SSL and PHP Streams, Part 1 - <AUTHOR> http://www.docnet.nu/tech-portal/2014/06/26/ssl-and-php-streams-part-1-you-are-doing-it-wrongtm/C0

<comment><USER2> Personally if I was getting data from HTTP in PHP the last thing I would ever do is use file_get_contents. Just because you can doesn't mean you should.

It's generally advised to set allow_url_include to off which would make this code not work. Also if you're mention curl in your technical article about code you should ask yourself why your code isn't using the curl integration in the language you're using.

Putting a "You are doing it wrong" in your title is just asking for people to point out everything that is wrong with it.

<comment><USER3> >Personally if I was getting data from HTTP in PHP the last thing I would ever do is use file_get_contents. Just because you can doesn't mean you should.

Why not? file_get_contents makes things much simpler, and there's nothing really wrong with it. Fetching a JSON file is simple, for example:

      $file = file_get_contents("http://example.com/some.json");
      if ($file === FALSE) {
        die("Failed to get JSON file");
      }
      $data = json_decode($file);
      if ($data === NULL) {
        die("Failed to decode JSON");
      }
      echo htmlspecialchars($data->foo->bar);

To be honest, I think cURL is unnecessary in most cases. PHP's HTTP streams do a better job without relying on an additional extension (HTTP streams are in the PHP core, while cURL must be built separately and often installed separately), and the HTTP stream context options with their string key names are much nicer than the dreaded CURLOPT_* constants.

<comment><USER2> Why not?

1) The name of the function is file_get_contents, however you're not getting a file. It just annoys me, it reads wrong. stream_get_contents is better but I still wouldn't go reaching for streams for HTTP requests. 2) It provides you with a lack of control. 3) It's pretty sloppy, to do anything like POST requests with bodies you have to do hacky stuff.

I wouldn't be writing my own curl call request either I would use a library such as Guzzle.

<comment><USER3> >1) The name of the function is file_get_contents, however you're not getting a file.

No, you are getting a file. It's from a remote location, but it's a file nonetheless. Are ftp:// resources not files? Are ssh:// resources not files?

>2) It provides you with a lack of control.

Does it? Stream context options give you a degree of control. If file_get_contents isn't quite right for you, there's also fopen.

>3) It's pretty sloppy, to do anything like POST requests with bodies you have to do hacky stuff.

      $ctx = stream_context_create([
        'http' => [
          'method' => 'POST',
          'header' => 'Content-type: application/x-www-form-urlencoded',
          'content' => $some_post_data_here
        ]
      ]);
      $result = file_get_contents('http://example.com/post_endpoint', false, $ctx);

Where's the hacky stuff?

It's also shorter and more readable than the equivalent in cURL (the PHP cURL extension, not the command-line, obviously) and you don't even need to install an extension!

<comment><USER2> > No, you are getting a file. It's from a remote location, but it's a file > nonetheless. Are ftp:// resources not files? Are ssh:// resources not files?

FTP of course it's a file, it's a FILE TRANSFER PROTOCOL. HTTP is HYPERTEXT TRANSFER PROTOCOL. You're getting Hypertext. SSH:// are not files. You are getting the contents of a stream. So you're getting the stream content.

> Does it? Stream context options give you a degree of control. If > file_get_contents isn't quite right for you, there's also fopen.

To be fair I've not looked into all the options for the streams in http. But does it give you the option to use global dns cache? How about save the cookies and reuse them for later requests? Will it deal with gzip for me? If you can do all the stuff curl can do I'll be all fair enough you've got a point.

> Where's the hacky stuff?

For me the fact I had to define the header.

> It's also shorter and more readable than the equivalent in cURL

It's not more readable. It says it's getting a file, you lied to me and got stream contents instead.

> and you don't even need to install an extension!

If you really don't want to install extensions and just use the core language fair enough, I would rather use the best tools available.

<comment><USER3> >HTTP is HYPERTEXT TRANSFER PROTOCOL. You're getting Hypertext.

The responses HTTP gives are very file-like. So much so HTTP is often used for distributing _files_. Indeed, most pages reference several _files_.

> But does it give you the option to use global dns cache?

I don't believe so. I don't think most users need to, however.

> How about save the cookies and reuse them for later requests?

I can't actually remember. Possibly.

> Will it deal with gzip for me?

Yes.

> If you can do all the stuff curl can do I'll be all fair enough you've got a > point.

It can do _most_ of the stuff cURL does. It doesn't do everything, but my point is most of the time you don't necessarily need cURL, and IMO this API is nicer.

> For me the fact I had to define the header.

That's not hacky at all; sending POST requests usually requires specifying a Content-Type. cURL just automatically does that for you in some cases.

> It's not more readable. It says it's getting a file, you lied to me and got > stream contents instead.

You did get a file. The file the request returned.

> If you really don't want to install extensions and just use the core > language fair enough, I would rather use the best tools available.

You might be missing my point.

</comment></comment></comment></comment></comment></comment><comment><USER4> It by default _doesn 't_ try to verify the certificate of the peer it's connecting to? Isn't that the whole point of introducing TLS support?

Pardon me if I'm missing something, but that sounds like a horrible design decision, and anyone who tries to use TLS streams without reading the documentation is fooled into a false sense of security.

<comment><USER5> The article is somewhat out of date, the default is now to verify (though you can turn it off if you need to). A lot is changing with PHP, and people aren't keeping up.

<comment><USER2> I love how this article was written today and is already out of date.

<comment><AUTHOR> I did quite clearly state, this information applies to PHP versions _before_ 5.6 (which means that in practice, people need to be doing this for at least the next two years until 5.6 is widely adopted)...

The next article will cover the changes in 5.6 and why you don't need to set those ctx opts any more (and a few more you might want to set instead)

</comment></comment></comment></comment><comment><USER6> Wow, that is terrible. I'm not even talking about the shitty defaults, but look at the code to make it "secure". String-based programming and all of the underlying OpenSSL crap just spills up to the API.

No one should be using that, if only because with the _magic strings_ everywhere it is not guaranteed to blow up when there are breaking changes.

<comment><USER3> >String-based programming

Are we talking about the same language? This is PHP, not Tcl.

>all of the underlying OpenSSL crap just spills up to the API.

None of it does. I mean, there's an extension for OpenSSL, but that's not what's 'spilling up'. What's happening is there were poor defaults, so people have to change them. Luckily, PHP 5.6 fixes this.

>No one should be using that, if only because with the magic strings everywhere it is not guaranteed to blow up when there are breaking changes.

"Magic strings"? Are you seriously trying to compare using string names for keys to specify options (standard practise in many languages) with magic numbers?

</comment></comment><comment><USER7> Ha no way, I'm sure I had a job interview with these guys. Cool to see some Manchester based tech on front-page HN.

</comment><comment><USER8> PHP - Part 1: You Are Doing It Wrong

</comment><comment><USER9> Innovative Titles - You are doing it wrong.</comment>


Startup Valuations: Why They Don't Seem to Make Sense and How to Increase Yours - <AUTHOR> https://www.atrium.co/blog/startup-valuations/ <comment><AUTHOR> Hello HN! One thing early stage founders always ask is what the "fair" valuation is for their startup.

After years of doing this, the truth is that early stage valuations are more about negotiation, what's market for other startups and what ownership percentage your investors want to achieve than they are about your business.

Once you realize they are fake, you realize the way to drive valuation is only to create a competitive market for your startups equity, by getting many investors to the table.

<comment><USER2> What this article did really well is explain how the size of a round is tied to its valuation. I often hear people wonder why a company raised so much or so little, whereas in reality, it was not their choice - how much they raised was dictated by what they were valued at and the ownership percentage the VC was targeting (which does vary, but like Augie said it's often in the 15-30% range).

What I wonder is if the pro rata rights play a role as well. When 30-40% of a later stage round is reserved for existing investors, will that have a positive or a negative impact on the valuation?

<comment><USER3> I think there's also some anchoring bias that happens with easy mental math calculations like 20 on 80, or 40 on 360, since the financial fundamentals don't matter at the earliest stage companies.</comment></comment></comment>


Ambient AI Is About to Devour the Software Industry - <AUTHOR> https://www.technologyreview.com/the-download/609635/ambient-ai-is-about-to-devour-the-software-industry/ <comment><USER2> Is anyone else clear on what this article is saying? Being able to call AWS services from a cloud based IDE is going to "Devour the Software Industry"?

<comment><USER3> It appears to be saying that because you can put an IDE in the cloud, it will use some kind of machine learning to write programs for you or something.

Honestly, this article reads like it was written by a buzzword fed Markov chain.</comment></comment>


MIPS goes to Pluto - <AUTHOR> http://blog.imgtec.com/mips-processors/mips-goes-to-pluto

<comment><USER2> Neat! I made a battery powered hand-held computer using IDT's MIPS R3041 long ago (1996 or so). It was nice because you could use gcc to cross-compile for it in Linux. My computer also used a Xilinx FPGA. The CPU was not particularly low power, but the FPGA was pretty good. So the CPU was powered off between key-presses- each time you hit a key it went through the entire reset process. I discovered that the external crystal oscillator also used a lot of power, so had to be powered off also.

Anyway, I'm curious what they use for glue logic on New Horizons. I certainly would not use an FPGA: too SEU sensitive.

<comment><USER3> Actel and Xilinx rad hard antifuse FPGAs are standard on space missions. Most LEON processors flying are soft cores on FPGAs.</comment></comment>


Ask Edward Tufte: Moderating internet forums: What's smart, not what's new - <AUTHOR> http://www.edwardtufte.com/bboard/q-and-a-fetch-msg?msg_id=0000fT <comment><USER2> Looking around on Edward Tufte's site, I was a bit surprised to find pixel fonts with hideous kerning on his front page: <http://www.edwardtufte.com/tufte/index>

(I'm talking about the captions on the smaller images below the motion blur dog; they basically read as "16 new pr ints by ed ward t ufte", etc.)

I'm not suggesting Tufte is a bad designer for having a couple of ugly captions, or anything like that (presumably he has someone else doing the actual Photoshop work for stuff like this). Rather my point is simply that when the expectations are very high -- he has a NYT quote on that same page calling him "the Leonardo da Vinci of data" -- this kind of tiny detail leaps out because poor typography is an example of how design mistakes can make it more difficult to convey information.

</comment><comment><USER3> "Philip Greenspun constructed a filter at photo.net which bounced all those who misspelled the word "aperture," on the grounds that they did not know much about photography."

Bouncing someone for a single typo, or maybe because English isn't their first language, seems a little extreme.

<comment><USER4> Yeah, but I think it may be useful to collect such metrics (and e.g. get it to cost karma).

For the record, English is not my first language and I do make mistakes, but I strive to write correctly.

<comment><USER3> Sure, I was even going to suggest something like that. A "cumulative bozo filter" basically.

</comment></comment></comment><comment><USER5> Notwithstanding his eminence, someone snarkily commenting on other people's misuse of "it's" should not be misusing "myself" non-reflexively.

Viz. _Five people are involved in the part-time (very part-time) management of this forum: Dariane Hunt (web designer), Elaine Morse (my design assistant), David Rodriguez (programmer), a very wise anonymous external reviewer, and myself._

</comment><comment><USER6> I don't think it is entirely wrong to be harsh on comments. What Tufte is trying to achieve is value on his site. Every comment that do not provide value is then removed.

The alternative option can give a worse signal-to-noise ratio. Bad signal-to- noise ratio will make all intelligent beings with little time on hand go to other places, because wading through all the noise is too expensive. In that respect, it might be worth being harsh on comments to keep certain commentors on the site.

I don't see it as censorship. You are free to make your own blog post condemning the view, start a comment-stream, use well-argued points, etcetera. In fact if the discussion is so vastly different it would probably be better served as a post of its own, laid out with good argumentation.

</comment><comment><USER7> His approach verges on being arrogant and probably only works when you already have fanatic followers.

<comment><USER8> which follows along with pg's observation nicely: don't implement controls until they're necessary.

</comment></comment><comment><USER9> Just because the guy's everyone's favorite visual information guy, why would we rely on his opinion for user interface? Especially social interaction?

His "better" iPhone interface was godawful.

This post on forums is also totally missing the point.

I see somebody already re-submitted Clay Shirky's _good_ , thoughtful essay on the subject (Clay Shirky: A Group Is Its Own Worst Enemy).

I wouldn't waste your time on this one. Read that one instead.</comment>


Surprise: these SXSW Twitter Visualizations are pure JavaScript (Flash-free) - <AUTHOR> http://pepsicozeitgeist.com/popular

<comment><USER2> Just because you can doesn't mean you should. Those are not good visualizations. The first one gave no indication of whether or not it could be used or clicked. What do the colors mean, does size matter? Something just scrolled off the screen, what does that mean? The one with bars is even more overwhelming and confusing to a user. Too many colors, no clue about interaction.

</comment><comment><USER3> Impressive and definitely influenced by Amy Hoy's Twistori

<http://twistori.com/>

<comment><USER4> Influenced, and created by :D (Both Twitstori, and this site made by Amy Hoy and Thomas Fuchs.

<comment><USER3> Thanks. I need to work on my sleep deficit.

</comment></comment></comment><comment><USER5> They certainly _feel_ like Javascript. Partly that's a good thing (I can highlight text), partly it's a bad thing (lots of rough edges).

It's still a great example of how powerful JavaScript can be when used well.

</comment><comment><USER6> I wasn't surprised ... if it was Flash, there'd be annoying music

</comment><comment><USER7> What a terrible URI!

</comment><comment><USER8> it eats quite a lot of CPU :)</comment>


Four rules for effective collaboration – Guidelines for better commits - <AUTHOR> https://github.com/salemove/github-review-helper/blob/master/doc/rules.md <comment><USER2> So you say to me rule 2 for effective collaboration is answering those 5 questions :

Why is this change necessary? What assumptions is it based on? Were any alternative solutions considered? Why was this solution chosen from among the alternatives? Are there any non-obvious implications that this change has?

But none of the proposed rules actually answer those 5 questions in their explanation.

<comment><USER3> Also then you get people writing their life time stories in commit messages instead of writing code, good luck with velocity.

<comment><AUTHOR> Thinking that providing additional context for commits is a waste of time is short-sighted. Yes, it requires more time and effort in the short-term (i.e. for creating the commit), but if it's a complex, long-lived project, then that extra effort will save a lot of time in the long run.

Sometimes the extra time and effort is already made up for in the review process, which without proper context could drag out and cause a lot of back and forth. Sometimes it might save somebody hours and days of investigation time. This is not to mention the benefits that both the author and the readers of the commit get by better understanding both the problem and the solution.

<comment><USER3> People are bad at finding out what is important and what is not. Most of the time I have to cut through not relevant stuff that others thought would be important for fixing some issue. Lot more than some insightful commit saved my day, but maybe that is just my environment.

Anyway good luck fixing anything trusting commit messages from long time ago. Code is truth and if you won't investigate you still don't know how it works.

</comment></comment></comment></comment><comment> purple-again Four rules for how to effectively collaborate with me and people that agree with me.

One rule for how to effectively collaborate - talk to the people you are trying to collaborate with about expectations and then follow them. Try to remember along the way that you are all human.

<comment><USER4> On the other hand, using this as a baseline and evolve from there will save a lot of time. I mean git conventions are starting to sound a bit like tabs vs spaces, just with a lot more options.

Pick a standard example, go with that, evolve. Same with e.g. processes, pick e.g. scrum, do it by the book at first, evolve.

I've started at half a dozen projects and every time a huge amount of time is being spent (wasted) on reinventing the wheel, be it processes, version control, code style, etc.

</comment></comment><comment><USER3> Maybe get your ticketing system tied to repo and add reference ticket number form a system where whole context can be provided in a proper way.

"Every commit should be complete." and "Every commit should only do a single thing." and then make it in a way that someone could actually review changes. In most cases it is not possible, more often it is complete or does single thing.

<comment><USER5> In my experience these assertions are untrue. Also the tickets are often the over arching context and will have nothing to do with the code. My product owner doesn't care if I had to try three different algorithms till I got it right; but my colleagues and my future self sure would love to see that and all the stack overflow links during a git bisect!

Not only that but the ticket is a full feature. Maybe it took 5 commits to get there: "Fix bad indenting", "Extract base logic to command object", "Update I18N entries", "Add missing tests for current behavior", "Add the feature asked for".

<comment><USER3> From what I see you just agree with my comment. Those 5 commits you described as example are the way I would do it.

The way it is described in article would make you do it in one commit and add information that would be in the ticket.

<comment><AUTHOR> What makes you say that? The _Focused_ rule from the article is also meant to persuade you to split the work into similarly concise and _focused_ commits.

<comment><USER3> Focused and complete are opposite. You can have focused commits or complete commits.

</comment></comment></comment></comment></comment><comment><USER6> All of these are prescriptions for establishing a narrative for your commits.

First you must convince people that the obviousness of their commits decays rapidly. What was obvious ten commits ago will be completely opaque three hundred commits from now.

Then you must convince them that the descriptions of the commits are often instrumental in fixing bugs without introducing regressions.

And to do both of these you must convince them that this code will survive for a long time. Everyone behaves like they won't be here for the consequences or like they can "fix it later". One of those tomorrows never comes.

</comment><comment><USER7> It's a bit baffling that git.git suggests using 7-characters commit abbreviations, when they already have collisions for them:

      $ git log --oneline | cut -c 1-7 | sort | uniq -c | grep -v ' 1 '
            2 1536dd9
            2 191f241
            2 2e6e3e8
            2 3b130ad
            2 d53a350

<comment><USER4> 7 characters should be enough for most repos, and iirc git can deal with collisions already (so git co 1536dd9 in your example would bring a prompt).

How many commits is the repo you're running this on btw?

<comment><USER8> Sure. And randomly generated UUIDs should not conflict... unless they do, and blow up a huge app in production. Yes, I have experienced that once.

<comment><USER9> the odds of truly randomly generated UUID's conflicting are .... really really low (see [https://en.wikipedia.org/wiki/Universally_unique_identifier#...](https://en.wikipedia.org/wiki/Universally_unique_identifier#Collisions)). If you had a collision, then the odds are truly opposed to anyone else ever having that problem in the foreseeable future, so thanks for taking the hit for the rest of us!

</comment></comment></comment></comment><comment><USER10> This should be retitled: Reasons Why The CL is Flawed.

Long to short, why can't this be a form of some sort? Engineers / developers have enough to worry about, why add more minutia to the pile?

The CL is not an adequate OSFA solution. If quality and quantity is a concern, when is that going to be addressed?

<comment><USER7> What's CL?

<comment><USER11> Commit log

</comment></comment></comment><comment><USER12> I used to work with people who didn't comment their commits at all. The company went belly up</comment>


Show HN: Heatmap of the Most Instagrammed Cities in the World - <AUTHOR> https://kndrck.co/posts/visualizing_the_worlds_most_instagrammed_cities/ <comment><USER2> looks cool but dangerously close to [https://xkcd.com/1138/](https://xkcd.com/1138/)</comment>


Breaking the 1000ms Time to Glass Mobile Barrier [presentation/video] - <AUTHOR> http://www.youtube.com/watch?v=Il4swGfTOSM

<comment><AUTHOR> This is a talk by Ilya Grigorik of Google's Make The Web Fast team, presenting a lot of hard data about the negative effects of slow loading web pages, the mechanics of downloading and rendering pages, which parts of those mechanics can cause significant delays (particularly on mobile networks), and practical techniques to mitigate these.

It's somewhat focussed on US carriers and 3G/4G networks in places, but probably relevant to anyone working on a web app and particularly on a web app with a significant mobile-user market.</comment>


Google Reader is Already Gone - <AUTHOR> http://www.google.com/intl/en/about/products/

<comment><AUTHOR> Noticed that it dropped off the "More" dropdown, and doesn't even show up under "even more".

You can still get there directly, however: <http://www.google.com/reader></comment>


Top 10 Lessons from the Dot Com Meltdown - <AUTHOR> http://www.businessplanarchive.org/whatwecanlearn/tenlessons.html <comment><USER2> good reading right up to the last point ...

 _'... we need better predictive tools to plot the speed at which new technologies will spread. Spreadsheet gymnastics by 20-something b-school graduates should not dictate our investment decisions. We can produce better predictions. We have the data - from decades of technology innovation. We have the ability to analyze the data - after all, Everett Rogers wrote "Diffusion of Innovations" 40 years ago ...'_ [0]

Baloney.

When will these analysts get it into their heads you cannot predict with certainty by looking into the past figures. If this was the case there would be a lot more people making a killing on the markets, insurance companies would be rolling in dollars because they could reliably predict disasters et., al.

As for the solution or alternative I just don't know. Maybe closely observing select influences in a Gladwellian sort of way [1]. Maybe something the way O`Reilly keeps an eye on the Alpha Geeks to guide what trends are worth investigating. [2]

Reference

[0] business plan archive, 'Top Ten Lessons from the Dot Com Meltdown, 10) Prediction tools must improve', Ibid.

[1] Malcom Gladwell describes one such way you can make rapid decisions by gathering less information on a subject and focusing on a few key indicators. ~ <http://www.gladwell.com/blink>

[2] Tim O`Reilly may well have read Gladwells book because seems to (publicly anyway) pay close attention to "the alpha geeks" in the hope of understanding gaps, opportunities and future directions in the tech market. ~ <http://www.itconversations.com/shows/detail197.html>

</comment><comment><USER3> Free is folly? Google's gmail seems to be working out fine. And in fact, YouTube seems to be working out fine (or at least Google thought so enough to buy it), too. Free is only bad if you didn't think your plan through, I think.</comment>


Boron arsenide crystals can dissipate the heat generated in electronic devices - <AUTHOR> https://cacm.acm.org/news/229534-crystals-could-cool-down-your-future-electronic-devices/fulltext <comment><USER4> "In the future, further studies which will enhance the growth of the crystal, as well as explore potential large-scale applications"

Hinting at awesome GPU cooling and such, with not one mention of the materials exceptional hazard.

Boron Arsenide

GHS Hazard Statements

H301 + H331 - Toxic if swallowed or if inhaled

H410 - Very toxic to aquatic life with long lasting effects. Safety Precautions

P261 - Avoid breathing dust

P273 - Avoid release to the environment

P301 + P310 - If swallowed: Immediately call a Poison Center or doctor/physician

P311 - Call a Poison Center or doctor/ physician

P501 - Dispose of contents/ container to an approved waste disposal plant.

[https://www.azom.com/article.aspx?ArticleID=8425](https://www.azom.com/article.aspx?ArticleID=8425)

<comment><USER5> This material is hardly exceptionally dangerous. Its close cousin Gallium Arsenide has been nearly the exclusive source of Yellow, Red, and Infrared LED's since the 70's. The screen you're looking at now would not exist without arsenide compounds, both for lights and for other circuit components.

While you could probably make yourself sick by taking old chips of this nature, grinding them up, and inhaling or eating them, or engaging in an accident with their raw materials during their manufacture, they rank pretty low on the list in terms of practical toxicity. Arsenic is a common trace element, and even (in small quantities) has been used to ward off disease in chicken and cattle.

It's not good for you, but this is a positive development, not a poisonous watershed.

<comment><USER4> If not limited to trace amounts for microscopic components, in the heat spreading role there could be demand for it in much greater quantity than elementally similar LED pigments.

Most manufacturing materials do not require such careful treatment and disposable -thankfully. The concern is not just about unusual behavior such as 'grinding up and eating'. This is a particularly hazardous material - <USER2> documented.

<comment><USER6> You're exaggerating how dangerous BAs would be in this situation. As far as I know, useful single crystal boron arsenide is very expensive to make in industrial quantities and it's too brittle to be used as a large heatsink - <USER3> best you can grow a several micron thick layer of it on a semi-flexible substrate like for solar panels. Instead, I'm guessing their design uses small quantities of single crystal BAs to interface between the wafer and the rest of the chip package so it would better transfer heat from the internal silicon to a regular heatsink. Thermal conductivity at that interface is a hard limit to how fast the heatsink can draw heat from the chip package and since its contained, toxicity is largely a concern for recycling.

<comment><USER4> Its a concern for manufacturing, containment and disposal. In few places public disposal and recycling facilities guarantee complete compliance. The materials hazard specs are not exaggerated, they are intended to be taken seriously as they are stated.

"Instead, I'm guessing their design..." There were no designs indicated here, only research on the crystals thermal properties with the vague mention of "electronic cooling" and "potential large-scale applications"

<comment><USER7> Absolutely, arsenic-containing materials have the potential to be extremely dangerous. Unscrupulous GaAs manufacturers have put their employees at risk in the past.

[0]: [https://www.eastbayexpress.com/oakland/the-axt- way/Content?o...](https://www.eastbayexpress.com/oakland/the-axt- way/Content?oid=1073304)

</comment></comment></comment></comment></comment></comment><comment><USER8> The original article and the "full" article don't actually list any numbers. Looks like the performance is 1000 ± 90 W/m/K [0]

For comparison, a traditional high-end thermal paste may have 10 W/m/K, a liquid-metal thermal paste is up to 73 W/m/k [1]. Copper is 385, Aluminum is 200, Diamond is 1000.

[0] [http://science.sciencemag.org/content/early/2018/07/03/scien...](http://science.sciencemag.org/content/early/2018/07/03/science.aat8982) [1] [http://forum.notebookreview.com/threads/liquid-metal- showdow...](http://forum.notebookreview.com/threads/liquid-metal-showdown- thermal-grizzly-conductonaut-vs-cool-laboratory-liquid-ultra-pro.791489/) [2] [http://hyperphysics.phy- astr.gsu.edu/hbase/Tables/thrcn.html](http://hyperphysics.phy- astr.gsu.edu/hbase/Tables/thrcn.html)

<comment><USER9> > Diamond is 1000.

The paper itself gives diamond as 2200 and isotopically pure diamond has even higher conductivity.

The question is whether it's any easier to manufacture than a diamond layer. Edit: The paper claims as much.

</comment></comment><comment><USER10> There are interesting non-metallic materials already in large-scale production which serve as excellent heat sinks and pipes. As an example, pyrolytic graphite has a thermal conductivity several times greater than that of Cu: [https://www.mouser.com/m_new/panasonic/panasonicthermalgraph...](https://www.mouser.com/m_new/panasonic/panasonicthermalgraphite/)

<comment><USER9> Heat sinks and pipes don't matter all that much since you can simply increase the area to achieve higher conduction. The bottleneck is getting it from small chip hotspots to the heat spreader on top of the chip. So this would sit as a layer directly on top of the chip beneath the more conventional heat spreader.

</comment></comment><comment><USER11> So how would such crystals be used? Fairly large crystals as shims between the tiny silicon chip and a larger heat spreader? Or lots of microscopic crystals as part of a TIM paste?

</comment><comment><USER12> Does this mean we can now have fully 3-dimensional ICs? (I imagine with stacked layers of silicon crystal).</comment>


PubGrub: Next-Generation Version Solving - <AUTHOR> https://medium.com/@nex3/pubgrub-2fb6470504f <comment><USER2> Nix is the right way to build an OS; declare _everything_.

</comment><comment><USER3> This is really cool. It was a little dense for me, not knowing much about version solvers.

I'd love to see a comparison to other existing solvers - i.e: How much work does this take relative to npm's solver? Are the same version choices made, or do they differ?

<comment><USER4> npm trivially bypasses this problem by allowing multiple versions of the same package. Using the authors example, dropdown can use icons@2 and root can use icons@1 so there is no conflict nor any need for a fancy solver.

This solver would be useful if you wanted to use npm in a purely flat mode where only a single version of a package was allowed.

<comment><USER3> Ah, see, I don't know much about version solvers. :)

Would something like apt-get or yum be a better comparison, as they require only one version to be installed with a given name?</comment></comment></comment>


The future of schooling may lie with video games - <AUTHOR> http://www.economist.com/sciencetechnology/PrinterFriendly.cfm?story_id=14350149

<comment><USER2> Neal Stephenson offered a tantalizing look at where the potential for adaptive AI teaching lies with the Young Lady's Illustrated Primer in "The Diamond Age"

"A book that is powered by a computer so advanced it's almost magical, and it teaches children everything. It does this through a fully interactive story. It teaches you how to read, how to do maths, it teaches you morals, ethics, even self-defence."

[http://mssv.net/2006/05/01/the-young-ladys-illustrated- prime...](http://mssv.net/2006/05/01/the-young-ladys-illustrated-primer/)

<comment><USER3> Yes if we have a computer that could answer our questions as soon as they come up, that would be great. I mean to be able to instantly act on any curiosities.

Actually we are getting pretty close what with the internet and Google.

<comment><USER2> Google may be working on an ancestor of The Primer as we write this. OLPC + smart Google

</comment></comment></comment><comment><USER4> My two kids learned english (we are Mexican and live in Mexico) by playing videogames and watching cartoons. Although their mother and I both speak english, we never spoke to them in english and they never took any kind of english lessons.

They both started playing videogames when they were two years old. I found out that games like Super Mario 64 were more educational than most PC "educational" games. Finding the 100 coins in a Super Mario level turned out to be an excellent way to learn about numbers and counting.

A few months ago they started playing World of Warcraft and since then I've seen a great improvement in my youngest (11 years old) son's skill for written communication.

</comment><comment><USER5> As a finance professor I've thought about how to incorporate some of this thinking into my teaching. I do some, having my students implement trading strategies in a simulator that we learned in class, but at the university level it seems that everyone is better off if I cut the crap and just teach them what they want to know, "chalk and talk" style.

I realize this doesn't scale well, but on some level I'm paid to teach small groups not online masses so I don't think my students are paying for me to be an "adviser" or "facilitator".

I like classroom games for teaching economic concepts like comparative advantage, equilibrium interest rates, and the like, but it's not clear those concepts are what I should be devoting time to in introductory corporate. For International finance games seemed to be a better fit.

<comment><USER6> just out of curiosity, what do you think of the criticism that finance students tend to learn too much theory?

When I was doing a project for a hedge fund, I showed an MBA student my analysis (financial model + write up on a bank) and this is a person that also majored in finance at the college level and could not understand any of the work.

It was pretty interesting. I never knew there was such a divergence. I ended up teaching myself finance (liberal arts major) so I just learned by going to the library and pouring over finance and accounting books.

I actually tell a lot of people that if they are interested in doing real good analyst work they are probably better off majoring in accounting because the finance end is easier to pick up outside of school.

</comment></comment><comment><USER7> Hey, don't submit 'printer friendly' links, it robs the content provider of what teensy money they /can/ make from putting their stuff online.

<comment><AUTHOR> Thanks for the tip! I'll remember that from now on.

</comment></comment><comment><USER8> The effect of computer games on education is probably also tied to when the person is exposed to the particular games.

As a kid, my best friends and I spent ages playing every manner of strategy game out there, from Red Alert to Alpha Centauri. In retrospect, we've come to the conclusion that those games taught us invaluable lessons about what it takes to analyze new situations for optimum strategies, and how to balance competing demands of time, resources, attention, and effort in the pursuit of several related goals at once.

Of course, this doesn't apply so well for studying quantum mechanics, but for learning project management, it's amazing.

</comment><comment><USER9> There's probably a way to teach almost anything using a computer. The problem is in how to present this to the kids.

In school, computers are an afterthought, and aren't really part of the curriculum in any meaningful way (except those couple of classes on Word and Excel, which you do use).

In the best scenario, a teacher will seat the class in the computer lab, then tell them to do research on the web for a report for an hour. Usually though, a visit to the computer lab involves running some buggy "multimedia addon" that ships with the textbook. It is always of awful quality, and, if it runs at all, can be "explored" in about 5 minutes, with the kids wasting the rest of the time hiding a Flash game or YouTube from the teacher. Finally, since "this won't be on the test", most students don't care.

Here's what would work: a resource with voluntary participation. Something for interested students to explore on their own time. Yes, most kids would rather not do something that "feels like more work". I also know I would have enjoyed something like this at that age.

It doesn't even have to be a game in the classic sense. Usually trying to fit educational content in a game just feels fake and contrived, and the result is neither educational nor fun. Kids aren't dumb, and see right through that. In fact, different subjects may require different platforms.

This sounds like a great open-source project. A Wikipedia-style set of learning materials. Someone make this please :)

</comment><comment><USER3> The future is not necessarily just video games. If we can get education to be intrinsically motivated, rather than motivated with external stimuli like grades, then that would be so much more efficient.

Frankly I don't even think video games would work for all types of people, just as the current system doesn't work for all types of people.

As long as we can get people to have fun while learning, or learn the things they like, however they do it would be fine.

</comment><comment><USER8> Computer games can also improve your eyesight:

[http://www.newscientist.com/article/dn16857-shootemup- video-...](http://www.newscientist.com/article/dn16857-shootemup-video-games- may-be-good-for-eyesight.html)

</comment><comment><USER10> I haven't been this jealous of a High-School curriculum since one of my friends told me of his "School Without Walls" course. Keeping the boredom out of learning seems so pivotal.

</comment><comment><USER11> computer games , and educational software in general could make learning more fun , more personalized , and probably much more effective.

But , one of the most important things children learn in school is to concentrate on boring things , which is very usefull in most jobs.

So probably a balance should be kept between interesting, fun learning , and boring learning.

</comment><comment><USER12> Not really a game, but I recently started learning Italian through Rosetta Stone. The interactivity, and engagement makes it highly effective. When I was in school I took French, but I had a hard time picking up the language. I feel I know more Italian from the 3 lessons I've completed then I learned from an entire year in French. Sorry if my comment sounds like a commercial, these are just my honest feelings...</comment>


[NONSENSE ALERT] I-Team: 'Heartbleed virus' a confusing security threat - <AUTHOR> http://abclocal.go.com/wls/story?section=news%2Fiteam&id=9521428 <comment><USER2> I assume that by editorializing the title (which the HN guidelines ask you not to do), you want to communicate that this is a technically bad media piece?

There's a much better thing to do with bad media pieces: just don't post them to HN in the first place. There's nothing unusual or interesting about reporters or their interviewees flubbing technical details. So it isn't only the submission title that violates the HN guidelines; the story is off-topic too.</comment>


NewsDiffs: Tracking Online News Articles Over Time - <AUTHOR> http://www.newsdiffs.org/

<comment><USER2> I was working similar idea, but for laws. They also change quite a lot and not very well presented online.

I halted the development after I realized how complicated can word diffs get. I would be interested about techniques that you used. I it is quite good as it is, but I noticed some common problems, such as:

1\. Reusing letters from words that have nothing in common:

> fury over a [-hik-]{+n increas+}e in bus fares [1]

2\. Inserting few paragraphs into one word (first paragraph) [2]

3\. Loads of minor changes, also more of 1. [3]

[1] [http://newsdiffs.org/diff/263401/263432/www.nytimes.com/2013...](http://newsdiffs.org/diff/263401/263432/www.nytimes.com/2013/06/20/world/americas/brazil- protests.html)

[2] [http://newsdiffs.org/diff/265812/265841/www.washingtonpost.c...](http://newsdiffs.org/diff/265812/265841/www.washingtonpost.com/world/asia_pacific/taliban- want-sign-on-their-qatar-office-resurrected-threaten-to-scuttle- talks/2013/06/22/ca979502-db0a-11e2-b418-9dfa095e125d_story.html)

[3] [http://newsdiffs.org/diff/265776/265810/www.nytimes.com/2013...](http://newsdiffs.org/diff/265776/265810/www.nytimes.com/2013/06/23/world/asia/flooding- kills-hundreds-in-northern-india.html)

<comment><USER3> That's ok. There's enough value in elevating the awareness that these things change frequently and providing a change record for those interested in a specific article, that providing a neater/cleaner way of conveying the changes is forgiven. Anyone can figure out how to read the diffs once they sit down to do it, and it still requires a human to interpret the value of changes. A single word can simply be a correction or it can be a complete reversal.

If a better UI is developed later on, it can be retrofitted.

<comment><USER2> I agree, in this case MVP is very good strategy. But I was more interested in technical side. Making it more readable is always a good target to have.

</comment></comment></comment><comment><USER4> This is amazing. This sort of technology may not be sexy enough for TechCrunch, but it's going to be infinitely more valuable to posterity than photo filters. Historiography will continue to evolve at lightspeed for the next several decades, and I'm excited to see how this sort of accumulated data interacts with coming advances in machine learning.

</comment><comment><USER5> Could you add disqus or some comment system? Some of these diffs are really notable, and it'd be cool to discuss them.

</comment><comment><USER6> [https://diphur.com](https://diphur.com) does this really well.

</comment><comment><USER7> [http://www.newssniffer.co.uk/](http://www.newssniffer.co.uk/)

</comment><comment><USER8> this would be ace as userscript that automatically shows the history if you visit monitored sites

<comment><USER9> Agreed. Flaggin articles that have had significant revision in line would be cool.

</comment></comment><comment><USER10> Brilliant. That's all. I just wanted to drop a little well-deserved praise.

</comment><comment><USER11> Show the % of change, and if the title is changed for each change

</comment><comment><USER9> I love this idea but I think it would be made a lot better by having this information available on the news websites themselves with a browser plugin or something.

</comment><comment><USER12> (June 2012, FWIW.)</comment>


Why Apple doesn't just sue Google and get it over with - <AUTHOR> http://news.cnet.com/8301-13579_3-57493056-37/why-apple-doesnt-just-sue-google-and-get-it-over-with/

<comment><USER2> Why don't they just focus on making the best product and stop arguing about who stole from whom?</comment>


Show HN: Fiction Hub – the best place to publish and discover awesome fiction - <AUTHOR> https://fictionhub.io/about?src=ShowHackerNews <comment><USER2> First impressions: looks unfinished, needs serious design work. Looks deserted, no sense of community.

Reading tools are pretty useless: autoscrolling gets my eyes tired and the slowest speed is too fast for me. Also I don't think people use desktops/laptops to read books. Better to optimize for mobile.

Progress bar, daily wordcount and all that only annoy me as a writer. It's a creative process, sometimes I write 1000 words, sometimes 0, sometimes I delete 1000 words.

But before spending any time on extra features I think an interesting question to ask would be: if I were a writer why would I choose fictionhub to publish my stories? You want to attract writers first of all, how are you going to do it?

</comment><comment><AUTHOR> Hey, everyone! Fiction Hub is finally out of beta, and I would really love to know what you think!

I've completely rewrote the site, and added a marketplace for publishing and buying stories. I have also built some cool tools that will help writers to develop good habits and write regularly, and more convenient reading functionality for readers.

Also, it is now possible to publish screenplays using Fountain(example: [https://fictionhub.io/post/big-fish/](https://fictionhub.io/post/big-fish/))

Really looking forward to your feedback! =)</comment>


Productivize Issue #2 - <AUTHOR> Hey there! Happy Monday. Productivize issue #2 is out. Super excited for this issue!<p>I learned a lot from last week and made some improvements. Hope you like it and find value out of it: https://productivize.substack.com/p/productivize-issue-2 <comment><USER2> This is good! Brief, easy on the eyes, well-suited to the HN crowd. I subscribed despite being on an unsubscribe tear. Job well done.

<comment><AUTHOR> Thanks Tom. I appreciate your time and attention. I'm fairly new to newsletters. So learning and executing on the go. Stay tuned for more editions.</comment></comment>


US travel firm $4.5M ransom negotiation open chat - <AUTHOR> https://twitter.com/jc_stubbs/status/1289199296328298497 <comment><USER2> While these stories are becoming all too common I'd like to think that while we're in a golden age of being a ransomware payouts, it will lead to actually caring about security by many of the high-profile affected companies.

While the overall cost may be low for them, if they don't make meaningful changes to prevent these issues in the future, it's not hard to imagine it might add up quickly.

I don't support these attacks and some of the targets in particular are insidious, like hospitals where an attack could lead to an actual death toll, but it might actually be the kick in the ass many organizations need to actually care.

It's sad that it's come to this point but the end result may be better for everyone.

<comment><USER3> Nothing will change until they make it a felony to pay a ransom.

<comment><USER4> On what grounds would you make a monetary transfer like this illegal? Why a felony? What's the punishment? Who gets punished when a public company does it? You can't charge a company with a felony (usually). What about a private company? LLC? Sole proprietorship? What about my laptop, can I pay a $1000 ransom for that?

<comment><USER3> I guess same as violating economic sanctions since it is similarly funding a group that is by definition hostile to the US's economic interests.

</comment></comment></comment></comment><comment><USER5> For some context about CWT (I was curious about these figures) -- via Wikipedia[1]:

* US$1.5 billion in revenue * 18k employees

For a firm like this, the payment probably amounts to a small uptick in a small portion of their IT budget and won't even come close to hurting them (and, frankly, neither would the $10m figure).

It's insane that this is the case and that companies are willing & able to pay ransoms like this, but the hackers were right - the payment is much less than lost business, bad PR, etc. if the actual information had leaked. Such is where we are.

[1] [https://en.wikipedia.org/wiki/CWT_(company)](https://en.wikipedia.org/wiki/CWT_\(company\))

<comment><USER6> It might over time. If I was deploying ransomware, the first thing I would do after receiving a ransom payment from a company would be to try them again in a month or two.

<comment><USER7> And if you don't 'visit' them in a month or two, someone else like you will visit them. Now they know their security is crippled, there is no way the patched all holes (system, process, operations) in such a short notice, and we know they can be blackmailed and pay big money.

The only way to mitigate this risk is actually walk the walk (implement appropriate security controls).

</comment></comment></comment><comment><USER8> Whilst paying the ransom is often advisable in specific cases like these, it's absolutely a bad thing for society as a whole. Seeing successes like this will encourage organised crime to keep doing this, as they know there's gonna be a big reward. It's like the prisoners dilemma. If people didn't pay the ransom, there wouldn't be ransomware. But people don't take precautions, so they have to pay the ransom, leading to more ransomware... it's a vicious cycle

<comment><USER9> To be honest, just how bad of a thing is this? It's a direct financial punishment for a company with lax security practices. It encourages greater security practices.

The money is funnelled to a criminal group, but what difference does it make? Some people consider the USG to be a criminal group; many people are out on the streets for that. My tax dollars directly go to corrupt crooks and nonexistent companies claiming billions for nonexistent PPE.

As a member of society, I don't care if I'm paying a professional ransomware group, or a professional corruption gang.

<comment><USER10> > It's a direct financial punishment for a company with lax security > practices. It encourages greater security practices.

That argument could be used to justify any theft or even kidnapping.

I know many people who grew up in countries where kidnapping was a very real concern. Consequently, they had to adopt "greater security practices" and it had a very real, negative effect on their lives.

There are real harms to randomware. Companies go out of business, people lose their jobs, people lose their service providers, etc.

To say, "it serves them right for not following proper security" literally can be said for a mom/pop business in a poor neighborhood who didn't have bulletproof glass or bars on their windows. It is negating the fact that (a) the harms are very real and (b) security costs money and resources, which is effectively another tax on their business.

If instead the government made it illegal to pay such ransoms and actively audited large BTC transactions and charged people accordingly, then we could get rid of the incentives to do this in the first place.

The government should similarly hold firms accountable when they are hacked (due to the harms on consumers) and require prompt disclosure of any hacks.

There are ways to incentivize the preferred outcomes without supporting the active theft of property and destruction of someone's business.

<comment><USER11> In addition, the company isn't the only victim in a ransomware attack, its customers are too.

And does anyone really believe the hackers deleted the data off their own servers? They can easily double-dip by selling that information. It's valuable, so why would they delete it?

<comment><USER9> Double dipping ruins the reputation of the hackers and future income potential.

</comment></comment></comment></comment></comment><comment><USER12> Here's a link to (photos of an lcd screen of) more of the chat, does anyone know where to get the full transcript? Feels like it has to be available somewhere.

[https://www.reuters.com/article/us-cyber-cwt- ransom/payment-...](https://www.reuters.com/article/us-cyber-cwt- ransom/payment-sent-travel-giant-cwt-pays-4-5-million-ransom-to-cyber- criminals-idUSKCN24W25W)

</comment><comment><USER13> I found it interesting none of these sites actually provided the alleged bitcoin wallet address. I found it @ [https://www.blockchain.com/btc/address/13nmJ3SsNB5pSyQrmX3e6...](https://www.blockchain.com/btc/address/13nmJ3SsNB5pSyQrmX3e6zveY9kHGw8Vs3)

<comment><USER14> clicked through the transactions and found this wallet: [https://www.blockchain.com/btc/address/17A16QmavnUfCW11DAApi...](https://www.blockchain.com/btc/address/17A16QmavnUfCW11DAApiJxp7ARnxN5pGX)

a balance of 16m and over 1.4 trillon usd has passed through this account.

the oldest transaction i could find was 2019-11-02 14:19: [https://www.blockchain.com/btc/address/17A16QmavnUfCW11DAApi...](https://www.blockchain.com/btc/address/17A16QmavnUfCW11DAApiJxp7ARnxN5pGX?page=10001)

<comment><USER15> I would assume one address with 377k transactions that has seen over 131 million BTC move through it strongly implies it's some sort of tumbler address. I'm not sure why reusing one address like this would make any sense though...

<comment><USER16> It is more difficult to trace funds through a single node with gazillion transactions. This is part of the laundering scheme. Of course, all such addresses are immediately suspect, but if they pay out to innocent addresses too... It's difficult to distinguish between signal and noise.

<comment><USER17> Isn't that overcomplicating things though? If tracing is a concern, why not use Monero instead?

</comment></comment></comment></comment></comment><comment><USER18> This story is going to be used by every security consultant selling their services for a long, long time.

<comment><USER19> When I started my career I'd always hear old greybeards talk about "oh this one time.. some certain thing happened, and everyone learnt a lesson" and I feel like I just witnessed one of those come into existence

<comment><USER20> Don't be surprised if companies would rather roll the dice than pay whatever it costs to prevent the problem.

$4 million once times the risk of getting hit vs. the up-front and ongoing costs of dealing with an overly paranoid IT guy.

Tough call.

<comment><USER21> How many times would you need to do a security audit before this paid for itself?

<comment><USER22> A company of this size? Just 10 or 20 times I'm guessing, which really doesn't seem like a high multiple. This is why laws are required to correct the incentives here.

</comment></comment></comment></comment></comment><comment><USER23> Let this be a lesson to those that say bitcoin and other cryptocurrency has no real value outside of speculation.

This kind of attack would be almost impossible in the pre-bitcoin era. The difficulty of receiving that volume of money in that short of a period of time in a difficult to trace manner is a new thing.

We are entering a new era where crime can pay in very large sums with orders of magnitude less complexity.

Instead democratizing currency, we're democratizing large scale crime. Previously only large organized crime organizations could perform such an attack. Now, almost anyone can.

<comment><USER24> >Let this be a lesson to those that say bitcoin and other cryptocurrency has no real value outside of speculation.

>This kind of attack would be almost impossible in the pre-bitcoin era.... Instead democratizing currency, we're democratizing large scale crime.

Just wanted to make this same point - right now, cryptocurrency has _negative_ value for society. Perhaps this is a justification for banning the current implementations.

<comment><USER25> We need to make laws in western countries that paying off these kinds of ransoms is illegal. It gives money to criminal elements and only encourages this. I also thought it would be possible for powerful law enforcement groups to follow the bitcoins even through exchanges. Why does this not run into the worldwide hunt for the perpetrators?

<comment><USER26> It's theoretically possible for powerful state-level adversaries to follow bitcoins through tumblers and exchanges (If they operate the former). Also, at some point, you're going to have to be paying rent, so you'll need to turn your BTC into dollars or pezos or pieces of eight, and may need to explain to your friendly tax authorities how you can by 4.5 million USD worth of BTC.

In practice, though, it's not clear what exactly are the capabilities of each branch of law enforcement.

<comment><USER27> In a lot of jurisdictions, your friendly tax authorities won't ask or care; international fraud is a valuable source of foreign currency for many countries as long as you're reasonably discreet about it. Banks and payment processors can't afford to be nearly as blasé, because they're at far greater risk of facing international sanctions; Bitcoin provides an essential layer of obfuscation and deniability.

<comment><USER28> In the US for example, there's an actual field in your 1040 tax return for entering income from otherwise undeclared illegal businesses. Putting your drug or extortion money there and paying taxes is not admitting guilt and can't be used against you IIRC.

<comment><USER29> What does one gain by doing this? Is there a particular incentive apart from one's own principles?

<comment><USER30> Tax fraud is usually much more painful to suffer from instead of a simple drug charge or illegal gambling charge. If you get nicked on drug charges there will be parallel reconstruction to get you on tax fraud despite this "not happening" between US government branches.

<comment><USER28> I think you have it backwards. If you commit tax fraud, you will be prosecuted. And the FBI will work with the IRS to do this.

But, supposedly, putting a non-zero value in the "illegal income" field of the 1040 (which ISN'T fraud) both (1) can't be used as evidence against you in court, and (2) isn't reported by default to the IRS to the FBI or other law enforcement agencies, so you don't end up on any watch lists.

Of course you gotta take their word for part (2), but it is their incentive to get every tax dollar regardless of source.

<comment><USER30> No sorry, I agree with you. I mean if you _don 't_ declare your income THEN you get busted on the illegal activity, you are guaranteed to get busted twice.

<comment><USER28> Ah I misunderstood, sorry.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER31> It should be a criminal offense punishable by prison time for companies to pay for ransomware keys. While that might cause some businesses to fail in the short term, it would benefit society as a whole by eliminating the financial incentive for such attacks.

<comment><USER32> I'm curious, how do you feel about people paying ransom for traditional kidnappings? Same logic, or is it different?

<comment><USER31> In general paying off kidnappers is also a bad policy. However I see a huge difference between protecting human lives versus protecting corporate assets.

<comment><USER33> Reading "Never Split The Difference" \- sounds like the police will work with families pay off kidnappers is some countries, but get it down from millions to a token amount. I think he aims for zero though most of the time.

<comment><USER34> It seems to be a necessary part of the strategy though as the negotiation also helps to delay and buy time for escape/rescue.

<comment><USER33> They sometimes paid the amount. In some countries that was probably seen as a better plan. It probably depends how loose the cannons are.

</comment></comment></comment></comment></comment></comment><comment><USER35> Maybe I just don't understand either the ThreadReader or Reuters article, but I couldn't find a transcript of the chat linked anywhere? Does anyone else know where it is?

<comment><USER36> Click the images in the article (showed up as white boxes for me but clicking through worked)

</comment></comment><comment><USER37> This is basically an advertisement for a career in black hat hacking.

<comment><USER38> Or online money laundering.

</comment></comment><comment><USER39> Gotta love that they pitch this as a "service" they provide. The person talking to them must have been seething at having to treat them like "professionals" too.

<comment><USER40> Isn't that almost a cliche of organized crime? It's not enough to be rich, powerful, feared, people also have to pretend to like and respect you?

<comment><USER39> Haha possible. Haven't had much encounters with organized crime thus far thankfully

<comment><USER40> I mean, neither have I, but it definitely shows up in pop culture depictions of the mafia and drug lords and oligarchs and warlords.

</comment></comment></comment></comment><comment><USER41> So what's the current optimal solution, as far as precautionary measurements go - for these kinds of scenarios?

The more companies that shell out, the more it's going to happen / motivate these pirates to continue with such rackets.

<comment><USER42> Offsite offline backups. Redundant ones. This scenario is really no different than if your datacenter had a gas leak and blew up, particularly because you never will ever be able to prove the attacker didn't retain your data somewhere so all you can do is guarantee recovery. Of note in this case is that the thieves only stole 2TB of data - this is a trivial expense to orchestrate a manyfold backup regime for in near real time when the alternative is shelling out millions.

And its also about your threat model. If data leakage of any form threatens your business you need way more security than if you just want to be able to recover from exploits in your publicly facing infrastructure (or the ability for a rogue actor inside the company from sabotaging the business from the inside).

At the most extreme having physical separation of infrastructure with physical token based auth and multiple signature verification to interact with data is going to be a heavy price in diligence to maintain secrecy. At the lowest end having a redundant backup storage array with a cron job on all employee computers to versioned backup files every minute that doesn't have network signin access.

<comment><USER43> As long as the backed up data can't be infected.

</comment></comment></comment><comment><USER44> Garmin, now this, in one week. I beleive it is much easier to pull a trick like this with the help from the inside. If so, with malicious insider's incentives in a ballpark of hundreds of thousands we are doomed :(

<comment><USER45> And yet, these hacks tend to be done with some social engineering and no insider knowledge. Many companies aren't well protected, you don't need an insider to hack them.

<comment><USER44> I think this is just a beginning. Word is out you can extort millions with internet connection and some scripts, no guns and police chase involved. And it looks like chances of getting away with the money are quite high. Compare it with Getty III ransom story.

</comment></comment></comment><comment><USER46> What's amazing to me is that even though it stings, you get better "customer" service from these criminals than from e.g. Google.

<comment><USER47> If your account is worth a few million dollars you get a direct line to someone in Google.

</comment></comment><comment><USER48> We are truly in the age of rich data pirates. I dont see them becoming extinct any time soon with decent ROI like this.

I would be curious to learn the % of origins for most attacks.

[1] Incompetence by dumb employees

[2] Insider attacks

[3] Paid cybersecurity protection racket that take down strong systems with stolen tech

[4] Unskilled or understaffed security employees

<comment><USER49> The US needs to pass a Federal law making it _personally_ (not just "corporately") illegal to pay ransom. That would stop them because it would kill the market.

Historically it's how they stop kidnapping in countries where it's common. It REALLY sucks for the first few people after the law is passed, but after that things get better.

<comment><USER12> But wouldn't the payments just end up being passed through?

For example, one way to get around that is you could sign a contract with a foreign consultant firm for "security services", say for 1 year, and they would take your money, and pay a portion of it to the ransomware authors and profit on the rest.

<comment><USER50> Wouldn't that be extremely obvious though?

<comment><USER51> Not when it's done through several layers of employees and then potentially multiple layers of foreign companies.

It's very hard to find individuals to hold criminally liable for things like this. When was the last time you saw a CEO go to jail when their company killed someone?

</comment></comment></comment></comment></comment><comment><USER12> Based on other articles, it appears they didn't hire specialty ransomware consultants for the negotiation but still got a 55% discount. Wonder if they did, if they would have been able to get a better all-in cost.

</comment><comment><USER52> I've always been curious about the "on-ramp" here

How does a legit company purchase $4.5M of BitCoin in 24 hours?

I would assume using a "K&R" style broker but, without one of those how would you do it?

</comment><comment><USER53> Anyone know what exchange would allow them to purchase 4.5m of bitcoin on short notice? I wonder if anyone can find the ransom payment transaction in the block chain.

</comment><comment><USER54> Who's to say this isn't an internal job? Random developer that is unsatisfied with his job sees blatant security hole and exploits it himself for ransom.

Let the money sit in a Bitcoin wallet for a while. Maybe move it around a bit here and there and cash out a few years down the road. Good retirement egg.

</comment><comment><USER55> Another windows local admin/group/domain thing. When are IT departments going to take it off their networks? Why have LANs at all, for most back office work?

Immutable, versioned files in managed cloud storage eliminates the locker threat (not the disclosure one though).

<comment><USER56> When work for a big IT team at a company that's already invested a fortune in on-prem storage and your job depends on pre-cloud procedures, you keep your mouth closed and do what's asked of you. After all, if the company gets hacked, it's usually just the CISO that gets fired. Not you.

You made a very good point about Windows GPOs. The delivery mechanism for them vs. how macOS does it shows how dated of a paradigm they are. It's bringing back memories to me of importing ADMX templates, gpupdate.....

<comment><USER38> Scenario 1: Keep head down, company gets attacked, shrug shoulders.

Scenario 2: Sell solid security and backup principles to management, fighting annoying budget and corporate culture battles along the way. Company does not get attacked. Nobody notices.

Scenario 3: Quietly set up an immutable backup service with hourly backups for your enterprise without anyone really noticing. Company gets attacked. "Actually, we do have backups. We can just reformat all those Windows machines." Hero!

<comment><USER57> > backup service with hourly backups for your enterprise without anyone really > noticing

Well, except this is similar to #2 as it will likely stand out in the budget - especially the initial setup. IT being a cost centre has to fight for every penny in most non-IT-centric organizations.

Plus, the hackers will still threaten to release your corporate data (i.e. emails, client info) which would compel most companies to pay-up.

Bottom line: every company needs good backups, intrusion detection, and system hardening (with 3rd party review).

</comment></comment></comment></comment><comment><USER58> Wow. $4mil just like that.

<comment><USER59> But now you have $4 million in a bitcoin address linked to criminal activity. Then what? How much do you lose along the way to having laundered cash in hand?

<comment><USER60> Aren't there mixer services for that or just convert to monero? This is off an exchange so lots of shenanigans to make things less traceable. I am guessing these people know what they are doing.

<comment><USER61> I'd imagine the feds are involved at this point. They paid to get their data, but the feds have to be tracking the addresses from this juncture and examining the breach.

 _I hope._

<comment><USER60> I hope the hackers are caught too. But from bitcoin perspective, I am not sure how traceable things are if the hackers use mixing services or convert to actually anonymous currency such as monero. The main problem is converting untraceable bitcoin back to fiat, since most exchanges now follow KYC and will track bitcoin both before and after it touches the exchange.

<comment><USER62> > The main problem is converting untraceable bitcoin back to fiat

Got to imagine there's a well-established laundering system for just that

</comment></comment></comment></comment></comment></comment><comment><USER63> When I was running some IT for our startup we used FreeNAS with ZFS (and had off site, borg backups), from my understanding we could just get to the last snapshot for the (unencrypted) data? (sorry, no IT admin but developer ;-)

</comment><comment><USER64> I wonder if this is a good argument to use cloud service providers. I'm sure if someone got into your network they could probably delete everything from your corporate Google Drive/Microsoft Office accounts, but these big companies are more likely to be able to restore from backup than you are. Similarly, good managed cloud databases will have backup and restore options that are much easier than setting up immutable backup infrastructure for your company, which might encourage companies to back up more often.

</comment><comment><USER65> How about good offline back ups? Then you don't have to pay and hope you get your data back. Of course you still need to to figure out how they got in and lock it down so it doesn't happen again and there will be downtime as things are restored. However your are already down at that point so that doesn't really make a difference and by paying you are encouraging the behavior.

<comment><USER66> They don't just start encrypting stuff as soon as they have a foothold. They spend some time on your network siphoning out valuable data, compromise backups, and staging for re-entry.

</comment></comment><comment><USER67> This is a very recent event (ransom was only paid on 07/28).

They're not out of the woods yet. Whats the bet they get crypto locked again next week?

<comment><USER68> From what I read, the hackers always keep their words. Otherwise nobody will pay them next time.

<comment><USER69> This particular hacker. What's preventing another hacker group doing the same? The company is not able to fix all of the security issues immediately.

</comment></comment></comment><comment><USER70> As much as I hate seeing douchebag criminals get rich, I do like that they establish a financial Cost of poor security.

</comment><comment><USER71> Looks like Garmin also payed [https://www.bleepingcomputer.com/news/security/confirmed- gar...](https://www.bleepingcomputer.com/news/security/confirmed-garmin- received-decryptor-for-wastedlocker-ransomware/)

</comment><comment><USER72> I'm waiting for the "Ransomware Negotiator with min. 15+ years experience" jobs to show up.

</comment><comment><USER73> A lot of people here are asking the government to make payment of ransoms illegal. Makes sense to me, but can someone explain the potential downsides, and why it may not be as simple as it sounds (I'm sure it's not)?

</comment><comment><USER74> What is the total size of the backup software industry, compared to the total size of the security industry? Is backup software undervalued, if "offline backup" is the only known defense against ransomware?

</comment><comment><USER75> I constantly hear talk about Bitcoin not being completely anonymous, but it seems like these ransomware attacks are always requesting Bitcoin. How are they managing the Bitcoin so it's untraceable?

</comment><comment><USER76> Malta is Binance's location.

Malta enables Binance to enable users to "clean" approximately ~2 bitcoins/day per an account.

Binance has ~5 times the daily trading volume of the 2nd leading exchange.

</comment><comment><USER77> Why not pay the ransom, then track down the perpetrators for an uncomfortable private chat with hired paramilitary types?

There has to be a stick or these folk will keep demanding more carrots.

<comment><USER78> What spend another few million on an illegal adventure well outside their area of expertise? Great idea. Why not reintroduce blood feuds to the Toy manufacturing business too!

</comment></comment><comment><USER79> How about stop using Windows servers in enterprise environments???

</comment><comment><USER80> how did they get bitcoins that fast?

</comment><comment><USER81> They are probably now on a priority target list for other groups, since they do pay out.

So they have to get their security in order, or this is just the beginning of their problems.

</comment><comment><USER82> So could a state actor force enough miners to act in concert and conduct a 51% attack and steal the bitcoin back?

</comment><comment><USER83> What exactly do the EDR tools recommended by the attacker give you?

</comment><comment><USER84> Bitcoin turn to be ugly currency, the price will slump very soon.

</comment><comment><USER85> What are the chances this is a $4.5m transfer to North Korea?

<comment><USER86> Low. The hackers are likely European, since there are telltales like European number formatting ("10.000.000$") and awkward phrases like "make a step forward" (perhaps Italian _fare un passo avanti_?).

<comment><USER87> it seemed weird to me that the hacker's messages were right-justified, maybe from a country with RTL input method?

<comment><USER86> It's screencaps from one of those annoying in-browser support chat systems, where doing text-align: left for one side and text-align: right for the other is pretty common.</comment></comment></comment></comment>


Ask HN: Equity for first hire? - <AUTHOR>

A startup with four technical founders and a great deal of potential is in the process of closing series A at a $25-30 million valuation.<p>A potential first hire currently makes $190k. He would bring significant value and take a leadership role as an engineer. What's appropriate equity if he's making $115k pay? <comment><USER2> As a starting point, it may be helpful to think about the equity stake that would be required in order to offer the potential employee compensation equivalent to that which he currently receives.

To that end, I did a quick back-of-the-envelope-style calculation that you can find here: [https://docs.google.com/spreadsheet/ccc?key=0AgLVLMvTOJ8ldDl...](https://docs.google.com/spreadsheet/ccc?key=0AgLVLMvTOJ8ldDlsUWRucHlsZ3p3WVpmWlhBeERoWGc&hl=en_US)

In my model, I assumed that he would receive a 5% raise in salary each year at either job. I assumed an 8% discount rate for his current salary, a 12% discount rate for his salary at your company, and a 25% discount rate for his equity cashout, which I assumed he would receive at the end of year 7. I also assumed that the growth rate for your firm's valuation would be 20% in year 1 and would decrease at a constant rate of 2% per year.

Under these assumptions, an equity stake around about 4.5% would yield a $2.56 Million payment when he sells his stake at the end of year 7. The net present value (NPV) of this one-time payment would be equal to $536,302 today. Taken together with his salary payments, the NPV of his total compensation package in this scenario over 7 years would be equal to the $1.13 Million NPV of his salary payments from his current job.

You can download the spreadsheet and can play around with the various assumptions that I made. The greater the risk associated with a particular stream of cashflows, the higher the discount rate should be.

Adjustments to these assumptions can have a significant impact on the NPV of the payments. For example, if we set the discount rate for his salary payments at your company to 16% and the discount rate for his equity cashout to 30%, then the equivalent equity stake would be more like 6.64%.

If you are able to make some reasonably accurate discount rate assumptions and valuation growth assumptions, then you should be able to get a reasonably good % equity stake that would compensate him for the decrease in salary.

From there, you might consider adjusting the offered equity stake upward... the spreadsheet will give you the equity stake that would presumably make him indifferent between choosing to stay at his current job or joining your team - In order to persuade him to join you, you want to be able to make him a better offer than that which he currently has.

<comment><USER3> I'm loving this. Thanks for sharing!

</comment></comment><comment><USER2> Finally, I'd also like to note that, given the proximity of this hire to your series A funding, you may want to consider the tax implications involved in granting an equity stake to an employee.

If the company is valued at $30 million, then granting a new hire 10% of the stock in the company might be viewed as a taxable event by the IRS. In that case, your employee might find himself responsible for paying taxes on $3 million in income. You don't want to wind up with an employee who owes $750,000 to the IRS and can't pay it.

Consulting with a qualified attorney will be invaluable in structuring this transaction in order to avoid this sort of problem. With a valuation of $25-$30 million, you really must seek legal counsel in this matter before moving forward. With that much money on the line, you really can't afford NOT to have a good attorney on your side when you are putting together this deal.

 _Note: I am not a licensed attorney and this is not legal advice. Please seek the advice of qualified legal counsel._

</comment><comment><USER2> Also, you may want to consider including vesting provisions in the new hire's compensation agreement. [http://en.wikipedia.org/wiki/Vesting#Ownership_in_startup_co...](http://en.wikipedia.org/wiki/Vesting#Ownership_in_startup_companies)

If you decide to offer an 8% equity stake, then you might, for example, want a 2% stake to vest each year for 4 years.

<comment><USER3> Agreed. Always vest non founders. Don't get stuck with a non-preforming shareholder a few years from now.

<comment><USER4> You should vest founders too.

</comment></comment></comment><comment><USER4> Out of curiosity: didn't this issue come up when you were negotiating your series a ?

I was under the assumption that it's typical for a series a term sheet to create an employee options pool pre-investment (to avoid dilution of the VCs), which would therefore require you to have a plan for how much equity you plan to give employees.

<comment><AUTHOR> You're assuming I'm not the potential employee. :)

</comment></comment><comment><USER5> IMO the level of involvement in IP generation, in determining the business's direction, and the degree to which you need this specific person are more relevant to equity vs. treating it as direct compensation.</comment>


Gold Value in CPUs and Computer Chips - <AUTHOR> https://www.chipsetc.com/gold-value-in-computer-chips.html <comment><AUTHOR> List of gold quantity and value in some old CPUs : [http://www.ozcopper.com/computer-cpu-gold- yields/](http://www.ozcopper.com/computer-cpu-gold-yields/)

Interesting to see that the pure gold cost was often a significant percentage of the CPU's price!</comment>


The word "Hacker" - Negative to Positive - <AUTHOR>

3-4 years ago when I started programming right out of school, the word Hacker used to have a negative connotation. I always wanted to call myself that but people would say "Hackers are people that just hack things together and cannot build scalable solutions" and programmers are ones that build real solutions. Glad to see that is changing now. <p>I didn't agree then - I don't now. Do you ? <comment><USER2> Is it changing?

I think it still holds the same connotation (that's in the rare cases where hacker isn't already taken to mean someone who breaks into computers). Which is why I cringed when startup news changed to hacker news.

</comment><comment><USER3> I have a few definitions of hacker, and consider it a fairly nebulous word.

1\. Someone who has attained a level of mastery of the art of making a computer do what you want.

2\. Someone who loves doing (1), even if they aren't a "master"

3\. A programmer who tends to use creative solutions with little regard for convention. This can sometimes be negative.

My definition of programmer is:

1\. Someone who writes computer programs

</comment><comment><USER4> I essentially agree with them.

Programmers are people who know what they're doing, like janitors.

Hackers are people who don't know what they're doing and are trying to figure things out, like scientists.

Code that shows you didn't know what you were doing is a hack.

Code that shows an innovative way to do something is a cool hack.

</comment><comment><USER5> I never call someone a "hacker" because people have such strong opinions about it. If you use it in a community where people aren't as progressive about it then you just look silly.

</comment><comment><USER6> the interpretation of words depend on each generation's intention. Hacker seems more aggressive and progressive for today's frontier; programmer seems old school...</comment>


Safari url bar crashes - <AUTHOR> Is anyone experiencing the same crash when clicking url bar in Safari? <comment><USER2> Fine for me (9.0.3 on OS X 10.11.3).

It's sometimes very slow (3-5 second lag) to focus the URL bar or open a new tab. The latter I think is related to process-per-tab forking. The former is just bizarre.

Safari became very sluggish ever since Yosemite and it's a shame it wasn't fixed in El Capitan. I can only suggest using another browser at this point. Safari hasn't gone under any testing at Apple for some time or these issues surely would have been noticed.

Edit: This may be because I have Search Suggestions turned off in the Search Preferences: [http://www.theverge.com/2016/1/27/10839758/apple-safari- cras...](http://www.theverge.com/2016/1/27/10839758/apple-safari-crash-search- suggestions)

<comment><USER3> When Safari gets sluggish for me, I go to Activity Monitor and kill any Safari processes with more than 1GB of memory. Usually cures the sluggishness.

</comment></comment><comment><USER4> I started seeing this today (iOS 9.2.1). My workaround is to use private browsing mode.</comment>


Show HN: Wireframe – A Simple PHP Framework with Routing and Templating - <AUTHOR> https://github.com/tbirrell/wireframe <comment><USER2> I chuckled when I expected simplicity and get smacked with a ton of process and dependencies that could be (and would be) thrown away. If someone wants to use these, they will include them.

Bootstrap Sass Bower NPM and Gulp

</comment><comment><USER3> Here is some of my comments:

Don't hardcode error levels like you do in your bootstrap file (wireframe.php)

        ini_set('display_errors', 1);

I am not a fan of setting title from some HTML comments, I can't really understand why you would do this when writing a PHP framework, as you wouldn't be able to make dynamic titles.

While nothing wrong with this code as such:

        if (file_exists($file)) {
          return true;
        } else {
          return false;
        }

It is unnecessary to explicitly return true or false,

        return file_exists($file);

Would have done the same...

Lastly I really think that you should consider using PSR-4 style autoloading for your internal classes, I see no point in not doing it.

<comment><AUTHOR> Thanks for the feedback! I am unfamiliar with PSR-4, I'll have to give it a look.

</comment></comment><comment><AUTHOR> I recently wrote Wireframe to practice with PHP and get a better understanding of how frameworks function. It's not intended to solve any problems that other frameworks don't already solve, though it does serve a practical purpose for me personally.

As this is my first attempt (well, version 2 of my first attempt), I welcome any feedback, critique, or pointers to where I can improve.</comment>


Game designers:  Do you avoid making gameplay changes after release? - <AUTHOR>

This seems like a hard thing to do, since you always want to improve the gameplay.<p>Yet making any gameplay changes is likely to upset your users, as their previous scores would not be comparable to those with the new gameplay. <comment><USER2> Rebalancing, ala StarCraft 2?</comment>


Android job openings overtake iPhone for first time - <AUTHOR> http://www.pcworld.com/businesscenter/article/221384/android_skills_outshine_iphone_expertise_in_developer_hiring.html

<comment><USER2> _"The huge growth that Google's Android platform has experienced during the past year creates a big opportunity for developers," wrote PayPal developer Naveed Anwar in a company blog. "We see it every day with the submissions using our platform. That's why we decided to put our money where our mouth is and make the theme to our next challenge Android mobile apps."

With prizes totalling $50,000, PayPal seeks Android mobile apps that leverage PayPal's technologies for mobile payments._

Do they not know what a good day on iOS is worth? It is certainly more than 50k.

This article isn't news, it's carefully placed PR, probably from Dice.com.</comment>


The Golden Flute IV: The Flute of Immortality - <AUTHOR> https://twitter.com/rickbrewPDN/status/1210023029087985664 <comment><USER2> Damn. Thats actually kind of amazing</comment>


Chicago is tracking kids with GPS monitors that can record them without consent - <AUTHOR> https://theappeal.org/chicago-electronic-monitoring-wiretapping-juveniles/ <comment><USER2> My favorite line:

"To the court's knowledge, no probation officer has used the device in violation of the law"

Which implies, they can, they just haven't yet or no one has caught them.

<comment><USER3> Or they do, but they haven't been caught not catching them. As long as they have plausible deniability right?

</comment></comment><comment><USER4> >Milhizer said in an emailed statement, ... that the communications feature is used "to inform the juvenile if the battery is low or that he or she entered an exclusionary zone where there is somebody or a place they must avoid."

Bullshit. If that was all it was, then a warning alarm would be enough. They could also have had a warning alarm to indicate when to call into the monitoring center. Such a device would be so easy to operate, a dog could be trained to do it ([http://www.iaadp.org/rescue- phone.html](http://www.iaadp.org/rescue-phone.html)).

<comment><USER5> I don't know, building system that handles all complex cases and can respond intelligently to any 16 year old is hard. Having a human in the loop that calls you up and says, "Remember you have to plug the device in." is going to be a lot more effective than a blinking red light or an auditory beep when the batteries are low, (after all the user might be asleep when that happens), a human would be able to remind the user before the battery is low or even escalate to another human for example calling a parent to remind the child in person.

It is fair to question if this extra flexibility is worth the cost in privacy. Though personally I think the GPS monitor is a much bigger incursion on privacy, but I think we generally accept that the benefits outweigh the costs in this situation.f

If you don't think this for communication as described what do you think it is for?

I don't think covert surveillance makes sense because the wearer is already going feel surveilled (that is kinda the literal point of the device). Sarah Staudt, Chicago Appleseed Fund for Justice, obtusely suggests the device is for sexual deviants.

> The idea that an adult can turn on a listening device while a child is, say, > in the bathroom or in their bedroom is not good.

I presume she is referring to the fact this is where children masterbate/have sex, as otherwise listening to a person sleep or use the bathroom really is not interesting or particularly hard to do (though if you do that is kinda creepy).

Anyways, this feels like way too much work if you just want to listen to 16 year old sexy-time, and the decision makers (like the mayor or chief prosecutor) isn't even going be in a position where they get to abuse the system to do that.

Perhaps this is a form of public corruption? Build an unneeded system in exchange for kickbacks this feels the most plausible but I don't see anything here that would make this more likely the case for the system mentioned in the article over any random public contract.

</comment></comment><comment><USER6> Just wondering as to why these devices are used to begin with? They don't prevent someone from re-offending or disappearing by just removing the device and destroying it, so why use it in the first place?

If someone can be trusted to not re-offend nor disappear then just trust them without the device, if someone can't be trusted then how is this device going to change anything? They'll just get rid of it and disappear at the earliest opportunity anyway.

<comment><USER7> I don't agree with your premises. These aren't elite criminals. They can't flee the country or go into hiding. For the most part they're low level offenders that run in bad crowds and made some bad decisions. But they still live in the community and are dependent on it. It is not hard to believe that a constant auditory monitor would change their behavior patterns.

</comment></comment><comment><USER8> Is it even true that more surveillance = lower costs / safer streets?

Regardless, this program should be struck down on constitutional grounds as you're almost guaranteed to infringe on the rights of 3rd parties when listening in on minors of all people. Totally absurd.

<comment><USER6> I have doubts about that. These spy devices don't actually prevent anyone from re-offending, and if anything could give the state a false sense of security (I can't imagine it being too difficult to take off the device without it noticing, as to make it look like everything is fine when you're actually on the run).

</comment></comment><comment><USER9> The title is a little more clickbaty than what it is. It's an ankle monitor for when kids are on house arrest for juvenile crimes.

> On March 29, court officials in Chicago strapped an ankle monitor onto > Shawn, a 15-year-old awaiting trial on charges of armed robbery. They > explained that the device would need to be charged for two hours a day and > that it would track his movements using GPS technology. He was told he would > have to be given permission to leave his house, even to go to school. But he > found out that through his monitor, officers wouldn't just be able to track > his location, as most electronic monitors do. They would also be able to > speak—and listen—to him.

and

> In January, Cook County, home of Chicago, awarded a contract to the > electronic monitoring company Track Group, which will lease 275 ankle > monitors to keep tabs on children awaiting trial.

<comment><USER8> Not clickbaity enough.

Chicago is tracking kids and listening to potentially anyone in the city without consent.

<comment><USER7> "Kids" awaiting trial for armed robbery. (The infantilization of teenagers is ridiculous. For most of human history, young men at 15 were fighting wars. If you're old enough to rob someone with a gun, you're not a "kid." Under certain circumstances it also may not be reasonable to treat you like an adult for purposes of the law, but calling the accused a "kid" is a disingenuous way to try to downplay the seriousness of his conduct.)

<comment><USER10> > For most of human history, young men at 15 were fighting wars. If you're old > enough to rob someone with a gun, you're not a "kid."

The hormonal peaks and incompletely developed executive function that made male adolescents excellent pawns in violent policy (and also contributes to their engagement in violent crime, often as similar pawns) is exactly part of them substantively being a kid.

</comment></comment></comment></comment><comment><USER11> Let's just fast forward 10 years and deploy these to everyone because if you have nothing to hide you have nothing to fear. That's what they keep telling me!

</comment><comment><USER12> What's more damaging to the future of these kids? An ankle bracelet or juvenile detention?

It seems easy to have a knee jerk reaction to this, but you have to understand that these ankle bracelets aren't being just randomly slapped on innocent kids. They're being placed on kids that have committed crimes or are awaiting trial. This is a lot better than the alternative to getting locked away where worse things can happen to them.

</comment><comment><USER13> Black Mirror Arkangel is coming to reality!

</comment><comment><USER14> With 5G, every felon can be so equipped.

<comment><USER15> > With 4G, every felon can do so _right now_ [1]

FTFY

[1] See all the posts on bounty hunters as of late.

</comment></comment><comment><USER16> I keep typing messages and deleting them because I can't possibly sum up my disgust with this whole approach.

<comment><USER17> This and the other front-page article about the prison video call system makes me wonder, just who are these engineers that are helping build this kind of evil systems? What's the difference between them and some war criminal "just following orders"?

<comment><USER16> "Are we the baddies"? heh ;)

</comment></comment></comment><comment><USER5> This article shows many issues with society but the title is super click- baity. It doesn't mention that it is talking about juvenile offenders, leaving the reader to assume Chicago is picking arbitrary children and tracking them. Furthermore, the main point of the article is not about GPS monitors, as those are already long accepted, as a condition of release, but instead about a two- way auto-pick-up call system built into the device, and the fact those calls are recorded.

Also lot of the issues they talk about go beyond the main privacy focused thrust behind adding a two wall call system to GPS tracking bracelets. How kids can get re-arrested because they forgot to charge the device, or are humiliated and effectively drop out of school because the device beeps in class, or are unable to eat because they are not permitted to leave their house which has no food because their family is poor.

These are real issues and deserves more attention, it is a shame that we only see because there is a clickbait headline. The problem isn't this specific feature being added to these devices, but rather a larger "emergent system" that is the result of many individuals and organizations acting independently and in a self interested fashion. As a society we have not managed to ensure the moral character of those with power over other people.

Technology isn't the cause or the solution to this problem because the problem is the people. People will find ways use things to be cruel or kind to each other regardless of of if that thing is latest advances in telecommunications or just fist sized rock.</comment>


Ask HN: What do you use for Feedback/Issue reports in your SaaS products? - <AUTHOR> We are evaluating what's the best way to allow customers to submit requests, issues, questions, and feedback and receive responses for those.<p>What do you recommend? <comment><USER2> Are you looking for something paid or free?</comment>