Hotspots.io team (YCW11) acquired by Twitter - <AUTHOR> http://hotspots.io/

<comment><USER2> Congrats to Matt, Sandy, and Ashu! Matt has been very generous in helping me navigate through the ups and downs of startups. He's been giving me startup advice and direction for the past year and a half (starting back when I had nothing) and I don't think I would have made it out here to work on Sonalight if it weren't for him.

Since moving on from moki.tv, they've been hard at work on hotspots.io and I'm really glad it worked out for all three of them.

</comment><comment><USER3> When did Hotspots.io launch? Did they ever broadly launch? I hadn't heard of them and couldn't find anything except news on the acquisition.

<comment><USER4> it was Moki.TV before this product. love these guys.

</comment></comment><comment><USER5> Twitter buys exclusively YC alumnis or what?

<comment><USER6> Hotspots, Posterous, BackType...who else am I missing?

<comment><USER7> AdGrok

</comment></comment></comment><comment><USER8> Is there a chance we'll know the acquisition price?

<comment><USER9> Out of curiosity, how does the process of publicizing acquisition prices tend to work? Is a price shared only when it's seen as a positive signal for one of the companies?

<comment><USER10> unless it meets SEC disclosure laws then a price is almost always leaked, and then often in ballpark

responsibility for leaks, almost in order, would be angel investors, VC investors, lawyers and then founders, almost always on the side of the company being purchased.

M&A execs, founders and investors sometimes leaks sales negotiations when they believe it is in their favor to do so.

</comment></comment></comment><comment><USER11> Congrats guys! How much?

</comment><comment><USER12> Reading the announcement would it be wrong to say this is a talent acquisition?

</comment><comment><USER13> another cool startup bites the dust, have fun at the day job.

<comment><USER14> Working at Twitter isn't really a "day job" (even Facebook or Google wouldn't be a day job in the sense of being an IT guy at a local school district, or something else).

There are awesome groups within organizations the size of Google, and even organizations the size of IBM. There's clearly more non-awesome in a big organization too, but if you get stuck in those, you kick back for a year or two, then go do another startup.

<comment><USER15> > Working at Twitter isn't really a "day job"

Why not? You have a boss and do what he tells you. That's nowhere near having your own startup.

<comment><USER14> I think you both overestimate the amount of freedom in having your own startup, and underestimate the amount of freedom in a good role at a larger company.</comment></comment></comment></comment>


Bill Kerr: "Point of view is worth 80 IQ points" explained - <AUTHOR> http://billkerr2.blogspot.com/2006/12/point-of-view-is-worth-80-iq-points.html <comment><USER2> I have to admit this remark doesn't quite compute (e.g. people who "have more IQ" can adapt their POVs more easily, etc. etc.) and the Roman calculation example, i.e.

"It was based on a few things from the past like how smart you had to be in Roman times to multiply two numbers together; only geniuses did it. "

is baloney. There were three method of calculation in the Roman times (e.g. see [http://books.google.com/books?id=bfgRxVzjbMYC&pg=PA79...](http://books.google.com/books?id=bfgRxVzjbMYC&pg=PA79&lpg=PA79&dq=history+of+mathematics+roman+multiplication&source=bl&ots=nS6TwS_ijS&sig=hJ9Qr6BNpgP92AvcR4xF1I8Xkxs&hl=en&sa=X&ei=HnACT5aiO8OQgwfShdGSCQ&ved=0CFoQ6AEwBw#v=onepage&q&f=false). Multiplication (or division) was handled by a combination of table look up, which is also a common technique in Babylonian and Egyptian math, and using the abacus to handle resulting summations. It was no walk in the park, obviously, but you didn't need to be a genius either. Incidentally the word _calculate_ stems from the small pebbles, called _calculi_ , used in an abacus (see here for a fascinating discussion on Roman calculating boards and abaci: <http://mathforum.org/library/drmath/view/57572.html>).

</comment><comment><USER3> No, point of view has little to do with representation. For example, the gradual acceptance of abstract reasoning in mainstream culture is said to be responsible for the steady increase of IQ scores over the last century, causing testmakers to constantly shift the curve to keep the center score at 100.

But I don't think that was Kaye's point, either. I think he was saying if you have the correct perspective you will make better choices than smarter people who don't. Rather than decimal notation vs. Roman numerals, consider DynaBook vs. "computers". For some (easier to come up with) negative examples: People who realized that everything done by timesharing would migrate to the desktop were able to escape dying industries before they collapsed. Bye, DEC. Ditto for people who realized that performance of personal computers would overtake workstations. Bye Sun and Silicon Graphics.</comment>


Being a Hipster Wont Save You, Having a Posse Will - <AUTHOR> http://www.thrsti.com/

<comment><USER2> [http://swombat.com/2011/1/13/how-to-get-your-startup-on- hack...](http://swombat.com/2011/1/13/how-to-get-your-startup-on-hacker-news)</comment>


Show HN: Chat Envy - Simple browser based video chat - <AUTHOR>

I decided to build Chat Envy this weekend to get a feel for the OpenTok API.
Chat Envy is a simple web based video chat platform that allows users to quickly setup a chatroom.
What do you think?  Would you use it?
Any feedback is appreciated.
http://chatenvy.com <comment><USER2> Your homepage_view function doesn't return an HttpResponse object. How do I know that? Because you're in debug mode. You should disable that.

<comment><AUTHOR> Ouch. Thanks for that, it's disabled now.

</comment></comment><comment><AUTHOR> Link: <http://chatenvy.com>

<comment><USER3> \- urls are too long

\- hit refresh when there is a flash problem, boots me out

\- no ability to type messages

\- should alert user to turn of flash block

<comment><AUTHOR> Thanks for the feedback, all good suggestions. URL length is an annoyance for me as well. I will look at passing the identifier in some other manner.

</comment></comment></comment><comment><USER4> You should promise anonymity like Jitsi.

</comment><comment><USER5> Very cool. Would use it. Bookmarked.</comment>


CDE – Common Desktop Environment - <AUTHOR> https://sourceforge.net/projects/cdesktopenv/ <comment><USER2> I dislike CDE. IMO, Motif was sabotaged by Microsoft's involvement. This is a very minor point, but I will never accept ALT+F4 as a sensible hotkey for exiting apps. I think macOS picked the best hotkey defaults.

Anyone interested in this should also check out OpenStep [0]. I've been researching this area heavily during the past year and I'm constantly amazed by all the revolutionary work that got done at NeXT and Sun. It's a damn shame they didn't win bigger mindshare.

[0] [https://en.wikipedia.org/wiki/OpenStep](https://en.wikipedia.org/wiki/OpenStep)

<comment><USER3> Cmd+Q is awful IMO. It's too easy to hit accidentally trying to do Cmd+Tab.

<comment><USER4> Every time people tell me they like MacOS shortcuts I look at them with a bit of stink eye. They're about as anti-muscle memory and as "shortcuts that shouldn't be next to each other" as key combinations can get.

Great, they're very easy to learn, but not so great to retain and use. I'm going to be spending the rest of my career looking up on SO the bottom 75% of the shortcuts I need to use. Thanks guys. Thanks Steve.

<comment><USER2> I disagree that they're difficult to retain and use. I've learned how to use both sets of shortcuts, as I sometimes move between macOS, Linux (Ubuntu), and Windows. Regardless, macOS shortcuts are my favorite.

In my experience, shortcuts are more consistent on macOS than on Linux and Windows.

When I first tried macOS I thought its shortcuts were the worst thing ever. But after giving it a genuine try for a few weeks, I immediately fell in love with em.

You can find the macOS shortcuts on the Mac keyboard shortcuts [0] support page. If you're interested in more details, you can learn about the guiding principles by reading the Human Interface Guidelines Keyboard article [1].

Even if you disagree with some of their design decisions, I'd still highly recommend reading through their Human Interface Guidelines articles. It's an amazing resource.

[0] [https://support.apple.com/en-us/HT201236](https://support.apple.com/en- us/HT201236)

[1] [https://developer.apple.com/macos/human-interface- guidelines...](https://developer.apple.com/macos/human-interface- guidelines/user-interaction/keyboard/)

</comment></comment></comment></comment><comment><USER5> The nostelgia is strong with this one.

Every 6ish or so months I see a link like this and spend a lazy Sunday trying to get CDE (or another equally retro package or system, my last hit was Desqview)

It usually ends up either me aborting because of some dependency hell trying to get all the old versions in sync, or I get the system up, take a pleasant trip down memory lane, then 10 minutes later get annoyed by the impracticalities of it, and go back to my current system with renewed appreciation

I don't know where I'm going with this, I'm not complaining I love doing it, and I can't imagine I'm the only one, anyone wanna share some stories?

<comment><USER6> > It usually ends up either me aborting because of some dependency hell trying > to get all the old versions in sync, or I get the system up, take a pleasant > trip down memory lane, then 10 minutes later get annoyed by the > impracticalities of it, and go back to my current system with renewed > appreciation

Hah. I go a bit overboard with windows managers/desktop environments from icewm to fluxbox to KDE to GNOME. I've settled on XFCE but I have a VM solely to muck around with desktop environments and get my fix.

The worst for me is VIm color schemes. Can't seem to choose one I can stick with.

<comment><USER4> > The worst for me is VIm color schemes. Can't seem to choose one I can stick > with.

[http://vimcolors.com/290/CandyPaper/dark](http://vimcolors.com/290/CandyPaper/dark)

Been using for years at this point. Very pleased.

</comment></comment></comment><comment><USER7> It looks like outdated shit, and that makes me happy. I worked on CDE HP systems for many years, and I liked it. The fact that it looks bad now is proof that we've come a long way and that great progress has been made, hence the happiness.

<comment><USER8> It wasn't until relatively recently that software engineers took the opinions of artists and designers seriously. Apple was probably the original and first to do so, with Jobs' own background in artistry. It's why Mac OS looked above and beyond better than anything else in 1984, an era still typified by command-line interfaces and overwhelming GUIs that simply vomited everything at you.

<comment><USER9> _" It's why Mac OS looked above and beyond better than anything else in 1984, an era still typified by command-line interfaces and overwhelming GUIs that simply vomited everything at you."_

I'm sorry, but it's not Steve's artistry, it's his ability to "steal like an artist". Look at the Xerox Star, it had everything the Mac had (and more) years earlier. The difference was in its price. At the time, nobody needed convincing that GUIs would be great to work with, they needed convincing that they were worth the price.

<comment><USER10> While I don't think it was his artistry per se, it was, to a good degree, his taste. And I don't think he was so much stealing as he was hiring the very people who produced the Xerox Star, so their work could see the light of day. And it improved pretty dramatically under his management as well.

</comment></comment></comment></comment><comment><USER11> Whoa, crazy, is CDE still alive? I remember back in the day I wanted to build a GUI application, and was utterly defeated by Motif as a toolkit. I wasn't a very sophisticated programmer (I think I was like 12 or 13), but I still remember how opaque it was. Qt was a breath of fresh air!

Oddly, I still really, really, really like the aesthetic of the CDE. I think if there were a modern, HiDPI version of it, I might even use it.

<comment><USER12> You could probably get very close with a well-configured twm or fvwm2

</comment></comment><comment><USER13> Yea.. click to type. Like.. why. This is why a bunch of us stuck to uwm -> twm -> tvtwm

<comment><USER14> I'm right there with you, until tvtwm. I went with ctwm. The reason why is lost in the mists of time. Probably because another grad student had already set it up, and had shared a nice .ctwmrc

<comment><USER13> I diverted to fvwm and regretted it and my Emacs friendly friends forced tvtwm down my throat? Improved my experience but I stuck with a modal editor!

If you do the right magic to bind 'jump sideways' in units of the virtual desk, it's like moving entire panes painlessly. I had to load 3rd party stuff into OSX to get the same experience.

</comment></comment></comment><comment><USER15> This was my first exposure to Unix desktop I used CDE on irix in that late 90s with Softimage for 3d animation. CDE had no bells and whistles but it enabled you to devote all your processing power to the task at hand.

<comment><USER16> You may have been using CDE, but the default on IRIX in the 1990s was Indigo Magic Desktop (later called IRIX Interactive Desktop), with SGI's own port of Motif. This used the 4Dwm window manager, which had window decorations like those of mwm, but with window title bar labels in bold, italic type.

</comment></comment><comment><USER17> Man OpenWindows was so much better looking and XView much nicer to program for.

And anyways by the time Motif didn't have ridiculous licensing and costs it was already too late. The world had moved on.

</comment><comment><USER18> I remember Solaris 10 shipped with CDE as one of two available desktop environments. The other one that it came with was based on GNOME.

</comment><comment><USER19> I feel like there should be a Ubuntu based CDE distro out there.

I spent so much time in front of CDE that I can't help but feel nostalgic for it.

<comment><USER20> I feel nostalgic for it too but only because I'm looking at if for a few seconds. I'm on Unity now, and I rather stare at Unity all day than CDE.

</comment></comment><comment><USER21> Yeah, but nope. Just get xfce, it has similar ideas and it is so much better.

</comment><comment><USER22> I think the last time I used CDE was on a Solaris/Intel box. At least I think it was CDE .. looked like it ... took over 30 minutes to load (literally).</comment>


Friendfeed Frenzy - Why it continues - <AUTHOR> http://anzman.blogspot.com/2008/03/friendfeed-frenzy-why-it-continues.html <comment><USER2> Ok, this is too much:

"It makes me wonder why Microsoft, with all their resources, can't move like this (They used to???) and, instead, still be looking at spending a rediculous amount of money on Yahoo."

Um...i think the answer is in that sentence. It's "all their resources" that keep them moving at that pace. Stakeholders take time guys!

Second! How has FriendFeed done this PR second-coming? Well, they hit the needs of early adopters right between the eyes! Can they sustain this interest? Good lord no! iPhones, Facebooks, (maybe even) Twitters all have some level of appeal to the mass market. FriendFeed is built on the data glut that confronts those who have too many networks (read: early adopters.) Science would call this a "false positive."

FriendFeed is a symptom that indicates the general problem. Social Networks aren't 100% ready for prime-time, and as we take one step closer with each new network we have to deal with the hiccups of having friends (and ourselves) on different networks. FriendFeed is a band-aid that corrects this, when Social Networks reach some sort of bankable state there will be no need for this work-around. (That's what this is: a work-around.)

Sorry for the long comment, but personally I'm exhausted from filtering through the blog noise on FriendFeed. Yes, I'm sure this is flame-bait to some extent, but I needed to call FF on it's shit at least once.

Poke holes in everything I write, I'll debate with all comers.

<comment><USER3> For sure FF is a work around, but what is this bankable state you mention? IM has been around for ages, and I still have friends spread across AIM and MSN and what have you.

Sure, blog noise is obnoxious; however, I think FF has some mass market appeal since social networks seem to be getting more and more specialized. It is unlikely one dominant network will emerge.

<comment><USER2> The IM comparison is a good point. Adium, Meebo and other clients have great mass-market value. The niche point is also sharp. The more specific the boxes of data in a network are, the more relevant they are to the end-user.

My problem right now is that FriendFeed is nothing more than a grand pipe. It really holds no content, instead it creates a window to view content elsewhere. There are problems with this. One of the big ones is the feedback loop that emerges with heavy users (I twitt, which goes to friendfeed and tumblr, where it goes back to friend feed. same with delicious...) The second problem is that FF relies on data from outside sources: if delicious or FB turns off the flow what can FF do?

I guess my frustration lies in people vesting in FF's potential. It hasn't done anything terribly novel (though useful) yet. I'm waiting for the 'wow' moment. Something anyone can experience without having lots of early-adopter, data-exhausting friends to see the immediate benefit. Until FF can pull that off, I'm afraid our enthusiasm is misplaced.

</comment></comment></comment><comment><USER4> I like FF. It certainly doesn't feel like a "frenzy", though.</comment>


A California Megachurch Is Trying to Bring a 2-Year-Old Girl Back to Life - <AUTHOR> https://slate.com/human-interest/2019/12/olive-alayne-heiligenthal-resurrection-bethel-church.html?via=taps_top <comment><USER2> If prayer worked, there would be evidence showing that.

[https://en.wikipedia.org/wiki/Studies_on_intercessory_prayer](https://en.wikipedia.org/wiki/Studies_on_intercessory_prayer)

</comment><comment><USER3> These people need to be made to watch _Pet Semetary_ until they figure out why their prayers are better off unanswered.</comment>


Pentagon seeks high school / college hackers - <AUTHOR> http://www.dc3.mil/challenge/

<comment><USER2> A forensics competition, managed by SANS.

Kids, if you're looking for an interesting and exciting career in information security, steer clear of forensics. Ask your friendly neighborhood pentester what "EnCase Jockey" means.

</comment><comment><USER3> "Only teams with all team members being U.S. Citizens traveling from within the Continental U.S. can win the DC3 Forensics Challenge."

They don't trust Hawaiians?

</comment><comment><USER4> The terminal on the left is a very nice touch. Looks like someone's hitting the DoD with a cybersec cluebat.

<comment><USER5> Nice looking, yes. Clue, not so much. It could be argued that they: \- shouldn't be sitting with an open root shell \- should use audited/logged sudo for root stuffs \- use the full path to 'ls'

but I probably shouldn't get bogged down discussing a graphic on a website

<comment><USER4> I think the point was to look like the POV of a hacker having taken root on another box.

</comment></comment></comment><comment><USER6> makes sense, enemies of the future are aiming to attack our connectivity in the field of battle( so we can't coordinate a war) and cyber attacks to steal information. _Cough_ _cough_ china.

<comment><USER6> wtf why the hell did people vote my shit down. cyberattacks from china is the new threat in future wars and the pentagon needs talented americans to prepare and combat it. Its an inconveinent truth.

[http://technology.timesonline.co.uk/tol/news/tech_and_web/th...](http://technology.timesonline.co.uk/tol/news/tech_and_web/the_web/article2409865.ece)

[http://www.scientificamerican.com/article.cfm?id=chinas- cybe...](http://www.scientificamerican.com/article.cfm?id=chinas-cyber- attacks-sign)</comment></comment>


Why aren't we using SSH for everything? - <AUTHOR> https://medium.com/swlh/ssh-how-does-it-even-9e43586e4ffc <comment><USER2> Hey everyone, thanks for dropping by the main ssh-chat server (chat.shazow.net). That one is running a fairly old version of the software (/uptime -> 13579h33m20.784837542s).

I just deployed the latest Github release on an east-coast server here, please come help test it:

      ssh chat2.shazow.net

Binary releases are available here if you're interested in running your own: [https://github.com/shazow/ssh-chat/releases/](https://github.com/shazow/ssh- chat/releases/)

<comment><USER3> Is chat2 dead? I entered sentence in Chinese and now I can't see anything after login or re-login.

And it's so dead that the ssh process has to be killed by a signal 15. ^C and ^D won't work.

<comment><USER4> ^C doesn't work because the SSH client is passing it through to the remote server (which is normally what you want), not because the client itself is stuck.

ssh has a little-known "escape character" feature for situations like this. You can type <ENTER> ~. to tell the client itself to exit, or <ENTER> ~? for a list of other escape commands.

<comment><USER5> It doesn't hurt to mash <ENTER> a few times, either, just to tell ssh that you're serious. I used to have it not work occasionally until I started mashing -- probably because it passed the newline through and I didn't make it to ~ fast enough, so whap-whap-whap ~. is my muscle memory for killing ssh now.

This is extremely useful information if you do a lot of work on remote servers, particularly when you restart networking and lock yourself out. You can get your shell back without having to kill the terminal or open another to kill ssh, which I see a lot of people do. It's too bad it's little-known.

~C is useful too so you can alter your forwarding setup (including cancelling open forwards) without dropping the connection.

<comment><USER6> _It doesn 't hurt to mash <ENTER> a few times_

Do you happen to be an older North Carolinian? I don't think I've heard anyone use "mash" in this sense since being a bewildered Northerner in an NC elementary school in the 70's when a teacher asked me to "mash the lights". Apparently some light switches once used buttons, and "mash" was (and possibly still is) a regionalism for "press".

Is it used elsewhere too? Personally I'd use "mash" to describe preparing potatoes, and would need it for brewing beer, but I wouldn't have considered that it might be applicable to escaping from ssh. Although searching now, I see that it also seems to be a term-of-the art for rapid button pressing in video games. And I see that suggestions that it's also used in the West Indies.

<comment><USER7> As a New-Englander, the term mash comes naturally to me as meaning 'press rapidly.' But I'm also a gamer, so I may have picked it up there.

<comment><USER8> Yeah, the phrase "button mashing" is fairly common in gaming.

<comment><USER6> Would you say "mash <up-arrow> several times until" or "mash <up-arrow> until"? That is, in gaming terminology, would you ever use "mash" to describe pressing a key only a single time? Or does "mash" always describe repeatedly and rapidly pressing a key?

<comment><USER7> Mash, as it did in the above context, only describes pushing a button rapidly and repeatedly. It can be used interchangably with spam, but usually implys a shorter time frame, and when using spam, you usually name the action, not the button.

To demonstrate the difference:

"After you get knocked out in punch out, mash A to get back up"

"In Quake 2, spamming rockets to protect entryways is the only use for the stupid things."

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> As tempting as it is to use SSH everywhere (for exactly the reasons outlined here), other protocols exist because they usually have some form of marginal gains over the alternatives, and marginal gains matter at scale.

Encrpytion isn't always something that's needed (arguably; though I'm all for enabling it everywhere it can be enabled), and in places where it's not critical, it adds performance overhead both client- and server-side.

SSH also has to be shoehorned into distributed chat applications, for example, else the interface deters inexperienced users and, again, almost inevitably, overhead is incurred. Using PGP for authentication and encryption in this case is a saner choice because it supports decryption by groups of recipients, and implementing a protocol over UDP (or even TCP) is plenty.

EDIT: Just to be clear, though, there are some pretty cool nonstandard uses of SSH out there. Medium OP's chat server is a great example.

<comment><USER10> > As tempting as it is to use SSH everywhere (for exactly the reasons outlined > here), other protocols exist because they usually have some form of marginal > gains over the alternatives, and marginal gains matter at scale.

I heard people "at scale" also use micro services over HTTP. Or even Rest for mobile apps, where latency is a real issue.

So I am not buying that part. I think HTTP (over TCP) has won because the web has won. As always technical people are overestimating the importance of technical aspects of a product and thereby their own importance, when really it is all about usability and network effects.

<comment><USER9> >I think HTTP (over TCP) has won because the web has won.

For sure. If I were building a mobile app that had to talk to a server, a RESTful API would be the first thing that comes to mind.

It's not the most lightweight protocol, but it's the protocol with a structure and interface that's designed for this -- making it a natural choice.

You could to a certain extent implement a REST-like API over SSH, or UDP for that matter, but that takes extra effort, and the fact of the matter is that many developers are just working on a higher level of abstraction, and lack the expertise to build new protocol. (My reasoning is that the lower barrier of entry into software development has created many developers with skillsets specialized in use of more "modern" technologies).

TL;DR -- IMO, using verbs to act on resources is easier to grok than working in terms of packets for most developers, and is sufficient in most situations. I still believe there are better alternatives for high-performance networking.

</comment></comment></comment><comment><USER11> (2015) previous discussion:

[https://news.ycombinator.com/item?id=8828543](https://news.ycombinator.com/item?id=8828543)

[https://news.ycombinator.com/item?id=11516582](https://news.ycombinator.com/item?id=11516582)

It's been posted twice in the last day, I wonder where it reemerged.

<comment><AUTHOR> I saw it on Lobste.rs and did a quick search for the url but it returned nothing. Medium articles suck with that hash they put on. Thought it was worthy of submitting here.

<comment><USER12> I thought it was a good read, oh and small world eh?

<comment><AUTHOR> > small world eh?

Haha indeed it is!

</comment></comment></comment></comment><comment><USER13> While SSH seems like the ideal console application delivery platform, it suffers in a major way: no local execution.

This matters when latency matters. Processing all keystrokes remotely sucks over high-latency links like airplanes, cell phones, satellites, etc.

This can also be a pro. JavaScript is a mess in terms of design, increased client complexity, and security. It depends on what your requirements are.

<comment><USER14> This is actually one area where I like our IBM i system, the 5250 console may be extremely lacking in many features compared to say a VT100, but the block- based console eliminates the remote server from needing to handle redrawing or dealing with input until the user explicitly requests an action. It's pretty amazing to see a thousand users connected to the box and none of them have any latency with inputting data (getting a new screen back from the server make take a couple milliseconds) because it's all done locally until they press a function key or some other action button that pushes the data off to the server.

<comment><USER15> The same description would apply to HTML forms in the browser. In fact there are HTTP gateways that translate IBM forms to HTML on the fly.

</comment></comment></comment><comment><USER16> > Why aren't we using SSH for everything?

Because when you have 100,000 users and you need to rotate your host key following a leak, the team in charge of user retention has a heart attack.

<comment><USER17> Informing users when your keys were leaked is more important than user retention. Hiding your weaknesses does not build trust.

<comment><USER16> You're missing the point: SSH does not provide a host key rotation/revocation mechanism. TLS does.

<comment><USER17> You said that you are afraid of loosing users after a leak, which implies if you don't have to, you won't tell your users about the incident.

<comment><USER18> No, its that the fix is client side and painful. They can tell their users to fix it and they would rather leave than do it.

<comment><USER17> I thought users would be prompted to accept a new fingerprint. Am I missing something?

<comment><USER19> If by "prompted" you mean:

@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ IT IS POSSIBLE THAT SOMONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now!

Then, yes, users will be prompted in the scariest possible language.

Compare this with HTTPS/browsers, which care not a lick if a certificate/fingerprint is different, provided that the certificate is valid and the chain is trusted.

<comment><USER20> Which --coincidentally-- is exactly the problem with it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> > When you join ssh-chat, not only do I know who you claim to be, but I can > also permanently and securely attach an identity to your connection without > any user intervention on your part.

A great part of IRC is that there's no registration. There's no identity.

<comment><USER22> That's... not true at all? Nickserv and Chanserv are essential parts of modern IRC and in practice people need a consistent identity to interact with most channels.

<comment><USER23> Most? Essential? Not really. I can hop into most of the channels with a different nick every time. Nobody cares. I can even use the same one without registering it as long as nobody else does that. I can open a chan without being registered and enforce rules in there.

The only time I need to register something is when I want to keep the channel alive and still be OP when I come back, when I want to keep my nick or when the chan owner requires me to register.

Which is all not "most channels".

<comment><USER24> Some channels ban non-registered users to protect themselves against spam.

</comment></comment></comment></comment><comment><USER25> SSH lacks a key distribution/certification model for server authentication.

The article describes server authentication (in the section with misleading title "SSH connections are encrypted") but does not mention the fact that fingerprint should be sent over another secure channel and manually verified.

<comment><USER26> [https://www.digitalocean.com/community/tutorials/how-to- crea...](https://www.digitalocean.com/community/tutorials/how-to-create-an- ssh-ca-to-validate-hosts-and-clients-with-ubuntu)

</comment></comment><comment><USER27> "It doesn't work because you generated your key with RSA instead of moduli-2048" is not a conversation I want to have with my mother. Until the tools to deal with SSH keys are _a lot_ more user friendly, it won't be used much by the wider public.

<comment><USER28> Agreed. How easy is it to remember a password vs. keep a sensitive file (in an obscure place) for years?

<comment><USER29> Is the file a word doc in c:\Documents and Settings\PC OWNER\desktop? :)

</comment></comment></comment><comment><USER30> Regarding the question, I use SSHFS to mount directories on remote machines: [https://en.wikipedia.org/wiki/SSHFS](https://en.wikipedia.org/wiki/SSHFS)

<comment><USER31> sshfs is so simple; I don't know why people seem to default to using nfs.

<comment><USER32> performance. sshfs is dog slow compared to NFS on a local network.

Also, coherence: sshfs manages to hide a lot of the ugly details, but you'll meet coherence problems on sshfs much more often than on nfs. They both do aggressive caching, but nfs gets help from the server side and is thus usually better.

<comment><USER31> Both good reasons. My personal use case happens to make these issues unimportant: mounting remote file stores that are only accessed by me. But I guess for mulitply-accessed files on the local network, nfs headaches may be worth the trouble.

</comment></comment></comment></comment><comment><USER33> If anyone is interested seeing another interesting service, our organization is currently developing user onboarding over SSH (WIP). All sources are public [1] and easy to follow/read. It's written in nodejs and has nice blessed/blessed-contrib based UI.

[1] [https://github.com/hashbang/signup- ssh](https://github.com/hashbang/signup-ssh)

<comment><USER29> The hashbang people are doing a LOT of interesting things. What's nice is that they aren't waiting to get the whole internet onboard with their ideas, they are building the services now.

The best part is that (theoretically), you could install their software on a machine of your own and it would then be capable of providing services to their users.

</comment></comment><comment><USER34> > Or better yet, ZeroMQ-style sockets with proper security and encryption?

ZeroMQ supports CURVE encryption + authentication as of 4.0

[http://hintjens.com/blog:49](http://hintjens.com/blog:49)

</comment><comment><USER35> If you look around there are cases of using ssh for various things, but at the end of the day HTTP is the protocol of the masses, you aren't going to beat it's adoption.

plenty of nethack servers that you can ssh into here: [https://nethackwiki.com/wiki/Public_server](https://nethackwiki.com/wiki/Public_server)

Another rougelike: [http://crawl.develz.org/wordpress/howto](http://crawl.develz.org/wordpress/howto)

</comment><comment><USER17> I added SSH authentication to the roadmap for the API in one of my projects. I love the UX of the first connection from a new users acting as registration.

When I looked for information on how git SSH servers are implemented I did not find enough information to get started.

Can anyone recommended reading for someone getting started with an API over SSH?

<comment><USER36> I looked at it a while ago using OpenSSH's AuthorizedKeysCommand feature and found Phabricator's implementation for vcs over SSH to be the most understandable thing I could find.

[https://github.com/phacility/phabricator/blob/master/resourc...](https://github.com/phacility/phabricator/blob/master/resources/sshd/sshd_config.phabricator.example)

[https://github.com/phacility/phabricator/blob/master/resourc...](https://github.com/phacility/phabricator/blob/master/resources/sshd/phabricator- ssh-hook.sh)

[https://github.com/phacility/phabricator/blob/master/scripts...](https://github.com/phacility/phabricator/blob/master/scripts/ssh/ssh- auth.php)

</comment></comment><comment><USER37> Why aren't we using ipv6 with ipsec for everything? Then we could just stick with rsh, telnet and http...

I honestly think that the time has come to turn back the clock, and move forward with that approach. We've time and time again proved that "mostly encrypted" is almost impossible to get right, and almost never what we really want. We've also shown that we really do care about authenticating the servers we communicate with.

With the recent advances in cpu power, ram (and custom hardware) -- there's not much reason _not_ just encrypt and authenticate all the things any more.

In the 90s, doing full ipsec and ipv6 everywhere was expensive: new switches and network hardware was needed, and the overhead of encryption was way too high.

But now the time should be right. Still not all that hopeful that we'll actually get there, though.

</comment><comment><USER38> No comments here because everyone is chatting about it at chat.shazow.net?

<comment><USER2> Pretty much. :)

</comment></comment><comment><USER39> Excellent explanation of how ssh works along the way, to boot.

</comment><comment><USER40> Until a recent version you couldn't even have a .d directory to hold a bunch of config files to simplify contacting your servers.

<comment><USER41> Oh neat, is that a thing now?

I ask because I hacked up something a couple years back to let me manage files in ~/.ssh/config.d, plus a Makefile that produced ~/.ssh/config from them and a set of shims for OpenSSH commands which would run make before running ssh, scp, etc., to make sure the live config stayed up to date with changes in .d files. But I haven't used that pile of shell scripts or looked at it in a while, so it's probably started to smell a bit, and it would therefore be nice if this were a thing OpenSSH itself can now do.

<comment><USER42> _Oh neat, is that a thing now?_

Yeah, since this Monday: [http://www.openssh.com/txt/release-7.3](http://www.openssh.com/txt/release-7.3)

</comment></comment></comment><comment><USER43> Because inventing new protocols is cooler.

<comment><USER44> Sadly, we don't even invent new protocols any more, at least not open ones. What we do is invent new, closed platforms like Slack (and HipChat and Campfire before it).

<comment><USER30> Besides the obvious hype and hipster "this time its different" appeal, is there any technical reason one would would prefer Slack over, say, XMPP? I looked into it only until I realized one has to pay to access chat history.

<comment><USER45> Slack gives you a unified chat stream and a simple, buttery-smooth onboarding process for the tech-naifs. Jabber does neither of these. I'm not fond of Slack in particular, as it's ridiculously expensive and the main chat window is too widely spaced, even with mods.

I use jabber with a friend, and frequently messages go to his other laptop, which he doesn't see until he logs onto it. Same in reverse. Similarly, history isn't unified. You can get around these problems by having your own centralised jabber chat client (like bitlbee), but that's a technician's answer, not an answer for the general public.

</comment></comment></comment></comment><comment><USER46> It's great if you can leverage the SSH keying system, but using SSH "raw" for anything high-bandwidth is a disaster (try using sshfs on a high latency network, you will get two digit kilobytes when you know the network connection can sustain a megabyte)

</comment><comment><USER47> SSH chat does not ensure that "I know who you claim to be". Only that "I know you're someone who has access to the same SSH key as that someone with whom I was talking yesterday".

In terms of authentication, that is about on par with an IRC "nickbot".

<comment><USER48> That's TOFU-POP, and it's perfectly reasonable for many situations. For example, HN.

<comment><USER41> For others who've never before run into that particular acronym, it glosses per [1] to "Trust On First Use/Persistence of Pseudonym".

[1] [https://lists.gnupg.org/pipermail/gnupg- devel/2014-March/028...](https://lists.gnupg.org/pipermail/gnupg- devel/2014-March/028350.html)

</comment></comment></comment><comment><USER49> [https://www.ietf.org/mail- archive/web/tls/current/msg12133.h...](https://www.ietf.org/mail- archive/web/tls/current/msg12133.html)

</comment><comment><USER50> I made a toy SSH API thingie a couple of months back; [https://github.com/jagheterfredrik/sheet](https://github.com/jagheterfredrik/sheet)

</comment><comment><USER51> round trip times. it makes somethings impossible with that much interchange required to send anything - and it will never go away because the speed of light is a hard limit.

</comment><comment><USER22> We're not using it because... well... it's weird (for lack of a better word)? Sure, it's a multiplexing protocol that can support a few neat use cases like port forwarding and X11 tunneling, but that's really not what we want in most cases. It carries a lot of baggage in its clients and implementations that _in principle_ shouldn't cause problems but _in practice_ makes it suboptimal.

One of the most important aspects of why we don't use it: it's scary to work with. SSH's implementation of its protocol is much closer to the actual client implementation than the divide traditionally maintained between SSL and its clients. People are rightly afraid to get close to cryptographic code without sufficient training, and so there is the equivalent of a "If You Are Responsible: Keep Away" sign for most developers who might be inclined to improve the situation.

Still, the community found the impetus to augment the protocol and UI to help deal with latency issues that plague SSH via Mosh. It helps escape the legacy idea that RTTs will be consistent and therefore are ignorable in a shell implementation.

Ultimately, SSL is a better understood tunneling protocol and full of a lot less... maybe it's just the perspective we have in a world where SSL is ubiquitous but SSH is weird. Its rules are weird, its certificates are weird, its tooling is weird.

This is a common contention in Hacker News I'm often on the minority size of, but I submit that while syntactic interfaces (shell, programming) has clearly demonstrated its value and deserves to be better developed, the same can not be said for serial text entry interfaces. Something based around a streaming query protocol like SSL+HTTP/2 that makes some fundamentally different decisions than the legacy UNIX shell and supporting tooling would be substantially better, and be able to use existing web browser techniques and software.

Which is all abstract, but imagine for a moment something we've seen before: an Electron Shell based terminal. But what we haven't seen is someone really dive in and attempt to redefine the world around shells. So bear with me for a second...

Imagine an Electron Shell based terminal experience that works locally and remotely. A line buffer separate from the display accumulates and maintains the current prompt (because instead of PS1 being pseudo-executable in our shell it actually can attach scripting functions and web-browser style timers).

Executables logically return open dictionary objects (which can contain streams) instead of the current fixed set of indexed streams. We can use 0, 1 and 2 as legacy keys into these objects to maintain compatibility. But you could imagine a "rich-1" key that actually outputs rich markup, "error-1" that outputs rich markup for error, etc. And of course, media itself could either be file system references. These rich objects are just textual objects with references to valid HTTP/2 requests do what they do.

This actually resembles SSH's protocol on the outside, but using tools that are reusable elsewhere and a cryptographic stack and transit protocol that has more funding and attention and traction.

<comment><USER52> Yes. I would suggest anybody who poses the question "why not" to try to actually implement SSH from the scratch! I've looked at some "smaller" implementations than OpenSSH and they are still, like you say, "weird."

SSH appeared to me to be an implementation of the console application that got crypto and network code bolted on, everything kept together almost with the Sellotape. And it doesn't change when somebody has to re-implement it as most of the "features" have to exist for a thing to work.

However, there are also some advantages in using SSH for some purposes: for somebody who knows what he does, just the key management is actually less weird than the whole SSL thing. The tunneling is also very convenient and I like it.

</comment></comment><comment><USER53> For one thing many corporate firewalls filter port 22 even got outbound traffic

</comment><comment><USER54> Do TLS client certificates make HTTPS equivalent to SSH?

<comment><USER20> No. Disregarding technicalities of which there are many, the most important difference is that with ssh you either get the host key through a different secure channel or "trust on first use" (TOFU). With HTTPS you trust certificate authorities (CA).

<comment><USER54> I was referring to the browser side certificate that can be generated using the <keygen> tag, and then used for the subsequent HTTPS sessions. Would this be equivalent to ssh-keygen for SSH?

<comment><USER20> That's deprecated though and afaik, that's only the client-side authentication, not the server-side. That still relies on CAs, with all the disadvantages.

</comment></comment></comment></comment><comment><USER39> Excellent explanation of how ssh works, to boot.

</comment><comment><USER55> ... probably because it requires a central server which the industry is moving against?

Things are moving to distributed.

<comment><USER56> I beg to differ [http://www.techrepublic.com/article/amazon-cfo-said- these-3-...](http://www.techrepublic.com/article/amazon-cfo-said- these-3-factors-are-the-reason-for-aws-revenue-explosion/)

</comment></comment><comment><USER57> SSH passing username by default is actually one of the things I hate about it.

<comment><USER58> Why? not much of an info-leak if you know where you're connecting, and it has to use _something_ , or enforce a foo@host string.

You could work around it with something like:

        Host *
        User WhosAsking

in your ~/.ssh/config (at the end of the file, so other entries can override it)</comment></comment>


UT-Austin completely evacuated because of bomb threat - <AUTHOR> http://www.utexas.edu <comment><USER2> It's almost certainly a hoax, of course. I'm fairly certain there's never been a bomb threat on an American school where there turned out to be an actual bomb.

Not once in any school in the United States, ever in the entire history of the nation.

I've really looked for a counterexample, but I haven't found any. If any of you have one, I'd love to hear it.

<comment><USER3> It seems remarkably easy and consequence-free to disrupt major institutions like universities, sporting events, etc.

The answer probably isn't to ignore the threat, but it seems there's gotta be a better solution than shutting the entire thing down. Maybe not.

</comment></comment><comment><USER4> It's not just Austin: <http://www.bbc.co.uk/news/world-us-canada-19602986>

I've heard from a friend in Austin that this is a hoax. Sounds like this might be related to the anti-Islam film.

</comment><comment><USER5> Why is this on HN? Hoaxes like this happen daily.

<comment><USER6> We had a discussion about this about how often bomb threats get made to universities. I felt as if this was a rare thing, which is why, IMO, when it does happen the news picks it up.

However, my coworker thought that it does happen often, but is curious as to how they then distinguish between what might be legitimate and what they immediately think is a hoax.

Then we both thought, if you do want to make a bomb threat, how do you decide who to call? Deans office? Football Coach? Ombudsman?

<comment><USER2> I'm at a public school in suburban Austin, and we get probably one bomb threat a year (that I know about). We evacuate for each one, unfortunately.

</comment></comment></comment><comment><USER7> Bruce Schneier wrote an excellent piece about this very topic back in April. It's worth a read: [http://www.schneier.com/blog/archives/2012/04/bomb_threats_a...](http://www.schneier.com/blog/archives/2012/04/bomb_threats_as.html)

(Reader comments are great, too.)

</comment><comment><USER8> What perplexes me is that the threat was called in at around 8:30 am and claimed bombs will go off around 10 am. UT made the decision to evacuate at 9:53 am, 7 minutes before the called threat. Is 7 minutes an ample amount of time to evacuate a campus this large?

</comment><comment><USER9> North Dakota State University has been evacuated as well.

[http://www.chron.com/communityblogs/atmosphere/article/North...](http://www.chron.com/communityblogs/atmosphere/article/North- Dakota-State-evacuated-3865583.php)

</comment><comment><USER10> Yikes! Looks like I'll take Mopac into downtown today.

Hope the threat doesn't amount to anything...</comment>


'Dying All Tensed-Up': 30 Years Since the Troubled Secret Mission of STS-27 - <AUTHOR> https://www.americaspace.com/2018/12/09/dying-all-tensed-up-30-years-since-the-troubled-secret-mission-of-sts-27/ <comment><USER3> Somewhere in the shuttle design is a lesson about not cramming too much into the MVP. Many years ago, in some high school engineering camp, I remember a university professor who had been involved in the STS design talking about feature creep in the shuttle program in very uncomplimentary terms.

According to the prof, the shuttle as originally envisioned would have had about 1/2 the cargo volume, and less throw weight, but in return a higher orbit at engine cut-off, much better serviceability, and a simpler design. In order to get the support of the military, the cargo requirement was pushed to what was just-barely-heroically-possible engineering in order to launch the military satellites desired by the spooks.

This decision compromised the program in every way imaginable. The schedule stretched out. The launch-pad weight ballooned, forcing the solid booster design into barely-possible territory. The original goal of "recycle for weekly launches" became a pipe dream. The re-entry heat shield design became very complex. The unit cost ballooned. The cost per launch ballooned.

The right answer all along would have been to tell the spooks: "No, damn it, design satellites that fit the payload bay or take a hike." The spooks would have had many years to refine and compact ever-better satellites. We paid a high price for poor program management decisions at the top.

The lesson I take out of it: As engineers, we need to think about risk budget at all times. Pushing the envelope on _something_ is probably necessary to beat the competition. Pushing the envelope on _everything_ is poor risk management. As an engineering manager, be very intentional about where risk is allowed. Concentrate your management efforts on de-risking the risky, and delegate the low-risk to clear your mind for managing the unpredictable.

I will admit that I have not always done that, and have collected the scars that I deserved.

<comment><USER4> You have to have a lot of power to do that. In most cases you'll just be removed.

</comment></comment><comment><USER5> Launching a (classifies) satellite into a useful-for-spying orbit is one level of secret, although clearly something which could be done with unmanned rockets (as was done later).

One of the super secret missions they used to sell the shuttle program was capture (and theft, or tampering and replacement?) of foreign in-orbit satellites. There isn't any solid evidence this was ever done, but it was a unique capability of something like the shuttle.

<comment><USER6> >> One of the super secret missions they used to sell the shuttle program was capture

No. That is the easier-to-swallow purpose. The logistics of capturing an enemy sat, one that might defend itself by changing orbit, are ridiculous.

What shuttle could do was bring friendly sats back. Why? Well it would have to be something that you couldn't let burn up in the atmosphere but neverthless needed to come home. Shuttle could have serviced space-based nuclear weaponry, the one type of friendly sat that couldn't be destroyed in the atmosphere or sent into a disposal orbit.

A fleet of nuclear-tipped reentry vehicles in orbit would have required constant up-and-down servicing. Russia saw the US biulding a vehicle capable of servicing such a fleet. Fearing a capability gap, Russia developed Buran. But when various treaties and understandings mooted space-nuke concepts, Buran lost its purpose and was parked. Shuttle continued.

Other aspects of shuttle also came from never-flew military missions. Those giant wings were to permit a polar-orbit overflight of russia with return to the launch center, a cross-range capability. It didn't need such massive wings.

<comment><USER7> Not just nukes. There were some tentative plans to use the shuttle with recon satellites. Either for on-orbit replacement of consumables (putting in more film), or returning a satellite to earth for reservicing and eventual reuse (which could also make getting the film back to earth much simpler)

<comment><USER6> True. Shuttle was begun long before digital imaging and asymmetric encryption did away with film. Of course shuttle could also be used as a recon platform itself, one that could alter orbit radically as needed to conduct surprise overflights. The MOL/Almaz programs, manned spying _stations_ , were still in the back of people's minds.

<comment><USER8> Pre-digital, the film from spy satellites was parachuted to earth and captured mid-air by recovery aircraft.

[https://en.wikipedia.org/wiki/Mid- air_retrieval](https://en.wikipedia.org/wiki/Mid-air_retrieval)

</comment></comment></comment></comment></comment><comment><USER9> A couple of thoughts.

> Flight controllers were convinced from the grainy images that the damage was > not severe and that the crew were mistakenly seeing damage in conditions of > poor lighting.

I can't help but wonder if they _had_ to say that because there was no real way to either fix the shuttle or retrieve the astronauts.

> If the heat shield was damaged, it could spell disaster during the fiery > return to Earth and Gibson's was instructed to use RMS cameras to acquire > imagery.

Why wasn't this SOP until after we lost another shuttle crew?

<comment><USER10> Supposedly (I can't find a reliable source), Neil Armstrong was once asked what he would have done with his final hours on the moon if the ascent engine had failed and they had been stranded. His response was that he'd have spent his final hours trying to fix the engine.

The point is that there's always something to try, even if it's improbable. Pilots are told to fly as far into the crash as possible, because it never helps to give up, and there might still be something you can do.

It's possible that they _chose_ to say that because they thought there was no way to save the astronauts, but they definitely did not _have_ to. And if that's really how it was, they definitely shouldn't have.

</comment></comment><comment><USER11> > Pity they didn't learn the lesson and maybe Columbia in 2003 could have been > saved. But again, mission controllers and engineers ignored the information > as "insignificant".

That was in the comments. That is the best part of the article. We have a long road to go about learning from things that worked ok by pure luck. But, as usual, we barely learn from mistakes...

<comment><USER12> I don't think any _engineers_ deemed any available information about Columbia as "insignificant", not that there was very much information to go on due to lax execution by camera tracker teams. Management on the other hand was... not effective.

I think that's really the crux of your statement. Humans seem to be terrible at working together in large organizations, or at least running them. Organizations seem to learn from mistakes only temporarily, or at all (as you pointed out). Consider the self-driving car group at Uber as a recent example.

<comment><USER11> Yes, and I agree with you. In my experience, even using some kind of protocol to prioritize which problem should be taken care first, it's easy to miss really important things because someone thought that "time to repair" should give the same score as "severity of consequences", and then we begin to fix things that are "easy and fast", not that are "relevant"

</comment></comment></comment><comment><USER13> "One tile on the shuttle's belly near the nose was completely missing and the underlying metal - a thick mounting plate that helped anchor an antenna - <USER2> partially melted. In a slightly different location, the missing tile could have resulted in a catastrophic burn through."

[https://spaceflightnow.com/shuttle/sts119/090327sts27/](https://spaceflightnow.com/shuttle/sts119/090327sts27/)

</comment><comment><USER14> > During their training, they earned the nickname "Swine Flight" from the > astronaut office secretaries, and were even given novelty pigs' snouts, as a > result of Gibson's penchant for making animal-like snorts whenever > attractive women were in the vicinity.

Gross. I'm glad culture, as well as technology, has evolved since the 80's.

<comment><USER15> It has, but let's not confuse that with it being good now. A lot of this sort of thing still goes on at a lot of very high profile places. I've personally seen it happen--and worse!

</comment></comment><comment><USER13> I am wondering why the images of the damage had to be encrypted - what sort of secret about the mission could they reveal? My only guess, which I don't find very convincing, is that it would reveal some modification that had been made to the robot arm, or its camera, for the purpose of the mission.

<comment><USER16> I suspect _all_ of the comms were encrypted.

<comment><USER13> I had not thought of that, but there are a couple of quotes that suggest that clear images were technically an option[1]:

Shuttle Commander Gibson: "So in other words, the resolution on the encrypted video was that bad that they based a conclusion on it that was in gross error. ... If I had said hey, I think this is important enough for us to break the encryption and send you guys clear video, oh, it would have been pandemonium down there at DOD. But in hindsight, oh man, that's what we should have done."

Ascent-Entry Flight Director Wayne Hale: "We were struggling in those days to try to maintain the security classification, so on and so forth... When the crew reported they saw this stuff, we had a long negotiation as I recall with the customer to say well, can we look at the TV? Because we weren't supposed to see any TV from on orbit. (They said) absolutely not. Could we look at the bottom side of the shuttle? That was the agreement, that we could, but we used this special slow-scan TV. And it was grainy."

So it looks like a case of "the rules are the rules, period."

[1] [https://spaceflightnow.com/shuttle/sts119/090327sts27/](https://spaceflightnow.com/shuttle/sts119/090327sts27/)

</comment></comment></comment><comment><USER17> Note the benefit of having a shuttle - the ability to fix the satellite after launching. Too bad the shuttle design (attached to the tank etc) is not ideal.

<comment> java-man I don't think one needs a shuttle for that.

</comment></comment><comment><USER18> I wonder what kind of payload had to be deployed with the shuttle rather than an unmanned rocket...

<comment><USER19> It was the first of the Lacrosse satellites; the remainder were launched on the Titan IV, though the first launch of that wasn't until a year later.</comment></comment>


Verizons case against full disclosure / "Narcissistic Vulnerability Pimps" - <AUTHOR> http://securityblog.verizonbusiness.com/2010/04/22/redefining-security-researcher/

<comment><USER2> Narcissistic Vulnerability Pimp - One who causes us to have to immediately pay those from the first two groups to avoid the losses that would result from the fourth group when really we'd prefer to do nothing at all and hope no one ever finds out how lousy our product was to begin with.

That's better.</comment>


Ask HN: How do you know you're getting paid enough? - <AUTHOR> There's a discrepancy in the payroll at my current workplace. I've come to this conclusion by finding out how much another employee gets paid, and the tricky thing is that he's a junior and I've been responsible for the project for some time, while he's been under my lead and supervision. He's always hasty, makes mistakes and simply cannot handle all the things implied with the project, while I am getting all the stress and often clean up after him. With that, I do not get paid significantly more than he does. Is it because my self-marketing skills suck and I should asses myself better in light of that, or because the guy who writes the check thought that the guy deserves more than he really does? <comment><USER2> You know if you are paid enough by learning what other offers you can get.

Companies do not pay you by value, generally speaking. Rare ones do, but most often you are paid whatever they can get away with.

That is why you are paid close to your junior colleague. Everyone has base living expenses that drive much of salary demand. Anyone without a job will undercut you towards that level.

But if you look at it another way, your pay is not much higher, but your savings rate is, after all your expenses subtracted.

<comment><USER3> > You know if you are paid enough by learning what other offers you can get.

Yup.

Instead of pouring an excess of effort your energy into your job, perhaps above and beyond what you agreed to do as per your employment contract, pour your effort and energy into investigating and cultivating your other job prospects. See if other companies are willing to make you a decent offer. It may take a fair bit of time to find a company that really wants you, that you'd be willing to work for, and will make you a strong offer. You are in a good position to look for other options when you are not rushed and are not desperate - i.e. - when you are already employed. Once you have one or more offers on the table, then you are in an excellent position to either take the offer, or begin negotiating with your current employer for a raise to a level that is competitive with the offer.

If you go to your employer and say "give me a 20% raise" \- or even "give me a 20% raise because <reasons why you are valuable>" without having first cultivated a strong alternative option, and they refuse, what are you going to do? Keep working for them at the same rate of pay?

A few resources that I found useful are:

      * the idea of a BATNA - Best Alternative To Negotiated Agreement
      * the ever popular Patrick McKenzie's salary negotiation advice
      * the book: "getting to yes: negotiating agreement without giving in" by Fisher, Ury and Patton.

On a personal note, I'm finding it far more valuable to become better at business-y things than technical things at this stage in my own career, after spending years thinking about programming, mathematics, and technical things. I regret not doing this earlier.

</comment></comment><comment><USER4> Does it matter? Just ask for more money.

</comment><comment><USER5> I assume you negotiated your salary when you joined your company. So did he.

Maybe he had a better sense of what he was worth, or what the company was ready to pay for his skills.

Ask for more money and that's it.

<comment><USER6> And what if they say no?

<comment><USER7> Be prepared to leave. Generally, you should have an offer in hand when approaching a situation such as this. This is a way of showing what your worth is to someone else. Companies will end up spending months and thousands of dollars in recruiter fees to replace you so it is cheaper and easier for them to pay the money. If you are reasonable, make a good case, and don't burn bridges in the attempt then you have a chance at coming out of the situation in a better place.

<comment><AUTHOR> Thanks for the suggestion. I am more than prepared to leave, but I've been on the project for quite a while and I'm emotionally attached to it, plus we didn't have a proper release yet and I want at least to see the first feedback / real world users. If I'll leave now, I'll feel like all the work has been for nothing.

</comment></comment></comment></comment><comment><USER8> I supervised a team of people and two of them made more than I did. I simply brought it up as another point in my argument for why my compensation should be adjusted a long with a very conservatively calibrated payscale report. I got a 30% raise as a result.

<comment><AUTHOR> Thanks for the point. I was considering this, but I though it would be rude for me to put this as an ultimatum. I think I will keep this as a fallback option if the 'I am absolutely sure I deserve more' fails.

</comment></comment><comment><USER9> not sure if it's true, but is it bad to use "[person] is getting paid more than me and i should be paid more than that" as a leverage in negotiation?

<comment><USER10> In my experience (and this is only _my_ experience/observations) it is extremely unprofessional to bring up a coworkers salary in your own negotiations, for several reasons.

Many companies still have policies against coworkers sharing salary information. Yes, this is illegal in the US, but practically speaking: it being illegal is about as effective as requiring traffic police to have a "preponderance of wrongdoing" to perform a traffic stop. It still happens near constantly, and the cost/benefit of trying to enforce these laws _in most cases_ isn't enough to actually pursue. (if you were to try and file a cause of action against your workplace for such a violation, you would surely mark yourself to future employers as being litigious - i.e you would paint yourself as a trouble-maker, so the benefit to doing so would have to be pretty big).

Secondly, social conventions don't really provide an incentive for near- strangers (and that's what many coworkers are for much of their careers) to share salary information. Yes, game theory says everyone wins if everyone shares, but we live in a society that is super prone to being offended. I don't even think it's polite to discuss money with friends.

As other posts on HN have stressed over the years, what really gives someone power in negotiations is a "Best Alternative" or BATNA[1].

[1] [https://en.wikipedia.org/wiki/Best_alternative_to_a_negotiat...](https://en.wikipedia.org/wiki/Best_alternative_to_a_negotiated_agreement)

</comment></comment><comment><USER11> How much longer were you at this company than him?

<comment><AUTHOR> More than 2 years.

<comment><USER11> It could very well be that in those 2 years the market has changed and they are putting out more money for talent. It's easier to get another job and get a part raise that way than staying at the same company and hoping for or trying to earn a raise.</comment></comment></comment>


Getting Started Full Stack - <AUTHOR> http://eguneys.github.io

<comment><USER2> One thing about going 'full stack' is there's a heck of a lot of OPS going on in the 'full stack'. You can be 'Full Stack Dev' maybe but really you need two people, or devops tools that are just incredibly more sophisticated than what's out there today.

Maybe these are all premature optimizations, but maybe they are essential steps you would regret not taking earlier.... But how can you tell the difference?

       How do you know the server is secure?
       What kinds of logs are you keeping?
       Are you monitoring uptime?
       What analytics?
       Backups!
       Testing Backups!
       Subscription to your blog?

Today the only solution is basically finding a PaaS who can offer that feature-set.

So I think a really great next article you could write is talking about getting it all live and in front of users - deploy it.</comment>


Coursera Data Science Certificate - <AUTHOR> https://www.coursera.org/specialization/jhudatascience/1?utm_medium=listingPage

<comment><USER2> :)

Open source lecture material

"These are the course materials for the Johns Hopkins Data Science Specialization on Coursera"

[https://github.com/DataScienceSpecialization/courses](https://github.com/DataScienceSpecialization/courses)

</comment><comment><USER3> Interesting, but I'm not sure about investing $150 for the first round of three classes.

<comment><USER4> Jeff here - one of the creators of the classes. The great thing we like about this is that you can take the classes for free if you want. You only have to pay if you want the specialization. More info here:

[http://jhudatascience.org/](http://jhudatascience.org/)

<comment><USER5> Jeff, I'm signed up for the entire set at the moment. It's just a matter of deciding if I want to pay for it and focus on it or take other classes (MIT is doing a data course as well this spring over with edx). If I can get my employer to pay that'd be better, not because it's expensive but because I perceive that it would be better material to add to my resume if I can say it was work sponsored.

I'd like to know your thoughts on the value of the final capstone project respective to career development?</comment></comment></comment>


The 99 Cent App Is Dead - <AUTHOR> http://blog.appboy.com/2010/02/the-99-cent-app-is-dead/ The App Store is a big place, sure … but maybe it's getting just a little too big. Maybe developers are losing sight of making sure they charge what their work is actually worth, rather than basing the factor of price solely on "I wonder how quickly we can get into the iTunes Top 10?". <comment><USER2> Link bait. Plenty of apps are still $0.99. One studio increases their price a little and they're declaring a huge change. There's no information when they made this change, I figure it must be recent.

Hardly a trend.

</comment><comment><USER3> So is this article.

</comment><comment><USER4> 99 Cent app usually have no chance at making anyone serious money.

The hardest part about selling your app these days is anyone ever finding it, not actually convincing them to fork over cash.</comment>


You can't avoid surprise medical bills even with a "PhD in surprise billing" - <AUTHOR> https://www.vox.com/2018/5/23/17353284/emergency-room-doctor-out-of-network <comment><USER2> as an insurance broker, i can honestly say this guy got lucky (after reading the whole article)

firstly, it sucks that someone else violently broke his jaw. he should sue and press charges if possible.

secondly, he was smart to go to an in-network hospital. given the circumstances of his injury, it all should have been coded under emergency care and not specialist care. either the doctor/hospital made a mistake, or deliberately coded it wrong.

In this instance, the doctor maliciously coded it wrong. then, the doctor sent him a bill for a ton of money andddd.... then the doctor gave up on pursuing the patient????

that makes absolutely no sense. usually the doctor would sell it to collections, or just take some crappy rate from the insurance company. why work for free?

ultimately he got lucky, but everyone needs to know this golden rule:

in the US-- NEVER, EVER freak out about a health care expense bill. it is literally fake 99% of the time.

if they ever do actually sue you, the judge will just push you to settle out of court for half the amount.</comment>


CVE-2020-2040 Palo Alto Networks fixes critical flaw in PAN-OS firewall softwar - <AUTHOR> https://www.bleepingcomputer.com/news/security/palo-alto-networks-fixes-critical-flaw-in-pan-os-firewall-software/ <comment><AUTHOR> [https://www.healthcareinfosecurity.com/palo-alto-networks- pa...](https://www.healthcareinfosecurity.com/palo-alto-networks- patches-6-firewall-vulnerabilities-a-14977)</comment>


US State Department begins social media screening for nearly all visa applicants - <AUTHOR> https://techcrunch.com/2019/06/01/u-s-state-department-begins-social-media-screening-for-nearly-all-visa-applicants/ <comment><USER2> [https://news.ycombinator.com/item?id=20065142](https://news.ycombinator.com/item?id=20065142)

</comment><comment><USER3> My wife mentioned this to me yesterday, and I laughed and said I guess it wouldn't have affected me anyways as I don't really do much social media (unless you count this as social media). Now I'm beginning to wonder if they'll assume you're lying if you said that, or somehow more suspicious...

<comment><USER4> Sounds like currently more of a black box to deny anyone a VISA that can't remember every website they signed up for in the last 5 years.

<comment><USER5> If you put "RT ≠ Endorsement" on your profile, you should be safe.

</comment></comment></comment><comment><USER6> > Yesterday the U.S. State Department began implementing its requirement that > nearly all U.S. visa applicants submit their social media usernames, > previous email addresses and phone numbers as part of the application > process.

> These new obstacles to immigration come at a time ...

If I understand this correctly, these are not obstacles to just immigrate to USA; these are obstacles for _visiting_ USA.

<comment><USER7> these are not obstacles for visiting USA; these are obstacles even if you are just transiting through USA.

</comment></comment><comment><USER8> IMO this is how social media ends itself. As real world consequences become less distant and people have to be more 'politically correct' where being 'politically correct' is a function of which political party is currently in charge, people will use social media less and less. Social media will just become another outlet for 'mainstream media' and sycophants.

It's been difficult to see anything positive in the social media sphere lately. I closed my Facebook account nearly 5 years ago because it just felt like a toxic influence. My reddit account nearly 6 years ago met the same fate.

These days I can only stand using Discord and WhatsApp for conversations with people I know IRL. I can't imagine my kids ever being interested in most social media sites as they've already skipped most social media services to talk to their friends directly in video games like Minecraft and Roblox and using iMessage in group conversations.

<comment><USER9> Or, this is how Facebook replaces US Customs and Border Protection.

I reckon Facebook could do a pretty good job at that. Deep network checks, location history, call logs, content history (if they're active on the sites you browse). Terrifying but through. Makes the NSA look like a nosey neighbour peeping over the fence.

</comment></comment><comment><AUTHOR> "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated..." — The United States Bill of Rights

"We hold these truths to be self-evident, that all [people] are created equal..." — The United States Declaration of Independence

<comment><USER10> The people applying are not citizens, so ʾthe people' doesn't mean those particular people.

</comment></comment><comment><USER11> I think there's likely a reasonable expectation of privacy somewhere, such as for private posts or protected tweets (which the measures FTA would not necessarily examine). At the same time, if someone's sharing their support for ISIS on Facebook, I sure hope authorities would take notice and act accordingly.

</comment><comment><USER12> I used my social media as a supporting argument for an O1 ama.

That said, _requiring_ it for everyone seems heavy handed and feels wrong. I can't quite put into words why, however.

And I bet most people who have not dealt with visas will just say "Well if you have nothing to hide ..."

</comment><comment><USER7> An interesting anecdote: Even if you are transiting through US you need a transit visa. So we were flying from Australia to Canada with a change of planes in US and we had to get an ESTA visa.

The visa application requires you to enter social media profiles for major platforms including facebook, twitter etc but there is no way for them to verify it's really yours. We did fill up ours but for my two year old toddler I just marked as no social media profile.

The lack of social media profile on one of the application meant the whole application was flagged delaying our ESTA. I would have assumed that the system would have a check to allow no social media for people younger than 13 (or 16)

<comment><USER13> I had no problem getting ESTA approved without mentioning any social media accounts within an hour!

</comment></comment><comment><USER14> I wonder if not having any social media presence would be a problem; I think that would be the more insidiuous thing. Social media posts are, effectively, _publications_ ; whether they tell you it's policy or not, it's likely that they would (and perhaps should) look.

My main concern is that they would be suspicious of people who don't publish their every thought on the internet.

</comment><comment><USER15> "Sure.. check out my blog. lemonparty.org"

... actually. We should/could setup a group collaboration site on a different shock URL that's close to this which would have plausible deniability if you gave them the shock URL.

"OMG! I mean lemonparties.org.. not lemonparty.org... WTF"

</comment><comment><USER16> Expect tit-for-tat responses from other countries for Americans trying to visit them.

</comment><comment><USER17> They already have access to 100% of social media. This is just to have a plausibly official second source.

</comment><comment><USER18> I can't tell if coming through with a B1 or B2 with globs entry is included in this.

</comment><comment><USER19> This is what happens when you believe you're the greatest country in the world and that anyone trying to visit is up to no good and just wants to overstay their visa and take advantage of your amazing system.

The reality couldn't be any further from that!

<comment><USER20> If the reality couldn't be further from that, how do you explain that nearly everyone in the world thst wants a better life comes to the United States?

<comment><USER21> Do you have any numbers to support your statement? I just looked up migration stats from the UN, and found:

1\. The vast bulk of migrants do not go to the US

2\. International share of migrants has grown much faster than the US share

The US has a large overall number of immigrants as it is a large country, but per capita many countries are taking in more. Canada takes in about 3x per capita for example.

<comment><USER22> Here is a nice info-graphic about it: [https://www.forbes.com/sites/niallmccarthy/2017/04/03/lebano...](https://www.forbes.com/sites/niallmccarthy/2017/04/03/lebanon- still-has-hosts-the-most-refugees-per-capita-by-far-infographic/#62c26eee3970)</comment></comment></comment></comment>


Show HN: Average working hours around the world (Map) - <AUTHOR> https://workingti.me/average-working-hours.html <comment><USER2> India private sector would easily be 60 to 80 hours

</comment><comment><USER3> Germany FTW!</comment>


How to Get More Women in Tech: Lessons from a Hackathon in Gaza - <AUTHOR> http://www.huffingtonpost.com/entry/585178e8e4b0320ed05a9a58 <comment><USER2> Thanks for sharing!

Two points I'd underscore: it's important to take risks to reach the inclusivity goals the organization sets, and a few individuals can make a huge difference in that commitment.

I was the leader at Gaza Sky Geeks when we decided to bring our women's participation rates to 50%. Part of what we did was require 50% women's participation at our main outreach event (a Startup Weekend at the time). That's the top of the funnel - whatever our women's engagement rate is at that stage, it'll either stay the same or drop after that (if there's bias at each selection stage against women, as founders enter incubation, then acceleration, then follow-on investment)

Some of our staff and partners disagreed with this strategy: only 30% of applicants to the outreach event were female, and their applications were indeed often worse than men's applications. Quite honestly, the main reason we stuck to the goal was because I put my foot down and said Gaza Sky Geeks would only run the event if we all committed to 50% women's participation.

What happened next? Women outperformed men at the event, winning most of the prizes. That was all organic - and if anything, we had expected the judges to be biased towards men.

The following year, we again had the same debate with our partners and our team, and again I stood my ground for this.

That's explained in this video: [https://youtu.be/vJnRy8jcac8](https://youtu.be/vJnRy8jcac8) ("How Gaza's startup community became one of the most female-inclusive in the world")

<comment><USER3> This is fascinating. If you had fewer women to choose from, and their applications were often worse, you were arguably "lowering the bar" in the name of diversity. And yet you ended up with better results in the end. Do you think that's because the skills needed for a good application weren't the same as the skills needed for performing well at the event? Or was it a team-based competition, and you ended up with mixed teams that therefore performed better? Obviously you've thought a lot about it, so I'm interested in whether you've come to a conclusion.

</comment></comment><comment><USER4> I don't understand how they can say "Ultimately, our goal is egalitarianism" and yet point #1 is "Make Women a Priority". Targets, arbitrary quotas, not holding events if 50% of the participants aren't female... does not sound like egalitarianism to me.

<comment><USER5> Oh no. Not again.

This generic objection is automatically off-topic on HN [1]. We've all heard it a zillion times, and we all know everything that comes next. What about nurses! What about coal miners! Why aren't there diversity efforts for preschool teachers! Well, there are! Well fuck you! You're a sexist, no you're the sexist. Yawn, yawn, snooze. Those of you who actually want to replay this discussion, please find a different corner of the internet to enjoy yourselves. The rest of us want respite from the tedium.

1\. This is well covered by the HN guideline that says: "Please avoid introducing classic flamewar topics unless you have something genuinely new to say about them." [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER4> Well, I _did_ support the moratorium on political posts but it got reversed and here we are again. As long as posts like this hit the front page you should expect people to point out inconsistencies in message.

<comment><USER5> This has nothing to do with the experiment we tried on political posts. It has to do with the outright ban on pointless repetition.

People come here to have their intellectual curiosity satisfied, and there stopped being anything new in any of this a long time ago. The way I see it, the options are: (1) would we like to be both bored and blared at? or (2) neither. On behalf of the community, I choose "neither".

<comment><USER4> I also tire of seeing the repetitive "let's get more X into tech!". I've quoted the article not raised points out of thin air.</comment></comment></comment></comment></comment>


RawDevJS – JavaScript raw image developer - <AUTHOR> https://www.bergnet.org/2017/03/rawdevjs-release/ <comment><USER2> Can someone explain what this is?

<comment><USER3> So images from most cameras are stored in the JPEG format, and that is after all the in-camera processing is done to it. (what the camera sees has to be corrected for stuff like lens distortion, color as a human would see it, and has stuff like sharpening applied) Two major problems with this is that JPEG is a lossy format, and the original image that was captured by the camera had a lot more information that can be used. (for example raw images are often able to be used to save blown out highlights or shadows) So professional cameras offer a "raw" capturing mode which saves that information in its own format like DNG. (which itself is pretty much TIFF + metadata) These formats aren't widely supported outside of image editors though and require manual processing before they look good. RawDevJS [0] seems to be a browser-based editor for that and the author also released other repositories such as a tool that renders DNG in the browser and a command-line converter.

[0]: [http://rawdev.bergnet.org/](http://rawdev.bergnet.org/)

<comment><AUTHOR> Thanks cooper12! Very well explained. I would be happy if somebody would join the development team. I'm very busy with other projects, but if you have a look at the further ideas I have already collected [1] this tool could be very useful for many people, not only users of DSLR cameras.

[1] [https://github.com/rawdevjs/project/issues](https://github.com/rawdevjs/project/issues)</comment></comment></comment>


Hacker News for Cats - <AUTHOR> http://cats.news.ycombinator.com.meowbify.com/

<comment><USER2> Most awesome thing I've seen all week. And far more useful than what a lot of startups are working in.</comment>


What do you think of PR? - <AUTHOR>

What do you think of PR? Necessary part of your business? Or is it all fabricated junk, and a hindrance to creativity? <comment><USER2> Read this Startups and PR Firms – The Gross Disconnect :<http://bit.ly/9DF2Yt>

<comment><USER3> Here's the non-shortened link: <http://www.pluggd.in/startup-pr-firm- strategy-297/>

There's no character limit on HN, and shorteners can be used to hide malicious links.

</comment></comment><comment><USER4> <http://www.plugin.com/2010/02/pr-should-you-do-it-yourself/>

You can do it yourself and then only have yourself to blame if things fail. Whatever you do, get your collateral edited by a professional.

</comment><comment><USER5> You should read the pg's essay about PR <http://www.paulgraham.com/submarine.html></comment>


Show HN: Algorithm for display of musical data tracks that keeps legibility - <AUTHOR> https://www.utab.com/music/xui_PvqnTt3

<comment><AUTHOR> Linear data is displayed in the top most view and the the interpolated result is displayed simulating a standard sheet paper on the bottom.</comment>


Camera+ for iPhone hits 500,000 sales just 2 days after launching Camera+ 2 - <AUTHOR> http://taptaptap.com/blog/camera-plus-hits-500000/

<comment><USER3> Tap tap tap is a legend in the App Store annals.

Good for them that Apple forgave them for openly flaunting the App Store rules.

[http://www.iphoneography.com/journal/2010/8/12/camera- banned...](http://www.iphoneography.com/journal/2010/8/12/camera-banned-for- volumesnap-hack.html)

Their small team has an incredible designer, Wolfgang, who wields Adobe CS like a wand to turn around iterations of designs in near-real time.

<http://taptaptap.com/blog/the-design-session/>

<comment><USER4> There's very few companies out there that can take a standard iPhone built application and have it replaced with something in the App Store. tap tap tap has built a product that has replaced the default Camera on my phone and my wife's.

<comment><USER5> To be fair, Apple frequently doesn't allow competition (like with Mail, Messages, Phone, etc).

</comment></comment></comment><comment><USER6> To clarify, this is 500,000 sales for the lifetime of the app, and not just the past 2 days.

</comment><comment><USER7> All of these camera Apps - Hipstamatic, Instagram, Camera+ - <USER2> popularity. I think that the iPhone is now clearly attacking the "photography" vertical as well as the "games" vertical. I expect Jobs to spend a significant part of his next iPhone roll out describing in more detail the attention they are paying to photography on the iPhone based on recent App Store results. Also looking for a big upgrade in the (already quite useable) camera.

Must be miserable news for the point n' shoot vendors.

</comment><comment><USER8> I bought this assuming that it had the volume control wired to take the photo, and was slightly disappointed that it didn't. I know the back story, but assumed that as that was surely the main point of the app, that this version would have it as well!

Nevermind, it's not bad anyway!

</comment><comment><USER9> The new version Camera+ is a great update but I cannot seem to find HDR. Does the new version lack HDR?

<comment><USER10> Correct, it does lack HDR. There's an HDR filter, but it doesn't come close to HDR shots from the default camera app.</comment></comment>


Commercial Pilot Catches Photos of Secret Chinese Missile Test - <AUTHOR> https://theaviationist.com/2017/07/29/commercial-pilot-catches-remarkable-photos-of-alleged-secret-chinese-anti-missile-test/ <comment><USER2> I would think this would be a better link. Its pilot's own words too [https://jpcvanheijst.com/blogs/2017/07/596970-rocket- launch-...](https://jpcvanheijst.com/blogs/2017/07/596970-rocket-launch-over- china)

<comment><USER3> Agreed, and the other articles there also make excellent reading. The avationist blog does add content, though, notably a photo taken from the ground by a Chinese blogger of the same event.

<comment><USER4> There's this link in the "pilots own words" post: [http://liuqiankktt.blog.163.com/blog/static/1212642112017624...](http://liuqiankktt.blog.163.com/blog/static/121264211201762495336818/) (scroll down for ground photos, appears to be the source for the photo in the aviationist post)

</comment></comment></comment><comment><USER5> "It is important information since it not only avoids the extremely remote possibility that an aircraft may be hit by part of a vehicle used in a launch test"

Did I miss something on mobile? Is this sentence just left incomplete? Did anyone else find this confusing?

<comment><USER6> It is incomplete. Most likely the result of editing a longer passage.

</comment></comment><comment><USER7> So.. what am I looking at? What's with the bubbles? I thought it was a droplet on the lens or something. Could someone with more knowledge of this stuff tell us what we're looking at?

<comment><USER8> I don't know the details, but it's the exhaust gases from the rocket spreading (in near-vacuum they can spread many kilometers) and being lit up by sunlight. There was a similar plume over San Fransisco from a Trident missile test a while ago: [https://www.theverge.com/2015/11/12/9720728/san-francisco- mi...](https://www.theverge.com/2015/11/12/9720728/san-francisco-missile-test- ufo)

I'm guessing the bulb-shape from the first stage is because the gasses spread further at higher altitude.

</comment></comment><comment><USER9> what are the legal implications/risks for this pilot? any risk if s/he ever flies through china in the future?

<comment><USER10> Likely none even that this is China.

</comment></comment><comment><USER11> Something needs to be done about China, they could end the situation in North Korea instantly by stopping trading with them. The fact they don't, combined with their aggression in the South China Sea is telling. Sanctions or tariffs should be placed, there are plenty of 3rd world countries with cheap labor.

<comment><USER10> China doesn't want million of Korean refugees crossing into China.

It doesn't want a true humanitarian disaster on scales rarely seen before in history.

And NK is a good distraction that China can pull out of its pocket anytime its own activists in the area are getting too much scrutiny.

<comment><USER12> Seems short-sighted, as in the winding down of the Kim Juche dynasty through a planned-for and managed process seems more attractive to China than those million+ refugees fleeing North Korea en masse because we went back to a shooting war.

In fact there is absolutely no real reason for China not to begin this effort immediately with or without the assistance of partners, given how their leniency has allowed NK to develop ICBMs and the fact they'll face the tidal wave if they fail to act to remove the NK regime. What happens if the fail to prepare and a war between NK/US happens? They're still going to be dealing with the refugees.

The US is not going to suffer a NK that and and does threaten nuclear attack as a foreign policy.

<comment><USER13> "...given how their leniency has allowed NK to develop ICBMs..."

The issue is that North Korea's atomic and missile programs were helped along by Russia. That's where the technical assistance all came from, at least initially. So China, and even the US for that matter, really had no way of stopping that. The Russian involvement is a fact that is generally glossed over by policy makers because there is little you can do to stop Russia.

What's surprising about the Trump belief that China could have stopped Russia, is what it says about Trump's foreign policy acumen. It betrays either Trump's lack of knowledge about the history of the North Korean program, or his naiveté with respect to the extent of China's power.

<comment><USER14> "After listening for 10 minutes, I realized it's not so easy," the president told the Journal. "I felt pretty strongly that they had a tremendous power [over] North Korea. ... But it's not what you would think." Trump.

[https://www.google.co.nz/amp/s/www.vox.com/platform/amp/2017...](https://www.google.co.nz/amp/s/www.vox.com/platform/amp/2017/4/12/15279654/trump- north-korea-xi-10-minutes)

</comment></comment></comment></comment></comment><comment><USER15> Yay! Lots of secrets everywhere...</comment>


The NSA's Massive Computer Clusters In Utah Are Failing Due To "Arc" Explosions - <AUTHOR> http://techcrunch.com/2013/10/08/the-nsas-massive-computer-clusters-in-utah-are-failing-due-to-arc-explosions/

<comment><USER2> Thirty years ago there was a not-dissimilar problem on the Superconducting Super Collider (SSC) project, a pre-LHC particle accelerator (much larger than the LHC; the Higgs field could have been detected twenty years ago if it had been completed) in Texas. Fire ants ( _solenopsis_ ) got into electrical boxes and caused no end of problems. Arc faults are one result. Located as it is in the desert southwest, _solenopsis_ infestation should be investigated as a possible cause.

</comment><comment><USER3> hope it is not sabotage</comment>