Canada's Quiet Weakening of Communications Encryption - <AUTHOR> https://citizenlab.org/2015/08/canadas-quiet-history-of-weakening-communications-encryption/ <comment><USER2> _As a result, DUAL EC DRBG has been incorporated into a range of products, including those from security company RSA, in operating systems such as Microsoft Windows,and in a version of OpenSSL (a tool commonly used to facilitate website encryption). The integration of the standard with operating systems was significant because, by changing the default method by which the operating system encrypted communications traffic, an intelligence agency could decrypt data now encrypted using DUAL EC DRBG._

Dual_EC was never the default in Microsoft Windows, and you'd have to put effort into building a version of OpenSSL that used it. The article is overstating its case here.

Dual_EC was famously the default for some versions of RSA BSAFE, and RSA BSAFE seems to have acknowledged accepting money from the USG to set that default. But BSAFE's licensors used it primarily to mollify RSA's patents, which expired over a decade ago. Lots of vendors that license BSAFE don't use it for anything meaningful. OpenSSL is much, much more popular in closed-source enterprise tools than BSAFE is.

<comment><USER3> I believe it also overstates or miss-represents the way the wireless telecommunications networks operate.

While I'm honestly not familiar with the SGES or all the rules the article is alluding to about decryption, I think this article also miss-represents the way wireless telecommunications networks work. The encryption used by networks such as UMTS and LTE are international standards specified by the 3GPP, and to my limited knowledge do not draw on DUAL EC DRBG in any way. However, my experience in this portion of the encryption is extremely limited.

Anyways, the encryption used by UMTS and LTE networks as specified by the 3GPP, are international standards, and are used to authenticate users SIM cards, and to protect the air interface for integrity and confidentiality. As such, the telephone communications should be difficult to intercept on the radio interface only, but when it enters the network the need for encryption is no longer needed.

To maybe draw a parallel to a web service, many load balancers offer SSL termination. SSL between the browser and the web server, is important to protect the connection between the client and any intermediate networks. However, once it get's to the load balancer, many services will just pass the traffic internally without encryption. Many systems like connections to a database will may also not be encrypted. Once you're within your own network, you don't keep everything encrypted at every step. The cellular network can be thought of in a similar way, the encryption is used to bring the service into the network in locations where it can be intercepted from outside the network.

Now if you think of something like say Internet traffic, for you to visit hacker news. You phone or tablet, will activate a cellular connection, and will send packets to the cellular network. The radio connection will be encrypted, but it will be decrypted by the network, because Hacker News doesn't know or understand the cellular encryption protocols, there are no end-to-end guarantee's provided. Also, the cellular network will eventually turn into an IP network, and the IP routing headers will be needed for regular Internet routing. When it leaves the cellular network, it will just be IP traffic like any other Internet traffic. What you are protected from, is that someone following you around with a special radio, can't listen in on your conversations, messages, etc __.

In the case of Hacker News though, SSL is used, so that regular Internet traffic is also encrypted at a layer above TCP/IP, and the contents will be unknown.

Anyways, I hope that made sense. The article may have a lot of merit about what's going on, but in my experience it miss-represents how the mobile network operates.

 __To be fair, and what may be relevant, is the 3GPP did cripple cellular encryption technologies at one point, for use in countries with export restrictions if I remember correctly. __Also, at least the older encryption algorithms have known flaws. And there are also documentation of other flaws, such as being able to trick certain phones into using null encryption for example and then intercepting the radio traffic. Or getting the UE to trust a network that it shouldn 't be able to.

Now for the mandatory disclaimer, the information provided are my own views, and in no way represent my employer. I do work in the wireless telecommunications sector in Canada, and all the information I provided is available to the public if you know where to look.

</comment></comment><comment><USER4> A side read, but somewhat related. By NY times "The closing of the Canadian Mind".

[http://www.nytimes.com/2015/08/16/opinion/sunday/the- closing...](http://www.nytimes.com/2015/08/16/opinion/sunday/the-closing-of- the-canadian-mind.html?_r=0)

<comment><USER5> This was a great read. As a Canadian, I get the feeling that (most) people get Harper is bad news, but don't quite get all the details. I'll be sharing this one.

</comment></comment><comment> white-flame This article doesn't mention warrants at all. Are those even a consideration of these laws?

Can a Canadian government agency simply say "Gimme this info" to Canadian businesses with no oversight or accountability?

Also, the C-13 provisions regarding a crime under foreign law reeks of US involvement. However, it's also a restriction on Canadian sovereignty, making the nation beholden to any crazy law anywhere in the world. (or simply broadening the ability for selective enforcement to pull in any reason they can think up)

</comment><comment><USER6> Speaking of weakening wireless communication, what ever happened to the Gemalto sim card revelations? This was big news 6 months ago then it just disappeared.

As far as I know, no recall ever happened. So we are all still using the compromised sim cards?

<comment><USER7> > Speaking of weakening wireless communication, what ever happened to the > Gemalto sim card revelations? This was big news 6 months ago then it just > disappeared. > As far as I know, no recall ever happened. So we are all > still using the compromised sim cards?

A local company was specifically named in leaked documents about the gemalto SIM compromise. When contacted by the news media, they asked Gemalto about it and were told an internal investigation had not revealed any evidence of breach. They proceeded to do nothing, and all those SIM cards are still in circulation.

I can't speak for what other carriers did, but certainly some of them are still out there, and I would hazard a guess that it would be most of them.

</comment></comment><comment><USER8> If it were the case that the telecom company is providing the government decrypted information, wouldn't they be giving the government an already- encrypted information if I were to use a VPN app like expressVPN on my smartphone?

</comment><comment><USER9> So I'm not familiar with Canadian law. Does royal assent mean it passed?

<comment><USER10> Yes.

The queen of the UK has a nominal right to veto led passed by parliaments. The Governor General of Canada provides that assent in Canada.

<comment><USER11> The Queen of _Canada_ must provide royal assent for legislation to pass.

The Governor General of Canada is her appointed representative who acts on her behalf.

The Queen of Canada also happens to be the Queen of the United Kingdom.

Canada could, if they wanted to, pass a new Succession to the Throne Act which could change who inherits the crown.

If Canadian laws surrounding the order of succession were different to the UK, the monarchs of the two countries could diverge. Canada's Canada Act 1982 prevents the UK parliament legislating for Canada, which since then means if the UK changes succession to the throne laws, Canada has to mirror it in their legislation, or they will potentially have different monarch. Canada had to do this a couple of years back when the UK changed the how the crown was inherited (made the oldest child of the monarch inherit it, regardless of sex ... I think)

<comment><USER10> Thanks for the clarification! This stuff has always been confusing to me :)</comment></comment></comment></comment>


The Website Is Down (Hilarious 10 Minute Video) - <AUTHOR> http://www.thewebsiteisdown.com/ <comment><USER2> I saw this a few days ago and considered submitting it, then I thought, "No way the HN community would find this kosher."

Shows what I know :P

EDIT: kosher for submission to HN, not kosher in general.

<comment><USER3> Hey, if it's this funny, submit it!

<comment><USER4> Downmodded, but i have to explain. First, it's specifically mentioned in the guidelines that just funny news are strongly discouraged. Second, this is not reddit and i like it. I read both, but for very different reasons.

<comment><AUTHOR> Agreed.

2 reasons I "strayed" and posted this:

\- Humor that only an IT person can really appreciate

\- I laughed so hard at this, I just _had_ to share it with you guys.

I won't stray from the guidelines again unless it's _really_ that good. This one was.

<comment><USER4> Notice I didn't pick on you but on the sentiment that "all funny is good". The video is already a meme, and I wasn't surprised to see it here.

</comment></comment></comment></comment></comment><comment><USER5> I love all the subtle touches in the video, like the Monster.com page being up in the beginning.

Favorite part though: logging in to guy's Exchange account and deleting the message from the sent box. Brilliant.

<comment><USER6> I loved the idle "shoot the Halo guy in the crotch" part, I can't think of how often I've been idling in a game whilst talking to a noob repeatedly shooting a teammate in the crotch in CS:S

</comment></comment><comment><AUTHOR> May not be the best of hacker news, but don't drink and watch this at the same time unless you have a waterproof keyboard.

</comment><comment><USER7> The voices in this video are sort of annoying, they sound all pitched up. The one thing that is great how each party has different terminology for what restarting is and means. plus the desktop is pretty funny.

</comment><comment><USER8> <http://news.ycombinator.com/item?id=230838>

Same video, different site, submitted 2 days ago.

This is a funny video, but what's also funny is that it made the front page this time.

<comment><USER9> (1) less-known submitter; (2) linkjacked.

<comment><USER10> I agree. It's a think about trusting. If someone less known submitted this I'd have not clicked or continue watching the video after 1st minute because it's boring at the beggining.

</comment></comment></comment><comment><USER11> I thought this was Hacker _news_. This is, what, 4 days old? Ancient!

</sarcasm>

<comment><USER11> C'mon downmodders! I even included sarcasm tags! :-)

</comment></comment><comment><USER12> Perfect opportunity for TIPJOY to step in!

<comment><USER13> I already tipped it :)

<http://tipjoy.com/joy/28560/>

There is no reason a page should go down because of bandwidth limits. Just ask the readers/viewers to support the cost. One tip in 10,000 should suffice.

</comment></comment><comment><USER14> Spot on!

\- website = Internet \- sales guy humor vs admin guy terseness. \- deleting from exchange email love it

</comment><comment><USER15> There is so much wrong with this I don't know where to start.

Paralysis of options!

I mean seriously. If I were in charge of this company, I'd fire everyone, format all of the servers and start the company over. You just can't fix it when its that far gone!

<comment><USER12> its not real?

</comment></comment><comment><USER16> funny as hell... cracking up throughout.

</comment><comment><USER17> "How many programs do you have running?"

Dang, I sometimes have 2x that much going at once, and not all little stuff either. Like, 5 eclipse instances and Visual studio, 7 or 8 shells, 10 notepads, 3 or 4 mysql prompts, 2 remote desktops, FF, IE, IM, outlook, word, excel, not to mention 5 different dbms's running in the background. I guess I could top it off with Halo.

<comment><USER18> Your context-switching costs must be huge!

And no, I'm not talking about the computer.

</comment></comment><comment><USER19> GENIUS

</comment><comment><USER20> hmm, thewebsiteisdown.com is... down?! you don't say?!

i saw it on TC first, but its now on the main page of www.noob.us if you haven't seen it.</comment>


Show HN: 100% CSS control of Masonry Layout with left-right content flow - <AUTHOR> https://medium.com/@jessekorzan/masonry-layout-technique-react-demo-of-100-css-control-of-the-view-e4190fa4296 <comment><USER2> Where does go the 13th item?

<comment><AUTHOR> Bottom of the first column... the pattern keeps going as expected.</comment></comment>


Why MDA Is Like Waterfall Process And Is Doomed To Suffer The Same Fate - <AUTHOR> http://www.skorks.com/2009/07/why-mda-is-like-waterfall-process/ <comment><USER2> MDA will only fail if it's approached from a "the model must be complete" perspective. MDA isn't really a process and IMHO fits nicely with Agile processes.

<comment><AUTHOR> I disagree, even just coming from the perspective of agile practices (rather than agile ideals). I don't see how you would easily engage in test first development. Infact testing in general is a challenge. Same goes for refactoring, you can adjust the model, but what if you're trying to overcome other challenges, such as streamline to make your code more performant. MDA hides all of that away. It is true though that the more people centric agile practices are still valid (retros, stand ups etc.), but these would be valid in any situation.</comment></comment>


The tribesman who Facebook friended me - <AUTHOR> http://life.salon.com/2011/10/13/the_tribesman_who_facebook_friended_me/singleton/

<comment><USER3> > when they boarded the plane back to PNG, we were the ones racked with envy – > envious of their joyously interdependent community, their clear > understanding of what mattered in life, their rock-solid roles, simple > pleasures and ample leisure time, their lack of mortgages and debts, their > indisputable "goodness."

I call BS. This is not an honest appraisal but just a good line to spew forth at cocktail parties. Anyone who really believed this stuff would find it relatively easy to join one of these hunter gatherer tribes. (For instance, Napoleon Chagnon lived for decades amidst one of the fiercer tribes [1]. Read the first pages of his book and you'll see he wasn't much prepared for it, either. But a few iron utensils go a long way towards acquiring tribal goodwill.) Any relocation inconvenience would certainly be over-compensated by the very fundamental benefits described.

[1] <http://en.wikipedia.org/wiki/Napoleon_Chagnon>

<comment><USER4> I couldn't agree more. They don't have mortgages and debts, but my god, they put their life on risk every day. The homicide rates in New Guinea during 1960s to 1980s were really high.

</comment></comment><comment><USER5> For anyone who hasn't seen it, the documentary he talks about is mesmerizing:

<http://www.youtube.com/watch?v=AS7a-OJ7IVw>

Two standout scenes for me. First, gazing out from the London Eye over a skyline filled with incredible feats of engineering, the chief is bemused - because our money houses are so much bigger than our spirit houses.

Second, entering the main spirit house itself (St. Paul's cathedral) - <USER2> establishing that their women won't be struck dead for entering such a holy place - the tribespeople encounter, seemingly for the first time, the glories of neoclassical Western sculpture, art, architecture. They caress the faces carved from marble and stone, dance with pure delight between the soaring Corinthian columns. They explain how such impossibly beautiful things could only have been created by God, and have obviously been part of the world from the very beginning.

Ever since watching this series, I've tried to look at my city with the same combination of cynicism and amazement.

There's also a bittersweet segment where the chief of the tribe is dumbfounded that he's not allowed to drop in on the "big chief" - Queen Elizabeth II.

<comment><USER6> Thanks for the link. Amazing show.

</comment></comment><comment><USER7> The myth of the noble savage isn't dead yet, apparently.

Do you have two kids? Fancy both of them living to five? Right answer: you want to live in your world, not your history.

</comment><comment><USER8> What a delightful story!

I feel bad for the commenters that feel they need to step on it, just because it's a bit heavy on the "noble savage" meme here and there.

A culture very different from ours is always like a mirror. And it's much more virtuous to describe the difference in terms of what is good, than how _we_ are better. That doesn't mean you'd immediately want to switch places with them.

"If you like X so much, why don't you go live there?" is the reaction of a small-minded person that feels threatened just because something very different and alien to them is described as "also very beautiful".

I even see this reaction happening between two different Western cultures.

And yes, "we" also got quite a few really good things compared to them. More than just feathered arrows, even :-)

</comment><comment><USER9> Good story. Where did the tribesman log into facebook?

<comment><USER10> Internet access of some kind or another can be found almost everywhere in the world now. It might have been from a cell phone or a shared computer at some nearby town. The point is, I don't think it matters _where_ or _how_ any more. That's insignificant in light of the real sea-change, which is that almost anyone in the alive _can_.

<comment><USER11> i heard in some talk that feature phones account for the largest segment of status updates to facebook</comment></comment></comment>


Websockify – we beat Google's AMP, now what? - <AUTHOR> https://websockify.nl/ <comment><AUTHOR> Submitting because I can't decide if this person is a genius - or delusional.</comment>


Amazon Workers Are Listening to What You Tell Alexa - <AUTHOR> https://www.bloombergquint.com/business/is-anyone-listening-to-you-on-alexa-a-global-team-reviews-audio <comment><USER2> I was sure of this, some time ago. I often tell jokes or short stories, i hope it makes things a little less boring in Amazons keyboardmonkey cage

</comment><comment><USER3> discussion already exists here:

[https://news.ycombinator.com/item?id=19629513](https://news.ycombinator.com/item?id=19629513)</comment>


Android apps cost more than iOS apps - <AUTHOR> http://www.canalys.com/newsroom/android-apps-are-too-expensive <comment><USER2> I think this is misleading. Most of the apps in top paid for Android, are not the same apps as those on the Apple App Store.

Also, there's a higher percentage of free apps on Android than on iOS. I very much doubt that the average app on Android is more expensive than on iOS, especially if you count iPad apps, which are usually twice as expensive as normal iPhone apps.

<comment><AUTHOR> I was thinking about that too, and I recall a thread where someone said a good strategy is to release a paid app for iOS and an ad-supported free one for android. That said, top 100 best sold apps here and there being priced quite differently is quite interesting and counter-intuitive.

I wonder if perhaps it might be partly due to some nicely priced niche apps being better represented in (by definition more open) android market than in the iOS one. Not that I know of any or actually looked into it; plus, I doubt many such apps would get into the top 100.</comment></comment>


Chance discovery brings quantum computing with standard microchips a step closer - <AUTHOR> https://www.sciencemag.org/news/2020/03/chance-discovery-brings-quantum-computing-using-standard-microchips-step-closer?rss=1 <comment><USER2> Arxiv link: [https://arxiv.org/abs/1906.01086](https://arxiv.org/abs/1906.01086)

</comment><comment><USER3> quantum annealing?</comment>


FTC appoints Princeton computer scientist Felten as chief technologist - <AUTHOR> http://www.princeton.edu/main/news/archive/S28/88/79S34/

<comment><USER2> This is huge. Felten is the perfect candidate for this job and it will be extremely interesting to see how his presence influences the online privacy recommendations the FTC will be making soon.

<comment><USER3> Yep, Felten is a pretty legendary electronic freedom fighter: <http://en.wikipedia.org/wiki/Edward_Felten>

I must admit to being shocked at this sudden outbreak of common sense.

</comment></comment><comment><USER4> I totally met this guy on a cruise with my family two years ago. Had no idea who he was. He was a very cool guy.

</comment><comment><USER5> I hate to say I am most surprised by the fact that he took the job. He's a perfect candidate, but it's a lot to drop your existing work and take on a responsibility like this. It was great to see he stepped up to do it. I hope he finds it fulfilling and can effect change.

</comment><comment><USER6> I would have liked to see him at FCC. Nevertheless a welcome change in appointments.

</comment><comment><USER7> The government made a smart and forward-thinking decision? Do not believe!</comment>


Show HN: Not an original idea, but was good practice. Built it in about 5 weeks. - <AUTHOR> http://iwastesomuchmoney.com

<comment><USER2> Surely this is nothing more than an advert for an amazon (and other) affiliate site? Saying "not an original idea" doesn't give carte blanche to basically spam a site.

<comment><AUTHOR> Amazon and Thinkgeek are the only two affiliates we work with. I look for stuff all over the internet, Etsy, etc.

How is it any different than any other block that curates content and advertises with affiliates or direct sponsors?

In other news, I got a lot of practice making categorized content which will come in handy for my other projects. I learned a lot about Modified Preorder Tree Traversal in MySQL, which is pretty neat. Sorry to offend, I was excited about building something fun. Have you built anything lately, even just to learn something new?

</comment></comment><comment><USER3> I think your Google ads could be deemed wrongful. They are blended into the content with your social network thingies underneath. An ad is supposed to clearly be an ad. You are going against that in two ways and I don't think it serves you, Google, the advertisers, the social networking thingies or the random site visitor to do it like that.

<comment><AUTHOR> that's a good point. other similar sites seem to all have a huge "ADVERTISEMENT" text above the ad. will look in to that.</comment></comment>


Ask HN: Paypal vs. Google Checkout vs. Amazon FPS vs. other - <AUTHOR>

I'm looking for payment processor for subscriptions. Does anyone have any experience with these services?
It seems like all these services have similar offering, but devil is in details. So I would like to hear some opinions and experinece. <comment><USER2> Paypal is simpler in terms of implementation and simplicity. Also you could try spreedly, they have a wrappers to help you.

</comment><comment><USER3> I know that kickstarter uses Amazon FPS because it alone allows them to perform their all-or-nothing funding process.</comment>


Apple and Volkswagen team up on iBeetle, but it's no iCar - <AUTHOR> http://www.theverge.com/2013/4/22/4251656/ibeetle-is-volkswagens-apple-icar

<comment><USER2> Well that's a bit underwhelming</comment>


Ask HN: Shouldn't this HN post be ranked higher? - <AUTHOR> http://imgur.com/eFf6YAQ

<comment><AUTHOR> The post has:

\- More points

\- More comments

\- Is more recent

Only it has been posted by a "newbie"... Should this really create that much of a difference in posts? (i understand a difference in comments, but in posts it's just link sharing). If it's something the community likes, they will respond and upvote it...

When Patio11 responds in a comment though, everyone likes to see him on top (he does have good comments ... )

<comment><USER2> Well, this is one "newbie", but not all "newbies" are the same. I also think it depends on the time span during which a post gathers upovotes and comments. You can't derive the position of a post based on points, comments and actuality of a post.

I think some things changes since pg posted the algorithm [0], but I can't find anything. Also make sure to check Google for "Hackernews ranking algorithm". [1] [2] [3]

[0] [https://news.ycombinator.com/item?id=231209](https://news.ycombinator.com/item?id=231209)

[1] [https://news.ycombinator.com/item?id=1781013](https://news.ycombinator.com/item?id=1781013)

[2] [http://www.righto.com/2013/11/how-hacker-news-ranking- really...](http://www.righto.com/2013/11/how-hacker-news-ranking-really- works.html)

[3] [http://www.quora.com/Whats-Hacker-News-ranking- algorithm](http://www.quora.com/Whats-Hacker-News-ranking-algorithm)

<comment><AUTHOR> I do think that the post should be higher then the ones before it... Looking at the raw metadata, it's more relevant and more recent. The whole point of the popular section is seeing more popular and recent news that you could have missed out.

The chance you missed out an article from 1 day ago is higher then one of 2 days ago. The chance you like it, is bigger if it has 90 votes then 50 votes. So there is no reason at all for putting it lower.

PS. I recreated HN for a client (it included tags and custom input fields), so i do know what HN is in the core.. I do not know the algorithm specifics though, but neither does Google :)</comment></comment></comment>


Automated Landscape Painting in the Style of Bob Ross [pdf] - <AUTHOR> https://uwspace.uwaterloo.ca/bitstream/handle/10012/2761/AlexKalaidjianThesis.pdf <comment><USER2> Inevitably, this would have happened sooner or later with Bob Ross.

He keeps popping up again and again, here and there, to the dismay of so many snobby art critics who have for so long dismissed his work and his TV shows on PBS. My favorite example of him unexpectedly popping up in popular culture is probably [https://www.youtube.com/watch?v=8-Cjsnq8kVU](https://www.youtube.com/watch?v=8-Cjsnq8kVU)</comment>


From the Facebook Blog - <AUTHOR> http://blog.facebook.com/blog.php?post=13245367130 <comment><USER2> Interesting -- sounds like facebook is taking cues from friendfeed.

Suggestion - make the subject on posts like this more specific to what is in the content, e.g. Facebook Minifeed adds better import feature.

</comment><comment><AUTHOR> Gotta love that first line: "Chances are, you use parts of the Internet that aren't Facebook"</comment>


Employees of kixeye accused of racist remarks fired - <AUTHOR> http://www.develop-online.net/news/42157/Four-Kixeye-employees-sacked-for-racism?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+developmag%2Fifbh+%28Develop%29 <comment><USER2> > While many in San Francisco have begun to use the term "post racist" as a > matter-fact-statement to describe the relatively inclusive work environment, > the difference between the mostly affluent white community on the peninsula > and the impoverished Oakland across the bay is impossible to miss.

What? Who says that? The only time I've heard the phrase "post racist" is either The Colbert Report, or people being sarcastic in reference to something really racist. It's because of places like Oakland that no one I know in San Francisco believes on any level we live in a "post racial America".

That little sentence is really offensive to me and hopefully others who are aware of the severe and drastic gender and racial inequalities in the tech industry.

Until I see ~10% of tech workforces being African American, I'm not even going to begin to think about "post racial" anything.

<comment><USER3> People think they are "post-racial" if they do not regularly use slurs and/or do not self-identify as racist and/or have friends or coworkers who are not white. Of course, when it comes down to it, very few people self-identify as racist, making this definition not particularly useful.

BUT it is a heck of a lot easier to paper over more subtle forms of racism by identifying racism as only the most outlandish kind, and the rest as someone being too sensitive or what have you.

A good rule of thumb is that everyone is at least a little bit racist. It's less of a problem if you're willing to admit it and work at it, but by suggesting that we are post-racial (we have a black president, therefore racism is over), white people let themselves off the hook from having to think much about race most of the time.

</comment></comment><comment><USER4> <http://www.twitlonger.com/show/jh72ja>

_What are we doing to make sure this never happens again in the future? Well, even before this incident, we hired a VP of HR who has implemented a sensitivity training program for all employees._

Which was evidently ineffective.

<comment><USER5> The point of such training is to make it less legally risky to fire people for being insensitive.

Looks like it was effective.

<comment><USER6> Stupid question: It's already illegal to discriminate and harass on the basis of race. Why do you need a training program to make it less risky to fire people over it?

<comment><USER7> I think it's less risky because it sends a clear signal to employees that if they're fired for being racist assholes, they don't have any real grounds for to sue for unlawful termination.

Even groundless unlawful termination lawsuits are a pain in the ass to deal with. It's better to discourage them than to litigate them.

<comment><USER6> If they're crass enough to sue for unlawful termination after being racist, what makes you think 'sensitivity training' will make them not sue?

(I'm not trying to be snarky, BTW, just trying to understand hiring law, and bad employees)

<comment><USER5> The training makes company policy crystal clear and makes it very difficult for any employee to later claim they were unaware of said policy.

</comment></comment></comment></comment></comment></comment><comment><USER8> This isn't racism. This is bullying, using, amongst many other things, marginally racist remarks as a weapon. That kind of stuff is as much racism as tasteless jokes about wife-beating constitute actual domestic violence.

This is clearly a very disfunctional and unhealthy work environment, but with the aggressively paranoid reaction to it is equally unhealthy and most of all, fails to address the actual problem. After firing the "racists", this is likely to remain a toxic environment who's next "victim" could very well be a white heterosexual male who for some other reason forms an easy target.

<comment><USER7> While I don't agree with your "this isn't real racism" premise, I agree that the dysfunctions probably run deeper than that.

I'm reminded of Bob Sutton's great book "The No Asshole Rule". The actions outlined in the blog post are undeniably asshole behaviors, and shouldn't be tolerated in any civilized workplace, with our without the racial implications.

<comment><USER9> Thanks for the reference to Bob Sutton. I hadn't heard of his book before, and after some research I dug up some great info and articles.

<http://bobsutton.typepad.com/my_weblog/the_no_asshole_rule/> [http://blogs.hbr.org/sutton/2007/03/why_i_wrote_the_no_assho...](http://blogs.hbr.org/sutton/2007/03/why_i_wrote_the_no_asshole_rule.html) [http://www.huffingtonpost.com/robert-sutton/the-no- asshole-r...](http://www.huffingtonpost.com/robert-sutton/the-no-asshole-rule- part-_b_49678.html)

The Kixeye CEO may have not intended to let things go this far, but from his remarks ( part 1: <http://www.twitlonger.com/show/jgntgj>, part 2: <http://www.twitlonger.com/show/jh72ja> ) he shows a stunning lack of empathy. One big red flag for me was how he doesn't say how he is planning to make amends with the black contractor and the black community. So it's pretty clear to me that Will Harbin is part of the problem here, and likely is an asshole himself. The company's investors and leaders should take this as a wake-up call and either demote or fire him. They won't reach their potential with 'asshole leadership' in place.

A fish rots from the head down.

</comment></comment></comment><comment><USER10> I cant help but feel that this qu33riousity guys is coocoo. While I think that what he was subjected to is unacceptable, his rhetoric reminds me of conspiracy nutcases that said that US government played a role in the WTC tragedy:

"And it's not a matter of generalizing white people, rather it's being real about the culture San Francisco creates. Other people of color, including some black people are in on it too, but the thing to remember is that there have always been people of color down with white supremacy. Matters of colonization run deep throughout the years and beneath our flesh, behind our eyes."

<comment><USER11> It's sad but true that some members of a minority always find that it's in their personal best interest to be the "good" exemplar of a minority in the opinion of the majority. Think about women who enforce the patriarchy as so that they can be metaphorically patted on the head by men (Phyllis Schafly, Ann Coulter). It's extremely common.

<comment><USER12> Do you mean the Feminist meaning of patriarchy?(from wikipedia) ""The patriarchal construction of the difference between masculinity and femininity is the political difference between freedom and subjection."[27] In feminist theory the concept of patriarchy often includes all the social mechanisms that reproduce and exert male dominance over women."

Patriarchy Feminist theory basically mean women are victims, man have power over woman and are conspiring (conscious or unconscious) oppressors. It is a very toxic and sexist theory, it ignores mens issues and it's also an Apex fallacy. Just because the majority of people at the top are male it does not mean they represent the majority of man. Did you know that in USA women hold the majority of the vote?

However I agree that people should not be forced in to gender roles and maybe that is what you meant when you wrote Patriarchy.

>metaphorically patted on the head by men

The majority of men (including traditionalists) don't treat women like dogs. Traditionalist men even believe in sacrificing their lives to save womens lives. A lot of modern men also believe in that sacrifice.

<comment><USER13> > Traditionalist men even believe in sacrificing their lives to save womens > lives. A lot of modern men also believe in that sacrifice.

No, they really don't. Or rather they may say they do, but when it comes it, then they don't. See the recent study of ship evacuations for proof, it's women and children last.

</comment></comment></comment></comment><comment><USER14> "We don't even tolerate people brining up concerns of racism here."

Wow. I assume that somewhere along the line, that guy misunderstood 'zero tolerance of racism'.

<comment><USER15> Nope, but you don't want topics where the conversation can get heated like politics or racism.

<comment><USER14> I'm confused: are you the guy being quoted?

</comment></comment></comment><comment><USER16> I'm one of the people who posted on the previous thread that didn't agree with the tone/method of the original blog post. Not that it matters in the slightest what I think. However, I'm glad it turned out this way.

<comment><USER17> I did not like it either. I thought it was laid with racist overtones and stereotypes. I also thought that it is peculiar that someone would choose to introduce themselves as a "poor black queer" instead of bringing forth their personality or skills or ideas.

Newsflash: if you are interesting or do cool stuff I don't give a fuck about your skin tone or sexual preference.

<comment><USER7> _I don't give a fuck about your skin tone or sexual preference_

Just a friendly heads-up, the phrase "sexual preference" is like fingernails on a chalkboard to a lot of people, as the word "preference" implies choice which isn't in line with our best understanding of how sexual orientation works.

I'm not offended, but I'm guessing you don't want to accidentally offend people. After all, you don't give a fuck.

<comment><USER18> I consider myself fairly progressive about these kinds of things, and this is the first I've heard about "sexual preference" being problematic. Is it really used to justify the belief that what gender(s) you're attracted to is a choice? What term should we use instead?

<comment><USER7> I believe that "sexual orientation" is favored. The parallel I like to use is being right-handed or left-handed. It's not that lefties "prefer" to use their left hand for tasks requiring dexterity, they are oriented that way.

</comment></comment></comment></comment></comment><comment><USER19> This was a very disturbing incident, and I can only hope that it was an isolated incident and not indicative of a larger trend in the startup industry. The demographics are skewed enough as it is when it comes to this industry.

<comment><USER20> I don't feel that this is a recurring issue in the startup industry. However based on my past work experience, this is definitely not an isolated incident for the video game industry. The only difference between different companies is how they handle it when it arises.

I do remember when working at one of the big three video game publishers:

1) HR and managers would repeatedly educate both new workers and existing employees on both racial discrimination and sexual harassment on a semi- quarterly basis.

2) HR would give anonymous surveys regarding workplace environment every quarter.

Regarding the last item, at my last stint at a gaming company; a co-worker reported a case of racial discrimination and it was handled promptly and professionally. There was no time for anyone to blog about the subject. I'm going to agree with other people, HR wasn't doing their job effectively.

<comment><USER3> How often and how likely are you, yourself, likely to be a target of racist language? And how keyed into the more subtle forms of racism are you? I mean these as serious questions, not rhetorically.

The thing is, you have to be really careful about selection bias and confirmation bias, here. This example happened to be one of the most egregious examples, the easiest to spot. A lot of the more subtle cues will fly right over your head, especially since a lot of behavior with racist over- or undertones is not something white people are exposed to or experience. (I include myself in this statement.)

Granted, I am assuming you are white, chiefly based on the demographics of HN and the tech community in general.

<comment><USER20> > How often and how likely are you, yourself, likely to be a target of racist > language?

I'm not white, but I'm still extremely not likely to be a target of racist language. In most tech offices, they try to do a good job to avoid unnecessary lawsuits that can cost in the millions. I also feel that tech offices tend to have more educated people on a whole, which massively helps.

> And how keyed into the more subtle forms of racism are you?

I'm aware. "subtle cues" do not "fly right over" my head

<comment><USER3> > I'm aware. "subtle cues" do not "fly right over" my head

Fair enough. On the basis of the previous threads on this topic, it seems to me, at least, that most HNers who bothered to comment didn't or don't get it.

</comment></comment></comment></comment></comment><comment><USER21> It is quite clear that this was not an inclusive working environment. Some of the comments on their own are not overtly racist, but it is certainly walking thin line.

I've had a situation that was sort of similar where a co-worker made a comment on my clothing being too uhm, urban. Jeans, oversized hoodie (hood up), and shit kicker boots. I was sick, and it was freezing out walked into a meeting and it was announced that Eminem just walked into the meeting. My reply was (paraphrased) that "Is that the only white rapper you know, I don't look anything like Eminem". I guess I was looking for something like Sage Francis or Necro, but I digress. I felt singled out for the way that I dress. Now I guess that anyone can debate here if what I said or the initial comment was racist, but I would say that it wasn't, just ignorant and stupid. That said, if that comment was slanted ever so slightly to the fact that I have some Jewish heritage, it would trigger a soft spot and would have REALLY irked me. Had some issues with that early in life.

So considering the more over-the-top racist comments, and initial reaction of management when confronted, this whole situation is really awful and should not happen. Instead of debating if this is really racism, we should probably just try to limit and control it's effect on our lives. It exists, it's all around us and you don't have to look very far, even in tech companies.

<comment><USER22> > I've had a situation that was sort of similar where a co-worker made a > comment on my clothing being too uhm, urban.

That's not the same thing at all. The guy in question was accused of dressing too "thuggish" when he was wearing skinny jeans and wingtips. In other words, because he was black, regardless of what he was wearing.

A joke was made about how you were dressed because you had a hoodie with the hood up and are apparently white... like Eminem[1][2][3][4].

[1] [http://cdn.preview.thumbplay.com/VAN/Thumb_Preview/Wall/UMG/...](http://cdn.preview.thumbplay.com/VAN/Thumb_Preview/Wall/UMG/Eminem.Eminem_Hoodie_2-00602498893142-800x800.jpg)

[2] [http://images.hitfix.com/photos/703638/eminem- hoodie_article...](http://images.hitfix.com/photos/703638/eminem- hoodie_article_story_main.jpg)

[3] [http://www4.pictures.gi.stylebistro.com/Eminem+Tops+Hoodie+0...](http://www4.pictures.gi.stylebistro.com/Eminem+Tops+Hoodie+0SBZ914m06Bx.jpg)

[4] [http://inthehoodie.com/blog/wp- content/uploads/2009/06/emine...](http://inthehoodie.com/blog/wp- content/uploads/2009/06/eminem.jpg)

<comment><USER21> Uhm, those comments were not connected in the story, it was wingtips provoking the RUN DMC comment. Baggy jeans and thuggish were connected in the story, which does make some modicum of sense. If anything I would say that the skinny/wingtip == RUN DMC comment was more worrisome because it is completely out there.

Lots of rappers wear hoodies. My point wasn't that anything there was racist, just that you do get comments for dressing differently, not fitting in. Those alone don't make this racist, the other comments do.

So is it that baggy jeans are less professional looking, or a racially motivated attack on urban lifestyle and dress. It doesn't matter really, the rest of the comments provide enough of a backdrop for us to make our own conclusions, which is all this is.

</comment></comment></comment><comment><USER23> Not surprised that a hiring campaign like the one they ran would lead to hiring of childish people.

</comment><comment><USER24> This is a common response in dysfunctional workplaces.

A problem comes up, identify some scapegoats, fire them, put out a PR statement.

Whether or not this is meaningful won't be obvious for some time. But at most dysfunctional workplaces the problems go deeper than the scapegoats fired, and problems persist. With an overlay of, "You got my friend fired!"

<comment><USER22> Scapegoats or not, I bet the remaining employees are more careful about the things they say from now on.

</comment></comment><comment><USER25> Racism or Bullying - either way props to the boss for firing 4 people over it. If you leave that unchecked, it destroys a corporate culture.

</comment><comment><USER26> Everyone is trying his best to be PC, but the real takeaway is that you have to be careful not to hire some ultra-sensitive pantywaist thug who publicly cries "racist" at every shitty joke, giving your company weeks of terrible PR to clean up.

 _"Hey he's dressed like Run DMC, does he know how to rap?"_

Oh, the poor darling. Let's ruin a bunch of people's livelihoods over this apparently wicked comment.

<comment><USER27> you sound racist

<comment><USER28> He sounds angry and a bit OTT to me. Inferring that someone is a racist (as you're doing) is extremely serious. Your remark comes across as a bit creepy actually

<comment><USER29> First, no one inferred that he _was_ racist, they said what he had said sounded racist. Second, why do you think it's "extremely serious" to consider something someone said racist? I consider racism itself extremely serious, but there's no consequence for expressing racism in a quasi-anonymous comment environment. There's not even any consequence for being called a racist. I am utterly confused as to how saying that racist statements sound racist could be "extremely serious", in that we should refrain from doing so. What consequences do you expect to follow?

Actually being a racist? Bad. Pointing out that something sounded racist? An opportunity for the person who said that to apologize and reframe or withdraw, perhaps leading to a less racist environment.

<comment><USER30> You're missing the point. It's unavoidable that if you say "you sound racist" that that attributes a trait to the person rather than their behavior, and is not much different than saying "you are a racist." The rule of thumb is address the behavior rather than the person, which is why the corrective response is supposed to be something like "wow, what you said sounded racist" It's a subtle but important difference. Then you are inviting the person to ask themself internally "did I mean what I said?" or "do I want to sound racist to other people?" instead of going on the defensive because they as a person are being labelled a cultural undesirable. If you make a statement about the person themself there's no avenue forward for discussion or correction, you just made an enemy. But if you make it about the speech, even if they get defensive about it you can clarify that you are addressing the behavior.

There are consequences here because there is username, user identities are often shared across sites, and there is a karma system here. They may be mild, but obviously karma is consequential or it wouldn't exist as a concept on the site. Your score is your aggregate reputation among other users. People fear saying things that will lower their karma.</comment></comment></comment></comment></comment>


Video Decode Acceleration framework available on Mac OS X 10.6.3 - <AUTHOR> http://developer.apple.com/mac/library/technotes/tn2010/tn2267.html <comment><USER2> Is this what Adobe was complaining wasn't available & their excuse for why flash video on the mac sucks?

<comment><USER3> According to <http://en.wikipedia.org/wiki/DirectX_Video_Acceleration>, Flash did not use DXVA (hardware-accelerated video playback) until 10.1. Video being the complicated beast that it is, there are probably many reasons why Mac flash performance was inferior to Windows flash.

<comment><AUTHOR> And Flash 10.1 won't be shipped for at least another six months. The beta release with DXVA was only released in November.

</comment></comment></comment><comment><USER4> I find it interesting that they don't support any of the video cards in the Mac Pro (GT 120) or high end iMacs (ATI Radeon). I guess it will make the biggest difference with battery life in the laptop line so they're not concerned with the desktops. Still somewhat disappointing.

</comment><comment><USER5> Some honest questions:

Does the caller of this API need a patent license to do so? Does the patent license of H.264 cover decoding of the format through OS APIs, or does each caller need its own license?

<comment><USER6> Of course you don't. That would be like having to get your own patent license to use iTunes.

Although you do actually need a license to use the QuickTime AAC encoder in your own program, but only on Windows. Or so I remember from mailing list traffic, haven't tried it myself.

<comment><USER7> Yes you will need it, not for using quicktime, but this is a low level API where you will implement a lot of patent stuff yourself.

<comment><USER6> Oh, I forgot this reply existed.

It isn't. An example of an API that does would be XvMC, which requires parsing and doing large parts of the video decode yourself.

The most you'd have to to use this framework is parse a .mp4 file yourself. Such things are not patented.</comment></comment></comment></comment>


The sky over Victor V. Prison on Feb 11 1990 as Nelson Mandela was relased - <AUTHOR> http://greaterskies.com/gallery.html

<comment><USER2> How this is relevant ?</comment>


The new kings of YouTube botting - <AUTHOR> http://kernelmag.dailydot.com/issue-sections/headline-story/15007/cheap-youtube-views/ <comment><USER2> The map of where the views come from is expected (Russia, India, South East Asia).

The bit that I find most interesting is: > Vass says that he keeps 500views.com running by paying a monthly retainer to "a number of high-traffic websites to have them run hidden scripts." >"The script contains the YouTube link we need to increase views on..."

Looking at the map, you have to assume that the high-traffic websites are specific to those regions. Otherwise you would expect IP addresses from other countries to show up more often

Is there a (relatively) easy way of scraping for these malicious tags to create a catalog of what websites are hosting the malicious code?

You could pay for the view boost service. Scrape the top 5,000 sites in those regions of the world and hope your bot gets roped into being part of the botnet (as you could identify the video you paid to boost). Just an idea.

<comment><USER3> >Is there a (relatively) easy way of scraping for these malicious tags to create a catalog of what websites are hosting the malicious code?

Better yet people do it for you. If you are running uBLOCK for FireFox, go into its 3rd party filters to enable most Ad/Spamware/Analytic networks depending on the filters you enabled.

</comment></comment><comment><USER4> Buying fake traffic removes the first hurdle. People are social, and instinctively don't trust something that has not been endorsed. It's like walking by an empty restaurant - you assume the food must be bad.

But it doesn't get you past the second hurdle. If you have bad content, no-one is going to share it. Which means zero percent growth. Zero percent growth on top of half a million paid-for views is still zero real visitors.

If you have good content and can ethically reconcile buying traffic, I guess this tactic could work. But if you can't, you need a network of people to help publicise your launch.

<comment><USER5> While I'm very aware of the social factor, I still use that heuristic. For example when deciding what software package to install, I heavily base my decision on amount of contributors and monthly downloads! (witch could be easily faked).

Startup idea: Make a trusted, corruption free review site, with employed reviewers.

</comment></comment><comment><USER6> My experience is that buying likes, views, installs, etc. works for niche products that need to rise in rankings. You rise a few spots, then organic kicks in, and you have just the edge needed to take over the competition.

<comment><USER7> Edge, how so? Is the idea to catch competitors with their "marketing -> marketshare" guard down?

<comment><USER6> Let's say you find some hyper-specific niche, like calculators for some obscure section of the American tax code. Very, very useful for a small amount of people. So you throw together an app in less than a day and put it on the app store.

The market is so small, that there really isn't room for more than 1 app, and it's so specific, people aren't going to really bother searching around. So being the first or second app they see when they search "section XYZ tax calculator" is critical to getting any installs.

As the app stores algorithms for thinly installed apps basically come to down to total installs, followed by rating, followed by recent updates, paying $5 on fiver for a hundred installs can really make a difference. Once you rise enough, people start finding you organically, they install, you rise higher, and it becomes a feedback loop.

This is a contrived example, but if you can make apps and want to sling ads as a way to earn money on the side, it can really help.

</comment></comment></comment><comment><USER8> This is why I'd rather be a Google(YouTube) than facebook or twitter. Imagine all the fake accounts, likes, bots, unknown spam that are giving us the next geocities.

It's simply cheapens everything about social media in general.

<comment><USER9> What is the difference between buying fake views/accounts/friends etc. or backlinking and other SEO 'tricks'? Unfortunately for them, both companies have to curate their product. For a google example, see the Rap Genius issue from awhile back: [http://genius.com/Genius-founders-rap-genius-is-back-on- goog...](http://genius.com/Genius-founders-rap-genius-is-back-on-google- annotated)</comment></comment>


Cops Told 'Don't Look' at New iPhones to Avoid Face ID Lock-Out - <AUTHOR> https://motherboard.vice.com/en_us/article/5984jq/cops-dont-look-iphonex-face-id-unlock-elcomsoft <comment><USER2> Easy to circumvent using an app which recognizes signs the phone owner might be sending with his face when the phone is put in front of him, just like if someone says something while blinking an eye. Ok, blinking eyes are easy to notice but I can for example dilate very easily my nostrils or fake strabismus, two gestures which would be next to unnoticeable to a human not paying close attention, but what about a vision algorithm "sniffing" the camera data flow and acting if one sign, all of them or both in a given order are performed?

</comment><comment><USER3> FaceID should have a lock-out gesture or face, so that if someone coerces you into unlocking the phone with your face, you can use a preprogrammed gesture to disable FaceID until the passcode is entered.

</comment><comment><USER4> Tip: to lock out Face ID and require passcode to unlock, you can hold the power + either volume button.</comment>


How Doom got ported to NeXTSTEP (2013) - <AUTHOR> http://blog.wilshipley.com/2013/12/my-doom-20th-anniversary-stories.html

<comment><USER2> I thought Doom was developed on NextSTEP, at least wikipedia says so

[https://en.wikipedia.org/wiki/Development_of_Doom](https://en.wikipedia.org/wiki/Development_of_Doom)

"We wrote all of DOOM and Quake's code on NeXTSTEP"

[http://web.archive.org/web/20140310124554/http://rome.ro/200...](http://web.archive.org/web/20140310124554/http://rome.ro/2006/12/apple- next-merger-birthday.html)

<comment><USER3> The author notes this in the post. _I wrote Carmack a message which apparently had the subject line "Doom diddly doom!" and said something like, hey, since you wrote this game on NEXTSTEP but don't want to waste your time tuning it up for that platform (it kind of ran in a pseudo-PC-emulation layer) can Omni do it for you and release it for free?_

</comment></comment><comment><USER4> Let's not forget the port of Doom to the Atari Falcon either...

<comment><AUTHOR> ...and irix at the other end of the spectrum.

<comment><USER5> Had the joy of running Irix DOOM on a 16-processor Onyx which was, for the time, _amazing_. Over 180 FPS for software-rendered 3D stretched over 3 monitors was just glorious.

</comment></comment></comment><comment><USER6> Great read. I love to read anything about Carmack, it just blows my mind that he re-wrote all his engines from scratch. I can't even fathom developing at that level.

<comment><USER7> Yeah, every time I read something he's written, or written about him, it's a good read. I've always considered myself good at understanding how systems work together, mainly with web applications from front (html/css/js) to back (http/app/services/sql), but Carmack does that with very low level/detailed applications... It's hard for me to imagine.

<comment><USER8> He is a great coder, but that is how we used to develop software before the web, you really needed to understand everything, specially the hardware.

<comment><USER9> In absolute terms I think there are more people than ever programming this way today. Just doesn't feel that way because there are even more people doing stuff differently.

</comment></comment></comment></comment><comment><USER10> NeXTSTEP was so ahead of its time. I wrote many sets of documentation (yes the printed kind) on my pizza box using FrameMaker. Best writing experience to this day.</comment>


Breaking LastPass: Instant Unlock of the Password Vault - <AUTHOR> https://blog.elcomsoft.com/2020/04/breaking-lastpass-instant-unlock-of-the-password-vault/ <comment><USER2> The short version: LastPass doesn't use the login keyring to save the master password when it's saved opting to instead store it in a local file.

I think it's funny that these things are considered vulns since I can't even count the number of random dev tools (hello awscli that needs a 3rd party wrapper to use the keyring) that need password and keys just lying around in plaintext files.

Filevault, Bitlocker, and LUKS are the only real defense against this sort of thing since once you hijack a logged in session the best you can do is make attacks harder, not actually stop them.

<comment><USER3> As far as I understand, Apple's Keychain lets you save passwords and then grant access to them on per-application basis, instead of leaving them lying in text files for any program to read. Could anybody confirm that? I've never had a Mac, but I've been thinking about this issue for quite some time.

(EDIT: TFA doesn't clarify that.)

</comment></comment><comment><USER4> Only exploitable on Windows, using the Chrome app, if you save your password. Attacker needs file system access.

<comment><USER5> My understanding is that this is exploitable on any machine using the extension (so Chrome or any other Chromium based browsers) regardless of operating system.

<comment><USER6> I don't understand how their "magic cracking tool" manages to crack AES256 "in a few seconds" regardless of the length of the password. Poorly written article. The PDF they link to is more interesting.

From their website:

"Reveal Stored Internet Passwords

Elcomsoft Internet Password Breaker instantly reveals Internet passwords, retrieves login and password information protecting a variety of Web resources and mailboxes in various email clients. The tool instantly extracts passwords, stored forms and AutoComplete information in popular Web browsers, and captures mailbox and identity passwords from popular email clients."

...instantly?

</comment></comment></comment><comment><USER7> I bailed from it when it was acquired by a PE But still good to know it's insecure with proof!

</comment><comment> anon-kun Who would have thought that saving all your passwords in a Browser (Extension) is a bad idea...

<comment><USER8> Who would have thought, that if you let your software to remember your password and use it automatically, it must store it somewhere?

The criticism of not using the Windows API for storing secrets is valid, though, but it still does not help if you, and the malware you run, are logged in.</comment></comment>


Microsoft Launches Xbox One SDK - <AUTHOR> http://www.theverge.com/2015/3/4/8149315/microsoft-xbox-one-apps-sdk-developers

<comment><USER2> So essentially Microsoft is democratizing access to a gaming console for indie developers? Hopefully the offerings produced from this will surpass the quality of those from the overly-hyped Ouya console.</comment>


All the things I hate about Python - <AUTHOR> https://medium.com/@natemurthy/all-the-things-i-hate-about-python-5c5ff5fda95e <comment><USER2> At the end of the article he says:

> Eventually the forces of entropy will take their toll; and depending on the > circumstances, the business outcome will either be frustrated or happy > people — be they developers or customers.

This must be a mistaken attempt to be even-handed. The "forces of entropy" he mentions usual overpower circumstances and rarely result in either happy developers or customers.</comment>


MIT asserts "no wrongdoing" in Aaron Swartz case - <AUTHOR> http://gigaom.com/2013/07/30/mit-asserts-no-wrongdoing-in-aaron-swartz-case/

<comment><USER2> If they are trying to say that they did nothing illegal, I have nothing to say. However, their being "prudent" while "not duly take into account the wider background" suggests that their action (or lack thereof) was partially responsible for this tragedy.

Their adopting a "position of neutrality" over the case makes them a silent accomplice to the corrupt and power-drunk prosecution.</comment>


Incorporating, Clerky or another service? - <AUTHOR>

Hi all, wanted to get some advice here before I jump the gun. I'm looking to incorporate, after research decided to go for C-Corp in Delaware. I'm down to two services; YC backed Clerky or Harvard Business Services (delawareinc.com).<p>If you guys have used such services yourself, which did you use? And how was your experience? Pricewise delawareinc.com is $229 whereas Clerky is $381 and both essentially offer the same service. I'm leaning towards delawareinc.com but wanted to get some feedback from you guys. Thanks. <comment><USER2> Clerky cofounder here - one important thing to note is that incorporation is only the first step in company formation. There's a bunch of other paperwork that's needed to issue stock properly and appoint directors and officers. We wrap that into our post-incorporation setup template, and make it easy to get through. Feel free to shoot us an email at support if you have any questions!

<comment><AUTHOR> Thanks, I ended up going with Clerky for the simplified process.

</comment></comment><comment><USER3> I used Nolo Press' How to Form a California Corporation. The book was $40.00, the name reservation was $15.00, the incorporation (that I handled myself) was $100.00.

However, if you don't know what you're doing it's probably a good idea to use a service.

Be careful to get your taxes right - the book Inc. Yourself simply does not discuss taxation. That led to some trouble for me.

<comment><AUTHOR> Thanks. I absolutely do need to do more research but due to time constraints wanted to go the service route. Thanks for the heads up on the taxes, will get in touch with tax contacts when filing.

<comment><USER3> If you have employees - or if it's just you, but you pay yourself as an employee - you need to file the US Federal 940 once per quarter, and the 1120, 941 and W3 once per year, as well as the state equivalents of each.

You owe 940 taxes (payroll withholding) by the 15th of any month during which you have issued a payroll, or two days after the payroll if you owe $200,000.00 or more.

The states and feds are especially strict about the 940, as failure to pay it is regarded as stealing from your own employees - even, as was the case for me, you are the only employee.

<comment><AUTHOR> Wow thanks a lot for this! I'm researching more into it but this overview helps a ton</comment></comment></comment></comment>


Ask YC: Who would you pay to read? - <AUTHOR> Along the same lines as yesterday's discussion, whose writing would you pay to read?  Keep in mind that for high quality, sporadic writers, payment might mean more frequent writing.
Here's my list (going alphabetically through my Google Reader list:
Definitely:
- Steve McConnell's stuff is always backed by research and therefore much more valuable than most thoughts or ideas ( http://blogs.construx.com/blogs/stevemcc/rss.aspx )
- Dan Weinreb is rational, thorough, a bit of a legend in my niche, and I'm a bit of an ITA fanboy ( http://dlweinreb.wordpress.com/feed/ )
- Bill Simmons (sports writer) is hilarious and my only remaining connection to sports spectatorship ( http://sports.espn.go.com/keyword/feed?query=Bill_Simmons )
- pg ( 	 http://feeds.feedburner.com/PaulGrahamUnofficialRssFeed )
- yegge is funny, and pay-per-post would be a bargain! (	 http://steve-yegge.blogspot.com/feeds/posts/default )
Maybe/Conditional: - pmarca if he would stay on topic ( http://feeds.feedburner.com/pmarca )
- defmacro if it caused more documentation and features to be written for weblocks ( 	 http://www.defmacro.org/rss/news.xml )
- Ted Neward is new to me but climbing the charts (http://blogs.tedneward.com/SyndicationService.asmx/GetAtom )
- Jeff Moser is coming on strong ( http://feeds.feedburner.com/Moserware )
- Kevin Kelley is on the bubble ( http://feeds.feedburner.com/thetechnium )
Based on previous writing more so than current:
- raganwald from a couple years ago - the Ruby stuff means less to me than his older topics ( 	 http://feeds.raganwald.com/raganwald )
- Joel a couple years ago, not Joel now (	 http://www.joelonsoftware.com/rss.xml )
That's 12 out of 172.  5 were conditional and 2 would be mainly to access archives.  So about 2-5% of authors I read are people I'd pay to read.  What about you? <comment><USER2> "for high quality, sporadic writers, payment might mean more frequent writing."

And more frequent writing might mean lower-quality writing. There are certainly writers I'd pay to write less - to get the same ideas not buried under so many words. If a magazine had its staff writers produce, say, a maximum 500 words a day, the quality would skyrocket and I'd pay much more for it. Look at the quality of the New Yorker - it's not because they have the best writers (although they do), it's because they let them work for months on a single piece.

</comment><comment><USER3> Mencius Moldbug - <http://unqualified-reservations.blogspot.com/> \- it's hard to tell if he's crazy or a prophet, but it's definitely the most intellectually fascinating blog I've ever come across.

</comment><comment><USER4> +1 for pmarca.

Also <http://particletree.com/> if it was updated more often - but I guess they're going for quality over quantity, which is fine by me.

Thanks for the post, will add some of those to my reading list.

</comment><comment><USER5> Tipjoy sounds more and more awesome by the day

</comment><comment><USER6> Very interesting question:

Scott Adams

Violent Acres

Mark Cuban if he hired a copy editor. I have a low tolerance for typos/grammar and that guy is off the charts.

My friend Mike May: <http://mikemay.blogspot.com/> , though I would have to pay per post since he doesn't write often and I'd feel ripped off with a subscription model.

I'd pay to not read TechCrunch, but I'm too afraid of missing something.

</comment><comment><USER2> Since I'm already paying with my time, what's the difference in paying a bit extra in cash? So almost everybody I read frequently and carefully is somebody I'd pay to read. In technology: Mark Pilgrim, pg, danah boyd, Ian Bicking, probably dozens more. Outside technology, there are too many to even begin listing.

</comment><comment><USER7> Malcolm Gladwell almost always has something interesting to say.

</comment><comment><USER8> Steve Pavlina of 2005 and 2006 had some dazzling productivity and personal management articles.

</comment><comment><USER9> Blogs? Nobody. I pay to read the authors that I'm willing to pay for, when I buy their books. Out of the OP's list, I've bought books by Steve McConnell, Paul Graham, Ted Neward and Joel Spolsky.

</comment><comment><USER10> Well I buy books fairly often, so I'm paying to read them.

In terms of blogs, I'd be willing to pay something to subscribe to the simple dollar, probably bruce schneier's blog, boing boing.

There are others, I'm sure.

</comment><comment><USER11> Malcolm Gladwell (New Yorker)

John Hollinger (ESPN)

Paul Graham

Warren Buffet

</comment><comment><USER12> Andrew Sullivan

</comment><comment><USER13> Since you were non-format-specific in your question:

Neil Gaiman Haruki Murakami William Gibson Neal Stephenson Banana Yoshimoto

;-)

</comment><comment><USER14> PG. So I bought Hackers & Painters.</comment>


Access two Gmail accounts at once in the same browser - <AUTHOR> http://gmailblog.blogspot.com/2010/08/access-two-gmail-accounts-at-once-in.html

<comment><USER2> You can use as many accounts as you like in Firefox.

In Firefox you need to create multiple profiles which can be a faf (but each profile gets its own add-in settings so I find it useful for testing my own code sometimes where add-ins and greasemonkey scripts might interact with it).

For web apps that only use temporary (session level) cookies, you can do the same in IE8 simply by selecting "new session" from the file menu.

</comment><comment><USER3> This made the rounds a few months ago and it's still the right way to go: <http://giveupandusemultiplebrowsers.com/>

</comment><comment><USER4> This is very old.

<comment><AUTHOR> Dual accounts was working for me, for a couple of years, without faffing with settings. But a recent Google Apps update broke things - such as forcing a tab into the other account, etc. I wasted some time until I dug this up. Thought some more people might currently be in the same boat.

(Not intended for front page discussion, of course, just a note left in the stream.)</comment></comment>


Project Eternity - old school RPG by Obsidian (ex Black Isle) on Kickstarter - <AUTHOR> http://www.kickstarter.com/projects/obsidian/project-eternity <comment><USER2> Already thrown a bunch of cash at the monitor.</comment>


Book of Ruby Completed: 425 pages, 300+ Sample Programs, free - <AUTHOR> http://www.sapphiresteel.com/Book-of-Ruby-Completed-425-pages <comment><USER2> Having just taken a quick look - it seems like a great effort.

The only thing that throws me off is the font choice for the code examples. I'm no font-snob, but a monospace font for code just seems much more readable and friendly to programmer readers.

Regardless of the font - very glad to see a great effort like this.

<comment><USER3> I'm more worried by the style guide. Just in the screenshot, I notice a lot of oddities and inconsistencies:

      * Unnecessary parentheses abound
      * A camelCase preference over snake_case
      * And nocase ("myname")
      * Calling methods with "::" and "."
      * Curly braces instead of do..end for multiline, unchained blocks.
      * Curly braces that don't even begin to line up.
      * Strangely erratic whitespace (see parentheses)

Don't get me wrong, I love what you can do with Ruby, but this seems like a confusing thing to throw at your readers.

<comment><USER4> It worries me more that newbies who use this guide will start writing in this very un-Rubyish way and then wonder why their code doesn't get used as much or why they don't succeed at the job interviews.. There's an informal, but popular, style for a reason. This is also why books (should) have technical reviewers.

Consider the second example in chapter one that includes: _name=gets()_ .. No true Rubyist codes that way. There's an example a couple of pages on that uses _if .. then_. No-one really uses _then_ either. This is explained in the text, but why show it if it's confusing and rarely used? And why methods like _get_name_? That's not typical Ruby style either. It'd just be _name_.

That said, once you get beyond a chapter or two and ignore the quirky stylings, it's not bad and certainly has some value. I know people who had weird music teachers and learned how to play pretty well under them.. but they had to go back and relearn basic breathing and fingering techniques due to the way they were taught.

</comment></comment></comment><comment><USER5> His explanation for breaking/ignoring conventions:

[http://www.reddit.com/r/ruby/comments/8diqr/book_of_ruby_com...](http://www.reddit.com/r/ruby/comments/8diqr/book_of_ruby_completed_425_pages_300_sample/c08xzgb)

</comment><comment><USER6> I've began reading this book to patch any holes in my knowledge of ruby. My only suggestion so far is that a new typeface for the code excerpts is needed. Perhaps not necessarily courier (after reading his post on reddit) but ANY other font. I mean really - anything but comic sans. It is widely abused in the world to point where reading it gives me a head ache. Surprisingly enough, I'm not the only one!

</comment><comment><USER7> Can anyone recommend a host (preferably free) where I can just mess around and start learning?

<comment><USER8> localhost</comment></comment>


Does Capital Efficiency Matter?  - <AUTHOR> http://david.weebly.com/1/post/2009/02/does-capital-efficiency-matter.html

<comment><USER2> _Why did SynthaSite need to raise $25M to get to a similar point Weebly has with $650k?_

The TC article offers up one clue; SynthaSite intend to innovate by acquisition. If that is the case, the funding is probably well timed given current low multiples.</comment>


Would you pay $1.99/month for newswire app on iPhone? - <AUTHOR>

I'm working on creating a mobile newswire app for the tech vertical. The following are the features that the app would have:
1. Headlines limited to 140 characters or less for quick consumption
2. Social sharing news via Twitter, Facebook, SMS and Email
3. Sentiment analysis - green for positive stories; red for negative stories; yellow for neutral stories; blue
for sponsors; orange for announcements
4. Four tabs - recent stories, trending stories, badges and options pages
5. Recent stories will show all stories in a chronological order
6. Trending stories will show top 10 most voted stories
7. 18 badges will give incentives for users to launch/use the app regularly and increase engagement
8. Options page will have users resubscribe to the app, manage push alerts and a host of other options
9. Push notifications for instant breaking news alerts
10. Shake device for positive-only, negative-only, neutral-only and regular story listings
11. Advertise "TrendOY!" on social sharing services with page branding
12. Integrated advertising/sponsorships to increase revenue
13. In-app browser to make reading full stories easy and efficient
14. Offline viewing for older stories
15. Search archives going as far back as 5 days
16. Keyword alerts to customize story alerts - user can select specific keywords to receive stories they are
interested in
The idea is that people with mobile devices don't have a lot of time to sit there, pull up an article on the NYTimes or WSJ app and read it in its entirety. They want their information quick in bits and pieces so they can stay in the loop and move on to the next piece of information. We promise to deliver that information in tweet-like headlines and help you on move.
Would you pay $1.99/month for an app as a subscription? What features could we add to make it worth the $1.99/month price? <comment><USER2> For me, it would ultimately have to come down to the quality and caliber of the news within the app. I'd kill for high quality, diverse, informative, and mildly entertaining news. All the extra features are just thing that are built around the sweet spot of great news. At best, they're icing on the cake; in an absolute worst case senario then may distract- but its how they're developed, so it may not be an issue.

I use Fluent News and Time apps many times daily, and it's not about the bells and whistles. I just want plain old good news agglomerated from many sources. If you can do that better (more stores, higher quality stories), $1.99 is a steal. If it's just the same service with better packaging, it's probably not worth the money.

But, I do log onto my free news apps many times daily. That's ad exposure that someone would pay greatly for.

<comment><AUTHOR> so the kind of news that we're hoping to deliver is breaking news. because we'll be push notifying you of breaking news, the goal would be to ONLY deliver good, quality news (in our opinion) and not everything that we can possibly find. we don't want to kill your device with 100 tweets a day. that's just way too much.

what will be missing would be blogger opinions etc. that generally go everywhere - unless that opinion happens to become a story of its own.

we're drop dead focused on simplicity and keeping the interface clean. i'll be sure to let you know when.

</comment></comment><comment><USER3> My personal opinion is that badges won't matter to people consuming newswire content. I suspect that within a year, badges have little-to-no value in apps as a whole (with the exception of gaming apps -- and I consider Four Square to be a game).

<comment><AUTHOR> you're right about the badges. that's just to get the engagement going in the beginning, but you will eventually see them evolve into something much more useful and perhaps you would be able to unlock real-life prizes like gift cards, sponsor supported gadgets etc.

</comment></comment><comment><USER4> I like the idea and my initial impression is that if you can truly deliver all these features, with excellent news content, $1.99 might be too low.

I would almost consider scaling some of the features back and focusing on simplicity and content.

Do you have anything you can show us yet?

Sounds promising.

<comment><AUTHOR> unfortunately, i dont have anything to show you yet. we're in week 4 of development. one more week and we'll submit the app to the app store. trust me, all these features will be laid out extremely simply with a great user interface and design (in my biased opinion).

for subscription, we plan on charging $1.99/month, $4.99/quarterly and $19.99/annually.

<comment><USER5> Any reason the quarterly subscription is 3 cents cheaper per year than the annual?

</comment></comment></comment><comment><AUTHOR> ALERT: PLEASE realize that this is $1.99/month subscription service.</comment>


Non-technical founder? Learn to hack (2013) - <AUTHOR> http://blog.samaltman.com/non-technical-founder-learn-to-hack <comment><USER3> "Although it takes many, many years to become a great hacker, you can learn to be good enough to build your site or app in a few months."

Yeah, just don't run it in production.

<comment><USER4> Running it in production is the point. An idea is pursued to validate the market for it, not to accomplish building a scalable, secure solution for which nobody wants.

<comment><USER3> Respectfully disagree :)

90 percent of the users who reuse passwords for your app will end up on a list and finding themselves on haveibeenpwned months too late, or never.

<comment><USER4> This is an unfortunate consequence of having a free and openly distributed internet. Unless you're auditing and compiling your own builds from open source, you have no idea where your data is going.

I'm all for best practices and due diligence. But from the startup founder perspective, you can't let yourself be paralyzed by the fear that everything will go horribly wrong.

<comment><USER5> > But from the startup founder perspective, you can't let yourself be > paralyzed by the fear that everything will go horribly wrong.

Some middle ground here is definitely needed.

Even for startups, things going "horribly wrong" can kill people (medical devices, biochemistry, robotics, transportation) or send people to jail (accounting, banking).

And if you think your web startup doesn't deal with "dangerous" things, I suggest googling for "life-threatening grindr security flaw".

There's never a good reason to ignore security.

</comment></comment></comment></comment></comment><comment><USER6> I'm not sure if this is genuinely good advice. I've tried to teach a few people how to code and while they've had a great time and also managed to solve a few "homework" tasks which I gave them, I doubt they would have reached a level in only a few months time where they would have been able to build a first version of a product.

Most software needs to do at least some basic data crud, integrating with some third party APIs (auth, some social media platforms, other 3rd party services, etc.) and also do some ops related work to get their first version shipped to some cheap hosting. I doubt that someone without any technical background can learn all these skills in only a few months time and then also build the first version of their product.

It's likely going to be a time sink and one year later they know perhaps some basic programming skill but will have no product at all. To me this would be a sign of bad entrepreneurism, focusing on the wrong stuff at the wrong time. Nowadays you can always hire someone or easily outsource the first version to some company in India or elsewhere. It's not going to be perfect, but much faster than learning and doing it yourself and probably still better.

I also doubt that you have to have some engineering skills in order to be a successful business owner of a software company. Even the most talented developer will not benefit much from his engineering skills, because they will not get the time to make any low level decisions. Surround yourself with people who you can trust and who you can delegate responsibility and you'll be much better off IMHO.

<comment><USER7> >> Nowadays you can always hire someone or easily outsource the first version to some company in India or elsewhere.

True.

And the process of gathering requirements, managing a software engineer, verifying quality all while working nights and having a full-time job - <USER2> somewhat similar to the entrepreneurial life.

So it can be a good test.</comment></comment>


History of Online Advertising - <AUTHOR> http://www.adpushup.com/blog/the-history-of-online-advertising/

<comment><USER2> Wow. I've been doing internet marketing for 12 years! Where does the time go?</comment>


The Real Secret of Thoroughly Excellent Companies  - <AUTHOR> http://blogs.harvardbusiness.org/bregman/2009/03/the-real-secret-of-thoroughly.html <comment><USER2> Jeff Bezos also practices this at Amazon, [http://www.shmula.com/987/jeff- bezos-5-why-exercise-root-cau...](http://www.shmula.com/987/jeff-bezos-5-why- exercise-root-cause-analysis-cause-and-effect-ishikawa-lean-thinking-six- sigma)

<comment><USER3> The company'd be much better off if he applied the same standard to the development side of the company, which has an average tenure of around 12-18 months for developers (more senior devs tend to leave more quickly than junior devs).

<comment><USER4> Really? Why is that? I always thought Amazon was a great place to work in.

<comment><USER3> When I was interviewing for jobs to get out, I encountered close to a dozen ex-Amazon folks... none were at all surprised that I wanted to leave, and one even said that he only joined Amazon for the resume pad.

My experience was basically that they hired me because "senior developers should be good at wading into bad code" rather than for anything vaguely resembling the sorts of engineering tasks that they grilled me for during the interview process.

Most of the software I got stuck with was a nightmare of bad design and rushed hacks. It was also a technological step backward from a government contracting job.

And then there's the problem of supporting all of that crap...

And the benefits aren't all that good, to boot.

Most of the developers I've talked to who worked there didn't like it, and the more senior they were, the less they liked it.

</comment></comment></comment></comment><comment><USER5> Call 10,000 people and give them each a coin. Ask them to toss it ten times.

Chances are one will get ten heads in a row.

This doesn't mean they have a secret you can learn, or that they can teach you how to flip ten heads in a row straight off, or that they can do it again or event that they can flip one more head.

We have a world where millions of businesses were started, some are very successful - most folded - that doesn't mean the successes have a secret you can copy to copy their success. Or even a non-secret.

I'm not saying business success is as random as tossing a coin, but self- selecting the successful companies to study is a very biased sample, and that doing what they do to get the results they get is not a guaranteed strategy.

<comment><USER6> Having read a number of business books, this article fits right in. "The secret" to write a popular business book is to take one simple idea, and fluff it up to the size of a dirigible by repeating the point in different ways, and adding lots of anecdotes to make it a better 'story'.

<comment><USER7> Yeah, the financial secret to most financial secret books is to write financial secret books.

<comment><USER8> People say this sarcastically, but has anyone ever gone down this path intentionally, _knowing_ they don't have a secret, but pretending they do?

<comment><USER9> Back in the day when magazines were things you read and they had weird little classifieds sections in the back. I responded to one "Make money blah blah, send $2 and SASE to..." a few weeks later my get rich "book" arrived it was a couple photo copied pages that described taking out ads in magazines "Make money blah blah, send $2 and SASE to..." and sending photo copied copies of the photo copied pages to any suckers naive enough to send you $2.

I was a child, and $2 was relatively cheap way to learn _that_ lesson.

<comment><USER10> SASE is "self-addressed stamped envelope," if anyone missed that.

</comment></comment></comment></comment></comment></comment><comment><USER11> Simple and beneficial, but hard for greed-minded people to grasp.

</comment><comment><USER12> Interesting points. It sounds like Michael and Issy have a lot going for them, and that they have a hard-to-find constellation of virtues, traits, and skills. It is that constellation that has brought about the atmosphere of trust, general goodness, and business success to the Four Seasons. It is the boss's aura that propagates to all levels of the organization, trust being but one matter.

The key to success is in people, starting with the person at the top of the pyramid. A bad boss cannot formulate success by inverting his personality or by adopting a daily "secrets to success" checklist to fervently abide by because he will fail eventually. That is a guarantee.

So if you want to be successful, you have to be good and hire good people. And if you can't hire good people it is probably because good people are hard to find (and probably expensive). That is why success is hard to achieve.

To push it one step further, an organization with lots of (or some) not-so- good people will not achieve trust, at least not to the fullest extent. A slacker causes other people to become embittered because they have to compensate. Slackers are not trusted. Gossipers are not trusted. Liars are not trusted. Greedy bosses are not trusted. Greedy bosses do not trust.

</comment><comment><USER13> Without even clicking the link I can tell the "secret" is either something extremely vague as "work hard" or something that wouldn't hold to the simplest statistical test.

</comment><comment><USER14> Man, this guy really likes staying at the four seasons.

</comment><comment><USER15> "Michael practices proximity management. Every month he meets informally with each employee group. No agenda. No speeches. Just conversation. That helps him solve problems"

Isn't this basic job of the manager? Why do academics and industry label common sense with lame terms?

</comment><comment><USER16> This exactly reinforces the advice from a talk Bob Metcalfe gave a year ago.

The bottom line, and the secret:

 _Great sales people create an opportunity to fulfill a commitment -- even when one doesn't naturally exist -- and then fulfill it._

<comment><USER17> There have been a few attempts to methodologize a more "consultative approach" to Sales, notably SPIN Selling, Strategic Selling and Solution Selling.

The last of these has been the most successful, and interestingly it was cooked up by a tech. support guy, Mike Bosworth, who was "persuaded" to try his hand at Sales.

I have tried to summarize the essence of Solutions Selling here: [http://dailykibitz.blogspot.com/2009/01/distillation-of- solu...](http://dailykibitz.blogspot.com/2009/01/distillation-of-solution- selling.html) and have just released a product, bSelling, intended to support this kind of approach: [http://dailykibitz.blogspot.com/2009/03/first-web- based-prod...](http://dailykibitz.blogspot.com/2009/03/first-web-based- product-released.html)

</comment></comment><comment><USER18> Sound great for a non-technical company.

In the drier example they give, the GM is able to understand the initial symptoms, follow the chain of inference, and identify the root cause.

What about the case where the chain of problems involves highly technical ones that the GM is really in no position to answer?

Before you say that tech companies should be run by hackers, consider that even unfamiliarity with a sub-project can make an otherwise competent techie give retarded advice.

</comment><comment><USER19> That's the real secret between human beings.

What is a friend?</comment>