There are limits to 2FA - <AUTHOR> http://arstechnica.com/security/2016/07/there-are-limits-to-2fa-and-it-can-be-near-crippling-to-your-digital-life/ <comment><USER2> The headline is a little misleading. The "limits" aren't with 2FA. The problem is there are holes in Apple's feature set where 2FA isn't enabled. This is an Apple problem and not necessarily a 2FA problem. As others have said, there are ways around this lost device problem like the one time use codes that Google and other companies provide.

<comment><USER3> Can also be lost.

I am losing things constantly (laptops, phones, documents — damn you, ADD), and I wouldn't want to be locked out from my digital life just because I lost another piece of paper or device.

In compensation, my symbolic memory is excellent — never had a problem with memorizing long passwords.

<comment><USER4> Then you should be able to memorize one of your backup codes, and you'll be fine..

I don't know if Apple does this, but Google's 2FA (and others) gives you static (printable - or memorizable!) backup codes in case you lose your device.

<comment><USER5> Yes, Apple gives you static backup codes

</comment></comment></comment></comment><comment><USER6> GitHub/Google/Microsoft/Blizzard/Heroku have "recovery" or "backup" codes which you are supposed to keep in a safe place (perhaps even a physical safe) and can be used when the phone is not available(lost, locked, erased, whatever).

They are one-time only (that's why you get 10), but are not time sensitive (like those generated by app/token) so they are longer.

<comment><USER7> Google also tells you to add a second, "backup" number for two factor auth, or even more of them. It can be a landline, or a trusted person phone.

<comment><USER3> Phone or SMS based 2FA is inherently insecure. Can be intercepted at carrier level (and it is quite cheap to do it — some political targets in Russia and Turkey were attacked this way).

<comment><USER8> Yeah but that's a different threat model than the one discussed. It will prevent 99% of attacks but someone always comes in yelling "BUT IT'S NOT PERFECT". As they say, perfect is the enemy of good.

<comment><USER9> Why would 99% of adversaries fail to choose the attack that's known to work?

<comment><USER8> Not everyone is a nation state or has SS7 access. Intercepting SMS isn't as easy as you make it out to be.

<comment><USER3> Not everyone, but many people of varied moral qualities _do_ have access to SS7 and carrier operations, and they can be contacted and negotiated for services.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Apple has two types of what might be called 2FA, two-factor and two step authentication. If memory serves, two step has a back up code that needs to be maintained by the end user. If the user misplaces this code, the account is unrecoverable. Two factor does not have this back up code feature. When I went to the genius bar to ask about this, they said that an affected user would need to contact Apple and they would interrogate the user to confirm identity. This seemed a bit strange to me but whatever.

Now with two factor I thought a code could be generated from any previously authenticated device that is El Capitan / IOS 9.3. These devices can generate codes while offline and unconnected.

To generate an offline code from a Macbook, turn off WIFI then open Settings > iCloud > Account Details > Get Verification Code.

To generate an offline code from an iPhone/iPad, put in airplane mode, > Settings > iCloud > tap your picture / name / Apple account icon-y think at the top > Get verification code.

So when I read this article, I'm thinking to myself that myabe I know a trick that the author did not.

Am I missing something?

</comment><comment><USER11> It sounds like his complaint is that Apple doesn't use 2FA when you acknowledge your 2FA device is unavailable (I had trouble following the article). This is admittedly bad. All they need is an offline code or something like Google's recovery codes. It's actually somewhat disappointing that so few sites have something like that.

</comment><comment><USER12> The limits described in this article are where all components are part of the same system - the 2FA device (iPhone) can be disabled from the same system (iCloud) that is protected by the 2FA device. Thus compromises had to be built into the system to allow device recovery, since that is also part of the same system.

Were iCloud 2FA provided by an Android device (or PC or Blackberry or RSA keychain), this problem could be easily obviated.

</comment><comment><USER13> It's a bit of a catch 22, if you lose your iPhone then you need some way to locate it / erase it without having your iPhone. I don't think it's a big deal, you should have backups anyways.

One thing they could do is, if you have more than 1 device on your account, then force you to use another device for 2fa.

<comment><USER14> It occurs to me that the "use another device" verification process built into iCloud Keychain would work well for this. You could make the entire thing cryptographic, actually: just store each device's "erase code" in the Keychain, such that you have to auth yourself on one of the devices that has the unlocked keychain in order to (automatically) grab the erase code and send it to the associated device.

<comment><USER15> You're still screwed if you lose both devices (e.g. a burglary where both your phone and laptop are taken).

<comment><USER3> I once left my bag with both inside. It surfaced in city's lost and found two months after, thankfully. But if I had 2FA enabled, it would have been mighty inconvenient.

<comment><USER16> I keep some Google and Github account recovery codes on a slip of paper with my passport, some more in my wallet, and all in an encrypted file on a server with SSH access.

Hopefully that's enough that I'm not too inconvenienced, should my phone be stolen.

<comment><USER3> How often do you travel?

<comment><USER16> For holidays (6 weeks per year) plus one or two business trips (up to 2 weeks per year), plus about 1 weekend a month.

But does it matter?

Should my wallet and phone be stolen whilst I'm away, I can log in to my server using SSH (and a long password), then decrypt a file containing the backup codes (PGP with a long passphrase). Then I can access GMail/Github.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> Please don't conflate Apple's "Can you read a message we sent you?" verification with well designed 2FA.

</comment><comment><USER18> I use 2FA and love it, however one issue I faced that I wanted to highlight for anyone having missing sms issues... in our country we can keep the number but change phone company, called porting number to other carrier... it works great however international sms which is mostly the case with 2FA messages, never work after number porting. Do not know it is just issue with our country porting config or universal problem. So anyone having issue of no sms received...may look into it if number ported...

<comment><USER19> You never mention the name of your country though :)

<comment><USER18> Pakistan :)

</comment></comment></comment><comment><USER5> Why not simply disabling "back to my iPhone"? I question its value against theft - thieves these days know about taking your device offline. Sure, it is useful if you forget your phone somewhere, but how often does that happen?

It seems the intrinsic risk of attack you expose yourself to by having "back to my iPhone" enabled is greater than the risk of forgetting your iPhone somewhere...

<comment><USER20> Find my iphone also has the benefit that if you erase and lock your lost iphone, then (in theory) the device becomes useless as it will refuse to reactivate, even with a factory reset. (aka "Activation Lock"). The idea is to make stealing these types of devices much less attractive (by killing off any resale value)

</comment></comment><comment> pi-err What's the goal of a "Find my iPhone" attack? Ransomware?

Also puzzled that the attacker manages to guess the victim's password (described as complex). In my experience, 3 incorrect login attempts on iCloud block the site for a while.

Is there more to this story?

</comment><comment><USER21> 2FA? Several years ago I have enabled 2FA on Facebook. One day they they stopped sending SMS and thus I wasn't able to log in to Facebook for arounnd half month. Fuck 2FA on Facebook!

</comment><comment><USER22> when an attacker is trying to access my Find My iPhone feature, I expect Apple to offer a different version of the their 2fa - either by user pre-authed device along with a special secret (those offline password print outs) or another form (landlines, biometrics, knowledge based, etc.).

remote wiping someone's one can a very serious threat if they don't offer something that handles both the usability requirements and the security of the service.</comment>


Native Encryption for ZFS on Linux - <AUTHOR> https://github.com/zfsonlinux/zfs/commit/b52563034230b35f0562b6f40ad1a00f02bd9a05 <comment><USER3> OK, I'm curious: why are people shoehorning the filesystem to fit the OS rather than carefully picking the OS that makes the most sense for the application it's being used for?

We originally ran OpenSolaris _just for ZFS_. Then we switched to FreeBSD when OpenSolaris/OpenIndiana dead-ended. We had a production server running PHP and we were sick of PHP5, so we switched to Linux because HHVM on FreeBSD was a joke. PHP 7 came out and obviated HHVM (from a performance perspective), and so our latest PHP deployments are back on FreeBSD.

If your data is valuable to you (and presumably it is and that's why you're looking at ZFS), why are you not on FreeBSD in the first place?

Same story with ASP.NET - tried deploying on Mono way back before .NET Core was even an idea and realized the futility of it and switched a server farm to Windows _because it just wasn't worth it._ PHP on Windows? Same story - <USER2> production ready, move to Linux.

(This isn't to disparage ZfsOnLinux, which I think is a great effort and laudable if only for home user purposes. Instead, this is a question for sysadmins on HN who are using ZoL.. .why?)

<comment><USER4> Most small shops don't have the expertise -- or appetite to develop it -- to do an OS and kernel comparison in depth. Larger shops like Netflix do (and Facebook, etc). So if you want a detailed answer by a systems/kernel engineering team who have spent weeks studying it, you need to ask a larger shop.

I'm one of those people. I'm on the Perf and OS team at Netflix. We're very familiar with FreeBSD -- we use it on our CDN. We're also very familiar with Linux -- we use it on our cloud. We're very familiar with a lot of other OSes too (Windows, AIX, Solaris, HP-UX, etc).

So why don't we use BSD everywhere, or Linux everywhere? There's no single reason -- it's many reasons -- and it's serious engineering time to document them all and do the topic justice. I'd like to, but I don't have that time right now.

But I wanted to point this out because I do see it commonly asked, and it sounds like a question that can be answered simply, but isn't. You're asking for engineering work, even to just summarize all the factors. I've written up an explanation of why not Solaris before on HN, since that's easy. But Linux vs FreeBSD is much more work, since they are both compelling options.

<comment><USER3> No, you misunderstood me. I am not arguing for FreeBSD everywhere or Linux everywhere. To the contrary.

I'm saying use whatever filesystem Linux provides when you need to use Linux. And use whatever operating system provides native support for ZFS when you need to use ZFS.

We're using ZFS on FreeBSD to do our data storage, ASP.NET on Windows to run our business logic, and PHP under FreeBSD where PHP is required (previously HHVM on Linux because HHVM was the requirement). I'm saying pick the right OS for the right job.

I'm saying figure out your priority with stability in mind.

ZFS is a must when managing big data. It's nice to have otherwise. Decide which factor is the "must" in your case, and if it's ZFS, don't use Linux.

<comment><USER5> Problem is, Linux does not have any decent general purpose filesystem.

That is why people risk their data using an untested hack.

<comment><USER6> What is not decent about ext4 as general purpose FS?

<comment><USER7> ext4 is fine for most people but it's not comparable to ZFS. Even ZFS aside, I've been unconvinced by ext4 these days and have starting using XFS on all new Linux server builds.

<comment><USER6> So it IS a decent general purpose FS. ;)

<comment><USER7> I think there's two incompatible arguements going on here:

1\. Is ext4 a decent general purpose file system?

2\. Is ext4 a decent alternative or comparable to ZFS?

My answers to those questions would be:

1\. It's an " _acceptable_ " general purpose file system but it's really starting to fall behind the competition. When I see comments like how people don't need features like snapshots et al I'm reminded about just how popular Windows Shadow Copy is. Ok that is a service rather than a file system feature but it shows that there is a demand for desktops to have this feature. Checksuming is another example - it's practically free service these days as CPUs have hardware extensions for popular checksum hashes. So the argument is akin to saying "why do we need file system journaling"; sure you don't _need_ them but you're massively grateful when you do have them and your consumer hardware throws it's inevitable hissyfit.

In my opinion Linux really does need to up its game. Ext4 feels almost stuck in time when compares to the likes of XFS which is years older than ext and yet they're working on snapshotting. Then you have really forward thinking file systems like what DragonflyBSD have been working on. They understand the need for better resilience of our data on desktops due to ever expanding storage capacities and HAMMERFS looks extremely exciting as a result.

So to get back to your question. Yes ext4 is acceptable for most people, but is _acceptable_ really good enough? Maybe we should invest more time and energy into XFS?

2\. Is ext4 a decent alternative or comparable to ZFS? Simply put, _no_.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> The title of this HN post should mention that this is ZFSonLinux.

This is good news, but I'll definitely want to wait a good long while before enabling this in production. Yes, _officially_ zfs isn't good enough to use in production anywhere even without shiny new features, but I reckon zfs as-is is better than some other filesystem.

<comment><USER9> By the ZFS proponents own standard for "mature", I guess I should still wait a decade to use this, right? ;)

<comment><USER10> Depends on a). how much you value your data and/or b). how much you trust your backups.

</comment></comment></comment><comment><USER11> The rate of work and breadth of contributors to ZFSOnLinux is pleasantly suprising and impressive: [https://github.com/zfsonlinux/zfs/graphs/contributors](https://github.com/zfsonlinux/zfs/graphs/contributors)

<comment><USER12> Things that happen when you employ folks full-time to work on something.

</comment></comment><comment><USER13> Why would one choose it over dm-crypt? What are the advantages?

<comment><USER14> Personally, I think the best thing is having (finally!) serious cross-platform encrypted drive support in software. (Yes hw encryption has its benefits, but like with software raid - the flexibility of software is great). Potentially this could also be easier to use for external disks than unlock, detect volumes, mount (or unlock zfs mount...).

In theory, having compression and encryption handled by one codebase might open the door to a safe/clearly delineated tradeoffs of enabling both.

<comment><USER15> This to me, is one of the GREATEST advances since Unix was created. Seriously, how !@#!@# amazing is it to be able to yank a pool from illumos, Linux, FreeBSD etc and swap it into a box of another OS supporting ZFS and simply import it wether its encrypted or not but especially encrypted!

I don't know if most of you are old enough to remember the absolute HELL of dealing with tape drives, and UFS to trying to get data recovered or migrated before ZFS. It usually resulted in tears.

<comment><USER16> ZFS - native encryption, resizing, bleaching | The FreeBSD Forums <[https://forums.freebsd.org/threads/56869/>](https://forums.freebsd.org/threads/56869/>)

> I hope that FreeBSD will be not too far behind. …

</comment></comment></comment></comment><comment><USER17> Only by looking at issues in github repo you can tell it's far, far away from being stable, even for homelabs.

</comment><comment><USER18> I'm curious how long it'll take for support to land in grub for this (or how much work it's likely to be).

</comment><comment><USER19> Does ZFS use the native compression libs in the linux kernel?

</comment><comment><USER20> s/Merkel/Merkle/

<comment><USER10> Thank you so much for your wonderful contribution to this discussion.

<comment><USER21> What's wrong with pointing out a typo?

<comment><USER10> What purpose did it serve? The typo was in a commit message. Assuming that the committer ever even sees it -- most submissions here are not submitted by the original author -- he is certainly not going to go back and fix the typo in his commit message.

Besides, in 99% of "typo instances" it is quickly obvious that a typo was made, everyone understands what it should be, and continues on. If it's a typo that actually results in a real problem then by all means point it out; otherwise it just adds to the noise (such as in this case, where it was merely a transposition of two characters).

</comment></comment></comment></comment><comment><USER22> It might not be fair but reading a .gov address listed as a reviewer does not exactly inspire trust. :'(

<comment><USER23> Why not? It's LLNL, who are heavy ZFS users and have been at the forefront of large datasets since they were a thing in computing.

<comment><USER22> Yet also advertise to be into counterterrorism, defense, and intelligence operational support. How many dual_ec_drbg do we need before we stop trusting those people ?

<comment><USER23> I think you're confusing the NSA with LLNL</comment></comment></comment></comment>


Derek Sivers:  Do this. Directives – part 1 - <AUTHOR> https://sivers.org/d1 <comment><AUTHOR>
      How to like people

      1. Assume it's their last day.

This is a powerful way to handle home/work place spats</comment>


Bigger, Lighter, Deadlier Navy launches new stealth destroyer - <AUTHOR> http://security.blogs.cnn.com/2013/10/29/bigger-faster-deadlier-navy-launches-new-stealth-destroyer/?hpt=hp_t2 <comment><USER2> USS _Zumwalt_ (DDG-1000) is a neat looking ship. This rendering (from the cover of a recent _IEEE Spectrum_ ) makes it look like something out of science fiction:

[http://spectrum.ieee.org/img/08cover2013-1374501406697.jpg](http://spectrum.ieee.org/img/08cover2013-1374501406697.jpg)

ETA: it was originally designed to have a _vertical_ gun that could only fire straight up. Smart projectiles would proceed to head off in whatever direction they were programmed to go:

[http://en.wikipedia.org/wiki/Zumwalt- class_destroyer#Advance...](http://en.wikipedia.org/wiki/Zumwalt- class_destroyer#Advanced_Gun_System)</comment>


How to increase conversions with a stellar landing page - <AUTHOR> http://blog.kissmetrics.com/beginners-guide-to-landing-pages/

<comment><USER2> Does anyone else find themselves reading the first 1/3 of a landing page and then clicking on the miniscule "About" button at the very bottom most of the time? I think of it similarly to a deck I'd present to an investor: I'd give my problem-solution spiel and then move quickly into my bio slide. It is my personal opinion (and Mark Suster's) that the features, demo etc aren't absorbed/swallowed if that kind of detail is presented before the listener knows who's behind the product. As a consumer, I'm inherently skeptical, so I can't stomach a whole page of "the hard sell," even if it's above the fold. Do you think there's merit in placing a tiny bio block or a whole paragraph-- something beyond four words at least--from a reputable press review after the pitch and call-to-action? I know it's not de rigeur but something worth thinking about nonetheless.

<comment><USER3> Not a bad idea. The anonymity of people who want you to sign up to their service (and usually give them your name) doesn't allow for trust building. Then again, a big picture of yourself on the page would probably also seem smug.

Laura Roeder <http://www.lauraroeder.com> is a good example of someone who uses themselves as the brand for their products.

</comment></comment><comment><USER4> This is a great example of how to spread information. No video, no live chat, just clear text and screen caps so everything is quick to sift through and obvious.</comment>


Sex-biased brain anatomy in humans and mice is much the same - <AUTHOR> https://www.pnas.org/content/early/2020/07/14/1919091117 <comment><AUTHOR> From the abstract:

""Sex differences in brain organization are theoretically important for our understanding of sex differences in human cognition and behavior. However, neurobiological sex differences have been easier to characterize in mice than in humans. Recent murine work has revealed a highly reproducible spatial patterning of gray matter volume (GMV) sex differences that is centered on systems for socioreproductive behavior and correlated with regional expression of sex chromosome genes. We integrate neuroimaging and transcriptomic data to establish that these same characteristics also apply to GMV sex differences in humans. These findings establish conserved aspects of sex-biased brain development in humans and mice, and update our understanding of the consistency, candidate causes, and potential functional corollaries of sex- biased brain anatomy in humans."</comment>


Ask HN: Are there any Git GUI clients as flexible as Magit but outside of Emacs? - <AUTHOR> Magit lets you stage/unstage/discard changes per file, per chunk, or per line, visually, using only keyboard bindings. Are there any other GUI git clients this powerful, either for Mac or cross-platform? <comment><USER2> I really like GitUp ([http://gitup.co](http://gitup.co)), it's open source and does what you asked.</comment>


Show HN: Product Hunt for Hollywood - <AUTHOR> http://www.pickingdailies.com/

<comment><AUTHOR> Hi HN,

My name is Jonathan Schwartz, complete coding noob, but longtime fan of HN.

I just finished fumbling my way through my first Meteor.js project (via Telescope) to make an Entertainment Industry Social News site, called "Picking Dailies".

I modeled it in the vein of PH, and I'd love to hear feedback from real hackers -- thanks for your time.

\--Jonathan</comment>


Internet2 Reaches 100 Gbps - <AUTHOR> http://www.webpronews.com/topnews/2007/10/10/internet2-reaches-100-gbps <comment><USER2> Measured how? Obviously no single computer is going to see that kind of bandwidth, since not even a front-side bus is nearly that fast.</comment>


Cache me if you can - <AUTHOR> http://bitquabit.com/post/cache-me-if-you-can/ <comment><USER2> Good post. When you are faced with performance issues one of the #1 things you can do is look at what you can cache.

Can you cache requests? Page renders? Database objects? How about function calls?

Caching isn't a panacea but it is certainly one of tools in your set of optimization tactics.

Other stuff I generally look for when trying to optimize include:

\- Connection times and connecting pooling \- Memory constraints \- Duplication of data</comment>


Private keys committed to Github repositories - <AUTHOR> https://github.com/search?q=path%3A.ssh%2Fid_rsa&type=Code&ref=searchresults <comment><USER2> No, this is people committing their private keys to a Github repository. Github is not at fault.

edit: submitter has since updated the title, was: "Github giving away your private key"

<comment><USER3> Seriously.

It looks like people have added their private keys to (public!!!) repos, and voila, a search allows others to find that.

<comment><USER4> I had a dev send me his. I guess he doesn't understand the whole key-thing.

Now he doesn't log in to my server. Just sends me a zip-file that I unpack and test. sigh.

<comment><USER4> On re-reading, I need to clarify: I asked a dev for his public key so I could give him access to my server, and he sent me his private key. Yikes!

</comment></comment></comment></comment><comment><USER5> Definitely a "you did what?" situation but probably still newsworthy since the new search tool makes the user's error easier to exploit and the publicity about the tool will make it more likely that someone will exploit it.

</comment><comment><USER6> Here is how to check if you ever committed your private SSH key by accident:

        https://github.com/search?q=%40user-name-here+path%3A.ssh%2Fid_rsa&type=Code&ref=searchresults

</comment><comment><USER7> Many of the items on that list are actually public keys, which should be perfectly safe to share to the world in a Git repo, but there are definitely a few private keys in there as well.

<comment><USER8> And most of which are "demo app" or "assignment app" or some kind of testing /demo use key in an application that deals with ssh in its processes. There also isn't any apps above 100forks, so nothing widespread to worry about. (add forks:>100)

Reminds me of google hacking: www.hackersforcharity.org/ghdb/ (which is way more fun)

</comment></comment><comment><USER9> Not just github: [https://www.google.com/search?q=site%3Agithub.com+inurl%3Aid...](https://www.google.com/search?q=site%3Agithub.com+inurl%3Aid_rsa)

</comment><comment><USER10> I hope people take the high road here and dont make an example out of github members. People make mistakes. You dont need to delete their repo to show them. A friendly email will do.

Also Github, provide an option to protect those who are less security savy.

</comment><comment><USER11> Don't forget id_dsa as well. [https://github.com/search?q=path%3A.ssh%2Fid_dsa&type=Co...](https://github.com/search?q=path%3A.ssh%2Fid_dsa&type=Code&ref=searchresults)

</comment><comment><USER12> .ssh should probably be on a default .gitignore list, along with .DS_Store

</comment><comment><USER13> for those saying that github or git should have a default rule preventing private keys from being committed, I say:

lolwat?

private keys are private. these people -know- that they are pushing a git repo to a very public site. as such, they should recognize that * is going to be visible in their dotfiles repo. it's not git or github's fault that users are doin it wrong!

<comment><USER12> That's terrible logic, akin to Apple's "the iPhone 4 isn't defective, you're just holding it wrong." If a product is confusing your users, you should improve the UX to increase its usability.

Adding a default .gitignore file with some sensible defaults has no negative trade offs. If you really do want to commit your .ssh folder, just remove that line from your .gitignore.

I will admit that adding .DS_Store, while convenient, might be impractical since git is meant to be platform agnostic, and they probably don't want to start adding all sorts of platform-specific files.

<comment><USER14> wait so your saying github should stick a default .gitignore file in there and bloat it just for the extremely rare case that a user commits and pushes their entire home folder?

Even more rare than that is the user being dumb enough to not consider all files in the home directory before pushing to a public site. I'm sorry but I definitely agree more with the other guy's logic than yours.

You say it has no negative tradeoffs? I say besides changing the whole game (as of right now github does not subject me to a single line of opinionated code) some projects are meant to be small. Sure you can just take out the github .gitignore but thats an extra step. I'm really tired of the stance that we should make development so easy even someone who refuses to RTFM can do it. I'm all against re-inventing the wheel, but dumbing things down like that is not something I can get behind.

<comment><USER12> I don't know about you, but I've never had a git repo that didn't have a .gitignore file. Having one automatically would make me do one less step.

This doesn't dumb down programming. It improves UX for everybody, while also improving security for beginners. Why does GitHub offer to autogenerate a readme file? Because it's convenient. That doesn't dumb down programming for anybody.

<comment><USER14> Correct, but having a line that ignores .ssh is bloat in 99.99% of cases.

The key word in your second point is 'offer'. If they were to protect these keys from being pushed they would have to interfere with your first push and add a line to your .gitignore, which you would then have to remove EVERY TIME... if your a developer I don't know how at this point your not like "eh, actually I don't really feel like doing that in every project, that would be annoying".

I would also argue that allowing newbs to become developers without realizing that they are ignoring private key files inside their git repo is just allowing them to continue on to become developers who are not security conscious. You could of course argue back that having to take .ssh/ out of your .gitignore for every project you do hammers the point home for everyone, and it sure would! I don't believe most of us need that, and if that is your idea of improved UX then please don't ever work with me ;) (I'm j/k about that by the way, tabule looks pretty nice and this is all just my opinion, please don't take it personally. I would welcome an opportunity to work with you... just don't go adding .ssh/ in my .gitignore!! :P)

<comment><USER12> Well, my line of thinking was that having a .ssh line in .gitignore does no harm, so I didn't consider it bloat. You could just leave it in there and it would make no difference, so it could just be completely ignored in most projects. At the same time, you would get a .gitignore file created for you, removing one of the steps you have to do now.

However, I agree with your point that allowing new devs to keep making this mistake and just shielding them from it is a bad idea. With that in mind, it might be nicer if GitHub checked for .ssh files on commit and showed a warning within the web app, letting you know what you did wrong.

</comment></comment></comment></comment></comment></comment><comment><USER15> Can someone just write a script that crawls this page for updates, then sends the users an email telling them what they did?

</comment><comment><USER16> It's actually very handy to keep your private keys in a VCS (along with other dotfiles.) I keep mine in a private repository. I don't worry about it because all my private keys are encrypted with strong passphrases.

</comment><comment><USER17> My favorite: searching for typos.

[https://github.com/search?q=legnth&p=1&ref=searchbar...](https://github.com/search?q=legnth&p=1&ref=searchbar&type=Code&l=)

</comment><comment> X-Istence Github is serving up private keys for those that added them to a git repository. I was wondering how they would be giving away my private key ... without me giving it to them.

</comment><comment><USER18> I wonder if there's a case for a default pre-commit hook that greps for anything secret-looking such as ssh private keys, gpg keys, etc. and bails if it detects any.

</comment><comment><USER19> More than half those results are public keys. It's not as bad as first impressions would indicate.

</comment><comment><USER20> I knew this was going to happen, i'm sure other goodies will be found too.

<comment><USER21> Lots of people still push their Rails secret_token.rb to their GitHub-account: [https://www.google.com.au/search?q=secret_token.rb+site%3Agi...](https://www.google.com.au/search?q=secret_token.rb+site%3Agithub.com&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en- US:unofficial&client=firefox-a)

But there is a certain probability that the token on the GitHub-page is not identical to the production site's token.

(afaik, the token is digested with the user's ID and stored in the user's cookie so a user cannot change his ID while he's signed in - knowledge of the token can let you change your ID to whatever you like)

</comment></comment><comment><USER22> Finally a github search that works!!!!

</comment><comment><USER23> author should grep -v pub from the keys list.</comment>


Open Sauce: Free unlimited testing for open source projects - <AUTHOR> http://sauceio.com/index.php/2012/12/announcing-open-sauce-free-unlimited-testing-accounts-for-oss-projects/

<comment><USER2> _"In exchange, we just ask that you agree you will only use this account for your OSS project(s) and that all of your test results (videos, screenshots, and the Selenium log) will be publicly accessible"_

This sounds great, but I couldn't find a listing of these resources anywhere, which would be great to have. The Open Sauce page [1] has a listing of some of the projects taking advantage of this service but no links to the actual test results etc. Does this exist, and if not can someone put it together?

[1] <http://saucelabs.com/opensource>

<comment><USER3> Here's an example for you, from the wd.js project spearheaded by our own Adam Christian: <https://saucelabs.com/tests/7639f02aa04d4393a7dd39a99e49de1b>

This differs from the default Sauce job page in that the logs for the test aren't shared, and of course, only the person who ran the job can edit it.

</comment></comment><comment><USER4> This is awesome. We're very FOSS and I've let our design team know about this. Thanks folks!

Note: I'm the community manager for <http://www.2600hz.com>

</comment><comment><USER5> Saw the title as was hoping for a salsa recipe site.

<comment><AUTHOR> I hear you. Every day I come into work at Sauce I find myself thinking, "maybe this is the day we pivot to salsa manufacturing?"

<comment><USER6> I reiterate that you should do promotional brazil nut hot sauce. :) (It's high in Selenium...)

<comment><USER7> I'd buy it!</comment></comment></comment></comment>


Lyft Files S-1 - <AUTHOR> https://www.sec.gov/Archives/edgar/data/1759509/000119312519059849/d633517ds1.htm <comment><USER3> >In January 2019, we entered into an addendum to our commercial agreement with AWS, pursuant to which we committed to spend an aggregate of at least $300 million between January 2019 and December 2021 on AWS services. If we fail to meet the minimum purchase commitment during any year, we may be required to pay the difference, which could adversely affect our financial condition and results of operations.

Not as bad as snap but what could they possibly be spending $100 million a year on?

<comment><USER4> 100M/year is ~8M/month. Some perspective on that, it could by you one of:

~400PB of data in S3.

~2600 bare metal "x1 type" ec2 instances running 24/7, 3 year upfront reservation.

~60M Write IOPS in dynamodb

~300M Read IOPS in dynamodb

~3500 16xl RDS aurora instances

Again, each of those is spending the entire budget on a single service, but that seems like a nonsense level of spending.

Maybe they really have that much data. Maybe they have 100PB of data in S3. Assuming 1B rides since day 1, that's 100MB per ride, which seems high. If the average ride is 20 minutes, that's 80KB per second. That would be 25% of the budget.

But assuming they generate 80KB/s/ride, that's ~1MB/second (assuming 1M rides/day). So maybe all of that hits DynamoDB, and between duplicate data, secondary indexes, and size of dataset we have 6 million write iops. And then we do big data processing jobs and have 5x the read load. That's 20% of the budget.

And to process all these events there is a massive EMR cluster of bare metal instances. About 1750 of them. That's 50% of the budget.

Leaving 5% (a measly 400k) for load balancers, and the like.

Those numbers are all a little outrageous to me, but I can see how they might be using that much.

<comment><USER5> At this point isn't it cost-effective for Lyft to just build its own infrastructure?

<comment><USER6> if I have one job in this life, it's to hang out on hacker news and repeatedly post about how it's not cost effective to run your own infrastructure. 8MM/month doesn't even come CLOSE to needing your own infra.

\- person who knows how hard it is to run your own infrastructure

<comment><USER7> > person who knows how hard it is to run your own infrastructure

> fierro Profile: SWE @ Google Resource & Capacity Planning

I think you mean "Person who's job it is to convince others it's really hard and they should just buy your product"...?

<comment><USER6> ha sure. I just meant I know the sort of operational burden cloud customers are able to outsource by not rolling their own, based on my time at the G inside resource planning and management.

<comment><USER8> You know anything of the burden to be reliant on someone else for your core operations? And having to invest and adapt so much just to lock yourself to one vendor? For many that alone is more than the operational burden of doing it yourself.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> > In 2017 and 2018, certain of our named executive officers provided rides to > riders using the Lyft platform in a similar manner as other drivers. We > believe that these driving activities provide the named executive officers > with substantial practical insight into how our platform serves drivers.

I thought this was a pretty interesting point. I was about to call it dogfooding but not quite, since it's more of an experience check than a crucial internal usage.

<comment><USER10> I had one of the VC investors in Lyft pick me up for a ride a few years ago in Menlo Park. Had a super interesting conversation - I was impressed they were scoping out their investment directly. I wasn't sure what the protocol for tipping as at the end, hah.

<comment><USER11> That's really cool. How did you know they were an investor? Did they introduce themselves, or did you recognize them?

I imagine when investors or execs give rides, they probably don't generally reveal their affiliation, since that may skew the experience and the feedback. Though on the other hand, I suppose it could be helpful to say "I work at/with Lyft, how do you like the app?"

<comment><USER12> The same happened to me when I took an Uber. The driver disclosed it immediately that he is an investor after we started driving. I think it makes sense because it allowed him to ask very specific questions without it being awkward.

</comment></comment></comment></comment><comment><USER13> As a former engineer at Lyft, looks like my RSUs would be worth ~2x my salary per year. Typical RSU grants are 25% of your salary per year, so those Lyft RSUs would have been a good return. But that's at a $18-25B valuation. I think $15B is more realistic given the losses and most recent round of funding. Lyft is in a tough industry. Kudos to Logan Green for getting this far. Good to see a UCSB alumn do well.

<comment> throwaway-1283 I don't see how these companies will stop losing $1b+ a year each year. The public markets will not be too kind.

The end game was supposed to be autonomous taxis (cutting the driver out). I don't see how that's going to happen before they run out of money unless they 1) significantly raise prices or 2) take increasingly bigger cuts from drivers.

Personally I will be shorting as soon as I can.

<comment><USER14> Right? Even if autonomous taxis _is_ their endgame, why couldn't companies that actually produce the cars do it cheaper? Almost all of them are heavily investing in it right now, some are even partnering up with companies that know how to do a lot of it.

I don't see how this works out for Lyft or Uber. To me it just looks like they'll both eventually run out of money and get squashed. Maybe I'm missing something?

<comment><USER15> Auto companies are not service companies, those are very different things.

That said, given the dynamism of markets, there's nothing to indicate that Lyft/Uber will have any huge advantage when the time comes.

But this is a game of musical chairs - early investors need to create the biggest, most miraculous but 'believable' story so they can pass the bag onto retail investors long enough to cash out.

If retail investors were able to do their homework, or rather, if their advisors at Morgan Stanley etc. were to do their jobs, I think that they'd see there is far more risk in these things than the valuations imply.

The problem is of course is that Morgan Stanley private wealth managers, managing for all those doctors, dentists, lawyers etc. only make money if there is buying action. And the emotional excitement of 'getting in on an IPO' is just too much to ignore.

The 'bragging rights' value of your dentist in Akron Ohio being able to tell to his buddies on the golf course that 'he has an 'in' on the Lyft IPO' (not really of course, he's at the tail end), is just worth more than a scrutinized deal.

Also - notice the PR/branding for Lyft, it's so funny, like the opposite of Uber - and yet they are for all intents and purposes the very same thing.

<comment><USER16> _> so they can pass the bag onto retail investors long enough to cash out_

I used to say this too, when companies sold stock to the public at outrageous valuations.

I thought it was insane to be the retail "dumb money" left holding the bag on companies like Amazon, Google, Facebook, Netflix, Twitter and Snap.

So will Lyft and Uber be more like Snap or the others on this list?

<comment><USER15> They are all different kinds of companies from different eras.

Amazon went IPO very early and had a very long term vision.

Lift and Uber, it's hard to say and also depends on price.

</comment></comment></comment></comment></comment></comment><comment><USER17> Biggest thing I noticed is that the cofounders only own a little more than 1m shares each, which is less than .5% each!

Painful amount of dilution....wow.

<comment><USER18> Still, a $150M-90M personal net worth at the 18B-30B valuation window. They're not going to starve either.

<comment><USER19> This is something that always strikes me about the amount of money swilling around in tech. $90M is an absurdly huge amount of money. By absolutely any outside objective measure of work put in to payoff it is off the scale. To look at this as the founders having lost out is almost comical.

<comment><USER20> The founders (theoretically) created $20B in value and you think $90M is sufficient compensation?

$90M is definitely enough to be more than comfortable the rest of your life. But a $5B payout would have meant they could start a VC firm, invest in the next several generations of startups, partially self-fund something ambitious like a Space-X, start funded non-profits, etc.

<comment><USER21> You can do all of those things and more - easily - with $90m.

<comment><USER22> Elon invested more than $100M in SpaceX and they came very close to death before they finally succeeded with their last rocket. So it's not clear that you can do all of those and more, easily, with $90M.

</comment></comment></comment></comment></comment></comment><comment><USER23> _" We have incurred net losses each year since our inception and we may not be able to achieve or maintain profitability in the future. We incurred net losses of $682.8 million, $688.3 million and $911.3 million in 2016, 2017 and 2018, respectively."_

<comment><USER24> It's pretty impressive that they've managed to lose that much money despite the fact that they are just running a website and an app.

Yeah, that's oversimplifying it, but it's not like they own factories or storefronts or need to buy access to expensive services or something. The vast majority of their "employees" are independent contractors with no healthcare or retirement benefits who get paid by the ride (so Lyft doesn't lose out when business is slow).

It seems like it should be a license to print money, but somehow they're losing cash hand over fist. Are they subsidizing rides all over the world?

<comment><USER25> When starting out in a city, these companies often have a chicken & egg problem around getting to critical mass.

To solve this, they must offer guaranteed minimums to drivers to maintain an available network even with low ridership. Without that, passengers are unlikely to find an available ride and will easily give up on the app.

Those guaranteed minimums are expensive, but are true one-time costs. They are no longer needed once the network is established.

<comment><USER23> Their sales and marketing is 25% of their expenses, and it's not clear to me how much of that is driver incentives. Even if they cut all driver incentives and marketing they're still in the hole.

<comment><USER25> It looks like sales and marketing only includes driver incentive's due to driver referrals. Referrals are likely a low number compared to the 'guaranteed minimum' incentives used in new markets.

Looks like the other driver incentives may not be included in revenue?

>This four percentage point improvement in Revenue as a Percentage of Bookings was driven by greater efficiency and effectiveness of driver incentives, which contributed approximately two percentage points, increased service fees and commissions, which contributed approximately one percentage point and revenue from the Select Express Drive Partner program, which contributed approximately one percentage point.

<comment><USER23> _Looks like the other driver incentives may not be included in revenue?_

Revenue is money they take in. If they pay drivers a minimum it will be an expense. I'm assuming under "cost of revenue" or "sales and marketing", since they don't categorize drivers as employees but contractors.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> 2018 revenue of $2.16B, with a loss of $911.3M. Oof. Though as a passenger I can't say I mind buying $2 bills for $1!

<comment><USER18> 20% of Uber's revenue with 50% in losses.[0]

I want to see Lyft succeed just to counter Uber, but yeah, those numbers need to be healthier

[0] [https://www.reuters.com/article/us-uber-results/uber- posts-5...](https://www.reuters.com/article/us-uber-results/uber- posts-50-billion-in-annual-bookings-as-profit-remains-elusive-ahead-of-ipo- idUSKCN1Q42CI)

<comment><USER21> That fully depends on what the losses are. I haven't read their financials, but if the losses are from expansion and other investment but their unit profitability is good, then it's not a problem. They can always pull back on investing in growth just to reap profits.

<comment><USER26> But this is where their one-trick pony hurts them. Where will growth come from if they stop growing in the one market they're currently in?

</comment></comment></comment></comment><comment><USER27> Nothing like increasing net losses leading up to IPO!

2016 - ($682,794)

2017 - ($688,301)

2018 - ($911,335)

As a percentage of revenue though the loss is decreasing,

2016 - <USER2>

2017 - 0.6x

2018 - 0.45x

2018 revenue was $2.1bn.

Since they are a tech company and not a real company they can IPO at 10x revenue so that's ~20bn.

Who cares what their margins are.

</comment><comment><USER28> Some notes:

\- They claim their US ride sharing marketshare is 39% - that seems high to me.

\- $800 mil in marketing spend in 2018 from $500 mil in 2017 - they say this increase was largely driven by cost of acquiring new drivers. I honestly thought this would be higher as a % of revenue - this topline number also includes spend on promotions/discounts for passengers.

<comment><USER16> _> that seems high to me_

What data do you have that indicates their market share is overstated?

<comment><USER29> Obviously they have no data, it's a hunch they have. This should be clear from how it's stated.

<comment><USER16> I value informed opinion much more than random anecdotes.

I'm hoping there's more to this comment than just "my friends use Uber so it's hard to believe Lyft has 39% market share".

</comment></comment></comment></comment><comment><USER30> FWIW, @modestproposal pulled out some interesting nuggets from the S-1 filing and wrote a very interesting thread about some good stuff and some things that raise questions. Worth reading. [1]

[1] [https://twitter.com/modestproposal1/status/11015421794812887...](https://twitter.com/modestproposal1/status/1101542179481288704)

</comment><comment><USER31> For those who can't wait to short Lyft/Uber, on average, it takes 10-12 weeks to hit the markets after the initial S-1.

<comment><USER32> That's far too slow given that they confidentially filed earlier.

e.g. Dropbox (which also confidentially filed earlier) was public 1 month after the public S1.

Realistically, Lyft is public by end of April, barring a Box-style pullback

</comment></comment><comment><USER33> The prediction was that ride-sharing would become a winner take all market and that Lyft and Uber would fight it out to attrition, but I'm not sure if this is the case. Both of these companies are massive and I don't see one reaching escape velocity to leave the other in the dust. At a point the losses will matter and the realization will need to be had that the other will not die.

<comment><USER34> "winner take all market "

This is the wet dream of all tech bubbles. It was the same in the 90s when people said whoever sells dog food online first will win that market and be the leader in perpetuity. Lyft and Uber will be easy to attack by local companies once they have to stop subsidizing their rides and actually run a real business (aka making profit)

<comment><USER35> That's an amusing example, because it turns out... pretty much only Amazon will sell dog food online. So it maybe WAS a winner-take-all market, but the winner wasn't that winner...

<comment><USER34> There are tons of dog food sellers online. Chewys, Petco, Petsmart and many others. Amazon is usually more expensive.

</comment></comment></comment></comment><comment><USER36> Some stylized notes:

\- If they do go public for $20B+ they that would be for more than Twitter and Facebook went public for. Would you really want to own Lyft over FB and TWTR the day they went public? That's a very large ask of the public markets.

 __EDIT __To be clear I "m talking about their valuation multiple not the abs valuation.

\- working with JPMorgan, Credit Suisse and Jefferies. So I guess we know 3 banks who won't be on the Uber IPO. Goldman probably has that locked up

\- doing a traditional IPO

\- banks pitching a valuation of $18 to $30 Billion, I believe their last round as at $15.1B

\- Seems rushed to beat Uber to market, maybe there is only room for 1 hugely money losing, $10B+ ride sharing company?

\- how do you loose $1B in a year on $2.2B in revenues and ave any concrete plan at all to become profitable?

> Lyft generated $563 million in revenue in the third quarter, up from $300 > million in the same period a year earlier, a person familiar with the matter > said in October. Losses increased to $254 million in the period from $195 > million in 2017, the person said.

So losses increase as revenue increases, again, what's the profitability plan?

I actually have no idea how to value this company? What metrics should we be looking for? How do use future cash flows to evaluate a company when their future cash flows are all negative by even the most optimistic of estimations?

\- Will be interesting to watch the first 6 months, if things don't go well, Uber could be in for a rough ride on the public markets. Uber has a much more diverse product line, maybe that will be their pitch.. Watch Uber's S1 to see if they promote food delivery, etc over ride sharing.

\- Part of Uber's pitch may be their stake in Didi ala Yahoo and Alibaba, if that's true

\- can't find any info yet on how long employee's and investors will be locked up

\- Lyft has lots of room for international growth as they are only in North America

\- shareholders with more than 5 percent of stock

      - Rakuten Europe S.à r.l.with 13.05 percent

      - General Motors Holdings LLC with 7.76 percent

      - Fidelity associated entities with 7.71 percent

      - Andreessen Horowitz associated entities with 6.25 percent

      - Alphabet Inc. entities with 5.33 percent.

\- Lyft's founders did negotiate for a special class of stock that gives them 20 votes for each of their shares. Will be interesting to see if they get locked out of indexes for this. Index/ETF flow can be a godsend to management as they tend to be passive and long term holders.

\- from the S1 "We have incurred net losses each year since our inception and we may not be able to achieve or maintain profitability in the future. We incurred net losses of $682.8 million, $688.3 million and $911.3 million in 2016, 2017 and 2018, respectively."

\- will list on Nasdaq under ticker LYFT, sweet ticker!!

<comment><USER37> I think investors are mostly betting on self-driving cars being closer than anyone thinks. The first company to get rid of its drivers wins.

<comment><USER28> People online say this but I'm pretty sure it's nonsense. The word right now is self driving cars won't be working for quite a while since they're nowhere near solving for rain and snow.

<comment><USER38> Not that I disagree with the larger point here, but it's fully possible that a system which can't (yet) handle rain and snow could still deliver a ton of value— for example, in Arizona, where neither of those things happen all that much.

A partial launch also gives you a bunch of opportunity to iron out other details, like establishing the protocols which allow a rider to call for assistance, or a remote safety driver to take over in a construction zone, weird driveway pull-in, whatever.

</comment></comment></comment></comment><comment><USER39> It looks like they spend a bunch of pages on rider retention and gloss over what I think is the primary issue for the gig economy: provider retention.

It's just like Groupon, you can't have a good sell-through product indefinitely if the service providers aren't happy and churn at a high rate.

Sooo... what's the churn for the drivers?

<comment><USER31> Driver churn isn't important if driverless cars are on the way.

<comment><USER39> So you think they'll stay solvent for 25 years?

</comment></comment></comment><comment><USER40> For those interested in modeling out the s1, here is a link to an excel version of all the tables in the s1: [https://get.sentieo.com/lyft- ipo/](https://get.sentieo.com/lyft-ipo/)

</comment><comment><USER41> As a multimodal platform/TaaS, is Lyft going to enter the urban air mobility space? Uber is already looking into eVTOL and air mobility with their Uber Elevate team. I saw Blade just launched scheduled helicopter flights in the Bay Area. Use my invite code, SF-4DAN98, for early access. Going to try a flight next week to see if it reduces my commute time.

</comment><comment><USER42> Why are there missing numbers in the form? For example, the percentage the founders hold, or the number of shares that will be made available?

<comment><USER43> Some details can be excluded from the public filling and get filled in closer to the IPO date.

</comment></comment><comment><USER44> This explains why I have seen such an increase in the number of cars with Lyft lights in their windshield driving around town.

</comment><comment><USER45> Aws costs aside, they are being painfully honest in their prospectus [https://www.bloomberg.com/news/articles/2019-03-02/lyft-s- ri...](https://www.bloomberg.com/news/articles/2019-03-02/lyft-s-risk-factors- are-the-stuff-of-ipo-dreams-bad-ones)

<comment><USER43> You are pretty much required by law to be painfully honest. You are required to disclose anything that you know of that might have a material impact on the shares.

</comment></comment><comment><USER37> Some useful numbers from the filing:

1 billion+ cumulative rides.

$8.1 billion in bookings in 2018

$2.2 billion revenue in 2018

From risks:

>> _" We have incurred net losses each year since our inception and we may not be able to achieve or maintain profitability in the future. We incurred net losses of $682.8 million, $688.3 million and $911.3 million in 2016, 2017 and 2018, respectively."_

<comment><USER46> 1 billion rides really doesn't seem that impressive to me given they're a global company.

<comment><USER47> Lyft is not a global company. They're only in North America.

<comment><USER46> Oh wow. I don't know where I got the idea they were global from then. Thanks for the correction.

</comment></comment></comment></comment><comment><USER48> Obligatory read about Lyft's dual class shares from Matt: [https://www.bloomberg.com/opinion/articles/2019-02-12/lyft-d...](https://www.bloomberg.com/opinion/articles/2019-02-12/lyft- doesn-t-need-investors-to-vote)

</comment><comment><USER49> Mazel tov! About time :) Congrats to John, Logan, and the entire Lyft family!

</comment><comment><USER50> Uber is kicking their teeth in. I would be very surprised if Lyft is still around in 5 years.</comment>


Doom (1993) Encryption - <AUTHOR> https://twitter.com/Foone/status/1189249817492557826 <comment><USER2> Neat stuff, but this really affirms, to me, that Twitter is a really terrible platform for any content longer than a single tweet.

<comment><USER3> A Twitter thread to explain why @foone uses Twitter threads: [https://twitter.com/foone/status/1066547670477488128?s=21](https://twitter.com/foone/status/1066547670477488128?s=21)

<comment><USER4> Is there a reason someone can't just ramble in a blog post?

<comment><USER5> ADHD. If I have a long-form blog post to write end, I get caught up in going back and rephrasing and re-editing and such, and it never gets finished.

Twitter's paragraph-size chunks with minimal editing (if I really have to, I can delete the last post and re-create it) means that I can't get stuck in the process of editing and revising, so I have to keep moving forward.

So it's really the only way I can write. My wife's gone through and rewritten some twitter threads into a blogpost for me, but she hasn't gotten to this one yet.

BTW, You can also use a threadreader/unroller to make a pseudo-blog-post out of it.

<comment><USER6> You produce some of the most interesting threads I've read on Twitter. Thanks for sharing as much as you do.

Out of curiosity, why not mastodon? Do you see a path from Twitter to a federated or decentralized service?

</comment></comment></comment></comment></comment><comment><USER7> Axiom Verge (2015) uses the same trick to avoid the `strings` utility, but with parametrized cheat codes. (Back then I took it apart in a decompiler and looked up all the cheats, see [https://trollbu.de/axiomverge/](https://trollbu.de/axiomverge/))

</comment><comment><USER8> Foone's is easily one of the most interesting and weird accounts to follow on Twitter.

Check out this thread starting with a response on the toxicity of _Rhodium_ and prepare for one hell of a ride!

[https://twitter.com/Foone/status/1190340638899724288](https://twitter.com/Foone/status/1190340638899724288)

</comment><comment><USER9> Similar efforts to hide string literals were used 5 years earlier in one of the first Internet worms: Morris worm.

[http://spaf.cerias.purdue.edu/tech- reps/823.pdf](http://spaf.cerias.purdue.edu/tech-reps/823.pdf) sect. 5.1.7

<comment><USER10> Huh. I'd forgotten that only five years elapsed between the Morris worm and DOOM. That's amazing progress in a very short time.

</comment></comment><comment><USER11> Is this not considered obfuscation? I thought encyption implies there is a key of some kind to decode the message. This seems like obfuscating binary and translating it at runtime, à la security-through-obscurity.

<comment><USER12> Based on the algorithm in the tweet, it looks like it's reversible. This would imply that it's indeed encryption and not a hash function or anything.

<comment><USER11> There is nothing preventing someone from decoding this message. Sure it's a bit of a hassle to reverse-engineer the isomorphic function but there is nothing secure about this. The cheat codes are not encrypted, they are obfuscated.

Wikipedia defines encryption as "the process of encoding a message or information in such a way that only authorized parties can access it and those who are not authorized cannot."

<comment><USER13> That's a poor definition. If I read someone's GPG password off a Post-It on their desk, I can decrypt any information encrypted with it, but I'm not authorized to do so.

A better definition would distinguish between those in possession of both the algorithm and all its inputs, and those who aren't in possession, and rather than saying they "cannot" access the encoded information, it would say that access is impractical or at least cumbersome.

By that better definition, it's still encryption, because it made it cumbersome for someone to access the codes without understanding the encryption method.

<comment><USER11> > because it made it cumbersome for someone to access the codes without > understanding the encryption method.

I disagree. This is security through obscurity. You are simply transforming data, byte-by-byte without any key. This is encoding data using an isomorphic function. By you definition, GZIP is encryption.

</comment></comment></comment></comment></comment><comment><USER14> If you enjoy this kind of content do yourself a favor and follow this guy. It's an amazing account.

</comment><comment><USER15> I think this small piece of nostalgia (and memories of struggling with extenders) is fairly timeless, and many game devs still say something similar today:

> We are going to use the 1.95 4GWPRO dos extender for the new version and > patch, but if you have difficulty with it, we will provide other executables > that you can try with the 1. 8 DOS4GW extender and 1.94 4GWPRO extender.

> Yes, we think this business with flakey extender versions is a pain, too. > The price we pay for want to make this game on a platform with a market. > PC's. DOS. Sigh.

\- Dave Taylor

<comment><USER16> Heh DOS4GW was incredibly stable compared to the one that 3DStudio 4 used, what was the name... Pharlap?

<comment><USER17> Phar Lap was named after a horse!

DOS4GW was probably the most common, especially with PC games.

PMODE was pretty popular with the hobbyist market. CWSDPMI was also pretty popular once DJGGP started being used with it instead of Go32 (which I think wasn't even a full dpmi provider)

<comment><USER16> Yeah I was using PMode for our demos since it came out in 94, but for my 1995 game I stuck with DOS4GW, and after Win95 and the GameSDK came out it was time to move to Win32.

</comment></comment></comment></comment><comment><USER18> If the cheat codes appear in the code in a particular order, wouldn't people tend to document them in order of appearance? I don't see why two people wouldn't generate the same list from the same code base.

</comment><comment><USER19> More and more gems coming out of the source code from the mind of Carmack.

<comment><USER20> Actually, this was implemented by Dave Taylor: [https://twitter.com/ID_AA_Carmack/status/1189567625631883265...](https://twitter.com/ID_AA_Carmack/status/1189567625631883265?s=20)

<comment><USER19> Ahh cool! Thanks for clarifying</comment></comment></comment>


Apple, FAA Investigating After iPhone Catches Fire Mid-Flight - <AUTHOR> http://www.nbcnews.com/tech/tech-news/apple-faa-investigating-after-iphone-catches-fire-mid-flight-n543516 <comment><AUTHOR> FTA:

 _Spring-break-bound sophomore Anna Crail was watching a movie on Thursday when her iPhone spontaneously caught fire over the Pacific. "All of a sudden there was like 8-inch flames coming out of my phone," she told KOMO News. The teen panicked, telling KOMO that she thought the plane "was going down." "I flipped it off onto the ground, and it got under someone's seat, and the flames were just getting higher, and a bunch of people stood up," she said._

(Spotted in a comment by resolaibohp < [https://news.ycombinator.com/item?id=12646376](https://news.ycombinator.com/item?id=12646376) > in today's thread about a replacement Samsung Galaxy Note 7 catching fire on a plane < [https://news.ycombinator.com/item?id=12645826](https://news.ycombinator.com/item?id=12645826) >)</comment>


Why Twitter Will Endure - <AUTHOR> http://www.nytimes.com/2010/01/03/weekinreview/03carr.html?ref=weekinreview <comment><USER2> Twitter won't endure, it's a land of marketers and bloggers and personalities pushing their own stuff. It's too complicated for real people, and unlike the bloggers they don't have an incentive to figure it out.

I'm a perfect example, I tried twitter like 6 months ago, tried it for a month, than gave up because there was just too much noise. I'm now back, but only because I use twitter to promote my own site. And since I now had an incentive to figure things out, I found things like tweet deck and lists that make things a lot easier.

<comment><USER3> I don't understand what's do difficult to understand about Twitter. It's a communication tool. It's valuable if/when there are useful things being communicated with it.

To say that Twitter is a "land of marketers and bloggers and personalities pushing their own stuff" is like saying that telephones are only useful for telemarketers.

To say that Twitter is too noisy is like saying that there's nothing good on TV. If you don't like what's on _your_ TV you're free to put on whatever you like.

<comment><USER4> > I don't understand what's do difficult to understand about Twitter. It's a > communication tool.

This isn't the problem with Twitter. I think everybody _gets_ that it's a communication tool. It's just that it's an awful tool for communication. It's designed with a number of ridiculous and artificial constraints to conform to an aging and rapidly dying technology (phone texting).

Almost the entire ecosystem of communication you see on Twitter is designed to overcome the limitations of the medium, from Twitter specific acronyms (RT, OH, b/c, etc.) to url shorteners (<http://bit.ly/>, <http://tinyurl.com/>, etc.) to multiple tweets to cover a single topic, and on and on and on. Most of the time, things like urls are simply designed to be pointers to actual content anyways, because you can't fit the content into a Tweet. In effect Twitter becomes an RSS/link aggregator.

Sure it's _different_ than other communication mediums, but it's not really solving a problem that anybody in particular had, and ends up creating a whole new slew of problems because of the poor decision to tie the entire architecture essentially artificial limitations.

</comment></comment></comment><comment><USER5> No matter how much I have tried to understand twitter, I have never really _gotten_ it. I can only see it as being a fad.

The character constraint forces people to say whatever they want to say concisely which I can see as being valuable - it's all too easy to otherwise get lost in the sea of data that is the internet. But that's about it.

How do people use it? Are most people using twitter from their laptop/PC or from cell phones? I can understand the need to keep messages small if you are using a hardware interface that provides a constraint on what you can practically write. But those limitations will go away in time.

I would guess that people will want increasingly higher bandwidth communication, not less. I can see people putting up with SMS type messaging for now, but I'd bet they'll ditch it when they can buy a working star trek communicator.

Seriously, if anyone can provide me with the true enlightenment on this please do so. It sometimes seems as though I'm the only person alive who just doesn't get it.

<comment><USER6> _I would guess that people will want increasingly higher bandwidth communication, not less._

I was going to call this a misconception. But, in fact, the answer is that Twitter _is_ a high-bandwidth medium. For readers.

(It's more effort for writers, but who cares about us? There are orders of magnitude more readers than writers.)

It's true that I could dump a lot more raw information on you with a ten- second video Tweet than a 140-character text Tweet. But most of that information would not only be _useless_ (you probably don't care to know the exact quality of the light falling on the bookshelf behind me, or how well I shaved this morning) but positively _negative_ (because it will distract you, detract from my point, and tend to engage and distract many more levels of your brain, thus contributing to the mental cost of context-switching that is the bane of modern existence).

What I crave as a reader, among other things [1], is a source of plain-text links and messages (which can be followed up if desired) that are drawn from a body of people I vaguely trust, or their immediate circle of friends; that have been wordsmithed, at great effort, to pack the maximum content in the minimum space; and that have been arranged on a single screen that can be browsed without fuss or effort and that doesn't contain big blinky ads that have been engineered to be among the most distracting things ever made. And, what do you know, Twitter is a pretty good approximation of that, especially for events that are evolving in real time.

\---

[1] This is kind of an important point. Twitter is one tool, for one kind of reading. I wouldn't entirely give up blogs, or YouTube, or HN for Twitter, just as I wouldn't give up all books for Wikipedia.

<comment><USER4> Now say all that in a single tweet.

<comment><USER7> Put the comments in a blog. Tweet the link.

<comment><USER8> Then Twitter is essentially an RSS front-end.

<comment><USER7> Maybe, but its a tech that is more understandable to the masses, than "RSS feed". You have to think like a typical client with a new phone. How many phones have a twitter client? RSS?

<comment><USER4> I can guarantee that if a smart phone has a twitter client, it most certainly has an RSS reader. Furthermore, I can guarantee that many smartphones that do not have a twitter client have an RSS reader.

m.google.com/reader

<comment><USER7> I can guarantee you that if I ask 100 average non"hacker news" people what RSS stands for I will get a blank stare, but if I ask them about twitter.....

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> _"I was on a Virgin America cross-country flight, and used its wireless connection to tweet about the fact that the guy next to me seemed to be the leader of a cult involving Axe body spray. A half-hour later, a steward approached me and said he wondered if I would be more comfortable with a seat in the bulkhead. (He turned out to be a great guy, but I was doing a story involving another part of the company, so I had to decline the offer. @VirginAmerica, its corporate Twitter account, sent me a message afterward saying perhaps it should develop a screening process for Axe. It was creepy and comforting all at once.)"_

For me, the one enduring lesson of Twitter is that if you build something that makes journalists and "public-relations professionals" feel important, you will get lots of free press.</comment>


IOTA surges up 70% after teaming up with Microsoft, now the 5th cryptocurrency - <AUTHOR> https://www.cnbc.com/2017/12/04/cryptocurrency-iota-rallies-after-launch-of-data-marketplace.html <comment><USER2> Bruce Schneier previously had this to say regarding IOTA:

> In 2017, leaving your crypto algorithm vulnerable to differential > cryptanalysis is a rookie mistake. It says that no one of any calibre > analyzed their system, and that the odds that their fix makes the system > secure is low

<comment><USER3> Yup. Once this happened, I immediately lost complete faith in IOTA. Not to mention, their response to this was horrible.

<comment><USER4> Same. I don't know a single developer worth their salt who doesn't know the golden rule of working with cryptography. The team must be full of amateurs.

Also, does anyone know if IOTA is a real blockchain I seem to remember when I first looked into it that it seemed to be nothing more than a distributed database with centralized control.

</comment></comment></comment><comment><USER5> It's funny how they make a big deal about having a link to Microsoft, but Microsoft doesn't mention them at all. [https://www.google.com/search?q=site:microsoft.com+iota](https://www.google.com/search?q=site:microsoft.com+iota)

The quote they have from Microsoft [https://blog.iota.org/iota-data- marketplace-cb6be463ac7f](https://blog.iota.org/iota-data-marketplace- cb6be463ac7f) appears to be from a sales guy [https://www.linkedin.com/in/omkareshwar](https://www.linkedin.com/in/omkareshwar)

<comment><USER6> The first result is a link to a MS blog post about Azure integration with IOTA: [https://azure.microsoft.com/en-us/blog/azure-blockchain- upda...](https://azure.microsoft.com/en-us/blog/azure-blockchain-update-5/)

But no mention of the marketplace demo (the subject of the article). You're correct, the quote is from a Sales guy involved with their blockchain strategy.

<comment><USER5> Making the claim of there being a partnership with a company because you have a container available on their cloud hosting platform seems a bit overstated to me.

<comment><USER6> Correct, the partnership referenced in the article instead refers to the marketplace demo.

</comment></comment></comment></comment><comment><USER7> This market is really greedy, any connection (justified or not) with an established brick & mortar company seems to give your cryptocurrency immediate visibility and boost.

<comment><USER2> It's very difficult for the investors to distinguish between different crypto- assets or even between crypto-assets and cryptocurrency. Any mention that describes one of those companies is seen as an endorsement -- that kinda thing really "helps" them distinguish.</comment></comment>


Is It Journalism, or Just a Repackaged Press Release? Here's a Tool to Help - <AUTHOR> http://www.theatlantic.com/technology/archive/2013/04/is-it-journalism-or-just-a-repackaged-press-release-heres-a-tool-to-help-you-find-out/275206/ <comment><USER2> As a former PR person I can tell you that this ap is AWESOME. the general public has no idea how much of their "news" is actually just corporate created "infomercials" I don't even mean to sound like a conspiracy theorist- but it is truly shocking when as an intern I would write press releases and then later that night hear my exact words said on the evening news. This is especially true of newspapers who are trying to create reams of content but with far fewer journalists. If this app works as well as they claim- this is a game changer.

<comment><USER3> I never quite published a press release verbatim in all the news stories I have written[1], but sometimes the information density of a press release is so low as to make a rewrite look like a copy anyway.

[1][https://www.google.co.uk/search?q=site:trustedreviews.com+hu...](https://www.google.co.uk/search?q=site:trustedreviews.com+hugo+jobling+news)

<comment><USER4> I don't think there is a problem with press releases, as long as journalists acknowledge them for what they are: press releases. It's fine imho for a newspaper to reproduce a press releases verbatim, if it makes it clear to the reader that no post-processing has been done.

What is not ok is to trick the reader into believing that a piece of information has received adequate treatment, when it really hasn't. There's an implicit contract of trust between the newspaper and the reader, and if that app does what it advertises, it will make the contract harder to breach.

<comment><USER5> The only way it should be acceptable is if the journalist writes "the company said X but they stand to make money off of it and I have not verified it."

<comment><USER6> I used to think that, until I read this: [http://www.zerohedge.com/content/zero-hedge-conflictsfull- di...](http://www.zerohedge.com/content/zero-hedge-conflictsfull-disclosure- policy)

In particular:

      | The reality is, critical readers should read analytic
      | posts and the rest of Zero Hedge* with the blanket
      | assumption that the author is totally "conflicted."
      | (Phrased more logically, that the author stands to
      | benefit from being right--imagine that).

* Replace "Zero Hedge" with "News Site", "Blog", etc.

</comment></comment></comment></comment></comment><comment><USER7> It may seem like a minor nitpick, but the main Churnalism site[1] touts the byline "Discover the journalism you can trust and what you should question." The purpose of this tool is definitely a step in the right direction, but just because a given piece probably isn't a recycled press release doesn't mean you should stop looking at it with a healthy dose of skepticism.

[1] <http://churnalism.sunlightfoundation.com/>

<comment><USER8> Sometimes the press release is _more_ accurate. There have been examples in the UK when something released by the Office for National Statistics[1] is looked at and interpreted by a journalist. Unfortunately statisticians get the numbers right and journalists don't, and so reporters make very dramatic statements that just aren't supported by the numbers.

[1] (<http://www.statistics.gov.uk/hub/index.html>)

<comment><USER9> Though in our defense, there are also plenty of times when the numbers are wrong and journalists are right.

After performing a basic checksum, we contacted the UN to get a clarification on their firearm-homicides report discrepancy (their A + B should have been equal to C, but wasn't in some cases.) Their response was to basically manually correct column C without ever explaining why it was off. That shook our confidence in their collection and analysis methodology.

State department nonimmigrant visa statistics for the past decade has plenty of numbers for T-2, T-3, T-4, T-5 visas (about 1,500) but only zeroes for T-1. Problem? Description of "T-2" through 5 is "Spouse of T-1", "Child of T-1", "Parent of T-1" and "Unmarried siblings of T-1". So if these are dependents of the visa holders, what happened to T-1's? After pursuing this, we received no comment and hit a dead-end. Somewhat understandably, as T-1 description is a sensitive topic: "T-1: Severe human trafficking informants."

</comment></comment></comment><comment><USER10> For reference, the term "PR Submarine" refers to pg's essay, "The Submarine" - <http://www.paulgraham.com/submarine.html>.

</comment><comment><USER11> Aren't good PR people supposed to "sell" their story directly to a "journalist", without an intermediate publicly available press release? Will this tool find those?

Also, there's a certain irony in that this story itself almost certainly is "planted" PR.

<comment><USER12> "Aren't good PR people supposed to "sell" their story directly to a "journalist", without an intermediate publicly available press release?"

That would require that the "journalist" pay attention and not just directly look through their pile of releases for a "story". News departments are lazy and don't want to pay for real news, they want it spoon-fed.

<comment><USER11> It's spoon-feeding I'm describing. It's just targeted, one-to-one spoon feeding instead of spray-and-pray press releases.

It is way easier for a journalist to go to lunch, accept flattery for his sharp style and leadership in his field, and then walk home and copy-paste the text handed to him, than sift through the same pile of press releases that every other journalist in the industry is also sifting through.

<comment><USER13> My, aren't we all cynical today?

There is nothing wrong with the concept of a press release, particularly when used as intended, as a starting point for a piece of journalism.

In the media we write many different kinds of stories. Some are the vast investigative pieces that put the world to rights and might one day win a Pulitzer prize, but others are simply humdrum announcements of new products or services. I'd have thought that a community of founders would appreciate the value engendered by outlets that gather eyeballs for particular sectors and spread the sort of bread and butter news that is press released day in day out by stakeholders in those sectors -- usually after having first removed the hype, dubious claims ("World's first!") misrepresentation ("A and B have partnered to..." when it means A has bought/licensed something from B) and fluff ("We are excited to...", "This development reaffirms our commitment to...") that the authors of the press releases have inevitably included.

The simple truth is that press releases were not designed for direct consumption by the public, and sites that reproduce them verbatim do nobody any favours. However, in many circumstances several outlets could legitimately run very similar stories based on the same press release, and deliver great value in doing so because they all reach different audiences. Using a press release as a source is not in every case a dirty little secret that needs to be exposed by clever software.

Addressing the point made in the parent post, it seems to me there is a bit of a disconnect in assuming that one can take a journalist to lunch, tell him how very clever he is, and then hand him copy-paste text. Wouldn't work on anyone I know...

<comment><USER11> I am indeed being cynical, but I was also trying to play along with the premise of the article.

I think worrying over the influence of PR amounts to rearranging the deck chairs on the Titanic, "news" ("The lie that something important happens every day") is much more fundamentally broken, as per this article that was discussed a while ago:

[http://www.guardian.co.uk/media/2013/apr/12/news-is-bad- rolf...](http://www.guardian.co.uk/media/2013/apr/12/news-is-bad-rolf-dobelli)

</comment></comment></comment></comment></comment><comment><USER14> Reminds me of the fake web browser and IQ study (which claimed IE users are dumb). Basically every media house just copy pasted the press release.

[http://en.wikipedia.org/wiki/Intelligence_Quotient_(IQ)_and_...](http://en.wikipedia.org/wiki/Intelligence_Quotient_\(IQ\)_and_Browser_Usage)

<comment><USER15> Since then, has there been a real study into the relation between intelligence and browser choice? I suspect the hoax report largely was picked up by IT sites and mainstream press because the conclusion sounded plausible to them (IE users = not smrt).

<comment><USER16> Yea it was an exploit of a cognitive bias (confirmation bias, to be exact [1].)

<http://en.wikipedia.org/wiki/Confirmation_bias>

</comment></comment></comment><comment><USER17> Depending on the release and the article, I'm not convinced that rewriting or lifting words from a press release is always a bad thing. Is it possible to write a story about the latest Consumer Price Index without it being substantially based on this press release <http://www.bls.gov/news.release/pdf/cpi.pdf> ? Is it possible to write about a newly announced iPhone without lifting data from Apple PR events or releases?

I would rather have an article that lifts a technical phrase from a press release over one that attempts to reframe or extrapolate from it in a way that is no longer factually correct.

<comment><USER18> > Is it possible to write about a newly announced iPhone without lifting data > from Apple PR events or releases?

No, but writing about the newly announced iPhone shouldn't really be called journalism.

<comment><USER17> Why not? So is a press release never news?

<comment><USER19> I agree with both of you. A journalist (in my opinion) shouldn't be someone who rewrites press releases. Having just finished Robert Fisks column before I came here, I'm certain of that. Not everyone can be where he is however, and the small local stories need to be written. Re-writing press releases is a mile from these situations however - at least read around the subject and compare/contrast (?pad it out) with what others are doing.

</comment></comment></comment></comment><comment><USER20> The Atlantic piece is light on details, but the Sunlight Foundation has a blog post describing the technology used for text pattern matching, titled "Churnalism US: the Nuts and Bolts" ([http://sunlightfoundation.com/blog/2013/04/23/churnalism- tec...](http://sunlightfoundation.com/blog/2013/04/23/churnalism-technical- background/)). They've released the core matching code, called SuperFastMatch, as free software (<https://github.com/mediastandardstrust/superfastmatch>).

</comment><comment><USER21> Is it published on a technology or startup-focused site that isn't Ars Technica? It's a press release.

</comment><comment><USER9> Pardon my skepticism, but an automated tool that replaces vetting, critical thinking and analysis may not be as helpful as it leads to believe. I've punched in three stories that I specifically know came from a PR, and the tool wasn't able to spot anything amiss with it.

</comment><comment><USER22> Journalism isn't supposed to be fiction. The information comes from some place other than the journalist's mind, and often that information originates in a press release, though that absolutely should not be the end of a journalist's research.

Still I don't understand why journalists (including some of the ones I have hired as freelancers) are willing to regurgitate a press release and leave it at that. Some even plagiarize releases and put their bylines on the story, which is beyond shady. But beginning and ending with a press release is lazy. Sometimes more information just isn't available. Sometimes.

I cover technology. There is no technology that isn't announced in a press release. It's just the way the industry is. It's either a press release or leaked information that will appear in a press release later anyway.

But press releases, as someone here mentioned, are often lacking in details. They're also often just plain inaccurate. It is a very rare PR person who has any grasp of technology beyond Twitter and Microsoft Office.

Why do people write stories based exclusively on a press release instead of getting hold of the software or hardware, reading spec sheets, reading manuals or at least visiting the product information page online?

You write a story about a new projector. What ports does it have? Those aren't in the press release, but they're easily accessible. Throw ratio? Weight and dimensions? Lens options? Throw distance? All of those pieces of information are important to your readers and can easily be learned by looking outside the press release. So why skimp when your audience is counting on you?

Now, all of that said, I think the premise of this tool is a joke. Google works fine when I want to find out if my writers are plagiarizing verbatim, which I have caught some doing. But other than that, every single piece of journalism is based on information obtained from somewhere, whether it's a press release in your mailbox or a press conference in the White House, whether it's a whistle blower meeting you in secret or a piece of damning evidence you found in a dumpster. It all comes from somewhere.

</comment><comment><USER23> Today I will mostly be: sketching out how to hook my URL catching bot to the Readability API for extracting article text and then to the Churnalism API for finding what press releases the BBC* have put lipstick on this time.

* other news-gathering organisations are available.

</comment><comment><USER24> This is really awesome. It's definitely a step in the right direction, anyway.

If the tool really catches on, though, there's an easy loophole that spammers have been using to trick Google for the last ten years. You simply load the content into a "spinner" and have it generate synonyms. Articles for human consumption used to require manual editing, but the programs are getting better.

Spammers have been known to use a similar trick to re-use company "news" by sending journalists re-written releases as "exclusives."

This is why real journalists call, verify, and investigate. Publications like the NYT or WSJ are never fooled by the tricks above, though they may use some AP or PR copy to save time.

<comment><USER5> Before a journalist takes the time to load a press release into a "spinner" maybe they'll just go ahead and rewrite in their own words.

</comment></comment><comment><USER25> The Churnalism concept has been circulating in media/nonprofit think tanks for a couple years now.

Before a team worked on something similar at the Berkman Center in Cambridge, MA, we all discovered tools like iThenticate, which do the same job and more better.

More importantly, very little PR news was mislabeled as not PR. It was hypothesized that politicians read from PR directly into the Congressional record, but the instances were so exceedingly few and the audience so exceedingly small that there were no discoveries to announce.

Hence color me a little unsurprised that despite a great tool, Sunlight Foundation didn't actually find anything too controversial to announce with their tool.

<comment><USER26> If the PR was circulated privately to a high value, unique target (like Congress), would you expect an eternal analysis to find it?

</comment></comment><comment><USER27> For an in depth investigation into this phenomenon, see Nick Davies' Flat Earth News:

[http://www.amazon.co.uk/Flat-Earth-News-Award-winning- Distor...](http://www.amazon.co.uk/Flat-Earth-News-Award-winning- Distortion/dp/0099512688)

</comment><comment><USER28> A cool app, but a sad statement about the state of journalism that PR fluff is as easy to spot as seeing quotes come verbatim from previously published PR pieces. The more insidious PR can come from spoon-fed "exclusive" interviews and not be as easily detected by this process.

Even better would be something that produced a dossier of organizations and spokespeople...so that you can easily see the potential connections behind any quoted source (of course, there will be false positives) In news stories, someone's role as a shill can be papered over by calling them a: "industry expert" or "author" or "researcher/analyst"

<comment><USER26> Of course, the simple solution to that is that "Exclusive" is never in the reader's interest.

</comment></comment><comment><USER29> In addition to stuff lifted from press releases, it seems to also notice when articles borrow large chunks of verbatim text from Wikipedia.

</comment><comment><USER30> I reckon all discovered examples should be posted by the browser plugin automatically to a central db where they can be analyzed. It won't take too long to build up a picture of which news outlets do this the most, then that data can be posted in a simple, updated list (with links to examples) for everyone to consume much as they would an email blacklist.

This could all be automated.

</comment><comment><USER31> Great application. And as always, a healthy dose of skepticism is good.

The two questions I always ask myself when reading something or listening to someone is "Why are they telling me this? What is their motive by telling me this?". I ask these questions whenever I listen to anyone, from the salesperson, to a journalist, to a politician, to my wife and kids.

</comment><comment><USER32> The Sunlight Foundation has been full of awesome ideas and tools. Its worth digging into their other projects

</comment><comment><USER33> Isn't this a part of some sort of PR strategy for the Sunlight Foundation? It's sort of hard to take this article seriously when the article literally contains fragments from the application's about page. Isn't this what they're trying to 'protect us' from?

<comment><USER26> The Sunlight Foundation may be happy for you to know this is their PR. Not really their fault that the Rebecca Rosen is too lazy to write a proper article.

It ironically drives home the very point of their app, which perhaps was intentional by Rosen!

<comment><USER34> Unfortunately, when I run the article through the tool it returns no hits.

</comment></comment></comment><comment><USER35> This would be pretty awesome with a browser plugin.

<comment><AUTHOR> Here you go: <http://churnalism.sunlightfoundation.com/downloads/>

<comment><USER36> Does it analyse every page I visit? I would prefer if it was activated by a button press only when I need it.

<comment><USER37> It runs automatically, but only on a whitelist of sites. You can edit the list in the extension settings.

<comment><USER36> Thanks, good to know.

</comment></comment></comment></comment></comment><comment><USER38> Obligatory reference: <http://www.youtube.com/watch?v=Hh_Kx7UKndI>

</comment><comment><USER39> And then publishers wonder why we've stopped buying newspapers years ago.

</comment><comment><USER40> [https://en.wikipedia.org/wiki/Manufacturing_Consent:_Noam_Ch...](https://en.wikipedia.org/wiki/Manufacturing_Consent:_Noam_Chomsky_and_the_Media)

</comment><comment><USER41> kudos on the name.</comment>


Circumstantial Superstitions - <AUTHOR> This concept quite diverges from the conventional superstition-beliefs. The following word is coined to throw light onto the dynamical nature of beliefs concerning superstitions.<p>Consider, a black cat crossing one's path, which is considered a bad-luck in the US, which on the contrary is a good-luck in the UK. Even the intensity of this belief varies based on the cruciality of the task to be carried out. Per se, if someone is going for an interview for which he/she has prepared with all their heart and it is quite important to crack it, they wouldn't risk going along the same path crossed by a black cat (US). However, with a trivial task, not taking the same path would be less rigorously thought upon. Is this quite frequently observed/ experienced, let me know what do you guys think? <comment><USER2> My views related to this topic are a little bit different. I don't say that one should blindly believe in some superstition but I do believe that we should try to understand the reason for it and might as well follow it. According to my experiences in life I have seen all the superstitions are made due to some scientific or religious reasons to it. We might not have discovered it yet so we think it's crazy to follow them. For eg. It is believed that we cannot leave the house with a diya in the house still lit. The underlying reason is that an object nearby due to any unforeseen circumstances may catch fire and create a problem.

Similar is with cutting nails in the night, that it would poke a bird's eye. But the real thing is that in night the vision is not as clear as day and in early days there used to be no nail cutter and people used scissors.

There are endless of these examples but unless we find a scientific or logical reason to it we are not going to follow it. So I would say if there's something that is preached by the previous generations there must be a reason to it let's not oppose it and find reality to it !!

</comment><comment><USER3> For the part where it is too important (interview), you are concerned more about it and think exaggeratedly about anything and everything. The crossing black cat and associated bad luck here could be a self fulfilling prophecy. For a trivial task you would not give it much thought and the crossing black cat would not matter much.

Consider you being an ambulance driver and attending an emergency call. The black cat crosses your path but you cannot change the route because it is the shortest one. You would do everything you can to save a life.

The point is - harder you work luckier you get.

<comment><AUTHOR> That is correct, as you portrayed here, the cruciality of task at hand may surpass the beliefs. I am quite certain, this ideology is persistent.

</comment></comment><comment><USER4> I have experienced this.

I consider myself a staunch rationalist and atheist.

But during a specific phase in my life, when I was dealing with something that was right on the knife-edge (almost exactly 50/50 odds, calculated analytically using financial mathematics), I became very superstitious about knocking over salt on the table. Whenever I went to a restaurant I'd ask to have the salt removed to avoid knocking it over.

I reasoned that I attached a low probability to the superstition about salt being true (yes, I know its origins: salt used to be extremely valuable so wasting it was _prima facie_ 'bad') yet that low probability of it being true applied to the tiny margin I had available to me made it significant to me.

Yeah, stupid, I know.

<comment><AUTHOR> Indeed, you're correct. Often a constant trade-off of weightage is observed while analyzing a situation through facts-superstitions.

</comment></comment><comment><USER5> Dale Martin's "Inventing Superstition: From the Hippocratics to Christians" is an interesting book. In that book, Martin spends some time on what you call "circumstantial superstitions" esp in the first two chapters.</comment>


Engineering Culture in a Remote Team - <AUTHOR> https://howtoapp.io/engineering-culture-in-a-remote-team <comment><AUTHOR> I'm building a database of remote companies and planning to find out more about their development culture – I'll list some engineering topics and ask them to choose what fits with a quick description.

So far I've came up with the following:

\- Daily standups

\- Pair programming

\- Agile software development

\- Continuous delivery

\- Open source contributor

\- Good for junior devs

Would these be helpful to know? What else should I ask?</comment>