Verizon's accidental mea culpa - <AUTHOR> http://blog.level3.com/global-connectivity/verizons-accidental-mea-culpa <comment><USER2> "If that's the case, we'll buy one for them. Maybe they can't afford the small piece of cable between our two ports. If that's the case, we'll provide it. Heck, we'll even install it."

That's what I would call a mortal wound to Verizon's arguments.

<comment><USER3> Clever technique to draw attention away from what is most likely a contractual dispute.

Verizon's argument is clear:

> Netflix chose to attempt to deliver that traffic to Verizon through a few > third-party transit providers with limited capacity over connections > _specifically to be used only for balanced traffic flows_

Level3 hasn't refuted this point (the imbalance of the traffic flow). If the traffic is not balanced, the contract between Verizon and level3 probably has clauses requiring Level3 to pay Verizon for the imbalance (in this case, since Level3 is pushing more data, they would be the ones paying). That is the real problem, most likely, and the technical argument merely serves to confuse

<comment><USER4> > in this case, since Level3 is pushing more data, they would be the ones > paying

No. That's not how the internet works. Nobody PUSHES data. People PULL data.

Verizon has customers who pay for internet access. Those customers make REQUESTS to Netflix for data and Netflix RESPONDS with data.

They happen to be streaming movies which use a lot of bandwidth, but on average it's about 3Mbps per concurrent stream. That is WELL below the 25/3 or 50/5 or 100/10 that Verizon advertises for purchase.

If someone were pushing data it would be called a DoS or DDoS. An attack is when someone sends unrequested data to try and break your network.

But this data isn't unrequested. Verizon's customers have requested it from Netflix as they are within their rights to do since they have literally paid for it.

This is Verizon wanting to bill their customers once and then their customers' vendors as well. Double billing for a single service is a neat trick if you can pull it off. But it tends not to engender goodwill.

<comment><USER3> You still haven't refuted the point. This isn't about the relationship between Verizon and its customers, at all.

The agreement between _Level3_ and Verizon probably has some balanced traffic requirement, with penalties for asymmetry. If that is the case, then the nature of the imbalance would force Level3 to make payments to Verizon.

Verizon gave a very clear suggestion for Netflix: work with other providers as well. If Netflix worked with the overwhelming majority of third party providers, then you could argue that Verizon is not playing fair. But I don't see any commentary that Netflix is actually working with most of the third party providers.

<comment><USER5> Verizon is charging me for access to the internet -- then charging the internet for access to me. That is double-billing, and it's egregious.

Verizon is selling me a 50Mbps connection, but if I use it, for even a little, they get upset and say they are over capacity. This is the same company that over-subscribes their network _on purpose_ , as most ISP's do. They will come into a neighborhood with a 1Gbps link, then sell 50Mbps to 100 homes, in hopes that not everyone uses the connection at the same time, nor for long duration.

<comment><USER6> _Verizon is charging me for access to the internet -- then charging the internet for access to me. That is double-billing, and it 's egregious._

Both me and my brother get billed when we call each other on our cellular phones! Help me!

<comment><USER7> Which is not how it works in the rest of the world. Only U.S. consumers are so used to getting screwed that they would defend it as normal. Verizon loves double-billing so much for cell service that they want to do the same with the internet.

<comment><USER8> There are other countries that bill for incoming calls. I know of at least Singapore that does it.

Also, your phone provider does get charged for each incoming call. They just eat/redistribute that cost, since for normal phone user it's likely to be less than a penny per month. But try running a conference service and you're definitely going to get billed for incoming calls (apart from some weird force-subsidised areas where you can get paid to receive calls)

<comment><USER9> The difference is that in Singapore, you can get charged for incoming calls depending on your contract, but you _don't_ get charged for incoming SMS.

From a Singaporean perspective, that's the most bizarre part of mobile service in the US. I need to get an unlimited texting plan so that I don't get billed for people sending me texts? Whoa!

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Theres a common theme in this discussion. We're stuck discussing analogies. Instead, we should be reasoning from "first principles" as Musk suggests.

If we do that, we find that physical link speeds of any variety have improved by many many magnitudes over. As this statement suggests, 10GBit is absolute jellybean in the networking world. Yet, last mile bandwidth available to customers has stagnated. Imagine a perfectly paved autobahn, and here we are discussing if we should be able to drive 20 mph on it, and who should pay for the extra damage that will cause to the surface. Incredulous.

There are some regulatory systems, where in a goldilockes moment, these basic truths are recognized and acted upon. Consider the EU drastically cutting roaming charges. What was so blatantly obvious that even the senile, crooked decision makers at the EU couldn't miss it? All the providers already roam over the internet, at basically zero cost for both parties if you consider that speeds are limited by the over-the-air interface at either end. Yet they kept charging customers the price for a specially erected microwave link from 1960.

<comment><USER2> I'm pretty sure that was an analogy! (A good one though)

</comment></comment><comment><USER11> I have to agree with this assessment. If Verizon is claiming they have green in their network with 34% utilization to Level 3, then the connection between Level 3 and Verizon is lacking.

Is it a simple fix like Level 3 & Netflix claim? If so, what is Verizon's advantage to continue the slow Netflix. Netflix is really slow for Verizon users, it is very obvious for all their subscribers.

<comment><USER12> Verizon's advantage should be obvious: they also sell TV service which is in direct competition to Netflix. If Netflix works poorly, that's more customers potentially signing up for FiOS TV.

<comment><USER13> I feel like this is what people often forget in the net neutrality debate. The pipe providers have a horse in the race (FiOS TV On Demand, XFinity On Demand) and we need to make sure they aren't rigging the race so to speak.

<comment><USER12> Going beyond that, they typically have a monopoly or duopoly as an ISP, while they're subject to competition as a TV provider.

Much of net neutrality can be reduced to "don't let monopoly ISPs leverage that into a monopoly in other services".

If Verizon didn't offer TV, this wouldn't really be a problem. If there were 17 other broadband ISPs to choose from, this wouldn't really be a problem. But Verizon does offer TV and they're one of two choices for me and most of their other customers, so it's a problem.

</comment></comment></comment></comment><comment><USER14> Let's not forget that those providers that Netflix chooses to use are global edge service providers for high bandwidth streaming content services. Cogent, Level 3, Limelight, etc... Their whole business is providing high capacity back-end network transit which they do well, otherwise they wouldn't be in business for very long. High-five Level 3 for calling B.S. on this!

<comment><USER15> Funny you'd mention Cogent and L3 together, seeing as L3 has done worse to Cogent (depeering) for the exact same reason Verizon is using (unbalanced traffic).

<comment><USER14> Oh I didn't say they weren't bastards. That's a whole other discussion.

</comment></comment></comment><comment><USER16> It doesnt matter what content is coming down the wire, if I pay for internet I expect to be able to access or connect to anything thats not forbidden in the EULA.

With comcast my data cap is 300GB a month, I should be able to use 300GB of whatever I want Youtube, Netflix, hell even torrents or file sharing. Doesnt matter where it comes from I'm paying for 300GB of data at X speed. How hard is that to get?

<comment><USER15> Cool! Now tell Comcast you want to download 300GB from my server, which I've got connected on a single 300 baud channel. Will they come give me a free 1GE connection?

<comment><USER16> It doesnt work like that because Netflix has already paid level 3 who does most of the heavy lifting. Similar to if you had a 10GE connection at your sever but comcast is still running a 300 baud channel on the connection they have to your server.

<comment><USER15> OK, so I'll buy a 10G port to another random ISP. And they'll go to the ICX and say "hey Verizon, hit me up with the 10G port". Oh wait, it doesn't work like that. It works with peering arrangements, hmm.

<comment><USER16> Why should netflix have to pay for last mile when they already pay their backbone provider, who may own most of the wire? We can come up with any scenario or one off situation but still the problem remains.

Should net neutrality go away? And is it fair what Verizon and others are demanding from Netflix/Youtube... Also, who should foot the bill, the backbone providers, the content providers or the last mile providers.

You talk of peering arguments yet you dont seem to back them. If netflix is a level 3 customer and level 3 has a peering argument with Verizon, then whats the problem?

<comment><USER15> L3's peering contract with Verizon requires roughly equal traffic. Maybe that's dumb, shouldn't be the case, unfair to Verizon customers, etc., but that's literally the issue at the moment.

L3 did the exact same thing to Cogent before, for the same reasons.

</comment></comment></comment></comment></comment></comment><comment><USER17> One question: There aren't that many large edge providers around. What would Verizon do if Netflix signed a contract with a dozen of the larger ones and routed their streams through whichever had the best connectivity for a given endpoint? If Verizon throttle all of them, they are going to get a lot of collateral - essentially degrading the Internet at large for their customers. Or would they just do packet level filtering then?

<comment><USER18> I've wondered this as well. I suspect that it would be cost prohibitive for Netflix to have a contract with several edge providers like Level 3. I'm certain that Verizon's price demands to Netflix would be cheaper than this option.

Think about your own ISP. I pay $80 for service, but to get the same bandwidth shared between 2 ISPs I'd have to pay $120 plus now I'm doubling my hardware costs (routers to each ISP).

<comment><USER17> True. But I would assume that the contract is largely a pay per usage or at least expected usage. So if they just make an estimate of how many Verizon customers they have and buy that block from someone else than Level 3. Then route all that traffic through the other provider, while keep using Level 3 for the majority of their traffic.

Or perhaps they could ask Level 3 (who are clearly pissed at Verizon) to make the deal for them. These edge providers already have business with each other (peering), so it should be relatively simple for Level 3 to purchase some bandwidth from another large provider and then route some of their packets (e.g. the Netflix ones) through there.

In any case, the edge providers have good reason to collaborate on thwarting Verizon on this, so why don't they?

</comment></comment></comment><comment><USER19> Is it just me or is this not at all inconsistent with Verizon's arguments? They've been saying the whole time that this link is meant to be balanced with roughly equal upstream and downstream, and they showed it was not. What am I missing?

<comment><USER4> You've missed the part where they're trying to double-bill for the same network traffic.

Verizon wants to bill it's customers for the bandwidth that they use. And then for some of that traffic, if it's from Netflix, they also want to bill Netflix.

Verizon is the company which is selling asymmetric internet plans so it should come as no surprise to Verizon that their customers are requesting more data than they're sending.

But they use this asymmetry to suggest that what's happening between Verizon and Level3 isn't business as usual (which it is) and that they should be able to double bill.

Verizon is doing a decent job of spinning but if you really look at what's going on it becomes clear that they're really torturing definitions to make their arguments.

<comment><USER19> I agree to an extent. But there's a point at which Level3 stops becoming a peer and starts becoming a subscriber. That point is somewhere between equal utilization of Verizon's peering point and (near) total upstream into Verizon's network, just as any Verizon subscriber would have. Where is that point?

I'm a Verizon subscriber and I get apoplectic when Netflix stutters, because I know exactly what's happening. But I also don't know what's the exact right model for peering points, and I think net settlement might be a better model.

<comment><USER20> Netflix isn't a Verizon subscriber. Netflix is what Verizon subscribers pay to access.

The problem is that Verizon has apparently been successful in spinning the story that peering between Verizon and Level3 is supposed to be balanced. As others have already said in these comments, that doesn't make a lick of sense. Peering between backbone providers should be roughly balanced, but Verizon isn't acting as a backbone provider, they're acting as a residential provider, and there's no way peering with Verizon will _ever_ be balanced. That's a fundamental consequence of the asymmetric plans Verizon sells and the fact that their customers are expected to download significantly more than they upload. This means that Verizon will absolutely be receiving a lot more traffic into their network than they send out.

Basically, I doubt Verizon actually has balanced traffic with _any_ other provider, except perhaps other residential providers. But they're only making a stink about Level3 because they're trying to use this claim to double-bill.

Note again, Verizon made the intentional choice to service the residential market, and to sell asymmetric plans. They knew going into all of this that they wouldn't have balanced traffic with providers like Level3. And that's perfectly fine, because the only reason they're receiving this much traffic is because their paying customers are _requesting_ it. Verizon has already been paid to receive this incoming traffic.

Also, and this is something I haven't seen anyone really address, balanced peering agreements between backbone providers is typically meant to prevent one provider from routing traffic through a second provider's network, destined for a _third_ last-mile provider. In that scenario, the second provider doesn't gain anything from the traffic, and hasn't been paid for it. That's why the balanced peering agreement exists, to ensure that no provider gets taken advantage of that way; if you one provider wants to route traffic through another provider's network, they have to be prepared to receive just as much traffic.

But that argument doesn't apply to last-mile providers. The traffic isn't being routed through their network to a third destination. The traffic is being delivered to the network because that's it's destination. If the traffic was unsolicited (for example, a DoS), then it's reasonable for the last-mile provider to try to charge the sender for it. But if the traffic was explicitly _requested_ , which is generally the case (and certainly is for Netflix), then the last-mile provider has no justification for charging the traffic sender. The traffic has already been paid for, by the subscriber who requested the traffic.

<comment><USER19> You make a much better point than I've seen here. Verizon acting both as a backbone and as an ISP. This creates an internal conflict between those businesses.

</comment></comment></comment></comment></comment><comment><USER21> I think a natural solution to this is to have Netflix charge all Verizon customers a $5/mo surcharge to pay for 4 more 10gbps ports.

But after reading this... am I the only one that thinks peering agreements are done bass ackwards? If Verizon's customers are _requesting_ Netflix access, shouldn't Verizon pay Level3, not the other way around?

</comment><comment><USER7> This is the entire net neutrality debate in one simple blog post. Verizon is selling internet access to their users but not actually providing real access!

</comment><comment><USER22> Point of information about Verizon as a purely residential carrier: Verizon owns MCI/Worldcom and Terremark. They're not just a residential carrier. I don't have any idea what the ratio of residential to business traffic is, of course, but I think Verizon is a real Tier 1 carrier. Happy to have someone with more definite data chime in if I'm wrong.

<comment><USER4> They are but the residential and commercial sides of the business are VERY different: [https://news.ycombinator.com/item?id=8050089](https://news.ycombinator.com/item?id=8050089)

<comment><USER22> Do they use different backbones? Which side of the business runs the interconnects?

<comment><USER4> Verizon might technically be one company but in reality there are several business units which are actually separate companies in all but name.

When you buy business backhaul from Verizon you get guaranteed bandwidth provisioned on their network from point A to B. They don't over provision because they can't: contractually. If they don't meet their SLA the customer is out of the contract and can go elsewhere.

On the residential side things are very different. We have no SLA other than "pfft whatever we'll roll a truck next Thursday I guess"

Verizon might share long distance backhaul between residential and commercial sides of the company but if so it's done with strict quotas to ensure that the commercial side of things isn't impacted. It's not as though the core network division lets everyone have a free-for-all on the available bandwidth through the core.

If I had to guess I would venture that the consumer group either runs largely or entirely separate equipment. They might share fibers but I'm not all that confident about that. They're very, very close to entirely separate businesses.

</comment></comment></comment></comment><comment><USER23> How did people think this wouldn't happen when ISP's are allowed to be content providers, too. Of course Verizon wants to choke Netflix and promote their own service instead. Letting cable and content providers be ISPs was always a bad idea.

</comment><comment><USER24> Seems to have been taken down. Here's the link to the cached version (a bit hard to read): [https://webcache.googleusercontent.com/search?q=cache:http:/...](https://webcache.googleusercontent.com/search?q=cache:http://blog.level3.com/global- connectivity/verizons-accidental-mea-culpa/)

<comment><USER25> Works for me. Those who can't see it: are you on Verizon?

<comment><USER24> It's working for me now as well. When I posted the cached version the page on Level3 blog was giving me a 404 although the post was on the "Recent posts" list.

I'm not getting why I'm being down voted for posting the cached version when I was getting the 404.

</comment></comment></comment><comment><USER26> i recently gave up my netflix and amazon prime because i was tired of streaming hanging up in the middle of an episode/movie. it was just annoying and embarrassing if i had guests.

now i just torrent everything so i can watch uninterrupted when i want. I consider i am still legal since i'm paying for both subscriptions yet and they pay the content. if not, not my problem.

but that raises a question... why the RIAA/MPAA is not using its bullying powers to harass ISP like verizon?

as i just showed, they are the reason lots of people are going back to torrents that do not make money to the studios like streaming services does. Why do they rather sue john does instead?

<comment><USER27> "but that raises a question... why the RIAA/MPAA is not using its bullying powers to harass ISP like verizon?"

Because it presupposes that whether or not in fact, streaming via Netflix is profitable or not, the studios didn't have to be dragged kicking and screaming to allow it at all.

</comment></comment><comment><USER28> I've always been suspect of cable and wireless internet connections. Anything that shares bandwidth with all subscribers is going to get maxed out if a large number of customers start streaming video. Is it possible that Verison (and Comcast and etc...) know that opening up the gate to the outside world will crush their network under the increased load? I like the milk-our- monopoly-on-the-last-mile theory as much as the next guy, but is it even possible for the technology used to deliver the necessary bandwidth if they open up the pipe?

<comment><AUTHOR> Even so, as a paying customer I would expect them to calculate for this and know how to scale.

<comment><USER28> My point is was that spectrum doesn't scale. There's X gigabits per second available over the air, and a similar X over a cable. For cable companies they can push equipment closer to the home and have fewer subscribers on the same line. I suppose Verizon could do the same with more towers, but imagine doubling the number of towers to support double the bandwidth (or something like that). As people have pointed out though, the congestion is specific to connections that carry netflix.

<comment><USER29> There's a limit for mobile bandwidth, where also the number of towers won't help; but cable is different - sure, at one point they have to put proper fiber to the home (and it's economically feasible to do so, if there's actual competition instead of monopolistic ability to charge huge prices for weak service), but after that you can have as much bandwidth as your routers can service.

</comment></comment></comment></comment><comment><USER30> Summary: The bottleneck is the the interconnection point. Netflix _is_ saturating the interconnection point, and Verizon wants them or their transit provider to pay more to "ensure a level of capacity that accommodates their volume of traffic".

But Level 3 claims it would be _very inexpensive_ for Verizon to increase capacity there. Just a few port cards and a few thousand bucks for a major city like L.A. They even offered to pay Verizon's costs.

<comment><USER4> Nope, Verizon's customers are causing the interconnection point to be saturated. Netflix doesn't send data unless Netflix's customers request it. If they sent data without requests Verizon could (and probably would) interpret that as some kind of a network attack.

This is Verizon wanting to double-bill for traffic. Plain and simple.

> Verizon wants them or their transit provider to pay more to "ensure a level > of capacity that accommodates their volume of traffic".

That's Verizon's job. To go out and get by any and all means necessary enough bandwidth to satisfy their customers, namely the residential customers who seem intent on using Netflix. At no point do they have a moral imperative to hold their customers hostage to extort money out of someone else that their customers are trying to access. It's already been paid for!

<comment><USER31> > Nope, Verizon's customers are causing the interconnection point to be > saturated. Netflix doesn't send data unless Netflix's customers request it. > If they sent data without requests Verizon could (and probably would) > interpret that as some kind of a network attack.

All of your comments keep ignoring or misunderstanding what peering is. It is supposed to be roughly equal data traffic for both sides. Once it is lopsided in one direction, it is no longer peering.

It doesn't matter who requested what, the fact that L3 traffic is consuming a majority of the bandwidth now is the issue, and Verizon wants L3 to pay to fix that.

<comment><USER32> You don't peer with residential ISPs, because they aren't backbone ISPs. Residential ISPs need to buy transit from Level 3.

If anything, Verizon should be L3s customer, and L3 giving them SFP is doing _Verizon_ a favor.

<comment><USER31> This doesn't really have anything to do with ISP's.

Verizon is a Tier 1 provider: [https://en.wikipedia.org/wiki/Tier_1_network](https://en.wikipedia.org/wiki/Tier_1_network)

Yes much of the traffic ends up at end user destinations, but this doesn't negate the fact that the peering arrangement is no longer roughly equal.

<comment><USER4> Verizon Business is NOT Verizon Residential.

Those companies couldn't be more different.

<comment><USER31> It really doesn't matter what the company name is.

At the peering point the arrangement is no longer mutually beneficial for both parties due to one side of the peering arrangement now using more than its fair share or traffic. This is what Verizon has issues with.

</comment></comment></comment></comment></comment></comment></comment><comment><USER33> Greed! It would not stop here. Today it is Netflix and youtube, tomorrow it will be image heavy sites. Then they will go after google, mail provider and bank sites etc.

</comment><comment><USER34> Doesn't Verizon realize they lose customers for crap like this? My phone contract with Verizon is up in November. I can't wait to be done with them.

</comment><comment><USER35> Great post. Frankly Level3 should be pissed off. Verizon essentially called them out for providing crap service when in fact they are the ones responsible.

</comment><comment><USER36> What would happen if Netflix stopped allowing access to its service to Verizon customers in areas where there's another provider? Netflix could argue that it doesn't want to provide an inferior product if there's a choice, and maybe leave a number on the homepage for the cable company in your area.

I wonder if Netflix or Verizon would lose more customers...

<comment><USER37> Then a) Netflix becomes the bad guy, b) they lose money from those customers leaving, and c) they no longer have the opportunity to influence those people.

They should continue to allow access, but they should also keep saying when the problem is with the network provider. Customers love Netflix (NPS of 54) more than Verizon (NPS of 32), so they'll be more inclined to believe Netflix.

</comment></comment><comment><USER38> The claim from Verizon that still stands after this blog post is the fairness argument to peering. If you peer between symmetric networks, it's typically free. That's not the case here, so Verizon wants to be paid for the asymmetry.

I actually don't know. Is that legitimate?

<comment><USER39> One solution would be for Netflix to modify their clients to send useless and quickly discarded UDP packets back to balance out the traffic. Verizon then has tons of data to push back to Level3 and everyone's happy.

<comment><USER40> That wouldn't work though. Verizon sells unbalanced services with larger download capacity than upload capacity. So it's simply not likely/possible that their customers can send matching data for what they are requesting. Additionally, while this might not negatively affect their FIOS customers their DSL customers are on asynchronous connections meaning that the uploaded data will negatively impact their ability to receive data at the same time in effect degrading their ability to stream and the quality of the video they can receive.

<comment><USER41> What DSL cusotmers have are _asymmetric_ connections, not half-duplex. Even on ADSL, you can watch a HD video stream while uploading stuff. The only way the upload matters is if it prevents timely delivery of ACKs for the video being downloaded, and that's only a problem on the lowest speed tiers and when you don't have decent QoS.

<comment><USER40> Thanks for catching that error, as I typed out asynchronous I was saying to myself "this isn't right, the a is in the dang acronym" and then I was too lazy to double check.

</comment></comment></comment></comment></comment><comment><USER42> _This congestion only takes place between Verizon and network providers chosen by Netflix._

 _The providers that Netflix does not use do not experience the same problem._

This needs to be put in front of the FCC since it is the bare minimum language they should be able to understand.

</comment><comment><USER43> He makes great points. But this is what the verizon marketing team is paid to repond to. They'll come up with something, just wait for it.

</comment><comment><USER44> If only we have a government body that did something about stuff like this... o wait FCC... o wait :(

</comment><comment><USER45> More like an accidental "Fuck you" than an accidental "mea culpa".

</comment><comment><USER46> The Internet is a crucial part of our infrastructure and a important backbone of our economy. If there is any indication that someone like Verizon in this case is tempering with it intentionally, they should be charged with terrorism. This is no different than someone going out and sabotaging Hoover damn on purpose. In fact it's worth!</comment>


What is the image of a brand and what does it mean? - <AUTHOR> https://brandcloud.pro/blog-en/what-is-the-brand-image-and-what-is-the-meaning-of-it <comment><AUTHOR> To make a difference between individual organization and the competitors and at the same time to be well recognized among consumers, companies need to use specific brand image and brand identity.</comment>


Is the Internet destroying the U.S. two party system? - <AUTHOR> http://www.newyorker.com/magazine/2016/02/22/did-social-media-produce-the-new-populism <comment><USER2> The system is destroying itself. Nader likened in 2000 to two drunk boxers who are leaning on each other for support.

The constant state of "phony war" means that politicians can get legitimacy by participating in symbolic fights over unimportant issues and thus don't get called account for dealing with the problems in front of them.

At point it is breaking down. Right-Wing hysteria is revealing itself to be a scam like Scientology.

<comment><USER3> The big problem with modern politics (US or otherwise) is that the issues are bundled together without any regard of being connected other than "it was always bundled this way", like gun ownership with gay marriage with market regulation.

Society can't hold politicians accountable for specific issues, it's always a package. The (hypothetical) guy did a good job on banking regulation, but made sh&t all over intellectual property, and he only can be "fired" as a whole, by not being elected later.

And now try to rally up enough force because of the IP bill! You won't get much leverage, because you attack _him_ , which includes banking issue, so you'll get an opposition that doesn't care about IP, but likes his work about banks.

Why not reward him for the former action _and_ punish for the latter?

</comment></comment><comment><USER4> IMHO, the best thing for the US would be a legitimate third party. Doesn't even really matter too much what it stands for as long as it forces coalitions to form which I hope will pull everyone back towards the center.

<comment><USER5> That cannot happen until the US does away with first-past-the-post voting.

</comment></comment><comment><USER6> political parties should be illegal, one of the founding fathers warned us about it

<comment><USER5> A good first step would be to get rid of the R and D next to names on state sponsored ballots.</comment></comment>


CashFlow forecasting for small businesses and freelancers - <AUTHOR> https://www.wisecashhq.com/

<comment><USER3> Hi there - I'm the guy behind WiseCash (SaaS service, in beta since July).

The homepage is not yet ready for the general public, nor for a "Show HN"!

I'll happily answer questions though.

Here's an internal newsletter archive if you want to have an quick look inside though:

[https://www.wisecashhq.com/newsletters/acquiring-more- financ...](https://www.wisecashhq.com/newsletters/acquiring-more-financial- freedom)

<comment><USER3> Here are a couple more screenshots:

[https://img.skitch.com/20121016-bjwqug4i7kymcaakc843y8b1kx.j...](https://img.skitch.com/20121016-bjwqug4i7kymcaakc843y8b1kx.jpg)

[https://img.skitch.com/20120722-rwkkn37g2p53stndgttbxsgqma.j...](https://img.skitch.com/20120722-rwkkn37g2p53stndgttbxsgqma.jpg)

<comment><USER4> Looks like a cool product!

If I could make one suggestion; if possible, you shouldn't be showing screenshots forecasting loss/deficit. It might not be rational, but finance is so important that even fictional losses are not pleasant to look at. It's sort of the equivalent of having unhappy faces in your stock art.

There's a reason the Google finance favicon is steadily increasing graph!

<comment><USER3> Thanks! WiseCash is a labor of love for sure - glad you like it!

It's a very good suggestion and it has deep ramifications.

Mostly: the divide between people without a recurring income, and the others.

Most freelancers I've talked to have planned expenses, but planned income, not so much.

This results in this typical graph :)

I'd like to encourage people to think about creating more recurring income over time. The time-wealth WiseCash computes is a good way to spare some time to build a SaaS product, for instance.

So thanks a ton for this comment, it really got me thinking!

I will very likely use more positive screenshots in the end, and will work on encouraging people to reach that situation where they have a growing chart.

</comment></comment></comment></comment><comment><USER5> The screenshots look great. I like that you support Euro (and will hopefully do dollar and other currencies too) - just make sure you get the commas and periods localized well ( [http://weblogs.asp.net/scottgu/archive/2010/06/10/jquery- glo...](http://weblogs.asp.net/scottgu/archive/2010/06/10/jquery- globalization-plugin-from-microsoft.aspx) ). The bootstrap UI looks sleek but I recommend styling the buttons to make it look slightly more customized than the default bootstrap CSS.

Also, you should check out my free app: <https://zetabee.com/cashflow/> (see the demo and update the dates/amounts to play around). It has similar features and is very much like the original spreadsheet I used myself. It has burn rate (balance), monthly (income vs. expense), and many other views/lists.

My biggest feature request has been multiple simulations/forecasts so users can do what-if scenarios. Also the ability to easily ignore/disable rules with one-click to help with this. Either I get the new car or don't. Check/uncheck to see how it impacts the future. I've been very busy with my other projects and have not updated this app in over two years. I hope you guys can incorporate these features into your app so I can forward the heavy users to you. Good luck!

<comment><USER6> > The bootstrap UI looks sleek but I recommend styling the buttons to make it > look slightly more customized than the default bootstrap CSS.

I'd think it'd be a much better use of their time to improve the product, especially seeing as how they don't think it's ready to be released.

The number of people who have any idea what bootstrap is or looks like is dwarfed, by orders of magnitude, by people involved with small businesses and freelancing. So unless you're targeting snooty design folks who get offended that someone would sully their site with bootstrap, get on with the features!

<comment><USER3> Given that I bootstrapped the service on my own saved time, bootstrap was an easy choice, just like knockout.js, dotcloud (hosting), recurly (billing).

I really wanted to avoid a born-dead app, and leveraging bootstrap and these other tools was very encouraging.

On the couple hundred of beta-testers, nobody complained about bootstrap, unsurprisingly :)

</comment></comment></comment><comment><USER7> This looks fantastic! Cash flow has been a major pain point for me, and quite an unexpected one with a rapidly growing apparel company (<https://www.kigu.me>).

We've been managing this using a spreadsheet but tracking loan repayments, stock purchases, postage, cost of sale and salaries as well as picking a useful scale (daily vs weekly) has been a real challenge.

I can't wait for an invite.

<comment><USER3> Hey - I'm inviting you this afternoon! Thanks.

</comment></comment><comment><USER8> Looks really interesting. As a freelancer/writer I sometimes don't know how much to charge and I've never found it easy to manage my cashflow.

Looking forward to receiving an invite to the beta :)

<comment><USER3> Will invite you this afternoon so you get an idea! Cheers.

</comment></comment><comment><USER9> The splash page is leaving a lot of questions in my mind, and the invitation to give my email address (just to find out more) is a bit of a speedbump. Reading the comments in HN I can see other people asking how your service works.

My suggestion is to take your answers to those questions and use them on the front page to provide a bit more information to hook potential customers like myself.

<comment><USER3> I totally understand and do agree! This wasn't meant to be posted on HN as is (although the app is up and running since July at least, with people using it daily).

The splash page is a placeholder I put in place a long while back and it does not explain at all what you'll get inside the app (and what you won't get).

A proper home page (with detailing benefits, features, privacy policy, pricing, and a screencast) is on its way.

Thanks for taking the time to underline this :)

</comment></comment><comment><USER10> I'm glad to see this here. I've been a beta user and it's really helped me get a good view of how far into the future money will take me.

<comment><USER3> Glad it helped :)

</comment></comment><comment><USER11> I didn't look closely, but if this product builds a direct-method cash flow statement from a balance sheet - then you've got a winner. Quickbooks - <USER2> default small business accounting product - does a HORRIBLE job with the cash flow statement.

<comment><USER3> Once WiseCash becomes profitable, I plan to work on automating data extraction from various tools (like QuickBooks, FreshBooks etc most likely), either as a first time setup or a full sync process.

I think WiseCash will complement those tools nicely.

Thanks for the suggestion!

</comment></comment><comment><AUTHOR> I'm using it as a beta user, and I find it really helpful.

I used to do this kind of things with a spreadsheet, but this tool automates it and gives you nice charts.

<comment><USER3> Glad you like WiseCash!

We (my wife and I, co-founders) also used a spreadsheet a long while back and it got fairly hairy.

We built WiseCash both to create a secondary income apart from freelancing and to help out people get more freedom like we managed to.

</comment></comment><comment><USER12> sorry i have not signed up yet but how do you get the required data to create the forecast ? I mean are you using an automated aggregrator (like yodlee etc.) to pull bank details, credit card info etc ?

<comment><USER3> WiseCash (currently) requires that you input the planned expenses and income (using recurrence rules).

It makes no attempt (for now at least) to pull existing data from sources.

I will work on that topic once we are profitable though.

</comment></comment><comment><USER13> hard to tell from the screenshots but do you or would you consider adding a weekly look at cash flow vs. only monthly? looks like a nice product in the making though :)

<comment><USER3> I will work on choosing different scales on all charts, including:

\- weekly vs monthly on the "breakdown" chart [https://img.skitch.com/20120722-rwkkn37g2p53stndgttbxsgqma.j...](https://img.skitch.com/20120722-rwkkn37g2p53stndgttbxsgqma.jpg)

\- 12 weeks view instead of yearly view on the "burn down" chart [https://www.wisecashhq.com/newsletters/20121013-mjckb43qgm6k...](https://www.wisecashhq.com/newsletters/20121013-mjckb43qgm6k5ihu3k13cetei2.jpg)

It's definitely a "baby product" in the making - I want to make it grow a lot :) Thanks for the suggestion!

</comment></comment><comment><USER14> If you're still giving some priority to HN users… /raises hand

<comment><USER3> I'm working on an "onboarding screencast" to avoid blowing up under support, then I'll invite pretty much everyone who left their mail (so 487 people, so far :-).</comment></comment>


Show HN: Search personal websites (tiny search engine) - <AUTHOR> https://hyperlog.app <comment><AUTHOR> Hello everyone, I'd like to introduce an index of personal websites and independent publications called hyperlog.app

The motivation is to help others discover essays and opinions around the small corner or the noisy web.

Suggestions and ideas are welcome.

Wish you all to be healthy and happy.

<comment><USER2> Just checking around, tried a simple 'python' search and got a bunch of non- working urls [0] but I did check out that blog and found it interesting.

I'd also suggest to highlight sites [1] in your comment. I don't have a personal suggestion to contribute, but [2] [3] [4] might be worth checking out for you.

Another suggestion would be to add some random interesting search, something like the examples in explainshell [5]

[0] [https://hyperlog.app/search?q=python&offset=0&count=10](https://hyperlog.app/search?q=python&offset=0&count=10)

[1] [https://hyperlog.app/sites](https://hyperlog.app/sites)

[2] [https://jvns.ca/blogroll/](https://jvns.ca/blogroll/)

[3] [https://lobste.rs/s/eiditd/what_rss_feeds_do_you_subscribe](https://lobste.rs/s/eiditd/what_rss_feeds_do_you_subscribe)

[4] [https://github.com/learn-anything/blogs](https://github.com/learn- anything/blogs)

[5] [https://explainshell.com/](https://explainshell.com/)

<comment><AUTHOR> Thanks for the suggestions! Non working results are fixed. (I think there might be other bugs too)

The blogs are indexing everyday and I hope to improve search results overtime.

I'll definitely add these sites.

</comment></comment></comment><comment><USER3> would be cool to be able to click on the results and go there

<comment><AUTHOR> I'm sorry. just updated a new version and should work soon as normal</comment></comment>


Please don't learn to code - <AUTHOR> http://accidentalhacker.com/post/16116466587/please-dont-learn-to-code

<comment><USER2> The "learn to code" meme has been going around a lot lately, but I think there is a much more nuance to the intent behind learning to code than to literally train new programmers. I think many technical people don't realize that others simply don't see computers the way that they do.

To the general public, computers and software exist as black boxes whose functions are not understood. This has an important negative side-effect of making regular people less critical about what goes on in their digital life.

What his lack of critical ability translates to in real life is a weakened ability to recognize problems with things like SOPA/PIPA, or misguided ideas about online privacy. More generally, it makes people vulnerable to the designs of others who are working in their own self-interest and can do so because they have some amount of mastery of the digital domain.

These initiatives to teach "the people" programming are all about getting them comfortable with digital technology, demystifying it, indirectly empowering them with the idea that computers and software are things that can be made to work in their own interests.

<comment><AUTHOR> Great points. I totally agree that there's value in opening the black box. I hope that I got across the point that I actually would love to see more people touch programming, even if they aren't going to become professional programmers.

The thing I'm objecting to is the false hope--that not everyone has, by the way--that we can dramatically increase the # of actual professional programmers by making things easier.

</comment></comment><comment><USER3> Please don't learn to speak a second language. It can be hard and even with tools like Rosetta stone, Berlitz et al, many people just don't have the passion to learn these sort of things.

Or... You could try and see if you like it. Awesome tools exist nowadays to enable us to try many different disciplines. Many of these are over-simplified and will only get you so far, but maybe you get a taste for a new hobby or a second career.

I get what the article is trying to say, in places. However, I really believe in the try it and fail approach. You can discover talents and passions you never knew you had. That is unless you don't try to learn...

On the other hand, they say ignorance is bliss.

<comment><AUTHOR> I would love to see some statistics on the % of people who use Rosetta Stone, etc. and actually achieve their goal. It's hard.

The general population loves the _idea_ of speaking another language. That's why they buy the tapes. But in reality is so incredibly hard.

But Rosetta Stone will happily sell you on the idea that "You too can start speaking French in 2 months because our methods make it super easy!" All they have to do is sell you on the dream to bank their cash.

In reality, it doesn't work because it's hard. And people, in general, don't do hard things.

<comment><USER3> Agree, I'm sure that the stats would fully back you up on that. Even the people that achieve their first goals, how many still go on to become competent, or abandon the idea, because it's too hard? I agree with you that people don't do hard things, or at least don't commit and stick to them. But =) I still think people should try if it tickles their interest. Because some people succeed. My theory is try 10 things and fail at 9 of them. IMHO the failures were worthwhile in search of the 1 success. And you have to learn something from 9 failures, right? But, I recognise, this is just my opinion. I'm sure a lot of people would not be happy with a 9:1 ratio.

</comment></comment></comment><comment><USER4> HyperCard was wonderful. It whet my appetite for programming when I was in third grade. The verbose syntax gave me the ability to open other people's stacks and learn the fundamentals of imperative programming by example. Now I have a CS degree under my belt, have had great jobs for the past six years (it's been that long already?), and feel no way compromised by having originally cut my teeth on a toy language.

I think the author is wrong here. It should be something like this: please learn to code, but just keep in mind that there is always room to improve your craft. I've seen a lot of novice programmers who cling to the one language they know and guard their One True Language jealously. Just don't be that guy, keep moving and keep learning, and you'll be fine.

<comment><AUTHOR> Novice programmers are still _programmers_. The title of the post is (intentionally) harsh, but the main point is that we have to reset expectations about what lowering the bar can truly accomplish. It's still programming. :-)

</comment></comment><comment><USER5> I completely disagree with this article. I have only just picked up programming in the last couple of years (at 23). I absolutely love it. Why's poignant PDF got me hooked. I am never going to be an expert programmer but I am going to run a company again and I will hire engineers. My hope is that they will enjoy working with me a lot more now that I actually understand what Gems and loops are.</comment>


Show HN: Using Machine Learning to Find Undervalued Super Bowl Rentals - <AUTHOR> http://www.pricemethod.com/superbowl/guest

<comment><USER2> How are you able to use the term Super Bowl without getting sued?

<comment><USER3> They're not using it on their product name, it's merely a search keyword, why'd they get sued?

</comment></comment><comment><USER4> Where does Machine Learning play into this? For the estimate?

In that case, what's the training set?

<comment><USER5> We use a linear model with binary extension of several properties of a listing to learn the current value of different listings as it is on the market.

We combine this daily with an analysis of how much hosts and hotels are already increasing their prices and whether they book or not to see how much our learned base price should be increased for the Super Bowl.

The dataset is based on publicly available data from Airbnb and Homeaway.

<comment><USER6> "We use a linear model with . . . . . " ... that's what most HN'ers clicked the link for; and not to actually _search_ listings. I wish you had linked to a nice, long nerdy writeup about the product, instead of the product itself (which, while interesting in general, is not as much for this crowd).

<comment><USER7> Great call on sharing a more robust write-up. We're going to be watching the market closely over the next 10 days and will share more here.

For our team, one of the more interesting aspects of continued observation will be a more fine-grained understanding of price elasticity around such a major event.

</comment></comment></comment></comment><comment><USER8> May just be me, but none of the links actually lead to the relevant airbnb listing. They all revert to area search.

<comment><USER7> If the link leads you to an 'area search', that means the user removed their listing from Airbnb, likely after having booked their place for the Super Bowl. Often, these are people who _only_ listed their place for the Super Bowl, a trend we expect will continue around other big events.

We analyze the market throughout the day, and on each pass, remove these listings from our results page. In the mean time, those 'area searches' illustrate the speed at which vacation rentals are booking for the Super Bowl!

\- I'm Andrew, co-founder of PriceMethod. Thanks for the comment!

<comment><USER9> I'm really interested in the methods used to create this service and the learnings about rental behaviors associated. I'm also interested how this model might be able to scale to other cities and times to provide a continuously evolving model of price trends and predictions for goods and services.

The website is more or less algorithmic "magic" wrapped in a pretty UI, and I was hoping that you might have a blog post linked somewhere on the site so that I could read more about it.

<comment><USER7> Yep - agreed. We're a relatively new team, so there is a lot more to come. Our larger goal is around making a lot of data accessible and actionable for owners everywhere. Stay tuned!

</comment></comment></comment></comment><comment><USER10> <snark>Just what superb owl attendees are most keen to do: save money! An amazing coup, a triumph really! </snark> How about just finding cheap apartments (or real estate) generally instead? Or is there too much manual intervention required in this machine learning?

<comment><USER3> I guess it's easier to track fluctuation of real estate value in Glendale, AZ rather than NYC or SF. I don't know OP though so I can't be 100% sure.</comment></comment>


What weather imaging is going to look like with the new GOES-R satellite - <AUTHOR> https://gfycat.com/PaleCreepyDoe <comment><AUTHOR> Video source [https://www.youtube.com/watch?v=9goWgq55xL0](https://www.youtube.com/watch?v=9goWgq55xL0)

</comment><comment><USER2> I love weather satellites. Does anyone know how GOES-R compares to Japan's Himawari-8?

Also, looking at what these things can do it makes me wonder what the capabilities of the military/spy-sats are. I guess I'll find out in 30 years or so :)

<comment><USER3> I worked on a system for the WMO that contains virtually all the weather satellites. The Himawari-8 detail page is here: [http://www.wmo- sat.info/oscar/satellites/view/167](http://www.wmo- sat.info/oscar/satellites/view/167)

</comment></comment><comment><USER3> You can check all the technical details at the World Meteorological Organization here: [http://www.wmo- sat.info/oscar/satellites/view/152](http://www.wmo- sat.info/oscar/satellites/view/152)

</comment><comment><USER4> This will benefit us all through weather prediction/alert apps. They're already somewhat useful, but this could really drive pinpoint accuracy for outdoor events and recreation.

<comment><USER5> Pinpoint accuracy in the spatial sense isn't what's useful here for weather forecasting - it's the increased resolution for detecting subtle features and the increased frequency for detecting said features more quickly.

This likely won't help improve "will it rain this afternoon at the golf course" forecasts, but it will very likely drive "we detected a thermal couplet on this supercell, let's tornado warn it" type decisions several minutes sooner.</comment></comment>


Yinbi: A Censorship-Resistant Cryptocurrency [pdf] - <AUTHOR> https://s3.amazonaws.com/yinbi/Yinbi_Whitepaper_v2.0_English.pdf <comment><AUTHOR> I'm a bit skeptical.

> Yinbi Client will enable users to send and receive YNB, and will be released > sometime soonafter the YNB giveaway has begun.

Will this be open-source? Can I make an alternate client? If not, this give Yinbi Global Alliance a lot of power.

Also: [https://s3.amazonaws.com/yinbi/Yinbi- TOS.pdf](https://s3.amazonaws.com/yinbi/Yinbi-TOS.pdf) It seems like Yinbi will have the power to terminate accounts at any time.</comment>


Lucky to be a Programmer - <AUTHOR> http://duartes.org/gustavo/blog/post/lucky-to-be-a-programmer <comment><USER2> Indeed. But don't forget that while you're feeling lucky, non-tech coworkers and management are also overjoyed that you're doing the programming and they are not. One thing about this craft is you either enjoy it immensely or can't stand it at all.

<comment><USER3> Are programmers that much more respected outside of the game industry?

</comment></comment><comment><USER4> I know what are you talking about. Joy at work is deminetely something I like very much. On the other hand I think it's about doing job that you like. It doesn't have to be programming.</comment>


Where to look for programmer that "will complete me :)" - <AUTHOR>

No, I do not think I'm the business genius with all the ideas that someone simply codes at my behest. I have a very (un)healthly distaste for MBAs / B-School lazys. 31 year old proven-entity starting companies since 20.  I love hackers, their attitude, and I know what I don't know. Let's prove that it can be done - together.<p>Help! <comment><USER2> Nothing about the project and no way to contact you. You're off to a great start.

<comment><USER3> Agreed.

And frankly, I would start by cleaning up your grammar and losing the smiley face. Though many "hackers" may not like to wear suits and may like to play beer pong, they are serious professionals that deserve respect. This solicitation feels disrespectful.

Secondly, I would articulate exactly how you would add value to your future partnership. Of course, like you hinted, having an idea hardly counts.

Good luck.

</comment></comment><comment><USER4> Well, here would be a good place to start. But you'd need to be clear and honest from the start. What is it that you want to do, and why and so on...

Programmers(or what you call hackers) like things to be specific.

</comment><comment><AUTHOR> I really appreciate all the great feedback. Thank you. More info to follow once compiled.

</comment><comment><AUTHOR> Sorry - one more thing: Yes, am looking for co-founder.

</comment><comment><USER5> from a business 101 perspective - pitch the product you are working on first</comment>


Teenager jailed for refusing to hand over computer password - <AUTHOR> http://www.itworld.com/legal/123153/teenager-jailed-refusing-hand-over-computer-password

<comment><USER2> I don't know if a law compelling you to reveal encryption keys to the government/police/courts is valid in the UK.

I do, however, know that such a law is morally reprehensible. Quite frankly, it is in the interest of the people to ensure encryption tools are entirely useable by criminals, gangsters, and terrorists, because that ensures they are entirely useable by lawful citizens as well.

Unlike guns (something possible to "defend liberty" as well as commit crime with), encryption has no victims, has no negative consequences. It can _hide_ negative things, but it merely provides automation for knowing something you refuse to tell.

Edit: spelling

<comment><USER3> It is valid, and it is morally reprehensible. In the US, the Fifth Amendment protects us from such travesties.

<comment><USER4> Has there been a case where the Fifth Amendment protected someone from disclosing a password? I'm not sure that giving up your password is analogous to being forced to testify against yourself.

Edit: Indeed there has been a case, and so far the Fifth Amendment is holding strong: [http://cyb3rcrim3.blogspot.com/2010/04/passwords-and-5th- ame...](http://cyb3rcrim3.blogspot.com/2010/04/passwords-and-5th-amendment- privilege.html)

<comment><USER5> _"I'm not sure that giving up your password is analogous to being forced to testify against yourself."_

This one is tricky. It depends on ones beliefs about the true reasons for the anti-self-incrimination laws. If you believe (as I do) that it is a fundamental right to remain silent whenever it could make your situation worse, then it is indeed analogous.

An opposing view is that not being forced to testify against oneself comes from other, more basic reasons. One of the "higher-order" reasons against forced self-incrimination might be that punishment for refusing self- incrimination gives incentive to false self-accusation. This one does not apply to forced revealing of passwords (you cannot falsely self-accuse in this case.)

</comment></comment></comment></comment><comment><USER6> Same story from three weeks ago with many, _many_ comments.

<http://news.ycombinator.com/item?id=1760700>

It's very likely that any comments here will cover the same ground, so if you're interested in might be worth reading the comments there first.

<comment><USER7> Three weeks later and this fast food worker is still in jail. I guess in the UK there is no "innocent until proven guilty" and that's why some left to form the USA a while back. This story couldn't occur in the USA.

<comment><USER8> _This story couldn't occur in the USA._

Actually it can and does. If a judge compels you to turn over your password as a part of the discovery process and you refuse then you can be served with a contempt warrant and go straight to jail without trial and with limited possibility to appeal.

<comment><USER9> What you have said isn't true or accurate.

On December 17, 2006, defendant Sebastien Boucher was arrested on a complaint charging him with transportation of child pornography in violation of 18 U.S.C. § 2252A(a)(1). At the time of his arrest government agents seized from him a laptop computer containing child pornography. The government has now determined that the relevant files are encrypted, password-protected, and inaccessible. The grand jury has subpoenaed Boucher to enter a password to allow access to the files on the computer. Boucher has moved to quash the subpoena on the grounds that it violates his Fifth Amendment right against self-incrimination.

The district court held that Boucher could invoke the Fifth Amendment and refuse to comply.

[http://cyb3rcrim3.blogspot.com/2007/12/court-upholds- using-f...](http://cyb3rcrim3.blogspot.com/2007/12/court-upholds-using-fifth- amendment-to.html)

They later worked around it by requiring him to provide the decrypted contents of the drive instead of the password itself since a border agent witnessed some of the files on the drive and he wouldn't be providing new evidence.

[http://cyb3rcrim3.blogspot.com/2009/03/5th-amendment- bummer....](http://cyb3rcrim3.blogspot.com/2009/03/5th-amendment-bummer.html)

</comment></comment></comment></comment><comment><USER10> This brings up an idea for TrueCrypt.

Why not have two passwords: "foo" and "bar".

If I type in "foo", I get my stuff. If I type in "bar", it may selfdestruct the data, but at least it will show a different content.

So I create a 100GB container, and reserve 10GB as dummy content, maybe 1 mio. copies of the constitution, which will show up with "bar" as password. So I have a password for the police, and everybody is happy.

<comment><USER11> Already in there...

I think they call them shadow volumes...

</comment></comment><comment><USER12> >> originally arrested for another alleged offence last May. It would be interesting to know the nature of this crime. Was it technology related, or was the computer ceased for less direct relationship with the crime?

</comment><comment><USER13> 1) Plant an encrypted file on somebody's computer.

2) Call the police.

3) ???

</comment><comment><USER14> A few random thoughts:

1) While it is true to say you are protected under First and Fifth Amendment rights from having to disclose a password here in the US, it doesn't cover border inspections (including airport custom/immigration, where it is considered you are in 'no mans land'). The legal issues of this are currently going through the courts based around the number of people who have had their laptops searched (passwords are requested at the time of the search if necessary). But even if this is resolved, it probably will only apply to US Citizens and not visitors.

2) The chap who has gone to prison for not disclosing his password will go back again for another term if he doesn't disclose the password when he is released. Someone mentioned "maybe it's better to server 90 days in prison for not disclosing the password then to be caught with something more incriminating on his hard drive". That is mitigated by the fact that each request is treated separately so he could be in prison indefinitely if he doesn't comply :/

3) I've always thought a great defense would be to have your password something like "gofuckyourself" or "obvious". That way if someone asks you for your password you can say "go fuck yourself" or "dude, it's obvious". When you go to court you can say "no, I fully complied. The password was 'gofuckyourself'"

</comment><comment><USER15> Some really good PDF on how this works in Europe, the Netherlands and comparisons to US law. (I took me quite some time to find something looking authoritative enough to actually read.)

"If Alice has stored her key on a diskette or a smart card, and if Polly is certain of its existence and Alice's possession of them, she can summon Alice to deliver it – at least, in the United States she can, and also in European countries, according to the European Court's decision in Saunders. In the Netherlands, article 107 paragraph 1 DCCP, however, prohibits Polly from commanding delivery from suspects."

Further on (page 11) goes on to state that a key that doesn't exist in the physical plane might be considered admission, and therefore protected. That is unless it is demonstrated that the suspect used the same key (elsewhere) recently -- in which case it's already "admitted" by the suspect and the s/he needs to deliver the key.

[http://rechten.uvt.nl/koops/THESIS/cryptocontroversy- ch08.PD...](http://rechten.uvt.nl/koops/THESIS/cryptocontroversy-ch08.PDF)

</comment><comment> dot-sean I think the point here is that this Teenager thinks that the punishment for not handing over the password can't be as long as the punishment for proving a crime using the evidence stored on his harddrive. I didn't go to the link, but from what I remember, he's accused of possessing child porn. In US, it would be as easy as saying, I've been under so much duress because of all this, that I forgot what the key is and where I kept it. I mean, they can't keep him locked up forever, right.

<comment><USER16> And that's the magic phrase right there. Along with "Terrorism", "Drugs" and "Rape", "Child Porn" is a bogeyman which many people feel justifies a reduction in rights of a serious nature.

Are they right? Well, that's not something I'm going to speculate on, but I believe the judicial system will push as hard as people expect/will permit them too. If the encrypted data was stolen e-books, I doubt they'd be so very harsh.

I think it's bollucks, however. I think you should have no punishment for refusing to help convict yourself, regardless of what you may have done.

</comment></comment><comment><USER17> Doesn't sound like much of a story. He's jailed for obstruction of justice. His password was requested because he was already arrested and under investigation for something else. The fact that it's a computer password doesn't make this a 21st century "Big Brother" issue.

</comment><comment><USER3> If he was using Truecrypt Deniable Filesystem with FDE (and the proper protocols), we wouldn't even be having this conversation.

</comment><comment><USER18> ✓ Old story (October 6th).

✓ Original article omits context.

✓ US Constitution does not cover the British.

✓ Already covered. <http://news.ycombinator.com/item?id=1760700>

No discussion required.

<comment><USER19> Word War II:

✓ Old story (September 1, 1939).

✓ Thousands of articles likely omitting full context.

✓ US Constitution does not cover the British.

✓ Already covered. <http://news.ycombinator.com/item?id=1507526>

No discussion required.

<comment><USER20> I agree without irony.

</comment></comment></comment><comment><USER21> If Moore's Law keeps working, this is a ticking time bomb for him. If the police stay interested and crack his crypto, he'll do more time for whatever he's concealed on his computer (if anything).

<comment><USER22> Who knows what he does have in that hard drive. Maybe 4 months in prison is significantly better to what might happen if they do get to his data. Hell 4 months in jail because he refused to give a password sounds a lot better than a sexual offender conviction for 4 years.

In any case, if I was him I wouldn't worry about them decrypting the data in my lifetime. Do you know how many millions of years would it take to decrypt a 50 random char pass phrase decent encryption. Lots of those. So unless there is a breakthrough on computing power several magnitudes bigger than what we have experienced and the money to dedicate millions of computers to the cause, or someone finds a loophole in the encryption algorithm (highly unlikely if using any type of military grade encryption), his data won't be decrypted.

<comment><USER23> And yet, I'm surprised by technological advancement every day. If you'd asked me several years ago if I thought we'd have artificial limbs controlled by thoughts, I'd have said it was far far away.

It's a race between the statute of limitations and encryption/computing technology. (I do agree it seems unlikely).</comment></comment></comment>


Real-time map of cyber attacks - <AUTHOR> http://www.sicherheitstacho.eu/?lang=en

<comment><USER2> That's pretty neat - it seems to only cover one aspect of what makes something a "cyber attack", though. Doesn't appear to cover things like XSS, SQLi, and other malware vectors - just network vulnerability probes and break-in attempts. Not that that's a bad thing, the information presented is still quite fascinating. :)</comment>


The 2010s were supposed to bring the eBook revolution. It never quite came - <AUTHOR> https://www.vox.com/culture/2019/12/23/20991659/ebook-amazon-kindle-ereader-department-of-justice-publishing-lawsuit-apple-ipad <comment><USER2> And be able to go down to a local print shop and have the book printed on demand...</comment>


Solar System's First Interstellar Visitor Dazzles Scientists - <AUTHOR> https://www.nasa.gov/feature/solar-system-s-first-interstellar-visitor-dazzles-scientists <comment><USER2> I'm really surprised this is the first one we've observed, I would have assumed that it would be a regular occurrence, but then I guess space is pretty big after all.</comment>


Ask HN: Best curated newsletters? - <AUTHOR> Based on my experience, Google searches rarely surface high quality blog posts, articles, and insider analyses. Twitter + LinkedIn have an SNR problem. HN is great only for the (primarily US) tech/startup scene, and other similar sites often lack the community standard or size to maintain a consistent flow of worthwhile new content.
What hand-curated newsletters or websites do experts in any field find incredibly useful? A recent example I've found is Mattermark's daily email newsletter, which has a curated list of 5-10 articles and blogposts from investors and operators.
Open to lists that aren't career related too -- ie: a jazz playlist curated by professional jazz artists. <comment><USER2> For tech I'm honestly trying to keep up less, I want more time in my life to read shitty fiction etc (and you know, spend time with humans I guess); I've spent the better part of a 15 years keeping up _too_ much IMO.

On nothing to do with tech: I'm desperately trying to find something that covers general world news without too much of a US slant, in a nice concise way. Next Draft (mentioned elsewhere in this thread) is pretty good, but is very US heavy.

When I trialled subscribing to The Economist their Espresso app-- which is essentially a daily curated newsletter-- was pretty decent, so if you sub to them you should definitely check it out.

These days I'm trying the qz daily digest, which I think is working out OK: they talk about what to expect in the next day, what happened while you were asleep etc. If anyone has any better suggestions I'd love to hear them: I like how the economist actually talks about other parts of the world apart from the states, but I don't love it enough to pay their standard sub rate.

In terms of general flowery writing I get emails from Medium based on what I've read, emails from Pocket based on what I read, and longform.org's newsletter. Depending on how snowed under I feel at any given time I either just delete them without opening them, of potentially skim them to see if anything is interesting.

<comment><USER3> I've subscribed the Quarz RSS feed (not the daily newsletter). I am mostly pleased with their articles. They do have a weird obsession with women's issues, though. It's not that I don't care about these but articles on this subject are often a bit fluffy for my taste.

Example: [http://qz.com/599694/a-peek-inside-modern-day-elite-kitty- pa...](http://qz.com/599694/a-peek-inside-modern-day-elite-kitty-parties/) (I read that article two times and still don't understand why "Kitty Parties" are of significance and how they differ from other social gatherings of business minded women or people in general)

@OP: Thanks for posting this questions. Looking forward to other people's answers. I find it quite reassuring that other people also long for curated newsletters.

<comment><USER4> Kitty parties are a huge thing for women :) It's a women-only kind of thing, mainly. Quite popular in India too (probably inherited from British colonial times), at least among the married women crowd. To try to describe it, I'd say that for women, it is something like "girling out", similar to geeking out or such terms. Meaning doing something you like, possibly intensively (along with others).

</comment></comment></comment><comment><USER5> Great question! I hope it gets traction and makes it to the front page. I'm curious to see what people come up with.

I like Dave Pell's Next Draft, which is just interesting general news stories, and also Azeem Azhar's Exponential View, which covers tech, with a slant towards AI/ML. In terms of stuff the HN crowd is less likely to already know about, I like Archinect, which covers architecture. It's not really a curated article roll-up so much as it is an architecture news site, but their weekly email is a nice way to stay on top of what's going on in the field.

<comment><AUTHOR> Thanks for the suggestions -- looking into them now. Clever idea to sign up for a site's weekly email instead of skimming the site.

I used to sign up for an HN newsletter that'd only show the top posts. I thought that was an effective way of pushing only the best content to me every few days. Realized later that I enjoy reading a some articles that didn't get a lot of upvotes.

I also tried to create an open google doc where a small group of friends could share links to articles they found particularly noteworthy. Participation was 0, so I gave up and now just store interesting articles in my bookmarks folder. Messy.

<comment><USER6> I've been thinking about setting something like this up, but over email. Anyone who opts in to the mailing list would be able to submit a link+description, and once a week some software would automagically send out an aggregated email to everyone who opts in.

The problem is getting it to the optimum size. If it's too small, it won't work because nobody will want to post. If it's too large, then the signal-to- noise ratio drops and it's no better than Reddit or HN.

Also, moderation is hard.

<comment><AUTHOR> Yeah, I hear you. Community-driven newsletters / news sites have a very narrow success zone -- too small and it'd lack fresh content, too large and it'll have SNR problems.

I think the best solution is to find one or two people who know their stuff to curate everything. Add community engagement mechanisms incrementally. For example, enable social media sharing and commenting before account creation, upvoting, and article submissions.

Wonder how a Quora/Medium model (invite-only) or The Information (paywall) would work for newsletters, since content isn't original?

</comment></comment></comment></comment><comment><USER7> I second [https://www.brainpickings.org/](https://www.brainpickings.org/) and also would like to add [http://nextdraft.com/](http://nextdraft.com/) (though it is more "general news") - other than that I can't help, because I actually prefer to use rss-feeds over Newsletters.

Some RSS-Feeds I follow and which might be of interest: [http://kernelmag.dailydot.com/](http://kernelmag.dailydot.com/) \- [http://www.rand.org/blog.html](http://www.rand.org/blog.html) \- [https://blog.codinghorror.com/](https://blog.codinghorror.com/) \- [https://bsdmag.org/](https://bsdmag.org/)

(PS: You can also get rss-updates about new entries in Youtube-Playlists (google it) and if you use Twitter and follow some interesting people, that might also be a good way to stay up to date)

<comment><USER8> Also a gem of a blog is Joel Spolsky's joelonsoftware.com. He doesn't post much now but read the archives. You won't regret it.

</comment></comment><comment><USER9> For iOS, I really like iOS Dev Weekly: [https://iosdevweek.ly](https://iosdevweek.ly)

Dave, who runs it, also built [https://curated.co](https://curated.co), which is a tool for producing these kind of hand-curated newsletters.

</comment><comment><USER10> A WordPress curated newsletter you can find at [http://wpmail.me](http://wpmail.me)

It's sent once a week and you should find at least one or two good articles that are worth reading.

Then there is [https://www.brainpickings.org](https://www.brainpickings.org) where the author reads a bunch of books and sends out a newsletter with a resume of each book. I personally don't think there's anything like this out there!

</comment><comment><USER11> Quartz's daily newsletter for everything global. - [http://qz.com](http://qz.com)

Morning Reader, for general tech news - [https://morningreader.com](https://morningreader.com)

hackernewsletter for avoiding lurking on HN too much - [http://www.hackernewsletter.com](http://www.hackernewsletter.com)

</comment><comment><USER12> [http://highscalability.com/](http://highscalability.com/) \- For news related to building large web apps and software.

[https://summitroute.com/blog/](https://summitroute.com/blog/) \- (mine) Infosec news.

[http://ben-evans.com/#newsletter](http://ben-evans.com/#newsletter) \- Email only newsletter from Benedict Evans of A16Z mostly related to large mobile business moves.

[https://www.feistyduck.com/bulletproof-tls- newsletter/](https://www.feistyduck.com/bulletproof-tls-newsletter/) \- TLS crypto news (monthly)

[http://golangweekly.com/](http://golangweekly.com/) \- Golang links

</comment><comment><USER13> I subscribe to, and enjoy reading, [http://postgresweekly.com/](http://postgresweekly.com/)

</comment><comment><USER14> In the Hadoop ecosystem, the Hadoop Weekly has been pretty useful to subscribe to:

[http://www.hadoopweekly.com/index.html](http://www.hadoopweekly.com/index.html)

</comment><comment><USER15> I enjoy reading

* [http://softwareleadweekly.com/](http://softwareleadweekly.com/) \- about people, culture, leadership

* [http://www.devopsweekly.com/](http://www.devopsweekly.com/) \- DevOps, by Gareth Rushgrove

Just my pick. Indeed, I've found links there that haven't popped up anywhere else (HN, Twitter), so I second the original poster's opinion that mail newsletters are a good thing - wouldn't have thought that.

</comment><comment><USER16> It's quite hard to build up a following these days. In the last 5-6 years, I made such newsletters for the coffee world, airports, plus cultural items and tech news out of Brazil. For all of them, I made use of my knowledge/familiarity of Romance languages and would thus translate foreign news to add to my newsletters. Essentially, I learned they were "nice-to-have" but not necessary in order to operate in these fields (the latter being what I was aiming for).

\- For coffee, I learned people in the know are after 24/7 changes in the commodities market.

\- For worldwide airport news, well, I don't think there is much of a market there (though I would regularly capture 30-50 pertinent articles per day).

\- For Brazil news, cultural awareness is nice to have but in order for something like that to be needed, I would think the focus would have to be Business, and very specific (in fact, I played around with making newsletters like this).

\- For Brazil tech, I think it was too early on in its development because there were only around 10-15 items per day.

There's a final component I failed to consider with the first two newsletters above, I had no product dev, no one on the inside to say "hey, focus on this aspect, that's what people need."

</comment><comment><USER17> There's a good one on internet (and non-internet) culture at [http://tedium.co/](http://tedium.co/)

</comment><comment><USER18> Try NewsletterStash [http://www.newsletterstash.com/](http://www.newsletterstash.com/)

It's a newsletter directory where you can search and find all kinds of newsletters even with subjects outside the tech world. (I've got no affiliation with them, just found it a while back on OpenHunt and thought it's useful.)

</comment><comment><USER19> I personally recommend Snippets from Social+Capital (s23p). I like their pick of articles - very logical and insightful. Delivered once a week, it captures an essence of what goes on in the tech and startup world while casting aside all the hype and hoopla that most other blogs end up pushing.

Take a look at some of their past newsletters - [http://us10.campaign- archive2.com/home/?u=d7f0f45160075006b2...](http://us10.campaign- archive2.com/home/?u=d7f0f45160075006b25756cd0&id=159d546edd)

2nd Place : Weekly Newsletter + Podcasts from Andreessen Horowitz (A16z). The podcasts are amazing - discussions with entrepreneurs working on bio-tech, AI, Fin-tech, Quantum Computing. All the people I would love to hang out with.

Preview [http://us7.campaign- archive2.com/home/?u=35c671b34bb40414916...](http://us7.campaign- archive2.com/home/?u=35c671b34bb404149166bf755&id=6da14709cd)

Non-tech: Brain Pickings FTW!

</comment><comment><USER20> For Data Science: Data Elixir [http://dataelixir.com/](http://dataelixir.com/)

</comment><comment><USER21> I run Mandarin Weekly ([http://MandarinWeekly.com/](http://MandarinWeekly.com/)), for people learning Chinese. It comes out every Monday, and I've been doing it for more than a year. It's fun to hear from other people learning Chinese, around the world!

</comment><comment><USER22> Fully disclaimer: I'm the one writing this newsletter.

Cron.weekly is a weekly newsletter (every Sunday) with news on Linux and open source. Focussing on the technical side mostly, featuring new tools & projects and guides & tutorials, as well as the latest news, releases, ... pretty much anything noteworthy in open source.

It's available here: [http://www.cronweekly.com/](http://www.cronweekly.com/)

And all archives are available here: [http://www.cronweekly.com/archives/](http://www.cronweekly.com/archives/)

</comment><comment><USER23> I pretty much _NEVER_ subscribe to anything like this as it seems like a given that I'll eventually get spammed.

Recently, though, I signed up for the "cron.weekly" [0] newsletter and it's actually pretty decent. I think I first saw it mentioned here.

The "archives" [1] are available as well, so you can get an idea of what it's like before you sign up.

[0]: [http://www.cronweekly.com/](http://www.cronweekly.com/)

[1]: [http://www.cronweekly.com/archives/](http://www.cronweekly.com/archives/)

<comment><USER22> Hi there,

I'm writing that mailing list, so I'm very happy to read you're enjoying it. Thanks for sharing!

Mattias

</comment></comment><comment><USER24> In addition to others mentioned here, I've been enjoying Weekend Reading by Assaf Arkin for a roundup of lighthearted tidbits about the dev world, in addition to some useful tips:

[http://tinyletter.com/assaf](http://tinyletter.com/assaf)

Example link from yesterday's I liked: [https://twitter.com/HenryHoffman/status/694184106440200192](https://twitter.com/HenryHoffman/status/694184106440200192)

</comment><comment><USER25> For Android development, Android Weekly is the most popular newsletter: [http://androidweekly.net/](http://androidweekly.net/)

</comment><comment><USER26> I read [http://www.MarketingLand.com](http://www.MarketingLand.com) 's MarketingDay Email every day & [http://www.SearchEngineLand.com](http://www.SearchEngineLand.com) 's SearchCap.

MarketingDay does an amazing job curating posts from around the web as well as give you the top stories published on MarketingLand that day. It is a must read for anyone involved in any area of digital marketing.

</comment><comment><USER27> [http://www.devopsweekly.com/](http://www.devopsweekly.com/)

I don't always have time to read it. But, when I do, I never regret it.

<comment><USER23> Looking at their archive [0], it appears the last "issue"(?) was a little over 14 months ago.

[0]: [http://www.devopsweekly.com/archive](http://www.devopsweekly.com/archive)

<comment><USER28> Still very much alive and excellent - I think he just hasn't automated the archive update.

</comment></comment></comment><comment><USER29> I've been pretty happy with Charged (www.char.gd). Nicely summarized articles on the tech news for that week, with links to the originals and links for further reading.

<comment><USER30> Thank you!

</comment></comment><comment><USER31> [http://javascriptweekly.com/](http://javascriptweekly.com/)

[http://nodeweekly.com/](http://nodeweekly.com/)

[http://rubyweekly.com/](http://rubyweekly.com/)

I like how they post the weekly newsletter on the website. I'm not subscribed, but I read it every week. It's a nice way to stay up to date of some technologies I use daily.

</comment><comment><USER32> Farnam Street Blog Newsletter: [https://www.farnamstreetblog.com/](https://www.farnamstreetblog.com/)

Great source of wisdom

</comment><comment><USER21> I run Daily Tech Video, at [http://DailyTechVideo.com/](http://DailyTechVideo.com/), with a single, curated conference video about the sorts of topics I like -- namely, Web development, programming languages, and databases. I started it to keep up on topics and conferences, and I'm now up to more than 430 videos, categorized by language, technology, etc.

</comment><comment><USER33> I like [http://www.StrictlyVC.com](http://www.StrictlyVC.com) for VC/Startup related news. I also enjoy [http://www.MarketSnacks.com](http://www.MarketSnacks.com) for a quick and often humorous read in the morning related to wall street and the public markets.

</comment><comment><USER34> Linux Weekly News ([http://lwn.net/](http://lwn.net/))

For Machine Learning I can't recommend Talking Machines ([http://www.thetalkingmachines.com/blog/](http://www.thetalkingmachines.com/blog/)) highly enough. It is a podcast though.

</comment><comment><USER35> If you're into food and agtech, we run [https://AgFunderNews.com](https://AgFunderNews.com) Our weekly newsletter features our top articles and other top external articles we shared on social media. Newsletter goes out to >15,000 people each week with a 30% open rate.

</comment><comment><USER36> You can check out,

[http://www.pythonweekly.com](http://www.pythonweekly.com)

[http://www.nosqlweekly.com](http://www.nosqlweekly.com)

[http://www.founderweekly.com](http://www.founderweekly.com)

Disclaimer: I am the curator of these newsletters.

</comment><comment><USER37> My friends hand curate newsletter related to Fintech and bitcoin & cryptocurrency

[http://www.fintechstreet.com](http://www.fintechstreet.com) [http://www.altcoinweekly.com](http://www.altcoinweekly.com)

</comment><comment><USER38> I really enjoy the stuff in Redis Watch - anything and everything about Redis: [https://redislabs.com/redis-watch-archive](https://redislabs.com/redis-watch- archive)

 __DISCLAIMER __: I 'm the curator and janitor of the newletter

</comment><comment><USER30> I found myself overwhelmed by the sheer amount of content coming out of most places, so I created one that focuses on technology and reducing noise on a weekly basis - about 7,000 subscribers now: [http://char.gd](http://char.gd)

</comment><comment><USER39> [http://importpython.com](http://importpython.com) is a Python Weekly Newsletter. Unlike some of the other newsletter on Python it's not just the best of Reddit but articles that aren't even on Reddit. Check it out.

</comment><comment><USER40> [http://importpython.com/newsletter/](http://importpython.com/newsletter/) is one I enjoy reading. Specially the open source projects they feature every week have been helpful to my development/work.

</comment><comment><USER41> [http://tinyletter.com/data-is-plural](http://tinyletter.com/data-is-plural) Data Is Plural by Buzzfeed's data editor. It's a curated list of interesting open data sets that can be used to build stuff.

</comment><comment><USER42> I'm curating Fullweb Weekly[1], a newsletter for Fullstack developers.

The format is the top 5 links of the week + 1 mini article. About 1100 subscribers now, I also welcome contributions!

1: [https://fullweb.io/](https://fullweb.io/)

</comment><comment><USER43> For engineering, I would recommend Sliced Ham [1]. It contains some engineering and development blogs from various companies and individual contributors.

[1]: [http://www.slicedham.co/](http://www.slicedham.co/)

</comment><comment><USER44> Shameless plug, but I am curating a Deep Learning / Artificial Intelligence newsletter: [http://www.wildml.com/newsletter/](http://www.wildml.com/newsletter/)

</comment><comment><USER45> My up-to-date list of newsletters (present, past, and future): [http://www.andjosh.com/lists/newsletter/](http://www.andjosh.com/lists/newsletter/)

</comment><comment><USER46> [https://www.soundshelter.net/](https://www.soundshelter.net/)

Curates a personalised list of electronic music/soul jazz vinyl releases based upon items you add to your Saves list

</comment><comment><USER47> IF you are python programmer, importpython ([http://importpython.com/newsletter/](http://importpython.com/newsletter/)) is the must for subscription

</comment><comment><USER48> Data Machina reliably surfaces links that I wouldn't have seen otherwise: [https://tinyletter.com/datamachina](https://tinyletter.com/datamachina)

</comment><comment><USER49> From [https://frontendfront.com](https://frontendfront.com) I send a newsletter every Monday with the most upvoted front-end news of the week.

</comment><comment><USER50> I compile some random links and send them out every week: [https://www.skorgu.net/weird/](https://www.skorgu.net/weird/)

</comment><comment><USER51> Azeem Azhar's Exponential Life David Farber's Interesting People Benedict Evans weekly digest Sinocism Webstock's weekly newsletter TechTails by Smalldog Electronics

</comment><comment><USER52> For front-end & web-development, the weekly »Web Development Reading List« is pretty nice.

[https://wdrl.info/](https://wdrl.info/)

</comment><comment><USER53> I use [http://www.pearltrees.com](http://www.pearltrees.com), fully hand curated. I think it matches exactly your needs.

</comment><comment><USER54> Beta List's newsletter

</comment><comment><USER55> importpython for python programmers.

</comment><comment><USER56> I like these, tending towards the .NET world

Alvin Ashcroft's Morning Dew [http://www.alvinashcraft.com/](http://www.alvinashcraft.com/)

Chris Alcock's Morning Brew [http://themorningbrew.net/](http://themorningbrew.net/)

Regular Geek [http://regulargeek.com/category/geek- reading/](http://regulargeek.com/category/geek-reading/)</comment>


Bug in the Pentium FPU (1994) - <AUTHOR> http://www.trnicely.net/pentbug/bugmail1.html <comment><USER2> For those young'uns who didn't suffer thru this, it turned into a really big deal. There were some circumstances where a floating point division result would be incorrect after about 4 decimal digits. The linked post is the original public report of the bug.

Wikipedia [1] has a summary. Intel wound up offering to exchange faulty chips, and took a $475 million charge against earnings.

But IMO the best part of the fiasco was all the jokes. Hundreds of jokes. Probably thousands of jokes. E.g.[2]. One of my favorite jokes doesn't appear on that list (but does appear on many others):

       We are Pentium of Borg.
       Division is futile.
       You will be approximated.

[1] [http://en.wikipedia.org/wiki/Pentium_FDIV_bug](http://en.wikipedia.org/wiki/Pentium_FDIV_bug) [2] [http://www.khd- research.net/Tech/Computer/Misc/PBug_Jokes.tx...](http://www.khd- research.net/Tech/Computer/Misc/PBug_Jokes.txt)

<comment><USER3> I heard that Intel lost one of its' divisions.

</comment></comment><comment><USER4> > You may use this information freely as long as you give me attribution by > name and employer.

I'm curious about this last bit at the end of the email. Is there any legal mechanism under which this is even remotely enforceable? You can't copyright information; this isn't a patentable invention; trademark isn't relevant. I'm curious why Dr. Nicely put this in there and what effect he thought it might have.</comment>


Attacking Google Authenticator - <AUTHOR> https://www.unix-ninja.com/p/attacking_google_authenticator <comment><USER2> The article assumes you know the topology of the secret. This is a completely unrealistic assumption for TOTP.

There's nothing in the article that makes it an actual realistic attack. Also nothing that makes it usable against Google authenticator, which is in the title just to attract clicks.

Waste of 5 minutes and disappointed with upvotes. I rely on HN to send me to quality content. Please don't trick me like that.

<comment><USER3> The article says at the bottom that Google Authenticator uses 10-byte secrets. Is that wrong, or is there something about the topology that's different from what's described in the article?

<comment><USER4> Google Authenticator (the app on ios/android) doesn't generate secrets, it consumes secrets that you either scan through a QR code or type in the raw base32. It _can_ use 10-byte secrets if that's the kind you feed it.

</comment></comment></comment><comment><USER5> On real systems, TOTP secrets are long random strings (the Golang TOTP library, for instance, draws 20 random bytes from urandom). You can't brute- force them.

There are libraries (looking at you, Ruby) with interfaces that ask callers for secrets, and have demo code passing intelligible strings through. You don't need hashcat to know the problem there. There is no reason at all for a TOTP secret to be anything but 128+ bits of cryptographic randomness.

<comment><USER6> Operator error is a possible reason for a TOTP secret to be inappropriately brief.

<comment><USER7> Maybe if you count the webapp programmer as the operator. For something like 2FA the end user doesn't pick the secret.

<comment><USER8> The app programmer is definitely considered as an user (or operator) of cryptography libraries.

That's what the "user misuse-resistant" best practice is all about: designing tools robust to wider levels of user expertise.

</comment></comment></comment></comment><comment><USER9> This may be a minor nit to pick, but I am finding it harder and harder to manage my TOTP keys.

I have now got 4 different TOTP apps on my phone, variously from my own need (ie grab Google Authenticator to use 2FA for Github) and mandated by clients / companies (use the RSA / Symantec / foobar app and scan this QR code)

It then turns out that every 2FA provider assumes your 2FA app will have only their code on it. So the setup process never uses the label function, and I am left with half a dozen ticking clocks, guessing which one is the right one for this site.

I have even doubled back and re-signed up just to be able to enter the long password manually so I can then enter the label manually.

(I think this is a long winded way of saying i want a TOTP app that allows me to edit a label post-hoc, or i want TOTP apps to force providers to enter a web site name in the QR code creation step)

I am eagerly looking for signs of a FIDO surge, but I am doubtful.

<comment><USER10> I had exactly the same problem (exacerbated because Latacora: 4-5 secrets per client x N clients == too many secrets) and I started using the Duo Mobile app because of it (yes, it does Duo push, but it'll also read TOTP).

<comment><USER9> I will give that a try too thanks

</comment></comment></comment><comment><USER11> To summarize: short keys are easy to brute-force. Nothing new here.

</comment><comment><USER12> So.. using 20 random bytes instead of 10 should be enough to make this pretty much infeasible?

<comment><USER10> 10 bytes, or 80 bits, is cutting it, but realistically fine for now if it's actually random. The problem isn't that it's 10 bytes, but rather that it's 10 bytes of _ASCII text_. English prose is only about a bit per letter (!!!). If you randomly select 10 base32 symbols: each symbol has log2 32 = 5 bits of entropy (as opposed to the full 8 it ought to have if it was a randomly selected byte), and 10*5=50 is insufficient :)

To understand why prose entropy is so low: if I tell you the sentence "Old McDonald had a" then you can predict the next word with approximately perfect accuracy. Clearly, if they were random they would be independent.

If your threat model includes quantum search, you need twice as many bits. (I'm intentionally ignoring that HMAC-SHA1 only has a 160 bit output space.)

<comment><USER2> The minimum allowed (and the common default) is 16 bytes of ASCII text, not 10.

<comment><USER10> Sure? The article addresses this: the RFC says it's the minimum, but apparently most clients will allow less, and sometimes (allegedly) servers produce less. I'm not sure I understand your comment: it's still responsive to GP's question.

<comment><USER2> Could you quote the sentence you're referring to?

<comment><USER10> Mind you: to wit, the TOTP RFC defers to the HOTP RFC, and that insists on at least 128 bits or something, so 16 pseudorandom bytes, not 16 ASCII bytes as you said :) But if you grep the article for "10 byte", you'll see the part where it claims that confusion about byte counts of encoded or unencoded secret results in the 10 byte claim.

<comment><USER2> Actually, it says that implementations use 16 bytes of ASCII and that's only equivalent to 10 random bytes. It doesn't say implementations use 10 bytes of ASCII.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> What does it mean "Hack the planet"?

<comment><USER10> It's a reference to the 1995 cult movie "Hackers".

</comment></comment><comment><USER14> I just checked my bank app, it uses a variant of TOTP with a 10 character numeric secret... luckily salted with my own password, but still, not very fond of this.</comment>


'Germanwings passenger video' is authentic, says French magazine - <AUTHOR> http://www.theguardian.com/world/2015/apr/01/germanwings-passenger-video-authentic-paris-match

<comment><USER2> A phone recording surviving the crash isn't too implausible. Remember that it doesn't need the whole phone to come through in one piece, only the memory chip (possibly an SD card).

On the other hand, the reason I'm very skeptical about this story is this part: "Near the end there was reportedly a heavy shake and the cabin tilted sharply to one side. After further screams the video ended, Bild said."

The impact speed has been estimated at about 700 km/h, or about 200 metres per second. The fuselage of an A320 is 37 metres long. First impact to complete destruction would take about 1/10 of a second; the described sequence of events takes far too long to be plausible. (The only way it might work is if the first impact was on a wingtip.)

<comment><USER3> "The aircraft clipped a mountain ridge, then crashed into a mountainside at 9.40."

[http://www.telegraph.co.uk/news/aviation/11498132/Germanwing...](http://www.telegraph.co.uk/news/aviation/11498132/Germanwings- Airbus-A320-tragedy-cockpit-recordings-reveal-co-pilot-Andreas-Lubitz-crashed- plane-deliberately.html)

</comment></comment><comment><USER4> "but French police say story is false" ... ""Considering that everything on the plane was destroyed, it would be unusual for a mobile phone to survive the impact""</comment>