The real reason grocery stores are running out of whipped cream this Christmas - <AUTHOR> https://www.washingtonpost.com/news/wonk/wp/2016/12/21/the-real-reason-you-cant-buy-whipped-cream-this-christmas/ <comment> alex- This almost sounds like a warning about a too centralised manufacturing process across the food industry.

> "This story is a metaphor for the vulnerability of the entire food system," > said Daniel Block

However it seems to some what contradict it self:

> consumers will still be able to get whipped cream this season if they're > willing to compromise or look around

> There will also be no impact on non-aerosol whipped cream products

I am ok with the food industries resilience being across brands or even category (i.e. aerosol v non-aerosol).

</comment><comment><USER2> I thought the reason was going to be that new pie face game. [http://www.hasbro.com/en-gb/product/pie-face- game:1AB12F8D-5...](http://www.hasbro.com/en-gb/product/pie-face- game:1AB12F8D-5056-9047-F5EB-DC080A178E16)

</comment><comment><USER3> "Neither Kraft, which makes Cool Whip, nor Saputo, which sells whipped cream under the Land O'Lakes label, responded to questions about whether they too would see shortages."

 _Would_ Cool Whip be affected by this? Cool Whip ain't typically distributed in a spray can, last I checked; does it still use nitrous oxide as a preservative?

<comment><USER4> I doubt that frozen corn-syrup-in-a-tub would suffer from a lack of NO2.

<comment><USER5> Pedantry: NO₂ is nitrogen dioxide; nitrous oxide is N₂O.

And yeah, Cool Whip is barely a dairy product, and doesn't require propellant. So no N₂O involved.

</comment></comment></comment><comment><USER6> I buy heavy cream from [http://www.snowvillecreamery.com/](http://www.snowvillecreamery.com/) and whip my own. So easy and much more tasty. Ever see people at a concert selling balloons? Those are filled with nitrous oxide. Wonder how this will affect them?

<comment><USER7> I presume you mean illegal nitrous oxide in the balloons? I would assume those come from diverted medical supply, and the article said medical supply is served first.

<comment><USER8> > I would assume those come from diverted medical supply

Not necessarily. A lot of head shops in Berkeley sell capsules full of nitrous, if you want to make your own whipped cream.

[https://www.amazon.com/Cafe-Creme-Nitrous-Whipped- Chargers/d...](https://www.amazon.com/Cafe-Creme-Nitrous-Whipped- Chargers/dp/B0002HLDD4). They look like C02 cartridges for airguns.

Coincidentally, the same stores sell balloons and devices (crackers) for releasing the nitrous from the cartridges.

</comment></comment></comment><comment><USER9> Manufacturing cream + powdered sugar + mixer on high = much yum!

Its always interesting to learn that the 'one thing' everyone uses is vulnerable (like the expoxy that goes into IC packages[1]). Given its pretty easy to make Nitrous Oxide out of Ammonium Nitrate[2] why not make it on site?

[1] From 1993 - [https://news.google.com/newspapers?nid=1309&dat=19930819&id=...](https://news.google.com/newspapers?nid=1309&dat=19930819&id=7jpOAAAAIBAJ&sjid=9RMEAAAAIBAJ&pg=5755,3383241)

[2] [http://chemistry.about.com/od/makechemicalsyourself/ss/How-T...](http://chemistry.about.com/od/makechemicalsyourself/ss/How- To-Make-Nitrous-Oxide-Or-Laughing-Gas.htm)

</comment><comment><USER10> Seems like a non-issue. Whipping cream by hand takes less than ten minutes and it's quite good. It's not going to be as fluffy and light as the stuff with nitrous oxide, but for topping I think that's not the point.

<comment><USER11> "Quite good"? LOL

From a can it's _always_ UHT so tastes, for want of a better word, industrial. Though I'd just call it horrible and would be offended if served it. Let's be clear, _no one_ is going to mistake it for real cream.

Real whipping cream and a couple of mins with balloon whisk is the only way to go.

<comment><USER12> What's UHT? The canned stuff I get is real cream.

<comment><USER10> He's referring to "ultra-high temperature" pasteurized creams. I figure, from what he's saying, that this type of cream is required for the nitrous oxide process.

Honestly I prefer the nitrous whipped creams, hand-whipped heavy/whipping cream is second for me. Alex seems to think that flavour is universal, and that all the people who like other flavours than him are _plants_ from the food and beverage industry.

<comment><USER13> I think you need the UHT pasteurization for the long life that a can of whipped cream is expected to last for.

</comment></comment></comment></comment></comment><comment><USER14> Given the speed with which one can whip heavy cream, I have a hard time seeing the use of canned stuff. Whipping your own gives you a container and a couple of blender paddles to clean, and that apart takes maybe a minute more. I have to think that it tastes a lot better, too.

(I should add that before I met my wife, it would never have occurred to me to do this. On the other hand, I'm not sure I ever bought the canned stuff, either.)

<comment><USER15> Buying a container of whipped cream once a year vs owning a blender.

<comment><USER16> People own blender for much more than just making whipped cream.

<comment><USER15> The total cost of ownership of a blender is more than the annual outsourcing of whipped cream preparation.

If your assertion of people own blenders were true, there would be no whipped cream shortage, unless there is widespread ignorance amongst cream whipping equipment owners of the possibility of satisfying their demand with the means of producton in their possession.

<comment><USER16> Warning: low flying propositional logic. It's something that is commonly taught to law and philosophy students, not only mathematicians.

> If your assertion of people own blenders were true, there would be no > whipped cream shortage [...]

Let's take it from here. My assertion was that people own blenders for more than just whipped cream. In other words, I claim that people use blenders _also for other things_.

Given the article's claim that there is "whipped cream shortage" and how implication ("if..then..") works, you basically say that my assertion is invalid, meaning that people only use blenders for whipped cream.

Now go back and rethink what your stance is and how to convey it, because you surely didn't mean _that_.

<comment><USER15> No and I knew it was flawed when I was typing it. I ran out of the will to fix it.</comment></comment></comment></comment></comment></comment>


A fully functional local AWS cloud stack - <AUTHOR> https://github.com/atlassian/localstack <comment><USER2> What is the recommended minimum RAM, cores and CPU speed if one wants to run all the supported mock services at once?</comment>


Tobias Schneider - Flash is Dead, Long Live Flash (Gordon.js) - <AUTHOR> http://blip.tv/file/3814985

<comment><AUTHOR> Presentation from JSConf US 2010 that provides a technology introduction to Gordon, an open Flash runtime written in pure JavaScript and HTML5.</comment>


Shitexpress: A simple way to send a shit in a box - <AUTHOR> http://www.shitexpress.com/?language=en <comment><USER2> According to comments on reddit this is a scam. They'll take your money, but they won't ship shit.

</comment><comment><USER3> is this sfw?

<comment><AUTHOR> The word "shit" is used throughout, and there are some thumb-sized images of animal manure. Wasn't sure that warranted a NSFW tag, but be warned.</comment></comment>


Jeff Bezos' advice: Don't aim for work-life balance; it's a circle - <AUTHOR> http://www.businessinsider.com/jeff-bezo-advice-to-amazon-employees-dont-aim-for-work-life-balance-its-a-circle-2018-4 <comment><USER2> Easy for him to say. If you're at the bottom, you get little satisfaction or recognition for performing well, and are instead judged based on things like how much time you've spent in the office, how much code you've written, and how much your superiors like you.

Don't listen to what the guy at the top is telling you to do with your life. Ever. But do nod and smile when he says it.

<comment><USER3> "If you're at the bottom for long / You're doing something wrong."

Definitely don't listen to the people at the bottom telling you how to run your life. Ideally, listen to people who started where you started, and rose to where you want to get.

Bezos himself started fairly low. [https://en.wikipedia.org/wiki/Jeff_Bezos#Early_life_and_educ...](https://en.wikipedia.org/wiki/Jeff_Bezos#Early_life_and_education)

<comment><USER4> > Definitely don't listen to the people at the bottom telling you how to run > your life. Ideally, listen to people who started where you started, and rose > to where you want to get.

There's a lot of bad advice there too. People like to attribute their success to something they did but most people have no clue why they are successful. Luck has a lot to do with it and sometimes people succeed in spite of things they think might help.

<comment><USER5> Who would you rather be: the person who attributes their success to their actions, or the person who complains about not being successful?

You don't necessarily have control over whether you're successful, but you have a lot of control over how you see yourself and your personal narrative.

<comment><USER4> Why would i want to be anyone but myself? But to answer your point, arrogance and ignorance are not something to covet and neither is whining.

</comment></comment></comment></comment></comment><comment><USER6> "I love to come into the office with tremendous energy", says world's richest man as he devises even crueler ways to exploit his employees.

<comment><USER7> It's easy for him because he distances himself from that aspect and only deals with what he wants. He hires managers to get their hands dirty for him. It's just like how I buy my beef in a tidy packet at a glimmering supermarket and don't have to consider the slaughterhouse at all.

<comment><USER8> We hear all the time that money can't buy happiness, here in HN no less, and you are saying he has such a perfect life that he doesn't deserve to give any life advice? Who should we be listening to?

Not sure if you spend time to read at all, but what he said is essentially you can't be happy at home if you are miserable at work, and vice versa. Which makes sense to me. Too obvious to be honest.

<comment><USER9> This is true. But he is directly responsible for the culture that makes many of his employees miserable at work.

</comment></comment></comment></comment><comment><USER10> In my experience those at the very top are horrified when they find out that their staff believe that the boss requires them to enslave themselves to the company.

I believe that in many cases cultures of overwork are intrinsically generated, not imposed from on high. It could be fear of the boss, it could be a ruthless layer of middle management, it could be example-setting by perceived high fliers. Nothing is ever done about it because nobody wants to bother the execs with that sort of nebulous and sticky issue (especially one which sounds like whining).

It often happens with very driven and brilliant leaders, the types who themselves frequently work very hard and very long hours. Doubtless there is some social primate leader emulation dynamic, something we are helpless to escape.

<comment><USER11> Well, even if the CEO doesn't mastermind the overwork, I think a leader is responsible for everything that happens beneath them. They have full visibility (if they choose) and hired those middle-managers (or the people who hired them).

<comment><USER12> I suspect that the real problem is the incentives for those middle managers. The CEO often may set those without understanding the consequences for the people below the middle managers...

</comment></comment></comment><comment><USER13> It's interesting how puff pieces about a specific person usually seem to crop up all around the same time.

<comment><USER14> Well you have to offset treating your employees like shit.

Be a billionaire, then you don't have to worry about your work-life balance.

</comment></comment><comment><USER15> Bezos is a really smart guy but here, I beg to differ. I interviewed for a management role over at Amazon. I asked them what they thought of work life balance and how many hours are we talking about a week. 60 or so was the minimum, and that doesn't include lunches. 12+ hour days didn't seem like something you can sustain no matter how much energy you have.

Sooner or later, you will get physically and mentally exhausted at work, even though you have lots of fun doing so before you get wiped out.

I also informed them that if your engineers are working 70+ hours a week basically every week, then you don't have an engineering problem but a management problem. It's no longer a work-life balance, but purely a work-work balance, and that it was up to management to ensure that they don't burn their engineers out.

I didn't get to the next round (thankfully). I didn't "fit their culture". So I thanked them and moved on. Better for them, better for me.

I personally want people who are effective, and can put in a solid day of work. I still pull wisdom from, "Debugging the Development Process" back from 1994. I think it still holds true today for many aspects of software engineering. Or am I really an outdated curmudgeon?

</comment><comment><USER16> Live the circle. Feed the circle. Be the circle.

Whatever you do, don't be the low-energy guy in a meeting.

Thanks for the "advice".

<comment><USER17> "Live the circle. Feed the circle. Be the circle."

Gavin Belson?

</comment></comment><comment><USER18> I'm sure this applies to the typical Amazon worker sweating out sixteen hour days in non air conditioned warehouses for close to minimum wage and forgoing bathroom breaks because of draconian management that starts directly with Bezos. /s

Bezos is completely out of touch with the reality of work for most workers, including most Amazon workers. Maybe for CEOs this advice might make sense, but it's bad advice for most other workers, including most Amazon workers. It's simply a plug trying to get workers to give up even more of their time in exchange for nothing so the company can get more out of them. Bezos is the last person on earth, literally, who should be giving workers advice. Few people are so out of touch with the lives of regular workers as Bezos is.

</comment><comment><USER19> how much truly free time does one have on a work day?

Work, sleep, commute, eat, keep yourself fed, keep you and the house clean, maybe do some exercise and a bit of whatever out of the ordinary needs to be done (shopping for new shoes, fixing stuff in the house, doing the taxes).

Leaves maybe 4h and it's fair to have to rest 1 of it with some no-brain activity.

So 3h for family, romance, hobbies, learning non-job related stuff, politics, culture, reading, friends, side projects, building things, helping someone, etc...

<comment><USER20> That's why I'm doing everything within my power to work towards getting financially free. It's not easy and it takes time, but I'm getting closer than I've ever been.

<comment><USER21> just curious, what does your definition of financially free. entail? living off residual income or what?

<comment><USER22> I'm not really that concerned about financial freedom right now. I am concerned with optionality. Meaning I never want to be stuck at a job I hate. For me that means a combination of staying marketable, keeping my network fresh, and being careful about "lifestyle inflation" so I won't have to always strive for the maximum income.

It's a big stress reliever knowing that if things go bad, you can always jump ship.

</comment></comment></comment></comment><comment><USER23> Not to be snide - but it's easy for the richest man on the planet to offer such platitudes while articles came out that his UK employees were pissing in bottles for fear of retribution for "circling" by the restroom for being less productive.

</comment><comment><USER24> Have an expectation that the work-life balance is a circle i.e. it is zero

</comment><comment><USER25> How practical is it to achieve this "harmony" when you are up late at night everyday trying to earn "points" in the latest development cycle? Oh well...

<comment><USER26> You could work for a while and then flee to $cheaper_place?

</comment></comment><comment><USER27> Let's go back to 1999 and ask him the same question. Heck, even at 2009 I'd like to see the changes between those two times.

</comment><comment><USER21> I heard Bezos is also selling the new 520 bridge...</comment>


Clarifying Recent Tests - <AUTHOR> https://media.fb.com/2017/10/23/clarifying-recent-tests/ <comment><USER2> As pointed out by a Human Rights Watch member ([https://twitter.com/NicDawes/status/922622481311166464](https://twitter.com/NicDawes/status/922622481311166464)), they ran the test in countries with recent and/or fragile democracies, where independent media needs every single help possible. All this mess is a fricking disaster.

</comment><comment><USER3> We saw a fairly significant drop in traffic on our Khmer site [http://www.postkhmer.com/](http://www.postkhmer.com/) which is mostly driven by Facebook news feed links.

We'll analyse this and comment further if/when we've got something to say.

Edit: realised that this won't make sense for most people. We're the Phnom Penh Post, in Cambodia: [http://www.phnompenhpost.com/](http://www.phnompenhpost.com/)

</comment><comment><USER4> Who in their right mind believes 'We've heard from people that they want an easy way to discover relevant content from pages they haven't connected with yet.'

You've heard this from... people working at Facebook?

<comment><USER5> Just ask in the right way:

\- "Do you want to see more interesting content on Facebook?"

\- "Do you want a way to discover more relevant pages?"

</comment></comment><comment><USER6> Anyone have broader context?

<comment><USER7> I believe it's FB's response to [https://news.ycombinator.com/item?id=15531823](https://news.ycombinator.com/item?id=15531823)

<comment><USER8> So, if I understand the context, this means:

"You may have heard an alarming rumor that we were letting people take control of their attention and actually communicate with their friends and family.

"Rest assured that we are doing nothing of the sort.

"It was just an experiment, in countries you might not care about anyway. Keep on clickbaiting."

<comment><USER9> Facebook inhibits you from communicating with friends and family? Are we talking about the same Facebook?

<comment><USER8> I pretty much only use Facebook to communicate with my family, but I have to wade through so much distraction, especially articles that people have "shared" or pages that people have "liked" or whatever. It's like a low- quality subreddit. I have to scroll a lot to find things that matter to me on a personal level.

<comment><USER9> The question was whether Facebook _inhibits_ you from _communicating_ with family and friends. It's a pretty laughable suggestion in my opinion. More specifically, the timeline doesn't even have to be a part of the argument. Facebook Messenger has made it easier to communicate with people, period.

</comment></comment></comment></comment></comment></comment><comment><USER10> The post doesn't mention that the test is / was also active in India. I've used the feature in FB from India.</comment>


ProtonMail – Secure Email - <AUTHOR> https://en.wikipedia.org/wiki/ProtonMail <comment><USER2> By running your own email server on a VPS you already bypass 99% of the vectors that intelligence agencies use to do bulk data collection. They look for the lowest hanging fruit. Where's the highest email volume? (Gmail.) Where are the people who think they can't get caught but lack technical skills and probably mess up in many other ways? (ProtonMail.) Same with VPNs.

</comment><comment><USER3> [https://digdeeper.neocities.org/ghost/email.html#ProtonMail](https://digdeeper.neocities.org/ghost/email.html#ProtonMail)

</comment><comment><AUTHOR> As I grow more experienced in life and career, I am becoming more conscious of security. Protonmail looks like a good product -- is it? And what other security vectors should one have buttoned up?</comment>


Apps Are Over - <AUTHOR> http://www.forbes.com/sites/anthonykosner/2012/04/01/apps-are-over-frog-designs-scott-jenson-thinks-they-should-discoverable-in-real-time/

<comment><USER2> Wow ... another "installed software is a dinosaur" article. Given that this nonsense has been bandied about since the late 80s (you know, last MILLENNIUM) you'd think by now people would stop saying it, at least until there's an HONESTLY suitably alternative.

SaaS is only barely there right now. Google Docs is still quite a few generations away from being truly competitive against desktop word processors. The same can be said of most applications of that nature.</comment>


Posting On Other Blogs vs. Having Your Own Blog - <AUTHOR> http://slodive.com/web-development/posting-on-other-blogs-vs-having-your-own-blog/ <comment><AUTHOR> I think it's important to post something like this because as entrepreneurs you may focus on one and forget the other. I know some who run great blogs but are limiting their potential by not writing for others. Sometimes it's useful to have both explained in one article to remind us that we should pay attention to whichever half we aren't working on developing.</comment>


UAE launches Robotics for Good competition on heals of Drones for Good success - <AUTHOR> http://robohub.org/uae-launches-robotics-for-good-competition-on-the-heals-of-drones-for-good-success/

<comment><AUTHOR> $1M US prize for international competitors</comment>


Criminals can guess Visa number and security code in six seconds, experts find - <AUTHOR> http://www.independent.co.uk/news/uk/crime/criminals-guess-visa-card-details-fraud-six-seconds-a7450776.html <comment><USER2> There are well-specified rules for coming up with valid credit card account numbers, and at most, say, 60 valid expiration dates (12 months × 5 years into the future).

Once an attacker has a valid credit card number and expiration date, there are only 10⁴ = 10,000 four-digit security codes possible, which the attacker tries with parallel requests to hundreds of websites. Each website gives the attacker at least a few tries to enter valid credit card information.

Worst case, it takes only 10,000 parallel requests to guess the correct security code. Worst case.

I don't know whether to cringe or laugh at this.

<comment><USER3> The data you'd gain from this is practically useless to anyone looking to commit fraud... so laugh at the article I guess?

Maybe you could abuse this to create a lot of netflix accounts, but you aren't really going to be able to buy anything with just the PAN/cvv/expiry.

<comment><USER4> [https://purse.io/](https://purse.io/) is a website for committing fraud with stolen credit cards.

It's a website that specializes in letting criminals convert credit card details (PAN/cvv/expiry) into bitcoin while exposing them to minimal risk.

There are very real ways to commit such fraud.

<comment><USER5> Not really, purse.io does not facilitate fraud more than Amazon itself does. Purse.io just connects people who are willing to buy bitcoin using Amazon gift cards for a premium, and those that would like to purchase products on Amazon using bitcoin.

<comment><USER6> It's an out and out money laundering service. It exists for no other reason, there are no legitimate circumstances where someone would want or need to sell amazon gift cards at less than their face value. It is straight up money laundering and it's frankly incredible that it's lasted as long as it has.

<comment> ctrl-j > no legitimate circumstances where someone would want or need to sell amazon > gift cards at less than their face value.

Absolute statements like this are _so_ hard to back up.

For instance, if you live in Cuba, Iran, Syria, North Korea, or Syria, Amazon.com gift cards are worthless.

I know I received some AmericanEagle gift cards as a promotion recently, and unloaded them for less than face value just because I had absolutely no need/want to use them.

</comment></comment></comment></comment></comment></comment><comment><USER7> So criminals can guess a valid CC/CVC/Zip in 6 seconds, and merchants that get nothing but green lights across the board from their credit card processor will be left holding the bag when the card holder disputes the charge.

Merchants doing everything they can need better protection from this crap.

<comment><USER8> I designed the fraud prevention for a major ecommerce site(PCI Level 1). We used to get hit with lots of card testing including bot nets. They are easily mitigated. First thing is detune your error messages. Combine all the errors into one generic message. This includes AVS, CVN, and Expiration. I've see so many sites return the raw message back from the processor.

We also actively black holed large blocks IP addresses including TOR exit nodes and open proxies. Before all the privacy people make comments. We're a store. If you show up wearing a ski mask we aren't going to sell to you.

Sometimes we go on the offense and detect the patterns/attributes for the botnets that allowed us distinguish them from real traffic. We didn't block them, we fed them bad data. That made them go away fast.

Most important take away: Mitigating fraud will lead to higher auth success rates as you build up the reputation on your MID(Merchant ID). Its not only important in preventing chargebacks but increasing revenue.

<comment><USER9> Regarding error messages: At a previous gig, we had to aggressively and repeatedly fight the business side who thought that vague credit card error messages were a large source of user confusion. Eventually, we won but it was certainly an eye-opening moment for the developers involved to even have to fight that battle.

<comment><USER10> I've had the same argument many times over error messages for login and forgot password flows. Being security conscious is a way of thinking that many people aren't really capable of and an even greater number have problem maintaining consistently. It's so ingrained in product managers to make their software as friendly as possible that they forget that sometimes their users don't have similarly noble intentions. This is also why social engineering is so successful. When it's your job to be helpful, it's very difficult to be strategically unhelpful when necessary.

<comment><USER11> If you have a sign-up page, the usual "invalid email or password" message on sign-in form doesn't increase security.

</comment></comment></comment></comment></comment><comment><USER12> Shouldn't this be easy to detect, though? Every attempt to use a credit card number online involves a request to the bank providing that card to determine if it's valid, right? So the bank would see thousands of attempts across hundreds of websites for the same card number in a matter of seconds, which is clearly impossible for a human, and flag the card as "stolen".

Or maybe I'm just way too optimistic about how this all works.

<comment><USER13> They don't have to use the same number. 100 attempts at 100 numbers is just as likely to turn up a hit as 10000 attempts on one number.

<comment><USER14> Actually, it's not even close. 10,000 attempts to guess a 4-digit number are certain to succeed. 100 attempts to guess 100 4-digit numbers have a good chance of resulting in no hits. For each 4-digit number, you produce 100 different guesses (with no repeated guesses for that number, because that would be silly). There's a 100/10,000 chance of a hit, and 9,900/10,000 chance of a miss. The chance of missing on all 100 4-digit numbers is (9,900/10,000)^100 = 0.366 = 36.6%. That's substantial!

Guessing 100 numbers, there's a chance to produce 2 or more hits, of course.

<comment><USER15> _Guessing 100 numbers, there 's a chance to produce 2 or more hits, of course._

..to the point that the expected value should converge to the same amount, right?

<comment><USER16> The expected value of both strategies is to have 1 success, but they have different variance. The first strategy has variance of 0.99, and the second strategy has variance 0. The chance of n out of 100 hits with the first strategy is: binomial(100,n) x 0.01^n x 0.99^(100-n)

edit: asterisks as multiplication signs => italics

<comment><USER13> Right, but variance doesn't matter if you just repeat the scam tomorrow.

</comment></comment></comment></comment></comment></comment><comment><USER17> The power of distributed attacks. Of course they can only guess a random correct credit card + exp + code not yours. Given the relative limited number of codes for each bank, I wonder what the odds are for them to wind up with yours.

<comment><USER18> ...for every valid/correct credit card? The answer is a ratio of 1:x_1, where x_1 is every correct cc. And each correct cc is a ratio to the total number of cc vulnerable to the system of attack, 1:x_2; and this is in turn a ratio of 1:x_3, for all the currently valid cc, etc.etc. Right? But what's more concerning is all of the successful fraudulant activity is adding to the loss those banks are adding to their books, which in turn will be passed on to customers as bank fees and other costs.

<comment><USER19> >the loss those banks are adding to their books

There is no loss to the banks, assuming the fraudulent purchases are "card not present". The loss goes to the selling merchant. Your point of it being collectively passed on to the consumer is still true, of course.

</comment></comment></comment><comment><USER20> Securing the current protocol for credit card transactions is completely hopeless. It is _inherently_ insecure because the "secret" information used to authorize a transaction is not bound to that transaction, and so it's reusable. Even if you were able to secure the system against brute-force attacks like this one, you can never secure against phishing. The only way to fix it is to change the protocol to one that relies on public-key cryptography and secure digital signatures.

[http://blog.rongarret.info/2013/02/a-simple-solution-to- cred...](http://blog.rongarret.info/2013/02/a-simple-solution-to-credit-card- fraud.html)

<comment><USER21> EMV tokens and virtual card numbers attempt to mitigate against the re-use factor. 3D secure adds a layer of auth to the regular method (at some expense).

There is a large infrastructure (acceptance, processing, acquiring, clearing, issuing) running on card numbers so the solutions mentioned above all attempt to build on top of them as oppose to replace them with something better. As the logistics of doing so tend to be prohibitive.

</comment></comment><comment><USER22> I'm no means on expert on this, but having delt a little with online transactions from testing responses from a payment processor.

The things that needed to match also involved the customers street address, zip and name. If I recall these were scored and if the match wasn't good (zip was entered wrong) the transaction was rejected. Maybe different payment processors have different thresholds for rejecting a transaction?

[https://help.chargify.com/payment-gateways/Error- FAQ.html](https://help.chargify.com/payment-gateways/Error-FAQ.html)

<comment><USER19> For US based transactions, AVS failures (address, zip) don't typically fail the transactions.

Most often, the api has 3 possible return values "Success", "Success With Warnings" and "Failure".

The "Success with Warnings" will have some error codes for AVS failures (street address, zip). Usually the same for invalid CVV2. I've also noticed that cardholder name matching isn't universally supported...AMEX does it well, but VISA/MC is hit or miss.

Most merchants choose to allow for "Success with Warnings" and then manually check them.

It's hard to automate, because it's very typical for real customers to mistype billing addresses, CVV2, etc. One good example is small business owners. They, very often, use their business address as billing, even when the billing address is actually their home address.

In short, you can configure for hard failure on address mismatch or CVV2 mismatch, but you're throwing away a lot of legit transactions if you do so.

<comment><USER23> Only Amex has the ability to check the cardholder name. Visa & Mastercard don't pass this data to the issuer.

</comment></comment></comment><comment><USER24> A solution that some banks provide is to enable a credit card for only transactions using 3-D Secure [1], in which you are expected to enter a 2FA code sent to your phone by the bank during transaction to a webpage of the bank that gets opened.

Unfortunately, some (most) websites don't support 3-D Secure. I remember that almost all Turkish e-commerce sites I shopped supported it but almost none of the American sites supported it.

[1]: [https://en.wikipedia.org/wiki/3-D_Secure](https://en.wikipedia.org/wiki/3-D_Secure)

<comment><USER25> As a customer I hate these 2FA codes and online bank confirmations, common in the EU. I don't want to bring my bank passwords and whatnot with me if I want to make an online purchase with my CC!

<comment><USER26> As a customer they are also entirely to your disadvantage as in any 3dsecure transaction the customer is liable for unauthorized transactions as the assumption is they are the only ones with the ability to authorize. This makes disputing charges extremely difficult for the customer, and shifts liability from the bank and merchant to the customer end.

</comment></comment></comment><comment><USER27> I find it impossible to believe distributed enumeration of card numbers via ecommerce sites was used to defraud 9000 Tesco customers over a weekend.

<comment><USER23> The article stated that Tesco weren't protecting against distributed card testing because they didn't track failures on the same card across different merchants. Thus I think it would be very plausible.

The people running the scam would choose a specific IIN/BIN known to suffer from this problem.

</comment></comment><comment><USER28> Wouldn't asking for the name on the card as well stop this? You're not going to be able to randomly generate the correct name.

<comment><USER19> Unfortunately, at least in the US, cardholder name matching doesn't work for most transactions. Only AMEX supports it.

Edit: Offtopic rant, but as an online merchant this is the sort of thing that pisses me off about the CC situation. They don't support other obvious things either, like passing in the shipping address and ip address so they can be used for fraud detection. Yes, there are outboard services (MaxMind,etc) you can use, but they are working with a small subset of transactions, so their algorithms and blacklists are incomplete.

<comment><USER29> Name matching _doesn 't work_??! I guess you must be right, or this attack wouldn't be possible, but holy shit that is fucked up.

<comment><USER19> 100% true. Does not work, outside of AMEX cards. You can put anything you want in the cardholder name fields.

</comment></comment></comment></comment><comment><USER30> hindsight is 20/20 - but I'm awefully surprised that this would not be detected by the backend/backoffice systems processing cards.

<comment><USER17> Matercard supposedly has a single back end but VISA does not, according to the article. Given the distributed nature of the attack I imagine only the card processors could detect it; if you pick sufficiently broad set of web site to test with the chances of them sharing a server that could detect something is probably low.

<comment><USER31> I remember seeing the VISA security centre, where they monitor threats etc. It was a huge high tech facility.

I would think that they flag if a card is attempted a lot of times in short time span.

<comment><USER19> Apparently, VISA does not do this.

The actual research paper is online: [http://eprint.ncl.ac.uk/file_store/production/230123/1918024...](http://eprint.ncl.ac.uk/file_store/production/230123/19180242-D02E-47AC- BDB3-73C22D6E1FDB.pdf)

It says this: _" Whereas MasterCard's centralised network detects the guessing attack after fewer than 10 attempts (even when those attempts were distributed across multiple websites), Visa's payment ecosystem does not prevent the attack"_

</comment></comment></comment></comment><comment><USER32> The paper:

Ali, Mohammed Aamir and Arief, Budi and Emms, Martin and van Moorsel, Aad (2016)

Does The Online Card Payment Landscape Unwittingly Facilitate Fraud?

IEEE Security & Privacy

[http://eprint.ncl.ac.uk/file_store/production/230123/1918024...](http://eprint.ncl.ac.uk/file_store/production/230123/19180242-D02E-47AC- BDB3-73C22D6E1FDB.pdf)

</comment><comment><USER33> That's why you should enable two factor authentication on your credit card: online transactions would require confirmation with single-use password you receive by SMS.

<comment><USER34> What cards allow this? I would do it in a second if that was a thing I could actually have. Not 100% foolproof but I'd bet it would stop almost all fraud.

<comment><USER35> Not aware of any cards specifically (outside of European chip-and-pin, but I don't think those usually work online), but this is the big argument for things like android/apple/firebomb pay.

Make a purchase, then sign off on your phone (or fingerprint reader on your laptop).

It obviously won't resolve the issue posed in the article, but it is definitely a step in the right direction and many of the major CC companies are integrating more and more. In five or six years I can easily see Chase and the like giving an option to only let the physical card be used in chip-and- pin mode and to require the use of an approved service for any contactless/online orders.

Obviously the approved services thing is a concern, but not a huge one.

</comment></comment></comment><comment><USER36> These attackers are probably brilliant enough to make their mark in the honest tech business world. I suppose they are driven by the challenge of the crime.

<comment><USER37> I suspect they live in countries without the rule of law so they have little incentive to make an "honest" living.

<comment><USER38> More importantly, an "honest" living as a developer probably makes them pennies compared to online fraud.

<comment><USER39> you will be surprised :)

<comment><USER40> He means in those countries. For example, in Vietnam the avg dev makes $1000/year or he could hack and make that in seconds.

</comment></comment></comment></comment></comment><comment><USER41> If you total the credit card numbers for any particular card the answer would be the same. For example: totaling the visa credit card number might be 32. The hackers would have to guess the 3 set of numbers if they get the fourth set.

So my guess is they would try out different combination with the available expiry date/cvv number

</comment><comment><USER42> Another one of those technologies which hasn't kept up with the evolving tech landscape.

<comment><USER43> It's pretty unfortunate that there is absolutely no federated, popular, and secure payment system in the US due to consumers and merchants simply sticking with older systems simply because "it's what we've always done."

<comment><USER21> There are many parties that would gain from a better payments system.

However the logistics of improving it are significant due to the number of highly regulated and kinda-fat and kinda-happy entities running the infrastructure.

Interestingly what has happened in India and China (success of non-bank payment wallets VS cards) is injecting a lot of the traditional players with a sense of urgency. Before this it would have taken a states intervention (Eg MEPS in Sing/MY) to improve acceptance through the launch of a new payments system.

</comment></comment></comment><comment><USER44> This is a good argument to be used against the creditcardization (war on cash[1]) of the world some governments are promoting.

[1]: [https://www.google.com.br/search?q=war+on+cash](https://www.google.com.br/search?q=war+on+cash)

</comment><comment><USER45> Laughed out loud after reading this headline</comment>


Ask HN: Are company culture initiatives real? - <AUTHOR>

I work for a software company and its launching a new company culture, with company values and such that are supposed to push us into the future. Has anyone been on either side of this? How did it play out? <comment><USER2> I've seen this happen at aerospace/defence companies, and at (incumbent) telephone companies. From the worker-bee standpoint, it's rubbish. Never changes a thing.

At an aerospace company in the late 80s, the "new company culture" was for "quality", that undefined something that would distinguish our products from their products. The new company culture consisted of putting up really pitiful posters, in contradiction to Deming's principle of not governing by poster. One of the posters said "Don't be a lemming, follow Deming!" My one regret is not stealing a copy of that poster.</comment>


Toptal's Selection of Top Developer Blogs - <AUTHOR> http://www.toptal.com/it/toptal-s-selection-of-top-developer-blogs <comment><USER2> Great article! Extremely thorough discussion of 20+ established blogs. Interested to see what opinions will come up in the comments section.

</comment><comment><USER3> Nice selection</comment>


How Much Is a Human Life Worth? - <AUTHOR> https://www.wired.com/story/how-much-is-human-life-worth-in-dollars/ <comment><USER2> The question doesn't make sense as is. It should be rephrased in marginal terms: if we decide to spend one extra dollar on saving lives compared to today's situation, how many lives will it save? Also it should be measured in QALYs, not lives. I don't know the exact answer, but I've seen estimates from 20K$ to 200K$/QALY. (That's for the West, in the developing world it's much cheaper.)

<comment><USER3> FYI for those who don't know: QALY is Quality Adjusted Life Year. Parent is right that it's problem the best metric to use. I believe that we aren't using it because we don't know the morbidity that results from Covid-19. In other words, we don't know how Covid affects people's long term health. Someone might survive the virus, but end up having long term lung or liver or whatever damage. That reduces their capacity to work and may reduce their lifespan, i.e., their economic output after the life-saving intervention is reduced.

</comment></comment><comment><USER4> Here's a good recent RadioLab episode with the guy who calculated the current $10m figure.

[https://www.npr.org/2020/04/15/835571843/episode-991-lives-v...](https://www.npr.org/2020/04/15/835571843/episode-991-lives- vs-the-economy)

<comment> herrvogel- A bit older, but this[1] Freakonomics episode was also great.

[1][https://freakonomics.com/podcast/kenneth- feinberg/](https://freakonomics.com/podcast/kenneth-feinberg/)

</comment></comment><comment><USER5> Why do articles insist on providing numbers with no appropriate context? What do the absolute number of deaths of 9/11 or absolute number of deaths in Viet Nam have to do with this?

Perhaps better comparisons would be: how many deaths are there in the world per day? Before and after the instigation of covid19? How many deaths due to pneumonia before and after?

Has the death rate in other categories been reduced? Are there fewer accidents? Maybe we should just lock down forever because it might save at least one death due to accident?

"On a long enough time line, the survival rate for everyone drops to zero".

<comment><USER6> Appropriate context: right now, daily US deaths from covid19 are about equal to heart disease and cancer. That's pretty high for a threat that didn't exist a few months ago.

We try pretty hard to reduce heart disease and cancer deaths, but we don't social distance for them because they're not contagious. If we allow covid's exponential spread to resume, it will be our leading cause of death before long.

Meanwhile, countries that did strict lockdowns for a while and used that time to roll out lots of testing are getting through this with little damage.

<comment><USER7> The problem with your math there is that by and large, we are talking about the same people - only the timeline is different.

It is just as possible that over a longer time period say a year the math will be radically different. We'll have fewer cancer deaths because the patient had already died of COVID. It is possible that a country has many deaths because up to that point it was able to keep large swaths of "terminally ill" people alive.

Delay, isolation and testing do not actually solve anything. For large segments of the population the virus is not a risk at all, they can't even tell that are infected.

Long term it is not obvious who gets out better, the population where the infection rates are high and they can reduce the crippling economical restrictions or populations where they managed to have no infections but the sanctions remain for years.

History, in general, is characterized by surprising twists and turns where it was impossible to tell what comes next.

<comment><USER8> All deaths are just people who would have died later anyway.

<comment><USER9> Yes, we are all going to die. This is not a helpful observation.

What you should be asking are two questions: what impact those deaths happening all at once has on everyone else when the medical system is overwhelmed and how much earlier are COVID victims dying than they otherwise would?

In the latter case, the early studies suggest even elderly people are losing at least a decade early. That's a lot of time to casually blow off the way you're doing even before you consider the younger victims. Maybe you're young, healthy, and low-risk but do you really have no older people you know that you wouldn't want another decade to share time with?

[https://www.economist.com/graphic-detail/2020/05/02/would- mo...](https://www.economist.com/graphic-detail/2020/05/02/would-most- covid-19-victims-have-died-soon-without-the-virus)

[https://abcnews.go.com/Health/people-coronavirus- dying-10-ye...](https://abcnews.go.com/Health/people-coronavirus- dying-10-years-earlier-naturally-study/story?id=70511494)

<comment><USER6> I agree with you, and I think your parent comment does as well. They were pointing out the flaw in an argument made in their parent comment.

<comment><USER9> It's possible - there's enough misinformation floating around here that it's become necessary to avoid ambiguity on certain topics.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Consider: You are worth about $10mil, in terms of labor. If you work for 40yrs, from 20 to 60, then you are worth about $250k/yr.

Conclusion: We are underpaying nearly everybody in society.

<comment><USER11> The $10m is not calculated based on economic value. As explained in the article, it's calculated based on extrapolating how much we will pay in order to avoid some small risk, then dividing that by the fractional risk. So if we will pay $1k to avoid a one in 10,000 risk of dying then a life is worth $10m. Economic value doesn't come into it.

If you're interested US GDP is $22tn, with a work force of 164m people. That gives an economic product of about $134k per person per year on average. That includes unemployed people though, because it's the labour force size not the number of people in employment.

<comment><USER10> Labor's value does not come from its output; I am not talking about economic value. I am, rather, talking about opportunity cost; for what amount of money would I spend time, my only personal and non-renewable resource, on anything besides what I want to spend it on?

</comment></comment></comment><comment><USER12> wharton published a "Coronavirus Policy Response Simulator" on may 1st [1].

Their analysis comes to the conclusion that fully reopening ("States immediately lift all orders listed above as well as restrictions on the operation of businesses and restaurants.") would lead to 500k lost jobs from May first and 350k deaths until end of june 2020, while partially reopening ("States immediately lift emergency declarations, stay-at-home orders, and school closures.") would result in -11.3 Million jobs lost and 162k deaths. Both assuming, that each individual maintains their current social distancing practice. Year-Over-Year GDP change % would be almost identical, -10.1 vs. -10.7.

So fully reopening, compared to partially, would save ~11 million jobs, but lead to roughly 190k more deaths.

Considering the $10 million as the current value of a human life, a job would be $~172k for the comparison fully vs partially reopening while maintaining current social distancing measures.

[1] [https://budgetmodel.wharton.upenn.edu/issues/2020/5/1/corona...](https://budgetmodel.wharton.upenn.edu/issues/2020/5/1/coronavirus- reopening-simulator)

</comment><comment><USER13> In monetary value, there's couple estimates in Wikipedia. I've heard that for airplane designers, they assume the value of life at 10M for safety features design purposes.

[https://en.wikipedia.org/wiki/Value_of_life](https://en.wikipedia.org/wiki/Value_of_life)

</comment><comment><USER14> $10 million is the current value of life, with the article ending by suggesting it's probably worth less by now.

<comment><USER15> That's about 30 thousand koi fish! Enough to feed a town for three days!

<comment><USER16> Or 60,000,000 Bells.

</comment></comment></comment><comment><USER17> This is a pretty good overview of the issues, but I note one significant omission.

> Take a program to save lives in a large, well-known population with a risk > that's well-understood but small, and then ask, OK, what's that worth? You > can figure that out through surveys or consumer behavior— "revealed > preference," as economists call it. Take what people will spend individually > to avoid a teensy risk, and multiply it by the odds of that risk coming to > pass and the total number of people it might affect. That's it.

Humans are notoriously bad at estimating risk, especially with very small numbers. We can't even accurately tell you which of two small risks is greater.

Asking people for estimates could be a good system _if_ there were a solid correlation between risk and cost.

</comment><comment><USER18> >> How Much Is a Human Life Worth?

Which life? The reality is that we do not value all lives equally. Wealth, location, legal status, and less acknowledged factors like age, sex and race, all result in some lives being more valuable than others. That is the world in which we live.

So when we look at covid-19 one must first ask: who is it killing? Is it killing the more or less valuable members? Or, rather than face that horrible question, are we willing to take the hard road and value all lives equally? That road leads to dangerous areas such as universal health care and government-sponsored wellness.

<comment><USER19> The article mentions this explicitly.

" _Some economists even think that globally, poorer people in the developing world may well value their risk lower because they simply have less to spend, and more to lose. Even if it's true, acknowledging it puts you on a slip-n- slide to racism and eugenics._ "

</comment></comment><comment><USER20> No matter whether people own their own lives. It is for experts and bureaucrats to decide what are lives are worth, what our lives are for, what is safe, what is acceptable.

Human life is just an equation for the central planners to tweak.

Soon, we will be each be followed an assigned quadcopter monitoring our every activity to make sure we are not engaged in any unsafe activities so as to be certain we are providing our maximum societal output.

</comment><comment><USER21> So, how much money or effort would you spend to avoid a hypothetical event that kills you with a well known probability, say half percent?

I don't even know a conceptual framework to think about it. For 100% it would probably be "all my money" (I'm not suicidal). Should it be half percent of my money for a half percent event?

<comment><USER22> But it's not just your life you're gambling with. You're gambling with other people's lives. People who have just as much right to life as you do. People who may be in a much higher risk bracket than you. People who might very well die.

<comment><USER21> I'm not talking about the virus, just a hypothetical event that kills only me

</comment></comment></comment><comment><USER23> I thought this was a pretty decent article until the very end when the author asserts:

> ...nobody could be bothered to develop a nationwide program to test people > for infection and trace their contacts if they were positive, or to > adequately support a pause of economic activity...

As for nationwide program to test people, of course nothing was built yet; it's a novel virus and therefore novel tests are needed. If a government had built out contact tracing pre-covid, they would be (rightly) criticized for taking steps in an authoritarian direction. Apple and Google have stepped in and built contact tracing, so to say this hasn't been developed is also factually inaccurate. Finally the comment about the ability to "adequately support a pause of economic activity" is kind of silly. To pause economic activity is to pause everyone's lives. What does it mean to adequately support people when they're no longer allowed to do the things they enjoy?

It was a breath of fresh air to read an article that admitted that this is a difficult trade off, not some kind of easy decision that's being ruined by _the other guy_. It was disappointing that it was concluded with a similar tone.

<comment><USER24> > adequately support a pause of economic activity

They mean to support people & families that lose their jobs. A good example is Florida and a couple states with intentionally byzantine and understaffed unemployment offices - claims are being handled so slowly that tons of at-risk people who have lost their jobs and are eligible for federal dollars will not see them.

Adequately supporting a pause in economic activity might have included overhauling or providing alternate systems for states with broken unemployment or paying wages private wages to prevent layoffs.

I don't particularly like the latter option but I certainly feel like a competent government could have paused economic activity and then supported its frozen citizens better.

3 of my favorite local restaurants have closed since the pandemic. There are "nonessential" businesses still expected to make $6k/mo rent without any customers. The private equity that owns most of the land in the area seems not to mind at all; construction is still booming...

<comment><USER25> Florida's junior senator brought this upon the state. I hope Floridians remember in 2024: [https://nymag.com/intelligencer/2020/04/florida- unemployment...](https://nymag.com/intelligencer/2020/04/florida-unemployment- benefits-desantis-trump-rick-scott.html)

<comment><USER26> They will. They'll remember he's the nominee of the party they don't hate because of some single stance on some single issue, and vote for him.

<comment><USER25> "Some single stance on some single issue" is millions of Floridians having to fight with terrible software designed to keep them from getting benefits they deserve—which they need to pay their rent, pay their mortgage, put food on the table, put gas in the car, or purchase medications.

<comment><USER26> For some. For others it's abortion, or gun rights, or a desired theocracy (but only for their own religion).

</comment></comment></comment></comment></comment></comment><comment><USER27> A better question would be 'How many years do we save' because the vast majority of the people dying from covid-19 are old people who already suffer from one or more prior diseases.

The average life lost in Vietnam or Afghanistan had maybe 55-60 years left, had it not been for the bullet that cut it short. The average age of covid-19 victims is maybe 73 or so, and those people would in average have lived another 0-5 years (typically less than the average life span for men of 78.5 years because of the prior illness).

<comment><USER28> It's way more than 0-5 years, it's 10 years according to a study made by researchers at University of Glasgow.

[https://wellcomeopenresearch.org/articles/5-75](https://wellcomeopenresearch.org/articles/5-75)

"Deaths from COVID-19 represent a substantial burden in terms of per-person YLL, more than a decade, even after adjusting for the typical number and type of LTCs found in people dying of COVID-19. The extent of multimorbidity heavily influences the estimated YLL at a given age. More comprehensive and standardised collection of data on LTCs is needed to better understand and quantify the global burden of COVID-19 and to guide policy-making and interventions."

</comment></comment><comment><USER29> The value of a human life is in most cases next to nothing. A life is priceless to the closest friends and family. Beyond that its value drops rapidly.

If lives were anywhere near as precious to politicians as they like to pretend, we wouldn't be sending kids off to war. We would be investing in anti-poverty measures.

The value of a life to someone in power is proportional to the likelihood of being overthrown or pushed out of office due to that person's death. Often a life has negative value to such a person.

<comment><USER30> > _Often a life has negative value to such a person._

Never thought about it this way, but it's true. A dead person can't vote against you. So to the extent that a given person, or group of people, can be relied on to vote against you, it wouldn't be that bad for you game theoretically if they were not around.

<comment><USER31> that's why we shouldn't let power concentrate in any person or organization, public, private, or religious.

<comment><USER30> At least no organization that requires votes.

Absent illegal activity, money will continue to flow when a person dies, but votes can be guaranteed to stop.

<comment><USER31> i'd say it generalizes pretty well to any threat to power, not just votes.

</comment></comment></comment></comment></comment><comment><USER32> Not sure why they're doing all these calculations when capitalism already assigns everyone a numerical worth.

</comment><comment><USER33> [deleted]

<comment><USER34> Everything you've written is wrong. No dead were burried in a park and there was mostly plenty of space for dead bodies. You should watch less CNN.

</comment></comment><comment><USER35> Whatever someone's willing to pay for it

</comment><comment><USER36> > Assuming that social distancing measures can substantially reduce contacts > among individuals, we find net benefits of about $5.2 trillion in our > benchmark case.

The article linked to this paper but I find their conclusion very unlikely. $5.2 trillion is 6% of the world combined GDP. When people are not performing value adding activities they consume value. Inventing money out of thin air is not similar to people actually creating value.

If these are the numbers our politicians base their decisions on we are in deep trouble.

[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3561934](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3561934)</comment>


Clair v2.0: the container security scanner - <AUTHOR> http://coreos.com/blog/celebrating-clair2.0 <comment><AUTHOR> This release adds support for Alpine Linux container image scanning. Thanks to the Alpine team for creating a machine-readable database to support this!</comment>


Show HN: API Marketplace for Developers by Developers - <AUTHOR> https://askmacgyver.com <comment><USER2> As someone with a research interest in such services maybe you allow me to ask a few questions (you don't have to answer all of them)

\- What separates you from existing API Marketplaces (e.g. Algorithmia)

\- What kind of run time environments do you allow?

\- Do you have programmer APIs other than JS?

\- From your blog I am assuming you use docker for running the algorithms? Will the docker images be made open too?

\- How much effort do you think it would take me to transform an existing algorithm that I have to be available in your system?

<comment><AUTHOR> > \- What separates you from existing API Marketplaces (e.g. Algorithmia)

Macgyver differs from Mashape in that we host the program and actually run the program against the data (processing). This allows us to have more control over verifying the up-time as well as any changes to the program which might affect an end user's application (we do our own versioning so any new changes will be pushed as an incremental version) as to mitigate negative impact to clients already using the API.

We differ from Algorithmia in that we don't require you to learn our development tools or programming languages. We offer custom runtimes. We function by specifying -

1\. How we will supply data to your program 2\. The runtime you want us to use 3\. How we expect the program to respond

But ultimately we don't care how your program does that or in what language it is programmed.

> \- Do you have programmer APIs other than JS?

Not sure what you mean by this, the API takes and returns JSON but it can be used with any programming language.

> \- From your blog I am assuming you use docker for running the algorithms? > Will the docker images be made open too?

The programs are executed inside docker containers. We are still architecting the optimal workflow for our publishers and if that means making the macgyver docker image public we will do that but that is still TBD. We may just offer a sandbox environment for publishers to test in.

> \- How much effort do you think it would take me to transform an existing > algorithm that I have to be available in your system?

It's likely going to be easier than any other tool. We are going to work on providing more documentation and releasing the API docs very shortly - but the gist of the process is that you can move your algorithm program (or directory) into a folder in a standard linux box and from there you will just need to modify how you get your input data and how you format your output data, and specifying a runtime for macgyver to call on your main program file.

Thank you for the interest!

::Tim

<comment><USER3> > \- Do you have programmer APIs other than JS?

He probably means SOAP, Corba, etc. not just REST/JSON.

</comment></comment></comment><comment><USER4> The site is not browsable on mobile. A lot of the content on the main page is obstructed or unreadable.

<comment><AUTHOR> Thank you, will address this week.

</comment></comment><comment><USER5> I'm getting OPTIONS pre-flight check errors for all calls to macgyver.services just fyi on Chrome so literally unusable

"No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '[https://askmacgyver.com'](https://askmacgyver.com') is therefore not allowed access. The response had HTTP status code 502."

<comment><AUTHOR> API went down, back up. Thanks.

<comment><USER6> Looks like it's back down, at least for me, none of the examples are loadable. Edit - user signup is down as well.

</comment></comment></comment><comment><USER7> Looks good, but the frontend is buggy on Chrome.

<comment><AUTHOR> Noted - Thanks.

</comment></comment><comment><USER6> Ok, so the signup and things are working now, how do I actually add an api endpoint?

You have docs for accessing it but I can't find any for me _building_ an api endpoint. The docs also seem to suggest I use a client library called "kittn", which I'm pretty sure is wrong.

Your FAQ is empty.

Your blog has nothing (as far as I can see) to do with your product.

I've made a new program, but it's asking me for "the program file". What file? What formats, how do I specify dependencies, what API should I be building this against?

I'm trying not to be too negative, but I am really actually trying to use your product and am failing.

<comment><AUTHOR> >You have docs for accessing it but I can't find any for me building an api endpoint. The docs also seem to suggest I use a client library called "kittn", which I'm pretty sure is wrong.

No you are absolutely right. The docs are not built out yet and you are seeing the template data. We will curate this process and provide documentation. But a quick overview is as follows.

The API endpoint is static.

POST [https://macgyver.services](https://macgyver.services)

The payload is a dynamic JSON object that has the following properties.

program id, user key, program_data (as defined on the program input page)

It would look something like this -

{ id: "9s9z6J6b", key: "private-live-6w9c2p10G5p3b6y" program_data: {} }

As far as how the program should function I can just show you the addition program as example.

The program should be called "main" with a file extension that corresponds to the run time you want macgyver to call.

So the addition program is a javascript file called "main.js"

// user specified data format

var data = '';

var sum =0;

data = JSON.parse(data);

for(var i=0; i<data.values.length; i++){ sum += data.values[i]; }

var result = { "sum" : sum }

// This gets returned to the client

console.log(JSON.stringify(result));

The variable 'data' will have it's string content be populated with the clients payload send data at the time of execution.

[https://askmacgyver.com/explore/program/addition/2c2c5w7W](https://askmacgyver.com/explore/program/addition/2c2c5w7W)

There is some information on that here.

[https://askmacgyver.com/how-it-works](https://askmacgyver.com/how-it-works)

</comment></comment><comment> FLUX-YOU

        $.ajax({
            ...
               key: "private-live-6w9c2p10G5p3b6y",
            ...
        });

I haven't signed up, but if this is going in an ajax request, how do you prevent people from getting your key? Is this specifically meant for node where you can guard such things?

<comment><AUTHOR> I just changed that to take the public key, thanks!. Users get a private and public key, the private key will work in all areas but should never be exposed. The public key can be exposed and in the dashboard you can white list the allowed origins.

</comment></comment><comment><USER8> I have a side project that I host on Mashape, and I wouldn't mind looking into an alternative. However, the first thing I tried to find out is, how much does Macgyver cost? Mashape takes a % of what I charge end users, is this the same?

Also, isn't the name going to get you sued?

<comment><AUTHOR> > how much does Macgyver cost? Mashape takes a % of what I charge users

We allow you to name your own price and that is how much you will receive from those who use your program. However the client facing price will be higher as we tack on our additional processing overhead and a fixed percentage fee.

<comment><USER8> Right, and that's the cost information I'm looking for.

<comment><AUTHOR> Got it, we will add this information and post it when it's up.

</comment></comment></comment></comment><comment><USER9> Very interesting and great name, however - should we expect a cease and desist order soon for using what is likely a trademarked name? There was a MacGyver film in the works a while back, though I'm not sure what the status of it is.

</comment><comment><USER10> what can I do with program Id. So when I click on it. it says that it copied text, where and how can I use that?

I was here: [https://askmacgyver.com/explore/program/general-optical- char...](https://askmacgyver.com/explore/program/general-optical-character- recognition/9t5A2G2a)

Also why all have different pricing?

Also most of the things on website seems broken. Like there is a select dropdown on explore page But when selecting any item from the list, nothing happens. (Not sure whether that is intended)

<comment><AUTHOR> You can demo the program, so for OCR if you want to run it against an image you can do that on the demo page.

Try this and see how well it fairs -

Program ID: 9t5A2G2a (General Optical Character Recognition)

Private Key: In your /account under "User Information"

Send Data:

{ "image_url": "[https://askmacgyver.com/images/passport.jpg"](https://askmacgyver.com/images/passport.jpg") }

____________________________________________

This will run the OCR program against the image below -

The image you are testing: [https://askmacgyver.com/images/passport.jpg](https://askmacgyver.com/images/passport.jpg)

[https://askmacgyver.com/demo](https://askmacgyver.com/demo)

</comment></comment><comment><USER11> Reminds me of Microsoft's newer offerings: [https://www.microsoft.com/cognitive- services](https://www.microsoft.com/cognitive-services)

<comment><AUTHOR> Ya Google has a counterpart product to that - [https://cloud.google.com/vision/](https://cloud.google.com/vision/)

Regardless Google and Microsoft have offered a narrow slice of what can potentially be done in this space. They are still not seeing that we really need is a marketplace that has the ability to let machine learning specialists surface their work to businesses for a profit.

</comment></comment><comment><USER12> The "custom runtimes" link is broken at [https://askmacgyver.com/algorithm- developers](https://askmacgyver.com/algorithm-developers)

<comment><AUTHOR> Thanks - fixed.

</comment></comment><comment><USER13> I see you joining the bands of "serverless" computing - this is no easy feat - can you speak to what is in your backend and how you plan to support heavy workloads?

<comment><AUTHOR> It shouldn't be an issue - the API currently sits on Google's Cloud Platform which provides the infrastructure and tools to scale the service. IMO Snapchat's usage of the platform really speaks to the stability and capability of it.

<comment><USER13> If I am going to trust you my API I want to know that you have top notch SLAs on your service, and since I am providing the code you are going to want to monitor the heck out of it so that you know that in case of failure whose fault it is.

<comment><AUTHOR> Understood, we will work on finding that info and surfacing it on the site. As far as monitoring and errors go, the program is actually hosted by us in this case. So unless the program is faulty in some way any response issue is probably our fault.

</comment></comment></comment></comment><comment><USER14> Is the Explore page broken, or is it supposed to be empty?

<comment><AUTHOR> It's back up now.

</comment></comment><comment><USER15> > Input Example

> { "image_url": "http : > //i2.cdn.turner.com/cnnnext/dam/assets/160203182545-bitch-face- > large-169.jpg" }

Eh?

<comment><AUTHOR> Didn't notice the URL - I've changed it. Thanks.

</comment></comment><comment><USER16> Almost unbrowsable on mobile. :(

</comment><comment><USER17> Although your front-end is a bit buggy, I did like the initiative.

All the luck for you guys.

<comment><AUTHOR> Thank you, we are still ironing out many of the finer details. Feel free to let us know if you have any questions.

</comment></comment><comment><USER18> how is it different from [http://market.mashape.com](http://market.mashape.com)?

</comment><comment><USER19> Site needs love for mobile styling</comment>


Show HN: JackDB - HTML5 database development client - <AUTHOR> http://www.jackdb.com/

<comment><AUTHOR> We're working on database developments tools that work in the web browser.

Of course, we'd love your feedback, questions and comments. If you're interested, sign up or email me at: saro [at] jackdb [dot] com.</comment>


FreeBSD 7.0 Released - <AUTHOR> http://docs.freebsd.org/cgi/getmsg.cgi?fetch=3236+0+current/freebsd-announce <comment><AUTHOR> Now, if Amazon would have an option to run BSD on EC2, I would be a very happy boy.

<comment><USER2> If FreeBSD would support Xen I'm sure they would be happy to oblige.

<comment><USER3> Why Xen? I've been using VMware for years and I am curious about these newer tools: Xen and VirtualBox.

<comment><USER4> EC2 is built on Xen.

</comment></comment></comment></comment><comment><USER4> Has anyone out there run FreeBSD on EC2?</comment>


How the rhetoric of "rare" is changing in the age of information abundance - <AUTHOR> http://www.niemanlab.org/2011/08/accessibility-vs-access-how-the-rhetoric-of-rare-is-changing-in-the-age-of-information-abundance/ <comment><USER2> The ironic thing about this problem is that more tech startups will see this as an opportunity. And they should.</comment>


A laptop computer today is 96% cheaper than a 1994 model and 1,000X better - Gabriel-Lewis http://www.aei.org/publication/technology-has-advanced-so-rapidly-that-a-laptop-computer-today-is-96-cheaper-than-a-1994-model-and-1000x-better/ <comment><AUTHOR> But browsing is only 1.3 times faster, given modern adware.

</comment><comment><USER2> Surprising message from the AEI--don't worry about income inequality, because consumer electronics are cheap!</comment>


Ask HN: What unknown Newsletters are you subscribed to? - <AUTHOR>

<comment><AUTHOR> I'll start :)

<http://cooperpress.com/> find all their newsletters to be quite useful

</comment><comment><USER3> photojojo - <USER2>

aquabumps - surfing and beach culture</comment>


Give HN: 50% of what i make will go out to a startup/charity - <AUTHOR>

I've been a long time HN'er. And I want to give back to the community. To 1 startup, 1 reader, and while i'm at it -  bootstrap my own startup.
tl;dr

      I'd like to donate 50% of what i get for the following domains
      to a startup or charity that the highest bidder chooses.

      aptly.me
      onboardings.com
 Why should you help ?

      1. You will provide much needed $ to fuel my own IM startup
      ( http://verbs.im along with chaitanyapandit )
      2. Another charity or startup of your choice will receive equal $
      3. You will own a kick-ass domain
 the small font...

      Bitcoin preferred
      I have asked @jason if he is be willing to announce this on #twist.
      He may never read my email.

 @bhaskerkode ( | or even better, Search for "Verbs.im" on your iPhone & let's chat! i'm bosky101 ) <comment><USER2> $4.</comment>


Bitcoin Pay-Per-Character Publishing Platform - <AUTHOR> http://bitcoinmagazine.com/13802/bitcoin-pay-per-character-publishing-platform-gathers-momentum/

<comment><USER2> On first glance an interesting idea. However a few minutes spent perusing the content (or non-content, more like!) had me almost pining for the Youtube comments section.</comment>


Microsoft Builds up Health IT Portfolio, Waits for Market to Materialize - <AUTHOR> http://www.xconomy.com/seattle/2010/02/26/microsoft-fleshes-out-health-it-portfolio-waits-and-waits-for-market-to-materialize/

<comment><USER2> Here's a cool video made by some nerds in this group: [https://tjackson.blob.core.windows.net/videos/GymOfTheFuture...](https://tjackson.blob.core.windows.net/videos/GymOfTheFuture_Walkthrough_720p_1600kbps.wmv)

Linked from this blog: [http://blogs.msdn.com/familyhealthguy/archive/2010/02/22/mag...](http://blogs.msdn.com/familyhealthguy/archive/2010/02/22/magic.aspx)</comment>


Strategic Scala Style: Principle of Least Power - <AUTHOR> http://www.lihaoyi.com/post/StrategicScalaStylePrincipleofLeastPower.html <comment><USER2> Reading this post reminds of when I tried to learn Scala and ran away when I saw the heap of complexity it was.

It seems like they tried to put all features they could in there without thinking about the orthogonality of the result.

Languages that need all that restraint to be used right maybe are ok for some very clever people, problem is all the rest of us that can't juggle all that in out heads.

<comment><USER3> As a Scala fan, I can agree with the sentiment.

Scala tried to be (1) flexible and (2) very interoperable with Java.

This lead to (1) a lot of confusing intersections of paradigms and (2) a lot of compromise even within those ideals.

That said, I don't see any better statically typed functional language with even half the available libraries of Scala (because of Java), so I stick to it as my language of choice. Haskell is very close though, with the added benefit (IMO) of native compilation.

</comment></comment><comment><USER4> > If you don't know what can go wrong, use exceptions

Disagree. Exceptions are broken in Scala. I think it's better to do what was suggested in an earlier point, and return an ADT. You should wrap them and return an ADT constructor taking in the exception.</comment>


Why I give my students a 'tragedy of the commons' extra credit challenge - <AUTHOR> https://www.washingtonpost.com/posteverything/wp/2015/07/20/why-i-give-my-students-a-tragedy-of-the-commons-extra-credit-challenge/ <comment><USER3> The professor omitted the sole interesting number: what percentage of students choose 6 points. Is it typically 15% or is it typically 80%?

It makes a huge difference. Most likely, it's a percentage low enough to indicate that the 10% threshold is carefully chosen. Otherwise he'd tell us.

This is evidence that he has an agenda to promote (that people are too selfish), and that the facts don't support his agenda (most people actually cooperate). So he omits the facts.

<comment><USER4> Or maybe it's 70% of the students who pick 6. Or 99%. Or maybe 10.01%.

The point is we don't know and can only speculate, just like the students in the experiment who don't have the signal either. It kind of sounds like you want to believe the professor has a bias, and are trying to speculate evidence to support that belief. Even in the article he talks about how picking 6 in the first round isn't viewed as selfish, just that this experiment demonstrates tragedy of the commons.

</comment></comment><comment><USER5> Actually, I think in this case the only rational choice is to ask for the 6 points. One of two things will happen:

1) Less than 10% will follow suit, in which case you'll get a 6 point boost, and you'll have secured an advantage over 90% of your classmates.

2) More than 10% will follow suit, and noone will get anything, in which case you will have no advantage over your classmates, and neither will any classmate have an advantage over you.

If you select 2 points, then either:

1) Less than 10% will opt for 6, in which case you'll have no advantage over at least 90% of the class, but some members of class may have a 4 point advantage over you, or

2) More than 10% will opt for 6, in which case the outcome is identical to choosing 6 in the first place.

Because the "points" have no intrinsic value except in comparison to your classmates (unlike a true tragedy of the commons, where the scarce resource such as food, etc, has real value), there is no reason not to roll the dice.

EDIT: Many people think the fact that the course is "not graded on a curve" makes a difference. It does not, at least considering the class in isolation. I took courses in college where an A was pretty much a dead certainty, and other courses where getting a B was actually quite an achievement. In all cases my performance within a course had to be judged based on my performance against the other students within that same class.

<comment><USER6> > Because the "points" have no intrinsic value except in comparison to your > classmates

This is where your logic is wrong. The professor is not saying the class is graded on a relative scale (for example, top 10% of the class gets As). If everyone gets two points, and it bumps up everyone's GPAs, then of course it will benefit them all, especially in comparison to people who are not in the class.

<comment><USER7> This is not necessarily true. If you're _already_ a good student, this devalues your GPA, mostly due to the generally awful GPA system. Assuming your school considers everything above a 92 to be a "4.0", if you're already in that range, you definitely don't want to help anyone else into that range.

Note that, of course, this would be fixed by just making GPAs decimal numbers out of 100, the average of all of your _actual, numeric_ grades from each course (multiplied by credit hours?). You can divide it by 25 if you really want the weird 4.0 scale for some reason.

</comment></comment></comment><comment><USER8> It's funny how many people are saying "oh just get everyone organized and have a lottery/auction". Yes, if we could perfectly organize large groups of people we could solve the tragedy of the commons. Unfortunately, organizing large groups of people is hard.

Even in the scenario where everyone is a rational actor (ie, fantasyland), effectively communicating to a group of > 20 people and obtaining unanimous consent is an exceedingly difficult problem.

<comment><USER4> The anonymous nature of this removes the reputation cost for picking the six points.

Collusion isn't possible because there is no penalty for breaking an agreement, and the signals it creates (everyone is picking 2) only makes rationally self-motivated individuals more likely to break it.

</comment></comment><comment><USER9> > I've been giving it to students since 2008, and only one class has > successfully mastered the challenge.

That's a real surprise. The 2 points option is the safe one, so everyone should go with that. Sure, I could assume that all (or most) of the other students think so and just get the 6 points myself. But then again, chances are that the other students think the same. So let's just go with the safer 2 points.

<comment><USER10> No, the safe option is to get organized and plan out who is going to chose the 6 points. That way, you know if you secretly chose the 6 points when you were supposed to get 2, you will get nothing. Then it doesn't become tragedy of commons, but rather an experiment with vandalism.

The experiment, IMO, isn't valid. In RL tragedy of commons, the selfish don't really suffer that much .. it's usually everyone else that does.

<comment><USER11> You could have an auction for the 6 point slots, with the proceeds being divided and distributed to the group.

<comment><USER12> I was going to respond to the GP that you'd likely have a spoiler who would either be upset at not getting the six points and so secretly blow it up, or demand to be one of the six-pointers by publicly threatening to do so, but if there's money involved than that "likely" turns into a "definitely".

<comment><USER13> I don't think you would have a spoiler, or someone who pulls the demand. I think the money would actually stop that pretty quickly because of the peer pressure ramifications from the others in the class.

So, a 20 person class has 2 6pt slots. You take the bids and collect and hold the money. Grades are announced and then you hand out the money or give it back to the original bidders in case of betrayal. The spoiler is basically denying the points and cash to everyone. I get the feeling the identity of the spoiler would be found, if for no other reason all the innocent folks showing their papers. I hope the spoiler is graduating and not coming back because that type of crap is remembered.

</comment></comment></comment></comment></comment><comment><USER14> Cooperative behavior is particularly difficult when the stakes are very high. In the context of climate change, increased energy costs have very real impacts on people day to day, particularly in developing countries. For this reason, it's difficult to imagine those countries would behave cooperatively (even if a figurehead signs a document promising they will). It may be that the better strategy is to have the best grades in the first instance, knowing that noone will get extra credit. That is, build a strong and resilient economy so that you are better prepared to deal with, and adapt to, the inevitable challenges associated with global climate change.

</comment><comment><USER15> I think this would be more interesting if there was a way to explicitly declare the marks post-curve. In the event the distribution of marks is smoothed to any sort of typically college distribution it's entirely rational to just select 6 points and not care whether 10% of the others do or not. Selecting 2 leaves you open to a worse result on a curve, but selecting 6 is nearly risk free if the distribution of marks is precisely controlled anyway. 2 marks when the average pre-curve goes up more than 2 and the average needs to be fixed post-curve is a really crappy proposition.

<comment><USER16> The article specifically state that the grades are not curved.

</comment></comment><comment><USER17> I wonder if jealously could also play a role here. The option to choose 2 points doesn't seem completely risk-free to me from an "emotional" point of view:

Suppose you choose the 2 and the class was actually disciplined enough that the points weren't lost. Then you might think that there might very well be a small group of students who got 6 additional points because they were greedy and you were not.

If students underestimate the risk of all points getting lost, they might in turn overestimate the "risk" of getting less than others if they play it safe.

<comment><USER18> Congratulations, you just independently discovered the sixth paragraph of the article!

"But many students choose the seemingly selfish option. Why? Perhaps to increase their own grades, or perhaps because they fear that they will be taken advantage of. No one wants to be the chump that chooses fewer points when they could have had more."

</comment></comment><comment><USER19> Get together, auction the 6 point slots. Then, depending on whether it works or not, either evenly distribute proceeds to everyone or return the money to the auction winners.

<comment> ryan-c Or more generally allocate the 6 point slots in advance - how they're allocated doesn't really matter. The point is that everyone knows that if they are supposed to choose 2 points and instead choose 6, nobody gets anything. Someone still might blow it for everyone out of spite, though.

<comment><USER19> By involving the auction you are adding an additional incentive to not blow it for everyone - you are getting money from the person who will get higher extra grade than you.

</comment></comment></comment><comment><USER20> I wonder if the prof has given any thought to what made that one class unique, if there were any factors that distinguished it from his other classes

off the top of my head, I wonder if it was a particularly small class

though I could imagine a lot of other potentially relevant factors

</comment><comment><USER21> This really doesn't work for me as an experiment.

10% is too easy to hit. Do 3 or more students _need_ the 6 rather than the 2? Why should I choose the 2 if it won't do me any good?

In any class I teach, there are generally 10% on the line between grades that requires that I take into account a little more than just scores. Did they do all the homework? Did they improve on assignments or were they blowing them off? etc.

Given that 10% probably _need_ the 6 and not the 2, this is likely to never work.

I had a tragedy of the commons that I hadn't intended. I had an extra credit programming assignment, but there was a catch--the _students_ had to write the tests for the automated tester. If nobody wrote tests, nobody had the chance to get any extra credit. They were allowed to collaborate on the tests, but not the solution.

Everybody complained bitterly when nobody wrote tests.

My response was not terribly charitable: "This is _extra credit_ , folks. Not charity. You all had two options.

First, write the tests yourself. Yes, writing tests is time consuming, but not horribly difficult. Some students started, realized the amount of work, and stopped. However, once _somebody_ writes the tests, everybody get to benefit.

Second, _encourage_ someone else to write the tests for you. Did any of you _talk_ to the students most likely to write tests? Did any of you encourage these students to put in the work if you couldn't pull it off yourself? Did any of you offer to compensate them for their valuable time?

Many of you have been repeatedly asking for a group assignment since the beginning of the semester. THIS WAS A GROUP ASSIGNMENT AND YOU FAILED. It simply worked out that freeloaders weren't _guaranteed_ to be carried by the best students. The best students realized the amount of work and simply opted out since they already had enough points.

Welcome to the real world. Figuring out how to get someone to do something that they don't really want to do is a fundamental problem of life."

</comment><comment><USER22> But the challenge doesn't make sense, there isn't much risk, no fear of being known. Economic studies have covered this before, would you rather make $50k where everyone else makes $75k? or make $40k where everyone else makes $30k and people pick the latter because they want to have more than their peers. Everyone getting the same points doesn't change anything relative to those around me.

In a paper score, assuming 100, 2 to 6 points just doesn't mean much. 6 points is greater than 5, it could take me from 84 to 90! I'll go for the gusto and try for 6. 2 points just doesn't make any difference, and I wouldn't feel any better getting 2 points.

<comment><USER14> Agreed, but your assumption may not be correct.

<comment><USER22> You're right I vaguely remember seeing a very wide range of top scores possible. From 25 - <USER2>

</comment></comment></comment><comment><USER23> Sure, the course grades are not curved, but the students are definitely competing academically, especially those in the same class. There's class rank, honors status, merit scholarships, internships, job opportunities, etc., that are technically at stake. It makes sense to choose 6 every time.

</comment><comment><USER24> I see it as a simple equation. I don't think it says more than that about people.

Can someone enlighten me as to why a 90% break point? Why not for example 50%? Is it because 90% introduces some level of collaboration or vice versa?

Sans collaboration or any other useful information (people I may already know in the class, etc.), I would say at best you have a 50/50 chance of a total stranger choosing the option that is better for the common good. That number is based on it being college age students. If it were the general public at large I would estimate at least 60% would choose the more personally beneficial option.

Am I just extremely pessimistic? Please give your thoughts.

<comment><USER25> I imagine it's because 10% kicks in really easy and requires the you to stop and think about your actions. If you need a full 50%, screw it, go for 6, almost everyone else will. At 10%, though, you stand a fairly good chance of being the tipping point.

<comment><USER24> With the given caveat that any more than 10% of the group requesting 6 voids the whole thing, it seemed a foregone conclusion to expect 0 points. On the off chance I am wrong about that, I would end up with 6.

So the final conclusion I had == highly likely 0, but a very small chance of 6.

2 points were statistically ruled out the moment I heard 10%.

I see how the thinking re: screw it though also is valid. Thanks.

</comment></comment></comment><comment><USER26> Its funny because we see the tragedy of the commons "fail" (succeed?) all the time in national elections: people are so afraid to "selfishly" choose the candidate they actually want to win (and thus cause the opponent to win) that we all "cooperate" on a sort-of ok choice (just like cooperating on 2 vs 6). I guess that's argument for penalties.

</comment><comment><USER26> I'm surprised no rich student ever just offered ahead of the tally that they'd pay everyone $x if _no one_ choose 6, where x is more valuable than 4 points. He now has the ability to safely choose 6, and everyone else is paid for their cooperation.

<comment><USER27> Great, except votes are anonymous.

<comment><USER26> It doesn't matter because the requirement is NO ONE choose it. There is nothing to gain by selecting 6. The second you are writing 6 down on your paper, you better hope the 4 extra points are worth more to you than $x because you have absolutely invalidated the game, not "maybe" invalidated it.

If x is big enough to trivialize 4 points, I am pretty sure no one would choose it (or at least fell well below 10%). For example, if Richy Rich was in your class and offered $1million to EVERYONE as long as NO ONE chose 2, I am quite certain that even the most selfish actors would not write down 6. If he offered 50 cents than I'm pretty sure some people would. Binary search and you'll know how much a point costs.

(apologies if you commented before my edit)

<comment><USER28> Have I? Assuming that it's a large enough class to where there are at least a handful of slots for 6s, and the one rich kid is offering the money so they get the 6, I might choose 6 as well, betting that few enough people will decide to risk it.

<comment><USER26> The whole point is that the rich kid is offering the reward solely if _no other people_ choose the 6. NOT if its 10%. By choosing the 6, you necessarily lose the money. Thus, you would only do that if the 6 points are more important to you than the reward, since you will _absolutely_ lose the rich kid's reward if you choose it.

<comment><USER28> But all votes are anonymous, so the rich kid wouldn't know.

</comment></comment></comment></comment></comment></comment><comment><USER29> Alternative experiment: every day, students are allowed to do this voting. Assuming that the first few days run like this experiment, I wonder if we'll see a change in their behavior. This actually models reality more closely, to some extent.

</comment><comment><USER30> Perhaps it's just cultural differences, but nobody getting extra points sounds like the most desirable outcome to me. Perhaps in a setting where the exam doesn't count for anything it'd be okay, but it just seems so juvenile.

</comment><comment><USER31> So you get all the grades from your fellow students and organise the bottom 9% to choose 6 and the rest of the class chooses 2

in 6 months 4 points on a random test will be completely forgot.. might as well game the professor that is trying to game you

</comment><comment><USER32> The challenge was recently discussed on HN: [https://news.ycombinator.com/item?id=9874215](https://news.ycombinator.com/item?id=9874215)

This new article is from the lecturer's point of view.

</comment><comment><USER33> I suspect that professors aren't upset that the game theory is validated, but rather they're upset that the students haven't done the analysis and thus choose to change the game by introducing structural changes.

</comment><comment><USER34> "People conformed to the group's positive behavior."

People are more likely to respond to social pressure, than to appeals to "do the right thing." Valuable lesson for startup marketing... and maybe even pricing.

</comment><comment><USER35> Doesn't take into account the student's standing in the class. If I am confident with the quality of my term paper and believe it is worthy of an A, what do I care if I get additional points?

</comment><comment><USER36> Really odd that the professor does not mention carbon taxes in the story. It doesn't make sense to borrow game theory from economics but completely ignore the idea of taxing externalities

</comment><comment><USER10> Don't the students just get together and do a lottery? And in RL tragedy of commons, it's rarely anonymous.

<comment><USER37> And then one person says that they chose 6 points and haven't won it via lottery. The other students can't retaliate because the only way to get back at her would be to take away points from the entire group

<comment><USER38> They can retaliate, there's simply a cost associated. That's one of the reasons this is a poor exercise: In iterative games it's often worth making sure people know that certain kinds of behaviour don't work - even where you have to harm yourself in order to do so. Otherwise you'll always be held hostage by those willing to move the costs closest in time.

I suspect this is why hatred and resentment are part of our make up.

</comment></comment></comment><comment><USER39> what if you choose 6 and explain to your classmates that "It feels good to be cooperative both from a strategic and moral perspective" and the whole commons thing and convince them to choose 2?

</comment><comment> anti-shill The commons worked great in two situations--1) europeans and 2) villages.

Maybe if we could get back to small villages of european descent we could have a higher quality of life.</comment>