Physics tests with a female bio get worse grades from inexperienced teachers - <AUTHOR> http://arstechnica.com/science/2016/01/give-teachers-a-physics-test-from-a-girl-and-theyll-give-it-worse-grades/ <comment><USER2> Looks like a null result that has been p-value hacked. Without the (paywalled) original paper it's tougher to say, but:

The effect only occurs in teachers with less than 10 years experience, and only teachers in Switzerland and Austria, not in Germany. Population of Germany: 80 million. Population of Austria: 8 million. German speaking population of Switzerland: 5 million. Approximate average career length for a Physics teacher in German speaking countries: 30 years.

So about 4.5% of their sample exhibited a bias against girls. The typical p-value to accept a result is .05. If we sliced and diced the sample into 20 groups, we would expect one to show a significant effect at p<.05, which is exactly what they showed. Note that they did a retrospective analysis based on years of teaching experience, gender of teacher, country of teacher, and fake major of student. There are plenty of combinations of subgroups to find something that makes it over the p<.05 hurdle.

Can't find a non paywalled full text of the original paper, but it looks strongly like p-value hacking a null result to me. They found no effect in 80 million population Germany, and only an effect among teachers with less than 10 years of experience in 8 million population Austria and 5 million population German-speaking Switzerland. If we assume that their sample is evenly distributed across German speaking Europe (The test question was in German),

</comment><comment><USER3> The one-time generic ID thing is an excellent idea.

In fact they should have run a control like that.</comment>


The Struggle for the Soul of Ben and Jerry's (2014) - <AUTHOR> http://www.greenmoneyjournal.com/march-2014/ice-cream/ <comment><USER2> Just a heads up littlewing, your comment is marked as dead. I went through your profile and it doesn't look like any of your comments were particularly offbase enough to warrant the shadowban so I'm not sure what's going on.

</comment><comment><USER3> Selling your company is like giving up your child for adoption in exchange for cash. If you are really incapable of taking care of your child, then you are doing the right thing and need to accept that and move on when the new parents don't do things the way you did.

If you can't live with giving away your child for money, you never should have given it up.

As much as I like Ben and Jerry along with the company and ice cream they made famous, Unilever is not the bad guy.

The partners that owned the company I worked for sold out like this. It's been really frustrating to see how it affected them and their employees, and the morale on our team dropped significantly. We all said that "they deserved it" because they were paid for their effort and sacrifice. But, we are also feel sorry for them, because to get compensated for their hard work, they inadvertently sacrificed what made the company great. We often blame the new parent company, but it isn't their fault.</comment>


How Rich Is Rich? - <AUTHOR> http://finance.yahoo.com/focus-retirement/article/110295/how-rich-is-rich?mod=fidelity-buildingwealth&cat=fidelity_2010_building_wealth

<comment><USER3> True wealth is how long you can maintain your preferred lifestyle without working. By scaling back, you become wealthier.

<comment><USER4> Only if you can manage to "prefer" your new, scaled-back lifestyle.

<comment><USER5> I think 'manage' is not quite the right word. I am sure there are plenty of people out there who _could_ be happier while spending less- the ones who are spending in search of happiness.

</comment></comment></comment><comment><USER6> >Over time, the shape of your nest egg would resemble a bell curve, growing in the early years, and then declining as inflation required you to withdraw more money to maintain a lifestyle equivalent to $300,000 in 2010. The $12 million would finally dwindle to $934 when you turned 100.

My bank is offering savings accounts that pay, like, .01% these days, so it's not so much a bell curve as just the right half of a bell curve. You can get a bit more interest from investments, but your risk goes up too. It would suck to be 50 after 15 years of not working and find you don't have any money. Would you even remember how to tie a tie?

Anyway, the big wild card is health care. Nobody will insure you as an individual if you have a health problem, and the bills you can rack up at the hospital are almost open-ended. I went in for just a couple days last year and they billed my insurance $26k.

It's not at all clear to me the changes the Democrats made last year will survive the next. I'd want at least 4-5 million in the bank just to feel secure on medical.

<comment><USER7> Over the last 30 years mortgage rates have decreased and with that savings rates (the less it costs to lend money, the less you pay to purchase money). An emphasis was placed on creating wealth in home equity and the stock market vs. saving from your job/paycheck, and living off interest in retirement. Unfortunately it's hard to turn things around (deflation causes depressions) and we have to accept that it's going to take time. Our generation will never see the increase in home prices the way our parents and their parents experienced. The same goes with the stock market. We're overextended and it will take time for things to even out. Being rich is having the amount of money that allows you to live the life you wish to lead. It's going to be more difficult for our generation to reach that point, but you can never go wrong with saving and preparing for retirement.

<comment><USER8> Not to mention the health care bill that the Boomers will generate. One way or another I think our generation will end up footing the bill for the extended lifespans of the Baby Boomers.

</comment></comment></comment><comment><USER9> Now all that living without working stuff is not quite right, i think. What if you don't work at all. Sure you can work not, and be non productive. But what does that mean for your life?

I want to work and i want to learn constanly. I don't want to be rich. If i would be i don't want to life on the money by myself. I just want to life and money is by far not everything.

What the hell is wrong with the persons that brand their lifes to "getting rich is everything"? I think that is actually what anoys me most with startup culture today. Its all about success, high exits, getting rich. Make as much money as you can in a short time.

But what for? What did you really gain from that? A burnout? A million? A few millions? And then you probably end like a austrian millionare and donate all your richness, before you really retire, just to life again and don't have to worry about all that richness.

<comment><USER10> The point of money is that it enables to choose what you want to work on.

Look at Elon Musk. If he didn't have all his PayPal money he wouldn't have been able to found Tesla or SpaceX

<comment><USER9> Sure, but how many people that have money, put their money into something useful, actually?

<comment><USER8> I don't think it is about putting money in as much as it is about putting time in.

So to shift your question a little, how many people that have money put their time into something useful? I think this number is quite high. Whether it be building new ventures or doing volunteer / philanthropic work. Once you don't have to "make a living" you get to decide what is important to you and live accordingly.

</comment></comment></comment></comment><comment><USER11> This article talks about two different things. First, it talks about how much money one would need to live comfortably in different parts of the country. Second, it talks about retirement.

I have a question about the latter. Does anyone else notice that the retirement articles are always written by the same old school business journalists, in this case CNN Money?

I think this article illustrates a major difference between our generation (I'm 24) and previous generations. The retirement conversation always revolves around living off of a nest egg investment that will hopefully be enough to survive on later in life.

Let's change the discussion to be about earning income regardless of employment status. Anyone banking (no pun intended) on a 401k to sustain himself in 40+ years is nuts imo.

<comment><USER8> Why is that nuts? A 401k is hardly a pension. Once the money is in it is your money. If you were to start putting 10% of your income into your 401k or IRA now, you would be able to live off it in 40+ years easy.

Yes, I think passive income is great. Most of my income is passive and I plan to keep growing that part of my life, but that doesn't mean it is a fool's errand to have a retirement account.

<comment><USER11> 10% is a considerable chunk. This is especially true for someone straight out of college who doesn't have a high income to begin with. You could argue that his/her expenses are lower than someone with a family, but the counter to that again is the income. Someone with a family isn't making a starting salary anymore.

Another problem I have with the 401k is that "most" people leave it in the hands of fund managers who we're told know what they're doing. I'm one of those that leaves it to a fund manager as well. The biggest argument for the 401k is that the market will perform X% by the time you retire based on historical data. This assumes that trend will continue and that you don't unexpectedly lose a chunk of it as many retirees did in 2008.

Another problem I have with the 401k is that it's incredibly illiquid. If you take money out before you retire you're strictly penalized.

I'm not saying don't invest in the 401k. I invest in it, but only enough to get my employer's full match. If someone is offering you free money, you take it. I'm suggesting that it's better to take control of your own finances and earn enough passive income to live on. The 401k money should be a bonus, not the salary.

</comment></comment></comment><comment><USER12> _Indeed, few experts think a million is enough to quit your day job._

I hear the startup crowd screaming "Wha!" $1m is more than enough of a safety blanket to quit your "day job" and work on your own ideas for even a decade or more. This article clearly assumes being rich involves "not working", yet all of the rich people I know personally are perhaps the hardest workers I know.

<comment><USER13> The truest measure of wealth is the degree to which working becomes a choice. It's a continuum - a little wealth gives you short-term freedom like choosing to start a business, whereas $10m+ gives you the option of doing whatever you like for the rest of your life without worrying about an income.

I suspect most people have things they like to do if they suddenly came into a large fortune, but continuing at their day job is rarely one of them. Actually, with people who win the lottery you often see the opposite - <USER2> don't need to work, but they feel pressured to do _something_ and often end up losing spectacular amounts of money in foolish business ventures.

</comment></comment><comment><USER14> I spent a few month in rural Nepal (think $10/month for rent). An ipod, digital camera and a few grand in the back account was enough to be considered uber-rich. It's all perspective.

Sidenote: Now im back in the startup game and im just as greedy as every else

<comment><USER15> An IAMA on reddit would be very interesting. Plus you'll get some publicity for your startup.

</comment></comment><comment><USER16> Key quote from the article: "Kaye cautions not to confuse wealth with income. Some people can make a million a year, but be spending a million and a half. They are not rich, said Kaye."

<comment><USER17> Of course they're not rich. What a silly thought. They're poor people with penthouses, Mercedes, caviar and champagne. Umm...

</comment></comment><comment><USER18> I think it's hilarious that people are aspiring to 'retire' at 35 --> they must have picked the wrong occupation to begin with!

i can't imagine a day when i won't want to work on something that i'm passionate about --> will i ever really retire?

</comment><comment><USER19> Har har, $3800/month for a NYC apt that makes you feel rich? Try $6500++

<comment><USER10> They also include another additional twelve grand in spending money each month.

I'm probably showing my stinginess here but I'd be vaguely baffled by how to get through that amount of spending money each month.

<comment><USER6> I think you could do it pretty easily in NYC if you started riding limos around, buying designer clothing, and going to tony restaurants.

</comment></comment></comment><comment><USER20> Is this...

> according to Steven Kaye, president of Watchung, N.J.-based wealth > management firm American Economic Planning Group. He based that number on > real-life figures his clients tell him they need.

...an example of this? -

<http://www.paulgraham.com/submarine.html></comment>


Outbox Makes Your Snail Mail Digital, Launches in SF - <AUTHOR> http://techcrunch.com/2013/02/25/outbox-digitizes-sf-snail-mail/

<comment><USER4> What a brilliant idea, all the way from 1999! Back then it was called PaperlesPOBox. EarthClassMail came several years later (2008) and offers additional conveniences.

The iPad makes everything better! (sarcasm)

On a more serious note: I think the USPS should offer this service. Why trust a private company with it?

On a practical note: good luck trying to prove your residency for public schools if your snail mail is forwarded to an address in another state.

<comment><USER5> You don't forward your mail. They pick it up at your mailbox.

<comment><USER6> (You actually can't forward your mail for very long; you can get a half year, and sort of a year, but the post office really doesn't apparently want to be in the position of being a routing system.)

<comment><USER7> Which is really a shame, actually.

I would love to have a virtual address, such as

        Mr. Beagle3 Esq
        742 Virtuality Road, Suite #3971
        c/o Monopod Iridium Violet
        Cyber, NY 19997

And would happily pay a few tens of USD per year for that to be forwarded to an address of my choosing, and also last-mile routing (e.g., if this address "resolves" to AZ, I accept paying for the NY->AZ resent -- even though, if properly managed, this would be resolved at a stage where a resend will not be needed).

Oh, and in case you wonder - the address including suite, c/o, city and zip code should together form an error-correcting code, so that e.g. a one digit error could be automatically corrected -- because otherwise, a one digit error would reach AZ instead of NY and vice versa.

</comment></comment></comment></comment><comment><USER8> All other problems aside: how can they afford to send someone to my apartment 3 times a week for $4.99? Seems like gas alone would be exceed that.

My assumption is that they can't, and the plan is to burn through VC money with the hopes of getting some sort of eventual deal with the postal service.

<comment><USER9> Not if they have the right density. I think their business model is viable at scale.

Assume they pay their pick-up guy $20/hour. Each customer is paying $5 for 12 pickups = 60 cents a visit. To break even they will need to do pick-up 33 mail boxes/hr. This seems like a lot in a suburb but it's possible in a dense city. They will probably need to tweak their model but it's not unreasonable.

<comment><USER10> That's just to pay the pickup guy. You have to pay for gas. And the costs of operating a batch scanning facility for mail. And most mail is not of uniform size and does not have uniform contents, so you end up having to manually open and scan the items.

It's totally unreasonable. The only place it makes even a hint of sense to do this is at the Post Office, before it goes to the actual customer. The customer could then choose scan, shred or deliver.

Maybe I'm just not clever enough to get it. But this just seems ludicrous to me.

<comment><USER11> Their idea is to make revenue from additional sources other than just the monthly fee.

<comment><USER10> What might those be? The check cashing and bill pay mentioned are already offered for free by banks. Diversion of junk mail marketing $ into "effective methods" of marketing is pretty cryptic. I think creating some online equivalent of postal mail would be interesting (there are things like notarized letters, etc that still seem to require snail mail), but I don't see how this service as currently implemented really does anything novel. Scanning your postal mail is tedious and cost ineffective...whether it's done by a startup or not.

</comment></comment></comment></comment></comment><comment><USER12> Most mail is junk. What happens to that?

Are you going to scan a single catalog and throw the rest away? That won't work because some have specific codes required, so you'll have to know which those are or perhaps scan every catalog cover. Some catalogs are going to be hell. Just to name a few: Sweetwater has a fairly long one; Blick's art supply catalog is bigger; Both are free and have wide distribution.

Where do you draw the line between package, parcel, and letter? What do you do when it is filled with confetti? What if it contains cash. Seriously.

Musical Hallmark cards anyone? Are you going to record them? No? Ok, then.

This is a neat idea and works for some things, but is also very seriously impractical and insecure for the customer, and a terrible mess on the business side.

Add to that that people (especially women I'm told, but I know of no studies to prove that) enjoy real magazines. I personally enjoy getting things in the mail. It is like a gift. I don't enjoy getting email.

<comment><USER13> I have used VirtualPostMail.com for several years and this is how it works. They scan the front and back of the envelope (front only for a parcel) and email you an alert. You view the scan and decide whether to scan the contents. For instance, you would not scan obvious junk mail, but click on the recycle button. For large catalogs, they stop at 35 pages and ask you if you want the whole thing at an extra charge. For parcels, magazines, or documents you want the original for, like musical valentines or credit cards, they will ship it to you at your physical address. If you receive a check, they will send it to your bank's PO box for depositing. Check their website for more inf.

</comment></comment><comment><USER14> I use a service like this in Sweden (abuni.se). You change your government- registered mailing address to a virtual PO box number with them, and all the companies and agencies that pick your address from the government database (probably 80% of them in Sweden) will start using it.

Then they scan all your mail and send it to you as PDFs, as well as archiving it on their site. I've also authorized them to do direct debits with my bank, so now they automatically pay any bills I get on paper for me automatically on the due date.

I've been living out of the country for over a year (I haven't even had an apartment in Sweden), and this system has worked great.

<comment><USER15> What happens if I send you a false invoice, would they still pay it?

<comment><USER14> I have to approve each payee separately (by checking it off on the site)

</comment></comment></comment><comment><USER16> I've been using Virtual Post Mail [0] for about 2 years, it has been excellent. It's a bit more expensive and the implementation is different but the end result is similar.

[0] <http://www.virtualpostmail.com/>

<comment><USER17> I'm another VPM customer, for a little over a year. I like it and I plan to continue using it, but the website is definitely a little clunky and could use a redesign. Still, it's better than all the competing services (at least as of a year ago when I did my research).

</comment></comment><comment><USER10> This idea just doesn't seem to want to die.

I saw an investor presentation for Earth Class Mail back in the day. They would scan the front of your mail, and then you could choose which items to have them open. They would then have to manually open and scan the items you instructed them to open at additional cost.

Earth Class Mail blew threw most of their funding ([http://blog.oregonlive.com/siliconforest/2011/01/earth_class...](http://blog.oregonlive.com/siliconforest/2011/01/earth_class_mail_attempts_rebo.html)) and rebooted with a different focus.

I don't see how this company plans to run a courier service to collect your mail from random places, then scan it, for $5 a month. The economics make 0 sense.

More importantly, snail mail is dying off. This is like building a business to make your horse and buggy move faster just as the automobile is being developed.

<comment><USER14> Faxes are also dying out, but there are plenty of companies making a living off of e-fax services.

Although I agree the economics of picking the stuff up out of your mailbox makes little sense... Mail forwarding or PO boxes would be far more efficient.

<comment><USER10> Any business is about balancing cost structure with revenue potential. For an e-fax service, once you invest in the initial infrastructure (and these days, there might not even be much fixed cost investment.... link together Twilio and a website for example), you are probably making money at $10 a month per customer. So it doesn't really matter that fax usage may be decreasing...there are still lots of people using fax machines and you make more money than it costs you to run the service.

My point with the mail pickup thing was that they could never make it scale. Their costs will kill them in the short and long term...even if they get a lot of customers. That is why the e-fax service works and the mail service doesn't.

</comment></comment></comment><comment><USER18> This is a mass credit and identity theft waiting to happen.

First of all, they're not gonna be able to do the collection themselves, they will contract it out. Then any contractor has power over all the mailboxes under their management. The contractors, their employees, or anyone who reverse engineers any single route & collection times can carry out mass credit applications, online shopping and everything.

</comment><comment><USER19> This is truly some next-level stuff. Very compelling price, and it seems like a very well thought out revamp of an existing paradigm.

Obvious concerns:

      - <USER2>
      - <USER3>
      - how easy is this to set up? to cancel?
      - how timely is this?
      - how accurate?

</comment><comment><USER6> In addition to not using the anti-credibility keyword "beautiful", Earth Class Mail (which I currently am using) seems to be a much more useful service offering (as it doesn't rely on people attempting to obtain your mail from your current address, nor does it rely on the idea that your current address even has relevance or permanence).

</comment><comment><USER20> It seems like a lot of work for them to swing by your physical address multiple times a week.

The other services that do this allow you to have mail delivered to a mailbox that the company controls and then mail that you actually want can be forward to your home mailbox.

</comment><comment><USER21> When I first read this, I was thinking, "Wow, cool idea!". Now I feel kind of sad – the need for this service really highlights the inefficiency and waste of paper mail.

</comment><comment><USER22> I'd be curious if USPS could acquire them (they still have resources), and then roll out this service much faster? I'd pay $5-10/month for this from USPS.

</comment><comment><USER23> similar to EarthClassMail which had a documentary: www.hulu.com/start-up- junkies</comment>


Puer – more than a live-reload server, built for efficient front end development - <AUTHOR> https://github.com/leeluolee/puer <comment><USER2> For the uninitiated, it's named after Pu'er Tea[1], a fermented Chinese tea that was made infamous by a previous imperial taste for the stuff and originates in the town of Pu'er[2] (recently renamed Ning'er), in Simao prefecture[2] (recently renamed Pu'er), Yunnan Province[3], China. The area is at the historical frontier of China, bordering Tibet, Burma, Laos and Vietnam. Ning'er is notable for its specific altitude and soil. The same variety of tea was also grown in Yiwu, Xishuangbanna, a town so small and otherwise without note that it lacks a Wikipedia entry. Last time I visited, they had a wild monkey locked in a cage, probably for sale for the (no bullshit) Chinese delicacy of live monkey brains.* The second area was probably traded through a different, more easterly route to the north via Jianshui[4].

[1] [https://en.wikipedia.org/wiki/Puer_tea](https://en.wikipedia.org/wiki/Puer_tea)

[2] [https://en.wikipedia.org/wiki/Ning%27er](https://en.wikipedia.org/wiki/Ning%27er)

[3] [http://en.wikipedia.org/wiki/Puer_Prefecture](http://en.wikipedia.org/wiki/Puer_Prefecture)

[4] [http://en.wikipedia.org/wiki/Jianshui](http://en.wikipedia.org/wiki/Jianshui)

* I lived in the area for 2.5 years.

<comment><AUTHOR> thx for kind reply.

My girl-friend also lived in Kunming, and I love the Pu'er tea, so 'puer' comes out. :)

</comment></comment><comment><USER3> Reminds me of this:

\- [http://gaearon.github.io/react-hot- loader/](http://gaearon.github.io/react-hot-loader/)

\- [https://github.com/gaearon/react-hot- loader](https://github.com/gaearon/react-hot-loader)

</comment><comment><USER4> It's also the french for "to stink"

... Sorry

<comment><AUTHOR> So sad to learn it.

I think I should learn French Seriously

<comment><USER4> Fais le!

</comment></comment></comment><comment><USER5> How is this any better than BrowserSync [1]?

[1] [http://www.browsersync.io/](http://www.browsersync.io/)

<comment><AUTHOR> @kolev great question.

1\. First,I need to say: puer is created before browser-sync (more than one year).

2\. puer provide some features that browser-sync that not supported(debugger, mock request, qrCode generate etc.)

but puer is not support the user-action Synchronization that browser-sync supported.

puer is aim to providing a simple foundation for common frontend workflow .

<comment><USER5> Thanks for providing this to us and for your great contribution to the FOSS community!

</comment></comment></comment><comment><USER6> For the rubyist, Middleman [1] is really nice alternative. It also includes live reloading [2].

[1]: [http://middlemanapp.com/](http://middlemanapp.com/)

[2]: [http://middlemanapp.com/basics/livereload/](http://middlemanapp.com/basics/livereload/)

</comment><comment><AUTHOR> The last two years, puer is nearly a personal tool for myself(and some clever colleague ). so the project may looks poor. if people also like it, I will do my best to make it better (document, gulp & grunt support, public api, etc) :)

</comment><comment><USER7> so useful</comment>


Show HN: I'm offering consulting for non-technical folks and startups - <AUTHOR>

Inspired by a good friend who did Unstick.me, as well as the recent MVP for 1k project, I've decided to give consulting a shot by offering my services as a developer and product guy to non-technical folks and early-stage web startups who are looking to brainstorm on both the technology and product side, and possibly looking to have an MVP built based on their idea.
I started accepting requests the other day solely with a Wufoo form, and just launched a proper one-page site here: http://youshouldworkwith.me/
Curious to hear feedback on the offer and idea in general. It's the first time I've tried any kind of "alternative" consulting like this. <comment><USER2> Good luck Kyle. It will be interesting to hear if you get any takers.

One thing I wonder is if the kind of people that would take up an offer like this have the means to pay for it. As in: do the "idea guys" that can't find technical guys have enough money?

One angle you might want to consider is the sanity check - going over the technical merit of an idea/early stage product/architecture. This could be for both the idea guy and technical guy. A company that is a bit further along would have more cash.

And for those on about the rates: that rate for two hours is not bad.

<comment><AUTHOR> Thank you. I actually already have about 15-20 hours scheduled (most prior to launching the actual one page site), plus a couple entries on the MVP form.

I'm still trying to figure out the best way to angle this, but my ideal customer is an "idea guy" who does have the means to pay, an interesting idea, and "gets it" with regard to what it actually takes to build a product.

I do like the idea about involving some kind of idea sanity check, though I'm kind of doing that as folks contact me — I'd rather tell them that it's not really a viable idea as is, and spend a little time working through that, vs. take their money for the 2 hours or MVP product just because I can.

</comment></comment><comment><USER3> Simple and clean, both the offer and the site; I like it.

You might want to think about some kind of satisfaction guarantee. I for once might have a problem shelling out $400 for a 2h talk with a guy I never worked with without one. I'd actually make it a "money back plus a beer on me" guarantee.

If you had a stackoverflow account I'd definitely link to it; too bad it's not possible with Forrst.

I'd also publish your HN karma. Seriously. A big, automagically updating number, showing that you really _are_ about community, sharing, brainstorming and all that jazz. :)

<comment><AUTHOR> Thank you. I think that's a great idea — I'll update the site right now. Neat idea re: karma, though not sure how much weight that would have for the types of folks I (think) I'm targeting. Couldn't hurt, either way though!

<comment><USER3> Ah, a good question to ask your non-technical clients then: what community sites like HN do _they_ peruse?

Anyway, I know that if I'd seen a "karma" number over 1k, I'd be impressed even if I had no idea what it meant.

<comment><AUTHOR> Definitely a great question to ask. Re: the karma - couldn't hurt to throw that up there then.

</comment></comment></comment></comment><comment><USER4> I like this consulting idea, but wouldn't you agree that the power of collaborative feedback via a question on HN is more powerful than a $200 hour with one person? Just my 2cents.

<comment><AUTHOR> Thanks. I think that it's likely a combination of both. Also, I'm looking to help so-called idea guys - folks who probably don't use HN, but have an idea with potential, and a little capital to throw at it. FWIW, folks who turn to HN for guidance and feedback probably aren't the target demographic anyway, and they certainly wouldn't need my help :)

<comment><USER3> I wouldn't cross the hackers out. People who hang out here are usually aware of all the technical/organizational challenges of building a scalable website with great UX, but lots of us could use some one on one guidance from someone experienced every now and then.

</comment></comment></comment><comment><USER5> Looks Great. Good Luck Kyle. BTW I am a loving user of Forrst. That being said, I think your link to forrst is buried too low in the copy. Maybe put it up top with something like "I can help you make products like this...LINK". Just took me a while to see the Forrst link and make the connection.

</comment><comment><AUTHOR> Clickable: <http://youshouldworkwith.me/>

</comment><comment><USER6> › 2 hours of consulting for $399. Are you for real??

<comment><USER7> It's a reasonable rate, but it would normally require a better resume _presentation_ than what's there at the moment. Great to know that Kyle did all this stuff, but what's more relevant is what he did _exactly_. Did he draw the ranger guy for Forrst or did he plan the server hardware allocation or did he just hack on some code... that sort of thing.

I've seen my share of product consultants, and they primarily specialize in invoicing. There are some exceptions, of course, but generally the amount of BS/hour is very depressing. The site needs to do a better job to explain that Kyle is not of their kind.

<comment><AUTHOR> I agree that I'm not exactly selling myself well enough. Wondering if it's worth showing that on this site, or just discussing in more detail with interested parties. I do agree that I'm not doing the best job of setting myself aside from the invoice pros.

</comment></comment></comment><comment><USER8> I like the website, clean design and to the point. Great domain too. Good luck!

</comment><comment><USER9> I would start out lower. Gain some feedback (testimonials) then ramp up the rate. As it is, I don't know you from adam.

<comment><AUTHOR> Point certainly taken. I actually (surprisingly?) have a bunch scheduled, so presuming all goes well, I'll have some real feedback and hopefully folks vouching for what I'm doing.

</comment></comment><comment><USER10> languages and db experience?

<comment><AUTHOR> I thought about adding that but didn't want to emphasize one technology stack over another, at least not on the one-pager.

That being said: PHP, Ruby, some Python; Mysql, Postgres, Mongo.</comment></comment>


The man who 'nearly broke the internet' - <AUTHOR> http://www.guardian.co.uk/technology/2013/may/20/man-accused-breaking-the-internet

<comment><USER2> The interesting thing about hacking now-a-days is that the security specialists have the same tools as the hackers at their disposal, thus the sooner the hackers realize that they can't hide anymore, the sooner we can have some peace (read: just go back to shooting at each other).

Now we just need an in depth interview conducted by The Atlantic or someone to round off this terrific news story.</comment>


Germany's Dangerously Flawed Energy Policies: It Needs Nuclear - <AUTHOR> https://www.project-syndicate.org/commentary/germany-nuclear-power-by-hans-werner-sinn-2019-05 <comment><USER2> Sigh.

I read the papers, and don't see anyone applying for permission to build replacements for the nuclear plants that are being decomissioned. Why not?

My guess is that the taxpayers won't insure nuclear generation against accidents/cleanup anymore. (There are also rules that would need to be changed, but those rules have been changed before.) It might be possible to get permission to build nuclear plant if the operator has liability insurance and a safe way to store the waste, but not without that.

And AFAICT, if the investors/operators need to pay for insurance and waste disposal, then nuclear power is too expensive compared to either building spare wind/sun capacity, learning to limit electricity use, or a combination.

I'd be happy to learn better. But these "thinktank" pieces aren't thoughtful. "X has disadvantages or problems, therefore we must do Y" is just pretense. What Y in the real world comes without problems or disadvantages?

</comment><comment><USER3> There is nuclear next door in France. Just use that as baseload. Also you could build a bigger interconnect to Norway and dump excess power in pumped storage. Many of the problems with energy in Europe are to do with insufficient capacity in international connections. Add interconnects to the east and you can sell excess wind and solar to Poland, Ukraine, and Russia, etc. Improve the connections to Spain and you can buy Spanish solar in the early evening when your own has stopped producing.

Above all: stop trying to solve each country's problems alone, stop thinking that borders between countries are a problem.</comment>


JQuery Combinators: Make any function into a jQuery method - <AUTHOR> http://github.com/raganwald/JQuery-Combinators <comment><USER2> Very nice.

Although I think the documentation would be better served by first showing the code. Its very short and very self explanatory. It's double awesome that it hooks into Functional Javascript.

Here is the code:

        ;(function ($) {
          $.fn.K = function (fn) {
            fn = typeof(Functional) != 'undefined' ? Functional.lambda(fn) : fn;
            fn(this);
            return this;
          };
          if (typeof($.fn.tap) == 'undefined')
            $.fn.tap = $.fn.K;
          $.fn.T = function (fn) {
            fn = typeof(Functional) != 'undefined' ? Functional.lambda(fn) : fn;
            return fn(this);
          };
          if (typeof($.fn.into) == 'undefined')
          $.fn.into = $.fn.T;
        })(jQuery);

</comment><comment><USER3> I think he should use simpler and more direct examples. I mean, Go only make the example more complicated with the intersection and stuff. It's like if I'm trying to show how filter works by using a 20 lines example of a game.. why not use a simple <p> and show what you can do with it in a simple one liner?

Ok, I know why, since it's functional stuff and more than that, COMBINATOR STUFF, it _needs_ to be more complicated than what it should be.

<comment><USER4> Or it could be that those are examples from his own code and he simply copied and pasted them without thinking that they might not be as useful as contriving more simple examples.

Do you have some examples you can suggest?

<comment><USER3> Actually, yes. At the end of his "tutorial", he explains in more succinct words what those functions do, and he use simpler examples. I suggest that instead of hiding them somewhere at the end in the middle of a paragraph, he put them in emphasis at the begin of the document.

<comment><USER5> You're talking to the author.

<comment><USER6> Shhhh!

This is good. :)

</comment></comment></comment></comment></comment><comment><USER7> I was playing a bit with this code last night and made a slight variation for some code I was writing, which I find easier to use

      //K variation
      jQuery.fn.run = function(fn) {
        var args = [].slice.call(arguments)
        args[0] = this
        fn.apply(this, args)
        return this
      }
      //contrived example
      var add = function(el, a, b) {console.log(a + b)}
      //no need to curry
      $(".foo").run(add, 12, 34).addClass("bar")

<comment><USER4> Your wish is a contributor's command:

[http://github.com/raganwald/JQuery- Combinators/commit/728713...](http://github.com/raganwald/JQuery- Combinators/commit/728713ee8bb1477d3ba383b7f63361298217bb3c)

I avoid passing a function and its arguments in the same list but it's purely a personal preference and adding the code doesn't remove any existing functionality, so it's in.

<comment><USER7> Yeah, looking in retrospect, binding the this keyword to the function already exposes the jQuery object inside the function, so the first argument in my version was redundant.</comment></comment></comment>


UK ISPs Block Pirate Bay's Artist Promotions  - <AUTHOR> http://torrentfreak.com/uk-isps-block-pirate-bays-artist-promotions-121202/ <comment><USER2> Regulating free speech is difficult.</comment>


Show HN: Colorpage – Web app to choose background color for your webpage - <AUTHOR> https://github.com/viveketic/colorpage <comment><USER2> This is neat, but I think you should tweak how the font colour is determined - it's incredibly hard to read sometimes when you have a hex like #ff6600 and the text is essentially pink. Maybe take a gander at the WCAG guidelines [https://www.w3.org/WAI/standards- guidelines/wcag/](https://www.w3.org/WAI/standards-guidelines/wcag/). Otherwise, looks good.</comment>


Releasing Outside The App Store - <AUTHOR> http://mattgemmell.com/2012/08/24/releasing-outside-the-app-store/

<comment><USER2> Do you want to be a sharecropper? Or do you want to own your own business?

I've had vaguely uncomfortable feelings about the app store concept on phones from the very beginning (and I've commented on those misgivings here on several occasions over the years, to mixed response), and I think all of the concerns I aired back then are coming to be proven to be real problems. When you sell an app via these stores, you don't have a customer...you have a sale. A customer is more valuable to a software developer than a sale by a _vast_ amount. A few thousand customers can sustain a business indefinitely.

Customers can help you make your product better, and you can help your customer get more value out of the application (which means they'll be happy to pay you more). Customers can be rewarded for recommending your application to friends or coworkers. Customers can help support your product in your forums or support tracker. Customers can end up becoming your best employees (our first employee is someone who used our Open Source stuff for years, and was one of our first buyers when we created a commercial product; he's a true believer in what we do). A sale without that direct customer relationship is just a sale.

I have hopes that this is a temporary anomaly in an evolution toward a more open web with more direct connection between developers and users, but I don't have a very high level confidence in that outcome. But, I can encourage folks to not become sharecroppers, I guess.

About 15 years ago, there was a really common sentiment among tech industry titans that curating the web would be where money was made (which led to things like push content, and "portals", which mostly failed, or evolved), and this seems to be that same idea coming back in a new form. But, the curators are simply extracting value from developers and users without substantially improving the ecosystem...in fact, they're kinda bleeding the ecosystem dry, and enforcing a "software-as-commodity" model...it's Walmart applied to software. Which is a pretty dangerous situation, I think, for independent software developers, and probably only serves the largest corporations.

<comment><USER3> That's a good point, but I think you're actually conflating two independent factors.

All else being equal, I wouldn't like working so that I can be shut down by another company at their whim. Nobody would.

But at the same time, I can get "customers" from App Store sales. Whether you develop your sales into customers is entirely independent of whether your work is hosted (and veto-able) by someone else.

For example, I bought an app on the App Store, and found a nasty bug in it, and so I sent an email to them. I got a personalized response, and started a dialog with the programmer. I've reported many issues and requested some features, was given a pre-release beta to test, and after a few weeks, the next release had my bug fixed. A "sharecropper" under Apple, perhaps, but earned my trust, and I'll buy from them again if I have the chance.

On the other hand, I have in the past bought software in a cardboard box from a store. The publisher wasn't under anybody's thumb, and I'm sure they were happy about this fact. But it was nearly impossible to give any feedback to them, and when I did, I never saw any of it included in any future release. Owned their own business, but made a one-time sale and definitely not a repeat customer.

<comment><USER2> So, I agree there is some conflation going on, but it's based on the way Apple is doing business in the app store. I didn't cause the issues to become conflated, Apple did.

Given your example:

'A "sharecropper" under Apple, perhaps, but earned my trust, and I'll buy from them again if I have the chance.'

That's the problem. You won't have another chance, unless the developer makes a new product. The store doesn't allow for purchase of upgrades or renewals of service. It is a one-time purchase and the purchase price has been driven down to insanely low levels; which is fine for one-off games, but unsustainable for large applications that need ongoing maintenance, bugfixes, enhancements, etc. to provide a great customer experience.

The ideal experience for both customer and developer for complex software is often one of constantly increasing value, in exchange for fair payment. It doesn't have to be a traditional "upgrade every year" model...it can be a subscription style service, where you pay a fixed, fair, amount, and get updates every couple of months.

And, I'm definitely not campaigning for a return to boxed software in stores, as it has all the problems of the app store, plus many more. That was a tradition imposed by technical limitations. There was no good way to deliver software without boxing it up and shipping it out. That hasn't been the case for well over a decade. Nobody should be delivering software in boxes, today, as far as I'm concerned.

</comment></comment></comment><comment><USER4> While we're on the subject of helpful deployment software, MarsEdit's Daniel Jalkut has an article about crash reporting for Mac apps on his blog:

<http://www.red-sweater.com/blog/860/crash-reporter-roundup>

I haven't yet tried any of his suggestions, and since the article is from 2009, I don't know how much has changed.

In any case, from experience on other platforms, I heartily recommend making crash reporting straightforward (1-click, or even opt-in to 0-click) for users. Once you have a few hundred people using your software, "rare" crashes happen all the time and tracking them down can be much easier than with just your internal testing.

Note that OSX's built-in crash reports go to Apple, not the App developer, so they're not much use to those of us outside the Cupertino ivory tower.

<comment><USER5> An option for automatically uploading crash dumps is <http://code.google.com/p/google-breakpad/> \- it's what Chromium and Firefox use.

</comment></comment><comment><USER6> I wrote up my experiences on releasing outside of the App Store: [http://writing.markchristian.org/2012/03/30/make-your-own- ap...](http://writing.markchristian.org/2012/03/30/make-your-own-app- store.html)

I use Stripe for payment processing with a custom in-app UI for buying the app. Stripe has been great — they charge 50c+2.9%, so I lose about 44c per copy of DragonDrop sold (versus losing about $1.50 to Apple in the App Store).

I suggest releasing in the App Store if possible, but selling independently, too. The whole thing took about a day to set up and has been totally automatic since then.

<comment><USER7> Hey Mark, any chance you could break down your sales percentages for us? How many are coming via the Mac App Store vs. your website?

<comment><USER6> As of August 21st, I've sold 5.9% of my copies through my independent store. This includes a few weeks at the beginning where the app wasn't available on the App Store at all.

The App Store utterly dominates.

However, I still think it's good to have your own release path as well, because it gives you a bit more courage to argue with Apple when you need to. :)

</comment></comment></comment><comment><USER8> "...You can't offer paid upgrades. The App Store model is "buy once, get free upgrades forever", which is of course tantamount to encouraging disposable software (and support practices)..."

And this is recently one of the culprits why mobile app developers are struggling financially; so it seems to be a big factor.

</comment><comment><USER9> I found this a very helpful article. In particular the thing which scares me the most is always the thought of Having to deal with people's money, and so it is really nice to see someone talk about how they did it, and and how easy it was.

<comment><USER4> I've had FastSpring recommended by others as well and I am planning to use that service. Having dealt with accepting payment via PayPal I can only say: never again - they still owe me money, but I eventually gave up after I spent days trying to chase it down.

<comment><USER6> For what it's worth, I really recommend Stripe. It took me about two hours to write my home-built store using it, and I plan on using it on a new project soon.

<comment><USER4> I'm already signed up to be notified when it becomes available to use in Europe. Until it does, FastSpring certainly seems good enough (and defers the effort of setting up a non-static website to handle purchases, which is worth a fair bit to me as well).

</comment></comment></comment></comment><comment><USER3> It's true you can't offer things called "paid upgrades" or "demo versions", but with In-App Purchases, you can mostly get around this. For example, make your app free, and make some key feature an IAP -- that's basically a demo version. Or when you make a big new version, make the key new feature of the upgrade an IAP, so new users have to pay base+feature, while existing users only have to pay for that feature.

I happen to like these: I love being able to try something out before I buy, so "free + IAP" looks great to me. But there are a lot of people who must think that "free" means "everything free, for all time", and when they discover a core feature costs 99c, they go and leave a 1-star review. So you have to tread carefully.

Another option is to make a free demo version, and just dump it on your own webpage. It's not as discoverable as the App Store, but if people learn about your app and go looking, it's not too hard to find. A demo probably has minimal needs for the things the App Store provides (like licensing, purchasing, and updating), anyway.

</comment><comment><USER10> Here is a personal experience on what it can be like as a customer of a product available _both_ in the MAS and outside it.

A while ago, I tried the Fantastical trial, and when I used the purchase link, I was immediately prompted to a credit card payment screen. I paid and bought the software, and all was fine and well.

But later on, I learn that the software was also available in the MAS - something Fantastical didn't really bother explaining to me. When I contacted them for any kind of refund (to be used to purchase the app in MAS), I was told that they couldn't accommodate that since a lot of other users have requested the same thing - which already seems like a weird way of thinking.

They price the software in both places the same - meaning they earn more money, if people don't by it in the MAS, and I felt the entire experience to be very deceptive.

All in all, a really bad experience that I can't recommend any developer to imitate, as it does nothing to inspire customer loyalty. Especially when the developer has a financial incentive to not addressing the issue. At least from my limited perception as a non-Mac developer.

Again, this is the _impression_ you get as a customer. I'm not saying this is the intent, but perception is reality in the real of customer experience.

Consider this another con to double-dipping, if you intend to do something similar.

<comment><USER11> When buying other items, do you expect to pay less when you pay in cash? After all, the retailer is making more money by avoiding credit card handling fees.

<comment><USER12> Many merchants offer a discount for paying in cash or charge a fee for using a credit card for small purchases. The only reason such practices are not ubiquitous is that they violate the merchant agreement.

<comment><USER11> Many do, yes. For those that don't – the majority – I'm curious if pessimism finds their actions as distasteful as he found Flexibits', the authors of Fantastical.

Personally, I find nothing wrong with their actions. pessimism was never purposefully mislead about how Fantastical was being sold, and it's perfectly reasonable for Flexibits to charge the same price in both venues even though they have larger margins in one.

</comment></comment></comment></comment><comment><USER13> I was under the impression that you couldn't install onto a non jailbroken iPhone/iPad without going through apple ( either App Store/AdHoc/Enterprise). This gives me hope that I am significantly wrong on that which would make my life much easier.

Can someone confirm that?

<comment><USER7> This article is about the Mac App Store. On iOS you _must_ use the App Store to distribute apps (without jailbreak).

<comment><USER13> Thanks, that makes better sense.

</comment></comment></comment><comment><USER14> How do I install apps from out side the app store? Doesn't it require the phone to be in developer mode or something like that? So why is it even worth investigating if its possible or worth the effort? What am I missing?

<comment><USER15> It's a Mac app., not an iOS one.

</comment></comment><comment><USER16> To release on iOS (which is not the major market any more btw) outside of the App Store consider Cydia. There's millions of jailbroken devices now and the Cydia store app is included in the process.

<comment><USER17> I just moved into a new house and the lawn needed to be mowed and all that, so one of my roommates made a deal with the neighbor and his kids came over to do the lawn. I went out to see if they needed anything, and I got talking with one of them. He asked me what I did and I told him I'm a programmer, and he asked me if I knew anything about jailbreaking iPods. I was completely and utterly flabergasted; I'd worked on jailbreaks back with the original iPhone and simply couldn't believe that a kid of maybe 9 or 10 in the middle of CT with non-techie parents actually knew about such things. Really speaks to how big jailbreaks and the like are these days.

<comment><USER18> Gaming. I had hacked my Sony PSP back when those were a new thing, and finding information on the process was tantamount to wading through half written forums posts from 10 year olds. Few people knew what they were talking about, it was often wrong or warned you about the wrong things, lots of people bricked their PSPs, but the prospect of free games lured in all the kids with no real income to try it. People who want jailbreaks for free games without knowing what it really entails.

Since iOS has become a huge gaming platform, it's no surprise that same PSP/NDS piracy consumer demographic has made the leap as well.

</comment></comment></comment><comment><USER19> so.. is the app store more profitable or is selling software yourself better?

</comment><comment><USER20> Great article! I have a question for you guys. Just today, in the past few hours, we are now featured on the App Store. Since we have made the decision to put an emphasis on that release - how would you go about sustaining the momentum from that channel? <http://techcrunch.com/2012/08/14/quilt-launch/>

<comment><USER21> I don't believe this has anything to do with the article, which is discussing the Mac App Store.

<comment><USER20> My apologies - conradev. My reason for posting was that people on this article are interested in app distribution. I have no experience in the Mac App Store, and was hoping to both learn something from the Mac discussion and piggyback off of anyone else's AppStore experience. Je m'excuse.</comment></comment></comment>


Ask HN: How do I turn my smartphone into a dumbphone? - <AUTHOR> I have a Oneplus 5 that I spend too much time on. I'd love to restrict the phone to calls, messages, camera + maybe whatsapp. Are there any custom ROMs or apps for this and has anyone tried it? <comment><USER2> uninstall the apps, remove accounts ... if you'll still be keeping WhatsApp, you might not be really ready for a dumbphone</comment>


The Case for Buying a Powerball Ticket - <AUTHOR> http://www.nytimes.com/2015/02/12/upshot/the-case-for-buying-a-powerball-ticket.html <comment><USER2> I hate the argument that, on the grounds that the aggregate money spent on lottery tickets is typically larger than the aggregate money paid out on lottery tickets, purchasing a lottery ticket is inherently irrational.

The same is true of insurance, yet few people consider the purchase of insurance to be intrinsically irrational by the same argument.

People are free to have whatever preferences they want. Some people prefer a life with a slim possibility of a tremendous windfall (and but a negligible loss in the more likely alternative) to a life of certain continuation with the status quo grind. More power to them.

<comment><USER3> > The same is true of insurance, yet few people consider the purchase of > insurance to be intrinsically irrational by the same argument.

The offsetting argument for insurance is that it provides risk management against unaffordable, catastrophic expenditures -- it is a trade-off of a certain expenses, against the risk of a much larger uncertain expense, with an expected net cost in _financial_ terms, but that it is rational in some cases given the decreasing marginal utility of net income (which, conversely, means that there is an _increasing_ marginal _cost_ of high expenses.)

Of course, the trade-off in the lottery is you are paying a certain, low cost for a chance at unlikely larger payoff -- this has not only a negative expected financial value, but -- given the declining marginal utility of income -- an even _larger_ expected negative _utility_ in most cases, considering utility of money on its own.

Of course, it may be rational _if_ the utility provided to a particular player by "playing the lottery" (the entertainment value, etc.) exceeds the expected net disutility associated with financial expectations.

<comment><USER2> If some people do, in fact, prefer situations in which there is a slim chance of tremendous windfall and large chance of small loss to guaranteed status quo, who is the economist to tell them "No, no, this is incompatible with the theory of diminishing marginal vNM-utility. Your preferences are misguided!".

Utility is just a construct for describing people's preferences; to turn around and demand that people's preferences ought change to match some textbook model of utility is to put the cart before the horse.

People can reasonably have all kinds of different personal preferences, right? If your theory doesn't account for that, that may not be an example of muddled thinking on your subjects' part; it could just as well be a problem with your theory. I mean, what is actually factually misinformed about preferring the risk profile afforded by a lottery ticket to the alternative?

<comment><USER4> Because it's hard to imagine that anyone _actually_ has a increasing marginal utility of money. If they did, over wide enough of a range, they'd bet their entire life savings on the Powerball.

What's much more likely is that they're getting some entertainment out of playing the lottery, or they're poor calculators of risk and reward.

<comment><USER2> I don't have to imagine that anyone prefers occasionally playing the lottery to never playing the lottery. I can see it in action any time I please, and while some of the people doing so may be laboring under delusions as to the quantities involved, I see no reason to conclude that all are. (I will proffer myself as an example.)

A person might well prefer the risk profile resulting from occasionally playing the lottery (small chance of tremendous gain, large chance of minor loss) to both the risk profile resulting from never playing the lottery (guarantee of no gain or loss) and the risk profile resulting from betting their entire life savings on Powerball (large chance of catastrophic loss, small chance of tremendous gain); these are all different risk profiles, so they can all perfectly well be valued arbitrarily differently.

[And I do mean arbitrarily differently. What rule of rationality demands that anyone who might want to play the lottery from time to time for the risk profile it produces ought further prefer to bet their entire life savings on the lottery? Whoever claims that to be a rule of rationality, I say they're the irrational one.]

Whether you would describe someone with such preferences as having "increasing utility of money" or not is up to you. But I see nothing problematic in having and acting on such preferences.

</comment></comment></comment></comment></comment><comment><USER5> This article is trash. First he makes a dumb argument that comes down to, what's $2 in exchange for the warm fuzzies of imagining where you'll move with that money.

And then goes on to explain why now's the best time to waste your money if you like wasting your money because of the ridiculously obvious point that the jackpot is larger now.

This is abysmal garbage and the author should feel bad and so should everyone who upvoted this. I rarely ever get mad but the lottery is one of my biggest pet peeves, and this brings no insight or elaboration on the issue besides, "gee wouldn't it be great to instantly have millions of dollars."

<comment><USER6> There are a number of things you can spend a small amount of money on with ultimately nothing to show for it but some brief enjoyment. It seems the author is encouraging his (non-addict, non-destitute) audience to reframe their thinking about what the lottery provides as entertainment value rather than simply being 'a tax on people who are bad at math' \- even if you don't ultimately play, you don't have to view those who do in a negative light.

That's certainly how I used to feel, but once I started thinking of it as a lark rather than a blight, it just didn't seem like that big of a deal.

</comment></comment><comment><USER7> Buying one ticket is a much bigger benefit over buying none than buying two is over buying one.

Buying one ticket does seem reasonable to me (even with excellent math skills). Buying two is just silly.

</comment><comment><USER8> "It's actually more complicated than that, because that calculation doesn't account for the fact that there could be multiple jackpot winners who must split the pot."

In other articles, it's been said that when the jackpot is high, the expected value actually goes down due to the increased chances of multiple winners.

</comment><comment><USER9> I don't think there's anything wrong with buying a lottery ticket if its cost is a trifle for you.

Buying one when the expected value is positive is not a sound gamble however. Suppose there is a jackpot of $300M and you have a 1 in 150 million chance to win. It's obvious that you have an edge, so you calculate how large part of your bankroll you should bet with the Kelly criterion[1] and get: f=3.33e-9

Oh well, if you are a centimillionare you can buy a ticket and be rational.

[1][http://en.wikipedia.org/wiki/Kelly_criterion](http://en.wikipedia.org/wiki/Kelly_criterion)

<comment><USER10> You need to factor in ticket price, odds of winning, cash payout, taxes. Powerball is $2 a ticket. The cash payout is around $338 million. The odds of winning with a ticket is about 1 in 175. Assume taxes will take half. You shouldn't buy a powerball ticket using reason unless the cash payout is at least $700 million. Problem then is so many people are playing there's likely more than one winning ticket which would mean the numbers don't work.

Edit: the payout tonight is $338m

<comment><USER9> I assumed a $1 ticket in the example. The point is that even if the expected value is high, buying a ticket means that you are likely overbetting by several orders of magnitude.

<comment><USER10> Yes. And even if you get to pot odds or better after taxes and decide to spend $20 (10 tickets), $200 (100 tix), or even $2000 (1000 tix) because you're at pot odds... 1 in 17.5 mil, 1 in 1.75 mil, even 1 in 175,000 are still very long odds. So, you can't win and dream if you don't play but if you play buy just one ticket. Buy it more for the fantasy you get to play in your dreams at night in your head, because that's most likely the greatest payout you'll get. $1 or $2 for a bottled drink or for some sweet dreams... Your choice, both are okay choices in my mind.

Edit: typos.

</comment></comment></comment></comment><comment><USER11> We all know that there are negatives to winning the lottery or getting rich. One big drawback would be never being able to make new ("poor") friends without knowing if they were true friends or only friends because of your wealth.

I can certainly see "rolling the dice" on a life changing outcome if you had nothing to lose because you were miserable. I think it make less sense if you are happy. Am I the only one who is so happy that I wouldn't take a chance on wrecking my life?

</comment><comment><USER12> The lottery is a tax on people with bad math skills.

<comment><USER2> You don't have to have bad math skills to play the lottery. For example, I am a mathematician who has on occasion chosen to purchase lottery tickets. And I see nothing at all irrational about this.

<comment><USER12> Oh, I'm not above buying the occasional ticket, either -- for that matter, I like playing Blackjack and view any losses incurred as entertainment.

However, people at the lower end of the income spend a _lot_ more of their money (proportionally) on lottery tickets. [1]

And states are increasingly dependent on those revenues [2], which means in effect we've got a system where our schools become dependent on our lowest income population wasting money on what is essentially a pipe dream.

Note: I'm not saying "we've got to stop lotteries!" As I said: I play myself. Just noting that we are funding our government on the backs of people who are making what is arguably a terrible investment.

In other words: lotteries are a tax on people with bad math skills.

[1] Lots of studies back that up; there's a pretty good list here: [http://stoppredatorygambling.org/blog/category/research- cent...](http://stoppredatorygambling.org/blog/category/research- center/lotteries-who-really-plays/)

[2] [http://taxfoundation.org/article/gambling-tax-policy- states-...](http://taxfoundation.org/article/gambling-tax-policy-states- growing-reliance-lottery-tax-revenue)</comment></comment></comment>


32 core virtualization cluster for £1300 - <AUTHOR> https://rwmj.wordpress.com/2014/04/28/caseless-virtualization-cluster-part-5/#content

<comment><USER2> I love this.

Threaded rods with a couple of nuts and crinkle washers might be cheaper and more adjustable than a lot of spacers.

As for power - you'll want some kind of industrial supply that can cope with multiple motherboards. These will ne sold at places like FEC or RS or etc, rather than computer parts suppliers.

And I freaking love "Ocha Ken".

<comment><AUTHOR> Yes threaded rods were suggested by a commenter on the blog[0]. By the time he had posted that comment I'd already invested in about 100 of those aluminium stand-offs, so I decided to go with that :-)

[0] [http://rwmj.wordpress.com/2014/04/13/caseless- virtualization...](http://rwmj.wordpress.com/2014/04/13/caseless- virtualization-cluster-part-1/#comment-9476)

</comment></comment><comment><USER3> Honest question, why are the computers connected with Ethernet as apposed to PCIe wouldn't that allow faster communication between cores?

<comment><AUTHOR> To be honest I didn't know that connecting them with PCIe was a possibility. Now I see it is, I may try that, so thanks :-)

<comment><USER3> when I say 'possibility', I should put more quotes around it. I know BlueGene (I one of the 00's top 10 super computers) did the interconnections of its processors with PCIe

</comment></comment></comment><comment><USER4> Does anyone know if there are any ATX power supplies that can power more than a single motherboard?

<comment><AUTHOR> Power is the major problem that stops me scaling this up to the ceiling, so I'd like to know the answer to this too. Apparently there are PSU splitters (used by bitcoin mining rigs) but most people seem to have made their own.

<comment><USER4> Btw - have you taken a look at this - [http://www.asrock.com/mb/AMD/AM1H-ITX/](http://www.asrock.com/mb/AMD/AM1H-ITX/) . Its not as good as having a single power supply for multiple boards, but it has a dc power supply (notebook style) that should take a lot less space / be a lot more silent than traditional power supplies.

<comment><AUTHOR> That motherboard looks good, but is rather expensive. The motherboards I'm using (see [0] for spec) plus the power supply is only a tiny bit more expensive than that. (And the central aim of this project is to get as many cores and as much RAM for as little money as possible)

[0] [http://rwmj.wordpress.com/2014/04/16/caseless- virtualization...](http://rwmj.wordpress.com/2014/04/16/caseless- virtualization-cluster-part-2/#content)</comment></comment></comment></comment>


Ex-Employees Say Home Depot Left Data Vulnerable - <AUTHOR> http://www.nytimes.com/2014/09/20/business/ex-employees-say-home-depot-left-data-vulnerable.html <comment><USER2> We have two issues here which are both bad.

One, big corporates that don't take the appropriate steps because of incompetence, corporate inertia and a lack of consequences. People who say something are not taken seriously and the good ones leave.

The other, has to do with startups, who are dealing with sensitive information, who do not take the appropriate steps to secure it because they would rather win the VC lottery. Putting customers data at risk is ok if they can get their payday.

I have personally observed two startups that have done this.

One was a startup working in the identity management and protection space logging sensitive information in plain text on their servers and bringing them down to unsecured local dev boxes for debugging. When I asked them about it they said they knew what they were doing was wrong but didn't feel like it was a big deal. From their point of view they didn't think they were a target. Of course they also didn't feel that it was worth the cost.

The other was a banking startup that was storing Social Security Numbers and account details that would allow direct access to bank accounts on Heroku PostgreSql databases. Once again when I brought it to their attention, making the product look good for the next round of funding was more important than a customer having their bank account cleared out or having their identity stolen. Incidentally many of the developers for this banking application had come from a large established Accounting company and didn't seen anything wrong with what they were doing.

What this really comes down to are ethics. Is it ethical to cut a corner and save money on development if it means that a data breach of our system could lead to possibly significant financial consequences to our customers?

I personally try to adhere to the ACM code of ethics [http://www.acm.org/about/code-of-ethics](http://www.acm.org/about/code-of- ethics) . But unlike the field of medicine where even the worst doctor has been vetted by a committee of professionals we have no bodies that evaluate the character of people in our field nor a oath like the Hippocratic oath that is an automatic piece of the training.

If more engineers were willing to say no and even quit over poor security practices I'll bet you security would be taken more seriously.

<comment><USER3> > We have two issues here which are both bad.

Sorry, where does anything in this article mention startups?

</comment></comment><comment><USER4> Things like this just means we should really bring out something that doesn't expose the magic 16 digits of "charge me anything" to the world. Tokenization schemes like Apple Pay go a long way to securing the general public in an easy to use way.

</comment><comment><USER5> So what's the chance one number out of the 50+ million will be used fraudulently? 1%? 10%?

<comment><USER6> I've already received notice from Discover that they are sending me a new card. They didn't mention Home Depot but did say that my current card had the potential to be used fraudulently.

If the card companies can issue new cards quickly enough they can contain the damage. 50 million is a lot though.

</comment></comment><comment><USER7> Things like this will continue to happen as long as the government insists on slapping companies on the wrist with small fines, which most of the time is a tiny portion of their annual profits.

My solution: hold the executive management directly liable for all security breaches that compromise customer data. Send a few of them to jail and you will suddenly see other companies treat information security with the seriousness it deserves.

(Most corporate CEOs make millions of dollars a year on top of an untold number of perks. It's time for them to start earning it.)

<comment><USER8> In this particular case, what is the justification for the Government fining them? Did the customers lose something that they were not adequately compensated for by existing system? Exactly who would we be protecting?

To me, this sounds like a matter to be handled between the banks, card processors, and Home Depot.

</comment></comment><comment><USER9> What I don't understand about these massive breaches is that once a pattern has been established all the cards get flagged... right? Which greatly increases the likelihood of subsequent transactions being flagged on the spot, which makes the risk of being caught much greater. Wouldn't the hackers and their clients be better served by much smaller batches of credit cards that aren't clearly from the same breach?

<comment><USER10> You're right, but they do it in a sneaky way to try and avoid that.

The Russian/Ukrainian rings that hit Target and Home Depot (and various other companies) gathered the cards in secret over many months, while not actually using or selling any of them. Then once they feel like they've gathered enough cards to compensate them for their time, or if they feel like they'll lose access or get caught in the near future, they dump them in bulk batches. Generally these breaches, and the company that was breached, get discovered after the very first dump batch. The banks who issue the credit cards can often figure out what store was breached if they're given a random sample of 1000 or so credit cards; they just correlate the cardholder locations with the stores in the area, and see what store has the most overlap. Often bank security personnel are some of the first to buy the credit card dumps. In fact, this is how Home Depot and Target both found out they were even breached at all: the banks ran their analytics on the dumps and informed them.

After the first batch is released, the subsequent batches are usually less likely to work, but sometimes the banks will just issue notices saying "you recently shopped at Home Depot, please check your account statement" instead of blanket disabling all the cards. In those cases, staggering the dumps in batches increases the overall fraud gain.

You can learn more about these kinds of tactics on Brian Krebs' blog: [http://krebsonsecurity.com/](http://krebsonsecurity.com/)

<comment><USER11> Probably the most strategic way to use 50mm credit cards would be to use them destructively, rather than just for direct gain. (All of this is illegal as well as immoral, but just presented so people can develop countermeasures)

Know that using the credit cards will cause the accounts to get frozen, which will cause decreased purchasing; it will also scare people away from those stores, and possibly from purchasing in general.

A nation state could do this for disruption directly; Russia could filter the 50mm cards to find cards belonging to US people (or just assume home depot = usa), and intentionally cause transactions requiring replacement. Do this on the last week before xmas, or black friday, or some other strategic time.

A criminal organization could use the breach to manipulate the stock market -- either directly (shares in the breached company tank, although this doesn't happen to a very large extent), or by blocking cards used at one merchant in particular, raise the sales of a competitor indirectly.

There's also straight extortion -- we'll sell these back to you and go away IFF you pay us.

<comment><USER10> Interesting tactic, and I could definitely see it being employed by an intelligence agency, but it's unlikely the fraudsters would be able to see any significant monetary gain from it. As you alluded, Home Depot's stock didn't decrease that much, and it bounced back shortly afterwards.

Some of the fraudsters and criminals are politically motivated to an extent, especially with the recent US sanctions against Russia (the codename for the Home Depot card dump is "American Sanctions"), which you can read more about here: [http://krebsonsecurity.com/2014/09/home-depot-hit-by-same- ma...](http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-malware-as- target/) The POS malware even has some not so subtle anti-American images embedded within it.

But that said, they care about the money above all else. The rest is just a little added motivation.

</comment></comment></comment></comment><comment><USER12> It does sound like a Home Depot's management may have failed to practice due care in protecting their customers credit card data. That will be perceived as a failure of corporate governance and expose the company to charges of negligence. I'm surprised they let it go on this long. It seems like there will be a material effect on the companies operations now...

</comment><comment><USER13> One thing I haven't seen the popular media take Home Depot to task on is: Why didn't they review their security after the Target breach?

The Target thing was announced in December last year. Home Depot had between then and April-May to do a full review and see if they too were vulnerable. Not only did they fail to do that, but they failed to find this issue for 5 additional months(!).

I liken it to being a miner, watching the canary die, and then continue to work. Then you're shocked _shocked_ that there was poisonous gas in the mine when you "found out" hours later.

I just looked up "Gross negligence" (per corporate law) and this seems to wholly fit. This is almost textbook Gross negligence but yet not a single prosecutor in the US has gone after Home Depot, why is that?

In fact it seems like Home Depot will walk away from this almost cost-free, no fines, no prosecution, no significant costs (the "free monitoring" is stupidly inexpensive, plus nobody actually utilises it), and only minor negative PR.

Maybe states should just fine companies 10c for every Credit or Debit Card number lost. That's a 5.6 mil fine for Home Depot, maybe then they'd take it more seriously.

<comment><USER14> > One thing I haven't seen the popular media take Home Depot to task on is: > Why didn't they review their security after the Target breach?

?

It's right there in the article:

"After the Target theft, Home Depot's chief executive, Frank Blake, assembled a team to determine how to protect the company's network from a similar attack, said one person briefed on the project. In January, Home Depot brought experts in from Voltage Security, a data security company in California, these people said. By April, the company started introducing in some of its stores enhanced encryption that scrambled payment information the moment a card was swiped.

"But criminals were already deep in Home Depot's systems. By the time the company learned on Sept. 2 from banks and law enforcement that it had been breached, hackers had been stealing millions of customers' card information, unnoticed for months. The rollout of the company's new encryption was not completed until last week."

</comment></comment><comment><USER15> _...more than a dozen systems handling customer information were not assessed and were off limits to much of the security staff._

This sort of decision is made at an executive level. There must have been multiple reports that included a record of the decision. PCI is a joke.

</comment><comment><USER16> "They say many companies do not even know they have been breached."

This is the scariest fact of the whole article. We hear about Sony, Target, Home Depot, etc. on the news, but how many others are out there that we don't know about? Dozens? Hundreds?

</comment><comment><USER17> Bitcoin and cryptocurrencies should really be capitalizing on the nightmare PR of all these credit card thefts at major retailers. This is way worse than the transaction fee argument.

<comment><USER8> And how would they go about capitalizing on the bad PR, considering that Bitcoin security is far, far worse than even the sloppiest credit card system? Virtually every business dealing in Bitcoin has been hacked, and this basically always results in the full balance of their bitcoins being stolen and the attacker getting away with it clean.

The credit card system has its issues, but even these massive thefts of numbers generally lead to no financial losses for customers and modest losses for banks and retailers, and the attackers often do get tracked and caught. The biggest complaint on here is that the losses are not high enough to convince these companies to pay serious attention to security.

</comment></comment><comment><USER18> So how did the malware get onto these machines in the first place? Why is a POS system running unexpected binaries?

<comment><USER19> Like most companies, client support is a real shitshow, with the most junior employees and fewest resources.

</comment></comment><comment><USER20> Since you can't prove a negative; Any proof that Home Depot benefited from this?

</comment><comment><USER21> Here's an article with more details.

[http://www.dailytech.com/Appalling+Negligence+DecadeOld+Wind...](http://www.dailytech.com/Appalling+Negligence+DecadeOld+Windows+XPe+Holes+Led+to+Home+Depot+Hack/article36517.htm)

Looks like they were still using Windows XP embedded instead of moving to Windows 7 embedded.

<comment><USER22> Heads up: Windows XP != Windows XP Embedded. Extended support for XPE has not ended yet.

[http://support.microsoft.com/lifecycle/search/default.aspx?a...](http://support.microsoft.com/lifecycle/search/default.aspx?alpha=Windows+XP+embedded&Filter=FilterNO)

</comment></comment><comment><USER23> 0\. Did Govt BUY or contract with the COMPANY? yes or no 1\. Can employees SUE FOR BIG MONIES under qui tam law?

2\. IS IT EASY TO FIND A LAWYER and GOVT agency and 'partners' who DO MOST OF THE WORK (other whisleblowers are RICH) in helping the GOVT to sue the COMPANY? yes or no

3\. got an entire group? ex-employees? do not plan on working for COMPANY AGAIN?

4\. Employee in I.T., computers, security, etc DONT GET NO RESPECT?

5\. Employees could be WHISTLEBLOWERS and when the GOVT and you and partners WIN, then the 99% ninety nine percent win?

Yes, I a worker. Yes, I paid taxes. Yes, COMPANY got all sorts of tax loopholes, Management got golf club memberships and perks and benefits.

Yes, see books by David Cay Johnston about tax loopholes and 'structures.'

</comment><comment><USER24> [https://en.wikipedia.org/wiki/Victim_blaming](https://en.wikipedia.org/wiki/Victim_blaming)

Seriously. Defending cyber infrastructure is hard. Incredibly hard. If you only play defense you lose. Always. 100% of the time. Nuclear facilities and critical infrastructure get hacked when they aren't even connected to the broader internet. Our software stacks are built insecure from the ground up.

And what's the threat model you want to Home Depot to protect you against? Hackers coming in directly from the internet? Hackers coming in from a contractor (like Target)? Hackers breaching their corporate datacenters? Attackers that gain access to the production line? Attackers that return goods after they've been infected? Attackers that phish for access to employees or with PDF malware as job applications? Leaving infected CDs, harddrives, and USB sticks near the company HQ of the business they buy their point of sales device from? Creating rouge access points or using femto cells to gain access to company devices? Hacking into home devices of employees? Attackers planting backdoors into the hardware at the manufacturing level? Attackers guessing weak passwords that employees configured? From these attacks applied to vendors and partners? From attackers that compromise tools used by employees hosted on C|NET and others (like sysinternals)? There's a million ways in. Point of sales devices are just one way adversaries could collect this data.

Security researchers have been crying that the internet has no clothes for decades. The internet is a wild west without vigilantes. It's been designed weak from the start. Adversarial-tolerant design costs far, far more than fault-tolerant design does.

Wall Street was hacked. The Department of Defense is routinely hacked. The _NSA_ has been hacked.

This isn't Home Depot's fault. Everyone gets hacked. Everyone.

<comment><USER25> Please don't bring social justice theory into a factual discussion of a company's missteps and negligence that resulted in a serious breach of its systems.

<comment><USER24> Because it's not relevant?

I argue it is. There's no way Home Depot could have prevented this. If they took every step suggested by every article and every comment in this 'factual discussion' they would have been owned another way. And it would have received a tirade of similar articles and similar comments about what it should have done to protect its data another way.

Hindsight and backwards engineering security suggestions is easy. But it isn't productive to the overall posture of cyber security. I guess it depends on what scope of the discussion you find interesting. The root or the symptom.

<comment><USER26> I completely agree with you. It's quite amusing to see this time and time again; 'security' folks then say "oh, it's Target/Home Depot/Heartland Payment/Apple/Adobe/Yahoo's fault"

There's an easily identifiable pattern here. Security is not economically feasible. Cyber security breaches are like industrial accidents or freak acts of nature, and they should be treated that way. Insurance, OSHA, inspectors, training. This problem is not going to go away.

Specifically for credit cards, banks could do a lot to solve the problem by removing the plaintext identity value that is a credit card number. As an engineering discipline, we can do a great deal to remove the high-value targets from flowing through many hands.

<comment><USER27> > _Security is not economically feasible_ //

Isn't it that others bear the cost of company's security lapses - except for good will - and so they don't really care beyond the legislated need to care? Are these companies making a loss?

It certainly sounds like Home Depot just thought that it wouldn't happen to them and so they could cheap it out - not pay for intrusion detection, not pay to have systems scanned for known vulnerabilities (I'm reading between the lines of the OP article a bit here), not paying for security updates like current anti-virus.

<comment><USER24> Companies lose huge amounts of money, much of it from PR with customers, when they are hacked. The recent EBay hack for example lost the company huge amounts of money (remember seeing but haven't had luck finding the numbers online).

But you're only thinking about customer retailers.

Many companies need to keep their intellectual property, source code, designs and trade secrets safe from hackers and competitors. Intel is a great example of a company that dominates an industry purely due to IP. Chinese companies (and government) sponsored hackers would love to utilize 12 nm transistor technology to outcompete Intel. I can't help but to wonder what Intel microcode update keys would sell for.

Brazilian PETROBRAS lost billions of dollars when they got hacked by the NSA and as a result lost offshore oil drill location auctions.

There's also 'outsider trading'. Intimate knowledge of what financial decisions companies and states are going to make is big money ([http://tinyurl.com/l834xou](http://tinyurl.com/l834xou)).

Finally, there's stealing money directly from corporate accounts (Axis Bank). A recent example are the thefts of large numbers of bitcoins from bitcoin trading companies. Often hackers abuse automated clearing house systems to transfer data between accounts and siphon small quantities across large swaths of time/transactions ([http://www.bankinfosecurity.com/ach-fraud-payroll-hack- drain...](http://www.bankinfosecurity.com/ach-fraud-payroll-hack- drains-217k-a-3980)).

Then there's political hacking. The Chinese government stole Israel's Iron Dome defense system specifications. What does that 'cost'? It's hard to calculate. There are countless examples where state actors steal designs from defense contracting companies.</comment></comment></comment></comment></comment></comment>