Samsung in hot water over splashy Australian phone ads - <AUTHOR> https://www.reuters.com/article/us-australia-samsung-elec-regulator/samsung-in-hot-water-over-splashy-australian-phone-ads-idUSKCN1TZ0EJ <comment><USER2> >The company attributed that to a manufacturing defect, affecting a small number of phones, which it soon fixed. But customers online continued reporting problems, forum comments show.

I wish corporations would stop using the "only affects a small number" excuse. I understand the motivation behind that but feels really bad when you're affected and you can obviously see it's not a small number.

<comment><USER3> Meaning only a small number of users actually put the phones in water (because to them electronics and water don't mix, despite ads).

</comment></comment><comment><USER4> So here we have a large multinational corporation that has let batteries explode on planes, sold bendy phones that don't really bend so well, and just flat out lied about the capabilities of a phone in a multi-million dollar ad campaign.

I'm _really_ trying not to be one of those crazy "wake up sheeple!" type crazy folk. But surely the public will wake up soon to the dangers of letting these giant megacorps run free without better regulatory oversight?

All we do is slap them on the wrist with a few million dollars of fines and say "now now! Don't do that again!". Then we wonder why fining them for less than they probably spent on the damn marketing campaign isn't deterring them from doing it all over again.

<comment><USER5> > _sold bendy phones that don 't really bend_

Are you talking about Samsung Fold? Because they didn't sold not even 1 of that.

You should be careful what you wish for. If companies were fined billions of dollars for faulty products, in a couple of years you'll have nothing to complain about. And not because everything will be amazing.

Just imagine if Microsoft/Apple/"Linux" was fined 1 billion for every major flaw in their OS. There would be no OSs any more, because they would all be bankrupt and nobody would dare selling anything remotely new.

Are you personally willing to accept $1 mil liability for any major flaw in the software you wrote in the past?

<comment><USER6> False dichotomy. There's certainly a middle ground between allowing corps to get away with whatever they want with a mere slap on the wrist, and fining them into bankruptcy.

</comment></comment></comment><comment><USER7> I remember these ads running here in Italy. it was funny to see the phone in water and written under in not so small letters "don't do as shown it doesn't resist running water"

[https://youtu.be/4B-fPS3W9Og](https://youtu.be/4B-fPS3W9Og)

saved them a lawsuit I guess.

</comment><comment><USER8> _It centers on more than 300 advertisements in which Samsung showed its Galaxy phones being used at the bottom of swimming pools and in the ocean._

I know that iPhones and similar can survive being dropped in a pool but can you actually "use" a Samsung underwater?

 _Some consumers damaged their phones when exposing them to water and Samsung had refused to honor warranty claims_

So can it be used in water, or not? If Samsung shows a phone being used underwater, I don't understand why it wouldn't honor a water damage claim.

<comment><USER9> I've owned an S8 for >2 years and I think it can safely be used underwater.

I've gone swimming with it in the sea, swimming pools, washed it under tap water regularly and even dropped it in a bowl of yogurt once. YMMV of course.

My guess as to why they won't honor their warranty probably revolves around return fraud. It must be trivial to damage the waterproofing intentionally, get the phone water damaged then demand an exchange. It's such a big problem that even the Apple store where I live has much stricter return policies than they do in the US.

</comment></comment><comment><USER10> Working consumer protection agencies are awesome.

Earlier this year another Australian consumer won against Apple when they dropped their iPhone in a pool and it stopped working (after Phil Schiller said said you can drop it in the pool and it will be fine) [https://www.reddit.com/r/apple/comments/aiknf4/i_fought_appl...](https://www.reddit.com/r/apple/comments/aiknf4/i_fought_apple_and_won/)

</comment><comment><USER11> I don't know about this one but I regularly wash my Moto phone under the tap (for hygiene reasons) and so far it has been working without problems (for 2 years or so). So I don't think its impossible for the Samsung one to act as in the ads.

<comment><USER12> I have a friend who used his samsung with a cracked screen underwater in the sea for years for photos/video. I'm not sure about the models in question, but the company does have effective waterproofing.</comment></comment>


Google Maps directions from Japan to China - Look at #42 - <AUTHOR> http://maps.google.com/maps?q=Japan+to+China&saddr=Japan&daddr=China&hl=en&ll=31.653381,129.682617&spn=32.009615,57.084961&sll=37.0625,-95.677068&sspn=59.119059,114.169922&geocode=FRhxKAIdfJI9CCkvGX_XD05nNDFEUmZ81HVC9Q%3BFZw0IwIdReU1BinBQsblZI5QMTFvNp80fKodlQ&t=h&z=5

<comment><USER2> Something makes me think there is probably an easier, albeit more boring way to perform step #42

<comment><AUTHOR> LOL....I agree. Makes you wonder...if this is an easter egg, or someone really put this in with a straight face.

<comment><USER3> Directions from the US to UK used to say "swim across the atlantic ocean"

</comment></comment></comment><comment><USER4> My little brother found this awhile back. I never thought it'd be interesting enough to put on here.

</comment><comment><USER5> It may be a way to prove that google owns this directions if they ever end up in court.</comment>


Show HN: First real C project. Where to go now? - <AUTHOR> https://github.com/roevhat/matriC

<comment><USER2> If you want to make it easier for others to use it, learn some basics about autoconf/automake. It shouldn't take more than a day to implement, but should make the installation a more standard process. Also drop the binaries from the repository - they're not needed. If you want to distribute binaries, package your app and provide a .deb and .rpm.

If you want to keep the custom makefile, Makefile is a more common name (but both are correct). For the clean target, you missed the `ma3c` file and the recursive option in rm is not needed. `rm -f *.o ma3c` would be more safe (or paranoid ;) )

I'm not sure what kind of comments were you looking for, but this is a maintainer's perspective.

</comment><comment><AUTHOR> Any type of comment! Great feedback, I can use anything at the moment, since I really wan't to learn the language and the process of building something with it :) And I had also recently started using HN, so I wanted to share it with others.</comment>


Popcorn Time Is Hollywood's Worst Nightmare, And It Can't Be Stopped - <AUTHOR> http://techcrunch.com/2014/03/17/popcorn-time-is-hollywoods-worst-nightmare-and-it-cant-be-stopped/?utm_campaign=fb&ncid=fb

<comment><USER2> Anyone tried this out?</comment>


Ask YC: Hiring a Freelancer with High Rates - <AUTHOR>

I'm about to hire a guy to add to the team who currently lives in the world of high-end, expensive freelancing.  Salary isn't very flexible since we're working on somewhat of a budget, and remaining conservative with our funds.
Currently his hourly rates are above what we're capable of meeting, but he remained optimistic about negotiations.
Have any of you gone through a circumstance like this, and if so what were your experiences in the long run? <comment><USER2> If he's fantastic and believes in what you're doing, what about bringing equity into the equation?

I ordinarily say, "Contractors don't get equity. End of discussion." But it sounds like money is tight, and you have deadlines to meet and/or goals to achieve that this person can help you achieve--that's what equity is for: The things that you can't get any other way. If you can't afford him, then you can't get it in the normal manner.

The other option: Trade equity to an investor for money--more than it takes to bring this person on board. It's still giving up equity, but it'll probably buy you more in the long run.

Or, keep negotiating. Rates are negotiable until one party gives a plain ol' "No". If he isn't having to juggle jobs to make ends meet, he may be willing and able to work on your project in order to do something fun. When I did contract work, I lowered my rate all the way down to 1/3 the normal rate to work on stuff I really liked. And when I could no longer give them my full attention at those rates, I left the job and helped them in the process of hiring a replacement.

<comment><USER3> Agreeing with one of the options above - one of my friends who works with a lot of startups will take a lower hourly rate in exchange for equity, depending on the startup. I think the deal is he gets 1% of equity for X amount of hours worked, with an hourly rate a chunk lower than he normally works at. He seems happy with the deal and the client's happy with his work.

As a freelancer, I've been asked to work just for equity on various projects. Normally this is by people who have a poor business idea and often no real clue about how to implement their side (i.e. the business and marketing) side of the idea. So if you ask a freelancer about working for equity, even if it's a split deal with some money, please understand that you're going to need to sell them the idea just as you would any other investor. iamdave it sounds like you're not in this exact situation as you all ready know the guy.

</comment></comment><comment><USER4> as a freelancer on the side, myself, i'd say that you should consider asking him if he would be willing to scale back his hourly rate the more hours he works on your project or the more hours you can guarantee him contractually.

i do this, as if i have a longer-term, solid project to work on, i know i'll have that committed income stream, so i can afford to charge less since i know i won't be having a dry spell.

<comment><USER5> Out of curiosity, what's the number of hours at which this discount kicks in?

<comment><USER4> it really depends on the situation and the individual contractor.

in general, though, if you can offer at least 20 hours/wk for a period of more than just one week, try making a deal. the more hours you can offer, the better deal can be negotiated.

also, especially in situations like this, be nice/good to them. if you're easy to work for, that'll be a good influence in your favor.

</comment></comment></comment><comment><USER6> I am on the other end (a freelancer who often quotes clients more than they were expecting) and I would say you get what you pay for.

Higher rates probably get you better work, but they also include better customer service, someone who is responsible, meets deadlines, etc. If the freelancer can't guarantee those things, then ask why he is charging so much more than his competition.

<comment><AUTHOR> I would say you get what you pay for.

QFT. I have seen the quality of his services, we've talked about our own personal ethics and approaches to development on the kinds of things my company works for, and he's the guy I want on staff.

</comment></comment><comment><USER7> You might consider just hiring someone as a w-2 or otherwise someone who has never freelanced (or is not currently a freelancer.) Even if you could not hire this person long term at least the person would be able to gain some experience and cash.

The problem with freelancers is that they have lots of overhead. They may not have to pay a lot for equipment or a building but they have limited hours and many of those hours are spent doing non billable stuff. The overhead is in the lost time keeping the business going.

A freelancer with a long term gig could lower rates a bit but many of those overhead items still remain. Even with a long term contract a freelancer still has to do marketing, keep sending out invoices, "maintain" the clients and many other things that a non freelancer doesn't have to worry about.

</comment><comment><USER8> bjclark right on spot</comment>


Computer Vision in 1982 Using Altair Computers and a Cromemco Cyclops Camera - <AUTHOR> https://www.youtube.com/watch?v=2y5oVHNfbf8 <comment><USER2> In the context of my life right now, this makes me pretty sad. Seeing effort, ingenuity and engineering leap the many hurdles of that era and build something that still seems remarkable to me because of prolonged exposure to the lack of talent, knowledge, skill, vision and perseverance in my corner of industry (the overlap of "web development" and "enterprise IT").

If the footage here was taken with modern camera equipment so I could pass it off as being from today, I feel like I could probably show it to colleagues, make up a story about how it takes some servos designed by Elon Musk, a quadcopter with a 4k camera that hovers in place above the maze (for whatever reason), uploading the footage (with no regard to latency) to a "Deep Learning" algorithm invented by Google and motion control algorithm designed by Boston Dynamics that "only" uses 8 GPUs and "only" costs a few dollars an hour running in Amazon Web Services without having many questions to answer about any part of that.

<comment><USER3> >makes me sad...my corner of industry (the overlap of "web development" and "enterprise IT"

Why do you stay there and keep doing it?

<comment><USER4> That's where the money and expertise is, I'm guessing.

And it's one of those fields where you have to invest a truckload of time and energy in advance learning about everything, but once you've done that keeping up is (provided you're on a focused team) not _that_ hard and it's easy to be productive. But webdev and enterprise IT are so thoroughly vertically integrated (especially when developing LoB apps) moving away basically means facing a nontrivial period of downtime.

If you're valued enough and don't have a primarily liquid lifestyle (relative to cost of living etc) then living off savings could probably work for long enough to study and line up a job somewhere else, but that doesn't discount the added cost/toll of the extra stress it will inevitably impose.

<comment><USER3> I think your guess is probably right.

But some enterprise IT jobs can be soul crushing. I don't mean to sound 1st world ungrateful but we are lucky enough to have choices.

How do you non-financially weigh the benefit of pursuing a lifetime of rewarding work at say, one half the salary you could otherwise earn?

<comment><USER4> > _But some enterprise IT jobs can be soul crushing._

Mmm, yeah. Good work-life balance that provides for some sense of distance is critical with such positions. Something that helps you see beyond the job.

If the job makes that difficult or impossible and it's not because you're in the middle of a sprint or some other temporary situation, burnout is a matter of _when_ , not _if_. If you can't find a way to to mix things up and get a change of scenery within your current environment (eg, working on a different project, working as design lead on some totally unrelated team, etc), it might be a very very good idea to start mentally preparing yourself to redo your CV, I think.

> _How do you non-financially weigh the benefit of pursuing a lifetime of > rewarding work at say, one half the salary you could otherwise earn?_

Obvious answers are quality of life, general mood and health, etc.

Money is after all a tool, not an end in and of itself. Sure, money will get you lots of "friends" and social status, but that's only because you look shiny and might drop breadcrumbs. I'm not aware of any other reasons money is useful; indeed, the more you have the more vulnerable you are, beyond certain thresholds.

</comment></comment></comment></comment></comment><comment><USER5> I love how it sounds like it's a re-purposed memory chip used for the camera.

[http://jalopnik.com/the-first-digital-camera-you-could- buy-w...](http://jalopnik.com/the-first-digital-camera-you-could-buy-was-a- total-hack-1215543300)

<comment><USER6> To me this is one of the purist expressions of the hacker ethos. I work at Google, and our ethos focusing on doing things the right way, e.g. well engineered, scalable, etc. This works, but is often expensive and slow to execute, and the result may last longer without having to be rebuild from scratch.

But when you're hacking, you use whats available, often outside of the intended purpose of the components. You make the impossible, possible, today, rather than years from now.

So Cromemco was selling a totally non-consumer friendly item, but they made prosumer digital photography available 12 years before anyone else, and while this didn't benefit a huge number of people, this kind of early exploratory product creation can influence lots of other people to do things with it, that eventually spawns off industries.

I think the first real AI breakthrough, or what we think as SciFi style AI, might come not from researchers or large companies, but from some hackers mashing up a ton of techniques and approaches that make no logical sense to combine, and can't be fully explained, but somehow "work".

<comment><USER5> Yeah I agree it's a really cool hack! I wonder if they could have even used multiple chips to increase the resolution, assuming they could re-package the silicon to minimise gaps between them.

One of the books I really love is "Hackers: Heroes of the Computer Revolution" by Steven Levy. Which shows the inventiveness of those guys!

With respect to AI, that sounds really interesting, I'd not thought a lone researcher could create something so complex, but that would be really awesome. One of the projects I find really fascinating is OpenWorm, if I recall correctly they have a bunch of videos, where the neurons of the C. Elegans worm have been recorded optically and they're creating their model from those.

</comment></comment></comment><comment><USER7> Interesting to consider how, according to my recent reading of some machine vision review literature, the industry's standard process for process-oriented vision tasks has apparently changed so little in 35 years. Already we see high contrast polarization of the image (reduction to black and white/binary), feedback loop, ring lighting, and task-specific image object classification. Of course, there are newer techniques, but for many linear processes incorporating machine vision the same general approach is still taken.

<comment><USER8> I was thinking that as well; I had a project that needed computer vision and I thought to hack a prototype to give to the real experts. I used OpenCV but with techniques I have learnt begin 90s in university on Sun Sparcstations in C. When I was done I handed it over for the 'real' implementation and that team told me it was done as they would have done it as well. Of course they knew many tricks to make it more optimal but like you say, the basis did not change much. Do the modern neural nets need this level of preprocessing too?

<comment><USER9> I used OpenCV for the first time around 2 years ago, and I asked one of my professors if he had a good CV text I could use to quickly learn the basic techniques. The book was from the late 90s, but the algorithms it covered were basically the same as those in the OpenCV API. It was quite surprising to me that not much had been added to the state-of-the-art since the publication of the textbook.

For those curious, I was writing some code for 2D object distance estimation for use in a undergrad robotics competition. My team ended up losing, but I think we could have done better had I not started reading up on CV and writing code only a week before the deadline. I'm surprised we were able to even get past the first round!

</comment></comment></comment><comment><USER10> If I have seen further than others, it is by standing upon the shoulders of giants.</comment>


Georgia Guidestones (2010) - <AUTHOR> https://www.atlasobscura.com/places/georgia-guidestones <comment><USER2> These are a regional curiosity about two hours northeast of Atlanta. They're often vandalized, which has led to the installation of security cameras.

Some say that TV mogul Ted Turner was responsible for funding their construction, but the veracity of that claim has never been proven. The Guidestones do seem to fit the theme of his "doomsday video" that he instructed CNN to play in the event the world comes to an end.

If you live in Atlanta, they're worth a visit simply due to how eerie they are.

<comment><USER3> I doubt it was Edward Turner. "Keep the population at 500MM" sounds very fundamentalist (though turner is a conservationist I don't think he's that far off the wall).

While I think we would do well by slowing pop growth, a 1960-1970 even 1980s level of human pop is sustainable long term without depleting wildernesses and wildlife. 500MM seems quite artificially low. Like pre industrialization low.

It's too bad it gets vandalized though.

</comment></comment><comment><USER4> There is a documentary "Dark Clouds Over Elberton" that is pretty good. They conclude that a man named Herbert Hinie Kersten funded their creation.

</comment><comment><USER5> Creepy. Makes me envision a dystopia with Bond villain super rich dudes with lots of AI driven robots ruling over ~500,000,000 slaves after they bioweapon a few billion into early graves to make way for giant nature preserves.

<comment><USER6> something like this scenario?

[https://images.app.goo.gl/Ypwyc4jrdcYkXNWb8](https://images.app.goo.gl/Ypwyc4jrdcYkXNWb8)

</comment></comment><comment><USER7> Limit humanity to 500 Million people?

* Doesn't that seems a bit arbitrary?

* What about when we stretch out through the solar system and beyond?

* What about advancements in technology and behavior changes?</comment>


Tesla: An Investment that Wasn't a Lemon - <AUTHOR> http://dish.andrewsullivan.com/2013/06/04/an-investment-that-wasnt-a-lemon-ctd/

<comment><USER2> Major props to Elon and Tesla as a whole on paying back its government loan before its maturity date. Hope this catches other car manufacturers off guard and reinforces the idea of how successful an auto company can be with properly built and aesthetically looking electric vehicles.</comment>


Self-employment, or the illusion of freedom - <AUTHOR> http://libcom.org/library/self-employment-or-illusion-freedom <comment><USER2> I feel like this article lacks a fundamental understanding of the labor market.

The beauty of being self employed and working for multiple clients means that, if you are constantly promoting your skills, you can accelerate your way up the proverbial ladder.

If you get a "real job", you might have an opportunity for a raise or a promotion once every year; 6 months at best.

Working for yourself, you can have that opportunity every day. If your client wants to maintain freedom with you by hiring you as a freelancer, then there's no reason you can't do the same with them. Only committing 10-20 hours a week to a client allows you to do that.

Get a client for $10/hr at 20 hours a week, then start shopping for a client at $15/hr at 15 hours a week. Once you find that, look for a $30/hr client at 20 hours a week. When you find that, dump the $10/hr client and start looking for a $40/hr client.

THAT is how you climb the ladder. And it doesn't just have to be about money - you can substitute money for creative freedom or benefits or working conditions or whatever you're in the labor market for.

</comment><comment><USER3> Title is deceptive.

This article is a personal account of an office worker in the film industry in France.

Interesting, maybe, but not what you were probably expecting here.

<comment><USER4> Title could be better, but I found it an OK-read. The leap from film work to software work isn't a huge one (today's startup guy is yesterday's starving artist)

This passage in particular is where it begins to get more general

" The whole "start-your-own-company, be-your-own-boss" racket is heavily pushed by government agencies and all kinds of employers. It was first put forth as a solution to high unemployment unemployment and then, less openly, as a route to cut costs and erode worker solidarity and class consciousness. It relies on people's underlying hatred of work, personified by the boss, and sells the dream of autonomy by telling people that they can become their own, fake, boss. The reality is different."

<comment><USER3> Yes, sociologically/anthropologically interesting.

But not relevant to the startup world in the few countries I'm familiar with.

I've worked in France. Lovely place, but it's a socialist country with next to no startup culture (note, I was there more than ten years ago). I don't mean "socialist" as a pejorative, except to the extent that it inhibits the startup culture, and even then only for the HN audience.

Just suggesting that many people on HN, reading the title, would have expected a very different and more relevant article.

I don't agree with the characterization of govt and attitudes toward work and bosses in your quoted passage...not in my anecdotal experience, outside of France.

But one truth is clear: working "for yourself" and having "no boss" is almost always just code for having no administrative support and having to please multiple customers with significant, open-ended, and sometimes conflicting demands. Learning to manage these situations is clearly more effort than "getting a job", so it's not attractive or successful for everyone.</comment></comment></comment>


PayPal Launches PayPal.Me, Request Money Using Your Own Personalized URL - <AUTHOR> http://techcrunch.com/2015/09/01/paypal-launches-paypal-me-a-simpler-way-to-request-money-using-your-own-personalized-url/ <comment><USER2> Yesterday's discussion: [https://news.ycombinator.com/item?id=10152224](https://news.ycombinator.com/item?id=10152224)

</comment><comment><USER3> I'm using Paypal to pay for whatever I can right now and once my account is at zero I'm never using the account ever again. You see moving my funds to my bank account was impossible and no one at paypal would explain it to me after numerous calls.

</comment><comment><USER4> Looks like just a small charge to signup:

[https://paypal.me/signup/5/](https://paypal.me/signup/5/)

I'm joking, of course.

<comment><USER5> Yeah, 'signup' should probably be in the blacklist. Someone grabbed /support too - [https://www.paypal.me/support](https://www.paypal.me/support).

edit: And [https://www.paypal.me/help](https://www.paypal.me/help)

</comment></comment><comment><USER6> Sadly for me, it says it's not available in Estonia. Even though the article mentions that they (unlike Venmo) should be available to users outside US and US credit cards. Oh well, guess I just have to wait until some Estonian start- up steps up in this field.

<comment><USER7> Estonia is so ripe for startups, I'm surprised Europeans all over aren't flocking to it.

Cheap (by most European standards) intensely skilled workers who speak fluent English in a country who's government has the best investment in technology in the world.

From what I read last, Estonian workers (especially those who work in tech) are fleeing the country due to lack of jobs- it'd be nice to give them a way of staying home.. too..

</comment></comment><comment><USER8> Isn't this a copy of Square Cash [https://cash.me](https://cash.me) ?

<comment><USER9> Definitely the unaddressed elephant in the linked article.

The mobile-first design, the '.me' address... all of this points to an answer to Square Cash.

</comment></comment><comment><USER10> Has techcrunch become complete cancer now? My Safari keeps freezing trying to render that pulp.

<comment><USER11> Does Ghostery help reduce the load death?

It reports 14 trackers, ads and other crud items.

</comment></comment><comment><USER12> Cool. Just created my own: [https://www.paypal.me/100th/1](https://www.paypal.me/100th/1)

(Just for the test, I'm gonna give every 1000th person back the total I received like this. That should be something around $1000. Not sure how the conversion with $€ works. I'll let you know when/if that happens. Everything above the $1 I consider as a donation, but not required ;) )

Update: after some consideration adjusted to $1. Seems better as test.

</comment><comment><USER13> Paypal woke up after so many bitcoin startups offered this feature(changetip.com notably). Too bad, they didn't fix their other problems first.

</comment><comment><USER14> It would be much better if the payer could just use his credit card and email instead of having to sign up, people would be more inclined to use. The payee could send it to anybody (because they don't have to worry about if the payer has an account), and the payer because they don't have to sign up.

</comment><comment><USER15> They should focus on getting some working dashboard and integration for SaaS.

</comment><comment><USER16> Maximum limit of just under a million £$€ in the URl.

[https://www.paypal.me/edent/999999.99](https://www.paypal.me/edent/999999.99)

If you're feeling generous

<comment><USER17> I wanted to see how it looked, enjoy your penny (and probably my details).

<comment><USER16> All I can see is your name and email address.

I've refunded your penny :-)

</comment></comment></comment><comment><USER18> For me the page just displays random Chinese text, not a very useful service.

[https://i.imgur.com/MoNUKWo.png](https://i.imgur.com/MoNUKWo.png)

<comment><USER19> For me it was in french while i live in the Netherlands (where we speak dutch). Somebody needs to get a fancier IP db maybe.

<comment><USER18> I think all browsers send the accept-language header now, mine is set to en-US and the site completely ignores it.

</comment></comment></comment><comment><USER20> Your email address was already your own personalized URL...

</comment><comment><USER21> Great - now you pay somone and PayPal makes another 3% of the volume. We really need to replace the PayPal/CC fiasko out there.

<comment><USER22> And who's going to give you a warranty on your money? Bitcoin? hahahah

<comment><USER21> I haven't mentioned Bitcoin at all. No, the fee structure tied to CC (and also PayPal since it's largely based on CC) is so multi-tiered, that it needs to be redone without up to 5 tiers (PayPal, Visa, Issuing bank etc) making money on a transaction.

EFTPOSin Europe e.g. has way lower transaction costs and there is absolutely no reason why this shouldn't apply for credit card transactions. Some european countries have been regulating the visa/master card interchange fee already, I hope there is more to come.

<comment><USER23> PayPal is free for friends/family when you use a bank account instead of a credit card. And a variety of US banks already allow you to transfer money via ACH for free, even between banks.

EFTPOS actually originated in the USA in the 1980s. In the NYC area it was known as "NYCE" and centered around ATM sharing.

Citibank didn't join and that one drunk friend who'd insist on walking eight blocks in a shady neighborhood at 3am to save a buck pretty much killed the movement.

</comment></comment></comment></comment><comment><USER24> It looks like someone didn't read Paul Grahams essay: Change Your Name[1].

As far as the service, I feel inextricably linked to PayPal right now. I used PayPal through the early Ebay years and while I don't have any money in my account; It still pays for my Uber and I have a few friends who haven't updated to Venmo yet. There are also a few items which I've purchased online where I use PayPal as a proxy so the company doesn't get my CC info. I'll probably end up setting up an account just to hold my name, but I doubt I'll use it much.

[1] - [http://www.paulgraham.com/name.html](http://www.paulgraham.com/name.html)

<comment><USER25> The first line of the linked article is "If you have a US startup called X and you don't have x.com, you should probably change your name."

Pretty sure Paypal owns paypal.com. Also pretty sure Paypal is not a startup. Not sure how this article is relevant.

<comment><USER4> And the extra ironic part is that PayPal literally even owns x.com...</comment></comment></comment>


The Best Standing Desks - <AUTHOR> http://thewirecutter.com/reviews/best-standing-desk/ <comment><AUTHOR> I've tried only one—a Geekdesk Max—and really like it: [http://jakeseliger.com/2015/01/24/geekdesk-max-sit-stand- des...](http://jakeseliger.com/2015/01/24/geekdesk-max-sit-stand-desk-review- two-years-with-a-motorized-desk/) . I'd never go back to sitting, provided I could exert any control over my environment.

</comment><comment><USER2> I'm a big believer in the veriDesk Pro models. Much cheaper and easier entry than most of the dedicated standing desks. It's also really difficult for an employer to tell you no if you provide your own. I have a fairly significant injury to my lower back (1 surgery to correct cauda equina syndrome and another scheduled) and I find a 50% split to be ideal when I can manage it.</comment>


Ask HN: Are YouTube videos a good passive income channel? - <AUTHOR> I wanted to know whether making & publishing videos on Youtube is a good passive income channel similar to websites with adsense? <comment><USER2> [https://youtu.be/a49fipjglyc?t=7m49s](https://youtu.be/a49fipjglyc?t=7m49s) (Dan Olson on the Fine Brothers) suggests that "tens of thousands of views per video is only making little more than entertainment money per month on ad revenue alone"

</comment><comment><USER3> find a niche you love and do it because you enjoy it.

if you go into it just trying to make money the odds of even finding subscribers is low.</comment>


Vaclav Havel about the designers' civilisation - <AUTHOR> http://www.forum2000.cz/en/projects/forum-2000-conferences/2010/speeches/remarks-by-vaclav-havel-at-the-opening-ceremony/

<comment><USER2> I like everything up to and including this part:

"I believe that the recent financial and economic crisis was of great importance and in its ultimate essence it was actually a very edifying signal to the contemporary world."

I'm glad he prefaces the next paragraph with "Most":

"Most economists relied directly or indirectly on the idea that the world, including human conduct, is more or less understandable, scientifically describable and hence predictable. Market economics and its entire legal framework counted on our knowing who man is and what aims he pursues, what was the logic behind the actions of banks or firms, what the shareholding public does and what one may expect from some particular individual or community."

Because I know that the Austrians (most hard-core free market types) don't fit into the above.

"And all of a sudden none of that applied. Irrationality leered at us from all the stock-exchange screens. And even the most fundamentalist economists, who – having intimate access to the truth - were convinced with unshakeable assurance that the invisible hand of the market knew what it was doing, had suddenly to admit that they had been taken by surprise."

The invisible hand of the market did know it was doing. It was correcting an unsustainable boom. Were sovereign debt crises the fault of falling prices and fluctuations in stocks, or because governments spent more than they took in? Was the housing boom in the US a result of the market going crazy for no reason? (hint: take a look at the CRA, low interest rates, fannie and freddie to figure out that the answer is no)

The "visible hand" was what screwed up. This includes: governments and coordination of activities between central bankers/globalists to explicitly run the course of the world on their fiat money regimes.</comment>


S3: Plus sign is interpreted as space in the path part of URLs - <AUTHOR> https://forums.aws.amazon.com/thread.jspa?threadID=55746 <comment><USER2> I don't necessarily think this is even breaking the HTTP standard. While '+' should not be interpreted as spaces as part of a URL _while it 's being treated as a URL_, the HTTP spec doesn't specify / care what file that may map to on a server.

Edit: As mentioned below, this isn't correct since URLs should be able to be escaped and return the same resource, and an escaped + differs from an unescaped + on S3.

<comment><USER3> Exactly! The OP's point is summarized in this sentence:

> My point is that the spec requires + to be escaped only inside the > querystring.

So what? What the standard mandates for query strings is irrelevant here. It's up to the server how to interpret and map the URLs. "Unconventional and unfortunate" \- yes, but breaking the HTTP spec? No.

<comment><USER4> Please read the actual spec before telling poeple whether something is conforming to it or not. Just making stuff up is exactly how this mess is created. The relevant section in this case:

[https://tools.ietf.org/html/rfc3986#section-184.108.40.206](https://tools.ietf.org/html/rfc3986#section-188.8.131.52)

</comment></comment></comment><comment><USER5> Amazon has a difficult time with the HTTP standard sometimes. Last time I had to touch an AWS project we discovered a bug[1] in the C++ code backing a Java library (sic).

They had implemented their own HTTP client, but forgot to add the "Host" header to requests which is required by HTTP 1.1.

Interestingly this client sent requests only to their own services, which means that they either released that without testing it or the backend once accepted faulty requests.

[1]: [https://github.com/awslabs/amazon-kinesis- producer/issues/61](https://github.com/awslabs/amazon-kinesis- producer/issues/61)

<comment><USER6> It's common for HTTP servers to accept requests without a host header. It's not usually needed by the server unless you're hardening it (I don't class it as a security issue but some security audits will flag it up if you don't force the server to reject invalid host headers) or running named virtual hosts (which is more common than it used to be thanks to SNI but you still often see a 1:1 relationship between (virtual) hosts and IPs). So Amazon could easily have tested their client on 3rd party servers and still not spotted the problem.

As an anecdote, about 15/20ish years ago I wrote my own webbrowser. Obviously something highly rudimentary albeit browsers were much easier to implement back then anyway. I was too lazy to read the HTTP spec (it was a hobby project and I was young and impatient) so a lot of what I did was trial and error. I too wasn't sending a host header but it took long while before I ran into any sites that rejected my HTTP requests. The web landscape was very different back then though and IPs were plentiful but it just goes to show how servers have coded around bad clients for years.

<comment><USER5> > So Amazon could easily have tested their client on 3rd party servers and > still not spotted the problem

This would still be a red flag, as the service in question is their instance metadata service that provides authentication tokens.

Something that important should be integration-tested with the actual service.

<comment><USER6> > This would still be a red flag,

Perhaps I don't understand the issue you're discussing but how would the client working on 3rd party services be a red flag when that is the desired behavior?

<comment><USER5> Sorry if this was unclear: It's a client that they specifically wrote to talk to their own services, and they're releasing it to their customers as an official way to talk to their own services. It could not talk to their own service.

Their own documentation refers to that library (or did at that point in time, not sure about now).

<comment><USER6> Ahh I did misunderstand you then. Sorry. Yeah that does sound bad.

</comment></comment></comment></comment></comment></comment><comment><USER7> Does anyone know if this behavior persists when the bucket is served as a website?

</comment><comment><USER8> Anyone that's dealt with S3 in any capacity should be aware of this, it's literally one of the first encoding problems to come up when dealing with signing requests.

@dang can you please add (2010) to the title?

</comment><comment><USER9> Funnily enough, "URLs and plus signs" is still my most up voted question on stack overflow ( [https://stackoverflow.com/questions/1005676/urls-and-plus- si...](https://stackoverflow.com/questions/1005676/urls-and-plus-signs) ) -- same a+b example too. 7 years later, it seems even the big names have issue with this.

</comment><comment><USER10> This burned me and because of it I can't host a specific static site on S3 because it requires plus signs. Can't change the files being uploaded due to the system generating them... tried to rig up some sort of Akamai rewrite rule to change it at the CDN level but couldn't get it to work.

</comment><comment><USER11> (Update - the original title mentioned AWS has been breaking standards since 2010. The new title is fine. Thanks for updating it.)

Little bit of hyperbole in the title imo. S3 has generally been very good at embracing the fundamental principles of HTTP and REST, leaving aside corner cases like this.

<comment><USER12> Don't see a hyperbole. The title is technically correct (the best kind of correct), although questionable from a grammar standpoint.

</comment></comment><comment><USER13> I change the "+" into the escaped code :-) It helped

</comment><comment><USER14> &tldr; A legacy behavior is to treat + as a space. When you've been around you need to keep backwards compatibility.

URLs and URIs have separate standards from HTTP and they have changed over time (been replaced by newer ones).

Many years ago it was common to encode a space as a + sign. For example, the PHP function urlencode[1] does the same thing with a + sign. If you're a PHP user, don't use this function unless you know you need to. There are better functions now.

[1] [http://php.net/manual/en/function.urlencode.php](http://php.net/manual/en/function.urlencode.php)

<comment><USER15> > _If you 're a PHP user, don't use this function unless you know you need to. > There are better functions now._

Don't leave me hanging! What are the better functions now?

<comment><USER16> `rawurlencode()` is what you're after.

And here is where you'd ask that question, a coding forum [https://stackoverflow.com/questions/996139/urlencode-vs- rawu...](https://stackoverflow.com/questions/996139/urlencode-vs-rawurlencode)

<comment><USER15> Thanks!

And here is where you'd answer that question, a coding forum [https://stackoverflow.com/questions/996139/urlencode-vs- rawu...](https://stackoverflow.com/questions/996139/urlencode-vs-rawurlencode)

;)

</comment></comment></comment></comment><comment><USER17> It's reasonable they don't want to fix it because it will break existing URLs. Welcome to the ugly world of back compatibility.

<comment><USER18> They could make it configurable on a per bucket basis (perhaps defaulting to the old behaviour if necessary; ideally you would make the conformant behaviour the default, of course).

That way you could opt in to the standard conformant behaviour if you require it, but they can still keep backward compatibility.

<comment><USER12> I'm not familiar with how S3 works in detail, but I imagine this could require additional API calls in the backend which increases the latency and resource usage of API requests. In the worst case, such a change could easily require Amazon to purchase dozens, if not hundreds of additional servers.

<comment><USER19> With the rate of AWS growth, they probably bought dozens more servers in the time it took you to write out your response. :)

<comment><USER12> Likely, but Amazon didn't get where they are by ignoring small costs.

</comment></comment></comment></comment></comment><comment><USER20> Should this really be considered to be a spec violation? It's a restriction, sure, but S3 is to be considered a specific application with specific constraints.

<comment><USER21> Does S3 use HTTP ? If so, it's a violation of the specification of S3 by way of incorporation of the HTTP specification.

Otherwise, if S3 does not use HTTP, we would need to see the S3 specification to determine if it (the implementation Amazon uses) is in violation

</comment></comment><comment><USER22> In response to the reported RFC violation, elving@AWS writes: "I agree that's unconventional and unfortunate." My corporate bullshit detector is off the scale.

In earlier times, we would have both the ability and the balls to treat that unwillingness to uphold the rules we all set out with as damage to the Internet, and route around it. But sadly, AWS has become too big to fail, so the engineers introduce special cases into their products and deploy them.

<comment><USER11> To the contrary, I think it's actually a refreshingly honest response. A "corporate bullshit" response would be to ignore it altogether, try to argue it's a feature not a bug, or give a canned statement about how we respect the environment and want the world to be a better place.

The AWS support is explicitly acknowledging it's an issue, while giving a rational reason why it probably won't be fixed (even if you disagree with the reason). The back-compat concern is unfortunate but a good argument can be made it's not in users' interests either (beyond being just a cost to AWS to implement the change).

<comment><USER23> But can they even change it without risking to break tens of thousands of websites?

<comment><USER11> They could, by versioning the API (e.g. add a /v2/ to all paths), but that would benefit no-one and should only be done alongside any number of much more important changes.

<comment><USER24> That opens a whole new can of worms. They have not deprecated a single part of the s3 API ever, in history (okay I'm partially lying, the SOAP API is now officially deprecated in the sense that they won't add new features to it).

They're not going to change it just for the sake of some minor path issues that have a workaround. (Side note: They tend to uses headers rather than paths for API declarations). I have personally been bit by this same issue, but I would never recommend they change pieces of the service to accommodate it. It's handled easily in client code. What they could do is make an obvious "gotchas" section of documentation

AWS has done a tremendous job of getting things right-enough the first time. They have never killed an AWS service. They'd need a much bigger reason to version an API.</comment></comment></comment></comment></comment>


Billion laughs - <AUTHOR> http://en.wikipedia.org/wiki/Billion_laughs <comment><USER2> It isn't obvious at first glance that this small xml file actually expands to billion "lols". You really have to give the bad guys credit for ingenuity.

<comment><USER3> :(){ :|: & };:

Even simple bash scripts can do weird things like this. And that's a lot smaller.

<comment><USER4> Yeah but there's a HUGE difference: bash is intended to be a turing complete language, while XML is a data format. It's trivial to use infinite resources if you can execute arbitary code.

It shouldn't be possible to use resources exponential to the input size for just PARSING (not doing anything else with) XML. This is a great example of why you want to use simple serialization formats like JSON.

It's the same reason I never liked YAML. The spec and implementations are just way too big. There's got to be something hiding in there like this.

<comment><USER5> YAML is acutally trivially compatible with this exploit, in a sense, though the result is not particularly disastrous with Psych.

        lol1: &lol1
          "lol"
        lol2: &lol2
          [*lol1,*lol1,*lol1,*lol1,*lol1,*lol1,*lol1,*lol1,*lol1,*lol1]
        lol3: &lol3
          [*lol2,*lol2,*lol2,*lol2,*lol2,*lol2,*lol2,*lol2,*lol2,*lol2]
        lol4: &lol4
          [*lol3,*lol3,*lol3,*lol3,*lol3,*lol3,*lol3,*lol3,*lol3,*lol3]
        lol5: &lol5
          [*lol4,*lol4,*lol4,*lol4,*lol4,*lol4,*lol4,*lol4,*lol4,*lol4]
        lol6: &lol6
          [*lol5,*lol5,*lol5,*lol5,*lol5,*lol5,*lol5,*lol5,*lol5,*lol5]
        lol7: &lol7
          [*lol6,*lol6,*lol6,*lol6,*lol6,*lol6,*lol6,*lol6,*lol6,*lol6]
        lol8: &lol8
          [*lol7,*lol7,*lol7,*lol7,*lol7,*lol7,*lol7,*lol7,*lol7,*lol7]
        lol9: &lol9
          [*lol8,*lol8,*lol8,*lol8,*lol8,*lol8,*lol8,*lol8,*lol8,*lol8]

<comment><USER6> In YAML, this is 9 objects in memory, one of them is a scalar, the other 8 are arrays of size 10 that happen to be pointers to the other objects. Not very big at all... much less than 1k. It's not even interesting since YAML competently serializes graphs that are far more complex. Lots of reasons to trash YAML, this isn't one of them.

As aardvark179 noted, a usage concern with YAML is more with how an unguarded application might fail to check for serialized graph cycles.

<comment><USER5> That makes sense. I tested this in a REPL that tried to pretty-print the result.

</comment></comment></comment></comment></comment></comment><comment><USER7> Probably should rename this to "billion reposts."

Can we move beyond this simple issue and discuss more complicated aspects of security on HN?

<comment><USER7> Fine, you guys asked for it.

<https://news.ycombinator.com/item?id=259458>

<https://news.ycombinator.com/item?id=3859853>

<https://news.ycombinator.com/item?id=1674911>

<https://news.ycombinator.com/item?id=301296>

<https://news.ycombinator.com/item?id=4619344>

People that exploit these kinds of things continue to innovate, but HN seems to be stuck with XSS, SQLi, and malformed XML.

<comment><USER8> While I'm all with you on talking about advanced security, the reality is that most people here don't understand basic security. I think talking about the low-hanging fruit is important -- everyone has to start somewhere. And as always, if you want to see more advanced security stuff, post it! I'll upvote it for sure.

Edit: This does make me think that I've been meaning to write a blog post about a security issue I discovered for about 6 months now. Time to do that.

<comment><USER9> Which he did: <http://news.ycombinator.com/item?id=4678309>. This is a tale in which cody pretty much ends up owning ccbill.

</comment></comment></comment></comment><comment><USER10> So, how much memory would a real-world parser actually consume given this file? I'd try it, but I had to RMA my workstation's motherboard yesterday, leaving me with a machine that only has 3GB, which is the obvious minimum for a full expansion. But I could imagine an XML parser might use UCS-2 internally, inflating this to 6GB. Or, some parsers might be clever and not attempt a full expansion.

<comment><USER11> So you're asking how much memory this resoource exhaustion attack consumes when you run it.

Each line in the WP examaple amplifies by a factor of 10. It has 9 lines. It's 10e9. That's a billion times 3, which is just enough to 32-bit virtual memory space in common operating systems.

Of course the XML implementation could be smart and short-circuit this while preserving the semantics.

<comment><USER12> I think you mean 10^9 = 1e9 rather than 10e9.

(And the parent actually mentioned the 3 GB minimum, I think it was essentially asking how much extra memory a real world XML parser uses.)

<comment><USER13> Nope, 10e8 is what you're both looking for, as 1^9 is.. 1.

<comment><USER14> Actually, dbaupp is correct. The e1 parts means *10^9.

See: <https://www.wolframalpha.com/input/?i=1e9>

</comment></comment></comment></comment></comment><comment><USER15> Is there a legitimate use case for being able to recursively define entities like that?

<comment><USER16> Look again. There's no actual recursion going on. It's fairly trivial to identify recursion in DTD entities.

<comment><USER17> Rather than nitpicking the terminology, can we answer the actual question: is there any legitimate use case for defining an entity in terms of another entity?

<comment><USER18> Right, that's the root of the problem: feature creep. Common with design-by- committee.

As with any feature, there are possible use cases. Perhaps you want to create a form document and use custom entities that you modify later to fill the document out.

But the amount of times that's useful is not likely to be worth the potential harm of things like billion laughs. Easy to separate that functionality, and have your XML parser do an element data replace with your own custom tokens. Eg node.replace("{name}", customerName);

</comment></comment></comment></comment><comment><USER19> I have to say, i love this, crazy, for a language that is really for transferring data.

I guess you could do this with YAML too?

<comment><USER20> To pull this particular style of trick you require a schema definition that allows for one object to be expanded into a whole set of objects, and for the resulting data structure to be a tree rather than a simply a rooted directed graph.

I don't know YAML well but I believe if you tried this trick with something like alias nodes then you would end up with a lol9 node with ten separate connections to a single lol8 node with ten separate connections to a single lol7 node and so on. This would not produce the same problem in the parser, though might trigger problems in whatever processed the resulting graph.

<comment><USER6> That's definitely correct: Since you can produce cycles in YAML (it's deliberate choice), programs which don't check for graph cycles and blindly go about traversing a serialized graph are subject to DDOS.

</comment></comment></comment><comment><USER21> This doesn't work with my sed-based XML parsers. :(

</comment><comment><USER22> so, how do I protect myself against this?

<comment><USER23> Use a parser or data structure that doesn't duplicate identical objects.

Functional programming wins here.

<comment><USER24> You might, but the expansion happens on a level that might be really hard to implement if you want to keep XML semantics. E.g. in the DOM API, each element has its own identity - you can't collapse identical objects (or you could, but the objects generated this way aren't identical, they have different parent nodes for example).</comment></comment></comment>


Ask HN: Anyone who lives/works in Mill Valley/Sausalito area? - <AUTHOR>

All,
I recently moved to Sausalito from Palo Alto to work at a startup based out of Sausalito. I'm pretty new to this area and curious if there are any 20-40-somes who live/work here? I'd love to meetup and have drinks etc. Also, happy to organize a weekly/monthly meetup if there's an interest.
Please bop me (firstname.lastname@example.com) or reply in this thread if you do live/spend some time around Mill Valley/Sausalito area.
Thanks :) <comment><USER2> Not anymore but I had clients up there several years ago and worked out near west marine on gate 5 road for about 8 months about a year ago. There is a little coffee shop called "Taste of Rome" on the way into town that I used to like to hang out in. Nothing special really but they used to have live music on fridays and a fair number of locals.

<comment><AUTHOR> I've heard of Taste of Rome but just haven't been there yet. Will definitely check them out. I live up in the hill and the demo is skewed towards married couples with .5 kids.

</comment></comment><comment><USER3> <http://www.hackernewsers.com/> use to be an awesome tool for connecting like minded folks from the HN community. However, I just visited it again and it seems to be down.

</comment><comment><USER4> Live in Mill Valley - it's fairly quiet for the tech scene here, but that's what SF is for. :)

There's a few "North Bay" entrepreuneur meetups but I haven't been to too many. Usually I just go to ones in SF.

<comment><AUTHOR> Agree! I did find Startup Grind North Bay meetup: <http://www.meetup.com/Startup-Grind-Northbay/>

I believe mid-late 20 folks like prefer to live in the city.

Edit: CorpQNA looks interesting :)</comment></comment>


Ask HN: In our field, how do you manage your learning? - <AUTHOR>

I have at least 7 things that I want to learn. I have an Evernote notebook with all the things I want to learn and all the resources I need.<p>How do you manage your time to get through all of them, one by one? <comment><USER2> I follow the routine of making big plans, completing 60% of them and then repeating the cycle.</comment>


Ask HN: Any good SIM-only carriers or plans in US? - <AUTHOR>

I would like to find service in the US, but I don't need a subsidized phone or (if possible) a contract. Does anyone know of any good options? <comment><USER2> Do you already have a phone? Sounds like you do, just checking.

If you walk into a T-Mobile or an AT&T Wireless store with a phone in hand, the salesperson can work with you. I recently checked this out for a development (unsimlocked) G1 running a friend's custom build of Android. I wanted just data service (no voice except emergencies). Did not want a contract.

The T-mobile person was happy to help, but couldn't give me an exact price until we'd run through the system. Said would be between $30-$50 per month. The AT&T person was also happy to help, but he cautioned that AT&T doesn't support the G1 and if anything happens I would be on my own. They were asking ~$35/month IIRC. Again, this is for data only -- voice is extra.

If you just want voice and not data, you can always buy a prepaid phone, then throw away the phone and take out the SIM card. That's actually what I'm doing with the dev G1 right now while I weigh the data options. I have an AT&T GoPhone prepaid service, works fine for voice.

</comment><comment><USER3> T-Mobile will sell you prepaid service at $100 per 1000 minutes/SMS messages, or pay-as-you-go for $30-40 per month without a contract. I have service for my G1 via the latter option, which costs me about $75/mo. with unlimited data and more calling minutes than I can conceivably use.

My experience has been that most carriers will happily let you sign up for some sort of prepaid service without a contract, as long as you don't expect hardware discounts.

<comment><USER4> You can get full data with T-Mobile prepaid? I'm using a SIM pulled from a $19.99 prepaid phone stuck in an iPhone 2G and all I get is EDGE service, funneled through their WAP portal. You really need the monthly service to get full internet connectivity (friend's G1 SIM in my phone works great).</comment></comment>


Think different, Apple. Peak iPhone? I don't think so - <AUTHOR> https://medium.com/babagadget-blog/think-different-apple-bd97af13f51#.8bmbaftpe <comment><USER2> Cheap iPhones have existed for nearly 10 years. They're just last year's model. That blows a gaping hole in this entire article.

<comment><AUTHOR> There are a lot of people who won't buy a used phone. And last year's model is not $249 brand new.

<comment><USER2> Then two years ago, whatever. I wasn't referring to used phones, anyway. There have been "cheap" iPhone options for a long time, and a decent, brand-new Android phone didn't really pop up until the Moto X, which was something like 2012.</comment></comment></comment>


The Curious Case of Copy and Paste - <AUTHOR> https://research.securitum.com/the-curious-case-of-copy-paste/ <comment><USER2> The related issue most irritating for me is that google search makes the URL hover claim one destination but when you click the click itself rewrites the URL to funnel through their tracking service.

This is an extremely dangerous attack vector which google is abusing to compromise user privacy (but fortunately, not worse). There was a firefox bug open on this for years but it seems like Mozilla really didn't want to break their big sponsor's analytics. ( [https://bugzilla.mozilla.org/show_bug.cgi?id=229050](https://bugzilla.mozilla.org/show_bug.cgi?id=229050) )

I find it extremely annoying because I often search for PDFs to answer questions for people and if I click the link it pops up in an external viewer and I get no opportunity to copy a url. Unfortunately the right-click to copy also triggers the onclick handler to add the google tracking spam, causing me to copy an extremely long and chat-unfriendly URL.

<comment><USER3> (DuckDuckGo doesn't do this, which is one of the minor reasons why I use it.)

<comment><USER4> I recently discovered that DDG does clickjacking too, albeit in a different way. My blog post: [https://lapcatsoftware.com/articles/duckduckgo.html](https://lapcatsoftware.com/articles/duckduckgo.html)

<comment><USER3> Oh, that's interesting. I wonder if this is intentional?

<comment><USER4> Yes, their JavaScript is checking whether you clicked an ad, clicked a DDG internal URL, etc.

</comment></comment></comment></comment></comment><comment><USER5> The ability of Javascript to alter the "copy" contents is, like the ability to disable zoom, something that's nearly always used against the user and the usability and accessibility of the site. Such as appending disclaimers and copyright notices to strings.

<comment><USER6> The problem is that the same medium (HTML) is used for "documents" and "applications". Programmatic access to clipboard, zoom etc is legitimate for "HTML applications" like Google Docs/Maps but unnecessary for "HTML documents", along with virtually all scripting.

<comment><USER5> I'd quite like to see a three-way partition between "dumb document" (DOM frozen after load, possibly no processing at all), "smart document" (DOM APIs only, possibly plus classical HTML form submission), and "actual application". Ideally with a way of telling which is which _before_ loading it. I don't realistically expect this to happen.

The stupid thing about AMP is that it's trying to push sites back into the "document" box, but only so that they can be monetized more effectively by Google...

<comment><USER7> It would be great if this could be enforced with browser permissions.

 _Allow Gmail to run as an application in your browser?_

[ _Deny_ ] [ _Allow_ ] [ _Always Allow_ ]

</comment></comment></comment></comment><comment><USER8> Copy and paste in browsers is a horrible mess, as LibreOffice is finding out with its web version: [https://people.gnome.org/~michael/data/2019-09-12-copy- paste...](https://people.gnome.org/~michael/data/2019-09-12-copy-paste.pdf)

<comment><USER9> Heh. this reminded me some libreoffice bugs i track. One is to have plain text copy paste be the default. The other is to completely disable selected text dragging.

There's a large number of people who likes both of these features. Go figure.

</comment></comment><comment><USER10> It's tangential to the article, but I've found it's been really helpful to have dedicated copy and paste buttons on the left hand. On Linux the highlight and middle click is nice, but not every application can be selected (like split windows in tmux) and the buffers don't always match between applications (like Firefox and something else). But I've found Ctrl+Insert and Shift+Insert works practically without fail everywhere. I have a programmable keyboard so made macros for those two commands and mapped them to keys on the non-mouse hand (extra thumb keys on an ergodox, not bad to lift the hand a little to reach them). Works great! For something so universal as copying text it would make sense to have dedicated keys for them on many keyboards, like volume up or down.

</comment><comment><USER11> Hey, I'm the author of the write-up. Nice to see my research here!

If you have any questions, please let me know.

</comment><comment><USER7> Great write-up. Reminds me of different copy-paste concerns that persist in other platforms. [1]

[1]: [https://news.ycombinator.com/item?id=22569662](https://news.ycombinator.com/item?id=22569662)

</comment><comment><USER12> All keyboards should have cut/copy/paste buttons under the delete/end/pgdn row.

<comment><USER13> On Linux: Control+Insert/Shift+Insert for copy/paste

</comment></comment><comment><USER14> In a barely related subject, does anybody knows a good clipboard manager (e.g. multiple copy + paste) for mac that supports both text and images? (like Ditto on Windows)

<comment><USER15> For Windows, Thornsoft Clipmate is very powerful and one of my must-have utilities, despite its lack of recent updates. [http://thornsoft.com/](http://thornsoft.com/)</comment></comment>


Univalent Foundations: "No Comment." - <AUTHOR> https://mathematicswithoutapologies.wordpress.com/2015/05/13/univalent-foundations-no-comment

<comment><USER2> I am definitely not a mathematician—and this is probably why—but I mostky resonate with Tao's views from the article:

> _some day we may actually write our papers… in language that some smart > software could convert into a formal language_

What I find fascinating about proof assistants and type theory is what I find fascinating about programming languages in general: they give me a language—and with that a whole world—that is more accessible and manipulable than the less concrete way of thinking so many others seem to prefer. It's like the difference between making something out of Lego as opposed to clay. I'm still making castles in the clouds, but they really exist in a surprisingly concrete way because they're made up of concrete parts. I can feed them into a compiler and execute them or run them through static analysis and answer questions about them… (As an aside, I find the same value in music theory: it provides components needed to turn arbitrary sounds into music without being overwhelmed.)

As a bonus, programs end up inherently well-founded and checked for correctness, potentially to an extent unrivaled by even the most rigorous natural language arguments. But that's just that: a bonus. The real value of a proof assistant is for _assistance_ , not proof. (Which, I should add, is radically different from automatic theorem provers, which are far more relevant for CS than math.)

The lock-in comment at the end is interesting, but not limited to _technical_ lock-in. Mathematics, as a community, already has quite extensive _social_ lock-in—in large part simply because it _is_ a community. And what happens to people whose ideas cannot be expressed in light of this social lock-in (but may, in fact, be entirely consistent)? They are indeed "forced to resort to _samizdat_ , or even blogs, to get their work published". I suppose in a world with finite resources and attention this is inevitable, but I don't think the technical factor changes anything meaningfully. If anything, it's a better sort of lock-in because it would have a technical component independent of social issues, personalities and fashion.

<comment><USER3> Not a mathematician either, but Tao's view does make sense for me.

What Lurie seems to be missing is you don't necessarily go "down to the metal" when using an ideal proof assistant. Ideally you should be able to specify almost the same arguments for formalization.

The only fundamental impediment I can think of relates to the following: is there some clear step that (for example) shows a proposition, which might be laborious and hence omitted normally, and is not amenable to being automatically filled in? I'm not sure of the commonality of this case, since as far as I know mathematicians tend to want to minimize intuitive leaps that are not completely obvious.

Even then, it might be useful for all other instances. So how close are we really to getting this piece of software? Seems quite revolutionary for writing mathematics; and equally interesting are the advances required to get there.

<comment><USER4> > is there some clear step that (for example) shows a proposition, which might > be laborious and hence omitted normally, and is not amenable to being > automatically filled in?

Automation works well for first-order logics, whilst proof assistants work with higher-order logics. One consequence is that inductive proofs are very difficult to automate; we can say "XYZ follows by induction", but the computer's often unable to construct such a proof.

There are various approaches to converting back-and-forth between different logics, eg. Isabelle's "Sledgehammer" tool, but

\- Some structure can be lost or obscured in the initial translation, which makes finding a proof harder

\- Using proofs converted from another logic can cause proofs to be overly- complicated and "unnatural". If they have any computational content (eg. where the proof is a datastructure or function), this can make working with such values more difficult (eg. if we want to prove a property holds in every branch of a function, having an overly-complicated function which branches based on not-completely-relevant conditions makes our life harder).

</comment></comment></comment><comment><USER5> I found it nifty that each commenter has a Wikipedia page to their name.

</comment><comment><USER6> Regarding the last paragraph from the article, about lock-in: as long as the chosen foundations are strong enough to reason about proofs themselves (as formal objects), it doesn't really matter. For example, suppose mathematics gets locked-in to a proof verifier based on Logic A, and I want to work from Logic B. Rather than prove Theorem T using Logic B, what I can do is prove Theorem T* using Logic A, where T* is the theorem: "Logic B proves Theorem T".

</comment><comment><USER3> Related discussion: [https://news.ycombinator.com/item?id=9572426](https://news.ycombinator.com/item?id=9572426)</comment>


Apple Hit with Two Class Action Lawsuits over iPhone 7 Audio Issues - <AUTHOR> https://www.macrumors.com/2019/05/07/apple-class-action-lawsuits-iphone-7-audio-issues/ <comment><AUTHOR>
         Apple's document said service providers could request a
         "warranty exception" for affected iPhones, which
         resulted in free repairs for at least some customers,
         but that abruptly ended in July 2018 after Apple
         deleted the document.

We're probably just a deleted-document away from keyboard replacements costing $795 each time too.</comment>


A facelift for the Macintosh - <AUTHOR> https://curved.de/news/curvedlabs-ein-facelift-fuer-den-macintosh-198570 <comment><USER2> > _However, when building new technology Apple often unfortunately neglected > their own design history._

One might argue that good designers and designs move on as they co-evolve. This "new" design is a nice piece of borderline-functional retro chique, but apart from being thin it hardly qualifies as futuristic or practical from our perspective today.

As components shrink, people expect the display to become the only visible component of the computer - and Apple is clearly on that path. I would consider it the right path from a usability as well as a design perspective.

<comment><USER3> > people expect the display to become the only visible component of the > computer ... from a usability as well as a design perspective

I'm not sure putting the ports on the rear of the e.g. iMac improves usability. It certainly looks nicer, but I wouldn't consider the required neck acrobatics to plug in a thumb drive a usability improvement. (But I guess it makes sense in the long-term with everything going wireless.)

<comment><USER4> Simply hook up a short cable and let it dangle from the rear.

<comment><USER5> What? How is that more aesthetically pleasing _or_ more functional than simply putting the ports where you can reach them easily?

<comment><USER6> There are basically four kinds of devices:

1\. interaction peripherals where Bluetooth+batteries is workable (keyboards, mice)

2\. interaction peripherals where Bluetooth+an external power cable is workable (speakers)

3\. low-power data peripherals (CF cards, flash drives) where low-speed USB is acceptable

4\. high-speed data peripherals and controllers (RAID storage, discrete GPUs, etc.) that effectively need a PCIe channel

1 and 2 are wireless, obviously. 4 doesn't get reconfigured much, so it makes sense that Thunderbolt and related "extension" ports are on the back of the device. (They were previously _inside_ the device, after all.)

3 is the main problem, then, that currently suggests accessibility of ports: the small, transportable, label-able data-containing devices that descend from floppy disks.

But why not think of alternative solutions, if "lightweight" data storage devices are the only constraint?

One design I always thought fondly of was having small magnetic-backed data- storage "pucks" with no plugs as such, and making the non-screen part of the computer (e.g. the front-bottom panel area of an iMac) a magnetic attach-point for them. You would literally "mount" the your drives onto the computer. (Presumably it would inductively power them while they're there, too.)

This wouldn't be a very fast storage device class compared to something using actual wires, but it wouldn't need to be; fast storage is what Thunderbolt et al are for.

It'd likely also have other uses: for example, magnetically attaching your ID card (which is also a smart card) to a corporate computer to cause it to log in—and also to indicate to anyone else walking by that the computer is in use.

</comment></comment></comment></comment></comment><comment><USER7> Regardless of its practicality the design made me smile.

</comment><comment><USER8> The design is a bit tacky and has too many useless elements. The extra long thing next to where the SD card goes into. Why is there a slit there? Just to remind you of the old Apple II? It's not needed and Apple would never do that.

That Apple logo on the front is nothing Apple would do. Lower left? nah. Apple would put one Apple logo on it. On the back. Maybe even none at all (look at the Mac Pro).

The headphone jack seems perfect to pull the thing down right on it's screen. The blue glow on the back? really?

Apple designs are about removing the bezel and letting the computer disappear and let the screen come out. This thing is like 60%-70% computer and 35% screen. This isn't a "facelift", it's a mock up of a design regression.

 _This would never be something out of Cupertino._

<comment><USER9> > That Apple logo on the front is nothing Apple would do. Lower left? nah.

If you look at the actual apple computer standing next to the mock-up, you'll see the nothing-Apple-would-do-lower-left logo.

According to his biography, Steve Jobs added a handle to the original iMacs, not because he wanted people to carry them around, but because it made it less threatening to people who aren't used to computers.

So adding things is part of Apple's design history.

Anyway, the rest of the slit is a speaker, so while it is obviously there as a throw-back (the whole design is a throwback) it does serve some purpose.

</comment></comment><comment><USER10> This looks like it wouldn't stand up to me? There would have to be something pretty weighty in that bottom portion...

</comment><comment><USER11> I miss the sunflower design.

</comment><comment><USER12> But can I play Bolo?

<comment><USER13> Bolo! Many an afternoon was spent in the computer science lab that had a bunch of Macs hooked up, playing Bolo.

</comment></comment><comment><USER14> The design seems good though a little unnecessary. There's a lot of extra unused space on the screen which is also increasing its weight. Now if the screen's triangular, that'd be awesome.

</comment><comment><USER15> Yeah, who wants widescreen anyway? ;)

<comment><USER16> Widescreen has never been a very good layout for anything other than multimedia.

<comment><USER17> It's good for side by side docs/code as a space saving alternative for a multi-monitor setup.

</comment></comment></comment><comment><USER18> The worst part of this design is now Apple can never release it.

<comment><USER19> The designer has probably infringed Apple's design patents making this. The designer couldn't do anything if Apple released an identical product because they'd countersue him and win.

</comment></comment><comment><USER20> I like that design. :)</comment>


Butch Cassidy and the Sundance Kid's Last Tango - <AUTHOR> https://www.thedailybeast.com/butch-cassidy-and-the-sundance-kids-last-tango <comment><USER2> You can still visit Butch Cassidy & the Sundance Kid's ranch cabin today just off Ruta Provincial 71 in Cholila, Argentina. Here's the location on Google Maps: [https://goo.gl/maps/pJuzdodbpJeejLEu7](https://goo.gl/maps/pJuzdodbpJeejLEu7)

</comment><comment><USER3> It's totally bonkers that they met Hiram Bingham while he was on his way to go discover Machu Pichu. South America is apparently a much smaller place than it would seem!

<comment><USER4> I think it's more to do with there being established routes and nexuses, much fewer people than today and they probably didn't feel the need to go off- piste.</comment></comment>


Public Highly Critical of State of Political Discourse in the U.S. - <AUTHOR> https://www.people-press.org/2019/06/19/public-highly-critical-of-state-of-political-discourse-in-the-u-s/ <comment><USER2> >Majorities in both parties say it is very important that elected officials treat their opponents with respect. But while most Democrats (78%) say it is very important for Republican elected officials to treat Democratic officials with respect, only about half (47%) say it is very important for officials from their party to treat Republican politicians with respect. There is similar divide in the opinions of Republicans; 75% say Democrats should be respectful of GOP officials, while only 49% say the same about Republicans' treatment of Democratic officials.

If there's one thing that unites us all, it is intense and hypocritical tribalism.

<comment><USER3> > If there's one thing that unites us all, it is intense and hypocritical > tribalism.

"You need to be tolerant of my beliefs, but I don't need to be tolerant of yours"

<comment><USER4> Not all opinions are equal and there's no reason to treat them as such.

<comment><USER5> Your interpretation of his comment quite succinctly sums up the problems with society today. Being tolerant of something is not the same as treating it identically to other views. Imagine my neighbor is completely and absolutely convinced that 2+2=5. I'd be somewhat curious why somebody would believe such a peculiar thing. If we had the time I'd certainly be happy to indulge him and of course I'd also try to correct him. If, at the end of the day, we couldn't agree? That's fine. Of course I'm probably not going to be convinced that 2+2=5 and won't make a secret of it, but _agreeing to disagree is okay_.

In practice this distinction of tolerance vs "all opinions are equal" is even more critical because many of the topics people love to get into heated arguments about have compelling, entirely factual, arguments supporting mutually exclusive conclusions. Life's fun that way. On these sort of topics - guns, migration, economic systems, etc - there are of course some completely unsupportable views, but there are no right answers. In fact they probably literally do not exist since even with omniscience, the answer would still be contingent on the state of a society and people at any given point in time and place.

We all believe the things we believe because we, tautologically, think they're what we ought believe - what is most right, or most supported, or whatever our personal value system tells us is correct. The problem we face today is when we then start assuming that because our value system tells us _this_ belief must be the most valid, that we start to treat other completely supportable views as invalid.

<comment><USER6> I think deep down, most people agree with you. But it's not very practical to have a level-headed approach to political discourse, since most political topics of the day are not rooted in morality, but instead are economic agendas shrouded in morality. For example, no one really knows the systems effect of forgiving student loan debt, but politicians advocating for it are quite confident that that policy helps them win. So, being uncertain or open to discussion along the lines of whether or not that policy is good for the US isn't really the point. It's already known to be good for other, more palpable reasons, and any effort to shift the discussion into uncertainty about the effects of the US is only bad for the politician who already knows about the policy's effect on them personally.

</comment></comment></comment></comment></comment><comment><USER7> And New Yorkers prefer the sound of ocean waves to the sounds of car traffic and jet engines. So what?

What the public prefers is irrelevant. The content of public discourse is dictated by the acoustics of the media environment. We are trapped inside a terrible, gigantic conch, which resonates with the frequency of scandals and sound-bytes and dampens the sounds of thoughtful debate.

</comment><comment><USER8> I see self-censorship in public political discourse, and that gives too much room for charlatan entertainers to suck up all the oxygen in the room. The negative discourse is not what the general public is engaging in.

Fully 40 years ago I remember more public debate about politics than today. I'd characterize that as having been semi-productive. The newsertainment pundits today just try to rile people up. It's anger for-profit. Getting pissed off is a product you buy by watching or following a professional agitator. And that is not public discourse, in my view.

</comment><comment><USER9> US needs a third major political party ASAP.

<comment><USER3> The funny thing is, I see merit in both parties. I like conservatism when it comes to the 1st and 2nd amendment protection, freedom of religion, etc, but I hate how the right treats the environment as a resource to be wasted, used, and abused. I think the libertarian stance on drugs is a little too extreme (I think drugs should be legal, but that they also shouldn't necessarily be easily accessible - people should still have to jump through a few hoops to get them). Rinse and repeat of a lot of issues.

If it were possible to transcend parties and vote just for candidates that represented my nuanced beliefs, I would switch in a heartbeat. Instead I'm forced to prioritize which issues are most important to me, and then plug my nose and vote for the party that best represents just those (even though said party comes with a lot of undesirable baggage).

<comment><USER10> > I like conservatism when it comes to the 1st and 2nd amendment protection

With a president that openly labels the press the enemy of the people?

> If it were possible to transcend parties and vote just for candidates that > represented my nuanced beliefs, I would switch in a heartbeat.

It's impossible. Everyone will have their nuanced beliefs and no candidate will match perfectly except in rare circumstances.

<comment><USER3> > With a president that openly labels the press the enemy of the people?

With a president that has appointed more 1st/2nd amendment-protecting federal appellate judges than any other president, you mean?

</comment></comment></comment></comment><comment><USER11> Best to click through to the content, which is very good. "Reactions to Trump's rhetoric: Concern, confusion, embarrassment"</comment>


Ask HN: Projects and applications for e-ink displays - <AUTHOR> What are some interesting projects and applications for e-ink displays? <comment><USER2> \- Ebook-like reading tools

\- Watches, low-power embedded displays

\- Low-cost screens</comment>


The Annoying Chinese Room - <AUTHOR> http://dobbscodetalk.com/index.php?option=com_myblog&show=The-Annoying-Chinese-Room.html&Itemid=29

<comment><USER2> Related to the detached lever fallacy posted yesterday: <http://news.ycombinator.com/item?id=263386></comment>


Ask HN: What is the best 5 year plan to join a startup? - <AUTHOR>

What do you think is the best 5 year plan to join a startup ?
I'm working in a good company. I cannot join a startup now due to various reasons.
What skills do you think should I master to become a rockstar in backend systems ? <comment><USER2> What you need to do is focus. Decide who you want to work for, learn what they use, and learn it. Startups want to see that you have a passion for what they do. Gather as much knowledge as you can about the startup you want to work for, walk in there on your interview day, and be as excited about it as the founders are.

</comment><comment><USER3> More than skills you need passion for a technology or a platform . Once you have that you will push yourself to learn more and in that process learn various skills.

Do what you love and make it a job instead of making a job out of something you have no interest in.

</comment><comment><USER4> In our B2B start-up the back-end skills needed would be

PostgreSQL - solid database design skills, stored procedures, and query writing and tuning.

J2EE for the application logic layer in the core system.

PHP for rapid prototyping of extensions.

Lucene

Willingness and ability to rapidly shift gears and adapt to evolving requirements</comment>


Hacker News is not working via http - <AUTHOR>

Hacker News is not working via http. There's no redirect to https, Please Fix it. <comment><USER2> I don't follow. There is already a 301 redirect to HTTPS in place... [https://gist.github.com/xxdesmus/8548677](https://gist.github.com/xxdesmus/8548677)

</comment><comment><AUTHOR> It's a "miracle", now redirect is working.</comment>


A well placed blog comment can still move the needle - <AUTHOR> https://medium.com/@obie/a-well-placed-blog-comment-can-still-move-the-needle-c87ad16d33a0 <comment><USER2> getting an Error 504: Gateway timeout</comment>


The Unix Chainsaw - <AUTHOR> https://www.youtube.com/watch?v=sCZJblyT_XM <comment><USER2> What is the talk about? I tried skipping and found something about git, something about python, very inaudible.

<comment><AUTHOR> It's about moving from treating the shell as a fancier program launcher to the full Unix experience that treats the shell as a powerful interactive programming environment. Several reasonably realistic examples are used to demonstrate how pipelines can be built on the fly to solve problems very quickly. Don't over-engineer if a "half-assed"[1] shell one liner does a good enough job. (even if it takes 3 lines).

The intended audience is people new(-ish?) to Unix that. Unix veterans already understand this stuff, but might want to watch the talk anyway because the presenter, Gary Bernhardt[2], has (in my opinion) a fun and unique presentation style.

> very inaudible

Yah, unfortunately the audio track is overly quiet. It's generally fine (albeit low fidelity) after heavy amplification.

[1] a running joke in the talk

[2] You may have seen his other talks[3], such as "Wat" or "The Birth & Death of Javascript"

[3] [https://www.destroyallsoftware.com/talks](https://www.destroyallsoftware.com/talks)

<comment><USER2> Thanks, it sounds a bit interesting, especially if it is about JavaScript dying (apologies to Hacker News moderators). I will take another look later on.</comment></comment></comment>