Necunos announces postmarketOS collaboration - <AUTHOR> Necuno Solutions and postmarketOS announce a community collaboration aiming to offer postmarketOS on the Necuno Mobile, truly open source hardware platform. Last week, the company announced similar collaboration with KDE, bringin postmarketOS to Necuno Mobile.<p>More in Necuno Solutions Blog. https://necunos.com/blog/necuno-solutions-and-postmarketos-collaboration/ <comment><USER2> Yuck, their device sports a i.mx6 Cortex-A9 SoC, which has great software support (it's what Bunny used in the novena platform), but we're now in the age of ubiquitous and cheap AArch64 devices. Long story short, the imx6 is really old so it's hard to get too excited about their hardware.</comment>


MEC: Modular Matrix Exponentiation Cryptography - <AUTHOR> https://github.com/douglascrockford/MEC <comment><USER2> The file date on the untested cryptography is 4/1/17.</comment>


Show HN: Small, secure Nginx Docker image - <AUTHOR> https://github.com/ricardbejarano/nginx <comment><USER2> The big question about using those Docker containers is security.

Based on past CVE history for nginx, there might be another CVE in 1-2 years. Will this git repo still be updated then? Will the user remember to pull latest version and regenerate latest image?

Official "nginx:alpine" image maintained by nginx team is 17MB. If you can, you should always use it. And you should subscribe to some sort of mailing list so you know when it is time to upgrade all of your servers.

(An alternative is to skip docker and use good old Ubuntu LTS with automatic updates; this will guarantee timely and fully automatic security updates for the next few years. The downside is that if the system will have an exploit, the attacker will often find it much easier to stay in the system and move to other parts of the network)

<comment><USER3> Agree, security here is a bold claim. Size does not imply security. Traceability, reproducibility, maintenance/rate of release, etc are... I'd rather use official images as they are maintained and reported against (or reported to the maintainer) when issues are found.

<comment><AUTHOR> OP and maintainer of the image here.

I understand your concerns. I would have them too.

To be fair, I tried pushing these changes to the official NGINX image, but they weren't accepted because I'm using a multi-stage build, which are not allowed to official images for a series of reasons. I mostly disagree with those reasons, but I don't own the Docker Hub. Here's the PR: [https://github.com/nginxinc/docker- nginx/pull/310](https://github.com/nginxinc/docker-nginx/pull/310)

As for traceability, we've had some discussion over at Lobsters about that. I believe you can do it from outside the container, and avoid bloat that will only get used in 1% of the cases.

About reproducibility, my CI process for this image uses GitHub and the Docker Hub, I don't build and push the images myself (which I consider a very big red flag in A LOT of images, even official ones), so it must be reproducible as the Docker Hub must be able to build it.

I've responded to another user about maintenance. TL;DR is: I use it, so I must keep it up-to-date, usually in less than 24h of the release of a new patch. If for whatever reason I stop using it, upgrading is just changing two lines in the Dockerfiles, so it's not tiring. But if for whatever reason I can't maintain it anymore... This is an inherent problem of volunteer maintained open source software.

I might have convinced you, or not. Again, I'd have the same concerns as you do, it's fair.

</comment></comment></comment><comment><USER4> If predictable build compilations were published by source owners and some wider review (like CT) the build could test if the specific code used matched externally provided sigs</comment>


Trump unveils 'merit-based' immigration policy plan - <AUTHOR> https://www.bbc.com/news/world-us-canada-48304975 <comment><USER3> This works out well for Japan. Why wouldn't it for the US?

The way I see it, only those highly qualified shall apply. If an american can do the job, then an american should do it.

<comment><USER4> It sounded fine up until this line:

> he proposed moving away from the current system that favours applicants with > family ties to the US

If a citizen is in the country and they want to bring their family over, that should be their right.

<comment><USER5> Except Europe, Canada, the UK, Australia, China and almost every other country in the world would disagree. Immediate family is one thing, however US immigration family preference means that a illiterate cousin of an applicant has priority over a highly accomplished person with no family in the US. Spouse and minor children, certainly, and Trump's proposal is in line with Europe and Canada in the regard. In fact, his proposal is more like Canadian immigration policy.

Honestly, Trump could propose single payer healthcare or universal pre-K and the anti-Trump crowd would oppose it.

A helpful exercise for people of both parties is to ask if you would agree with a given policy if "your guy" had said it.

<comment><USER6> It seems like a very outdated part of America's immigration philosophy, but it is such a fundamental part of American culture, that I'm shocked it has recently been relabeled and scorned as "chain migration".

Sure, "Talented Doctor Immigrant" migrates to the US and sponsors "Illiterate Cousin", but IC finds a less skilled role, and still has the familial support of TDI. In fact, oftentimes, this takes the form of small business loans. It's basically how every ethnic community in the US flourished, from German migrants settling the midwest to recent immigrant-fueled boons like the Indian population in Edison, NJ.

The system may be a little outdated in the globalized world, but it's a source of labor that mitigates the risk of antisocial consequences (IC turns to crime, is exploited at work, becomes a burden on the government, etc). I don't entirely agree that it's the "right" of a new immigrant, but eliminating it could have far greater consequences on the future of American than it may seem.

</comment></comment></comment></comment><comment><USER7> People talking about this not passing Congress, they know. This is a play for the next election. He made promises in his last election that he can't keep. Now this will let him blame someone while saying look I tried.

<comment><USER8> The real question we need to ask here is why won't it pass in Congress, answer is Democrats are blindly opposed to Trump even if he wants to do something that is great for the country. This is the root of the problem in this case.

<comment><USER9> It wouldn't have passed under any other Republican leadership, let alone Trump. If you want Democrats on board any immigration package would need to contain path to citizenship for undocumented folks.

</comment></comment></comment><comment><AUTHOR> So, do those who have Masters degrees from US get preference over those who don't possess any sort of Bachelors or Masters degrees from US?

<comment><USER10> This is unlikely to be passed. It has to be approved by Congress, which is controlled by the opposing party. Even if the Republicans win the next election it is unlikely this specific bill will be passed. As far as the specifics for this, all the article says is highly educated people would be given preference. I would assume this would mean a person with a master's degree would be given more preference than one with a bachelor's, but not as much as one with a doctorate. I am sure the area study would play a large role in this as well. Job offers are always helpful, as is the ability to speak English

<comment><USER11> Congress isn't controlled by the opposing party, it is split. Regardless, there is value in the proposal because, agree or disagree, it is actual policy you can't weigh in on by voting in the next election, not just the usual vitriol.

<comment><USER10> You're right, the House of Representatives is controlled by the opposing party, I always wrongly consider this "Congress" because it is full of what we call Congressmen and women, whereas the other house of Congress is filled with Senators, which I supposed are also Congressmen and women, but I never hear them called that.

</comment></comment></comment></comment><comment><USER12> > Senior Democrats dismissed his ideas as "dead-on-arrival".

That is the most important line of the article. Without Democrat support, this plan will not pass in this congress. While it is possible it could pass in the next congress (2021), I would characterize it as unlikely. Both parties see the status quo in legal immigration as a good thing, with most changes in the day-to-day policies of USCIS being dictated by court rulings and not congress.

<comment><USER13> why would they be any other way. We have been trapped in a cycle of party first American second for far too long. The schism caused by the Tea Party was the first major rebellion within a political party and it took years before the Republican party could co-opt it and bury it. The Democrats had an inkling of similar with a few candidates displacing established players but they are too few and too radical in general to steer the party in a different direction.

however most all reforms towards voting all lead to the same outcome, no competition for established parties. Oh sure they dress it up and market it as protecting us from big special interest or money but the real outcome is, no one is permitted to run who does not have the blessing of either party. the US pays towards the security of only the Democrat or Republican conventions just to make it clear how much they have locked out all other choices. People decry barriers to voting but the real issue is the barrier to even be a choice.

</comment></comment><comment><USER14> This seems like it would set up a situation where immigrants really do compete for US jobs, rather than being a net economic positive.

Right now, unauthorized immigrants are 24% of maids and cleaners, _half_ of ag workers, and a big chunk of construction labor and home aides like nannies.

These jobs are filled by immigrants because they are a big step up for a lot of the people arriving here, while Americans don't want them. In a saner world, work visas for unskilled labor and a pathway up to citizenship would benefit everyone.

Instead, the president seems to want a carve-out for the tech and health industry that makes life more precarious for everyone else.

Source on numbers: [https://www.cbsnews.com/news/illegal-immigrants-us-jobs- econ...](https://www.cbsnews.com/news/illegal-immigrants-us-jobs-economy-farm- workers-taxes/)

<comment><USER15> "while Americans don't want them"

Former construction worker here.

Americans don't want these jobs at the below-market wages they pay. The wages would be higher if not for the supply being inflated by laborers willing to work for below minimum wage.

The most dangerous job in the world (Alaskan crab fisherman) is brutal, dirty, and high paying. Therefore there are always American citizens waiting on the docks to learn the trade.

Not saying I don't want more immigration in the US. I want WAY more of it, but only if it's not reducing pay in entry level vocations.

<comment><USER16> Since we're talking about incentives, without cheap labor the incentive will be to increase automation until the total cost comes back down. So domestic workers' desire for high-pay/low-skill jobs is just as selfish/artificial as companies' desire for cheap labor. That doesn't mean it's bad, but slamming companies for responding to market forces when it comes to immigration alone is almost cherry-picking. You have to consider the whole picture to make good policy.

<comment><USER17> This didn't really work for Tesla.

It turns out skilled labor is still really important even if you have a bunch of machines printing and milling material.

<comment><USER16> What's true for high-tech manufacturing might not be true for farm labor, meat packing, hospitality and food service, construction, or the other kinds of jobs that many immigrants are doing. The pool of unskilled jobs with decent wages is shrinking and will continue to do so. Artificial labor-force limitation is a temporary palliative at best, and energy spent kicking others off the bottom rung of the ladder would be better spent climbing. Climbing, not kicking, is what capitalism is supposed to be about anyway.

<comment><USER15> I get your point, but there is an inherent contradiction in your statement:

You simultaneously point out that low skilled jobs are being lost to automation, and advocate for bringing in more low skilled workers for this dwindling pool of jobs. Seems cruel.

<comment><USER16> > there is an inherent contradiction in your statement > ... > Seems cruel.

I see your point also. I assure you, I don't mean to be cruel. The problem is, what is cruel to one can be kind to another, and vice versa. That immigrant has hopes and dreams, and maybe a family, too. If the global pool of jobs is shrinking, and the global pool of workers is growing, the system _will_ move toward equilibrium. Jobs will shift person by person, factory by factory, or industry by industry. Increasing the premium for our labor, and thus for the products of that labor, only ensures that it will be industry by industry. This process is already under way. I'm sorry, but it's the _market_ that is cruel.

So, since I'm away from my own home and have some time to spare, what does that mean in terms of KirinDave's idea to keep entry-level jobs for Americans? I'll be blunt: that's _stupid_. Americans, who have to earn a certain wage to maintain even the lowest standard of living, can _never_ be as cost-effective as people to whom that same wage looks like a king's ransom.

That's where "merit based" immigration comes in. It's about making the best and the brightest from all over the world part of _our_ ecosystem instead of a competing one. It's a deliberate brain drain. It leaves the low-skill workers where they are, unable to compete job by job but also bereft of any leadership that would enable them to compete industry by industry. It's unfair - <USER2> might even say cruel - to them, but global fairness is not a goal. It's an _effective_ way to promote Trump's and KirinDave's goal of propping up uneducated Americans' wages. I just happen to think that's a lousy goal, not least because it's not sustainable. The longer we put it off, the worse the eventual result will be.

<comment><USER17> > So, since I'm away from my own home and have some time to spare, what does > that mean in terms of KirinDave's idea to keep entry-level jobs for > Americans? I'll be blunt: that's stupid. Americans, who have to earn a > certain wage to maintain even the lowest standard of living, can never be as > cost-effective as people to whom that same wage looks like a king's ransom.

That's uh.. not my idea? You mention me a lot here but you've comically misrepresented my position, which you can't really know because the only thing I've articulated on this subject in this thread is that Tesla tried and failed spectacularly to automate, and that the American (really Victorian) idea of trying to replace all human labor with machines (or at least make it LOOK like it's all machines) hasn't fared very well overall despite it being a near religious conviction by many western industrialists.

Meanwhile, China's labor policies (which in my personal belief system lead to reprehensible limitations on human freedom and rights) lead to a country that is industrially crushing the rest of the world to a degree that we haven't seen since post-WW2 where American interests could push their products on others because everyone else's industrial bases were smoking craters due to war.

> That's where "merit based" immigration comes in. It's about making the best > and the brightest from all over the world part of our ecosystem instead of a > competing one. It's a deliberate brain drain.

You misspelled "richest", because that's actually the goal. We're getting tepid, moderately talented but quite wealthy Elon Musks. Once, we were significantly better at the "brain drain" and it showed during WW2. And perhaps that's for the best, because the circumstances that lead to the genuine brain drains of WW2 were quite dire.

> It leaves the low-skill workers where they are, unable to compete job by job > but also bereft of any leadership that would enable them to compete industry > by industry.

But at the end of the day, the notion that the folks you are leaving behind are not essential to society as a whole is a capitalist dogma not supported by reality. The idea that society isn't built on essential but socially dismissed and denigrated labor like construction, cleaning , and even sex work is a fantasty. It's the Victorian desire to have a "dumb waiter" all over again, only on a much larger scale. And this myth largely persists because western industrialists imagine a fantasy world in which Taiwan and China are full of magic robots and not millions of skilled (and socially oppressed) humans.

> It's unfair - one might even say cruel - to them, but global fairness is not > a goal.

Indeed. The goal is to realize Burke's dream and roll back every social contract change post-French Revolution. I'm well read on the capitalist ethos.

> It's an effective way to promote Trump's and KirinDave's goal of propping up > uneducated Americans' wages.

Trump's goal is to prop up the wages of under-educated Americans? What? The man and his party's policies have rendered over half of the farmers in America desperate, directly threatened the livelihood of many American manufacturing workers with his pointless tariffs, and outright declared war on American unions. He is as anti-worker as they come. The fact that you think otherwise is a reflection of the phenomenal branding engine.

> I just happen to think that's a lousy goal, not least because it's not > sustainable. The longer we put it off, the worse the eventual result will > be.

I'm not sure what you're advocating at all. The completely abandonment and disenfranchisement of every skilled laborer that doesn't meet your definition of "educated?" The radical purging or forced labor of anyone who doesn't meet specific economic or physical standards? Many US States already do that via their justice system. Does that not already satisfy you?

If you want to talk about unsustainable systems, we need only look at the current political environment in America, where voters are so disenfranchised, misinformed and manipulated that a toxic hyperindustrialst grifter can hold power just because folks are so pissed at the status quo that hope of massive disruption is all they can hold on to.

Eventually, folks are gonna stop believing in all the delays. Already, fascists interests in the US are gathering people who've hit that breaking point and organizing them to point at perceived enemies. Already, we see people who question truths known and trivially observable for thousands of years because they're so convinced the entire system is out to get them. Already, folks know that their punishments for challenging the rule of law are only truly enforced towards the poor and the forgotten.

<comment><USER16> > The completely abandonment and disenfranchisement of every skilled laborer > that doesn't meet your definition of "educated?

You complain about strawmen, then launch a straw giant like that? What I actually believe is that we should do more to help people get on a path to a stable, well paying, fulfilling job. Education can be part of that. A living wage can be part of that. Universal health insurance can be a part of that. Even unions can be part of that (but perhaps not in their current corrupt/co- opted form). But discrimination and exclusion can't. Not for long, and not on a global scale. If you also oppose discrimination and exclusion, why are you trying so hard to pick a fight here?

<comment><USER17> > You complain about strawmen, then launch a straw giant like that?

This was more a rhetorical "obviously this is false" statement than a genuine articulation of your position.

> If you also oppose discrimination and exclusion, why are you trying so hard > to pick a fight here?

You're the one accusing me of... I am not even sure anymore. Of somehow aligning with the current US president over inflating wages which you do like but you don't like but you do think should be done but maybe not because it's not sustainable.

I get the impression you have not carefully formulated an articulate form of your beliefs and then tried to convey it to others. I showed this conversation to a few other folks just to see if I've got a blind spot. I didn't discover one, sadly, because they agreed that it seems like you're arguing against yourself at least as much as you're expressing antipathy towards whatever ideas you think I have.

The only thing I "discriminate" against (besides my sorting algorithms ;) is the notion of hyper-concentration of capital into individuals.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> For once, I think that Trump is actually taking something in the right direction. With a few tweaks that make Democrats happy, this will actually be a net-positive over the current lottery-based system. Hopefully they overhaul the green card process too.

It's a pain to see a senior engineer from India or China have to go home because their 6 years of H-1B are up.

</comment><comment><USER9> This is dead on arrival in Congress.

</comment><comment><USER19> That article didn't really spell out any details, but coming from Trump I doubt the details are good.

That said, I've always thought there was a glaring hole in our immigration policy, which is that people who come and earn a degree in the US should have an easy option to stay and work and become citizens if they would like.

It seems crazy to me that we're investing a ton in the people who come here for higher education and then making it difficult for them to stay here and use the skills and education they acquired.

<comment><USER20> " people who come and earn a degree in the US should have an easy option to stay and work and become citizens if they would like."

No, this would immediately put Universities in the business of selling citizenship. Of course they'd probably love that. Though foreign student exports have doubled in the last few years, it'd grow even faster as a source of revenue for them.

The criteria for admissions in many undergrad/graduate programs is really not that high, and some schools are not very expensive at all.

"we're investing a ton in the people who come here"

When foreign students pay tuition that's an _export_ for the US, it's not so much 'the US investing in them' (though I understand many are on scholarships, and the institutions get indirect funding).

There are 1.1 Million foreign students in the US, and it's a $42 Billion dollar export [1]. That's quite a lot of money (and quite a lot of people).

Surely, under a 'merit based system' foreign students should get a bunch of 'points' towards the system, but a broad points-based system is by far better than a 'buy your undergrad/citizenship' program.

[1] [https://www.nytimes.com/2019/01/03/magazine/one-of- americas-...](https://www.nytimes.com/2019/01/03/magazine/one-of-americas- most-vital-exports-education-never-goes-abroad-but-it-still-faces- threats.html)

<comment><USER21> > The criteria for admissions in many undergrad/graduate programs is really > not that high, and some schools are not very expensive at all.

We could, at the same time, make standards a lot higher to obtain a student visa in the first place.

I for one have no problem making it extremely hard to get a student visa or an H1. But it seems to me rather unfair to allow someone to build a life here for 6 or 8 years and then deport them.

In general, a system where only the most promising individuals are awarded immigrant visas, and where it is extremely difficult and unpleasant to reside here as an illegal immigrant, but where anyone who has resided here for a given number if years (legally or otherwise) is automatically a permanent resident, might be a marked improvement over the current system. Almost all new immigrants would be economic assets, would not drive down wages for working class citizens. And at the same time the problem of the "dreamers" already here will be solved.

</comment></comment></comment><comment><USER22> As the article pointed out, no dreamer compromise so it will never pass the house. It is likely useful for uniting the fractured Republican base, but that's about it.

<comment><USER11> Democrats can add a dreamer compromise and then pass it and see what happens. White House has signaled many times they are willing to do something for the dreamers in exchange for something.

<comment><USER23> The White House may have signaled that, but so far when presented with actual compromises the President has always aggressively rejected them. This is one of the areas that people use to show that the White House staff and the President are not actually on the same page.</comment></comment></comment>


Serving Bandwidth-Friendly Video with HTTP Live Streaming (HLS) - <AUTHOR> https://ryanparman.com/posts/2018/serving-bandwidth-friendly-video-with-hls/ <comment><USER2> This is a really good write-up to get people started on the road to streaming fragmented video. video2hls is doing a lot of heavy lifting.

[https://github.com/vincentbernat/video2hls](https://github.com/vincentbernat/video2hls)</comment>


Show HN: Try to Pass FizzBuzz From Your Browser - <AUTHOR> http://www.trybloc.com/courses/fizz-buzz?foo=bar

<comment><AUTHOR> Jeff Atwood's article on FizzBuzz: [http://www.codinghorror.com/blog/2007/02/why-cant- programmer...](http://www.codinghorror.com/blog/2007/02/why-cant-programmers- program.html)

</comment><comment><USER2> I think FizzBuzz is complete bullshit, I find it very hard to believe most programmer's can't solve this.

</comment><comment><USER3> this is awesome! can't believe most programmer's can't pass this</comment>


Django 1.0 alpha released - <AUTHOR> http://www.djangoproject.com/weblog/2008/jul/21/10-alpha/

<comment><USER2> I absolutely love Django and I'm happy they've been able to get toward a 1.0 "more usage" milestone so quickly. I'm also glad they started the Foundation so I could donate.

</comment><comment><USER3> i still think the documentation is still aimed at a relatively high level and/or at a single learning style. i've tried a few times with 0.96 and i'm happy if i can get the darned server running. i'd love to see 'themed' tutorials that help newbies learn python+django to build lots of different things rather than a single 'it can do anything, you just have to start somewhere'. i wouldn't recommend that approach with chemistry - why is it the default for programming?

<comment><USER4> The assumption the writers of the Django docs might be making is that you're coming from a web dev background already (e.g. recovering PHP4 or ASP user), and you're ready to dive into what makes Django different.

</comment></comment><comment><USER5> Can I say woot? Or should I resrve that for 1.0?

<comment><USER6> You can say it both now _and_ later. :)</comment></comment>


House Oversight Committee Report on Equifax Breach [pdf] - <AUTHOR> https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf <comment><USER2> > The attackers transferred this data out of the Equifax environment, > unbeknownst to Equifax. Equifax did not see the data exfiltration because > the device used to monitor ACIS network traffic had been inactive for 19 > months due to an expired security certificate.

> Equifax had allowed over 300 security certificates to expire, including 79 > certificates for monitoring business critical domains.

(on page 2 of the Executive Summary)

I've been following the Equifax breach story but this is the first I'm hearing about the expired certificates. That is shockingly bad.

I'm a little disappointed in the final "conclusion" of the report, though. The end of the executive summary basically chalks the breach up to two things: "Equifax's IT management structure was complicated" and "Equifax uses legacy software that is hard to secure". These _are_ valid points, but these are also issues that nearly every single major corporation in the world faces, and yet many of them still manage to prevent (or at least mitigate) major breaches. These aren't good enough reasons to explain why Equifax failed so spectacularly compared to every other bureaucratic company with legacy software.

Also, I know this report isn't meant to be a remediation strategy roadmap, but it's also pretty disappointing that the recommendations section is basically just 3 pages of fluffy, vague, "X and Y should work together to increase cybersecurity" bullshit. Such a high profile incident would have been a great time for the federal government to really show some leadership (or at least strong guidance) in this realm, but they really didn't. I mean hell, at least link your recommendations to the NIST Cybersecurity Framework...

<comment><USER3> If the House's conclusion is that software of this complexity is impossible to secure, then it seems reasonable that we should treat any data stored in it as insecure. Maybe companies as complex as Equifax shouldn't have access to the data they have access to.

I'm pretty tired of companies telling me that it's fine for them to hoover up extremely sensitive information like my social security number and then turning around after a breach and saying, "well, there was nothing we could do."

It can't be both. If it's impossible to secure companies, then maybe Merriott shouldn't be asking for anybody's real name when they sign up for a hotel. Maybe we should stop using credit agencies for identity verification and start investing government resources into a separate 2-factor system. Maybe you should have a legally protected right to lie to businesses that ask for your personal information.

Equifax leaked personal information for 50% of the US population. If you were voting, and there was a 50% chance that your ballet and voting history was going to be leaked publicly after the election, you would expect either:

A) Someone is so incompetent that they're going to jail, or

B) The system we're using is so fundamentally broken that we need to rethink the core paradigms of how it's built.

To me, a report like this sounds like the House is saying that where corporate security is concerned, B is the answer.

<comment><USER4> >>> maybe Merriott shouldn't be asking for anybody's real name when they sign up for a hotel

It's important to distinguish that it wasn't actually Marriott that had the data breach. It was starwoods resorts, now a marriott owned entity, but at the time of the breach it was not a marriott property. Marriott is being attributed to the guilty party b/c they now own starwood, but Marriott's systems were never breached, so marriott should keep doing what they are doing (presumably) and transition all the starwood systems over to the more secure marriott systems (which I believe they already said they are doing).

<comment><USER3> That's a really good point, Marriott just had an unlucky purchase.

That being said, between the recent Google+ breaches, to the older Target breaches, it increasingly feels like I'm flipping a coin when I trust companies with data.

Based on Marriott's handling of this breach, they seem to be decent at security. But I don't know how as a consumer I could tell that in advance of all of this.

<comment><USER5> > Marriott just had an unlucky purchase

M&A is a culprit in no small number of these cases, so let's be crystal clear: M&A does not absolve anyone of responsibility. Let me know when the underwriting bankers have their bonuses garnished for lack of due diligence, and then you can tell me about how "it wasn't actually Marriott that had the data breach". Let's say it loudly and clearly: no, it _was_ Marriott that had the data breach.

<comment><USER3> Eh. The breach happened before Marriott had any control or agency to stop it. Their due diligence in buying the company wouldn't have protected any consumers, it would have just meant the breach was someone else's problem. My understanding (of course, correct me if I'm wrong) is actually that their purchase is the reason the breach was disclosed -- Marriott buying the company and doing its own internal audit on their systems is why we know about it now.

So I don't actually feel a ton of ill will to them, even though I agree that doesn't absolve them of the fact that they bought it, and it is now very much _their_ problem to deal with. It may not be your fault that the puppy that you bought isn't house trained, but I'm still not going to clean your carpet for you.

Having said that, this kind of underscores what I was talking about above. If Marriott themselves couldn't tell in advance that the company they were buying was an insecure liability, how the heck am I supposed to be able to tell?

If it's not feasible for a company like Marriott or Verizon to know in advance of an acquisition which companies are secure and which companies aren't, consumers have no chance. There's no feasible way for a consumer to protect themselves in that world.

<comment><USER5> > The breach happened before Marriott had any control or agency to stop it.

Strongly disagree, this is playing with variables.

Marriott2016 + Starwood2016 = Marriott2017.

Marriott, the present day company, absolutely includes the company that had the "control or agency to stop it".

> it would have just meant the breach was someone else's problem

This isn't a wash. Tort is only effective if the party responsible gets punished, so it's very important which party gets punished. If Marriott had discovered the breach in due diligence, the Starwood investors' payout would have taken a big hit.

As it happens, there's two behaviors that need to be disincentivized: Starwood designed faulty systems, and pawned off its ramshackle legacy crap to the highest bidder; and Marriott2016 (much like Equifax) glommed together so many legacy systems that the likelihood of breach intensified (though to Marriott's credit, the attack doesn't seem to have escalated out of the former Starwood into the parent systems. I'd still like to see steep fines imposed, but way smaller than on Equifax, proportional to that contained scope).

The penalty on Marriott2017 should be steep enough to encourage future buyers to step up their due diligence enough to put the acquiree's payout at risk, while also rewarding Marriott for catching the leak before escalation.

> It may not be your fault that the puppy that you bought isn't house trained, > but I'm still not going to clean your carpet for you.

I like your analogy a lot.

<comment><USER3> > Marriott2016 + Starwood2016 = Marriott2017.

This is a good point that I wasn't considering. It's not like Starwood vanished when it got acquired. It's still there, it just got rolled up into Marriott. So even if I wasn't mad at Marriott2016, most of the people who I am mad at are currently working at Marriott2017.

> Starwood designed faulty systems, and pawned off its ramshackle legacy crap > to the highest bidder

Also agreed on penalties, and that's a good way of phrasing the problem. I don't think that Marriott should be let off the hook for having to deal with the breach. And while I've been trying not to criticize their security response, their social response has basically been, "look over there, free credit monitoring," which is clearly insufficient.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> > Recommendation 6: Reduce Use of Social Security Numbers as Personal > Identifiers The executive branch should work with the private sector to > reduce reliance on Social Security numbers.

I'm disappointed this is recommendation 6, but at least it is in there. I'm also disappointed that they suggest the executive fix this problem instead of legislating a solution. Hopefully they take some action on their own recommendation!

<comment><USER7> The executive branch is the proper solution.

If Congress mandates a solution, then it'd be like the VHS stuff all over again. Congress writes a thingy about VHS in the 1980s, and its completely irrelevant 10 years later. (If a law states that something with VHS is done a certain way, will it apply to DVDs or BluRays when they are invented 10 years later? Or to streaming media 20 years later??)

The Executive Branch is the one that actually runs the government. Legislative Branch / Congress sets policies, but shouldn't set solutions. Law goes out of date incredibly quickly.

Ex: If Congress says that RSA Tokens are to be used instead of SSNs, what happens if a better invention (ex: Google Titan) comes out? Furthermore, even if Congress writes a certain policy down (ex: Two Factor Authentication is necessary to protect bank accounts), the Executive Branch is still the ones who enforce the matter.

So in the case of Two Factor Authentication (legal requirement of banks to protect your bank account), the Executive Branch says that "3-personal questions + Password" counts as two-factor security in the USA. And that's why you have so many banks implementing "3-secret questions".

\</comment></comment><comment></comment><comment>

So regardless, the job will come down to the Executive Branch.

<comment><USER6> The legislative solution would be to mandate a national ID with a cryptographic token, and then leave it up to the executive to define the implementation.

Right now, even if they wanted to, the executive can't force a national ID.

<comment><USER7> > The legislative solution would be to mandate a national ID with a > cryptographic token, and then leave it up to the executive to define the > implementation.

That's still too specific. "national ID with a cryptographic token" means that OpenID / Paypal-based single-sign on logins are __illegal __.

Yeah, writing laws is hard as heck, and Congress is NOT the experts in the field of cryptography / login security. So Congress will get it wrong if they even tried to write the law in that manner. Executive Branch __CAN __hire experts (ie: 18f, NIST, etc. etc.) to define best practices.

As such, the proper legislative solution would be to mandate "industry best practices of identity protection, as defined by (Insert Agency Here, maybe NIST)".

<comment><USER8> > "national ID with a cryptographic token" means that OpenID / Paypal-based > single-sign on logins are illegal.

Why? Why doesn't it just mean that there's a canonical government system that doesn't touch PayPal or OpenID that can be used for stuff that would currently be tied to your social security number?

<comment><USER7> PayPal touches your SSN, as it is tied to your bank account. (Bank accounts require a "Individual Taxpayer Identification Number", which is the SSN for any citizen. Non-citizens get a different ID, but really its the TIN that is the cause of all of these security issues). So yes, really, the proposed wording would probably make Paypal illegal.

You have a point on OpenID, but my overall point is that OpenID would __probably __be sufficient for most financial transactions on today 's internet. OpenID is basically equivalent to Paypal's security model.

Neither Paypal nor OpenID require 2-factor or security tokens. I think they're an optional feature. But in any case, the Paypal / OpenID model of identification (Paypal controlled website verifies password, and sends a token to the 3rd party website) would be sufficient for today's security.

\</comment></comment></comment></comment></comment><comment></comment><comment>----

Of course, none of this even touches upon Equifax. Equifax uses SSNs to identify people, and often without their knowledge or consent. Equifax is a service to the financial industry, to help keep tabs on individual's history.

So the Paypal model will NOT work with Equifax's use case, because the individuals don't always know when they are being tracked. Maybe it'd have to be something to OAuth's model.

In any case, I'm not an expert either. I just appreciate the difficulty of this problem.

</comment><comment><USER9> > In 2005, former Equifax Chief Executive Officer (CEO) Richard Smith embarked > on an aggressive growth strategy, leading to the acquisition of multiple > companies, information technology (IT) systems, and data. While the > acquisition strategy was successful for Equifax's bottom line and stock > price, this growth brought increasing complexity to Equifax's IT systems, > and expanded data security risks.

> Second, Equifax's aggressive growth strategy and accumulation of data > resulted in a complex IT environment. Equifax ran a number of its most > critical IT applications on custombuilt legacy systems. Both the complexity > and antiquated nature of Equifax's IT systems made IT security especially > challenging. Equifax recognized the inherent security risks of operating > legacy IT systems because Equifax had begun a legacy infrastructure > modernization effort. This effort, however, came too late to prevent the > breach.

As someone who works in Tech M&A, I often tell clients "hackers go after the weakest link and you just acquired a new link". They nearly unilaterally ignore this advice and ignored hardening even the smallest of acquisitions, because well, "growth". Someday people will learn.

<comment><USER10> If you start with the accounting assumptions that work on security is a cost, and storing of private data is not a liability then all the actions are rational within the narrow scope of profit optimization. (I'm not in agreement of this, but it seems to be true). Equifax holds these assumptions even more strongly because their fundamental existence is founded on monetization of private data.

<comment><USER11> This afteraction also validates breaches are not a liability, in the end their sharevalue recovered nearly immediately.

</comment></comment></comment><comment><USER12> Just want to talk about Recommendation 6 (Recommendation 6: Reduce Use of Social Security Numbers as Personal Identifiers). Page 96.

The recommendation is essentially "Try to convince the public and private sector to use them less." But I'd argue it is well passed time that SSNs be replaced by something fit for purpose. SSNs were never designed to be a unique form of ID, and using things like the cardboard card as further verification is almost comical.

I'd like to see an aggressive alternative that uses the best of our security knowledge and then have it vetted by everyone in the security industry with a pulse. We've seen other countries try this. But most of those countries outsource it to the lowest government bidder, who hide the inner workings behind proprietary claims, and never vet the resulting proposal.

Instead we need something more akin to the United States Digital Service, a publically created proposal (fully released specs) that is vetted by every academic and security expert they can find.

The hardest part will be saying "no" to requirements creep. Allow certain government agencies to continue to use SSNs for now, and have the new ID "flip" into an SSN behind the scenes. Better than needing five hundred different departments to adopt the new standard before it can go live.

<comment><USER13> > Try to convince the public and private sector to use them less.

It's gov, so they can do more. It can also be "By 202x using SSN for identification in non-SS purposes becomes illegal."

</comment></comment><comment><USER14> Why is Equifax in business still? I don't get it.

A company like Bear Sterns got "killed", Enron and others got litigated out. But it looks like Equifax did not face any consequences. Its high time we treat data as an asset class and regulate accordingly. Particularly personal information is acquired by every company and is treated as a valuable commodity. Companies get acquired purely for the amoutn of data they have. The market has already declared it as an asset why is it not regulated?

<comment><USER15> Bear Stearns failed because it was overextended on subprime mortgages and lost the ability to conduct business when the cash dried up.

Enron was convicted of massive, deliberate accounting fraud. The company wasn't viable without the fraud.

Not even remotely similar to the Equifax breach.

<comment><USER5> Dissimilar from Enron only in that Equifax was never convicted for its fairly deliberate negligence of the public interest, or for its massively distributed tort, because the civil case is infeasible, and because no law or regulation is adequate to cover what ought to be criminal case -- this I think is yalogin's point.

The security patch here is not a technical solution. It's to wipe out the stockholders of any company this negligent, and repossess the spare homes of the entire C-suite. That should cover most attack vectors pretty reliably.

<comment><USER15> > its fairly deliberate negligence of the public interest, or for its > massively distributed tort

If anything, the report says the _opposite_ of that.

> It's to wipe out the stockholders of any company this negligent, and > repossess the spare homes of the entire C-suite.

This is why we don't get any real reform...citizens have these insane ideas on how to "fix" the problem. How can the government take you seriously?

<comment><USER5> > the report says the opposite

My comment was not aimed at agreeing with the majority report. Would you dispute my characterization of those expired certs as "negligence"? Or perhaps you don't consider the budget meetings that declared how low cybersecurity fell on the list of priorities as "fairly deliberate"?

> insane ideas

Hmm, maybe you're right. Monetary penalties for undesirable behavior is insane. Let's repeal all tort laws and cancel criminal fines, and make no attempt to levy proportional damages for anything. Let the C-suite keep their options!

> How can the government take you seriously?

If all else fails, a yellow vest might help. I'm hoping it doesn't come to that here.

<comment><USER15> > Would you dispute my characterization of those expired certs as > "negligence"?

I would. Does the report indicate that the cert was expired due to budget issues? Does it show that cybersecurity was low priority? Again, the report shows the opposite: they had solid policies and procedures in place, but the failures seem to be in execution and training.

> Monetary penalties for undesirable behavior is insane.

No, that's just fine. And Equifax took a huge stock hit, had to make a potentially cash generating service free for everyone, has to earn back its reputation, etc.

> Let's repeal all tort laws and cancel criminal fines, and make no attempt to > levy proportional damages for anything. Let the C-suite keep their options!

Show the _criminal_ activity that resulted in the breach (by Equifax, not the attackers). Show the _damages_ that have resulted from the breach.

> If all else fails, a yellow vest might help. I'm hoping it doesn't come to > that here.

If it does, it won't be over the Equifax breach (or even the other 4 larger breaches: [https://abcnews.go.com/Technology/marriotts-data-breach- larg...](https://abcnews.go.com/Technology/marriotts-data-breach-large- largest-worst-corporate-hacks/story?id=59520391)).

<comment><USER5> > Does the report indicate...

> Does it show...

> the report shows...

I'm not asking you whether the House Republicans would call the expired certs negligent, or the security underprioritized. I'm asking _you_ , as the reader of a technical forum. Do you believe everything the government tells you? Or here, what one party tells you? At the very least, read the minority report linked elsewhere in this thread, and interpolate.

> huge stock hit

Nowhere near huge enough, and it rebounded once it was clear there were basically no consequences.

> has to earn back its reputation

Why? Equifax could care less what its unwilling inventory thinks of it.

> Show the criminal activity...

Name one victim whose damages are large enough to merit hiring a lawyer to comb all the contracts to identify the line where a bank promised that Equifax promised that the victim's data would be safe, and I'll show you a breach of contract. Hint: it's a different line for each victim.

> Show the damages...

Precisely my point: the damages to the public are "massively distributed" and infeasible to pin down, which is why there should be a criminal penalty, like we do for say, ozone-depleting chemicals.

> it won't be over the Equifax breach

(sigh) you're probably right.

<comment><USER15> > I'm not asking you whether the House Republicans would call the expired > certs negligent, or the security underprioritized. I'm asking you, as the > reader of a technical forum.

No, that's not negligent. Nor was security "underprioritized". If you read the reporting on the issue (whether the government report or just reputable news), it show solid processes and procedures, but there were implementation flaws. There is no amount of security that will ever be perfect.

> Do you believe everything the government tells you? Or here, what one party > tells you? At the very least, read the minority report linked elsewhere in > this thread, and interpolate.

Considering that the report matches all the other reputable reporting on the issue? Yes, I believe it. Equifax is claiming "factual errors", but I'd have to see their response before commenting on that.

> Nowhere near huge enough

That's your opinion, but the market has decided otherwise.

> Equifax could care less what its unwilling inventory thinks of it.

Correct. I was talking about their _customers_...the businesses that supply and use their data and services.

> Name one victim whose damages are large enough to merit hiring a lawyer to > comb all the contracts to identify the line where a bank promised that > Equifax promised that the victim's data would be safe, and I'll show you a > breach of contract. Hint: it's a different line for each victim.

Once you do that, prove that the information came from the Equifax breach, and not one of the dozens of other breaches, let alone the 4 other large breaches I cited.

> the damages to the public are "massively distributed" and infeasible to pin > down, which is why there should be a criminal penalty, like we do for say, > ozone-depleting chemicals.

Or their negligible and impossible to detect at any meaningful level.

> (sigh) you're probably right.

It's troubling that you seem to think violence is some sort of solution to any problem, let alone _this_ problem.

<comment><USER5> > the market has decided

Like do you understand what an externality is? When I say it's not huge enough, it's pretty clear that I don't mean Equifax is overvalued & people should all go out and short it. The lawmakers and regulators have decided that the externality will have no significant consequences. The market hardly decides anything here; it reacts.

My reading of the reports is that this company was roughly in line with common practices. My point is that common practices must change.

<comment><USER15> > The lawmakers and regulators have decided that the externality will have no > significant consequences.

No, they just haven't finished yet. There's already been some new regulation, and I believe more to come, for the credit industry as a whole.

> The market hardly decides anything here; it reacts.

If Equifax's customers decided that they couldn't safely do business with it, then Equifax would cease to exist.

> My reading of the reports is that this company was roughly in line with > common practices. My point is that common practices must change.

I certainly agree there, wholeheartedly. But you seem to be singling out Equifax, when it's an industry wide problem.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> There is so much to comment on and digest in this report, but the lifecycle of an attack diagram[1] on page 31 (figure 164) is something every software developer should burn in to memory.

It is easy to fall in the trap of seeing the most miniscule of vulnerabilities and dismissing it as "no one could ever possibly utilize that as a vector, it's not critical."

But that miniscule vulnerability becomes a single link in a ladder to everything in the system. Every seemingly-small vulnerability matters, like this painfully shows.

[1] referenced here: [https://blog.hellobloom.io/how-hard-was-the-equifax- hack-a3b...](https://blog.hellobloom.io/how-hard-was-the-equifax- hack-a3bae36f9e6f)

<comment><USER17> That's something you keep seeing as a pattern in many hacks. It is rarely just one mistake, usually a chain of small ones, each of which doesn't look all that bad by itself.

<comment><USER18> That's why technologies like SIEMs exist. No number of humans could look at logs across all the various systems and spot anomalies within them, but a SIEM can. But only if it's turned on, ingesting data, running a useful ruleset, and crucially: only if someone is watching the output.

</comment></comment></comment><comment><USER19> The report linked here is the House Oversight Committee (Majority) Staff Report.

Another report from the committee's minority is also available.

[https://democrats- oversight.house.gov/sites/democrats.oversi...](https://democrats- oversight.house.gov/sites/democrats.oversight.house.gov/files/Equifax) Minority Report - FINAL 12-10-2018.pdf

<comment><USER5> Link not working for me. Try:

[https://democrats- oversight.house.gov/sites/democrats.oversi...](https://democrats- oversight.house.gov/sites/democrats.oversight.house.gov/files/Equifax%20Minority%20Report%20-%20FINAL%2012-10-2018.pdf)

Key recommendations from the minority report:

"Based on the investigation conducted by the Committees, four key legislative reforms proposed by Democrats would help prevent future cyberattacks:

[A] hold federal financial regulatory agencies accountable for their consumer protection oversight responsibilities;

[B] require federal contractors to comply with established cybersecurity standards and guidance from the National Institute of Standards and Technology (NIST);

[C] establish high standards for how data breach victims should be notified;

[D] and strengthen the ability of the Federal Trade Commission (FTC) to levy civil penalties for private sector violations of consumer data security requirements."

On [B], they note that "Equifax was a federal contractor at the time of its data breach".

On [D], they note that "In the three years before the Equifax data breach, the company spent only about 3% of its operating revenue on cybersecurity—less than the company spent on stock dividends...Civil penalties would incentivize private sector companies to prioritize and invest in continually upgrading and deploying modernized IT solutions and applying cybersecurity best practices."

</comment></comment><comment><USER20> The report doesn't appear to mention that you could just login to their web portal with an obvious password [1]. It also doesn't appear to be under the purview to look at the leadership team selling stock[2]. Both of which it should consider when reviewing the competency and ethics of an organization managing and profiling nearly everyone in the U.S.

Speaking of which... why is it only ~50% of the adult population in the U.S.?

If the intruders were going around the Equifax network at will (which from the report it appears they were). We should assume 100% of the data was breached.

[1] [https://www.cnbc.com/2017/09/14/equifax-used-admin-for- the-l...](https://www.cnbc.com/2017/09/14/equifax-used-admin-for-the-login- and-password-of-a-non-us-database.html)

[2] [https://www.bloomberg.com/news/articles/2018-03-14/sec- says-...](https://www.bloomberg.com/news/articles/2018-03-14/sec-says-former- equifax-executive-engaged-in-insider-trading)

<comment><USER21> _The report doesn 't appear to mention that you could just login to their web portal with an obvious password [1]._

That was a different portal and a different breach.

</comment></comment><comment><USER22> The most alarming part of this is that it appears that the intrusion was only discovered when the new SSL monitoring certificates were being checked to ensure that the appliance was again "on". I wonder how long it'd have taken if someone hadn't spotted something suspicious by accident at that point - I'm sure we've all spotted bugs or flaws by accident when testing a completely different feature.

</comment><comment><USER23> >The Equifax data breach and federal customers' use of Equifax identity validation services highlight the need for the federal government to be vigilant in mitigating cybersecurity risk in federal acquisition. The Office of Management and Budget (OMB) should continue efforts to develop a clear set of requirements for federal contractors to address increasing cybersecurity risks, particularly as it relates to handling of PII. There should be a government wide framework of cybersecurity and data security risk based requirements.

From my understanding of FEDRAMP, all of the things that Equifax failed to do should be already covered. Software patching, isolation of data, audit trails etc. etc. Seems more like a massive auditing fail.

<comment><USER15> Reading through the timeline, it shows that at every step Equifax was trying to do the right thing...internally publishing vulnerabilities, applying patches, scanning for vulnerabilities, etc. The policies and procedures were good.

One difference is that previously Equifax claimed a single employee failed to scan and patch a system. I don't see a reference to that in the report. All I see now is that someone scanned a system improperly:

> The scan did not identify any components utilizing an affected version of > Apache Struts. Interim CSO Russ Ayres stated the scan missed identifying the > vulnerability because the scan was run on the root directory, not the > subdirectory where the Apache Struts was listed.

</comment></comment><comment><USER24> Check out how Equifax started rolling heads starting on page 50. They pinned the fact of not patching Struts on a SVP who was one of hundreds of people notified of the need to patch Struts. But he didn't _forward_ that email, so he's toast!

Now pardon me while I go route my patch management procedures through the nearest baffling and inane dependency.

 _A senior Equifax official was terminated for failing to forward an email – an action he was not directed to do – the day before former CEO Richard Smith testified in front of Congress. This type of public relations-motivated maneuver seems gratuitous against the back drop of all the facts_

</comment><comment><USER25> > Equifax, however, did not fully patch its systems. Equifax's Automated > Consumer Interview System (ACIS), a custom-built internet-facing consumer > dispute portal developed in the 1970s, was running a version of Apache > Struts containing the vulnerability. Equifax did not patch the Apache Struts > software located within ACIS, leaving its systems and data exposed.

1970s? Am I reading that right? HTML wasn't even developed yet.

<comment><USER15> Most likely they had a web front end that talks to the legacy system. Very common in big companies.

It was probably developed very quickly, possibly outsourced, and just stuck in front of the older system with minimal re-engineering.

Many years ago, I worked on a system that put an X Windows front end in front of a mainframe app that used a 3270 emulator to interact with parts of the legacy app. I imagine this is somewhat similar.

</comment></comment><comment><USER26> Anyone got any stories of being affected by this breach?

<comment><USER27> The problem is identifying which breach caused your problem. Often, criminals use data from multiple breaches. Inaction on data security is actually lowering the liability for companies and pushing more responsibility onto individuals.

</comment></comment><comment><USER28> > Equifax did not see the data exfiltration because the device used to monitor > ACIS network traffic had been inactive for 19 months due to an expired > security certificate. On July 29, 2017, Equifax updated the expired > certificate and immediately noticed suspicious web traffic.

Ouch.

</comment><comment><USER29> What does the baseline of "good enough security" look like? For physical banks it looks like money stored in vaults with no staff access, cash in transit stored with market dye, etc etc

For the non physical world I have some ideas

\- The entire infrastructure of IT can be rebuilt in an automated fashion and is done so in a prod-parallel equivalent at least weekly

\- Any chnage to "vital" files on any server is audited

\- err?

</comment><comment><USER30> This is the equivalent to "We offer our thoughts and prayers" after a mass- shooting.

</comment><comment><USER31> >> _" Equifax's IT management structure was complicated" and "Equifax uses legacy software that is hard to secure"_

I feel for them (not!). BUT they shouldn't store any valuable data then. They should be not-insurable.</comment>


2014 Could Be the 'Tipping Point' for Female Founders, Says Jessica Livingston - <AUTHOR> http://techcrunch.com/2014/03/01/2014-could-be-the-tipping-point-for-female-founders-says-y-combinators-jessica-livingston <comment><USER2> I think it's mildly offensive to both sexes to present the lack of female founders in this way. To women is says; all you lack are role models and community support. Which has a 1950s, "even a woman can do it!" Ring to it.

To men, it reinforces the idea that women are being kept down by men. Maybe that's true and I'm simply not getting invited to the meetings where men gather to conspire to keep women down and out of the board room. Or maybe that doesn't happen and the real reason there are fewer women in the very high positions is a result of something else.

There is a vocal minority of dick heads out there who hate women and happen to be in tech. My guess is that they hate women for the very reason you would expect a "geek/nerd" to hate women; because girls ignored them, and were probably mean to them. The power balance in school between boys and girls goes a long way to explaining the animosity between some men and women in my opinion.

If I were asked to organise a talk to encourage women to become founders, I would ask an expert in risk assessment to speak, because we know it to be true that women are more risk averse than men. And that is why there are more male founders AND more male prisoners. To talk about anything else is just pretending there are no real, measurable and relevant differences between men and women. And I don't see how that helps anyone.

<comment><USER3> :There is a vocal minority of dick heads out there who hate women and happen to be in tech.

Prove it!

<comment><USER4> [https://news.ycombinator.com/item?id=7328572](https://news.ycombinator.com/item?id=7328572)

<comment><USER2> Proved! Oh the irony.

<comment><USER3> That is one idiot, not idiots.

<comment><USER4> How many people makes a minority these days?

</comment></comment></comment></comment></comment></comment><comment><USER5> After attending the conference, I'm even more convinced that 2014 could be the tipping point. I was blown away by both the depth and quality of the presentations. There was a degree of openness that I've really only seen at a YC dinner (which are all off-the-record). This was one of those magical events, like the first Startup School in 2005, where everyone there was realizing as it was happening, that this was something unusual.

<comment><USER6> Honestly it was probably the best conference I've ever seen (I'm a male and I watched online).

What was really special is that people there were actually giving useful, practical advice instead of just telling the story of their company. There was no bravado, no bullshit, and it sounded like the speakers actually wanted to help people in the audience and pass on advice instead of promoting their companies.

Oh and the segment on fundraising was probably the most useful and forward talk on fundraising I have ever listened to in terms of practical advice.

There's a statistic - Ben Horowitz used it in a talk once - that on average an educated woman will educate at least 4 other people in their lifetime, whereas you're lucky if a man educates one. I felt like this really rung through as I was watching this.

You should watch the stream of the conference if you haven't.

<comment><USER7> > There's a statistic - Ben Horowitz used it in a talk once - that on average > an educated woman will educate at least 4 other people in their lifetime, > whereas you're lucky if a man educates one.

How was that defined and measured? Or in other words, [citation needed].

Luckily, I've educated many people with nit-picky anonymous and pseudonymous internet comments, so I must have great karma.

<comment><USER6> Hey - I'm so sorry I didn't link the video for you!

Here's it is: [https://www.youtube.com/watch?v=wQnDDKDiSy8](https://www.youtube.com/watch?v=wQnDDKDiSy8)

It's 6 minutes in: "If you educated a girl in the developing world, you educate 5 people, because if you educate one girl, on average, she'll educate at least 4 other people through the course of her life."

I feel really bad for not linking it. Thank you so much for the reminder.

<comment><USER8> > "If you educated a girl in the developing world, you educate 5 people, > because if you educate one girl, on average, she'll educate at least 4 other > people through the course of her life."

I believe the [citation needed] is meant to ask for the source of this fact, i.e. whoever investigated this phenomenon and measured it.

To me, the statement is rather dubious because even the thesis is (in general use of the word educate) loosely defined -- Does a mother educate the children, is it the teacher who educates them, or do we count both? How often do we count the father as well? What about when a foreman teaches a fresh employee, is that education also?

Unless we exactly specify what is meant by education, this statement seems "purely inspirational" to me, i.e. rather meaningless.

<comment><USER6> You should ask Ben then! He's a really smart and accomplished guy and I'm sure would be very happy to share that with you.

<comment><USER9> This is how myths get started. _He said it and then I 'passed it on', because if it came from him so I assumed it to be true, 'cause he's a pretty swell guy_, rinse and repeat.

<comment><USER10> In other words, it's an argument-to-authority (discarding the Latin here). Claiming "some famous guy said it!" is no more a proof than claiming "crazy, homeless Bill said it!": a convincing argument should be able to stand on its own weight, without being stated by a credible source.

If the hypothetical 'crazy, homeless Bill' said that the sun were bright, he'd be correct regardless of the fact that it came from 'crazy, homeless Bill'. If Ben Horowitz stated that 1 = 2, then he'd be wrong, regardless of the fact that he's 'Ben Horowitz'.

<comment><USER11> Argument from authority is a formal fallacy, but in terms of practical reasoning it's a valuable tool. If you find that someone has been reliable in their claims in the past, you would be a fool to not give some weight to future claims. Of course, that has to be modulated by your priors for each claim. But it is perfectly reasonable to form a weak belief on a respected person's say-so.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Thanks YC for putting this conference together. It was seriously the best conference I've ever been to.

The talks were real and gave honest and practical advice we could all relate to. The audience was incredible. Everyone I talked to was a founder and / or engineer. I haven't been at an event with so many impressive women in one room!

We got a glimpse of what a world with a lot more female founders would look like, and it's going to be better than I could have imagined.

</comment><comment><USER13> Role models matter a lot. Seeing relatable people be successful in ambitious undertakings can be transformative. I can only hope this trend continues so that, decades from now, our children and grandchildren will shake their heads in disbelief that technology and entrepreneurship were "for boys".

<comment><USER14> Its my belief that most women, and men, throughout human history HAVE been entrepreneurs. What is a farmer, after all? Or a hunter? Or a gatherer?

After all, what do people naturally do? What do animals naturally do? Well, they don't sit and wait to be told what to do. No, they seek out opportunities.

The current economic arrangements, however productive they are, are the anomaly.

I don't think they are going away, but the work we do will become more more entrepreneurial as labor is automated. And as education evolves away from "sit still and listen to the lecture" towards something more compatible with how people actually thrive.

<comment><USER15> > What do animals naturally do? Well, they don't sit and wait to be told what > to do. No, they seek out opportunities.

Emulation is a massive part of animal behavior and learning, just FYI.

</comment></comment></comment><comment><USER16> Totally Agree. I see more & more female founders coming up.

I think it was great initiative by YC. Though I couldn't attend this time, Hope to have more of such conferences. Excellent way to build up our female network and learn from each other.

Kuddos to YC for taking up this initiative

</comment><comment><USER17> > "Learn to program yourself. That is the best advice I could give to anyone > non-technical," she said. In addition, she said, non-technical founders > should surround themselves socially with programmers.

For context, she said this specifically about women _who were having trouble finding technical hires_.

</comment><comment><USER18> For those who missed it: [https://www.youtube.com/watch?feature=player_detailpage&v=QD...](https://www.youtube.com/watch?feature=player_detailpage&v=QDaqt9NzDUc#t=2238)

</comment><comment><USER19> A small piece of anecdata that feels relevant : I took my three year old daughter to her friends birthday party yesterday - and there met amoungst others a chemical scientist with two PhDs, two City lawyers and an ex-fortune 50 development lead. All female, all skilled and all normally happy. And one who was extra happy because a local business was hiring her to do her old job, two half days a week and at a fraction of her rates.

Any one of whom happily outshone me in risk taking, capability and skill sets, but I was the self employed one.

I don't think that a high growth shoot for the moon startup can be run whilst doing anything else like raising kids, but there is a world of alternatives between the next 100m exit and nothing.

Oh and risk assessment - oh yes, given my daughter is currently jumping off the stairs onto a chair, risk assessment is a real boon to colonising that middle ground of entrepreneurialism as well as an equal number of all or nothing founders

</comment><comment><USER20> It's good to see stories that call attention to unique problems faced by women in technology. But you will know that progress has been made when we start seeing stories about women succeeding or failing in the industry and the news doesn't associate those triumphs or setbacks with gender.

The four stages of overcoming social stratification:

* Contributing to or ignoring the disadvantaged group's problems.

* Recognizing that the group faces undue burdens but not acting.

* Pushing for the group members to be treated differently to recognize their intrinsic value / contributions to a society, industry, etc.

* The "Aha!" moment when a majority of people realize that not only does the group bring value to an industry, but that value has nothing to do with their ethnicity, gender or other born characteristics.

After the "Aha!" moment, more news stories focus on what individuals in the group are doing rather than the fact that they are doing it despite their identities.

<comment><USER21> Did you get these from somewhere or are they just your opinion on how this does/should happen?

 _Pushing for the group members to be treated differently to recognize their intrinsic value / contributions to a society, industry, etc._

If you mean treated differently as in no longer doing whatever it was you were presumably doing before that contributed to this group's "undue burdens," OK. But I'm not clear that that is what you mean, based on what you said.

If you're advocating preferential treatment due to "undue burdens" (e.g. Affirmative Action), all you're doing is discriminating in the other direction and adding an undeserved burden to other groups that didn't have it before. That's not progress; it will only ever 'work' at the expense of creating or inflaming animosity based on this attempt to counter inequality with unfairness.

 _But you will know that progress has been made when we start seeing stories about women succeeding or failing in the industry and the news doesn 't associate those triumphs or setbacks with gender._

This I absolutely agree with. Women are underrepresented in all sorts of areas, but firmly planting that badge on their foreheads takes away from their individual successes and failures. Defining someone -- anyone -- based on their sex, ethnicity, nationality, etc. for the purpose of categorization serves only to tacitly affirm discrimination.

<comment><USER20> I was sharing my opinion based on observations about how various disadvantaged groups have made social progress in the United States.

I agree with your ideas about the way "treated differently" should be defined and how preferential treatment is counterproductive. Hopefully we'll see more news stories in the future that focus on women's successes and failures but don't concentrate so much on gender.

</comment></comment></comment><comment><USER22> I think it's great that there are more female role models, which will undoubtedly have a knock on effect in the industry.

The one thing that really puzzles me in this article is the following quote:

"I'm not an aggressive person, and often, girls aren't trained to be aggressive in the same way that boys are."

I am hoping this has been taken out of context because otherwise it's really a sweeping generalization without substantiation. This worries me. I think it's great to make women aware of trends in the tech industry and society, but statements like this will put people off from listening. I'd be interested in data that backs up the fact that boys are trained to be aggressive. My anecdotal evidence to the contrary includes myself and my male friends. I don't have any reason to believe that we have been trained to be aggressive, but that might be because we fall outside the "often" bracket.

<comment><USER23> There actually are studies showing women ask for raises less often, etc.. That could be what they are talking about re lack of aggression. Although I admit I haven't seen anything re if it is nature or nurture that causes it. Although, personally, even as a non-aggressive tech geek myself, as a male I had a couple fights back in school when people stuck me with needles, etc.. We might be able to find stats that males fight more often.

<comment><USER22> Interesting, any links to studies that indicate that women systematically ask for raises less often? I find that topic particularly difficult myself, so I'm curious to know if I'm the odd one out when it comes to men in general.

I've never had a physical fight in my life. I'm also not sure that that's what was the intention of the quote.

</comment></comment></comment><comment> grey-area What a great set of talks - from the introduction giving an overview of the founding of YC, through the homejoy founder talking about their horrible mistakes and failures on the way to an epiphany, these talks have a lot of really fascinating, practical and useful advice. Thanks!

I loved the bit in jl's talk where she announces this conference, and it is reported in the press as 'Paul Graham announces...' :)

I'd definitely recommend watching all of these talks, and avoiding the toxic and inexplicable troll threads on HN on the original story. Perhaps those result from people not watching the talks before commenting? Anyway, here is a direct link to the video for anyone who has not seen these:

[https://www.youtube.com/watch?v=QDaqt9NzDUc](https://www.youtube.com/watch?v=QDaqt9NzDUc)

</comment><comment><USER24> amazing conference. women lining the walls, sitting on the floor--all of us incredibly grateful to be there.

female founders have more than our share of Sisyphian tasks; events like this give us the strength to keep going.

</comment><comment> k-mcgrady >> "Fully 34.5 percent of the female founders who have launched companies out of Y Combinator have had significant others as co-founders"

An interesting statistic. Does anyone know why this is the case?

<comment><USER17> Did you expect it to be higher or lower? (She said, by the way, it's a lower bound because they don't actually _ask_ , so she might not know about all of them.)

I have one wild guess that may influence it, while I'm sure there's many other factors; selection. They pay close attention to the strength of the relationship that the founders have because one of the most common ways to fail is for the co-founders to have a fall-out. When you're a couple, you've probably been on holidays or other adventures together (look at the Lanyrd founders for instance, who I think started Lanyrd on a long honeymoon) or worked your way out of tough times and sticked together, there's clear evidence you have the potential to work together through stressful situations. (And who knows, perhaps they're less likely to walk away if it means walking away from their startup _and_ spouse.)

<comment> k-mcgrady I expected it to be lower but tbh I hadn't really thought about it. Selection is a good point though, it could be a good criteria for a strong co-founder relationship.

</comment></comment></comment><comment><USER25> On the conference itself - Great information imparted by talented and interesting individuals. Unfortunately the event also shames YC with its overt sexism. You're better than this. I noted most speakers rose above it by keeping sexism out of their talks. Not all did and that is a shame.

</comment><comment><USER26> This is very cool, but could we please stop calling things a tipping point? The tipping point for 'tipping point' was when Groupon stopped being thetippingpoint.com. Since then it's just been shorthand for 'change is happening'.

Could we please get a more interesting metaphor?

</comment><comment><USER27> i fail to see why this matters.

</comment><comment><USER28> Women typically don't want to be founders. The ones that do generally lack the physical and emotional stamina, intuition, instincts, persistence, are too emotional in their decision making, lack natural leadership skills ETC. If all this somehow changes, any year could be the tipping point. Good luck ladies.

Women in general, I think your best bet would be to try to rid the world of all the no talent entertainers (such as Miley Cyrus, Beyonce singers actresses ETC). All these women do is shake their butt or breasts all over and try to sell sex. Speaking of selling sex, get rid of all hookers, strippers, porn stars, nude models, start dressing your teenagers and yourselves modestly (cover up), stop sleeping around, no more one night stands, having 4 kids from 3 daddies, stop stripping down in movies too, doing half naked fashion shows or miss X contests, ETC. You do nothing but lose respect when you do all of this. You think men are pigs for ignoring the fact that you have a good brain in that head and just staring at your chest, yet women doing all of the things I mentioned are why men think like this (a vicious cycle I know).

Do this and I guarantee that you will have a tipping point that is unprecedented. Men will take you seriously and the amount of respect that you get will be far greater than today.

I am not saying that this would guarantee or put you on equal footing as a founder because the skills and desire that is necessary are not common in women. But it would sure help you be taken seriously, and there is not much that is more important than that.

<comment><USER29> I've just been ignoring _(well, downvoting a few)_ the HN-comments around these YC Female Founder. But this one, this one is just awful. You represent the absolute fringe worse-case scenario that I suspect a few of the other commenters are thinking just not foolish enough to actually post.

Get back in your time-machine and return to the 1950s.

<comment><USER30> People will believe anything they fear is true.

</comment></comment></comment><comment><USER31> I have two daughters, I strongly believe that women are very talented, in particular communications, management and focus are their strengths where they can easily outplay their male competition but I dislike this women movement everywhere.

Women do not need special treatment, they are not disabled. They were enough women making stellar careers for years. Such events make women feel _disabled_.

But I know that many weak protagonists jump on this trend because that's the only way they can get attention (Jessica Livingston, Sheryl Sandberg and many more).

<comment><USER17> Concluding that they therefore must be doing it purely for attention is quite a stretch. Please don't forget to consider the possibility some people simply disagree with your opinion about such events, especially when they're affected by the situation in different ways than you.

<comment><USER31> I think you didn't get my point -- they engage in such activities because they couldnt succeed somewhere else and think the cause of their failure is that women do not have same opportunities. Moreover, it's easy to get attention with this subject. Women and career is a foolproof topic press and media love. Women who really succeed do not have the time to engage and they do not need to. They don't need this special treatment because they are successful because of what they do and not what they are.

<comment><USER17> You're right, I didn't get that point, I still can't say I agree but thanks for clarifying.</comment></comment></comment></comment>


Support large repositories. - <AUTHOR> http://lwn.net/Articles/381854/rss

<comment><USER2> Some good comments here, too: [http://www.reddit.com/r/programming/comments/bml4i/support_l...](http://www.reddit.com/r/programming/comments/bml4i/support_large_repositories/) , including:

 _There's a reason companies pay hundreds (or is it thousands) of dollars a seat for Perforce.

Semiconductor industry similar to games. A big chip like a GPU or large CPU can have millions of files, with multiple branches for development and different models._</comment>


Ask HN: Blogs about reliability/infra/sysadmin? - <AUTHOR> Looking for more contents like rachelbythebay (currently on the frontpage). <comment><USER2> [http://highscalability.com/](http://highscalability.com/)

[https://medium.com/faun](https://medium.com/faun)</comment>


Ask YC: Where else do you spend your time (online)? - <AUTHOR>

Besides news.yc, what other communities / sites / webapps do you use the most?  If you have a regular (non-web) app that consumes an inordinate amount of time, include that too. <comment><USER2> email, delicious, google reader, working off to do lists with igoogle. on breaks i watch videos on youtube, hulu, chat on meebo, and browse facebook occaisionally.

off-line i mostly read newspapers and books...patiently waiting until kindle comes back in stock

<comment><USER3> !!|sed 's/hulu//g' Maybe i should get out more...

</comment></comment><comment><USER4> This is pretty much it.</comment>


How do amateur security engineers learn to find new exploits to produce CVEs? - <AUTHOR> Saw a similar post on reddit but it didn't have many responses. I'm also very interested in the subject.
Considering one already has experience in security. E.g. Bachelors/Masters level courses, practical bug bounties, CTF and can use metasploit. These all teach the users how to use tools, or to find pre-existing/known attacks and vulnerabilities.
How does one jump from this to finding new/undiscovered vulnerabilities in applications, operating systems that could be made into actual CVEs?
Does anyone have experience in this?
For example, how do those in Google Project Zero perform such finds?
Thanks. <comment><USER2> There is no magic. You have to try things. There are two things that worked for me personally:

* Study the technology in order to find out potential oversights and design problems. * Fuzz test it to find problems by brute force.

Keep in mind that the more you practice the better you become at it. Your intuition will start to help you filter things that are worth exploring and as such get more fruitful results faster. While you can read about vulnerability research techniques, your intuition will only grow through practice and experience.

Also the more bugs you discover the more confident you become which also helps in the long run because in many situations you will not know what you are doing but you believe strongly that you will find something.

Also, keep in mind that while security researcher are smart people, what they do is not that genius at the end of the day. When you are reading someones awesome research you may come to the conclusion that the work had the same logical development as outlined in the paper - a stroke of a genius. It does not work quite like that in reality. It only makes sense at the end. It does not make that much sense in the process. You just fake it until you make it. :)

So yah, the way you make the jump from using tools to finding vulnerabilities yourself is by making that jump. Pick a small target area of research first and grow from there.</comment>


OnLive Launches Cloud Video Game Console - <AUTHOR> http://www.informationweek.com/news/global-cio/trends/showArticle.jhtml?articleID=228300137&cid=RSSfeed_IWK_All

<comment><USER2> Interesting. I'd like to see videos of the gameplay and stats on performance, load times, lag etc.

The Netflix of gaming consoles?</comment>


Battle over Encrypted DNS - <AUTHOR> https://www.wsj.com/articles/google-draws-house-antitrust-scrutiny-of-internet-protocol-11569765637?mod=rsswn <comment><USER2> Ridiculous... the cable and wireless companies expose their moral bankruptcy with this lobbying.

"Traffic shaping" to manage the network is a reasonable goal (whether or not you agree with it). "Monetizing consumer data" is slightly less reasonable, but still arguably reasonable. It is, however, NOT OK to do this without clear Notice, Transparency, and Choice to the consumer.

Today, these large ISPs do the opposite: hiding their behavior, offering no choice, and now enlisting lawmakers to eliminate alternatives.

The cable and wireless providers should ask their customers: are you OK with unencrypted DNS (a less-safe protocol) in return for lower prices (because we can throttle certain streams and monetize with advertising data)?

Or, if they suspect (rightly) that most customers would say "hell no"... these ISPs should offer a competitive encrypted DNS solution of their own. You're Internet service providers, for heaven's sake -- provide a modern Internet service, instead of regulating that your customers use your inferior legacy DNS!

</comment><comment><USER3> Actual title: "Google Draws House Antitrust Scrutiny of Internet Protocol"

HN title: "Battle over Encrypted DNS"

Real title: "Cable and wireless monopolies caught stealing consumer data and selling it, ask Congress and Media to force Mozilla and Google to stay with unsafe internet protocol so they can continue to sell their customers"

<comment><USER4> Real real title: "Battle over Centralized DNS"

(I'm guessing they're talking about DoH, I'm not a WSJ subscriber and can't read the actual article.)

</comment></comment><comment><USER5> is it beyond them to supply their own DoT or DoH services (maintaining the info they have) and then using that as a selling point?</comment>


Ask HN: Why hasn't the Semantic Web caught on? - <AUTHOR> <comment><USER2> I think in a way it has, just not in the purist sense that Semantic Web proponents have advocated.

Microformats, semantic HTML tags, and non-rendered meta-data can be found all over the place. Especially in eCommerce.

What hasn't caught on is the formal language of the semantic web. And for that my hypothesis is that it is so formal and so strict that it produces a barrier of entry that is too high for non-academics. RDF has a bit of a leaning curve compared to competing technologies. Furthermore, FOAF (Friend of a Friend) last time I looked at it had a lot of outdated domain specific tags. For example, there is a tag for ICQ (an instant messenger practically no one uses anymore but was very popular in the 90s) but no tags for new technology rather than, say, having generic tags that can be used for any messenger system and using attributes.

Summary:

\- High barrier of entry

\- Easier to use alternatives

\- It hasn't really failed, it's just taken a form that is more friendly for day-to-day

Edit: Also, if you go the Semantic Web Meetup in Cambridge there are a lot of talks of the medical industry, database industry, and things like that which show it is alive [https://www.meetup.com/The-Cambridge-Semantic-Web-Meetup- Gro...](https://www.meetup.com/The-Cambridge-Semantic-Web-Meetup- Group/events/232572089/)

</comment><comment><USER3> It depends what you mean by "Semantic Web"

Many companies are using RDF-based technology and are not talkative about it because they see it as a secret weapon. I find out about these by going to conferences, cold calling, etc.

People are slowly starting to understand about JSON-LD, maybe around 2025 people are going to realize that it's a problem that vanilla JSON lacks decimal math. (Even COBOL programmers know if you do money math with floats you will sooner or later cut somebody a check for the wrong amount) JSON-LD unobtrusively adds the "good parts" of XML (decimal math, date and time types,...) to JSON.

As for the model of "Linked Data" the deep problem is that the model of "I publish data, throw it over the wall, and my responsibility is done" does not work. As much as people like to deny it, there is a science of quality, and it involves forming feedback loops that just don't exist in the likes of DBpedia, Wikidata, etc. See the last part of this essay

[http://ontology2.com/the-book/data-lakes-ponds-and- droplets....](http://ontology2.com/the-book/data-lakes-ponds-and- droplets.html)

</comment><comment><USER4> It helps to first ask what problem the semantic web is trying to solve. It most business cases, it solves more problems for 3rd parties consuming your markup than it does for your own business.

Because most of the time, you already have your data in a structured format of some kind. So if you need to share data between your own systems, you use the underlying data, not the presentation layer. And your end users see the UI created by your markup, so they don't really care either. Semantic markup really helps other people ingest your data... so unless you intend for your data to be shared, it infrequently makes a ton of business sense to invest effort into making things semantic.

That being said, if you DO intend to share your data, and want it exposed and usable, then it does make sense to work at it. But in the grand scheme of things... where does most web content fall?

</comment><comment><USER5> In many ways it has, you just don't necessarily see it. SemWeb tech is largely _not_ something humans see directly... machines use the SemWeb to do things for humans, but the back-end mechanism is opaque to the human user.

</comment><comment><USER6> creating a really good ontology is not an easy tasks.

also, you need to decide on a format, and there are all sorts of micro formats to choose from. You would have to get everyone on board.

Writing HTML from the old days was pretty easy, and most browsers could handle bad HTML. I am not sure if the same could be said about bad micro formats.</comment>


Hacker Faces 60 Years - <AUTHOR> http://www.webpronews.com/topnews/2007/11/12/hacker-faces-60-years <comment><USER2> you mean cracker?</comment>


Show HN: Konstellate – An Open Source GUI to Visualize Kubernetes Applications - <AUTHOR> https://github.com/containership/konstellate <comment><USER2> Someone who uses Kubernetes on a daily basis here.

The visualisation thing looks like a nice to have feature, but nothing a K8s administrator can't live without. What's really interesting is the yaml generator tool. This is something that would significantly improve my productivity if only it were a little bit more uses friendly. Building new deployments/jobs/resources in general involves a lot of 'kubectl explain' invocations and documentation searching, not to mention the painful experience of making sure the yaml is properly indented. This tool has a lot of potential when it comes to improving that experience, but it would have to be simpler and faster, e.g. remove the popup windows after clicking "plus" and instead have a panel at the bottom of the screen. Do something to remove the extra clicks when adding nested items, maybe a tree-list structure with quick-add option? I mean, after you get accustomed with all the fields you don't even need the description anymore, you just want to add new attributes and assign values to them.

<comment><USER3> The way I've saved myself from YAML insanity in k8s is by using kubecfg [1] and kube.libsonnet [2]. I can now build abstractions that work for my particular deployments and never have to worry about extraneous verbosity in day-to-day operations.

[1] - [https://github.com/bitnami/kubecfg](https://github.com/bitnami/kubecfg)

[2] [https://github.com/bitnami-labs/kube- libsonnet/blob/master/k...](https://github.com/bitnami-labs/kube- libsonnet/blob/master/kube.libsonnet)

</comment></comment><comment><USER3> This would be a nice addition to kubecfg.

Eg `kubecfg show --web` to bring up an HTTP server that hosts this and lets you inspect the k8s resources that your jsonnet describes.

<comment><USER4> Yeah that is definitely something we are considering adding in. It seems to be a pretty logical next step. Also, we want to tie it into local folder structures to enable a gitops flow!

</comment></comment><comment><USER5> Why clojure here?

<comment><USER6> Developer here. I suppose the simple answer is that this was a personal/side project at my job and I picked the language I most enjoy. Additionally, I've been hacking on a couple of libraries for writing web apps for the last few years and wanted the chance to hone them on something non-trivial.</comment></comment>


SF to release Transbay housing developer from grocery store commitment - <AUTHOR> http://www.sfexaminer.com/sf-release-transbay-housing-developer-grocery-store-commitment <comment><AUTHOR> TL;DR:

1) Developer gets project approved partly conditional on reserving 70% of retail space for a grocery store.

2) Developer deliberately allocates only 10 _(ten!)_ parking spaces to _the entire retail footprint_ (not just the store!).

3) Surprise! No grocery chain wants in under those limitations

Result: developer gets out of commitment. The 55-story building will have no inherent or added grocer. _Ka-ching!_

<comment><USER2> I hope the developer gets punished somehow for acting in bad faith.

<comment><AUTHOR> I'm guessing that this wouldn't have unfolded the way it did had they not greased the necessary palms from the outset.</comment></comment></comment>


Ask HN: What is the state of the art set of tools for front end Web developers? - <AUTHOR>

Libraries, Frameworks, Testing tools, Continuous Integration tools, Automation tools, Compilers, Debuggers, Profilers, Collaboration tools... <comment><USER2> Current stack at work for me is Clojurescript / Reagent / Boot.

In JS land, I'm in the React camp. React's model is the biggest step forward on the frontend since jQuery. I stick with React over faster/smaller alternatives (virtual-dom) because the community size network effects mean there's stuff I want to use that I didn't have to write (e.g. React Router). I'm not a fan of any Flux library I've run into (and I've checked a dozen) so I'll be porting my cljs setup whenever I have to switch back. I'm in the functional JS camp so Immutable.js, Ramda, and js-csp for libraries and I run mocha+chai for testing. Keep an eye out for Netflix's Falcor and Facebook's Relay, which are vaporware at the moment but most likely disruptive.

I favor Webpack over the js task runners. It's always mostly done what I wanted and extending it is fairly straightforward. I find the configuration setup somewhat arcane but I've done enough variations that I have a working version of what I want to do somewhere on my hard drive to copy/paste.

Compiler is babel. The dev tools in most browsers are comparable, I'm still mostly on the Chrome ones out of familiarity.

</comment><comment><USER3> A compilation of things I consider state of the art in the world of Front End.

Libraries : There are infinite number of libraries so - its kind of hard to mention any single one. But VirtualDom[1] is a great one. Also jstruct[2] seems like a good one.

Frameworks : React, Angular 2, Ember - Perhaps even Mercury or other VirtualDom based frameworks.

Testing Tools : Jest. A few other property testing tools as well.

Continuous Integration : ??

Automation Tools : Protractor ?

Compilers : Hmmmm. Babel obviously. Also consider Spiderlang, Clojurescript and Typescript.

Debuggers : Remote Debugging Protocol. Note that this is not itself a debugger but an enabler.

Profilers : Chrome and Edge Profilers.

Collaboration Tools : Not sure what you mean by this.

[1] : [https://github.com/Matt-Esch/virtual-dom](https://github.com/Matt- Esch/virtual-dom) [2] : [https://github.com/sebinsua/jstruct](https://github.com/sebinsua/jstruct)

</comment><comment><USER4> I want to ask where ember.js stand at?

<comment><USER2> Ember is IMO second best at everything, which is pretty good for a fully integrated stack. If you don't have a very good idea of what you want to use for all the pieces of your app, you're working with a group of less experienced frontend developers, or you're on a project that's going to be maintained for a number of years by someone else, Ember is probably the best choice. Their project stewardship has been commendable.

</comment></comment><comment><USER5> Meteor</comment>