Details Behind Today's Internet Hacks - <AUTHOR> http://blog.cloudflare.com/details-behind-todays-internet-hacks <comment><USER2> > _Technical teams from CloudFlare, OpenDNS and Google jumped on a conference > call and discovered what appeared to be malware on the site to which the > NYTimes.com site was redirected._

On the HN post _" Google.ps domain was hacked (google.ps)"_ [1], HN user _biot_ predicted this exact scenario, although not a zero day most likely. He talked about submitting hacked sites to HN _"... and thousands of HN readers get infected by a zero-day exploit. Maybe. If you're thinking of submitting a known compromised site to HN, consider instead submitting a third-party site which explains/documents the compromise. Ideally from a respected security research company"._ [2]

[1] [https://news.ycombinator.com/item?id=6278737](https://news.ycombinator.com/item?id=6278737)

[2] [https://news.ycombinator.com/item?id=6279253](https://news.ycombinator.com/item?id=6279253)

<comment><USER3> I'd suggest extending the idea to non-responsive sites as well. Instead of submitting a link to a company's homepage when they're being DDOSed or are otherwise unavailable, submit a link to their status page if they have one or, failing that, use a third-party indicator. Off the top of my head I can't think of a third-party indicator that would capture point-in-time availability, but a manually crafted URL like [http://isup.me/example.com?1970-01-01T00:00:00Z](http://isup.me/example.com?1970-01-01T00:00:00Z) would get the point across just fine.

<comment><USER4> Maybe something like Zapier's API Status Board, though I'm not sure how realtime and whether it only applies to site's APIs rather than their general websites.

[https://zapier.com/status/](https://zapier.com/status/)

<comment><USER5> It applies to their APIs specifically. It is realtime within ~5 minutes.

</comment></comment></comment></comment><comment><USER6> Basically zero information. They keep telling us how MelbourneIT is usually more secure but doesn't do on to tell us how it is any more secure than other registrars. More importantly, even with admin access to to their control panel how can it be so easy to change registry information of such high profile sites with a click of a button?

<comment><USER7> Devilishly clever marketing for Cloudflare, though. Clearly I need to spend my days on more bridge calls for situations affecting other ops teams that have nothing to do with me, so my company can put out a PR piece from a position of authority about how awesome we are. What exactly did a team of people at Cloudflare do today? Consult? Do you bill hourly or is it a friendly NYT discount? What was your plan connecting end users with recursive operators? Want them to manually flush their resolvers out of the normal DNS TTL protocol? Is that a service that comes with my Cloudflare subscription?

Next time a startup goes down, ask yourself: if I were on a bridge call with their ops team, could I use this to sell my company's reliability product? Clearly, the answer is yes.

Classy, too, jumping out in front of MelbourneIT's response then speculating on it. I would be furious about Cloudflare writing a details-thin "postmortem," headlining it as a postmortem, analyzing my initial statement to customers in it, then getting it on HN before DNS caches are even cold from the incident itself. It's not even subtle.

This is the sort of thing I remember in discussions about using Cloudflare. There's lots of choices for CDNs, a market growing surprisingly full of ambulance chasers: one CDN startup had the fucking courage to email me directly after a hellish multi-hour outage and say "want to set up a call to discuss how our product could have prevented this outage?" I was still awake from fixing the problem overnight and no, your CDN is not going to fix my catastrophic DB failure. Get bent.

This is a disgusting move by Cloudflare. The little human network signoff made me gag; don't forget, small ops teams, you will only get things done if you know people. Notice HuffPo wasn't on the call? Exactly.

<comment><USER8> Didn't they pull a similar story telling people an attack on them by Cyberbunker impacted the London Internet Exchange, prompting quite some pandemonium?

I remember there being a more somber post after the whole incident by another blog detailing just how little fluctations there were on the alleged day of the incident, and how the numbers didn't stack up.

Cloudflare is tricky, isn't it?

<comment><USER9> This is known as 'inserting yourself in the news story' and it works well as a marketing trick but in this case cloudflare is actually part of the story because the NYT (one of the affected sites) and cloudflare did communicate on the subject. The more peripheral the link the trickier it is, in this case (a first order contact with the affected party which was initiated by cloudflare) I think it is fine to issue some statement, but not necessarily this statement.

<comment><USER10> Not only did CloudFlare (where I work) and the New York Times communicate, the CTO of the paper has said the following: [https://twitter.com/rajivpant/status/372559771960098816](https://twitter.com/rajivpant/status/372559771960098816)

"I'm super impressed by the operations, incident/crisis management & expertise of the @CloudFlare and @OpenDNS teams."

<comment><USER7> Before leaving my comment, I searched and searched for any shred of reason for CloudFlare to release this inappropriate statement, including reading all of Rajiv's timeline. Obviously, since I left the comment, I came up empty.

Can you point to what you feel makes this statement appropriate on behalf of your company? I can't identify what annoys me most about it, because there are many things: the "it's who you know in ops" attitude that I've been fighting for my entire career, the creation of a Batman-esque hero at a startup CDN provider who assembles a team to guide the lesser ops teams through a crisis, the overdramatizing of a DNS hijack that happens countless times daily (just with an interesting vector this time, but certainly not the first of ITS kind, either), speculating on another company's statements, preempting an official response with your own "postmortem" to score some traffic...

It's particularly frustrating because I've been in this exact scenario, to the T and including a registrar compromise, before. But because my personal side project doesn't have name pull, I didn't get a CloudFlare Crack Squad on speakerphone calling in a dozen courtesy phone favors to score my contract. And I had to wait for tickets and TTLs like _everyone else_. That sounds bitter -- and I hate bringing it up for that reason -- but that's why this is ethically shitty. Either you're playing favorites or capitalizing on something for sales. There is no third option, not even an altruistic one.

<comment><USER11> No good deed, it seems, goes unpunished by those upset they're not getting enough attention. May I suggest you read the end of the NYT CTO's recently updated blog post:

[http://www.rajiv.com/blog/2009/12/10/tech-ops- irc/#2013Aug28](http://www.rajiv.com/blog/2009/12/10/tech-ops-irc/#2013Aug28)

<comment><USER7> That wasn't remotely the thrust of my comments and you know it. I also (correctly) predicted you would hop on the bitter swan song instead of, you know, the half-dozen reasons why this sucks immediately prefacing it. Also, that's two employees who have posted Rajiv's words as rationale for the blog post; can we go for three? Shouldn't you be hiring Rajiv at this point, as hard as you're riding him?

Address something smaller and bite-sized, like preempting MelbourneIT's statement with your own and speculating on their behalf. Can you at least defend that inappropriateness? Can we start there?

Your company provided guidance and connections, which makes this statement inappropriate. Or did CloudFlare do something that has been left out of all statements?

I am _not_ annoyed by your "good deed". I'm annoyed by how hard and how inappropriately you are capitalizing upon it as a PR coup, before the ashes have even settled. The victim tone is discouraging for this conversation, I have to say, and it's quite unbecoming.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> > At 1:19pm (PDT) today, a researcher noticed that the New York Times' website > wasn't loading.

So if the content on the redirected page had been more subtle - for example, mirroring NYTimes but editing stories etc - then things would have taken a lot longer to have been noticed?

</comment><comment><USER13> Are there any registrars that allow one to set serverDeleteProhibited, serverTransferProhibited, and serverUpdateProhibited?

<comment><USER14> I'm not sure it would have helped in this instance. If the attacker got access to the administrative interface for the registrar, all he'd have to do is unset the relevant flag first, using the same interface, before changing the name server records.

These flags are the functional equivalent of forcing you to break a piece of glass before pushing the fire alarm button.

<comment><USER15> Some registrars require you to send in a hardcopy request, along various forms of ID, in order to clear these flags. I know mine (PairNIC) does.

It's not unspoofable, but it is an time consuming extra step that involves a human on the receiving end.

 _Edit:_ I was thinking of the client(Update|Transfer|Delete)Prohibited flags, which is a registrar lock. I'm not even sure how one goes about setting the "server" version of those flags for a registry lock, but it's probably even more complicated.

<comment><USER16> And someone reviews that hard copy and flips a switch in an admin interface like the one that supposedly got hacked?

<comment><USER17> Probably sends out a call to verify first.

</comment></comment></comment></comment></comment><comment><USER18> So, if my DNS is hacked, I can call Google and OpenDNS and have them correct my records upstream? And then contact Verisign for a registry lock? And expect a personal response from MelbourneIT (even though it's likely their reseller's fault)? This is great news!

<comment><USER11> If you're the paper of record, yes.

</comment></comment><comment><USER19> The details actually look pretty sparse. I'm looking forward to MelbourneIT letting us know the specifics (if they do!).

<comment><USER20> Particularly the malware. Is this related to the Google Palestine hacking yesterday? Somebody linked the hacked site and it hit top of HN, so a number of us had to have clicked through to it.

<comment><USER21> Uh oh. What was that HN link?

<comment><USER20> [https://news.ycombinator.com/item?id=6278737](https://news.ycombinator.com/item?id=6278737)

</comment></comment></comment></comment><comment><USER22> I'm amazed that Melbourne IT seem to be held in high regard these days. Going back to the 1990s, they had a monopoly on Australian domain registration, they charged the earth, and had really crap customer service.

<comment><USER23> I've only heard bad things about them.

</comment></comment><comment><USER24> > The correct name servers should have been DNS.EWR1.NYTIMES.COM and > DNS.SEA1.NYTIMES.COM.

How does this work? How would you get to DNS.EWR1.NYTIMES.COM without first knowing where nytimes.com is?

<comment><USER25> Nameservers have their IPs registered with the registry, and they are returned in the additional answers section. These are called "glue records".

</comment></comment><comment><USER26> How would setting the registrar lock have helped in this case? The registrar lock can be unlocked by the current registrar... which was the target in this case.

It's good advice, but seems kind of irrelevant.

> It's worth noting that while some of Twitter's utility domains were > redirected, Twitter.com was not -- and Twitter.com has a registry lock in > place.

<comment><USER11> registry lock != registrar lock

The former is with Verisign and cannot easily be removed by the registrar. The latter is with the registrar and can be removed by the registrar. In whois status codes "clientXXX" = registrar lock (weak). "serverXXX" = registry lock (stronger).

</comment></comment><comment><USER27> I'll bet five dollars the credentials were stolen by a botnet the SEA runs or has access to. You wouldn't believe the shit that pops up sometimes. (It's also incredibly trivial to take over botnets run by jackasses who took a tutorial in setting up Zeus) Less likely but still highly possible would be spear phishing of registrar resellers.

Edit: I don't know why, but the nameservers I use don't resolve any address for nytimes.com now. If I query 22.214.171.124 directly I get a response. So, could be they're still suffering from this attack, which sucks.

</comment><comment><USER28> > MelbourneIT has traditionally been known as one of the more secure > registrars

They were one of the registrars compromised back in May as part of Hack the Planet[1]. If I recall correctly, they were the only registrar where the attackers actually got shell access on a server. That's when they lost any reputation for security in my eyes.

[1] [http://www.theregister.co.uk/2013/05/09/melbourne_it_hacking...](http://www.theregister.co.uk/2013/05/09/melbourne_it_hacking/)

</comment><comment><USER29> I don't think I understand why CloudFlare was involved - do they provide services to NYT, it isn't clear from the post that they do.

<comment><USER7> No, they're the concerned citizen that performed first aid on the motorist, then hung around to take questions from the media.

</comment></comment><comment><USER30> Good to see the MelbsIT product using two factor auth.</comment>


Ask HN: Where are the best places to find Freelance jobs? - <AUTHOR> I am a designer working with a developer and we are looking to do some freelance work. We have looked on craigslist, but that does not seem like the best place to find jobs. Any suggestions would be greatly appreciated! <comment><USER2> I recently wanted to break into the freelancing market and had some success with this chain of events:

1) I joined my local programming mailing lists - e.g. the nearest Hacker Space, Ruby Ireland. 2) I went to a local tech conference. 3) I went to local tech meet ups and made a lot of noise. I paid extra attention to the non techies. 4) I followed everyone I met at said events.

After a few months of doing this I understand the local freelancing scene much better, have a good idea of market rates and am exposed to lots of freelancing opportunities.

</comment><comment><USER3> I have had great success with Elance.com. At first I had to bid the projects on the lower end to get some ratings. After I had a few happy clients and a few 5 star ratings I started receiving 3-4 proposal requests a week. I also tried oDesk, but did not see the same results.

</comment><comment><USER4> Many of the freelancers I know work primarily from referrals. I realize this is a chicken-and-egg problem, so here are a few ways to get started:

\- Tell all your friends and family you're freelancing. Chances are, you can find a few leads this way.

\- Get hooked in with a network of local freelancers; they might share referrals. Unfortunately, I don't think you can just search for these groups on Google. I believe they're mostly informal networks of freelancers who stay in touch with each other, rather than actual clubs or trade organizations. I found one through another freelancer I happen to know, so give that a shot. YMMV.

-I haven't set up a Sortfolio account yet, but you might want to give it a shot. If you do, and it works out for you, please let us all know.

Best of luck!

</comment><comment><USER5> ODesk is a good resource to find freelance jobs, most are virtual though and I've heard it gets mixed reviews (mostly good though :)).

</comment><comment><USER6> There are posts here every month, although your mileage may vary regarding what you want out of them.

</comment><comment><USER7> Go to conferences and wear a big badge that says you're a developer.</comment>


Truly offline mobile chat via (Bluetooth) Multipeer Connectivity - <AUTHOR> https://testflight.apple.com/join/mLE8dqZH <comment><AUTHOR> We run the same code on the web server crowd mesh simulator to catch edge cases, and then on the iPhone. Open Source: [https://github.com/m4rr/burevestnik](https://github.com/m4rr/burevestnik)</comment>


Vim Cheat Sheet - <AUTHOR> http://gum.co/vimcs <comment><USER2> Why charge $1 for a Vim Cheat Sheet when there are so many out there that are free?</comment>


Port Talbot Banksy garage owner 'struggling' - <AUTHOR> https://www.bbc.co.uk/news/uk-wales-46771722 <comment> who-knows95 honestly, the art of banksy shouldn't be protected. that's not the reason he did the art, and ian shouldn't be held accountable for it.</comment>


How to hire salespeople for your startup - <AUTHOR> http://ezliu.com/blog/how-to-hire-salespeople-for-a-startup/

<comment><USER2> Some of this was useful. Thanks. It's fun to hate on Hotmail users, but perhaps the person's ported over to Gmail and just uses their old hotmail handle because they saw no reason to change. I'm not sure that filter is any more legitimate than one that would include AOL or Yahoo.

<comment><AUTHOR> I don't think its a particularly awesome filter.

I said "hotmail" but what i really mean is "any free service OTHER than gmail". I understand if you have firstname.lastname@example.com

Outside of that though, I use google docs and spreadsheets a lot, and less friction to get people i work with to use the tools i use is a good thing.

</comment></comment><comment><USER3> Very interesting article. Thanks for sharing.

Anyone have advice about salaries/commisions for salespeople in startups? Will candidates expect to earn less relative to larger, more established companies?</comment>


FBI would rather prosecutors drop cases than disclose stingray details (2015) - <AUTHOR> https://arstechnica.com/tech-policy/2015/04/fbi-would-rather-prosecutors-drop-cases-than-disclose-stingray-details/ <comment><USER2> This is not the only situation where investigators are hiding iffy information sources, and committing perjury. We all know about deals with informants, who sometimes receive immunity for major crimes, in exchange for their information.

But the elephant in the corner is DEA's Special Operations Division (SOD).[0] This funnels information from the CIA and NSA to the FBI, IRS, DHS and USCIS. But you will find _nothing_ about SOD in _any_ of the cases where it reportedly played a key role (according to that DEA Museum lecture).

Anyway, there's no evidence that SOD has ever been used except for major drug cases. But there's no reason to assume that it hasn't been, either.

0) [https://www.deamuseum.org/wp- content/uploads/2015/08/042215-...](https://www.deamuseum.org/wp- content/uploads/2015/08/042215-DEAMuseum-LectureSeries-MLS-SOD-transcript.pdf)

<comment><USER3> > _there 's no evidence that SOD has ever been used except for major drug > cases. But there's no reason to assume that it hasn't been, either_

What does this mean?

<comment><USER4> Lack of evidence of something does not equal evidence of non-existence of said thing.

<comment><USER5> In the context of Criminal Procedure and Rules of Evidence, the prosecution has to turn over all evidence (including mitigating evidence) in discovery and failure to do so means: a. It doesn't exist, b. If it does the prosecution is risking mistrial; their career/disbarment; and over turning convictions going back in time.

<comment><USER6> [https://www.hrw.org/report/2018/01/09/dark-side/secret- origi...](https://www.hrw.org/report/2018/01/09/dark-side/secret-origins- evidence-us-criminal-cases)

You're not wrong, but you're also significantly overstating the risks to prosecutors. Prosecutors are rarely punished for misconduct. [http://www.latimes.com/local/politics/la-me-lying- prosecutor...](http://www.latimes.com/local/politics/la-me-lying- prosecutors-20150201-story.html)

<comment><USER7> Indeed it's so common there's an accepted term for burying your poison vine: parallel construction.

<comment><USER2> This. It has become the norm. I suppose that it's justified by outrage over the sorts of crime involved. But with SOD and Stingrays, we're talking about widespread subversion of federal agencies, state police and prosecutors, and probably at least some judges. It has indeed been a criminal conspiracy. Not that anyone will ever be prosecuted for it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Is the preference to throw away the case because of all the accessory data being gathered? I wonder how much this has to do with all the DC stingray devices[0]. Truly a weird time to be alive. The first Stingray discussion I saw was at DEFCON 18[1], though that talk was just about 3G/2G. Is anyone seriously thinking that this shit is safe? I don't know the nuts and bolts of a current stingray, but I don't think it's $300k black magic. How many similar devices are running outside of LE identification?

[0] [https://www.wired.com/story/dcs-stingray-dhs- surveillance/](https://www.wired.com/story/dcs-stingray-dhs-surveillance/)

[1] [https://www.youtube.com/watch?v=fQSu9cBaojc](https://www.youtube.com/watch?v=fQSu9cBaojc)

<comment><USER9> There's a few reasons to throw away a case, and I make no assertion that these are why -

* they've identified a legal or technical reason that would render their evidence invalid

* may give up information that would let someone identify which towers are stingrays

* may give up information on where they are or have operated

* may be protecting some not-yet published or not yet well known exploits of the cellular network

> How many similar devices are running outside of LE identification?

Well, foreign versions of these have been found on US soil. No doubt we've deployed them internationally as well. Spies gonna spy. And it seems safe to assume that naughty hackers probably prop these up at major events for fun or profit.

<comment><USER8> I wonder if anyone has outlined best practices for going to major public events? Just a burner cell? I assume airplane mode isn't enough. Faraday cage bag and keep the phone off until I get outside the event. Since we no longer really have pay phones, I wonder what best secure SOP is aside from must "don't go". I think airports and tube stations qualify as minor major events.

I don't just worry about it because of the tracking, but also pushing false over the air updates. I know 4G is a lot more secure, but I don't fully understand the current stingrays. With the government saying they don't know who's running the DC stingrays, it pulls a lot into question for personal security.

Here's a presentation from last year's Blackhat:

"New Adventures in Spying 3G & 4G Users: Locate, Track, Monitor" by Ravishankar Borgaonkar and Lucca Hirschi

[https://www.blackhat.com/docs/us-17/wednesday/us-17-Borgaonk...](https://www.blackhat.com/docs/us-17/wednesday/us-17-Borgaonkar- New-Adventures-In-Spying-3G-And-4G-Users-Locate-Track-And-Monitor.pdf)

<comment><USER10> > I don't just worry about it because of the tracking, but also pushing false > over the air updates.

Pretty sure OTA updates are signed, and signatures checked, so you'd need to steal a vendor's private key. Those are almost certainly kept on a hardware security module, so it's not an easy task at all.

<comment><USER11> That's putting a lot of faith in HW manufacturers' security practices. I've had conversations with ex-employees of a couple of large cell phone firms who know about their build systems, and am not willing to buy those brands now.

(Think: Dedicated PCs, one builder for each major revision of a phone, basically unpatched for years, with magic and difficult to reproduce configurations. Don't know specifically about HSMs, but those seem unlikely given their level of care and sophistication).

<comment><USER12> That's a pretty accurate description of firmware build environments for a whole lot of products, not just cell phones.

<comment><USER11> Once upon a time, a certain large maker of a popular video game console lost the hardware engineer's laptop where the source code for the game controller firmware was. I don't know the nature of the catastrophe, whether the code was accidentally deleted, or the drive failed, or perhaps the employee left and the the laptop got recycled. In any event, the source was gone.

Source control? What's that? Sounds complicated and unnecessary. All you need are files on disk, right?

"Wait, I thought _your_ laptop had the source code. Um..."

They wound up paying a consultant to disassemble the binary and turn it back into plausible C. For all I know, given the way that those firmware engineers wrote code, the recreated source was of _better_ quality than the original. :-/

[I am trying real hard not to turn this into a "how bad can firmware code get" comment, but I do have to say that this was the same group where one contractor had written the firmware for a device, consisting of one massive function with a bunch of goto statements and static variables, with names like 'v' and 'x' and 'xx'. The contractor also seemed to think that removing whitespace from the program would make the binary run faster...]

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> I have 2 theories about why the EXTREME secrecy surrounding Stingray.

1\. It is based on stolen credentials / crypto keys.

2\. It is based on exploiting a vulnerability in the protocol.

Either way, secrecy is important. In case 1, if the secret got out, those keys / credentials could be revoked and replaced and Stingray would no longer work. In case 2, if the secret got out, every high school kid would be building a Stingray and poor people would be spying on rich and powerful people (gasp!).

In case 2, the vulnerability may be something that takes years to fix, requiring compatibility over the replacement period both to base stations and mobile equipment as old mobile sets attrition out of the system.

<comment><USER14> Given the vulnerabilities that have been recently announced for LTE, it seems to me that your #2 is much more likely. Anyone with a Software Defined Radio and the right code could run their own Stingray.

Circumstantial evidence of recent reports of massive increases in suspicious activities would seem to indicate that this is actually happening.

</comment></comment><comment><USER15> This suggests a criminal defense strategy where if someone was up to no good, they should arrange it so that the investigators are forced to use sensitive and illegal techniques to obtain evidence, making the case not prosecutable.

<comment><USER16> Criminals can't force the government to use illegal strategies. This problem is entirely self inflicted.

<comment><USER17> > _Criminals can 't force the government to use illegal strategies._

Parent said _sensitive_ or illegal.

I think it's perfectly possible to have such state of the art opsec, that the government would not be willing to out their investigative technique to bust a run of the mill criminal.

<comment><USER16> Actually parent says sensitive _and_ illegal, but it is beside the point. Criminals can't force the government to use their sensitive investigative techniques either.

<comment><USER17> > _Actually parent says sensitive and illegal, but it is beside the point. > Criminals can 't force the government to use their sensitive investigative > techniques either._

You're playing semantics. Written language is not machine code, try not to be a faulty compiler :)

Sure, a criminal cannot _literally force_ the government to use a sensitive technique.

But since the government tends to want to investigate all crimes it is capable of investigating, a criminal can easily create a situation where the costs involved with a prosecution (disclosing a sensitive technique, causing people to update opsec accordingly) outweigh the benefits (prosecuting a small time criminal).

The end result is that the government is figuratively forced to not prosecute a criminal despite having the capability to prove their guilt.

<comment><USER16> > But since the government tends to want to investigate all crimes it is > capable of investigating, a criminal can easily create a situation where the > costs involved with a prosecution (disclosing a sensitive technique, causing > people to update opsec accordingly) outweigh the benefits (prosecuting a > small time criminal).

This is the part I'm disputing. If a criminal could reasonably control what evidence is available to the government, a better and less risky strategy is to give them no evidence rather than to give them evidence that they don't want to use.

<comment><USER18> What if that evidence reduces your bottom line considerably or reduces your risk, as opposed to other evidence?

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> I'm curious as to whether or not it is possible to identify a stingray "tower". I would love to read more about that.

<comment><USER20> Yes, unfortunately in this under-caffeinated moment I can't recall the right google search terms. As I recall, there are a small number of root-able Androids that are suitable for pairing with a RasPi, which together with suitable software gives you a stingray detector.

<comment><USER21> Something like this, perhaps? [https://hackaday.io/project/15711-raspberry-pi- stingray-dete...](https://hackaday.io/project/15711-raspberry-pi-stingray- detector)

Looks like a pretty standard software defined radio reciever that profiles local cell towers so as to notice when a new, lower power (local) tower is put up, which you can then assume is some kind of stingray type device. Looks pretty easy to set up as well.

<comment><USER13> A low power cell tower might simply be a legitimate micro-cell, such as in a home or office where ordinary tower reception is very poor.

</comment></comment></comment></comment><comment><USER22> It's because they know that what they are doing, collecting up everyones cellular data WITHOUT WARRANTS...IS ILLEGAL!</comment>


He's 79 and working fulltime at Walmart: A sobering truth for those w/o pensions - <AUTHOR> http://www.sacbee.com/latest-news/article191519519.html <comment><USER2> More people in IT should treat pensions more seriously.

<comment><USER3> What pensions?

</comment></comment><comment><USER4> A 70 year old man having 12 years left on a mortgage sure seems like strange math going on.

</comment><comment><USER5> People should guarantee higher pensions for the elderly. In fact, we should pay them more than they made when they when tHey were working. Take the money from the wealthy.

<comment><USER6> A weird thought:

If you do this, it introduces an additional disincentive for wealthy people regarding public healthcare.

Not only would they have to carry the tax burden for the healthcare, they would also have to pay for the additional years of lifespan that result from improved health.

I'm not taking a stance either way, and in fact I have been impressed that some countries in Latin America have a functioning public health apparatus while far richer countries like the USA struggle to put such a thing in place. Just think it's an interesting multiplicative effect.

<comment><USER7> An even weirder thought:

What if we had a national system that you pay into your entire life that will privide a living wage to retire on, even if you didn't save additional money?

Either that or maybe we can start blending up the uber rich in this country to make a cheap food source (like soylent green) to feed to the weakest amoung us (like the elderly).

It seems like our greed-stricken society has no desire to help those even when they worked their whole life to benefit society.

<comment><USER8> Data sources? Evidence? Anything at all to back this up?

[http://www.independent.co.uk/news/world/americas/america- new...](http://www.independent.co.uk/news/world/americas/america-new-zealand- and-canada-top-list-of-world-s-most-generous-nations-a6849221.html) That seems counter to you point. Got more than rhetoric here?

<comment><USER9> Charities are the exact opposite of what a generous society is, though. There should be no need for charity (or elderly people working) in a wealthy country. Charities should be for helping third worlders.

</comment></comment></comment></comment></comment><comment><USER10> Obviously having to work as a greeter at the age of 79 with spinal problems is not a great situation, and people deserve security in old age. But is working to this age really the end of the world? This guy will probably live a longer life and experience a slower decline in health than if he were sitting at home watching TV.

<comment><USER11> "... is working to this age really the end of the world?" Yes, it literally is the end of the world for him. Later in the article it says the average life expectancy is 79!!

<comment><USER12> Not that it matters too much in the context, but the average life expectancy is the average at birth not 79. The man should expect to live into his 90s if he makes it to 79.</comment></comment></comment>


I hate Matlab: How an IDE, a language, and a mentality harm - <AUTHOR> http://neuroplausible.com/matlab <comment><USER2> > Sadly, one can either be for open science or against it

An example of a harmful mentality.

<comment><AUTHOR> Agreed. In fact, companies like Google, which do a huge amount of closed source development, are also major contributors to open source.</comment></comment>


jklp: a 36-key ergonomic keyboard - <AUTHOR> https://github.com/brow/jklp <comment><USER2> I wonder why most ergonomic keyboards have the halves pointed in, so your hands are like /\, rather than V. When I used a Freestyle I greatly preferred the V shape, quite spread apart, to reduce pectoral tightness.

<comment><USER3> I think it's because they're so tiny.

I have a kinesis advantage and love it. Tried others and I don't like that they feel to me too cramped.

I'm not small either at 6'2" with broad shoulders... I might not be the target audience.

<comment><USER4> Yeah, tiny keyboards are a menace.

I had a Microsoft Natural Keyboard Pro for many years, the one with full size arrow keys, and I loved it.

The thing with the angle-in is because that's how most people's arms and wrists naturally fall when they put them in a relaxed position (on a table, in their lap) in front of them. Having your wrists at the same width as your elbows is for many people not a natural relaxed position.

I do like the Kinesis "fall-down" button position, though. I imagine your wrists don't bend back-/upwards as much? Today I have a large/wide armrest to avoid the wrist-bend. No ergonomical keyboard, though. A Corsair Strafe Silent RGB.</comment></comment></comment>


Google to pay $17M fine in smartphone privacy breach - <AUTHOR> http://www.cbc.ca/news/business/google-to-pay-17m-fine-in-smartphone-privacy-breach-1.2430979

<comment><AUTHOR> >Google Inc will pay $17 million US to settle allegations in 37 states and the District of Colombia that it secretly tracked web users by placing special digital files on the web browsers of their smartphones.

>The Safari web browser used on iPhones and iPads automatically blocks third- party cookies, but Google altered the computer code of its cookies and was able to circumvent the blocks between June 2011 and February 2012, according to the states' allegations.</comment>


GitLab now operating as US corporation - <AUTHOR> https://about.gitlab.com/2015/07/01/Operating-as-GitLab-Inc/

<comment><USER2> Please let me know if there are any questions or concerns.</comment>


Apple seeking to patent spyware - <AUTHOR> https://www.eff.org/deeplinks/2010/08/steve-jobs-watching-you-apple-seeking-patent-0

<comment><USER2> So as about a million comments on Slashdot -- about as Apple-hating a place as you'll find -- pointed out, this patent application is basically for the phone equivalent of OnStar's "someone stole my car, find it and shut it down" system, plus a couple extra features like taking a picture of the thief or detecting attempts to get through the passcode lock. The patent, if granted, will most likely be bogus, but the intent is perfectly reasonable.

Of course, reasonable things don't generate lots of pageviews and donations, so it has to be spun into some megalomaniacal complex Steve Jobs has which drives him to want to spy on you, _you personally_ and take away all your freedoms to suit his nefarious purposes. Which is vicious lying stinking reeking bullshit FUD, which is what EFF has lately taken to using as a signature tactic, which is why I no longer donate to them.

<comment><USER3> Analogy problem: You can't steal your own car. This application, bogus or not, is targeted to the possibility that you steal your own phone.

<comment><USER4> > This application, bogus or not, is targeted to the possibility that you > steal your own phone.

Uh... how? And what sense does that even make? How can you steal what you already own exactly?

<comment><USER5> If Apple doesn't agree with you that you own the software on the phone, then jailbreaking your phone is "stealing" the software from them...

<comment><USER6> It seems much more likely that they'll use this to recover stolen phones (which makes them money), than to spy on jailbreakers (which makes them no money, and will probably get them sued).

<comment><USER7> You forgot part 3, where law enforcement compels Apple to activate this "feature" on whomever the suspect of the day is.

Most people don't realize that they are trading their privacy for a shiny GUI when they buy an iPhone, which is why the EFF tries to remind them.

<comment><USER4> > Most people don't realize that they are trading their privacy for a shiny > GUI when they buy an iPhone

You do realize that you trade privacy for convenience every time you carry a cell phone with you — unless it's a one-time phone with prepaid SIMs — don't you?

There is no need for "a shiny GUI" for that, be it Apple's, Google's or HP's.

<comment><USER7> That's true, but while my government-tapped phone can only harm _my_ privacy, _your_ government-tapped iPhone can harm everyone's privacy (by recording sounds and video and sending them to Apple's Centralized Server).

Now, I know there is no "expectation of privacy" in public, but does anyone really expect that some random person's phone is recording a video stream of you and storing it indefinitely on a private company's servers?

<comment><USER2> Government agencies have used cellular phones as recording devices since long before there was such a thing as an iPhone. Take your meds and get some sleep.

<comment><USER7> Oh yeah. The government has already taken some privacy rights, so we should stop speaking out against taking more.

You can do that, but I'm going to continue to support the EFF and ACLU.

 _Take your meds and get some sleep._

I wouldn't need the meds if the Internet wasn't so full of rhetoric like this!

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> From the patent description:

      "Many [..] electronic devices are used frequently by
     their owners, and the electronic devices may contain
     personal or sensitive information stored within them. [..]
     Accordingly, if the electronic device is lost or stolen,
     the loss of the electronic device can be exceedingly
     disruptive to the owner's peace of mind and security.
     Thus, the owner may desire to find out where the lost
     electronic device is located or who may have gained
     possession of or stolen the electronic device."

Note the use of the word "owner", not "Evil Empire". What is being described here is a service called "Find my iPhone", which is part of Apple's MobileMe subscription service. (What, you didn't think Apple would be spying on you for free, did you? $99 a year, baby!)

</comment><comment><USER9> "traitorware"? Wow, that's not unnecessarily inflammatory at all!

<comment><USER10> They're taking after the RMS school of linkbait PR — a mix of activism that's too earnest for all but their most strident supporters and neologisms so punny that even your dad would groan at them.

<comment><USER9> I know. I know. It isn't endearing when RMS or the FSF do it either. Turns me off from supporting them in the future.

<comment><USER7> OTOH, it keeps my $120 a year flowing.

</comment></comment></comment></comment><comment><USER11> What Apple is attempting to patent sounds almost exactly like the software that was at the center of that school-district spyware scandal a few months ago:

<http://www.wired.com/threatlevel/2010/04/webcamscanda/>

</comment><comment><USER12> I'd be fine with this as long as it is an optional install. If the software is forced on you is where it becomes a problem. Apple could have the best intentions ever, but as mentioned in the article, if they have this capability the government, at some point, will come knocking.

<comment><USER4> "The Government" doesn't need this. Your standard phone already has everything it needs to locate you and tap your communications.

<comment><USER12> I disagree...the government will very much want this as I don't have a standard phone anymore because of cell phones. Many people are getting rid of their land-lines in favor of one phone. Not to mention that tapping my phone would likely require a warrant whereas in this situation they simply have to convince Apple it's in there best interest to comply.

</comment></comment></comment><comment><USER13> Bogus articles like this, particularly from an organization with a serious reputation, obscures good articles that point out actual dangers. This is a patent on a form of lojack or extension to what's already available on the mobileme website. I am much more afraid of a thief using the stolen data than the government (who already have means to do this).

</comment><comment><USER14> Answers the question: why do normal people, when they know the EFF exists at all, think it is a joke?

<comment><USER15> Well I never understood the phrase "normal people", that's sort of like "the real world", but given that "most people"(choose your study and scary high percentage) can't identify which century the civil was fought it and believe the president is a muslim, it wouldn't surprise me that normal people would think that an organization dedicated to protected their constitutional and civil rights was a joke.

<comment><USER16> > _an organization dedicated to protected their constitutional and civil > rights_

The appeal to emotion aside, that sounds like serious work, maybe they should avoid sensationalist blog posts and snarky little nicknames like "traitorware" that make them sound childish.

I certainly take them a little less seriously now than I did before I read the linked blog post.

</comment></comment></comment><comment><USER17> Everyone here is talking about the sensationalistic headline from the EFF. What about all the hype and sensationalism that follows Apple products??

The EFF is trying to work in your best interests, for the sake of _your_ privacy. Apple is not.

<comment><USER18> The danger is that it could backfire... ever read the fairy tale of the child who cried wolf?

</comment></comment><comment><USER19> Sensationalistic headline from EFF. Then again, they need to raise some awareness, even though I am not always siding with them. I still do support the EFF.

</comment><comment><USER20> Talk about prior art, Google already does most of this.

<comment><USER21> I've had Prey installed for some time (though I've never needed to use it).

<http://preyproject.com/>

It doesn't do the biometrics stuff, but then neither does Google.

</comment></comment><comment><USER22> It seemst hat MobileMe is getting a biometric update huh?

</comment><comment><USER23> Link to patent [http://www.patentvest.com/console/reports/docs/app/201002077...](http://www.patentvest.com/console/reports/docs/app/20100207721.html)</comment>


Cabeau reinvents GPS Smart Locks with a tracker that creates cellular hotspots - <AUTHOR> https://www.cabeau.com/pages/track-and-shield <comment><USER2> It's just "Join the waitlist to be the first to find out more", no information at all, doesn't even say Lock or GPS.

Sadly [https://www.dfnionline.com/product-news/cabeau-unveils- new-t...](https://www.dfnionline.com/product-news/cabeau-unveils-new-track- shield-gps-lock-26-03-2019/)</comment>


Cameron's World - <AUTHOR> http://www.cameronsworld.net/ <comment><USER2> I do miss the early days of the web. I remember transitioning from BBS'. It truly was the "Wild West" era of the Internet. Ahh, the nostalgia.

<comment><USER3> Me too. Stumbling upon a webring while randomly traveling through geocities and then spending hours discovering. I would email the webmasters directly with questions and they'd answer. Oh and perl. Getting lost in perl webrings without knowing the language too well but managing to run some scripts here and there...Now days its just pull requests on github that require me to run a docker instance and install 500 packages for a hello world. Also, people used to discuss programming languages more openly. I'd spend hours reading about crack pot ideas to improve/extend BASIC. Then more hours emailing the authors of such ideas with questions. Now I can't even open an issue on github with questions about the architecture of a javascript library. Or mention how ugly Go is without getting hate email for weeks...

<comment><USER4> A lot of the spirit you mention and miss seems to be alive and well in the Clojure community. There's a lot of enthusiasm for old-fashioned hacking, improve/extend discussions, just fun times a lot of the time. I don't get that as much when interacting with, say, the JS community, or any other than I can think of. The Clojurescript community in particular is a really experimental bunch, with high energy (and many of their experiments have reached #1 here on HN in recent weeks).

<comment><USER3> I'll make sure to revisit Clojure again, thank you. Any specific recommendation as to where to start looking?

</comment></comment></comment></comment><comment><USER5> Made me think of this: [http://www.arngren.net/](http://www.arngren.net/)

It's a Norwegian technology/gadget retailer that was basically the Norwegian equivalent of what Radioshack used to be. Then it was sold to some entrepreneur back in 2000, promptly went bankrupt, and was bought back by the original founder. The design stems from the design of their huge paper catalogue back in the 80's.

<comment><USER6> Which reminded me of [http://www.lingscars.com/](http://www.lingscars.com/)

<comment><USER7> I had no idea she was still in business. Good for her, I thought she was brilliant on Dragon's Den.

<comment><USER6> Yes, she was. The website still hurts my eyes, but it works and manages to impart some of her personality, making me want to browse it more.

</comment></comment></comment></comment><comment><USER8> Not two years ago I was having a conversation with an old friend that went approximately:

"Facebook, this whole internet thing, hasn't really..."

"...worked out"

"Yeah, this isn't what we thought it was gonna be. Let's just... "

"...turn it off"

There was a belief implicit in the idea of every human on Earth being connected. Many of the phenomenon that came about have made that belief look vulnerable to a certain cynicism, a cynicism about humanity, that we fear in each other, that we hold towards ourselves. A currency that bound us together face to face became fiat and then failed at scale. It is within the vacuum painted by this fear that the organizing effects of the old-world economy have been fallen back on, but I do not presently fear this cynicism, and I save my currency wherever I can earn it.

</comment><comment><USER9> Link to interview with Berlin-based designer Cameron Askin:

[http://hyperallergic.com/230415/hundreds-of-geocities- images...](http://hyperallergic.com/230415/hundreds-of-geocities-images- organized-neatly/)

</comment><comment><USER10> This for sure conveys a certain magic, I cannot quite explain how that happens honestly, but we have to recognize that the highly amateurish design makes for a more.. alive thing.

Hmmm, are we close to the next paradigm shift? :)

Perhaps there is a reason why after the perfectly smooth and metal-shining flying-saucers the next stage is usually biotechnologies..

<comment><USER11> Now you got me thinking about a notion i have when i see photos of houses for sale. All of them show rooms to styled and pristine that my first thought is that nobody lives there.

Any place where a human lives (unless they are suffering from some kind of OCD or whatever) inevitably end up having things stacked in corners or strewn across surfaces in a semi-random fashion. You can almost trace a timeline from what is on top of what.

I wonder if designers end up stuck trying to reproduce Platonic ideals, thus making everything look sterile.

</comment></comment><comment><USER12> I love internet archaeology. Contemporary Home Computing[0] has some great pages. I particularly like the one analysing the so-called 'Prof. Dr. Style'[1].

[0]: [http://contemporary-home-computing.org/](http://contemporary-home- computing.org/) [1]: [http://contemporary-home-computing.org/prof-dr- style/](http://contemporary-home-computing.org/prof-dr-style/)

</comment><comment><USER13> I was expecting this to be David Cameron's new website. Was not disappointed!

<comment><USER14> I was expecting to see a story about some new colony that has no porn and lots of surveillance.

</comment></comment><comment><USER15> This is not, I repeat, this is not my old CamWorld (pioneering blog) site from the late 1990s. :-)

</comment><comment><USER16> Still faster than Engadget's homepage.

<comment><USER17> And easier to use than Facebook.

</comment></comment><comment><USER18> So great. Yahoo should not have been allowed to shutdown Geocities.

</comment><comment><USER19> This is great :-) My friend made a similar site, but not quite as extravagant:

[http://rainbowdivider.com](http://rainbowdivider.com)

Every refresh is a new experience!

<comment><USER20> Some friends of mine decided we're going to bring webrings back. This was my attempt: [http://rcr.io/webring.htm](http://rcr.io/webring.htm)

<comment><USER19> I came up with an idea for a new webring which is some remote javascript you embed in your page and it's hosted on github and people do pull requests to add their website to a text file to join the webring

Want to start a new webring? Fork the project, alter slightly

<comment><USER19> I should note that it's an entirely satirical idea :)

</comment></comment></comment></comment><comment><USER21> It is beautiful. At least there wasn't any Flash and no corporate-jumbotroned- conventionnal-websites.

</comment><comment><USER22> If you like animated GIFs as art, you might enjoy Olia Lialina's work.

[http://art.teleportacia.org/olia.html](http://art.teleportacia.org/olia.html) (warning: page autoplays audio)

</comment><comment><USER23> My oldest site is 20 years old, haven't updated it in forever, but kinda fun it's still there! [http://www.coolsig.com/](http://www.coolsig.com/)

</comment><comment><USER24> So many broken links. It's a shame that more couldn't be saved.

</comment><comment><USER25> If this was the internet of old I'd still be waiting for the first row of GIFs to load and my computer would grind to a halt after the fifth.

But I do miss it so.

<comment><USER26> Totally agree. This would have killed my computer back in the mid or late 90's!

I was impressed how everything rendered without a glitch on Chrome on my Mac (I do have a new Mac...).

We've come a long way. :)

<comment><USER27> >I was impressed how everything rendered without a glitch on Chrome

Well, to be fair, this is a modern website composed of artifacts from the Geocities archive. This page would be a beast if it were implemented with techniques of the era.

Looking at the source for the page, the author seems to be lazy loading the assets and then dynamically placing them in the page with CSS.

We've definitely come a long way.

</comment></comment></comment><comment><USER28> Under construction gifs!

It's like finding an old TV show and watching it with my teenager. "Yeah, we used to think this was really cool."

</comment><comment><USER29> Impressive. I hardly remember an old internet, but well, created a website at times when people used to use <marque> tag. :-) This site made me think about it. Probably we've lost something with this whole progress and knowledge how to design, maybe started overdoing it often? I don't know. Thanks.

</comment><comment><USER30> The truly amazing thing is, that I can visit that site from my phone without any lag or performance issues.

Welcome to the future!

</comment><comment><USER31> If I could only view this through my skinned IE 5... I never thought I'd be nostalgic for this, but I am.

</comment><comment><USER32> Not enough tables in the HTML though.

<comment><USER33> But they did have plenty of frames though!

</comment></comment><comment><USER34> It should have a message that tells you to _downgrade_ your browser for the best experience.

<comment><USER35> You _upgrade_ it to Catscape Navigator.

> Catscape is the most advanced browser available.

> Version 2.324.46948633454654564646

</comment></comment><comment><USER36> My macbook got CPU throttling at 100% when I stayed at that page for around a minute :)

<comment><USER37> Should have bought a PC.

</comment></comment><comment><USER38> I was recently trying to dig up the IDE's of the early internet publishing platforms like Geocities, Tripod, MySpace (1.0) to try and do a similar project. Could only find the archived pages/assets like this.

<comment><USER39> IDE... I might be remembering this wrong, but weren't GeoCities sites coded offline and uploaded as static files?

Also... [https://neocities.org/](https://neocities.org/)

</comment></comment><comment><USER35> Reminded me:

[http://www.themostamazingwebsiteontheinternet.com/](http://www.themostamazingwebsiteontheinternet.com/)

Warning: I think it plays sound, I have no speakers right now.

</comment><comment><USER17> This is very well done.

</comment><comment><USER40> So a lot of "new" stuff in the source (HTML5 doctype, "no-js" body class, apple-touch-icon, FB things etc). Is this site being updated still?

</comment><comment><USER41> Wow...nostalgia. They should add a fake connection throttle to the site so all the GIFs take 1 minute to load and it would seem even more authentic.

</comment><comment><USER35> My favorite part is the little green sign:

> Welcome to the INTERNET

> ENJOY the RIDE

<comment><USER42> That just reminded me of Mahir[1] and his "Welcome to my home page... I kiss you!" fad. Good times...

[1] [http://web.archive.org/web/20040905074540/http://www.ikissyo...](http://web.archive.org/web/20040905074540/http://www.ikissyou.org/indeks2.html)

</comment></comment><comment><USER43> So much cheese. My favorite:

 _IF YOU STUDY THE MATERIAL ON THIS WEBSITE YOU WILL HOPEFULLY UNDERSTAND WHAT OUR PURPOSE HERE ON EARTH HAS BEEN._

</comment><comment><USER10> Funny how on first page right now there's also Bootstrap 4-alpha :)

<comment><USER44> Relevant: [http://code.divshot.com/geo- bootstrap/](http://code.divshot.com/geo-bootstrap/)

<comment><USER10> Haha!

</comment></comment></comment><comment><USER45> Can you disable the automatic playback of the music, please? Screen reader users cannot hear a thing over it all. I know you're trying to create a tribute to the web of old, but this particular throwback is not one I think deserves a place.

</comment><comment><USER46> I can see eternity.

Nice work!

</comment><comment><USER47> So much win!

</comment><comment><USER48> Be afraid.

</comment><comment><USER49> I just had to imp my car. Did a quick google search read the first two steps and then bam I was hit with a screen taking over advertisement that took me 15-30secknds to get off of my screen. The first thing that I thought was, "damn the Internet sucks." And I was let referring to my connection.</comment>


HBO Isn't Netflix. Which Is Why It Should Stay with Time Warner - <AUTHOR> http://recode.net/2016/01/08/hbo-isnt-netflix-which-is-why-it-should-stay-with-time-warner/ <comment><AUTHOR> This looks a lot like HBO's really getting pressured to go for growth, in stark comparison to the classical model of a cable company (which is typically a cash (dividend) cow rather than being a growth engine). I suspect that the whole 'cord-cutter' paranoia is getting to HBO.

On the other hand, investing heavily in upcoming technology is a good idea, as is being the person to cannibalize yourself rather than let anyone else do that.

</comment><comment><USER2> Netflix is the faster, more nimble disrupter, and while HBO is not as stodgy as TWC (or other telco's), it will lose the game of both content creation and the scale required to negotiate attractive content deals.

<comment><AUTHOR> I think you might be onto something - better negotiated content deals would are actually key to acquiring more customers and scaling up. I've previously worked on film financing deals where everything hinged on being able to get cheaper financing for money for content creation.</comment></comment>


Building a better and more diverse community - <AUTHOR> https://www.hackerschool.com/blog/43-building-a-better-and-more-diverse-community

<comment><USER2> In anticipation of the comments we've gotten in the past:

* We hold everyone to the same admissions standard, regardless of race or gender. The grants are our way to create a more diverse applicant pool.

* Hacker School is free for _everyone_

* We admit everyone who applies who we think is a good fit. No man has ever been rejected because a woman was accepted, so there's no way in which this harms men.

* We auto-generate pseudonyms for applicants, so our initial application review focuses on people's code and what they write, not their race or gender

(I'm one of the founders, and I'm happy to answer any questions folks have about Hacker School.)

<comment><USER3> Yeah maybe you hold everyone at the same admissions standard but it's not true for accessibility to the grants. Will we reach a society where we hope to be born from a more "diverse" race?

That's racism... it's sad that you use racism while believing that you are solving it. Please don't help based on the race, help based on the needs.

Edit: Can anyone debate instead of downvote? That's doesn't seems like an healthy way to change opinions...

<comment><USER4> Okay so, not so long ago they were only providing grants to women. Did I think to myself oh that's sexist? No, you know why? Because I'm pretty sure they provide the grants to people with needs (at the end of the applying form you check a box that says you'd need financial aid). Yes, they're using filters like gender and race first.

But if you were a white male, you live in a society where you could probably approach any hacker space or anything else without feeling weird about it, unlike many trans*, queer or black/latin@ people. That's the way they're promoting diversity, by creating spaces where people can feel more welcome/safe, they're in no way denying white people or males.

<comment><USER3> I did find that sexist, maybe you weren't but I was. I was afraid to talk though... this is the sad part I guess.

> you live in a society where you could probably approach any hacker space or > anything else without feeling weird about it, unlike many trans*, queer or > black/latin@ people.

That's what need to be fixed. You don't solve that by giving them money. You solve that by showing we accept them, by stopping people from making them feel weird. A strict policy against racism is what's needed and being vocal about it.

> they're in no way denying white people or males.

That's making the issue here way more complicated to talk about for no reason. You need to draw a line between the school and the grant. I'm not saying they are racist for the school admission, I'm saying they are racist for their school grant. They are denying white people that school grant.

<comment><USER4> >I was afraid to talk though

Yeah, don't worry. While I may not agree with you on this issue I'm all for your right to express your opinion. However you may have to accept the fact that your opinion may give you a negative backlash, that happens to everyone, how ever it will only give you negative internet points (at least on hn).

>A strict policy against racism is what's needed and being vocal about it.

While I agree, how do you enforce that? How do you make sure that actually happens? How do you protect the groups which we agree have certain degree of disadvantage most of the time from the outside? And even with that enforced, being in an environment where most of the people might hate you based on your gender/sex/skin color won't change your experience based on a paper/set of rules.

>They are denying white people that school grant.

They're denying a group the grant. A group that as we have discussed and you seem to agree with me have more advantages, and even if they couldn't afford to go to hackerschool, could go to any other similar space near them. Because again they don't have to fear racism or sexism that can not be controlled.

edit: fixd typo, more space for read-ability.

<comment><USER3> > While I agree, how do you enforce that? How do you make sure that actually > happens? How do you protect the groups which we agree have certain degree of > disadvantage most of the time from the outside? And even with that enforced, > being in an environment where most of the people might hate you based on > your gender/sex/skin color won't change your experience based on a paper/set > of rules.

Giving them money might fix that? What you do however is punish any racist action that happens. You kick people out of the school when it happens, no second chance. You give people opportunity to talk about it, you talk about it with people. What about a class that everyone need to do which talk about racism.

Now they are saying that it's okay to care about your gender and race, you will get monetary support if there's a possibility of racism... if you are not white...

>A group that as we have discussed and you seem to agree with me have more advantages

No I disagree on that part. I know multiple people that are white that have trouble with money and I know plenty of people from other gender/race that doesn't. Generalization is wrong. There's plenty of white people that couldn't afford to go and there's plenty of non-white people that could afford to go.

> could go to any other similar space near them

You make me think about it. A good way to use that money would be to help hacker school to stop racism. A safe network of hacker school that fight against racism.

> Because again they don't have to fear racism or sexism that can not be > controlled.

I still doesn't see how giving them money fix that. I completely agree that's the issue that need to be solved.

<comment><USER4> This is getting too long and we're going around in circles about the issue.

So the only thing I'm going to reply is:

>Giving them money might fix that?

No, they're not trying to battle this issue you want to tackle. Simply because is bigger than them.

>I still doesn't see how giving them money fix that.

Again, this is not to fix this huge issue. This is to give other people the chance to assist this and assure them they can feel safe.

>There's plenty of white people that couldn't afford to go and there's plenty of non-white people that could afford to go.

And again, they're not giving you the money simply because you're non white. They might give you the grant if you mark any of the checkbox that make you eligible but you still need to check "I'd need financial assistance to do Hacker School" which is not automatically checked as you seem to believe simply because you check that you're non white.

Again, what you propose is that non white people who want to attend to a place like hacker school:

a) wait until racism is non existent

b) deal with ugly situations/experiences because there will be rules to make sure to deal with the cause after

Instead of doing what they want/love and creating safe spaces where they don't have to deal with stuff they shouldn't deal with in the first place.

If you want to keep discussing you can shoot me an email (email@example.com). I could probably even direct you to people who could answer as to why your proposal of simply solving racism is not as easy, with plenty of real life examples and historical facts.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> That's actually quite clever, wrt. generating everyone who applies a nonsense pseudonym so there's no unconscious bias happening in the pre-selection process.

<comment><USER6> It is, but what I've found a bit funny about the entire recent 'diversity' discussion is that such things aren't already done as a matter of course.

We're in an industry where modeling, A/B testing, logging, trending and engineering for redundancy is implicit - except when it comes to hiring apparently.

If a load balancer assumed to split 50/50 was actually operating at 80/20 someone would notice. If a particular demographic were bouncing from the landing page at disproportionate rates, someone would figure out why.

Both problems would be broken down empirically and solved with a thorough post-mortem published on the company blog.

To this point, those same sort of issues applied to hiring have been largely addressed with "We've got to do better" and "The problem is upstream" with barely a word about how things managed to creep so far out of whack to begin with.

It's really refreshing to see admission of an actual (potential) problem and some of brains being applied to mitigate it directly.

<comment><USER7> As an industry, we used to be in favor of approaching meritocracy as a goal. We'd take pride in using github in lieu of a resume, difficult technical tests, and general attempts at objectivity.

Strangely, the pushback against meritocracy as a goal and objective measurement as a method doesn't come from the alleged "good old boy" network.

[http://readwrite.com/2014/01/24/github-meritocracy- rug](http://readwrite.com/2014/01/24/github-meritocracy-rug)

[http://www.ashedryden.com/blog/the-ethics-of-unpaid-labor- an...](http://www.ashedryden.com/blog/the-ethics-of-unpaid-labor-and-the-oss- community)

<comment><USER8> Consider 2 candidates with github profiles:

\- A has a created small number of functional and elegant projects

\- B has created a large number of functional but sloppy projects

Which is objectively better? The candidate who is more productive, or the candidate whose products have higher quality?

One may be a better fit for your organization, based on your group's needs and existing makeup, but that doesn't mean they are objectively "better" than the other candidate. Do you believe one of these candidates has more "merit" than the other?

Some people who believe a person has objective merit (as opposed to suitability for a particular organization or role) are actually expressing an aesthetic preference (selecting for tidy code, or work ethic, etc) while claiming/believing that their preference is "objective" truth. People opposed to using "objective" or "meritocracy" as labels are arguing for more nuance in understanding the needs and biases of people and teams.

<comment><USER7> Wait, I can go one better. Candidate A) has a large number of elegant projects. Candidate B) is a ninja with a large number of high profile assassinations under his belt.

Obviously the question of "objectively better" comes with an implicit "for the role in question".

 _People opposed to using "objective" or "meritocracy" as labels are arguing for more nuance in understanding the needs and biases of people and teams._

That sounds pretty but it's totally vacuous - it doesn't give me any information on how the decision process would be altered.

</comment></comment></comment></comment></comment><comment><USER9> Really impressive program! I'm glad that these guys are encouraging diversity, but focusing on keeping the bar for admission the same across all candidates.

</comment><comment><USER10> Any '-ISM' CANNOT be a real '-ism' if does not combine prejudice (which is the only thing people think it is) PLUS power (the social, cultural, and political heft which usually underlies the ability of prejudice to keep or enforce -isms in place)

[http://rationalwiki.org/wiki/Prejudice_plus_power](http://rationalwiki.org/wiki/Prejudice_plus_power)

Until folks understand this primary principle, most of you arguing for this "anti-white and asian" bias will simply be tools of the status quo. Equality does NOT mean treating all people equally, WHEN ALL PEOPLE DON'T HAVE THE SAME FOOTING, and don't have the same political power (which is conferred from our social and political system).

</comment><comment><USER11> I am so happy to see this program in place. We all talk about how most problems we have with diversity come from upstream, and now a school is directly addressing it. An objective solution to an objective problem.

</comment><comment><USER12> Diversity in our field is a hard issue to tackle, and it's great to see people trying to find solutions.

This said, I'd like to see the results, as I would believe the diversity problem is not as much with hackerschool as it is with the pool of applicants.

</comment><comment><USER7> Their evidence for lack of bias in their process is pretty weak: "Men and women are invited to interview, advanced to a second interview, and admitted at the same rates."

All this means is that the person doing interview #1, interview #2 and admission decision are biased at the same rate. It doesn't mean that rate is zero.

The proper test - compare admission rates against a truly objective and unbiased measure like a final exam (particularly if students anonymize their names). If gender information does not leak to the grader, bias is impossible.

[edit: Wow, I've clearly made a blatant failure of reasoning - apparently my knowledge of statistics is far less than I thought. I hope someone can explain my error - I'm not afraid of math, so don't skip the details.]

<comment><USER2> What we mean by "at the same rate" is that these rates are the same as the rates that men and women apply. For example, about 65% of our applications are currently from men, and men are about 65% of the people we invite to interview, advance to the next round, and ultimately admit.

<comment><USER7> This is only evidence of lack of bias if you know the quality of both pools is equal. If there was a quality gap between pools, this would be evidence that you are biased.

I reiterate - if you truly want to measure bias on factor X, you need to compare to a metric that is blind to X or otherwise known to be unbiased.

<comment><USER8> They did point out that the first round selection is done based on anonymized applications.

It might not be not perfect, but if round 1 is blind to X, and rounds 2 and 3 admit people in similar ratios to round 1, it sounds pretty good to me.

<comment><USER7> They did not claim that the % passing the blinded stage is the same as the % passing the other stages. The only points they listed were interview #1, interview #2 and admission (none of which are blinded).

<comment><USER8> > about 65% of our applications are currently from men, and men are about 65% > of the people we invite to interview

That sounds to me like the point where blind review of applications would take place.

<comment><USER7> They said the blinded portion is only skimming the application, and they get that info after a minute or two. If they blinded the entire pre-interview process (e.g., browse github profiles/etc through a chrome plugin that changes "nitin patel" to "grande puta"), that would be fairly convincing.

Ultimately a quality measurement at the end of the process would be the best, however - measure the outputs rather than the inputs.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> If you are someone that buys in to all this diversity nonsense, please watch [https://www.youtube.com/watch?v=v_dRt00ufp4](https://www.youtube.com/watch?v=v_dRt00ufp4)

I am prepared for the downvotes, keep them coming.

<comment><USER14> oh, please. No one wants to engage with a self-proclaimed martyr.

</comment></comment><comment><USER15> >The short: We now have need-based living expense grants for black and non- white Latino/a and Hispanic people, as well as people from many other groups traditionally underrepresented in programming.

I disagree with this, it's racist.

<comment><USER4> If it simply said "for under-represented groups" you wouldn't have made that comment. The difference is that they need to clarify what groups are under- represented so they (people within those groups) can approach hacker school and don't feel like I did a year or so ago when I thought "oh I can't go cuz I don't have enough money to sustain myself".

<comment><USER3> Please define "under-represented groups". How do you divide theses groups? I love movies, does they have a group for movie-lover? What about books? I believe theses groups are based on race. Divide by race and you get what? Racism.

> "oh I can't go cuz I don't have enough money to sustain myself"

That's the reason why you should get that grant, not because you are from a different race.

<comment><USER16> > "Divide by race and you get what? Racism."

I believe you're confusing the mere recognition of races and the fact that they exist with racism. They aren't the same thing.

Not to go all dictionary on you, but here's what American Heritage has to say: "the belief that all members of each race possess characteristics or abilities specific to that race, esp. so as to distinguish it as inferior or superior to another race or races."

Nothing in the post falls under the strict dictionary definition of racism. I would also argue that nothing in the post _at all_ falls under any definition of racism.

</comment></comment></comment></comment><comment><USER17> I really don't understand this obsession with diversity in tech, particularly the oft-repeated mantra of "the team as a whole improves when there's more ethnic/gender diversity", as if being black or genderqueer gives you special insight into distributed computing algorithms. This seems like a uniquely American phenomenon. I certainly don't think you hear a lot about this in India, China, Japan, etc. And yet, their companies still manage to function.

<comment><USER18> It's pretty easy:

1\. American society consists of all kinds of people

2\. A lot of those groups are weirdly underrepresented in the American tech industry

3\. That means we're wasting a lot of great programming talent at a time when we badly need it.

<comment><USER13> 1\. American society consists of all kinds of people

2\. One group is weirdly underrepresented in the American [nursing/childcare/secretarial industry]

3\. That means we're wasting a lot of great [nursing/childcare/secretarial] talent at a time when we badly need it.

Does this make any sense to you? If no, your own statement should not either.</comment></comment></comment>


The Acid3 Test (2008) - <AUTHOR> http://acid3.acidtests.org/ <comment><USER2> "Acid3, in particular, contains some controversial tests and no longer reflects the consensus of the Web standards it purports to test, especially when it comes to issues affecting mobile browsers. The tests remain available for historical purposes and for use by browser vendors. It would be inappropriate, however, to use them as part of a certification process, especially for mobile browsers."

[http://www.acidtests.org/](http://www.acidtests.org/)

</comment><comment><USER3> For people who don't follow modern web standards, a modern web browser getting 100/100 is actually failing tests. You should get 97/100, failing tests 23, 25, and 35.

The site itself is no longer maintained and updated to reflect changes to standards.

<comment><USER4> ha, did not know that.

IE gets 100/100 ... while firefox got 97. That explains it!

<comment><USER5> "IE beat us, let's change the rules of the game."

It doesn't surprise me, after seeing all the other stuff that happens in the web community...

</comment></comment></comment><comment><USER6> On my machine:

Chromium 71: 97%, blocks 2&3 silver, pauses at 24, 64.

Firefox Quantum 64: 97%, blocks 2&3 silver, pauses at 24, 64, 65.

From Wikipedia:

Bucket 2: DOM2 Core and DOM Events

Bucket 3: DOM2 Views, DOM 2 Style, CSS3 selectors and Media Queries

By April 2017, the updated specifications had diverged from the test such that the latest versions of Google Chrome and Mozilla Firefox no longer pass the test as written. Hickson acknowledges that some aspects of the test were controversial and has written that the test "no longer reflects the consensus of the Web standards it purports to test, especially when it comes to issues affecting mobile browsers."

<comment><USER7> As I recall, the Firefox of the time didn't pass Acid3, either, and there was a minor controversy over the fact they changed the test in a way that made it friendlier to Firefox:

[https://en.wikipedia.org/wiki/Acid3](https://en.wikipedia.org/wiki/Acid3)

> Initially, Firefox 4 scored 97/100, because it did not support SVG fonts. > Later, Firefox 4 scored 100/100, because the SVG font tests were removed > from Acid3.

> According to Mozilla employee Robert O'Callahan, Firefox did not support SVG > fonts because Mozilla considered WOFF a superior alternative to SVG > fonts.[29] Another Mozilla engineer, Boris Zbarsky, claimed that the subset > of the specification implemented in Webkit and Opera gives no benefits to > web authors or users over WOFF, and he asserted that implementing SVG Fonts > fully in a web browser is hard because it was "not designed with integration > with HTML in mind".[30]

</comment></comment><comment><USER8> Sounds like it is time for Acid4. After all, those test did a great job at showing browser incompatibilities.

<comment><USER9> There's html5test.com and css3test.com

<comment><USER10> The google bot scored 45% on css2test.com.

</comment></comment></comment><comment><USER11> Acid2 is currently not passing either in Chrome (71.0.3578.98). I'm surprised these never got turned into automated unit tests.

<comment><USER12> From Wikipedia: "The test fails when browsers become compliant with current CSS collapse and margin standards."

</comment></comment><comment><USER13> > Modern web browsers don't 71 pass the Acid3 test anymore

What does it mean by "71 pass"?

<comment><USER14> The test is scored out of 100, so presumably it means getting a 71+ score

<comment><USER15> My understanding with these kinds of tests is that the only passing grade is 100/100

</comment></comment></comment><comment><USER16> [http://acid3.acidtests.org/support-a.png](http://acid3.acidtests.org/support-a.png) is a resource that page attempts to load that 404's now. I'm guessing that's part of the reason it doesn't score 100%. Not the browser's fault.

<comment><USER17> It loads fine for me. Looks like this [https://imgur.com/a/lrTMBmE](https://imgur.com/a/lrTMBmE)

<comment><USER18> If you wget the file you'll see this:

\--2019-01-18 13:46:40-- [http://acid3.acidtests.org/support-a.png](http://acid3.acidtests.org/support-a.png)

Resolving acid3.acidtests.org (acid3.acidtests.org)... 126.96.36.199

Connecting to acid3.acidtests.org (acid3.acidtests.org)|188.8.131.52|:80... connected.

HTTP request sent, awaiting response... 404 Not Found

2019-01-18 13:46:40 ERROR 404: Not Found.

<comment><USER6> This is by design. By the specs, browsers should not display a favicon if the file 404s. But that file contains a valid favicon, so rendering it is a failure. [source: Wikipedia]

</comment></comment></comment></comment><comment><AUTHOR> I bumped into the acid3 test, and I noticed it didn't pass in Chrome anymore. Would anyone have any context as to why this is? It's a little bit odd to me that backwards compatibility was broken in at least 3 ways here.

<comment><USER3> Acid3 was not updated when people decided to change the specifications. There are 3 things that are known to fail. Two of them are related to one change (see [https://github.com/whatwg/dom/issues/319#issuecomment-296345...](https://github.com/whatwg/dom/issues/319#issuecomment-296345763) for details on that change). The third test is one where Acid3 mandates something that every browser did but was wrong per the specification, and it took several years for people to notice (see [https://bugzilla.mozilla.org/show_bug.cgi?id=1311329](https://bugzilla.mozilla.org/show_bug.cgi?id=1311329) for some more details).

The Acid3 test on that website is officially unmaintained: [https://lists.w3.org/Archives/Public/www- archive/2017Jul/000...](https://lists.w3.org/Archives/Public/www- archive/2017Jul/0003.html)

</comment></comment><comment><USER19> 98/100 in Safari for me.

</comment><comment><USER20> Fails the back button test.

</comment><comment><USER21> Has it really been 10+ years since the "acid" tests debuted? I can remember when these things were the height of the browser wars. I guess I should be glad that we don't really need them anymore.

</comment><comment><USER22> Latest Chrome: 97% IE 11: 100%

Acid3: FAIL

</comment><comment><USER23> Internet Explorer 11 .... 100/100 !!

<comment><USER24> Quirks or strict mode?

</comment></comment><comment><USER25> Current Safari Mobile gets 98/100

</comment><comment><USER26> 66/100 on Firefox and after a pause it shoots up to 96/100! 97/100 on Brave.

</comment><comment><USER27> Safari Version 12.0.2 (14606.3.4) 98/100

</comment><comment><USER28> Microsoft Edge gets 100/100

</comment><comment><USER29> Chrome is still 97/100, but honestly that's a pretty old test and things have changed.

Someone remembers XHTML..?

<comment><USER15> Also getting 97 with Firefox.

<comment><AUTHOR> Safari is at 98, which I guess now means slightly worse.</comment></comment></comment>


Trying to find a startup - <AUTHOR>

There was this startup I seen on here, where you can pay people to do tasks in your local area i.e. go to IKEA and purchase this and you pay X amount to have them deliver it to you. Other examples were to clean your house, pickup groceries, etc.<p>Anyone happen to know the name?
It was similar to mineeds.com, but more wildly known (bigger user base)
FOUND IT: http://www.taskrabbit.com/ <comment><USER2> There's also: <http://www.zaarly.com/>

</comment><comment><USER3> gigwalk is another one.</comment>


Ask HN: What's a Good Alternative to an iPhone for Kids? - <AUTHOR> <comment><USER2> Jitterbug? [https://www.greatcall.com/phones/jitterbug-flip-cell- phone-f...](https://www.greatcall.com/phones/jitterbug-flip-cell-phone-for- seniors)

If you're trying to give the kid a device to call home and call the police if they need to.

</comment><comment> La-ang Huawei lmao</comment>


Ask HN: Help me going from books to real projects - <AUTHOR> Guys I need your help.
I've completed all Udacity early programming classes, Ng's achine Learning course, Boneh's Crypto 1 and Crypto 2, worked through most of SICP, all of Nand2Tetris, all mof CSAPP and done all CMU labs, programmed in Python, Clojure, Go, C, Haskell, Javascript, Bash script, lived in terminal with vim and tmux (but spent 6 months in emacs just to be sure), hosted my website on linode... and I could go on.
But I have never written a real software program in my life. Zero, nada, nicht, rien, nulla.
I need to stop doing courses/books and just commit to write a real program, start to end, something useful. But I can't; I think it would be easier for me to start reading TAOCP and spend the rest of my life working through it.
So I want to try this: ask you to suggest a project that could be done in one year by a solo programmer as a side project. And then commit to the project in the most voted comment. Ideally I don't want to do web apps or mobile apps, ideally I'd like to write something in C which for some perverse reasons I've really enjoyed programming in.
Please help me, I've already started reading the first few pages of the Rust book...
Help me make 2019 the year I wrote my first, real, computer program, choose a project for me! <comment><USER2> You have to choose it yourself. Programming is a difficult intellectual struggle and the only two things that I'm aware of that cause anyone to endeavor to do it is either pressure (obligations to an employer, for instance) or enthusiasm; satisfying some desire to make a computer perform some specific task.

So either take a job that inflicts deadlines or discover some passion great enough to make you hunch over a keyboard and squint at a display for hundreds of hours. If you can't or won't commit to the former and you haven't a passion that motivates the latter you may need to to reconsider your motivations.

</comment><comment><USER3> Hi

I'm learning Python at the moment, so I'll try to offer something from my perspective (which is obviously different to yours!)

I found the best thing to help me learn last year was working on a project that I came up with to help my girlfriend's school. She's an ICT tech in a first school in the UK, and GDPR means (amongst other things) that each child's parents choose which internal and external media they can be in, and managing that is difficult. Between us we came up with the idea for an internal web-based system which displayed this info quickly and easily for staff, and allowed management of this info via an admin interface (including import from .csv and Google Sheets). It grew considerably as I iterated on features, and I learned SO much from doing it - both technically (I'd write it completely differently to how it is at the moment) and in terms of planning and soft skills, etc. I wouldn't have learned anywhere near as much by spending that time on more courses.

Despite my technical reservations about its internal quality, it functions well, and is in daily use at the school (hosted on a Raspberry Pi).

So, I'd suggest either finding something that someone you know needs doing, and trying to do it. It's the same as when I did my apprenticeship (which ultimately was in Electronics and Instrumentation, but in the first year involved mechanical work such as lathe use, milling machines and welding) - you learned skills which were OK, but it was the projects we did (making parallels, a punch, eventually a battery charger completely from scratch) which was where we really learned why we needed the skills and which areas we needed to work on more.</comment>


Ask YC: Does anyone have any experience with these guys (http://prototypeinvest.com)? - <AUTHOR>

There is a new kind of VC called prototype invest, and they claim to develop any software or webapp for equity. i will like to know if anyone has done anything with them and how the experience was. <comment><USER2> Actually,they claim to develop a 'PROTOTYPE,' not a shippable product. There can be a large chasm between the two.

They way I interpret their service is like this: They build enough of a prototype to help you get funding. They make no mention of taking you the rest of the way. Nor do they claim to build 100% of your functionality.

If that's true, then you will end-up walking into a VC/angel office and showing the prototype. The person across the table will ask you how long it will take to turn the prototype into a launched product. So, here's the question: Can the prototype they develop even be turned into a real product or is it throw-away code only mean to help you raise money? What if they're writing crappy throw-away code and you know it, can you ask them to improve their engineering? Probably not because they're writing a prototype.

If you walk into a funding meeting with a prototype but without an engineering team, your chances of getting funded are pretty slim, IMHO. But, it is possible that a good prototype can help you attract engineers, so maybe that's not so bad.

</comment><comment><USER3> They've been submitted here a couple times now... I think someone should submit an idea to them just to see what the process is like, though I'm guessing they are incredibly selective about ideas.

</comment><comment><USER4> I'm in touch with them and have requested to add FAQ section on their website to make us understand how the whole thing works and how much equity they expect in return to develop, maintain, support and upgrade an application.</comment>