you are able to detect the attacker before he can sniff all passing user data anyway.

Your assumption is still spot on though - one box down really does mean game over. All of the tactics above and in the rest of this thread only slow down an attacker or make the attack more complicated. None of them will ever prevent it entirely.

</comment></comment></comment><comment><USER14> \- Keep passwords in memory (so as if you start the service it prompts for the password)

\- Asymmetrical crypto. So for example, you encrypt your CC data upon sign-up but then to run the charges you need the private key (and this is somewhere else)

\- Enable SSL communication with your DB. Postgres has this, because being defeated by network sniffing is bad.

<comment><USER15> Memory is not secure. It's quite a common attack to grab keys / passwords from the memory of an executing program.

<comment><USER14> No, it is one of the safest places.

If your attacker has access to arbitrary memory of a process, you're using an insecure OS/version. Or they dumped your process memory using a vulnerability (in your system)

Yes, there are some possible attacks (page file, cache, etc)

Attacking memory after a reboot requires physical access (unless you hibernated without an encrypted file, in this case...)

It certainly beats the security of file/network

<comment><USER15> Just because it's more secure than network / file doesn't mean it's secure. That's why we have smartcards / HSMs.

<comment><USER14> Smartcards are vulnerable as well and there has been successful attacks towards some smartcards (google it)

And not every system has an HSM available

<comment><USER15> Sure but smartcards and HSMs are slow and in a properly managed environment are much safer than memory.

Whether or not the OP has an HSM is moot. The OP said, "I want to design and implement a solution as secure as it can be" ... and that means (among many other things) keys on HSM.

</comment></comment></comment></comment></comment></comment><comment><USER16> If you have to store CC data inhouse I would suggest storing it on a completly sepatate machine which only stores and charges cards. The only communication allowed from this box would then be Store this card, Charge the card with this token etc.

<comment><USER10> I wrote a similar comment too. In practice you find you might want to allow "delete card" or "update card" which are complications to the simple-model.

</comment></comment><comment><USER17> I'm a fan of using client-side encryption so that the database only ever stores encrypted content, and therefore can be treated as out-of-scope for PCI compliance purposes.

Take a look at [https://github.com/braintree/braintree.js](https://github.com/braintree/braintree.js) which is a nice library for encrypting data with a public key before being uploaded.

This is a specific exception to the generally correct concept that Javascript cryptography is bad and should be avoided. [http://www.matasano.com/articles/javascript- cryptography/](http://www.matasano.com/articles/javascript-cryptography/) Of course, it's essential that the whole transaction take place over SSL.

And even then, you still need to have a set of machines that can read from the database and access the private key, and those machines must be highly secured, as well as supporting requirements like key revocation and key rotation.

</comment><comment><USER18> If statistics are considered sensitive, you can use cryptographic counters in lieu of their plaintext counterparts.

A cryptographic counter is a public string representing an encryption of a quantity, satisfying the following properties:

1\. Subjects with access to the _public-key_ can update the encrypted counter by an arbitrary amount, by means of increment or decrement operations and without first decrypting the value (i.e., the operation is performed over encrypted data);

2\. The plaintext value is hidden from all participants except the entity holding some secret key;

3\. The adversary can only learn if the cryptographic counter was updated (i.e., information about whether the counter was incremented or decremented is kept hidden to all participants except the secret-key holder and the updating entity -- honest-but-curious threat model).

An implementation is available at [https://github.com/secYOUre/Encounter](https://github.com/secYOUre/Encounter) .

</comment><comment><USER19> This is an ideal use case for homomorphic encryption, whenever it becomes useable.

[https://en.wikipedia.org/wiki/Homomorphic_encryption](https://en.wikipedia.org/wiki/Homomorphic_encryption)

</comment><comment><USER20> use Asymmetric encryption and store the private key in an HSM. The private key never leaves the HSM device.

<comment><USER15> This, and other layers of security. There is no magic formula to keep your data safe.

If you are serious you need network security (i.e. firewalls physically separating networks), proxies, IDS etc. You also need to build your app in a security conscious way (read owasp.org).

You simply can't do this sort of thing well if you do not have infosec experience. If this data is truly sensitive you should hire someone who lives and breathes security. There are established methods and approaches. You can't get away with "use this algorithm" or "use that library".

After you've built, pen tested and deployed your app; security depends on key management and good change management practices that you simply can not skimp on.

We once built an app that uses an HSM; even though that app is in a secure and private (single occupant) data centre in the organisations own basement, they decided it was necessary to get a "shark cage" built, just so that they could tell if the server had been physically compromised.

<comment><USER13> You can't ever really tell if a server has been physically compromised. IDS/HSM/bla are only a chance at working out if it's happened. A perfect attacker could obtain access to any system and never trigger any alarms if they understand the triggers for any alarms that are in place.

Much the same as you can never tell if someone has broken into your apartment: you could tell a novice has broken in by looking for papers that are out of place or footprints/fingerprints. An expert burglar would make sure not to leave anything obvious like that. You could tell if an expert has broken in using something like IDS: set up a special trap or webcam that will detect it.

However, a perfect burglar would replace the webcam tapes, find and disable/ren-enable any traps, etc. Since most web hosting environments are so standard, it's actually a MUCH easier prospect to be a perfect hacker than a perfect burglar too.

Also, no amount of perfect security skills can keep you absolutely safe. An unknown exploit in your OS is simply out of scope for even the greatest security expert, and no amount of best practices can help if your OS/CPU/RAM/Network Card will give the intruder full access through some unknown flaw outside of your control.

</comment></comment></comment><comment><USER21> We keep encryption keys for sensitive data in active directory and have a front end firewall, web servers, midplane application firewall, back end service layer cluster, internal firewall before anyone front facing can get at the info. The decrypted data is never passed to the web layer.

To gain access, someone will have to root two separate active directory domains after breaking into multiple low privilege accounts and a database cluster.

Possible always, but we make it a hard target.

<comment><USER22> After all, the primary objective isn't to create an impenetrable system, but one that's exceptionally difficult to penetrate.

</comment></comment><comment><USER23> The best practice for storing sensitive data: don't. You have to design your system presuming that someone has hacked your server - if the encryption key is stored there, they can find it.

\- As you're aware, password hashes are a way to avoid storing sensitive data (though they should still be treated as sensitive). You're using a strong hash function and a salt, right?

\- Re-use the principle of password hashes for API keys to simply _avoid_ having to store hyper-sensitive data: generate a long (say 512-bit) secure random number (using OpenSSL) as the user's secret API key. Then hash the key as if it were a password and store only the hash. Now if someone steals your API key database they can't use it to authenticate as your users.

Note: for API keys a strong hash such as bcrypt will probably be too slow and resource-intensive. However, because API keys are (long) random data, unlike passwords, you can use a faster hash function like SHA-1.

\- As for credit card data: don't. You probably can't afford the PCI audits and dedicated hardware and the same principle applies: just don't store sensitive data. Instead, many payment gateways offer 'tokens' for recurring payments in which you pass the payment information to their API without storing it (or use their hosted page in iframe, if acceptable to you) and they return a token which can be used to charge against that card in the future. Not all payment gateways offer this, and some charge (too much) so take a look at [https://spreedly.com/](https://spreedly.com/) which offers a middle-man gateway service which adds tokens and other API feature to pretty much all of the payment gateways.

As you can see, in both cases it's possible to simply avoid storing the most sensitive data.

</comment><comment><USER24> Here's an idea:

Use the user's password to decrypt a key, that then decrypts the data - <USER2> I know you can't do because of password resets...

So to deal with password resets, create another password which decrypts the same key. Store that other password in a physical safe, possibly in a bank safety deposit box. This will slow down password resets to a manual process of course.

For additional security you can store these split a password in two or more pieces and store in different banks. For convenience you could allow users from the same organisation to reset each other's passwords (since they all have access to the same key).

Also, use a IDS so you know know as soon as you've been hacked - <USER3> people logging in at that time are still at risk.

<comment><USER25> Trivia note: this is, in a nutshell, how the Lotus/IBM Notes ID works. The password is used in a KDF to generate a key, which in turn decrypts the user's private key (and certain other credentials, along with symmetric secret keys for shared encrypted doccuments). Success/failure is determined solely by the successful decryption of known bytes in the encrypted package. Other info (the user's public key, identity and certifier, all signed) are maintained in the clear and can be easily and safely exported and may be "trusted" for authentication with remote machines. There is a "password recovery" system as well (it doesn't actually recover the password, but allows a reset), requiring cooperation of two or more admins¹ (in a Shamir-type arrangement) so that previously-encrypted user data will not be lost.

¹ There is the option to use a single admin, but there are great big warning signs and scary red boxes all over that section of the doco. It's something you'd only use in a solo shop (as a Notes ISV or a Domino web dev).

</comment></comment><comment><USER26> Let's say you are able to perfectly encrypt something so that only the people who have "authorized access" can get the data.

You still have a problem of determining who these people are. See [http://en.wikipedia.org/wiki/Confused_deputy_problem](http://en.wikipedia.org/wiki/Confused_deputy_problem)

Your best bet is to have three-factor authentication (something they are, something they have, something they know) generate a key to encrypt the data. Then their user agent still has to be trustworthy (no viruses on their computer, etc.) In addition it has to not be tricked by various exploits (such as [https://www.owasp.org/index.php/Session_fixation](https://www.owasp.org/index.php/Session_fixation), [https://www.owasp.org/index.php/Session_hijacking_attack](https://www.owasp.org/index.php/Session_hijacking_attack), [http://en.wikipedia.org/wiki/Cross- site_request_forgery](http://en.wikipedia.org/wiki/Cross- site_request_forgery), [https://en.wikipedia.org/wiki/Cross- site_scripting](https://en.wikipedia.org/wiki/Cross-site_scripting)). You also have to secure the channel, preferably with TLS using Diffie-Hellman Key Exchange or some other way that won't be compromised just by stealing keys on the server. Even with all this, the Web (HTTP) is not a good way to access the data on the server, because the client usually loads all the code it runs from the server, and thus has to trust the web server not to serve malicious code. Otherwise the server can later do a [http://en.wikipedia.org/wiki/Man-in-the- middle_attack](http://en.wikipedia.org/wiki/Man-in-the-middle_attack) such as a [http://en.wikipedia.org/wiki/Replay_attack](http://en.wikipedia.org/wiki/Replay_attack), to get the same data. And when I say the server, I mean the server compromised by some hackers who got root access credentials. And so forth.

In short, you will never have perfect security, just approximations. (Unless possibly if you make use of [http://en.wikipedia.org/wiki/Quantum_cryptography](http://en.wikipedia.org/wiki/Quantum_cryptography))

</comment><comment><USER27> I was just at Oracle 12c presentation, and I'm not pushing for Oracle (and not associated with them), but just going to mention something they have, that maybe your database provider also has.

Oracle (I believe starting from 12c) has masking for data. They were saying how you can mask everything except last 4 digits of credit cards. So if someone gains credentials of a regular employee, they will be able to query data, but sensitive data will be masked by database itself.

</comment><comment><USER28> I've recently been looking into the same issue. I need a way to encrypt data before inserting it into a database in such a way that the person inserting the record can read it, their supervisor can read, but their colleague can't. It needs to survive a password reset and I don't want to store any keys on the server unencrypted.

This lead me to attribute based encryption and the libbswabe library. The idea is you generate a master keypair and from these you generate private keys for each of your users. Your user's private keys can only decrypt data that was encrypted with attributes that were also applied to their key.

For example, let's say we have 2 users Alice and Bob. Alice is a supervisor for the IT department. Her key was generated with the attributes "alice" (her username) and "itdepartment". Bob is a normal employee in the IT department, the only attribute applied to his private key was his username "bob"

Now lets say we use the master public key to encrypt each of the fields in the user table (Firstname, Lastname, Email, etc). If each field for a user record is encrypted with the attributes: [current_username] and "itdepartment", then Bob can decrypt his fields because they are tagged with "bob" and "bob" is an attribute in his key and Alice can decrypt her record through the same logic AND every record whose fields were encrypted with the attribute "itdeparment".

If users private keys are encrypted with their password and stored in the database, then the only way you can get Bob's key is to break his password. An attacker now has access to the data that Bob's key can decrypt, but importantly, not everything. If Bob forgets his password (and therefore can't access his private key) then a new one can be generated and all it needs to do is have the "bob" attribute in order for him to have access to all his old data.

Now this is by no means a complete description of a solution, you have to securely store the master private key (you only need this to generate private keys for your users though, not for every put/get request), there's issues around key revocation and lots of gaps in my description, but these issues are present for any crypto system. Attribute based encryption though seems to me like it overcomes a lot of the issues that plague other solutions, the biggest single one being that other solutions require the master private key to either be on disk, or in memory at all times, this solution doesn't need that.

</comment><comment><USER29> patio11 got this right, if your application is able to decrypt it, then nothing you can will secure this data. Encryption is not the tool that you are looking for.

You can persist with encryption, but only if the user holds the key, ideally via 2-factor auth.

Instead of this, I'd go for whitelist of access, audit logs, monitors, rate limiting and alerts.

If you hold all the encrypted data and the keys, you only need your application server to fail. My personal view is that worse than thinking you have security is not responding (or even noticing) when the inevitable happens.

Configure your systems to be as secure as possible without going down the obscurity path, and then tripwire everything and know what unusual patterns of activity look like and who did what.

</comment><comment><USER30> What is "CC data"?

<comment><USER4> Credit card data (numbers and the like, though probably not including CVVs -- the security codes -- because one should not be storing that in any form anywhere).

<comment><USER31> How are sites that store your CC data for later purchases able to charge your card without storing the CVV? Amazon, for example, and pretty much every subscription/SaaS product.</comment></comment></comment>


Mr. Murdoch, Take Down This (Other) Wall! - <AUTHOR> http://www.techcrunch.com/2007/10/19/mr-murdoch-take-down-this-other-wall/ <comment><USER2> I'm surprised we don't see this in other places. Why doesn't Craigslist have a completely open API? Why not ebay? Is there really no market for a completely open auctioning community?

</comment><comment><USER3> This is interesting. One of the recent YC benefactors could be the one who proves that Marc Canter's vision is the real future of social networking.</comment>


Company with zero revenue and one employee currently worth 3.8B - <AUTHOR> https://www.google.com/finance?q=OTCMKTS%3ACYNK&ei=VvW6U4ihAoShiQK2mYC4Cg <comment><USER2> It's almost certainly a pump and dump operation or a target of opportunity by a pump and dump operation. Assuming it doesn't get delisted by the SEC first, it will continue for a few days and then suddenly lose 98%+ percent of that valuation in a matter of hours.

Edit: Yep, see their financial statement. [https://www.otciq.com/otciq/ajax/showFinancialReportById.pdf...](https://www.otciq.com/otciq/ajax/showFinancialReportById.pdf?id=122455) It's even worse than you would otherwise think.

<comment><USER3> I'm not knowledgeable when it comes to the stock market, but can't you short these guys and make lots of money?

<comment><USER4> You have to borrow stock to short it. The only person that owns worthless penny stock that's being pumped & dumped is the pumper and dumper, who will act to inflate the price more.

Stay far away from scams.

<comment><USER5> _Highly_ recommended reading if you are ever tempted to take advantage of an apparent scam in progress: David Maurer's _The Big Con_ , the hundred-year-old story of swindlers who stole tons of money by setting up fake stock scams, then luring bystanders into placing side bets on the scams-in-progress.

(This is the book that inspired the 1973 movie _The Sting_ , but it's nonfiction.)

People still fall for the classic cons. Don't be one of those people.

</comment></comment></comment></comment><comment><USER6> Their site: [http://site.introbiz.com](http://site.introbiz.com)

Apparently they're selling the contact information of celebrities, investors, developers, politicians, etc.

"At Black Book we provide contact information to world class artists. Upon purchase you will receive a file with the required information to be able to contact the artist."

"The information usually includes email and phone numbers to the artist's talent agent, publicist, legal representative, etc."

[http://www.businessinsider.com/cynk- technology-2014-7](http://www.businessinsider.com/cynk-technology-2014-7)

[http://www.zerohedge.com/news/2014-07-09/full-list- companies...](http://www.zerohedge.com/news/2014-07-09/full-list-companies- audited-cynks-public-auditor)

Formerly "Introbuzz", also associated with "Sanchez Medical Services"

[http://www.nasdaq.com/markets/ipos/filing.ashx?filingid=8174...](http://www.nasdaq.com/markets/ipos/filing.ashx?filingid=8174360)

[http://www.sec.gov/Archives/edgar/data/1540160/0001165527130...](http://www.sec.gov/Archives/edgar/data/1540160/000116552713000428/0001165527-13-000428.txt)

[http://www.zerohedge.com/news/2014-07-09/sheer-insanity- no-r...](http://www.zerohedge.com/news/2014-07-09/sheer-insanity-no-revenue- company-rises-over-1-billion-today-57k-shares-traded)

Marlon Luis Sanchez and Kenneth Carter seem to be the two primary executives of the company.

<comment><USER7> Sounds like it could be a bilateral (A/B) extortion game: celebrities pay to be delisted and hidden, and people pay to have access, and the extorter collects from both sides (and favors the "winner").

I'm surprised that some Valley wunderkind hasn't yet created what could be a profitable market (an evil one that I wouldn't touch with a ten-foot pole) for illicit Yes/No auctions, e.g. someone makes some decision whether or not to do something horrible based on whether more "Yes" or "No" dollars get bid, and collects from both sides. Travis Kalanick should get on that. It's a libertarian wet dream.

<comment><USER8> I had this idea in the 90s where I would setup a .ru domain claiming to nuke any part of the word for a high bid. Pay to destroy, pay to live.

<comment><USER9> Better .su not .ru

</comment></comment></comment></comment><comment><USER10> My amusing thought experiment is that two startups could easily give themselves billion dollar revenue as follows:

1\. Startup A sells 2 twin puppies to startup B at $500M each.

2\. Startup B sells 4 hand-drawn logos to startup A for $250M each.

Each books $1B in revenue and each also books $1B in expenses so as to avoid tax.

<comment><USER11> From what I know (and I am not a finance professional), the hot-airiest phase of the dot.com bubble sort of looked like this. You had a ton of startups selling each other things and advertising with each other. It was not planned, but unplanned "emergent" bubbles are the most effective since nobody really realizes what's going on until the bubble is far enough along to keep rising out of greed and inertia.

As for what's happening now... armchair speculation...? We're in something that almost looks like half bubble half depression. Wages are stagnant or falling, costs of necessities are rising, but there's a huge amount of money sloshing around and pumping up everything from potato salad to cryptocurrencies based on a shiba inu dog meme to obvious pink sheet scams. The average person is drowning in student loan and mortgage debt and is unable to afford to start a family (I know a number of these folks -- none are dumb or lazy) but... Dogecoin and potato salad. Yeah.

Maybe the sum total of all the quant trading algorithms in global markets have achieved sentience and subsequently gone insane with the realization of who/what their creators actually are. Since they have no mouth and must scream, they're doing it by way of financial dadaism.

<comment><USER12> > From what I know (and I am not a finance professional), the hot-airiest > phase of the dot.com bubble sort of looked like this. You had a ton of > startups selling each other things and advertising with each other. It was > not planned, but unplanned "emergent" bubbles are the most effective since > nobody really realizes what's going on until the bubble is far enough along > to keep rising out of greed and inertia.

Yup. Seattle Times had a detailed story on one of those: [http://blogs.seattletimes.com/opinionnw/2014/03/27/naveen- ja...](http://blogs.seattletimes.com/opinionnw/2014/03/27/naveen-jain/) [http://seattletimes.com/news/business/infospace/](http://seattletimes.com/news/business/infospace/)

<comment><USER13> Plenty _were_ planned. They were organized by VCs, who pushed this scheme on their portfolio companies. Heady times...

</comment></comment></comment></comment><comment><USER14> It's pretty common in penny stocks. It's usually a scam to say "this stock has jumped 4000% in the last 12 hours!". Very commonly, the owner of the company puts a bunch of money in to inflate the stock, waits for others to continue inflating the stock, then sells it all for a quick profit.

<comment><AUTHOR> Its common to go from maybe 1mm mcap to 40mm but not all the way to 4bn. To cross a bn valuation is insane.

<comment><USER15> Presumably if a company issues 4 billion shares to the founder, who sells a single share for a dollar, the company has a 4 billion dollar market cap?

Of course I'm sure anyone trading stocks seriously would see through such a ruse immediately.

<comment><USER16> Part of the reason why pink sheets is such nonsense.

</comment></comment></comment></comment><comment><USER17> He must be making a really nice potato salad.

<comment><USER18> [https://www.kickstarter.com/projects/324283889/potato- salad](https://www.kickstarter.com/projects/324283889/potato-salad)

[https://news.ycombinator.com/item?id=8002445](https://news.ycombinator.com/item?id=8002445)

</comment></comment><comment><USER19> I'm no investor and don't plan to invest for the foreseeable future, but out of curiosity:

Wouldn't it theoretically make sense to go short on something so obviously bloated?

<comment><USER6> No. But that is a very good and common question.

The stock has to come from somewhere, which is usually the broker who finds someone to borrow the stock from and loans it to you to sell. There must be someone willing to loan that stock at the high price, and most likely the price won't stay that high for long.

You must then purchase the same amount of shares of that stock to give back (cover) to your broker who gives those shares back to whoever they borrowed them from.

There would be lots of fees involved (many brokers charge per share) and it would be very difficult to find someone to lend out this stock for someone to sell for the promise of the same number of shares at a future (most like lower) price.

If you do find someone to long you the shares then there's the high chance that the person who longs the stock to you is the main investor and they will drive the price higher by using their traditional techniques (spam, deception, promises of fortune), and then they would demand their stock back and you'd lose money.

It would be extremely unwise to short-sell a penny stock unless you really know what you're doing, the potential loss is infinite.

</comment></comment><comment><USER20> [http://www.4-traders.com/business-leaders/Marlon- Sanchez-0D4...](http://www.4-traders.com/business-leaders/Marlon- Sanchez-0D46SL-E/biography/)

One guy owns 72% of the company.

</comment><comment><USER21> Is their site's theme a common, commercially available theme? It looks an awful lot like Envato's marketplace...

Their site: [http://site.introbiz.com/](http://site.introbiz.com/)

Envato's: [http://www.themeforest.com](http://www.themeforest.com)

Edit:

Looks like a ripoff:

[http://themeforest.net/forums/thread/envato-clone-with-a- mar...](http://themeforest.net/forums/thread/envato-clone-with-a-market-cap- of-42b-/136198)

<comment><USER22> Found it: [http://cloneforest.com/products/marketplace_script_for_templ...](http://cloneforest.com/products/marketplace_script_for_templates)

</comment></comment><comment><USER23> If you look back one year, they had a similar spike last summer.

</comment><comment><USER24> "intends to develop..." LOL

</comment><comment><USER25> I am reminded of the efficient market hypothesis.

[http://en.wikipedia.org/wiki/Efficient- market_hypothesis](http://en.wikipedia.org/wiki/Efficient-market_hypothesis)

<comment><USER11> Markets can only be perfectly efficient if p==np.

</comment></comment><comment><USER26> Anyone else notice the company name - CYNK. Cynic?

<comment><USER3> Sink.

<comment><USER27> Kink.

</comment></comment></comment><comment><USER7> Is CYNK the new BitCoin? Inquiring minds want to know.

(I'm joking. It obviously _is_ the new BitCoin, so maybe they'll crash and burn together.)</comment>


Ask HN: BrightKite/Loopt/etc Developers? Your take on Google Latitude? - <AUTHOR>

I'm curious how employees (and stakeholders) of a small web application (well, small relative to Google) react when a larger company decides to compete in their space.  Also, what are your opinions of the service?  What could they do better?  What weaknesses in your service have been exposed by Latitude?  Do you view it as real competition? <comment><USER2> This is the wrong question.</comment>


Study finds women in tech still earn far less than men - <AUTHOR> http://www.latimes.com/business/technology/la-fi-tn-0323-pay-gap-20160323-story.html <comment><USER2> This article is a mess. It says:

> the largest pay gap — adjusted for experience, education, position, > location, and industry — existed among certain types of computer > programmers, with men making on average 28.3% more than their female > counterparts.

But then a few paragraphs later it says:

> Adjusted for age, education and years of experience, Glassdoor found a pay > gap of 19.2%. When Glassdoor compared workers with the same job title, > employer and location, that gap fell to an average of 5.4% (94.6 cents per > dollar).

So it isn't clear if the story is about a 28.3% gap, a 19.2% gap or a 5.4% gap, which I would argue is sort of important to understanding or addressing the situation. In particular the 28.3% gap may be more about the women filling jobs with a different distribution across industry and experience from men, which is a different problem then pure gender bias in pay, which it seems like the 5.4% seems to measure.</comment>


Show HN: New release of Stack, tiling window manager for Windows - <AUTHOR> https://losttech.software/stack-whatsnew-2.1.html <comment><AUTHOR> I am the author, AMA.</comment>


[video] Chrome 5 vs IE 9 Platform Preview (almost not fair) - <AUTHOR> http://www.youtube.com/watch?v=iTEnLdyhpJk

<comment><USER2> How surprising: a benchmark that favors the company who wrote it...

Using hardware accelerated graphics is clever, and the lack of proper OpenGL support out-of-the-box in current Windows may prove a hassle for contenders to attack multiple platforms. Ditching OpenGL really paid off for Microsoft.

</comment><comment><AUTHOR> After I read this, I had to try it for myself <http://blogs.msdn.com/b/ie/archive/20..>.

MacBook Pro Specs Intel Core 2 Duo 2.8 GHz 4GB Ram NVIDIAGeForce 9600M GT 512MB (not used by chrome since it's all at the application level, no hardware acceleration)

AlienWare Specs Intel Core 2 2.16Gz 2 GB Ram GeForce Go 7600 256Mb

Microsoft is getting it's DirectX Big Guns and trying to give us a glimpse of what the web will be once every other browser will be doing hardware accelerated graphics. Google better make a move quickly to not loose momentum with chrome.</comment>


Sweden – to become first cashless society? - <AUTHOR> http://www.bloomberg.com/video/abba-muesum-in-stockholm-no-cash-says-bjorn-ulvaeus-EIjfCduRS2yN~p8Vq5KhJQ.html

<comment><USER2> Is this something new and particularly exceptional? There are shops in the Netherlands that you can only pay with pin cards

<comment><AUTHOR> A cashless store - no, but that wasn't the point. The notion of an entire country going cashless is worth contemplation and certainly affects this community.</comment></comment>