Tell HN: Google now requires SWEs to take part in company citizenship activities - <AUTHOR> This is a throwaway account that I created.
I work as a SWE at Google. The official SWE role expectations were recently amended to include citizenship contributions such as interviewing, recruiting, mentoring, and organizing extracurricular events. It is now mandatory for SWEs at higher levels to make these contributions, however it does not list any specific requirements.
This seems like another major blow to the company culture. I simply can't see how this will result in anything other than a further watering-down of any remaining pockets of good engineering culture within the company, as engineers no longer have the option to simply focus on getting good work done.
HNers, your thoughts? <comment><USER2> Interviewing, recruiting and mentoring are good work. If you want to be nerd in a corner, stay junior.

<comment><AUTHOR> It's harder to take pride in that kind of citizenship work when your company keeps making these kinds of top-down decisions.

<comment><USER2> I agree, it's harmful, there should be other career paths that don't require it. But from the perspective of the employer, it's way more economically valuable. I think that's when you know it's time to go to a smaller company.

<comment><AUTHOR> I agree that it is time to leave.

</comment></comment></comment></comment><comment><USER3> I would expect interviewing and mentoring to be a job responsibility at any large engineering organization.

<comment><AUTHOR> The mentoring part is specifically for areas outside of your team's work.

<comment><USER3> Maybe I'm missing some implication here. What do you mean by areas?

<comment><AUTHOR> For example, suppose you work on the Search for Android team, under Search. You might work to train others in Search and others in Android as part of the work on Search for Android. Those don't count as citizenship, because they are directly related to your work.

You'd have to mentor people outside of that area, such as mentoring new hires in general, not as part of your job role.

<comment><USER3> That sounds like it would improve engineering, not water it down. Information spreading between people like a DAG, rather than a tree. Unless the "mentoring" is bulloney.

</comment></comment></comment></comment></comment><comment><USER4> Don't you think you have other stuff to offer? Like guidance, developing the skillset of others and learn along the way?

</comment><comment><USER5> Volunteer to work on a committee to overturn this policy.

</comment><comment><USER6> The actions Google has taken over the last 3 years are far different than in the past. Something is wrong with the organization as a whole.

Last week, Google donated to the Salvation Army[1] here in Seattle (a group that fights against LGBTQ+ rights) yet Google claims to adhere to the GSBA Code of Ethics that bans such behaviour[2]

Google has also chosen to fund climate change deniers[3] over the last year.

1 - [https://mynorthwest.com/1540117/google-gives-1m-for- seattle-...](https://mynorthwest.com/1540117/google-gives-1m-for-seattle- salvation-army-homeless-shelter/)

2 - [http://www.thegsba.org/membership-sponsorship/standards- of-e...](http://www.thegsba.org/membership-sponsorship/standards-of-ethics- conduct)

3 - [https://www.theguardian.com/environment/2019/oct/11/google-c...](https://www.theguardian.com/environment/2019/oct/11/google- contributions-climate-change-deniers)

<comment><USER5> You could volunteer at Salvation Army, which does a lot of good work, and piss off the cancel culture jerks.

<comment><USER6> Why would I volunteer for an organization that thinks my future husband and I should be arrested and either chemically castrated (like Alan Turing) or committed to an asylum?

<comment><USER7> That doesn't seem consistent with their stated stance on the LGBTQ+ community:

[https://www.salvationarmyusa.org/usn/the-lgbtq-community- and...](https://www.salvationarmyusa.org/usn/the-lgbtq-community-and-the- salvation-army/)

<comment><USER6> That site does not cover the Salvation Army's political activism wrt LGBTQ+ rights. Take a look at: [http://www.abc.net.au/am/content/2012/s3532177.htm](http://www.abc.net.au/am/content/2012/s3532177.htm)</comment></comment></comment></comment></comment>


Ask HN: Previous article where the author AB tested his ending email statement  - <AUTHOR>

I'm trying to track down the article, but for the life of me can't remember what it was titled.
The premise was that the author upped his client responses by changing how he ended his initial contact emails. For example, if I recall correctky, he moved from writing "Let me know if there's anything I can do for you," to something much more directed (i.e. "This is the next step we should take").
Does anyone recall this article? <comment><USER2> [https://news.ycombinator.com/item?id=7156630](https://news.ycombinator.com/item?id=7156630)

<comment><USER3> [http://letsworkshop.com/blog/the-email- line/](http://letsworkshop.com/blog/the-email-line/) The email line that's client repellent

<comment><AUTHOR> Excellent. Thanks!</comment></comment></comment>


A Hunger for Tomatoes - <AUTHOR> https://bittersoutherner.com/a-hunger-for-tomatoes-shane-mitchell <comment><USER2> I've never grown tomatoes commercially, but growing up on a farm my dad didn't believe in allowances and therefore always found us work to make money. There were few jobs because the area was so rural, so most of his ideas revolved around growing and selling various crops.

I earned the money for my Commodore 64 by raising and selling sweet corn one summer. Growing sweet corn for market is its own special kind of hell. The silk of the individual ears have to be sprayed with insecticidal oil several times during the growing season to prevent corn worms from getting inside the ears, making them unsalable. This is accomplished with a backpack sprayer, basically a ten-gallon water tank you carry like a backpack, with a spray head and a pump handle to pressurize it. Corn fields at full growth are murder to walk through. Corn ears are abrasive at best, and if you catch them right they cut like a serrated razor. And there's always morning glory climbing the stalks, meaning you have to push through; it's what I imagine walking through rain forest must be like. The corn is high enough that there's no wind, and the stalks actively produce humidity. Then there are the ticks and chiggers.

All in all, that was the hardest job I've ever done. And at the end of the summer I cleared $200. Which was enough for the C64, but it worked out to be like 25 to 50 cents an hour.

I never looked down at physical laborers after that, and farm workers least of all. And I also went to college, and the fact that this was a privilege that most of the kids I grew up with didn't have was not lost on me.

<comment><USER3> How do those industrial sized farms do the spraying for corn worms - is that crop dusters?

Your story reminded me of the recent reporting on the attempt to replace Mexican migrant farm workers with American high school kids in the 1960's. [https://www.npr.org/sections/thesalt/2018/07/31/634442195/wh...](https://www.npr.org/sections/thesalt/2018/07/31/634442195/when- the-u-s-government-tried-to-replace-migrant-farmworkers-with-high-schoolers)

<comment><USER2> The industrial guys are likely using some sort of broad pesticide, so they don't have to specifically target the silk on each ear. There are special tractors with really high clearance and sprayer arms that are often used.

[https://goo.gl/images/9ozRxC](https://goo.gl/images/9ozRxC)</comment></comment></comment>


North Korean hackers are working with Eastern European cybercriminals - <AUTHOR> https://www.reuters.com/article/us-usa-cyber-north-korea/north-korean-hackers-are-working-with-eastern-european-cybercriminals-report-idUSKBN1YF1KA <comment><AUTHOR> report itself: [https://labs.sentinelone.com/the-deadly-planeswalker-how- the...](https://labs.sentinelone.com/the-deadly-planeswalker-how-the-trickbot- group-united-high-tech-crimeware-apt/)</comment>


Yes, the Screen Is Tiny, but the Plans Are Big - <AUTHOR> http://www.nytimes.com/2007/06/17/business/yourmoney/17mobile.html?ex=1339732800&en=5e00963ccd20816b&ei=5088&partner=rssnyt&emc=rss <comment><USER2> Summary: ESPN, MTV, etc., producing video specifically for mobile phones. Didn't read the rest.</comment>


Cambridge Analytica whistleblower used same Facebook dataset for own startup - <AUTHOR> https://www.buzzfeed.com/ryanmac/cambridge-analytica-chris-wylie-eunoia-trump-campaign <comment><USER2> I don't know why I don't trust this Christopher Wylie. They way he is pictured, filmed etc. looks over produced, like he is trying to lie to me. I can't put it in words but something is fishy about him. In one of his interviews I found out that CA has sue him, so he did not care about anything, he did something wrong to CA, they sue, he blows the whistle to save his __*. Is not about "oh, I care so much about the data of millions of people and I can't live any more with the guilt", its about his own skin. If its your own skin that you care about please don't picture in a victim/tormented soul, it makes me hate you just for that.

<comment><USER3> Agreed. And did you see how he died his hair and changed his look to be more edgy when he got all this media attention? It's like he is playing some role and maximizing his media exposure. This is the behavior of a sociopath.

It really is looking more and more like the real story here is about a guy that tried to usurp his puppet masters with a technique that was likely oversold and probably couldn't really deliver what he claimed it could do, based on his limited understanding of machine learning and statistics.

The next best thing in his twisted mind is to become a "national hero", probably taking a card from Julian Assange and various other whistleblowers. I do think that most whistleblowers have positive intentions and what they do, they are doing for public good, not for notoriety or personal celebrity. However, I don't really feel that to be the case with Christopher Wylie. In his interviews he definitely gives me a strange gut feeling and I'm glad to see I'm not alone in this sentiment. I'm sure we will find out more facts about him as this whole thing continues to unfold, but I'm not holding my breath as to his intentions.

The silver lining in all of this is that Facebook and others will be forced to treat privacy seriously for a change, and its always good to have this conversation front and center for a change.

<comment><USER4> To be fair, it is wise to think critically about one's own appearance when faced with a large amount of media attention.

<comment><USER5> I don't think he thought critically.

<comment><USER6> Or, he thought critically, just not about the stuff we would think a good actor would think about. Which is sort of the problem, and would explain why people are put off.

</comment></comment></comment></comment></comment><comment><USER5> And that is why you _never_ let such data off your premises in the first place. Who knows how many copies there have been made by now. Remember that AOL stuff that was online for a couple of hours? It will never go away.

A pretty good source of very interesting information is the OpenRTB interface to your average advertising bidding platform or company. A couple of bucks and you too could be bidding for ads. If you bid low you will get _all_ the data you could possibly imagine and you can keep it even if you lose the bid. All you need is a good story and a couple of bucks to keep the exchanges satisfied.

<comment><USER7> > And that is why you never let such data off your premises in the first > place.

I find it a much more defensible policy to _not collect_ such data in the first place. Regardless of who you share it with, the fact that _you_ have the data trove is dangerous enough.

<comment><USER5> Yes, totally agreed, that's the preferred approach. Unfortunately most start- ups seem to be under the impression that more data is better because that worked so well for everybody else. But let's hope it is not too late to turn the tide on that. Between Equifax and Facebook some people are waking up. Not enough of them yet but who knows.

Start-ups should start to see data as a liability instead of as an asset.

<comment><USER8> Equifax and Facebook may have PR black eyes right now, but they have made a shitload of money with their data and they continue to make money.

It's going to be really hard to convince businesses that data is a liability when the costs of data problems have not typically come anywhere close to offsetting the revenue made with that data.

Data might be better thought of like a type of inventory, in that it is an asset on the balance sheet, but has costs and risk that must be managed very carefully to maximize profitability. Because these costs and risks show up in the paperwork, manufacturers work to minimize their inventory even though it is technically an asset.

Or maybe another way to think about it might be a hazardous natural material, like oil or mine tailings. Accidental release is always a PR problem, but the only way direct costs are imposed on the business is via lawsuits or a regulatory enforcement regime. Otherwise the public just soaks up the costs of the breach.

Ultimately I think that the way data enables revenue is a new thing in business and although we can find analogies, the best way of accounting (I mean in the technical financial sense) for data is yet to be determined. I just think it's unlikely to be considered a straight liability.

</comment></comment></comment></comment><comment><USER9> What's the point of this article, to try to discredit him? He's already discredited. The whistleblowing doesn't require his trust, it's true or it's not. We already know he's not trustworthy, and surprise, he did it (at least) twice.

<comment><USER10> I posit that its a beautiful piece of artwork designed as a honeypot. The sweetness that will draw certain people in is all of the conflicting, and therefore inherently controversial information that can be used to paint Facebook and Christopher Wylie as the true problem here, and the incredible Donald is just the poor guy caught up in the middle.

This is evidenced by the conservative media's discrediting of all of the people telling the story. I don't even contend that Buzzfeed is conservative or liberal, so I think Buzzfeed is either an unwitting accomplice in this honeypot, or perhaps it is their pot. Time will tell.

My thesis is that, just like actual honeypots, the sweetness is coverfire for the trap lying inside. That trap is to frame this whole story as if the most heinous part of the story is just Facebook losing control of the data. Once the key players admit to the microtargetting, but claim everybody does it, the jaws of the trap will spring shut.

Some of those players have already made their confessions, literally on Fox News, a week after the election, and they couldnt contain their joy:

[https://www.youtube.com/watch?v=_fFbVwuU8bM](https://www.youtube.com/watch?v=_fFbVwuU8bM)

It is obvious that Donald Trump intuitively understands the general concepts at play in microtargetting, but also just as obvious that he doesn't understand its mechanics.

Microtargetting is literally a deep learning algorithm, and Cambridge Analytica is a Robert Mercer affiliated outfit. You may remember Robert Mercer from such travesties as high frequency trading. After all, he invented it, and used it to become a billionaire. Microtargeting is to humans as high frequency trading is to investment markets.

The underlying principle is the same. If you can glean information about your target faster than your competitors, you can act upon that information to your own gain. Microtargeting is literally a computer evolving its algorithm to influence the targetted. It is A/B testing what will unite one half of an electorate with the reddest of red meat policies, which by definition induce panic in the other half of the electorate.

Cambridge Analytica has cracked the code on how to divide or unite people with an algorithm. I'll leave it as an exercise to the reader to figure out which one they are aiming for.

<comment><USER11> > I posit that its a beautiful piece of artwork designed as a honeypot.

Ok, but designed by whom? It seems interesting but tbh sounds a bit conspiratorial. Who is setting this elaborate honeytrap the CIA, the British, Buzzfeed, Mueller?

</comment></comment></comment><comment><USER12> In the original whistle-blowing interview the whistle-blower (Wylie) says that he was the one which initiated this whole project:

> At 24, he came up with an idea that led to the foundation of a company > called Cambridge Analytica

> It was Wylie who came up with that idea and oversaw its realisation.

> Alexander Nix, then CEO of SCL Elections, made Wylie an offer he couldn't > resist. "He said: 'We'll give you total freedom. Experiment. Come and test > out all your crazy ideas.'"

> But Wylie wasn't just talking about fashion. He had recently been exposed to > a new discipline: "information operations", which ranks alongside land, sea, > air and space in the US military's doctrine of the "five-dimensional battle > space"

<comment><USER13> Yeah... There's a certain imprecision with the use of the term "whistleblower" here.

It's far closer to the immunity a mobster informant might get (although it's obviously not (yet) playing out as a criminal matter)

</comment></comment><comment><USER14> I have a sneaking suspicion this guy is a plant or something for the C.I.A. or NSA. The interviews I have heard, he starts to ramble on about Russia, and making bizarre connections. There is such lust for a ward with Russia it is nuts.

<comment><USER15> CA would have identified that you clearly have a combination of "openness" and "neurotisism" that predisposes you to conspiratorial thinking

</comment></comment><comment><USER16> I haven't been following this stuff super closely, but hasn't there been ongoing counternarrative of how CA data analysis and its 50 million profiles may not have been very useful, period? Because there's a concurrent (and legitimate) narrative of Facebook's questionable data practices, I've been wondering whether CA has been an overhyped antagonist in our media's rush to find the true villains.

Yesterday Drudge Report (still one of our biggest news drivers) had a headline [A] that almost made my eyes roll through the back of my head. It was "WHISTLEBLOWER: FACEBOOK CAN HEAR YOU!" But the linked story [B] contained nothing more than Wylie speculating how it was physically possible for Facebook (and other apps) to do this, but they probably weren't, but if they _were_ , it could lead into some bad shit or something.

Yeah, Wylie can't control what linkbaiters write about him. Or what politicians ask him in a public hearing. But because he was a whistleblower about CA's abuse of FB's data, he's been considered an expert/whistleblower in domains far beyond what he actually has experience in. Being a good data analyst and having a bunch of FB scraped data is still not enough to remotely guarantee success in the startup scene.

In terms of the election, what's the most substantive discussion/proof that CA and its magic data was any more a game changer than, say, Brad Pascale [0]? And I also haven't read out CA's insights were a gamechanger in boosting the Russians' alleged propaganda and fake news bots schemes. I haven't yet read a better reporter on this angle than the New Yorker's Adrian Chen, and his relative reluctance to blame big data/bot schemes has perhaps made me too skeptical every time I read media stories about CA's magical mind-bending dataset [1].

[A] [https://pbs.twimg.com/media/DZVzHctU8AAZBxa.jpg:large](https://pbs.twimg.com/media/DZVzHctU8AAZBxa.jpg:large)

[B] [http://web.archive.org/web/20180328111429/https://pjmedia.co...](http://web.archive.org/web/20180328111429/https://pjmedia.com/trending/cambridge- analytica-whistleblower-facebook-may-listening-home-work/)

[0] [https://www.washingtonpost.com/news/politics/wp/2018/02/27/t...](https://www.washingtonpost.com/news/politics/wp/2018/02/27/trumps- facebook-advertising-advantage-explained/)

[1] [https://www.newyorker.com/tech/elements/a-so-called- experts-...](https://www.newyorker.com/tech/elements/a-so-called-experts- uneasy-dive-into-the-trump-russia-frenzy)

<comment><USER13> The doubts about CA's real-world effectiveness are actually well-represented in the media, as your example or [0] show. This actually closely follows the a similar news cycle right after the election. I distinctly remember reading several articles casting doubt on CA's effectiveness in The New York Times and The Atlantic.

I also don't think many reports actually assert that CA was responsible for, say, a 10% swing. Why people are taking this serious is, I believe, because we now know that it's possible to get such data and we have seen the sort of feats that machine learning can do today. It's doubtful that CA was the company to successfully combine those two ingredients. But without changes it's all but guaranteed that _someone_ will soon will.

Plus there is the fact that the election just happened to be incredibly close. You can make a list with about ten possible reasons for the result, from people being tired of Hillary, to the FBI's strange moves regarding the e-mail investigation, third-party candidates, russian trolls, the free media Trump got, Cambridge Analytica, and probably the weather in eastern Ohio. It's possible that the absence of any two or three of these would have changed the outcome.

[0]: example: [https://www.vox.com/science-and- health/2018/3/23/17152564/ca...](https://www.vox.com/science-and- health/2018/3/23/17152564/cambridge-analytica-psychographic-microtargeting- what)

<comment><USER10> Lets imagine you developed a Deep Learning algorithm that proved beyond a shadow of a doubt to be able to pull off what CA pulled off. Why on god's green earth would you ever tell people that you have the algorithm, if you could instead use it for your own benefit? Why would you ever publish?

<comment><USER17> Answer A: in the case that you think you can publish at just the right time such that every political party would have enough time to master the tech before the next election cycle.

Answer B: in the case that you can charge exorbitantly for access to the published algorithm, and that - being a rational actor without nationalistic pride - you don't give two hoots and a holler what happens to the nation where you publish, so long as you can walk away with a fat paycheck.

<comment><USER10> The true power in microtargeting lies in the iteration speed achievable by computers. As with any effective weapon, if you can wield yours faster than your opponent, you will emerge victorious in the normal case. This is the same principle at play in High Frequency Trading. And just like High Frequency Trading, which was pioneered by the chairman of Cambridge Analytica, Robert Mercer, the less competition you have, the less entities that can usurp your temporal advantage. There is no "mastery" of this technique, only being able to do it faster than everyone else. Thus, there is no balance lent by proliferating the algorithm, as I see it.

I guess as an irrational actor, which we all are as humans, I would either seek one of two outcomes, neither of which resulted in giving away the algorithm. If I felt no moral qualms empowering someone else with this ability, then that is the same lack of qualms to use the ability for myself. If I were so inclined, I could use this technique to make that fat paycheck, and never have to walk away. This technique is effective in many fields beyond elections. In the situation I'd walk away, it would only be to suppress the work, in the hopes it stays undiscovered.

</comment></comment></comment></comment></comment><comment><USER18> any source thats more reliable than buzzfeed?

<comment><USER10> Do you have context to add to the story, or just more reasons to look somewhere else, preferably away from this story?

<comment><USER18> i don't like giving buzzfeed clicks and when i share stories with people i like to give sources that preferably isn't buzzfeed. kinda makes it less credible.</comment></comment></comment>


The early 2013 retina MBP 15" have faulty firmware/hardware - <AUTHOR> http://aniggler.tumblr.com/post/44586267125/the-early-2013-retina-mbp-15-have-faulty <comment><USER2> The 2012 15" rMBP had considerable bugs in the SMC and UEFI that took half a dozen firmware updates, several dozen OS X seeds, and the better part of a year to resolve. I had a particularly nasty bug where any time I unplugged my Mac from the charger, 5 seconds later it would go to sleep _though it was still open and I was actively using it_. You'd have to shut the lid and re- open it for it to wake again.

I also had the infamous ghosting issues, though my LG panel was decent enough that I put up with it for a few months. Luckily, when I took it in to get the entire upper clamshell replaced, there was a new part number in stock literally the day before that had apparently resolved the problem.

I've purchased a dozen or so MacBooks since the original Unibody and countless iPhones, iPads and other minor Apple products — it is my opinion that engineering quality has gone down over the past two years considerably.

As for the issue TFA refers to - it does not plague my 2012 rMBP and I'm sure Apple will, sooner or later, issue a patch to fix it. It's just a question of whether you believe they still have their shit together or not.

(awesome song, btw!)

<comment><USER3> I _still_ have the "goes to sleep 5 seconds after unplugging" bug and I've installed all updates and am running the latest version of everything. And have done SMC and NVRAM resets. How were you able to fix this?

<comment><USER4> My wife's 2012 11" MBA has this same issue, it's not related to just the MBP line.

</comment></comment></comment><comment><USER5> But have they fixed the problems with the previous generation? I have a couple issues with my 2012 retina MBP. These are all corroborated by others on Apple's support community:

* LG panel ghosting

* Graphical glitches in Safari

* Audio clicks, pops and stutters when using Intel graphics

* Power manager issues: Sometimes it'll drop to sleep when I unplug the magsafe, even though the laptop is in use. Sometimes it has trouble waking from regular ("closed lid") sleep - maybe every other week I have to go as far as holding down the power button to force a power off to get it back.

I haven't been to an Apple store because I can't be without my machine for a week or however long it'll take to fix, and it sounds from the discussions forum that many of these problems have no fix, or it's random if you'll get a new part that works right or not.

<comment><USER2> See my top-level comment.

* Graphics issues are fixed in 10.8.3 (still in beta). It appears that the drivers have been rewritten from scratch, this was the worst beta seed series I can recall for any OS X release, ever, with new seeds days apart, seeds that were completely broken, kernel and graphics driver instabilities, etc. The latest seed is much improved and should address this issue.

* LG panel ghosting: I had my clamshell replaced a few months ago. There was a new part number, it has been officially "fixed."

* I have hisses and pops when listening via headphones, but not over the speakers

* Power management: _Finally_ fixed with latest firmware updates + 10.8.3 + reset NVRAM/PRAM _and_ SMC. Firmware updates plus NVRAM [0] and SMC [1] reset will likely fix it for you.

0: <http://support.apple.com/kb/HT1379>

1: <http://support.apple.com/kb/HT3964>

<comment><USER6> Apple's DACs have hissed for a long time. My 2010 MBP had the same problem. They just use shitty DACs.

<comment><USER5> The problem I'm having with the retina isn't just hissy/poor quality. The audio literally cuts out or lags for a fraction of a second, causing very audible crackling. First time it happened I thought I had ripped a CD incorrectly, it sounds like a CD with scratches in it. And it disappears when you disable the intel integrated graphics and switch to the nVidia.

<comment><USER7> Interesting... I have a problem with a Mid 2011 iMac where the audio does the same thing. It's an i7 so I was pretty certain that I wasn't pegging the CPU; I chalked it up to a problem with VLC but perhaps there's more to it than that.

</comment></comment></comment></comment></comment><comment><USER8> I just spent 1 hour today at the Apple store and talking to Apple care getting my brand new (2 days old) 15 Retina MBP replaced. It kernel panicked on me and bricked itself. The only sign of life is a slight hum of a fan when I try to power it on.

It's the first Apple product I've bought but I can't shake the feeling that this frequency of bad hardware is becoming normal.

<comment><USER9> > _It's the first Apple product I've bought but I can't shake the feeling that > this frequency of bad hardware is becoming normal._

Probably because you haven't experienced the overheating G4 Cubes, the liquid cooling dripping G5 Pros, the frequently crapping out on the motherboards iBook G3, the wheezing MacBook Pros, and tons of similar stuff.

There's even a saying that goes as far back as 2002: NEVER buy Apple 1gen product (like the Retina was) --or at least be cautions. Wait till the put the second generation in the market.

So nothing to do with "declining quality" as such. All new models have some ironing out of issues to do, and all models will have some problematic runs. Same thing in the PC world, be assured, just that noone buys 3 million of the exact same PC model, whereas in the Mac world they do.

<comment><USER10> > overheating G4 Cubes

I'm not sure that anybody ever had that issue. Mine has been in constant use since it's purchase, and it's never once had overheating issues, even in 40c+ ambient temperatures. Even if it did, there's a dandy little slot in the bottom for adding a fan if you choose.

<comment><USER11> [http://www.pcmag.com/slideshow/story/294758/10-gadgets-we- co...](http://www.pcmag.com/slideshow/story/294758/10-gadgets-we-could-ve- lived-without/5)

> It had some major overheating issues that produced miniscule cracks in its > porcelain body. Another major flaw was that it didn't have a fan, so users > had to shutdown every so often and let the vent breathe. Apple stopped > selling the Cube within a year of its release.

<comment><USER10> I don't believe the "shutting down" bit. My stock Cube runs constantly, shuffling backups, processing logs and performing health checks. It's uptime is around 4 months now, and was almost 2 years before I moved to a new apartment.

</comment></comment></comment></comment></comment><comment><USER12> Why worry about this when the LG panels have horrible ghosting? I had to have mine replaced, and luckily got a Samsung panel (this was on the original Retina 15" hardware, though apparently this happens elsewhere too).

I've had lots of problems with Apple hardware over the years, most of it dealt with very well by Apple, but the panel ghosting was by far the worst.

I'd open Gmail, read email for 2 minutes, then flip to my terminals on another desktop and could still read my email. Yuck.

</comment><comment><USER13> This doesn't surprise me at all.

I've had so much Apple kit pack in on me it's unreal. It got to the point I dumped it all and switched to a 5 year old Lenovo unit which has been flawless.

While they look pretty, I'm not sure the engineering is sound or you're getting good value for money.

<comment><USER14> My anecdote masquerading as evidence: I have not had problems since the original two generations of Intel laptops. I think the engineering is great!

</comment></comment><comment><USER15> Soooo... Apple hardware being rushed and having quality issues. What else is new exactly?

This is probably what happens when you spend more money on lawsuits than research.

<comment><USER16> That's exactly what is new, though. A couple of years ago they had much higher quality computers (and the RAM wasn't glued in). Every time I see a post on here about Apple I mention this: I think they are pushing to get into the market of people that don't know how to use computers at the expense of their customers that do.

I used to buy Apple and recommend it. But they fucked up, they are increasingly trying to prevent developers from creating apps for their OS's without getting their approval first. Fuck that, that is anti-competitive and anti-freedom. I now recommend Android to people, but I am looking forward to Ubuntu phone (shopping lens and all :) ) and FirefoxOS as hopefully better alternatives.

</comment></comment><comment><USER17> I have a 2012 model with the 256 hd - I just downloaded and played the song and no fans came on.

Did have a dead pixel show up in my display but apple fixed that for free. Also it does get too hot for lap usage sometimes.

Other than that this is the best computer I've ever used. Pretty much every other computer I've use now seems slow and pixelated.

<comment><USER2> Re: heat. My problem is that when the fans of my 2012 rMBP are whirring, _the heat emanates from the keyboard_ which is.... odd. It's not something I'm used to, and irks me to no end.

<comment><USER18> That's more or less happened with every Macbook Pro I've used since 2009.

</comment></comment></comment><comment><USER19> i got my mbp 15 (ordered online) begin of february - it worked for 5 days then it was done.

i already noticed that i had big fan issues, and wondered about it, because co-worker has the same model and has no issues with the fans, and normally they only start when he is gaming, what is ok.

so i had some problems, but said "okey"... on day 5 i went afk from my mbp to play a round of fifa13, when i came back, i had a black screen and only saw my mouse courser, reboot showed flickering apple-logo, dir-icon, etc.

i tried everything to get my system back (after 5 days had not started with time machine) - no chance at all, the sdd was done...

my luck: in the next city we have an apple store, so i made an appointment for the next morning went there, they tested again the ssd, because i guess the normal case for them is: THE CUSTOMER IS STUPID, OTHERWISE HE WOULD NOT PAY THAT MUCH MONEY FOR THAT CRAPPY HARDWARE...

after the "genius guy" noticed that the ssd was crashed, he was like "ok i guess on the retina the ssd is not changeable anymore...let me talk to my boss what we can do for you, so that you get your mbp in 1-2 days, because its not ok then it will take 2 weeks on a 5 day old mbp until u get it back"

15 mins later he came back, and was like "ok it is possible to change the ssd, and we have one here..."

he changed it, reinstalled osx and i payed 0,00 - left the building...

since then i never heard anything back from my fans (only when i'm playing www.heroesofnewearth.com =D )

p.s.: it is my first mbp, and i really pissed already, all my co-workers have apple products too, and everybody is getting pissed and more pissed from day to day...apple hardware is getting crappy...

</comment><comment><USER20> Discussion on the Apple Forum (more useful than the original link): [https://discussions.apple.com/thread/4735947?start=210&t...](https://discussions.apple.com/thread/4735947?start=210&tstart=0)

</comment><comment><USER21> My friend got incredibly excited about the Retina MacBook and ordered one on the day of release. He has already been through seven of them. Yes - seven. And it wasn't even the screen each time - loose hinge, broken keyboard, SSD died.....you would have thought that in a machine for so much money they would've sorted this out.

</comment><comment><USER22> Can someone explain to me why that file causes the issue to occur?

</comment><comment><USER23> I can confirm this as well. I have a mid-2012 MPB retina with a 500.28 GB APPLS SSD SM512E (vs. the author's SD512E) and the fan has recently acquired a life of its own. I can understand it going berserk when the CPU is busy, but this happens even while its utilization is below 10%.

 _Very_ frustrating. Paid $3k for this machine and use it mainly for Pro Audio recording, so the noise really hurts... Wanted to buy a Mac Pro instead but, alas, last year's update was a joke. It's getting really hard to be a customer of Apple's high end machines, even for someone who likes their stuff and is gladly willing to pay.

</comment><comment><USER24> just to add a counterpoint to this classic everything sucks on the internet thread:

no issues at all with a 13" 2012 MBAir. best machine I've ever owned, had Lenovos in the past. Last Thinkpad bluescreened sometimes when connecting a USB headset. The Air? Nothing has brought it out of step so far, which for a former Windows user, is simply amazing.

<comment><USER25> Same here, tried reproducing the issue without any success. Also, I can express the same feelings towards my 13" 2012 MBA - best machine I've ever had.

<comment><USER26> Third'd. Mine has been dead nuts reliable; no problems, no regret spending the most I have ever spent on a laptop.

</comment></comment></comment><comment><USER27> If you are going to post online about a problem with an Apple product, I personally believe that it's a good idea to also file a bug (<http://bugreporter.apple.com>) and include a bug number in your post. Doubly so if you submit it to HN.

It is possible that there are people who work at Apple that read HN and if you post a bug number one of those people might then be able to open the bug.

</comment><comment><USER28> When I first bought the MBP 15" retina, my screen started ghosting. I got it replaced 3 times. Even though its an issue that was resolved with an update the staff at the Apple store told me they will not consider it to be a problem unless a certain amount of reports of it have been filed, so if you have the problem, report it, get your laptop sent in because they need laptops that produce this problem in order to fix it.

</comment><comment><USER29> Maybe your MacBook is fan of dubstep ;)

I'd say the audio is leaking into the fan controller, and your dubstep just happens to contain the pattern that's sent to the controller to signal spin up. the controller probably uses some simple serial bus protocol, maybe i2c.

Edit: For people who are more adept at peeping at the song's spectrum: on the Apple forum people report the fan speedup to occur at 0:28, 1:47, 2:05/2:10, 2:30, and 3:50

</comment><comment><USER20> I was supposed to buy one this week. Now I'm scared...

<comment> rkuykendall-com You're scared that one model has a bug where you play a specific song in a specific media player, the fans spin more than they should? and it can be fixed with a firmware update?

You scare easily.

<comment><USER30> I have been considering an upgrade, but have been more worried about getting an LG screen with awful ghosting.

<comment><USER31> I had an LG with really bad retention - I took it to an Apple store where the rep saw the issue. Two days later I picked it up and haven't had a problem since. It was very easy to get it replaced and is great for coding for me.

<comment><USER30> Thanks for the data point!

I have a 2009 mbp (matte screen! ;_;), and the retina seems like the best display to upgrade to from the matte for 'staring at text for hours'.

</comment></comment></comment></comment></comment><comment><USER32> After 4 Apple Macbooks since 07: never buy the first gen of any Apple hardware.

</comment><comment><USER3> I'm running iTunes 11.0.2 and it won't even let me add this file to my library. It won't attempt to play via Quick Look from Finder, either.

</comment><comment><USER33> 2013 MBP 15" 256GB (APPLE SSD SD256E Media). Downloaded the song and right around the 1:47 mark the fans started going crazy :\

This also happened to me after I purchased the MBP and started it for the first time, about an hour in. Out of nowhere it just started spinning the fans to the max. Has been over a month without it happening, but this song made it do the same every time.

<comment><USER34> I made a video of the problem: <http://www.youtube.com/watch?v=ly0Sp7lMKJU>

</comment></comment><comment><USER35> I've been using the retina MBP 15" heavily since its release. I noticed the fan for the first time last week when I was booted into Windows.

There are other issues with the machine—notably the screen flicker and ghosting that others have had issues with—but I wouldn't worry about this.

</comment><comment><USER36> Weird. Never had hardware problems with Macs like those being reported here. Worst I ever got was hard drives dying and a ram module going bad.

My sister had a bad MBP from about 5 years ago that just kept having all sorts of problems though. Bad batteries, like 3 replacement mobos, bad hard dive, etc.

I think hardware issues might just be a batch based crapshoot.

</comment><comment><USER37> The last link is apparently the source of your information but it is not referenced as such. Why not?</comment>


Random Numbers from Astronomical Imaging (2005) - <AUTHOR> https://www.cambridge.org/core/journals/publications-of-the-astronomical-society-of-australia/article/random-numbers-from-astronomical-imaging/5F41FF42864F2774A47A0B4B09A43989 <comment><USER2> > _Abstract This article describes a method to turn astronomical imaging into > a random number generator by using the positions of incident cosmic rays and > hot pixels to generate bit streams. We subject the resultant bit streams to > a battery of standard benchmark statistical tests for randomness and show > that these bit streams are statistically the same as a perfect random bit > stream._

An honest question, but couldn't the exact same results be achieved with a simple USB webcam pointed at... well, anything?

<comment><USER3> In both cases you'd need to know some properties of the distribution to get a random bitstream.

Which pixel would you be looking at? Below what threshold would you call it a 0 rather than 1? How long till you can confidently say next reading will be uncorrelated?

I don't know how the astronomical imaging solved these (and TBH cosmic ray scanning seems a bit overkill to me too).

<comment><USER4> USB webcams get hit by cosmic rays, too. This paper is interesting because it's not just looking at the low bits of a normal image, but rather at at exceptional events. It's a different sort of random.

</comment></comment></comment><comment><USER5> This is very interesting, I love exploring all the "weird" sources of entropy such as random number generators based on background radiation (easy to build if you don't mind playing with high voltage), ones based on radio white noise (easily tampered with) and others.

However my favorite is probably: a Nokia N9 + a laser pointer: [https://www.sciencealert.com/physicists-have-created-a- quant...](https://www.sciencealert.com/physicists-have-created-a-quantum- random-number-generator-from-an-old-nokia-phone)

<comment><USER6> You might enjoy this: [https://en.m.wikipedia.org/wiki/Lavarand](https://en.m.wikipedia.org/wiki/Lavarand)

<comment><USER5> I did enjoy that, thanks!

</comment></comment></comment><comment><USER7> Interesting : The book "His Master's Voice" by Stanislaw Lem depicts astronomical imaging tapes as random number generator in use by mathematicians and other professionals, until one of them sues the observatory for a lack of randomness in the tape he received. Turns out the was a signal in there after all, triggering a fascinating scientific investigation (and setting the whole plot of the book into motion)

</comment><comment><USER8> Why not just take the least significant bit and build the random stream from that?

As the comment from matt_walfeck suggests:

> couldn't the exact same results be achieved with a simple USB webcam

Random radiation flipping the least significant bit of the CMOS sensor should be enough. If you're really worried about randomness, you can combine several streams (XOR) and get an even distribution of bits.

<comment><USER9> You won't get a perfect (~8 bit per byte) entropy required for a good PRNG just by getting the least significant bit of the CMOS sensor (or an ADC), as it will always have some kind of bias.

<comment><USER10> There are standard techniques to remove (eg DC) bias from such bit streams.

</comment></comment></comment><comment><USER11> Actually this is what I believe in life :) I believe, seed reference point of the random theory is stars and that's because most of the times astrology is accurate.</comment>


Many Academics Are Eager to Publish in Worthless Journals - <AUTHOR> https://www.nytimes.com/2017/10/30/science/predatory-journals-academics.html?action=click&contentCollection=science&region=rank&module=package&version=highlights&contentPlacement=2&pgtype=sectionfront&_r=0 <comment><USER2> We shouldn't call them "predatory journals", instead we should use words like "journals of convenience". After all, many of those involved profit.</comment>


12 reasons why your app won't scale - <AUTHOR> http://blog.scalingo.com/post/149073816358/12-reasons-why-your-app-wont-scale <comment><USER2> I agree with most of their points, but their assertion that "writing files to disk is one of the slowest operations you can do" is laughably wrong. File IO is optimized to the extreme and cached on many layers from the IO library all the way down to the hardware.

I assume the writer is only familiar with synchronous disk IO which is ironic considering the mention of asynchronous programming.

File IO is one of the fastest operations if done right and some popular databases even use the OS cache instead of their own, MS SQL server is the only database I'm aware that doesn't.

I seriously question the authors knowledge of what it takes to "scale" if they think file IO is going to slow you down</comment>


Honeywords: Making password-cracking detectable - <AUTHOR> http://people.csail.mit.edu/rivest/honeywords/

<comment><USER2> Since the whole system turns on having a hardened system which can distinguish honey from true passwords, it seems like you could get a _significantly_ improved level of security by replacing it with a hardened system that hashes passwords with a secret, long pepper, which vastly increases the amount of time necessary to crack even trivial passwords.

The alarm trip is nice, but if you assume that you have a hardened black box that you can put data into and get data out of, you could use that to increase the complexity of the given hashes to a degree that they would be uncrackable (offline) in the first place, and standard throttling (and alarming) makes online brute-force attempts trivially detectable and blockable.

Assume that you have a user whose password is "1234", and the salt is "5678". Let's assume the system is naive and uses SHA1 for hashing.

Given these two pieces of information, that password is trivially crackable. Not a problem. However, let's now assume that we take our password and feed it to our black box, which hashes it with a 1024-bit pepper, and feeds the resulting hash back to the web app. Assuming the pepper's secrecy is protected, the password's complexity is now so ridiculous that even with all the computing power in the world, you wouldn't be able to brute-force the hash for the password "1234" before our sun explodes.

Now your passwords are mathematically protected against breach, which is arguably more valuable, since it means that the attacker can't take my email address and my six honeywords + real password and plug them into various sites trying to get a hit - those other sites won't know which are the honeywords, and won't trip any alarms when the wrong ones are used, but given the tiny quantity of passwords to try, attackers are sure to get hits. Why not just prevent them from ever discovering a usable password in the first place?

Or, if you wanted the honeypot aspect to be preserved, make your black box take a password, perform some transformation on it, then hash it. For each user, we'll generate and store (in the black box) a one-time pad that we use to transform (/encrypt) their password, then hash it. Password complexity isn't affected, but without the pad, the original password is unobtainable. My bad user uses a 4-character password "abcd" which maps to "hvz5", which I then hash. An attacker who steals the hash list can brute-force "hvz5" easily, then attempt to log in with it, and my system can detect an that the attacker is attempting to log in with a transformed (and thereforce, obviously derived) password and raise the alarms. The system allows for detection of compromised logins without ever risking exposure of the user's actual password to an attacker.

<comment><USER3> Argh. The whole concept of "peppers" begs the question. If you can keep attackers from learning a "pepper", keep the attackers from learning the password hashes too. Problem solved.

The reality is that attackers learn password hashes when they pop a database. They don't get them from XSS attacks an they don't get them from CSRF bugs. When attackers pull password hashes, they've got the database. When attackers get your database, they have your server. It's over. Stop pretending. Your database server has vulnerabilities, even in the (extraordinarily unlikely) event that you've configured it perfectly so that the ability to issue a SQL query doesn't hand over the filesystem to an attacker. But more importantly, your app server has a whole new class of vulnerabilities once it can't trust the database anymore.

People who talk about relying on secret keys in their password hashing schemes are doing the world a disservice. Just use a strong adaptive hash and move on.

<comment><USER4> > When attackers get your database, they have your server.

Could you please link me to more info on this escalation vector?

<comment><USER5> I don't have it in the context of an escalation, but if they can get the database to make a new stored procedure,

[http://www.mssqltips.com/sqlservertip/1263/accessing-the- win...](http://www.mssqltips.com/sqlservertip/1263/accessing-the-windows-file- system-from-sql-server/)

then they can usually do a very large amount of things

</comment></comment></comment></comment><comment><USER6> If the Honeychecker system has to be secured in order to guarantee that the whole system is secure, why not store the encrypted passwords there in the first place ? It seems to be manufactured complexity.

<comment><USER7> If you keep the encrypted passwords in one "secure" place and the honeychecker in another "secure" place, then the system is secure unless _both_ systems are compromised.

It's classic engineering redundancy.

<comment><USER4> Except that:

A. It doesn't do a lot to 'secure' the password credentials (in the way most people think of the term). It just tells you that someone tried to login with a honeywords. What happens then is a difficult process.

B. It's only belt-and-suspenders redundant to the extent the difficulty of cracking the honeychecker server is independent of the regular login server. It's certainly beneficial that it has a much simpler API, but if your honeychecker is just a different Ruby Gem hosted on a different Linode (for example) the benefit are lessened.

</comment></comment></comment><comment><USER8> This is such a simple, yet powerful idea. What an elegant way to add another layer of security to a system. It's very easy to generate long random passwords that no user would create on their own. Then to populate the database with a large number of these phony passwords. There would be a small hit based on the amount of space the honeyword passwords occupy. However, the amount is manageable, and the benefits are well worth it.

<comment><USER9> _long random passwords that no user would create on their own_

Really? You see the ones my IronKey comes up with... I have about 140 of them. IMO anyone using a password manager is pretty likely to be generating long, random passwords, or they're Not Doing It Right.

<comment><USER10> I am working on a replacement for password managers. Type a password, then [Ctrl] + double click the field to hash it. Even if the database is compromised, an attacker is unlikely to assume your plaintext password is a base64 hash. <http://deckar01.github.io/SHA512JS/>

<comment><USER11> Personally, I suspect the Right Way to do this is for W3C to standardize a special input field something like:

        <input type="passhash"/>

which looks like a normal password entry field but automatically does some clever hashing on the client to create a per-site password.

Of course, you can still get keylogged if you use a public computer or whatever.

</comment></comment></comment></comment><comment><USER12> I didn't go to MIT, so I may just be talking out my ass here, but here goes.

While I think this is a good step in the right direction, there is no technological solution for the real problem:

AVERAGE USERS ARE IDIOTS

They use dictionary passwords. They write them down on post-it notes. They re- use passwords.

Try as we may to enlighten people. They are still stuck in their ways. The only thing we can really attempt to do is force people to add complexity (#1).

Security is only as strong as its weakest link. I'm glad that companies take my security seriously, and I hope this idea catches on to strengthen that security. But it's only a small step overall.

<comment><USER13> Users aren't idiots. They're trying to get shit done, and these stupid and arbitrary rules about passwords are hindering their ability. They're stuck in their ways because holding the computer's hand is a waste of time.

Forcing them to add complexity has already failed, because fundamentally it's not a humane solution to the problem.

<comment><USER14> This times a lot. I'm far from a naive user, but I recycle a handful of easily memorable passwords for most of the services I subscribe to. And I'm willing to bet that most of you do too.

Security is a tradeoff, and we tend to forget that complex, unique passwords have a very real cost. They drastically increase the risk that I will lock myself out of some service, and dramatically increase the workload of authorizing myself when I do want to use it. With a few obvious exceptions, this tradeoff is a huge net loss for the average user.

In other words, the risk of some stranger wanting to post as me in HN is acceptably small. The cost of having to install KeePassX, then download my passwords file from Dropbox then decrypt and copy/paste, then make sure the paste register is clear, then securely delete my passwords file every time I borrow a friend's computer is prohibitively high.

<comment><USER4> Just write your passwords down in a safe place.

<comment><USER15> Real question: assuming you live alone is 'next to your computer' eg in your own home considered a safe place? What's the risk of a physical robber stealing bits of paper next to your computer desk then hacking your accounts?

<comment><USER16> "A safe place" really depends on your threat model.

If you live in a place where home entries by persons with an interest in your online accounts is common, then no, your home would not be a safe place. This could include: living under an oppressive nondemocratic regime, living in a democratic regime with broad search and investigation rules, living with your snooping parents, having an ex with (authorized or otherwise) access to your home, roommates, roommates friends, being a highly social person hosting parties and not being able to secure your computer area.

Among others.

A friend tells doing consulting work with a national diplomatic corps in a foreign country, using his personal Linux laptop, had the device scanned on his exiting the country by a known, trusted, and competent security expert. Several surveillance mechanisms were detected.

The offices of faculty and staff at major universities associated with that foreign country are also subject to surveillance software, according to the same source. Those offices and the buildings they are in, as well as the associated computer networks, are generally readily accessible.

Computers are complex enough, even for sophisticated users, to be difficult to secure completely.

An advantage of physical, nondigital records of passwords is that they provide a much smaller attack surface. Computers (especially always-on systems) can be attacked from anywhere on the Internet (at least in theory). A slip of paper concealed in some out-of-the-way place in your home is much less likely to be found, though unless it's encrypted, it's much more likely to be useful if found.

<comment><USER4> Yes, if your adversary has physical access to your home, your computer, or other methods of installing backdoor software on it then the question of password security is rendered moot.

You can't have a secret and type it on a compromised computer too.

<comment><USER16> My point wasn't to moot the question.

My point was to put the question in its appropriate context: it _really_ depends on your threat model. And if that model includes those whom you'd prefer not acquire information having ready access to your house, then no, it's not safe.

Similarly: if that's not a problem for you, it's a perfectly reasonable practice.

That said: I'd probably try to find a slightly more obscure and/or secure location than in plain sight.

Your threat model _matters_. It includes possible attackers, their modes of access, likeliness of access, the assets you're trying to protect, and how they might be used in ways damaging to you. Any significant discussion or assessment of security should be framed in this context, and it's very much generalizable beyond online, electronic, or data systems.

<http://en.wikipedia.org/wiki/Threat_model>

<comment><USER4> I completely agree it depends upon your threat model. But I find the term 'threat model' isn't that useful when a simpler answer is possible. The term is great for leading you to ask more questions.

One huge advantage of the paper system is people have thousands of years of collective experience dealing with the security of paper documents. For example, the 4th Amendment to the US Constitution reads "The right of the people to be secure in their persons, houses, _papers_ , and effects, ... shall not be violated...".

The question "is it safe on my desk next to my computer?" illustrates how users tend to discount their own experience and common sense once computer security gets involved. This is certainly reasonable from the users' perspective. We've all had absurdly counterintuitive experiences with computers, heard astonishing stories about hackers, and gotten plenty of nonsensical advice from the 'experts'.

<comment><USER16> _I find the term 'threat model' isn't that useful_

It's domain-specific language. It is a model. Of your threat profile. Of risks, exposures, etc. Understand the concept, it's useful.

 _One huge advantage of the paper system ..._ Paper has _many_ advantages. I own a great deal of paper. I love paper. It's tremendously stable.

It's also hard to search, expensive to duplicate, and carries a risk of single-copy loss. Even misplacing (without destroying) a document can be a crisis.

Those are all parts of the paper threat model.

Your mention of the fourth amendment brings up s great many other issues, and I won't discuss them, but generally pointing in the direction of:

Are electronic records "papers", and in what contexts and locations are they treated as such.

Do protections against unreasonable search protect against warrented searches? Or warrantless searches?

As for practical experience: I've had some in the areas of which I write here.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> It's a good idea but avoiding collisions with genuine passwords could be tricky particularly for sites with millions of accounts. If the honeywords are very long and random, then they probably won't collide but they will be obviously different from a typical users password. If you add a standard prefix or an extended character that is disallowed for real user passwords, that avoids collisions but also makes the honeywords easy to filter out. If you generate the honeywords by swapping around the characters in a real password then theres a danger that a user could set off a false alarm with a simple typo in their password.

<comment><USER18> The generator shown will produce random variants on passwords it's fed, so it shouldn't be easy to filter them out. False alarms should be easy to avoid - stick 100 honeypot passwords in the database, and set off the alarm if say, 10 of them are tried within a week. Obviously those numbers can be tweaked according to password strength, number of users, etc.

Edit: It's actually talking about a specific set of honeywords for each user. So when the password is chosen, you generate a set of honeywords that are quite different from that password, and can't be reached by mistake.

</comment></comment><comment><USER19> Maybe i'm crazy, but I really hate PDFs. Why don't people at least provide an HTML or text copy next to their PDF?

<comment><USER20> That's how academic papers are done. One reason is that it's more complicated to do mathematical equations and such in HTML (we don't even talk about text) than it is to simply use LaTeX.

<comment><USER19> I understand the need for proper formatting in academic papers, but it wouldn't hurt anyone to provide a text copy after the fact.

If someone needs a formula they can render the pdf. But a secondary text copy can be more easily indexed, searched and viewed on any kind of text-viewing device... it's just a million times more convenient.

<comment><USER21> It "hurts" in that it takes time. It's also not just math, but figures as well - diagrams and experimental results. There are automatic Latex-to-HTML programs, but their results are not pleasant. And I have difficulty putting up things that are ugly.

<comment><USER22> a standard PDF _is_ ugly to the 99% of readers who aren't going to print it out.

<comment><USER21> That doesn't hold for the people who would read my papers - other researchers. We read pdfs on our screens all the time.

</comment></comment></comment></comment></comment></comment><comment><USER23> Listen carefully, that is the sound of foreheads being slapped.</comment>


Withal – an API that make it easy to create referral programs - <AUTHOR> https://withal.co/ <comment><USER2> Signup submits a form to Formspree, no account gets created.

So you get added to a waiting list.

[https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html) "Blog posts, sign-up pages, and other reading material can't be tried out, so can't be Show HNs."

</comment><comment><USER3> Looks interesting, when is this coming out?

<comment><AUTHOR> The beta is live! We'll do a full rollout in the next week or two. Sign up for early access :)</comment></comment>


Scientists can now keep brains alive without a body - <AUTHOR> https://thenextweb.com/science/2018/04/25/scientists-can-now-keep-brains-alive-without-body/ <comment><USER2> >What happens when you wake up inside of an environment of complete sensory- deprivation? If scientists determine that 'normal' brain activity can continue outside of the body, by EKG for example, is it a form of unlawful imprisonment to keep someone "alive" in that condition without their expressed consent?

Well this is just disturbing. a real life purgatory.

<comment><USER3> Sometimes even consent doesn't work very well. Roald Dahl described just this situation (for a human) back in 1959 in this story: [https://en.wikipedia.org/wiki/William_and_Mary_(short_story)](https://en.wikipedia.org/wiki/William_and_Mary_\(short_story\))

</comment></comment><comment><USER4> Could they put the brain in a cyborg body...and extend life ad infinitum that way? Seems to me this might be the ticket to immortality.. Way better than downloading your brain, just move it to an indestructible vessel.

<comment><USER4> If this were Reddit that'd earn gold. Brilliant idea. I mean the brain is what we are essentially... If we just ditched the bodies and stored our brains forever, my mind is blown by this. This would be a great company to start, would probably get tons of funding by sv too. We could still experience life especially if we can create bodies that feel like human ones. Even immortals could get hot by a bus, but not if the brain is miles away in a nuclear bunker...

</comment></comment><comment><USER5> This is truly nightmare material. I shudder to think how this could be used to extract information from someone once the tech progresses to where it's possible to communicate with these brains.

<comment><USER6> I think we'd soon find out that a brain without a body operates very differently than when the brain is in the body. The brain relies on the body's sensory organs for much of its decisions, how can it compute things when these are removed?

And also - if we managed to extract data from a brain, could we hold someone guilty for what we pull out? Would the brain say different things than the mouth? Which one is correct?</comment></comment>


Spherical 360-degree video, on a budget - <AUTHOR> http://www.airpano.com/Articles-AirPano.php?article=101606&set_language=2

<comment><AUTHOR> This is the rig that was used to film the videos included in Der Spiegel's coverage of the recent volcanic activity in Kamchatka:

[http://www.spiegel.de/international/world/four-volcanoes- eru...](http://www.spiegel.de/international/world/four-volcanoes-erupting- concurrently-on-kamchatka-peninsula-a-880777.html)</comment>


Licensing photos through 500px became a rip-off - <AUTHOR> https://blog.kareldonk.com/licensing-photos-through-500px-became-a-rip-off/ <comment><USER2> I think there's a good chance a text analysis would determine this page is porn devoted to anal sex. I just mean it is a bit much how often it is described, broaden your range of metaphors please.

<comment><USER3> What metaphors would you prefer folks use for describing the scale and depth of disenfranchisement and disempowerment that corporate copyright lobbies have inflicted upon the artistic community at large? In addition to anal sex, the author also mentions leeches and fraudulent business practices.

<comment><USER2> I'm not particular, I just think instead of 4 graphic references to anal sex and one reference to the corporate leaches as cock-sucking maybe could drop a couple anal sex references and find something non-sexual to relieve the tedium.

<comment><USER4> Clearly the author would never be caught doing any of that homosexual stuff!

<comment><USER2> and uh the metaphors were obviously about non-consensual anal sex so it was just weird to keep on the same theme.

</comment></comment></comment></comment></comment><comment><USER5> I have a few photos on various sites for years. Overall might have earned a few € but nothing actually reached my account as of course these type of sites have payout minimums.

I'm not a professional photographer and have a good income, so don't care too much personally. But the exploitation of the people doing the actual work is just unbelievable. I'm split between putting my photos online for free (CC0, CC-BY or CC-BY-NC whereby I assume the 'NC' is anyway 99% of the time ignored), or alternatively to just not share and leave it to the professionals...

Is there even any good photo sharing & licensing site left?

\- Flickr sells merch based on your CC0 (or -NC) images. \- Zooomr disappeared too quickly to ever achieve any of its aims \- 500px apparently also is criminally exploitative now. Mostphotos maybe?

Is there any site left for hobby photographers or professionals to share work on their own terms and/or possibly license them?

<comment><USER6> Smugmug?</comment></comment>


JSFM – A JavaScript Library to write codes in Java style architecture - <AUTHOR> https://github.com/anoopchaurasia/jsfm

<comment><AUTHOR> JSFM is a JavaScript framework ([https://github.com/anoopchaurasia/jsfm](https://github.com/anoopchaurasia/jsfm)) that enables a developer to write codes in Java style architecture - the way key features in Java behave, such as Inheritance, Abstraction, Polymorphism, Encapsulation, Constant, & Static. ECMAScript 6 is also coming up with similar feature set that have already been implemented in JSFM.</comment>


Teaching programming, RUR-PLE, and Rurple NG (Python syntax for kids) - <AUTHOR> http://www.lshift.net/blog/2009/08/13/teaching-programming-rur-ple-and-rurple-ng <comment><USER2> Cool... except for the name. How about something pronounceable (you know, for kids). Logo in python syntax with missions- exactly what I'm going to need for my kids.</comment>


Ask HN: jetBlue's site is down, last minute ticketers? - <AUTHOR>

So, is it all the people getting last minute tickets?  I wonder what type of monetary effect this is having on them, might help justify building more scalable solutions... <comment><USER2> This wouldn't happen with (language of the month) plus (random no-SQL database). Why didn't JetBlue think about scalability in the first place.

</comment><comment><AUTHOR> Any other airline sites down?</comment>


Group sex app leaks locations, pics and personal details - <AUTHOR> https://www.pentestpartners.com/security-blog/group-sex-app-leaks-locations-pictures-and-other-personal-details-identifies-users-in-white-house-and-supreme-court/ <comment><USER3> I've reported a bug like this in an application that deals with a similarly sensitive topic— They managed to call me back in 30 minutes (I never gave them my number) and had it fixed in a few hours.

I did contact them via every medium I could find, not just email. Obviously, the response these folks got from the company should have told them they were talking to the wrong person, and they should have been more vigilant in attempting to contact the right person.

<comment><USER4> How often do the researchers get paid for doing this sort of work?

<comment><USER3> An early stage company doesn't have much to pay you with, but they're thankful for the help.

From my perspective, protecting the data of 10k users was just as important as— or more important than— protecting the data of 1.5m users.

I feel bad when people assume negative intent. I don't think anyone at this company wanted to violate the privacy of their users— they just didn't get the message through the right channels.

<comment><USER5> > protecting the data of 10k users was just as important as— or more important > than— protecting the data of 1.5m users

care to elaborate on a logic behind that?

<comment><USER6> One line of reasoning is that the everyone will know about companies leaking data of millions, so they can take steps to mitigate, whereas probably no one will know about a leak like this and just live unaware

</comment></comment></comment></comment></comment><comment><USER7> Isn't it irresponsible for pen test partners to publish the maps with the location markers with such details as they did in London?

It's a good example of how concerning this is but they should have shown fake data there since this is still user's private data...

<comment><USER8> That is basically the middle of London. I expect hundreds of thousands of people pass through the area in the screenshot every day. The density of people there is so high that the location really can't be linked to anyone specific. Plus it is real time location so you can't distinguish if this is a person's home, someone at work, someone checking the app while sitting on a bus, etc. This location data would be much more dangerous if it was showing the manually entered addresses of users, a screenshot of an area with a low density of people, or if you had constant access and could identify patterns of locations to identify individuals.

<comment><USER9> To be devil's advocate, since London is _coated_ with CCTV some bad actor (think state or organisation with access to said CCTV) here could probably combine the location timestampw with CCTV images and identify people.

I am sure some civil servent could argue that know if people in "positions of power" were using suchs apps that opened them up bo blackmail and that they should be therefore checked as aprecaution.

<comment><USER10> If you've ever had a crime committed against you in London you'll know just how useless the CCTV can be. The quality is often so bad you can't really get anything useful from it, and in many cases the camera isn't even on/working/recording to anything.

<comment><USER11> I had my bike nicked a few weeks ago in London. Turns out the council installed new HD/4K cameras that very morning right where I left it - <USER2> managed to ID and arrest the perp, and charge him with multiple other thefts too.

So it looks like the crappy cctv is getting an upgrade

<comment><USER12> Did you get the bike back?

<comment><USER11> Unfortunately very little chance of that, long sold

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> all of this makes me wonder when - not if - there's going to be House of Cards style blackmail + intrigue when it comes to leveraging data leaks like these over politicians or influential people.

"vote for this or we expose your $recent_embarrassing_breach data" is quite a powerful ultimatum, no? and the only way to win is not to play (e.g. never download + use a potentially embarrassing app), and we know that many aren't so digitally savvy, so this seems like a gold mine for nefarious uses.

i dunno, maybe it's too tin foily but it feels inevitable.

<comment><USER14> After this latest spiral down in the degradation of politics I feel like that kind of information would nearly be a badge of honor. When your highest seat of the government does pr0n stars, well, the bar is pretty low.

<comment><USER15> Maybe for the type of person that 'rises' to political office, but regular people probably still care quite a bit.

<comment><USER16> Do regular people care with their words or with their votes? Because if it just words then how much care is there? As Mitch McConnell's office has stated recently, "Boys will be boys."

Isn't that an informal assessment of American culture?

<comment><USER17> Certainly not of corporate culture. People get fired for stuff like that all the time. Johnah Friedland said the n-word and had to step down from Netflix and he didn't even use it in a racist context. He only said the word as he listed offensive words.

Weird sex stuff can certainly be used to affect people in powerful corporate positions.

</comment></comment></comment></comment></comment><comment><USER18> Maybe I didn't have enough coffee yet today, or maybe I'm just missing something entirely, but.... this whole report talks about how the web API leaks user data, right? Yet all I see in their examples are HTTPS requests. Doesn't that require that somebody already infiltrated either a client device (scope limited to single client), or a central server? How did they man-in- the-middle/decrypt this HTTPS traffic?

True, if a web cache (not under exclusive control of the company) can be queried for this data by a 3rd party, it sure is a big problem. But that is rather an operational fuck-up more than it is a fundamental design flaw.

How did these pen testers get access to server requests, inside the HTTPS traffic with 3fun's servers? I'm curious how they got access to this info. I'm also curious why nobody else appears to be asking that question. Did I read the article too quickly and miss something that explains how they did that?

<comment><USER19> They're just querying the API.

The data they are examining was meant so the app knows how many people are "in your area" .. but instead of just giving you some vague information, it's giving you the exact coordinates of other users, and identifying info about them.

<comment><USER20> Really, one could argue it's not even "leaking" data about other users, it's just delivering that data to you per your request. "Leak" kind of implies at least disclosing info about other users was not your intention, whereas this seems more like "Delivering".

<comment><USER21> > "Leak" kind of implies at least disclosing info about other users was not > your intention

That's the whole point - it's not uncommon for (very) junior programmers to not understand the difference between client and server-side validation. This is absolutely a leak.

</comment></comment></comment></comment><comment><USER22> Isn't ~35 days very short for a responsible disclosure timeline? This is extremely sensitive info and from the blog post it sounds like they didn't even warn the company that they were planning to disclose it.

edit: didn't notice the article does mention the problem was fixed before publishing, although they don't say how well it was fixed

<comment><USER23> > 3fun took action fairly quickly and resolved the problem, but it's a real > shame that so much very personal data was exposed for so long.

<comment><USER22> Ah thanks I missed that on first scan

</comment></comment></comment><comment><USER24> I'm just waiting for the day when Tinder is down in popularity, security fixes are a bit more lackadaisical and a zero-day exposes a decade of personal preferences of a large share of the population, not unlike a nuclear waste leak. Imagine the awkwardness when a coworker finds out you swiped them left (or right).

And no, I am not going to end this with a paternalistic or moralistic statement.

<comment><USER25> > Imagine the awkwardness when a coworker finds out you swiped them left (or > right).

This really doesn't seem like that big of a deal to me.

</comment></comment><comment><USER26> I thought "pentestpartners" was writing a self post-morem based on that company description

<comment><USER27> Thank God I'm not alone

</comment></comment><comment><USER28> Penetration testing a group sex app.

I'm surprised it hasn't been done before.

<comment><USER29> I certainly chuckled at the combination of the title and the domain the article is hosted at. pentestpartners sounds like it could be the name of a group sex app...

<comment> xkcd-sucks "penetration testing" is my new euphemism for "early stage dating"

</comment></comment></comment><comment><USER30> What reading this it crossed my mind that a part of this is a result of too much frontend code. Here in exposing the location for distance purpose.

</comment><comment><USER31> Interesting, that's the second dating app with a data leak today - Lovoo also has one, though the data is not as fine as here. [https://www.heise.de/newsticker/meldung/Dating-App-Lovoo- Nut...](https://www.heise.de/newsticker/meldung/Dating-App-Lovoo-Nutzer- koennen-leicht-geortet-werden-4492446.html)

</comment><comment><USER32> Reminds me of a similar submission a while ago: [https://news.ycombinator.com/item?id=18029078](https://news.ycombinator.com/item?id=18029078) Shame that they transmit sensitive information like that in a URL param in a plaintext.

</comment><comment><USER33> I agree that the ineffective privacy setting is broken, but I feel like an app which has as part of its functionality finding users near you, naturally needs to tell others your location, and vice-versa. I assume any app which asks for GPS permissions is going to phone home with your location.

<comment><USER34> "There's someone within a mile of you" and "here's their coordinates down to ~30 feet, and their supposedly private photo, and their birthday" are very different bits of info.

</comment></comment><comment><USER35> That's a great example for lack of understanding of the sex app between great UX to the risks the user face when all those features are in the app

</comment><comment><USER36> Very funny: A security issue in a group sex app is reported by penetration test partners. It could have been the name of the app.

</comment><comment><USER37> there's a group sex app? brilliant!

</comment><comment><USER38> I doubt it is good for society for such apps to exist in the first place.

<comment><USER39> I am curious... Why do you think so?

<comment><USER38> The app is promoting and is a manifestation of what a National Review essays calls our

Our Childless, Childish Culture By MADELEINE KEARNS August 8, 2019 3:34 PM [https://www.nationalreview.com/2019/08/our-childless- childis...](https://www.nationalreview.com/2019/08/our-childless-childish- culture/)

In the Western world and Asia, fertility is below replacement world, and in the Western world, the fraction of children born out of wedlock, who do worse than children of married couples by any measure, is rising. So I think working on something like eHarmony is much more moral than the app discussed in this thread.</comment></comment></comment>


Twitter Comes Alive With Realtime Activity Streams - <AUTHOR> http://techcrunch.com/2011/08/10/twitter-activity-streams/

<comment><USER2> It's interesting that Twitter seems to be getting a similar backlash to what Facebook did when they launched the News Feed, and look how that turned out. Some people loved it, some people hated it (a lot), but I can't imagine Facebook without it today.

This is going to change how people interact with Twitter, moving from one single place to consume to two, I'm curious how that will work out. I don't think I'd look at it all that often, it just feels like another place they will eventually cover with ads.

</comment><comment><USER3> I really, really don't like it. It's like bringing a mini News Feed to Twitter, and the layout just doesn't work for me. I'll try to give it a chance, but my early impressions are that it's just a messy, cluttered News Feed implementation.

<comment><USER4> I agree. I think the problem is Twitter already _is_ a "news feed", it's user provided though. In 99% of cases I don't care if x follows y, whereas on Facebook if x is now friends with y "Hey, I might know Y! Oh, they're someone from high school I haven't spoken to for years!".

It feels unnecessary and irrelevant to Twitter.

</comment></comment><comment><USER5> I used to think that this content (the new activity feed) being hard to get was an intentional, thoughtful design. It felt nice in contrast with using Facebook, which gives me an unpleasant feeling of everybody observing every single action I make. Turns out Twitter sees it as a missing feature.

</comment><comment><USER6> It's just one of those things that people say it's not a good idea then get used to it. However, it does provide a great way for spammers to get into your activity stream. It also gets in the way of twitter's casual model of following and un-following when you raise the visibility a notch.

</comment><comment><USER7> Every time Twitter announces a new feature I grit my teeth, clench my sphincter and rasp, mostly to myself, "What. About. Spam."

It mystifies me that they're content to do so little as this slowly but surely erodes the quality of the Twitter experience. Between scale and spammer volume, I get that it's not an _easy_ problem. But give me something, here.

<comment><USER8> It is a tough problem, I'm pretty aggressive about using the 'block and report as spam' option on TweetDeck, but every so often an account that I've thought was trustworthy will start spewing links that "Make Money Fast".

Why just this afternoon, an iPhone dev who works for a YC funded company...

<comment><USER7> Ha. Indeed. I don't even know how my account got hijacked. Pretty unsettling.

<comment><USER8> Given what they did to my browser (I followed the stupid link, in part b/c of who it came from) I'm guessing you hit a booby trapped page while you were logged into twitter.

But that's a theory for which I don't have direct evidence, merely the unreasonable effectiveness of their browser hijacking.

</comment></comment></comment></comment><comment><USER9> The activity stream just feels pointless for me. Favourites, I don't care, if it's worth me reading then they can retweet it. Retweets, they show up in my stream, if I want to see them specifically I could under the old system thanks to the specific retweets page. Who my friends start following just isn't interesting, and just wastes the space.

And I disagree with TechCrunch's "oh, people hate change, they're not thinking rationally" theory. When newtwitter beta launched last year (I guess 11-12 months ago, can't quite remember) I thought it was cool for about ten minutes, then hated it, and switched back to original twitter, where I stayed until the move was forced last week. In the week I've been using it solidly, I still hate it. And I'm not exactly on my own, EVERY friend I have that uses twitter either moans regularly about newtwitter, or has switched to an external client to avoid using it. Sure, that's a bunch of specific cases not an overall study, but it shows it's not a rare opinion to have.

</comment><comment><USER10> Buh, here I thought they fixed the "2 more tweets, click to reload" to automatically reload.

We don't need more distractions.</comment>


What Open-Access Publishing Actually Costs - <AUTHOR> http://chronicle.com/article/What-Open-Access-Publishing/234108 <comment><USER2> It depend what services you want.

I was involved with arXiv.org and we estimated costs somewhere around $5 a paper, however we were not doing any typesetting (mostly we got submissions in TeX) and no peer review. It may sound blasphemous, but it is not clear how much value you really get out of peer review.

One key is that arXiv was running on a very large scale, if you are considering the cost of the programmers, hardware and such, it is just as expensive to run a small "journal" as it is a large one.

The reason I don't work there anymore has to do with the extreme difficulty we had in finding that $5 a paper. After years they've finally been able to get other academic institutions to put some chips in the pot, but it seems to me that it is much easier to find money for a boondoggle than it is for a lean operation.

<comment><USER3> It seems to me that all we really need is a way to attach reviews/endorsements to papers already posted on the arxiv. Tim Gowers's initiative is a good start, but with just one specific overlay journal, a tiny one.

<comment><USER2> It is a tricky problem.

For one thing there are a lot of people who are not qualified to have an opinion who would like to chime in on the topic and in certain fields (say gravity) they outnumber the real researchers. Some of these people are clearly psychotic but some of them will put up an huge fight, in the courts even, and other people are marginal cases, right on the edge, where you will lose the moral battle if you keep them out.

Another issue is that some senior (and junior) scientists tell it like it is (or rather how they think it is) and don't stop to think about the emotional impacts their words have on people, particularly when shared with the wider community.

These people have valuable things to say, but they make mistakes like the rest of us, and the peer review process defuses much of the tension in this situation, although it too has the problem with tail cases with very high cost.

</comment></comment></comment><comment><USER4> All I hear from academic publishers is "publishing costs money", but that's not the point, and they know it.

The point is exactly threefold, and much simpler than even the simplest article they review:

1\. It costs dramatically _less_ to publish it used to.

2\. Editors routinely offload expensive tasks to those submitting, i.e.: formatting figures and text, converting to publication-quality file formats, and in some cases even layout, to the point where we're not even sure what it is they _do_ anymore.

3\. Most research is publicly funded. It seems ethically wrong for there to be paywalls, especially considering the hefty price-tag associated with submitting an article in the first place.

Editors: we're academics, not idiots. Please respond to our actual goddamn points.

<comment><USER5> I think point #2 is only true for LaTeX-heavy fields like math, physics, and statistics. It's certainly not true for biology, medicine, psychology, or other fields where Word is king.

In biology and medicine, NIH open-access requirements mean most articles are converted to XML ([http://jats.nlm.nih.gov/](http://jats.nlm.nih.gov/)). Articles are submitted in Word files, edited and converted to XML via some proprietary complicated toolchain, typeset to PDF with a big proprietary system like Arbortext, and shipped off to PubMed for archiving. Figures are usually TIFFs or PDFs converted to whatever formats are needed for the web or print.

I don't know how the conversion process works, but I suspect that turning arbitrary Word files into semantic XML with accurate bibliographic cross- referencing metadata and high-quality tables and figures requires a lot of manual work. You have to deal with complicated tables, weird Word formatting, and whatever weird styling the authors think is a good idea. The bibliography has to be annotated with DOIs and converted to a standard format.

LaTeX and BibTeX, or some other structured markup language, are undoubtedly much easier to deal with and much easier to automate.

I think Michael Eisen of PLOS has commented on the situation and said they're actively working on rebuilding their publishing toolchain to automate more of the process, since it requires hours of work for every paper.

<comment><USER6> Automatic typography isn't! Let's suppose for example, there is $P_A$ in the text. According to the rules of math typesetting if A stays for description like "Alice", it should be set in the current math roman font i.e. $P_\text{A}$. So $P_A$ looks suspicious, what shall the typesetter do? 1. ignore everything and this way leave the typographic responsibility to the author; 2. set it correctly, because she is one of those underpaid TeX- typesetter, who can read out of the text, what A stands for; 3. send back a question to the author for clarifying. And this is just a simple example. The before/after gap betweeen author typoscripts an proper typesetted books is enormous.

Sadly, the job of the scientific typesetter is not valued this days any more.

<comment><USER7> The job of the scientific typesetter should not exist. Give me your reviews and your latex template (and only your latex template) and get out of the way.

</comment></comment></comment></comment><comment><USER8> Here's my naive view:

1) Upload PDF of a paper to a server 2) Reviewers get notified and do their thing 3) Paper is accepted and set to public (or rejected)

Collecting related papers and typesetting them and whatnot should not be default but rather addons. All that matters is getting the paper, quality control and making it available. No need for set release dates and quarterly, just kanban it. As long as you have enough reviewers who are willing to do the work that should work.

Optional: 4) Allow git style updates to the paper (author needs write access for this) 5) Comment system (potentially mark papers as "not so great after all, should not have made it through review")

<comment><USER9> > Paper is accepted and set to public (or rejected)

Is this even relevant post-scarcity? Just make everything available all the time, just like the rest of the web works.

If it is obvious how many citations a paper have, and of their respective quality, that would carry over to make a quality index for the paper itself. Low quality papers would languish as only friends and family would bother with the.

<comment><USER10> What about a new medical study that hasn't had time to gather citations? What is its "quality index"?

<comment><USER9> What is its status today, before it is published? It's very low, but there is a system in place to get a select few peers to review it. Could there not be a similar system of reviewers in place, without necessarily making a difference between "published" and "rejected"?

</comment></comment></comment></comment><comment><USER11> > Eventually, the publisher won't need a programmer...

Yes, they will need 5 ;)

</comment><comment><USER12> arXiv.org, which does just the _publishing_ part of publishing — without the typesetting, lawsuits, sales staff, and political lobbying against freedom of speech — spends about US$1 million per year, with a staff similar in size to the Open Library for the Humanities, but more highly paid: [https://confluence.cornell.edu/display/culpublic/arXiv+Susta...](https://confluence.cornell.edu/display/culpublic/arXiv+Sustainability+Initiative;jsessionid=3B375E7BFF6B88E48141AA7B29C46974?preview=/127116484/327622987/arXivCY15Midyear.pdf)

I didn't say "without peer review" because, although the arXiv doesn't pay for peer review, traditional academic publishers don't pay for peer review either. Instead, scholars do the peer review for free, often as a favor to the journal editor (who may or may not be paid).

They do have a moderator on contract for physics submissions to keep out the cranks.

They currently get about eight or nine thousand submissions per month, all of which they publish: [http://arxiv.org/stats/monthly_submissions](http://arxiv.org/stats/monthly_submissions) and about 12 million downloads per month [http://arxiv.org/stats/monthly_downloads](http://arxiv.org/stats/monthly_downloads).

Reducing these figures to SI units, arXiv spends 32 millidollars per second, accepts submissions at 3.2 millihertz, and provides downloads at 4.6 Hz. If you impute their costs to the submissions, then they spend US$10 per submission.

Definitely see PaulHoule's comment [https://news.ycombinator.com/item?id=10539269](https://news.ycombinator.com/item?id=10539269) about how they were struggling badly when they were trying to get by on half that.

A couple of academic fields — notably math and physics — have switched almost entirely to arXiv. These are, perhaps not coincidentally, fields where the researchers already did most of their own typesetting.

It's probably worthwhile to cost out how much it costs on the market to buy academic editing (in the traditional sense of fixing your prose so that other people can read it) and typesetting services. That information is not as easy to find because those services are not as standardized; the US$380 per paper given in this article is probably not too far off for typesetting, but I think editing can run somewhat higher, particularly for non-native speakers who have not yet reached a high level of competency.

</comment><comment><USER13> The biggest thing I object to in this article is the following quote from Michael Eisen (one of the PLOS founders):

 _" The costs are largely the same between open-access journals and non-open- access journals," said Michael Eisen, a co-founder of the open-access project PLOS. "We're doing essentially the same thing as traditional publishers."_

The type of peer review that megajournals (like PLOS One) do is categorically different than a lot of traditional journals. A megajournal will typically review for scientific soundness only. If the methodology is sound then the paper should be accepted regardless of whether it breaks new ground in the field or is seen as important.

This is not the same kind of peer review that you will find when submitting to Nature, where they are trying to curate for importance in addition to vet for soundness. I won't argue one way or the other about whether one type of peer review is better than the other, there are arguments to be made on all sides. But they are not the same, and they do not cost the same amount.

Methodological peer review is cheaper. That's why the megajournals like PLOS One, et al do it that way (well, it's one of the reasons, the other main one being a philosophical reason). You could not run the big OA operations at their price points with traditional peer review. Their revenue is purely driven by acceptance volume, and so therefore anything that slows down peer review or rejects too many papers has a serious material impact on revenue. It's a balancing act between ensuring you don't accept quack science accidentally but don't reject too much than you have to.

<comment><USER14> PLOS ONE is only one of many PLOS journals. The others do also review for importance. This is probably why PLOS ONE is cheaper than their other journals: [http://journals.plos.org/plosone/s/publication- fees](http://journals.plos.org/plosone/s/publication-fees)

So Eisen is correct, it's the same thing. A non-open access publisher could make a non-open access equivalent of PLOS ONE if they wanted to (and maybe somebody has). It's not a question of open access.

<comment><USER5> I don't think the cost difference comes from the type of review, or at least not entirely.

Consider that PLOS ONE, because it doesn't review for importance, has a much higher acceptance rate. Only accepted papers pay processing charges, so each accepted article has to subsidize the review and rejection of all the rejected papers. In PLOS Biology or PLOS Medicine, with a low acceptance rate, each accepted article has to subsidize review of numerous other articles, driving the cost per published article way up.

<comment><USER13> I was arguing the cost of APC can only be low in the megajournal review format precisely because of the points you mentioned. So I think we agree, the type of peer review drives the acceptance rate, so with a higher acceptance rate you can charge a lower per-article APC.

</comment></comment></comment></comment><comment><USER15> The focus on costs as business expenses overlooks the primary problem with non-free journals: It limits the dissemination of knowledge - the primary reason for publishing - to the few who can pay.

Currently, independent scholars or intellectual members of the public who want to learn something have very limited access to this knowledge. AFAIK, you need to go to a library to access it - you can't even join a library and get remote access to their computers. That means all the well-researched, expert knowledge in those journals is replaced with whatever is found on the Internet. How will the next brilliant patent clerk participate and make her/his contribution?

(If anyone knows a way to access JSTOR without enrolling in a university or going on-site to a university library, I'd love to know.)

</comment><comment><USER16> I found an example of a Wiley journal that claims to be "open access." But you dig around it is really "pay to place". Example: [http://www.win- vector.com/blog/2015/11/fast-food-fast-public...](http://www.win- vector.com/blog/2015/11/fast-food-fast-publication/)</comment>