Seven Codes You'll Never Ever Break - <AUTHOR> http://www.wired.com/dangerroom/2012/12/codes/

<comment><USER2> Unpaginated: [http://www.wired.com/dangerroom/2012/12/codes/?pid=1708&...](http://www.wired.com/dangerroom/2012/12/codes/?pid=1708&viewall=true)

 _Added in edit: Interesting that someone downvoted this comment. Did someone fat-finger it, or do some people really think it's wrong to give a link to the unpaginated version? I'd like to know. If you feel unable to reply here, then feel free to email - address is in my profile. Thanks._

<comment><USER3> I, for one, appreciate unpaginated links, so thank you.

</comment></comment><comment><USER4> Stupid title.

Just because Kryptos Part IV hasn't been broken so far doesn't mean that it won't be. It was designed to be broken.

Oh, wait, the actual title is "7 Codes You'll Never Ever Break" instead of "Codes Hackers Will Never Ever Break". The actual title is more likely to be true, especially given the complete crackpots that appear in groups like Kryptos with outlandish 'breaks' to the codes that are complete crap.

Breaking codes is hard, takes a long time and requires method. Most people won't break these codes.

<comment><USER5> At some point, someone will just brute-force these.

<comment><USER6> One of the codes may be a one-time-pad reference to a book which may no longer exist OR the ciphertext may simply be a meaningless fraud.

Another is probably written in an invented, private language.

Two others are short enough that brute force approaches will almost certainly create false positives.

In general, brute force can only work if you have some idea of what to expect the clear text to look like.

<comment><USER5> So 2 of these probably aren't even codes, just gibberish.

So what if false positives are created? We can just brute-force the analysis of those to find the right one. Are you forgetting the sheer magnitude of quantum, digital, & human-analog computing power we have available today?

<comment><USER6> I think you're forgetting to check your hubris at the door.

Given the folks who've attacked these problems, the ones that have yielded to brute force thus far: 0.

</comment></comment></comment></comment></comment><comment><USER7> Bruce Schneier broke these codes before breakfast, and now he's gonna break you! <http://www.schneierfacts.com/>

<comment><USER8> Thats brillianty funny, now us geeks have our own chuck norris.

<comment><USER9> There is also Jeff Dean: [http://www.quora.com/Jeff-Dean/What-are-all-the- Jeff-Dean-fa...](http://www.quora.com/Jeff-Dean/What-are-all-the-Jeff-Dean- facts)

</comment></comment></comment><comment><USER10> Grr, of course the link to "drawings of naked women" is broken. Anybody has the correct URL?

<comment><USER2> For your delight and delectation, here's a link:

<http://brbl-zoom.library.yale.edu/viewer/1006200>

For reference, a simple Google search found it in about 30 seconds.

<comment><USER10> Delightful, thanks!

</comment></comment></comment><comment><USER11> On decoding the Voynich manuscript, <http://www.edithsherwood.com/voynich_decoded/>

</comment><comment><USER12> semi-offtopic: how could one crack a cyphered text if it was written in a 100% invented/artificial language, with no relation to any natural language, not even good word-to-word mapping (imagine a pictografic language like the assian ones, but unrelated)? where would one start without word-frequency analysis or something similar to begin with?

Maybe the Voynich manuscript has such a completely imagined language, and that's why nothing worked (if it's not a "hoax:, of course).

<comment><USER13> A 100% artificial language can be equivalent to a one-time pad, so there's no guarantee it could be cracked.

<comment><USER5> Why can't we brute-force one-time pads? Did someone figure out how to create infinite combinations of 26 letters? As far as I understand, this space is finite, and thus can be brute-forced.

<comment><USER14> The thing about a one-time pad is that the size in bits of the pad is the same as the size in bits of the message (before and after encryption). So given an encrypted message, the number of possible one-time pads is equal to the number of possible corresponding cleartext messages. There's no way to brute force that -- if you tried every single possible one-time pad to decrypt the ciphertext, you'd end up with every single possible cleartext message, with no way to distinguish which was the original cleartext.

<comment><USER5> So for every iteration, we get a cleartext message?

So every cleartext message is 100% dictionary words and absolutely no gibberish?

So every cleartext message has complete, logical sentences?

So the complete, logical sentences in each message make sense in the context of the message?

I do not believe this to be the case. Only one cleartext message would actually make sense.

<comment><USER15> > So every cleartext message is 100% dictionary words and absolutely no > gibberish?

No, but for every sensible message there is a way to guess a key that decrypts the given ciphertext to it.

<comment><USER5> Right, so we just throw out the ones with gibberish and brute-force the remainder.

<comment><USER15> But 'the reamainder' amounts to 'every non-gibberish sentence of the appropriate length in the target language' with _no_ way to distinguish between them. So

        "Attack at dawn."

and

        "Attack at dusk."

are equally valid and equally probable decodings of the ciphertext:

        739B912B0B067A9B803C46FBDB1E03

Brute force amounts to making a large number of guesses. But you can't brute- force something if you have no information about whether not a specific guess was correct.

<comment><USER5> This means you have to extend your concepts of brute-force and guessing to include determining which cleartext message is the correct one. If the message is that short, then indeed there is no way to determine from the message alone. Yet even this example gives us tons of info -- we know the attack won't come near midday or midnight, so we only have 2 times to prepare for an attack. This isn't as good as knowing exactly when, but it's better than having no idea of when.

This feels like a skill used by those who guess on tests.

<comment><USER15> It's not just two messages. The key (sometimes called a keystream) is as long as the message itself, so one can construct _any_ message just by selecting the appropriate key and no information is revealed about whether or not this plaintext is correct.

An attacker may as well just try to guess the message directly and thus dispensing with the pointless process of guessing a keystream and XORing it with the ciphertext.

This is the feature of One Time Pads that gives them a kind of provable security that is not possible to prove for any system in which the key shorter than the message.

<comment><USER5> There _has_ to be a way. This is just a signal with an approximately equal amount of noise intentionally applied to it.

<comment><USER16> You're making a fool of yourself. Try again to look at the basic concept. For EVERY POSSIBLE cleartext of the correct length, there is a key that decodes your ciphertext to it. Every. Possible. Cleartext.

Pick whatever method you use to decide if a cleartext 'makes sense'. EVERY POSSIBLE message that fits your criteria will be output during the brute forcing process.

You don't seem to realize just how nigh-infinite the number of different keys there are. If I give you a kilobyte blob of one-time-pad data, it could be any [sub-minute-long] sentence that has ever been spoken or ever will be spoken in the history of the human race, in any language.

.

I can explain it a different way, that will explain how you can kill the signal. Okay so the original message has 0s and 1s.

1\. What happens if we take a 1 and have a 50% chance of flipping it: we get a 0 50% of the time and a 1 50% of the time.

2\. What happens if we take a 0 and have a 50% chance of flipping it: we get a 0 50% of the time and a 1 50% of the time.

3\. What happens if we know someone had a 0 or 1 and had a 50% chance of flipping it: we get a 0 50% of the time and a 1 50% of the time.

4\. What happens when we try to figure out the original bit: Well both 0 and 1 have _the same output_ , so it is fundamentally impossible to figure it out without knowing if they flipped it.

5\. Repeat for every bit. Store which ones you flipped. Congratulations, you have a one-time-pad utilizing the XOR method of application.

.

Also you're right that adding noise as in addition won't mask a signal, but we're not 'adding'. We're looking at the signal, and the completely random noise, and marking down whether they match or not. If I tell you that bits 1, 2, 3, 5, and 8 matched my coin flips that doesn't tell you a single thing about what my data was.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> The Dorabella cipher has been solved: <http://unsolvedproblems.org/S12x.pdf>

<comment><USER4> No, it hasn't.

Did you read his 'explanation'?

First the decrypted code is close to gibberish and second he starts by creating the key by removing duplicated letters and yet the key has two Ns, three Is, two Ys, two Ws, etc.</comment></comment>


On the Shoulders of #InfoSec Giants - <AUTHOR> https://hackernoon.com/how-to-become-a-hacker-e0530a355cad <comment><AUTHOR> Good resources for learning how to hack</comment>


Young, Gifted and Neglected - <AUTHOR> http://www.nytimes.com/2012/09/19/opinion/gifted-students-deserve-more-opportunities.html

<comment><USER2> These are public schools, and many accept 20% or less of qualified applicants. The rejected kids will likely be educated in other public schools.

So ..... why don't we have more exam schools????</comment>


Interactive command-line tool for HTTP inspection - <AUTHOR> https://github.com/asciimoo/wuzz? <comment><USER2> Easing authentication and cookies is a must. I find myself a lot inspecting HTTP when trying to understand services that are on the other side of the wall.

</comment><comment><USER3> This could make scraping easier, as it shows the plain response. Is there plan to support XPATH queries in search?

<comment><USER3> Nevermind, I have found it in the README. It is planned to be supported according to the TODO section.</comment></comment>


Charging for concurrent apps: Windows 7 a non-Starter on netbooks - <AUTHOR> http://www.pcpro.co.uk/news/246859/windows-7-a-nonstarter-on-netbooks.html

<comment><USER2> I think Microsoft is going to catch a great deal of flack for this one. I can't imagine how they came up with the idea that people use 2 apps at a time on average. Even if this is true on average, every user will at some point want to use more than 3. Being told by your computer you can't do so will infuriat Windows. And windows can't afford to infuriat its users. Not its users who only stick around because the environment is so comfortable.

This move has another interesting consequence. The simple hack for beating this limit is to use your web browser for everything possible (which is actually almost everything). Are starter users going to wind up using google docs instead of office to save having an extra application open?

<comment><USER3> It also says this will only be sold in none-developed markets. It's a way of selling cheap(free) copies of windows in China/India to reduce piracy while still protecting the market of business customers.

<comment><USER2> Oh, I actually hadn't noticed that part. Honestly I think a 3 app limit will anger pirates so much that their propensity to pirate will be just as high as if they didn't have the option for the cheap to free version. Microsoft's methods of price discrimination are less dimwitted than we give them credit for. But I think this one really is as bad as it seems.

<comment><USER4> That might apply in a developed environment where piracy is essentially free aside from bandwidth. We're talking a 'buy bootleg CD from the local market' type of piracy, where price competition + some benefits may be a tenable strategy. People aren't pirating out of anger or stinginess - they're pirating because the official discs are a month's salary.

</comment></comment></comment></comment><comment><USER5> "Microsoft says the restriction is designed to ensure that users get the best possible performance from limited netbook hardware."

Because being _able_ to run more than three applications at once makes your hardware less efficient?

(EDIT: To be fair, I suppose that having a low fixed number of applications could let you pull off some useful optimizations. However, most of those optimizations seem like they would significantly change the OS architecture, so I doubt that Microsoft performed them. Maybe they did, though.)

<comment><USER6> Netbooks are much more powerful than the hardware used in the G1 Android phone, and Android gives a pretty good impression of running every possible app at once (if apps are written to save state) even though the constraints of the device and UI limit it to about 6 apps active at once. If an app is removed from memory because it hasn't been in the foreground in a while, they usually pick up right where they left off when they are restarted, and it doesn't even look like they had to be restarted. Microsoft won't do this with Windows though, because it would break backward compatibility and change the user experience consistency that is the bread and butter of their Windows sales.

</comment></comment><comment><USER7> I think the multiple versions are daft, there should be two versions — Home, and Pro. You're not giving people who can afford it the choice of a more feature filled (or in this case, less limited) OS, you're just giving the people who can't afford it half an OS.

Until I can find a decent explanation to why the world needs six versions of Windows 7, I'll have to say Microsoft have done it for one reason — money, which is a shame really...

</comment><comment><USER8> I'm not being snide or smug here (just a disclaimer). If anything, i'm 100% dead serious and curious about this:

Who did, how many did, and why did so many people think this was a good idea? Microsoft isn't a small company, and i'm sure tons of people have to review a decision like this. How did no one pick up that this would be a horrible idea? At least test the waters on it. I barely use desktop apps, and i still have quite a few open now:

-Firefox, ichat, itunes, mailplane, and textedit

Do apps like last.fm, dropbox, etc. count as apps? If so throw that on there too.

</comment><comment><USER9> We really would know when they announce pricing. In any case, Windows Starter is crap.

</comment><comment><USER10> So what if my apps live in the taskbar? Can I still only run 3 at once?

I honestly cannot see any benefit for the end user from this restriction.</comment>


Sign this petition to investigate MPAA for bribery - <AUTHOR> https://wwws.whitehouse.gov/petitions/%21/petition/investigate-chris-dodd-and-mpaa-bribery-after-he-publicly-admited-bribing-politicans-pass/DffX0YQv

<comment><USER2> If this is Dodd's understanding of how congressmen work, I'd like to see an investigation into Dodd's time in congress. Who wrote him checks? What kind of attention he paid in return?

</comment><comment> Tim-Boss Isn't this more "blackmale" than "bribery" (quotes intentional...)

Unfortunately, either way, I don't think anything serious will come of this!

<comment><USER3> I think the issue with the system as it is now runs a little deeper than "bribery" by one organization but perhaps this is a good way to get some thinking about it.</comment></comment>


Most important choice of a hardware startup - contract manufacturer  - <AUTHOR> http://bugblogger.com/a-long-overdue-productstatus-update-159/#more-159

<comment><USER2> I worked for a contract manufacturing/engineering company for a while.

Here is what I would recommend based on my experiences:

1\. Interview employees at the CM. Talk to the people that will be building your product. Talk to the bosses and their bosses. Talk to the people in the warehouse. Talk to the accountants. Talk to their suppliers. You need to find out how things are run. Try to see if you can shadow people in key departments at the CM.

2\. Talk to their customers. Get a current and past customer list. Talk to the customers that walked away and find out why. Lots of good info here.

3\. Find out when building starts. Show up unannounced and see how things are going. I recommend this throughout the relationship till you are confident that things are how you want them to be. This keeps the CM honest.

</comment><comment><USER3> And since nobody ever names names, _your_ startup gets to make these same mistakes over again!

<comment><AUTHOR> Can't name names, but I would say - take a hard look at the amount of square feet the CM has. The larger the manufacturer, the more they can scale. The smaller the manufacturer, the more they care about your business. It would seem like the 2nd is the one you want, but it is not, go with the large one. Look for a CM with "new product introduction" expertise, and their experience and size will pay great dividends.

<comment><USER2> I agree with your statements of going with the large CM and one with extensive "new product introduction" (called NPI in the biz) experience.

I will re-iterate the points from my previous post. Extensive due diligence is a must. You need to make sure their goals are exactly in line with yours. It is very difficult to move a CM in a direction they aren't already going.

</comment></comment></comment><comment><USER4> Cool.. a hardware post! I feel your pain.. We had such bad experiences we decided to do our own end assembly, and strictly source everything in the US. It's more expensive, but then again, we were a small company, and making things happen overseas is really difficult.

Are you manufacturing in the US or China/Taiwan?

<comment><AUTHOR> US at the moment

</comment></comment><comment><USER5> For more interesting information about a hardware startup and their experiences building a product, check out the following:

<http://www.bunniestudios.com/blog/?cat=7></comment>


Show HN: Wallet List – Shareable list of your public cryptocurrency wallets - <AUTHOR> https://walletlist.me/ <comment><AUTHOR> Mubashar Iqbal and I started chatting about the idea of a centralized public location for your crypto wallet addresses, we came up with a few conclusions.

We wanted Wallet List to be super lightweight where it can work in areas with low broadband. This will help with the adoption in 3rd world countries and will expose crypto there.

We also wanted Wallet List to be internationalized. (WIP)

We have more plans for the future of what Wallet List can do, but for knocking this out on day 1 on Product Hunt's hackathon… I'm pretty happy with it.

<comment><USER2> I love building quickly and getting users in on the website, to help us drive future development.

Although we've only been live a few hours, we've already had a ton of great feedback.

</comment></comment><comment><USER3> Fantastic website, how long did it take you to build it?

<comment><USER2> About a day in elapsed time, probably about 6-7h of actual work.

<comment><USER3> Are you both serious, that's amazing!

<comment><USER2> We came up with the idea a couple of weeks ago after we signed up for the Product Hunt hackathon.

We did some thinking on it, but didn't start designing or development until the start of Hackathon, which was yesterday.

You can checkout the Twitch stream where Seth worked on the design here: [https://go.twitch.tv/videos/186775869](https://go.twitch.tv/videos/186775869)

</comment></comment></comment></comment><comment><USER4> nice</comment>


Presence of SARS-CoV-2 reactive T cells in Covid-19 patients and healthy donors - <AUTHOR> https://www.medrxiv.org/content/10.1101/2020.04.17.20061440v1 <comment><USER2> Cross-reactivity of the immune response between the common cold coronavirus and SARS-COV-2 is a really interesting finding if this research is replicated and validated. As they found 34% of their healthy/non-COVID donors had reaction to the COVID virus, that pre-existing immunity might be an important part of why the response to infection is so different in different people. One thing this could be involved in that the paper didn't seem to discuss is antibody dependent enhancement type responses (except not ADE exactly since this wasn't about antibodies, more some cellular response). This sort of "backfiring" of the immune system making the disease worse has been (Controversially) suggested being responsible for the asymptomatic vs symptomatic split. Here's a good read on it: [https://www.pnas.org/content/117/15/8218](https://www.pnas.org/content/117/15/8218)</comment>


Want to chat with inaccessible people? Pay them, not Facebook - <AUTHOR> https://www.gramicon.com/pages/howto <comment><USER2> Which inaccessible people are available on Gramicon? None? Oh, okay... moving along.

<comment><USER3> "Want to talk to someone fast? Purchase credits to get to the top of their inbox."

Honestly, this looks more like a scam. I hope I am wrong.

</comment></comment><comment><USER4> I don't know who your target advertisor or target advertisee is

But, if I were an advertiser, I'd worry that people willing to spend time looking at ad messages for money don't have a lot of disposable income... and thus they are exactly the type of people I don't care about advertising to.

<comment><USER5> But that solves the users' problem. No advertiser will ever send them spams or any promotional message.

I do see value in this for busy people. Who want to receive message by urgency. So yeah, if it's urgent then only contact me like use case certainly exists.

I actually liked the concept of pay to send message. Want to contact a star no problem. Pay the highest or set number of credits and you are in.

<comment><USER4> You are right that "pay to send" solves the spam problem. But gmail filters spam so well that this is already a solved problem.

Additionally, the sidebar ads in google or facebook are auctioned off to the highest bidder. So users are already receiving improved targeting based on pay-to-send. The only problem I see this solving for users, is that they collect the money instead of facebook or google.

That is very little money on a per-user basis. So it's not solving a meaningful problem.

I agree that there is huge potential in "pay-to-send." But this marketing appears to be off-the-mark.

</comment></comment></comment><comment><USER6> While I can see this being of use to a certain type of person, the twitter- only login is a pretty big limitation. Please stop doing that.

<comment><USER7> I'd be curious what rationale was behind this design decision. (ie was it as simple as expediency?)

</comment></comment><comment><USER8> Your post advocates a

( ) technical ( ) legislative (x) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work.

( ) Spammers can easily use it to harvest email addresses ( ) Mailing lists and other legitimate email uses would be affected (x) No one will be able to find the guy or collect the money ( ) It is defenseless against brute force attacks ( ) It will stop spam for two weeks and then we'll be stuck with it (x) Users of email will not put up with it ( ) Microsoft will not put up with it ( ) The police will not put up with it ( ) Requires too much cooperation from spammers (x) Requires immediate total cooperation from everybody at once (x) Many email users cannot afford to lose business or alienate potential employers ( ) Spammers don't care about invalid addresses in their lists ( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it (x) Lack of centrally controlling authority for email ( ) Open relays in foreign countries ( ) Ease of searching tiny alphanumeric address space of all email addresses ( ) Asshats ( ) Jurisdictional problems (x) Unpopularity of weird new taxes (x) Public reluctance to accept weird new forms of money ( ) Huge existing software investment in SMTP ( ) Susceptibility of protocols other than SMTP to attack ( ) Willingness of users to install OS patches received by email ( ) Armies of worm riddled broadband-connected Windows boxes ( ) Eternal arms race involved in all filtering approaches ( ) Extreme profitability of spam ( ) Joe jobs and/or identity theft ( ) Technically illiterate politicians ( ) Extreme stupidity on the part of people who do business with spammers ( ) Dishonesty on the part of spammers themselves ( ) Bandwidth costs that are unaffected by client filtering ( ) Outlook

and the following philosophical objections may also apply:

(x) Ideas similar to yours are easy to come up with, yet none have ever been shown practical ( ) Any scheme based on opt-out is unacceptable ( ) SMTP headers should not be the subject of legislation ( ) Blacklists suck ( ) Whitelists suck ( ) We should be able to talk about Viagra without being censored ( ) Countermeasures should not involve wire fraud or credit card fraud ( ) Countermeasures should not involve sabotage of public networks ( ) Countermeasures must work if phased in gradually (x) Sending email should be free (x) Why should we have to trust you and your servers? ( ) Incompatiblity with open source or open source licenses ( ) Feel-good measures do nothing to solve the problem ( ) Temporary/one-time email addresses are cumbersome ( ) I don't want the government reading my email ( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(x) Sorry dude, but I don't think it would work. ( ) This is a stupid idea, and you're a stupid person for suggesting it. ( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

<comment><USER9> If you're in the mood and fast, you can prefix each line with 4 spaces to get the more traditional monospaced layout of that.

<comment><USER10> Takes about 30 seconds to do in sublime text but I think the horizontal scrolling makes it worse.

Your post advocates a

        ( ) technical
        ( ) legislative
        (x) market-based
        ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work.

        ( ) Spammers can easily use it to harvest email addresses
        ( ) Mailing lists and other legitimate email uses would be affected
        (x) No one will be able to find the guy or collect the money
        ( ) It is defenseless against brute force attacks
        ( ) It will stop spam for two weeks and then we'll be stuck with it
        (x) Users of email will not put up with it
        ( ) Microsoft will not put up with it
        ( ) The police will not put up with it
        ( ) Requires too much cooperation from spammers
        (x) Requires immediate total cooperation from everybody at once
        (x) Many email users cannot afford to lose business or alienate potential employers
        ( ) Spammers don't care about invalid addresses in their lists
        ( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

        ( ) Laws expressly prohibiting it
        (x) Lack of centrally controlling authority for email
        ( ) Open relays in foreign countries
        ( ) Ease of searching tiny alphanumeric address space of all email addresses
        ( ) Asshats
        ( ) Jurisdictional problems
        (x) Unpopularity of weird new taxes
        (x) Public reluctance to accept weird new forms of money
        ( ) Huge existing software investment in SMTP
        ( ) Susceptibility of protocols other than SMTP to attack
        ( ) Willingness of users to install OS patches received by email
        ( ) Armies of worm riddled broadband-connected Windows boxes
        ( ) Eternal arms race involved in all filtering approaches
        ( ) Extreme profitability of spam
        ( ) Joe jobs and/or identity theft
        ( ) Technically illiterate politicians
        ( ) Extreme stupidity on the part of people who do business with spammers
        ( ) Dishonesty on the part of spammers themselves
        ( ) Bandwidth costs that are unaffected by client filtering
        ( ) Outlook

and the following philosophical objections may also apply:

        (x) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
        ( ) Any scheme based on opt-out is unacceptable
        ( ) SMTP headers should not be the subject of legislation
        ( ) Blacklists suck
        ( ) Whitelists suck
        ( ) We should be able to talk about Viagra without being censored
        ( ) Countermeasures should not involve wire fraud or credit card fraud
        ( ) Countermeasures should not involve sabotage of public networks
        ( ) Countermeasures must work if phased in gradually
        (x) Sending email should be free
        (x) Why should we have to trust you and your servers?
        ( ) Incompatiblity with open source or open source licenses
        ( ) Feel-good measures do nothing to solve the problem
        ( ) Temporary/one-time email addresses are cumbersome
        ( ) I don't want the government reading my email
        ( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

        (x) Sorry dude, but I don't think it would work.
        ( ) This is a stupid idea, and you're a stupid person for suggesting it.
        ( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

<comment><USER11> Why does the horizontal scrolling exist?

<comment><USER6> Because

        pre { overflow: auto; padding: 2px; max-width:600px; }

If you want to override it, you can use a user stylesheet, userscript or the like.

<comment><USER11> I meant more like - is it intended to be there? I don't see any benefit from having it.

<comment><USER6> It prevents someone from breaking the site's layout with super-wide lines of preformatted text.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> I can't imagine using this. I'm interested in hearing from people with the most interesting things to say, not the ones with the most money.

<comment><USER13> So, you're not in politics. Or a lobbyist.

<comment><USER14> You can't stop corruption but you always create an App to make it more efficient.

</comment></comment></comment><comment><USER15> > As a recipient, you have complete control over the mesages you receive. Your > inbox is sorted by the number of credits attached to each message, so the > more valuable messages automatically rise to the top.

Don't they mean, I have zero control over the messages I receive?

</comment><comment><USER16> I like this idea. It has potential definitely. This is a sales tool and a way to get your message in front of people that want to know someone took the effort and has targeted them instead of many people and is willing to pay for the opportunity. I get solicited plenty by email (and by phone). I would definitely pay more attention if I knew there was some cost to targeting me instead of spraying everyone. I can see using this service to get a message I want to deliver in front of a decision maker (and know that it arrived). One of the biggest part of sales is getting someone to listen to what you are saying.

Let's test this out. I can get any HNers idea in front of a well known VC in NYC that funded Twitter. The cost for having me do this is $25 if I decide that he should give some thought to your product. If, after I review, he replies to what I forward (which means it has also passed my review) you owe the $25. If no reply, you owe $5. Any takers? Send me an email. (By reply I mean either "yes have them tell me more" or "no not interested" which also has value.)

<comment><USER11> The problem is that gramicon doesn't implement the 'if no reply, you owe $5' - it's free if they don't reply. So the cost for sending a shitty email that nobody wanted to receive is free.

edit: clarity.

</comment></comment><comment><USER17> this looked like a spectacular idea for a moment, until I saw that Gramicon credits are pretty much only good for delivering onto a charity or shopping with "retailers", I'm assuming that small number of charities/retailers who've made a deal with Gramicon, and Gramicon keeps a hefty portion of the money that's actually gone into the system.

I'd prefer cash without a middleman, so please use <http://gittip.com/> instead, which allows knowledge/content creators to become more financially independent overall (giving us more time to answer your questions).

</comment><comment><USER18> Or. You could get in touch with top VC folks by donating to their charity through oneleap.to.

<http://oneleap.to/featured/investors>

</comment><comment><USER19> Reminds me very much of a Seth Roberts article earlier this year which actually references a PG article:

>Here's what I want: A price per email. A service that charges people for each email they send me (e.g., $1/email). I get most of the price, the company providing the service gets a small percentage (1%?).

Even the comments seem like they're describing the exact features here:

>A great feature would be allowing people to pay more and being able to see that in the inbox. The $40,000 email gets answered first! Seth: Yes, rank them in your inbox by how much was paid. More paid, closer to the top.

[http://blog.sethroberts.net/2012/03/27/the-future-of- email-m...](http://blog.sethroberts.net/2012/03/27/the-future-of-email-my- suggestion/)

</comment><comment><USER20> This has some potential if it got enough traction... but it's another chicken- or-egg business which is going to have trouble drawing users without having anyone people actually want to talk to.

Slideshare is here <http://www.slideshare.net/gramicon> if anyone is curious. The monetization rate is really low for their case study (less than 1% of clickthroughs and even >1% of registered users), but I'd imagine more of their monetization would come from advertisers - if they can convince people to stick around and keep using Gramicon.

</comment><comment><USER21> You Might Be An Anti-Spam Kook If... you assume that your attention is so important that strangers will pay money to send you mail.

[http://www.rhyolite.com/anti-spam/you-might- be.html#e-postag...](http://www.rhyolite.com/anti-spam/you-might- be.html#e-postage)

<comment><USER22> Doesn't seem too kooky, there's $163 billion spent every year to do just that: <http://www.the-dma.org/cgi/dispannouncements?article=1590>

</comment></comment><comment><USER23> Why is this linkbaity title still allowed by the HN mods? The mods usually forbid (and then change) misleading titles and this to me seems like an obvious one.

It's essentially just free advertisement for this website masking itself as an article about a recent Facebook change.

</comment><comment><USER24> A great opportunity for an entrepreneur to take these emails and direct them to the spam folder.

<comment><USER25> It says that a read message demands a reply, and a replied to message can be rated upon by the receiver.

There was a service years back that did something similar via the phone -- you could register as an expert of something and people would call and pay them for time with you. It _is_ a good idea, fundamentally, though voice was a horrendous medium for it.

<comment><USER4> If you have to reply to get paid, you could hire someone on oDesk to reply to your gramicon mails for $3/hr.

<comment><USER25> That would be a cynical view of it, sure. I do consulting work, 90%+ of it out of sight. I _could_ technically hire some offshore help to do it for me, but it turns out that the reason people pay me what they do is the insight and knowledge that I bring to the work. The exact same principal applies here.

I can see something like this (not necessarily this implementation with their ridiculous psuedo-currency) having applicability for core developers of widely used projects (Apache, nginx, Linux, Cyanogen, etc). If they gave useless replies the jig would be up.

Aside from the technical, in the gaming community lots of people like to email Gabe Newell about Half Life 3, for funny comments, etc, usually to cash in for karma on Reddit. It would make it more interesting if he could have something like this with proceeds donated to charity.

<comment><USER4> Maybe I'm wrong, but I think they've changed their front page over the course of the day (perhaps in response to these comments).

When I first read it, it looked like a way for advertisers to reach potential buyers. If that's the case, then someone on oDesk could easily respond pretending to be interested in a product just as well as I could.

Envisioned more broadly as a way to pay for the time someone spends responding to email, it would be hard to outsource my role in email correspondance.

</comment></comment></comment></comment></comment><comment><AUTHOR> Thanks so much for the feedback. I'm impressed and encouraged by the number of people who think that this is a good idea.

To the others, I wouldn't think of this as a replacement for e-mail. E-mail is great for a majority of communications. Framing messaging from a historical perspective helps understand where our company fits.

Prior to the internet when you wanted to communicate with someone you had to attach value to that message. Whether it was a letter, long distance phone call, telegram, or other form of communication the cost and the time that it took to send were non-zero. The cost was also apparent to the recipient, which often had an impact on the recipient's likelihood of replying. The internet has done a terrific job unburdening messages of their cost and the amount of time it takes to send them. At the same time, it has created a problem of a small signal-to-noise ratio.

Consider a journalist who I would like to cover a story. With a list of 800 journalist's emails I can send 800 emails instantly. At the same time, with each journalist I am competing with hundreds of other message senders. This includes people with bad ideas for a news story who suffer no transaction cost in sending their messages. If I could communicate my value on the that journalist's time I could rise about the noise and communicate that idea more successfully. The system wouldn't be perfect, but I am betting that the overlap between people who place real value on a recipient's time and people who are offering value to the recipient is larger than the overlap between people who place no value on a recipient's time and people who are offering value to that recipient.

There's also a lot of discussion as to what these credits are worth. Right now, they're pixels on a screen. Scarce pixels. As we grow an ecosystem of message-sending, some people and companies may decide that they would like to purchase credits at a discount and offer to do things like paypal money or send discount codes for certain number of credits. At first though, the credits won't be the point. The point will be that we will provide a service for those people which will allow them to filter out people who place zero value on their attention.

I'll address twitter sign-in quickly. When you log on to Gramicon the users who float to the top of your "find users" page are the ones you follow on twitter. Here is a list of people who you have already identified as interesting or notable. Next to their usernames you can see the average price in order to get a reply as well as their user-generated rating. Right now we only allow twitter login because we don't want people signing up with facebook or their email and choosing the username kanyewest or stevecase.

Thanks and stay tuned for updates!

</comment><comment><USER26> this is awesome, doing the same thing i built about a year ago. couldn't pull it off successfully though. maybe they can

</comment><comment><USER27> The stone man looked it, but was not a statue. Once every few years, sometimes in winter and sometimes in summer, he would become flesh for long enough to speak a few words. All listened, for he was wise. Then he would sleep. A color appeared in him. His hand began to tremble. His mouth began to move. He said, "This is not the solution to that problem." Then his mouth stopped moving, and he returned to stone.</comment>


How much to keep of your startup? - <AUTHOR>

I just listened to Sam Altmans "How to Start a Startup" lecture. One part that irritated me is that it is said that in the end you will probably keep around 10% of your startup.
Im building a startup right now that is suitable for hyper growth. I expect to keep the majority of it. From previous ventures, I have enough money to pay for myself for the forseeable future. And one or two team members if I find them. So far I do stuff on my own. Its a pure software startup. Why would I expect to sell 90% of it?
Zuckerberg owns 28% of Facebook. Larry and Sergey own 18% of Google.
Any numbers on how much the AirBnB, Dropbox, Pinterest... founders kept? <comment><USER2> The mismatch you have with Altman is that you're assuming you'll keep the lion's share _of the founder equity_ (as distinct from employee and investor equity). That being the case: with investors, you can plausibly hope to end up with somewhere between 20-50% of the company.

Say that as a single-founder company, in the unlikely event that you manage to raise not only a seed rounds but an institutional A round, you end up holding 40% of the company by the time it sells.

Now look at what happens if you have two equal co-founders: 13%, squarely in Altman country.

Being irritated about this is pointless. At each dilutive step --- dividing the pie between cofounders, allocating options to employees, buying a pile of money from seed investors, buying a bigger pile of money from VCs --- you were given a judgement call: "will the amount of equity I end up, converted to dollars, be _higher_ or _lower_ if I give up equity now?" If the answer is "no", you say "no".

Often the answer is "yes". For instance: "will I make more money in the long run if I cut my stake _in half_ by bringing on an equal cofounder?" If you're being careful, and you don't have a cofounder already, probably yes. Looking at your percentage is not helpful. Think of it this way: prior to having a cofounder, all your energy and skill is generating ${X} amount of value. If you select a cofounder carefully, you can end up generating _more than ${2X}_ : not only is there _a whole other founder_ working on the problem, but their skills complement yours. Also you can get the stomach flu for a week and not leave the company rudderless.

The percentage you're left with is a barometer, but it's a little like the spot cost of a share of stock: you need more context to actually evaluate it. Having 90% of it can be a _bad sign_ : it means you're keeping a lot of your value in the bank, rather than deploying it to accelerate your business.

You say you're building a company positioned for "hyper growth". I'd suggest you double-check that assumption. Implied in the strategy of "hyper-growth" is "fast go-to-market". That costs money. Money costs equity. My sense is that a lot of people who believe they're in a shoot- the- moon startup are just fine with 10%; 10% of ${BIG NUMBER} is ${BIG NUMBER}. If you're thinking about what 10% of ${MODEST NUMBER} is, you're not thinking about "hyper growth". Which is fine! I think "hyper growth" is a bad strategy for most founders.

You can keep 100% of the company if you go it alone, don't take on investors, and pay nosebleed market salaries for all your employees. Good luck. Just remember what 100% of zero is.

Here's a link to one of the rare infographics that is actually helpful:

[http://tctechcrunch2011.files.wordpress.com/2011/10/dilution...](http://tctechcrunch2011.files.wordpress.com/2011/10/dilutionfinal02-640.jpg)

Here's Joel Spolsky on how equity divides in a well-run startup:

[https://gist.github.com/isaacsanders/1653078](https://gist.github.com/isaacsanders/1653078)

</comment><comment><USER3> I might be wrong, but I doubt the cap tables for the startups you listed are public. What the founders own is their own business.

Sam's likely talking about a 'typical' exit for a startup that's taken venture capital - multiple funding rounds, reasonable valuations at each round.

If your startup is a Facebook or Google and does a lot better than the 'typical' startup that exits (which just by getting to an exit has _already_ done better than most), you can raise at better valuations and choose to sell less equity. If your startup manages to grow in a capital-efficient manner, you can also choose to sell less equity and keep more of it for yourself.

That said, being irritated with Sam is just shooting the messenger - he's not lying to you. I certainly know of founders who came away with much, much less than 10% of their company. That also isn't necessarily a bad thing, since the stake they sold was used to get to an exit and expand their company. I'd certainly rather have 1% of a mammoth exit than 100% of a failure.

</comment><comment><USER4> If you're hyper-growth, the needs of your startup will outgrow your team of 1-3 very quickly. You and your small team will get overwhelmed by either your infrastructure (servers melting down under load), customer support, or user acquisition costs.

The only way to keep up is to spend money addressing each of these areas. Unfortunately, hyper growth startups are rarely hyper-revenue startups so the money's gotta come from elsewhere. For at least a few years, you'll be outspending any incoming revenue to keep the growth engine going.

If you want to keep more equity then the best choice is to focus on sustainable growth. Take on customers only when you have the revenue to support them and make sure you monetize your growth very early. This is a perfectly acceptable strategy. Until a hyper-growth startup shows up as a competitor and is willing to burn investor cash to move 10x faster than you and doesn't need to worry about monetization strategies for a few years.

</comment><comment><USER5> What matters is a controlling interest, not raw percentages.

Gates wound up with single percentage points of Microsoft. Around 2010, he and Ballmer owned about 6% combined and were the two largest shareholders [ larger than any of the massive S&P based mutual funds obligated to hold Microsoft shares ]. This allowed them to control the company without worrying about Wall Street because ousting Gates as Chairman or Ballmer as CEO required a significant super-majority of voting shares ( ~56% plus 1).

For what it's worth, Gates and Ballmer also amassed more wealth than the three tech founders you mentioned. In no small part because they took almost no outside investment. This allowed them to maintain control over the timing of the Microsoft IPO [ venture capital funds have lifetimes and thus there is a pressure toward a liquidity event for any company which takes VC funds that Gates and Balmer avoided ].

Good luck.

</comment><comment><AUTHOR> Another example that comes to my mind is Markus Frind, owner of PlentyOfFish. Did he every sell a part of it? I think he kept everything. And makes like 10 million a year. Not sure if that qualifies as "Hypergrowth". What do you guys think?

<comment><USER4> Markus Frind was in the right place at the right time. When he launched PlentyOfFish, most dating sites were subscription-based and he came up with an ad-based revenue model. By being free for users when there were no alternatives, he quickly got viral growth.

I'm not sure you could emulate his success today in wake of Tinder and other free mobile dating apps that are venture funded and continue to grow at an exponential rate.</comment></comment>


Silicon Valley's Hottest VC Is a Rug Dealer - <AUTHOR> http://www.forbes.com/sites/victoriabarret/2012/03/21/silicon-valleys-hottest-vc-is-a-rug-dealer/?feed=rss_home

<comment><USER2> I had no idea the carpet stores in downtown Palo Alto ever sold actual carpets; I've never seen anyone in any of them. I guess when you sell a product which appreciates with time (like wine) and where each item is both high margin and high price, they don't need a lot of traffic -- plus the "showing at your home" thing.

(I picked up a bunch of nice Qom and Afghani carpets when I was in Afghanistan. Kind of amazing to get 80-100 year old wool carpets in such good condition. I'm more in the $100-500 range vs. the $5-20k US retail price range. The thing I really want is an Afghan fortress door turned into a conference table -- one of the stores in downtown Kabul has a branch in Los Angeles run by the guy's brother, so it didn't seem worth trying to arrange shipment myself.)

<comment><USER3> There is an absurd number of them. It used to feel like a quarter of al the stores on University were selling rugs.

I just assume that stores I can't explain are fronts for something.

I used to work in Times Square and always wondered about the absurdly expensive gadget stores around...

<comment><USER4> A few years ago I was in Montreal and commented on the presence of what seemed like an extraordinarily large number of stores selling Persian rugs. I was told -- completely sincerely, as far as I could tell -- that they were fronts for drug smuggling, since the rugs were bulky enough to hide things in and expensive enough that customs agents wouldn't start slicing them open on the basis of drug dogs alone.

I'm still not sure if there was any truth to that story or if it was just xenophobia speaking.

<comment><USER5> Pioneer Square in Seattle is also littered with an irrational number of carpet stores. It seems like a widespread oddity, whatever the cause.

</comment></comment></comment></comment><comment><USER3> That article makes me feel like there is a parallel Silicon Valley that I haven't seen into. I don't think I am a coinvestor on a single deal with them.

<comment><USER6> Like some kind of Bizarro Valley where shady rug deals finance hot new tech startups? I'd watch that movie.

</comment></comment><comment><USER7> At first glance I thought the headline said,

"Silicon Valley's Hottest VC Is a Drug Dealer"

Would have made for a nice twist.

</comment><comment><USER8> I actually called his office last week trying to speak with him. Some of the best venture capitalists took my calls to give some great suggestions and feedback. One was an original investor in WebMD and another was a very big in the venture world. I even had a discussion with Alan Patricof's office since Alan's son and I were friends since childhood. I used to hang out at their house before Bill Clinton did. I also lived across from another rug dealer who did pretty well. His name was Tom Freston and for those of you who are kind of young, he was the main guy at MTV a long time ago. I set a meeting with MTV just by calling him up and persisting. You never know what you can accomplish when you put your mind to it. It doesn't matter if your a rug dealer, have a PHD, or were homeless. My motto is to keep going and to never stop no matter what!

</comment><comment><USER9> Funny that Plug and Play Tech Center was not mentioned. That's the setting where Saeed Amidi made those investments and gave real estate to those early companies mentioned. This was around pre-YC but never quite adapted to what entrepreneurs really needed: rock solid mentorship as opposed to just real estate.

<comment><USER3> Did it close? The building it was in seems to have removed the marquis.

<comment><USER10> It is still there...<http://www.plugandplaytechcenter.com/startups/office- space>

</comment></comment></comment><comment><USER11> My wife thought for the longest time that this store was a front for something. I had heard of a persian landlord in the area taking equity in lieu of rent for office space leased to startups but first time I'm reading of the back story of the rug store. Move over Ron Conway :)

</comment><comment><USER7> Pretty darn interesting view in this article. "Hustle" is the magic factor, is what I got from it. Keep trying and asking for things (intelligently), and you'll eventually get some of them.

</comment><comment><USER12> "There are too many of them investing in too many deals," snickers one prominent venture capitalist. "This doesn't end well for a lot of white- haired guys who should know better."

</comment><comment><USER13> something about that guy reminds me of lazarus long from the heinlein novels. toss him into a brand new environment, and he can look around, take its pulse, find out almost instinctively where the leverage points are, and land on his feet.</comment>


Infield top-aligned labels beat floating labels on forms - <AUTHOR> https://uxmovement.com/forms/infield-top-aligned-labels-floating-labels/ <comment><USER2> Where is the data? This article, like everything I've ever seen on UX Movement, makes all sorts of claims without any sign of conducting usability research to actually support their claims.

In this article, the examples are artificially constructed to support their claims in a dishonest manner. For example, they talk about how "floating label" text is smaller than the "IFTA label" text even though there is no reason they couldn't be the same size (and, of course, the text is larger and more visible in the floating label's initial state). The same thing is true of the "crammed spacing" claim, there is nothing inherent to the floating label that reduces spacing.

Finally, the article suggests that "IFTA label" is better by using colour to differentiate between complete and incomplete fields. This manages to ignore well-established research showing users with achromatopsia and low vision won't be able to differentiate between those states at all since the contrast difference is only 1.25:1! At least unfilled fields with floating labels have no label at all above the field—which is not a great UI clue either, but is at least one that is legible for everybody. (In any case, unfilled fields should always be discoverable by form validation at submission time pointing out which fields are invalid and why.)

<comment><USER3> The article claims that _not_ having the label inside the field allows users to spot fields that have yet to be filled-in. In the next section the article claims that by moving the label out of the field leaves room for helpful hint- type text within the field.

My eyes almost rolled out of their sockets reading this article.

</comment></comment><comment><USER4> I generally agree with a lot of these points, but I'm not sure I agree with using the placeholder for hints. If you put in a couple characters and forget the hint, it's now gone. The 'bad' example there actually seemed better to me.

<comment><USER5> material design distinguishes between: label (the one that moves to the top when the user focuses the field), placeholder (which is visible inside the field when the user has not entered anything yet) and help text (below the text field). The label should describe the field (eg. Name, Email, Phone number), the placeholder should indicate an example of a value that one has to enter (eg. email@example.com, +01 234 56 32), and the help text should provide additional context (eg. Must be at least X characters)

</comment></comment><comment><USER6> How about just using a regular textbox, and a regular label right outside the box?

</comment><comment><USER7> "Users with vestibular disorders need control over movement triggered by interactions"

Also: it's fucking annoying.

I appreciate how much UX devs put into affordance and usability patterns, but I equally despise they "hey let's make this animated and more complex" for no good reason.

<comment><USER8> It's a bit of flair that can be handwaved away. Unlike back-end systems, where due to the non-visibility, flair isn't exactly seen, the best way of being tongue-in-cheek is a dud API or a comment highlighting some strange behaviour. But front-end is more visual, which is why designing how to animate your hamburger menu button is just something you might end up doing.

It's not necessarily bad, trying to add a little animation or complexity, if it's not in-your-face: it can help vary style, experiment with what clicks with an audience, and develop skills. It can also act as a status signal for the website if it can afford for developers to fine-tune every detail – Apple is a good example here.

But yes, the best design is usually one of the simplest ones. Some designers try to make content glide over your eyes and forget that this doesn't fit usability needs.</comment></comment>


In 200 men direct descendants of Genghis Khan (2010) - <AUTHOR> https://www.discovermagazine.com/the-sciences/1-in-200-men-direct-descendants-of-genghis-khan <comment><AUTHOR> [..] here is a quote attributed to Genghis Khan:

The greatest joy for a man is to defeat his enemies, to drive them before him, to take from them all they possess, to see those they love in tears, to ride their horses, and to hold their wives and daughters in his arms.

You're probably more familiar with the paraphrase in Conan the Barbarian.

The Genetic Legacy of the Mongols:

We have identified a Y-chromosomal lineage with several unusual features. It was found in 16 populations throughout a large region of Asia, stretching from the Pacific to the Caspian Sea, and was present at high frequency: ∼8% of the men in this region carry it, and it thus makes up ∼0.5% of the world total. The pattern of variation within the lineage suggested that it originated in Mongolia ∼1,000 years ago. Such a rapid spread cannot have occurred by chance; it must have been a result of selection. The lineage is carried by likely male-line descendants of Genghis Khan, and we therefore propose that it has spread by a novel form of social selection resulting from their behavior.[..]</comment>


What data format for object (like JSON) supports in place update? - <AUTHOR> Hi, I want to ask if anybody knows the data format for object serialization that supports in place update (updating a field of object does not cause the rest of object to be copied to another memory location to fit new size of this object) <comment><USER2> Some data stores (Mongo, CouchDB) do support in-place updating of JSON objects

<comment><AUTHOR> Yes, but they are not efficient: When updating one small field, like string, which is larger than the original one, the whole document must be resized too, to have enough space for the updated field. This is inconvenient.</comment></comment>


Blacknegative - <AUTHOR> http://blacknegative.com <comment><USER2> Splash screen? So '80s.

Looks pretty, but I gave up after one screen change due to the horrible navigation control.

I can only ask... why?</comment>


Cisco's cloud vision: Mandatory, monetized, and killed at their discretion - <AUTHOR> http://www.extremetech.com/computing/132142-ciscos-cloud-vision-mandatory-monetized-and-killed-at-their-discretion

<comment><USER2> _If_ this had been done correctly, it probably would have been a great boon for the average person. It would have allowed Cisco's tech support to more easily address problems users are having and allowed Cisco to keep software up to date.

Unfortunately, Cisco decided to see how well they could "monetize" (gads, I hate that word!) it:

\- Create a "marketplace" for features built into many routers? Check!

\- Sell people's internet history to the highest bidder? Check!

\- Force the upgrade and provide no way for people to opt-out? Check!

I'm really trying to image the product management meetings that created this travesty. Did the meetings happen after somebody came and said, "You know, we could make administering these routers a lot easier by making it so users don't have to," or were the meetings more like, "We have a lot of users. How could we package things so we can sell all their data"? Did it start benign and turn malignant or was it malignant from the get-go?

Regardless, I can't imagine being willing to screw my customers like that.

<comment><USER3> I'm sure it started as the latter. Since Apple's success with the App Store, every vendor wants to turn their platform into a walled garden where they control everything.

Cisco tried it previously with their attempt to marry a VoIP phone with an Android tablet.

From an MBA point of view, Linksys is a problem -- it's a commodity product with low margins that was only acquired to protect Cisco's high-profit small router/switch business. Focusing on improving the user experience makes your $80 router a $150 router (ie. Apple's strategy in this segment), which doesn't help the bottom line -- the world doesn't need another AirPort Extreme.

Instead, you can turn your router into a "monetization" machine and extract recurring cash flows without changing the product price-point in a competitive market.

</comment></comment><comment><USER4> >"The Terms and Conditions of using the Cisco Connect Cloud state that Cisco may unilaterally shut down your account if finds that you have used the service for "obscene, pornographic, or offensive purposes, to infringe another's rights, including but not limited to any intellectual property rights, or… to violate, or encourage any conduct that would violate any applicable law or regulation or give rise to civil or criminal liability.""

So let me get this straight, Cisco feels that they have the right to shut off your Internet connectivity IF:

1) They don't like what you say.

2) You watch porn. (Or anything they consider pornographic, which may not agree with your definition of pornographic; see corporate Internet filters.)

Well, that just proves to me that they have no idea what the hell they're doing, and have just permanently lost me as a customer.

<comment><USER5> It's not clear that the router itself is considered part of the service, so maybe they would only brick your router if you transmit porn _through their servers_.

And I think those terms have been removed anyway.

</comment></comment><comment><USER6> I'm thankful Jeff Atwood posted another article about the commodity router + open source firmware one-two punch [1]. I finally took the plunge and installed Tomato (Toastman [2]) and have been thrilled with the features, but mostly excited about the fact I get to tinker with another device :) It is empowering to know that I can circumvent overarching and onerous policies such as this...innovation...by Cisco.

[1]: [http://www.codinghorror.com/blog/2012/06/because-everyone- st...](http://www.codinghorror.com/blog/2012/06/because-everyone-still-needs- a-router.html)

[2]: <http://toastmanfirmware.yolasite.com/>

<comment><USER7> Don't miss the previous discussion of Jeff's post here on Hacker News for more details and alternatives:

<http://news.ycombinator.com/item?id=4127393>

<comment><USER6> I did indeed follow both the discussion here and the comments on his post closely! I wasted/spent a good 6+ hours reading about all kinds of router features that I had didn't know existed, or never even thought possible (VLANs, VPN, NFS, CIFS, Captive Portal, router CPU overclocking, etc). Some versions of Tomato (Shibby's firmware [1] in particular) allow the router to act as a BitTorrent client! I'm sure it's old news to some, but for anyone on the fence about trying new firmware on their routers - take the plunge.

[1]: <http://tomato.groov.pl/>

<comment><USER8> I have an ASUS RT-N16 router at home, which I connected to a hard-drive by USB. Then with Tomato installed, you can SSH into the router and install optware. Then you can configure optware[1] to install its packages on the external hard-drive. From there, you can retrieve and install a bunch of packages, like http servers, bittorrent clients and whatever else you feel like running from the CLI. Pretty convenient! I installed Transmission with a web-gui and I can SSH into it from anywhere in the world to my house's router, load a magnet or torrent in the queue and when I get home, the content will be waiting for me on my hard-drive.

I don't pretend Tomato firmware are the first to allow to do so, but I just found it was an interesting and usefull thing.

[1] <http://tomatousb.org/tut:optware-installation>

</comment></comment></comment></comment><comment><USER9> The author seemed to gloss over the part that really stuck out to me: "...we may keep track of certain information ... e.g Internet history ..."

So the router is tracking your online activity and they will terminate it if they find you've been using it to watch porn or content not deemed legal. I'm guessing not many people from Hacker News will be able to do much with their routers if they start enforcing this.

<comment><USER5> Their TOS says you can't use the service for naughty things, but it's not clear whether your router is part of the service or just a client to the service.

</comment></comment><comment><USER3> I suppose that Cisco's experience collaborating with the secret police of various nations has seeped into it's corporate culture.

</comment><comment><USER10> Wow, pretty amazing. I'm not sure of a better advertisement for open source router software than this sort of bonehead move.

</comment><comment><USER11> This is hilarious, and exactly what you get when there is no forethought to product longevity. What if in 10 years the economy is still shit, the cloud is unfeasible, and the WRT54g from 2002 <http://en.wikipedia.org/wiki/Linksys_WRT54G_series> is still working? Just about as bad as Diablo 3.

Cisco is scared, because for most people there is not a need to upgrade your router every 2-4 years. Router oses generally suck less than windows. Internet is not even >25mbit/sec in most places in the USA.

<comment><USER12> My WRT54G is still going strong. I run the `tomato` firmware on it, and haven't had to mess with the configuration in years. If only the rest of my hardware could be as reliable.

</comment></comment><comment><USER13> Looks like Apple really opened Pandora's box with the advent of their closed app ecosystem. I think we're going to find "App Stores" popping up at every level of the network stack at this pace (as to why you'd need one over your wifi router firmware is anyone's guess though)

</comment><comment><USER14> > "In some cases, in order to provide an optimal experience on your home > network, some updates may still be automatically applied, regardless of the > auto-update setting."

I have just added Cisco to my list of hardware companies never to buy from.

</comment><comment><USER15> Wow. I understand that Cisco wants to sell a service to consumers instead of commoditized hardware. But who in their right mind wants to _buy_ that kind of service?

</comment><comment><USER16> Someone could probably come along and eat Cisco's lunch. I imagine a company using a longevity argument like "routers built to last" or something; a nice commitment to sensible autoupdate; maybe a product that does just what it's supposed to do: route packets.

</comment><comment><USER17> This is really just a view into technological companies losing sight from the customer view. Even though the new design is probably meant to be a much better product, newer isn't always better. No matter how much more valuable the new design might be, sometimes the simple change in UI is too much of a hurdle for people and that enough, is something to consider before forcing updates. 37signal's Jason Fried wrote a good article on the topic: [http://www.inc.com/magazine/201205/jason-fried/you-can- lead-...](http://www.inc.com/magazine/201205/jason-fried/you-can-lead-a- customer-to-an-upgrade.html)

</comment><comment><USER18> Who the hell still runs the stock firmware on their router?

<comment><USER16> Every-damn-body that's not technologically inclined. Are you this myopic about everything?

<comment><USER19> He's not myopic, he's being a snob.

</comment></comment></comment><comment><USER20> This has been implemented in a totally boneheaded fashion with the forced update and onerous privacy policy, but it's not necessarily a bad concept. Router interfaces are clunky, inconsistent, and not very user-friendly, but they're hard to improve because they're quite constrained by the limited resources on the router and the difficulty of pushing out firmware updates. If the UI were in the cloud it would be easier to provide a really nice experience and start offering new features.

For instance, Marshini Chetty, a researcher at Georgia Tech, has been working on a project called Kermit[1] to provide increased visibility into home networks, mainly to provide QoS (e.g. you can determine your teenager is hogging the bandwidth with video streaming and throttle him back). However their system generates a lot of data, too much to process on the router itself, so IIRC they schlep it over to a PC running on the network. If this were coupled with a cloud service, you wouldn't need to keep a PC running all the time. I'm not sure how much of a market there really is for this, though in a presentation she said they had done a study where they put these in average people's homes and received a positive reception.

On a different note, I find the outrage about this (both here on HN and elsewhere) somewhat ironic because the privacy policy isn't that different from the privacy policies people put up with everyday with other cloud services they use. I think it's just when it's put in contrast with the status quo of routers (not in the cloud and with good privacy guarantees) that people find it outrageous. This is not a comparison people make with other cloud services; perhaps they should.

[1] <http://www.cc.gatech.edu/~marshini/kermit.html>

<comment><USER21> A router is not a 'cloud service'. I give specific information to a cloud service to do with as it sees fit; I give my router literally everything I do on the Internet.

Somewhat of a difference there.

<comment><USER20> Gmail is a very popular cloud service, and email contains almost everything you do.

<comment><USER22> It does? Last I checked my gmail was full of letters to/from my mom and spam. Hardly "everything I do" on the Internet. I also willingly signed up for gmail because, you know, it offers a service that is useful for me. Hard to make that argument here.

<comment><USER20> I tried to make the argument that a cloud router (though not this one) _could_ provide a useful service. I guess people don't agree, hence the downvotes.</comment></comment></comment></comment></comment>


IPFS Pics - <AUTHOR> https://github.com/ipfspics/server <comment><USER2> My concern with the IPFS claims of permanence, like "Where you can know for sure your pictures will be available forever" is that, AFAICT, files are only uploaded to the network once another party requests them.

An example:

      $ipfs init
      $echo 'agdkjagka' > test
      $ipfs add test
      added QmTtmsSSTH5fMQ9fn9NRXWtcZXnBBazxR8fidXcE5KB76h test
      $rm -R ~/.ipfs
      $ipfs init
      $ipfs cat QmTtmsSSTH5fMQ9fn9NRXWtcZXnBBazxR8fidXcE5KB76h
      Error: merkledag: not found

In English, `ipfs add` does not upload anything to the network. The only way a hash becomes distributed on the network is for another party to request that hash. Even then, I believe that the data only exists on that party's system. That is, if both you and the requester leave the network, the data is gone.

<comment><USER3> IPFS is just piece of the puzzle. Filecoin, Bitcoin like technology (but about files instead) is meant to combat this issue. Similar to how you pay Dropbox or AWS to host your files, you'll have IPFS hosts that you'll pay to rehost your content. Or, you'll have your own public daemon that you can "pin" your own content. In the end, people are not willing to give out disk space for free, therefore Filecoin will exist.

[http://filecoin.io/](http://filecoin.io/) < built by the same guys behind IPFS and meant to be used together

<comment><USER4> > In the end, people are not willing to give out disk space for free, > therefore Filecoin will exist.

Disk space is one parameter of the equation though. Bandwidth and uptime should be considered too in order to estimate the effective amount of resources a node adds to the network.

<comment><USER5> Given enough peers over time, neither bandwidth or uptime should be an issue. If an incentive based system like Filecoin were to take off, and there's a market to exchange that currency, then it may actually be a viable business just to set up farms that host content. Kind of like a hosting service, but with indirect customers.

</comment></comment></comment></comment><comment><USER6> Great idea and use case for IPFS. I'm not sure I want to run php just to host images though. I always have this 'oh... It's in PHP...' moment with things like this and I generally end up not wanting to play with or host them, either because I don't find php attractive as a language or because of the various security issues around hosting php applications.

<comment><USER7> It's worse than that, his PHP scripts make cURL calls to a local nodejs server which then exec() the ipfs commmands.

<comment><USER8> Ipfs exposes a JSON API locally. Not sure why the author didn't just use a JavaScript front end making calls to the local API.

[https://ipfs.io/docs/api/](https://ipfs.io/docs/api/)

EDIT: I'd encourage the HN community to look past the technical merits of the code, and focus on the idea presented (and even perhaps fork and contribute back an improved version).

<comment><USER9> Hm what prevents some malicious website from pinning unwanted content on a visitors machine?

<comment><USER10> The visitor needs to chose to run IPFS and cache it

<comment><USER9> He just needs to happen to have IPFS running. Any website can make a request to localhost via Javascript or even without.

Scenario:

Attacker sends you harmless looking link to a page that contains some invisible JS that sends a request to localhost and pins kiddypon on your IPFS node. Attacker then sends the police to you.

<comment><USER11> The IPFS API isn't exposed like that, there is actually a whitelist for hashes that can access the API (the IPFS webui is in the whitelist by default), and hashes that are blocked will get a 403.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> So, we would blindly host other people's pictures. Does noone see the danger in that?

<comment><USER13> Also see: Freenet, Perfect Dark, etc.

The difference here is that the content you're opting in to rehosting is sitting in cleartext on your machine. So it's not blind, per se; you can delete (un-rehost) whatever you don't want to be there, or run a nudity detection algorithm (yes, those exist) to automatically prevent re-hosting of any porn, etc.

<comment><USER14> Similar to this, you could suscribe to a good-faith censor that removes known illegal images from your ipfs enlistment (using known hashes, for example). Obviously wouldn't catch everything, but I suspect would remove any legal obligation on your part (IANAL).

</comment></comment></comment><comment><USER15> This may be somewhat immature as far as its development but IMHO it's the beginning of the future. My guess is that we'll now be seeing almost complete server/client decentralization of many of the most popular apps (social / search / sharing). 5+ years from now.

<comment><USER16> I bet strongly against that. "Decentralized" systems do not scale, and are impossible to keep clear of spam.

<comment><USER17> So Git for example doesn't scale and is impossible to keep clear of spam?

<comment><USER18> Git's not that decentralized, though. You've got centralization at a technical level (everybody contacts the same server to push code) and at an organizational level (if you want to add code you need to be the repository owner or someone authorized by them).

That brings up an important point, though: you can make your system partially decentralized, and gain many of the benefits of a totally centralized system with a fraction of the complexity.

<comment><USER9> Git does not need any centralized server. Git is fully distributed. It is a DVCS, D standing for Distributed.

That some/many organizations tend to centralize parts of Git, doesn't mean that Git itself is inherently centralized.

<comment><USER18> HTTP's not inherently centralized either. What's your point?

</comment></comment></comment></comment></comment></comment><comment><USER19> >where you can know for sure your pictures will be available forever.

This is certainly untrue, but it would be interesting to know what reasonable conditions would need to be true for an IPFS file to become unavailable.

</comment><comment><USER20> It seems to be a huge problem that random people can store crazy pictures on your computer.

Maybe it would have been better if the images were stored encrypted in some manner, and decrypted on the client.

However I applaud the initiative and newness of this!

<comment><USER21> This is not true. You only store pictures you have requested.

</comment></comment><comment><USER22> I realize this may not be constructive, but it definitely qualifies as "glorious": I clicked "Random" and this was what I got: [http://ipfs.pics/QmPJddhYZb2kXtn2vzeGTAagPcPyfCb7fuoPxQ3mqpE...](http://ipfs.pics/QmPJddhYZb2kXtn2vzeGTAagPcPyfCb7fuoPxQ3mqpEL4G)

Excellent project.

<comment><USER23> While we are sharing, this is what random threw up for me [http://ipfs.pics/Qmcim5DzJSW7xpmonxALaEw9oVbhYM9RjqUhAjSws4F...](http://ipfs.pics/Qmcim5DzJSW7xpmonxALaEw9oVbhYM9RjqUhAjSws4FEeF)

</comment></comment><comment><USER24> Does IPFS have a client-side JS library for building apps that interact with the IPFS DHT? Something similar to [https://github.com/feross/bittorrent- dht](https://github.com/feross/bittorrent-dht).

I've been looking into developing distributed client-side apps for IPFS, and it would be great if we could just tap into the native IPFS DHT rather than having to depend on a separate IP-based DHT for peer discovery in our apps.

<comment><USER3> A fully client side implementation of IPFS is in the works. Right now, you'll have to run the daemon on your server and interact with it, so not fully distributed until either the client-side implementation of IPFS is done (node- ipfs on Github/NPM) or the public gateway can accept calls from the JS api client that works in the browser too (node-ipfs-api on Github/NPM).

</comment></comment><comment><USER25> [edit] derp I am dumb, was not familiar with [https://ipfs.io/](https://ipfs.io/) this explains my questions

<comment><USER16> It's just POSTing the image to a web server running from something else.

I don't understand why they are doing dumb things like passing everything to a shell when PHP has curl support of its own, and imagemagick.

<comment><USER7> Not to mention that index.php contains only HTML.

</comment></comment></comment><comment><USER26> Can a user delete a picture he or she has uploaded?

<comment><USER27> I imagine no, just like you can't delete a picture after someone else has downloaded on their PC.

</comment></comment><comment><USER28> It seems to be licensed under AGPL which means it is unusable for a whole lot of stuff.

<comment><USER29> It seems to be licensed under AGPL which means it is usable for a whole lot of stuff.

<comment><USER30> But for less stuff then if it was licensed under MIT.

<comment><USER29> Yes but the argument is unidirectional. AGPL answers different needs than more permissive licenses.

Also it would be good to recognize the work done before shooting out "wrooooong license (for me)", specially when it still is licensed under a free software license.

<comment><USER28> > Yes but the argument is unidirectional.

I'd say yes. IMO there isn't a single thing you can do with a AGPL licensed piece of SW that you cannot do with a MIT licensed one, -the other way around, -quite a bit.

> Also it would be good to recognize the work done before shooting out > "wrooooong license (for me)"

Sorry. Wasn't my intention but I can clearly see it being read that way. I just wanted to point it out as I personally don't like AGPL and wanted others to avoid the disappointment had.

<comment><USER31> > IMO there isn't a single thing you can do with a AGPL licensed piece of SW > that you cannot do with a MIT licensed one

Sure there is. You can prevent others from imposing restrictions. If someone takes your non-copyleft software and uses it to build something that forbids people from knowing what's in it, how it works, or what it does with their data, then you are helpless to stop it.

<comment><USER28> And this is where our views differ:

IMO nobody can impose restrictions to your MIT licensed code unless they can somehow threaten you and your users (think patents, law enforcement) in which case you have lost anyway.

They can reuse your MIT code and impose restrictions on their modified code but we still have the free MIT code that is way free-er that AGPL and we also have an additional proprietary option.

Edit: And if your worry is that they will use the code to create a commercial product with a slightly different file format etc this is a standards issue, not a open source issue. Furthermore, if there isn't liberally licensed code available they will just create their own broken/different version.

Summarized: I am fairly convinced that for many companies the option to using BSD/GPL/LGPL/MIT code isn't using AGPL but rather using a commercial solution or write their own. Both this more or less guarantees you get no patches back to your open source project. AGPL is then just a way to make a statement.

<comment><USER31> > IMO nobody can impose restrictions to your MIT licensed code

Not to you, but to your users. If you don't care about your users' well-being, well...

> use the code to create a commercial product

I wish people who oppose the AGPL didn't see mistreating their customers as the only way of being commercial. There are several examples of commercial AGPL software.

Yes, hiding the source code and forbidding them from copying the source code is mistreating them. If you are not doing anything wrong, then why are you hiding the source code? When software is naturally copyable, why are you denying them this natural right?

> Both this more or less guarantees you get no patches back to your open > source project

There are also plenty of examples of copylefted projects getting even more patches than corresponding non-copylefted projects. There's a popular kernel called Linux that is copylefted and gets tons of industry-backed patches. People have been using that bugbear for as long as copyleft has existed. Mailpile got that threat when it switched to AGPL-only and so far its contributions haven't slowed down.

<comment><USER28> > Not to you, but to your users. If you don't care about your users' well- > being, well...

They can still use my MIT licensed code which gives my user more rights than AGPL ever will.

> Yes, hiding the source code and forbidding them from copying the source code > is mistreating them.

Now you are arguing against closed-source, not liberal open source licenses.

> There's a popular kernel called Linux that is copylefted and gets tons of > industry-backed patches.

Note that you can use Linux on your server without announcing it to everyonce who acesses it. Also another reason for why patches are submitted are because industry hope their patches will be mainlined so there will be less maintenance.

That said, _GPL_ has worked well for the Linux kernel, possibly better than BSD. (I'm mostly arguin against AGPL.)

> Mailpile got that threat when it switched to AGPL-only and so far its > contributions haven't slowed down.

Now that is interesting.

<comment><USER31> > Now you are arguing against closed-source, not liberal open source licenses.

Non-copyleft licenses provide no protection against proprietary derivatives. If you have no objection to proprietary derivatives, then I think that's a weak stance to take. It means you don't care if your users can be given your software but without the rights that you intended them to have, because someone between you and your users can always take that right away.

While your users might come back to you to get the same software with the same rights you intended them to have, they might not be aware of this, or they might not want your software alone, but together with whatever else was built on top of it, which they cannot get under your original permissive terms anymore.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> Bonus points for that gif:

[http://ipfs.pics/QmYqA8GiZ4MCeyJkERReLwGRnjSdQBx5SzjvMgiNwQZ...](http://ipfs.pics/QmYqA8GiZ4MCeyJkERReLwGRnjSdQBx5SzjvMgiNwQZfx6)

</comment><comment><USER33> So, this is like eMule? What's the benefit of this over eMule? Faster/better/hype?

<comment><USER34> No this is Imageshack decentralized.

</comment></comment><comment><USER35> Without an extension many forums won't let you embed these images.</comment>


WeWork calls time on free beer and wine at North American sites - <AUTHOR> https://www.theguardian.com/business/2020/jan/30/wework-ends-free-beer-wine-north-american-sites <comment><USER2> Given the cost cutting situation with Softbank, not that surprised.

I've worked in a dozen different Wework locations (as a digital nomad). Beer is also one of the perks I rarely use. Sure it's nice to know you can have a beer in the evening, but it's not something you want to have everyday when being productive.</comment>