Of Money, Responsibility, and Pride - <AUTHOR> http://veridicalsystems.com/blog/of-money-responsibility-and-pride/ <comment><USER2> This is a mistake. The Apache foundation doesn't sell $250/hour consulting gigs for its primary source of revenue. Neither does the Linux Foundation, the SQLite Consortium, or other massive, mission-critical open source products.

This is the wrong funding model. It keeps money in OpenSSL developer's pockets, but there is no financial incentive for any OpenSSL developer to work on foundational improvements to OpenSSL. He said himself: there is over $100,000 in open contracts for competent developers to work on non- foundational improvements to the project. If you are an enterprising developer with good C skills and a knack for crypto projects and you apply to work for the OpenSSL foundation, are you going to start servicing that $100,000 pool of contracts or are you going to pretend that money doesn't exist and live on ramen?

If nearly all of OpenSSL's revenue comes from clients that want OpenSSL to meet their particular needs, then none of that money is going to developers to strengthen OpenSSL's foundation. This is why OpenSSL looks like a hodgepodge of hacks upon hacks in order to accomplish narrow goals with limited impact testing. It should be no surprise to anyone else: clients are literally paying OpenSSL developers for this, and nothing else.

Who is paying OpenSSL for developers to clean up the code base and remove ancient #IFDEFs? Who is paying OpenSSL for developers to analyze code paths and do case analysis? Who is paying OpenSSL for developers to write unit tests or even have a test harness at all?

No one will pay an hourly rate to accomplish these tasks. Google is not going to pay by the hour for a developer to stare at a function until they grok it; they want a feature. Joe Company will not pay for developers to write unit tests, they want OpenSSL to handle $QUIRK from a vendor's system, or to know how to make their code handle it.

This model needs to go away. Competent OpenSSL developers time is too valuable to waste on client asks. Their project is too important, and as long as the money is flowing only for novel features and not structural improvement, then that money will dictate that only new features are developed.

<comment><USER3> This is one of the better comments I have seen on OpenSSL in the past week. Well said.

"This is why OpenSSL looks like a hodgepodge of hacks upon hacks in order to accomplish narrow goals with limited impact testing."

It doesn't just look like a hodgepodege of accumulated hacks, it is a hodgepodge of accumulated hacks. :)

"It should be no surprise to anyone else: clients are literally paying OpenSSL developers for this, and nothing else."

One could say this with respect to many popular open source projects, including ones with corporate sponsorship. The complexity just keeps building over time and there is no such thing as "finished, accepting bug fixes only".

"Who is paying OpenSSL for developers to clean up the code base and remove ancient #IFDEFs? Who is paying OpenSSL for developers to analyze code paths and do case analysis? Who is paying OpenSSL for developers to write unit tests or even have a test harness at all?"

Those are rhetorical questions. We know the answers. Alas, when the people who pay for (open source) software and consulting pay to have "features" removed instead of added, "pigs will fly".

Doug McIllroy is quoted as saying, "The hero is the negative coder".

(Just in case this need explanation: Prof. McIllroy is the mind behind UNIX pipes and one of computer science's most prominant contributors. "Negative coder" means someone who removes code instead of constantly adding, or "committing", new code.)

We could really use some more heros. And as we switch away from OpenSSL there will be a lot of links to libssl to remove.

Meanwhile some people have been writing and testing small, auditable and usable open source crypto, more or less for "free".

[http://tweetnacl.cr.yp.to](http://tweetnacl.cr.yp.to)

My guess (and hope) is that pathological requests for "features" to be added would be met with heavy scrutiny. The authors already have day jobs in academia.

<comment><USER4> > Meanwhile some people have been writing and testing small, auditable and > usable open source crypto, more or less for "free".

With all due respect that is complete bullshit. I do not care that you put quotes around free. Writing "free" will never be considered to include sums in the hundreds of thousands of dollars. More importantly blatant lies like this muddy the debate and set outrageous expectations. The Nacl project gives the following description of funding:

      NaCl was initiated by the CACE (Computer Aided Cryptography Engineering)
      project funded by the European Commission\'s Seventh Framework Programme
      (FP7), contract number ICT-  2008-216499. CACE activities were organized
      into several  Work Packages (WPs). NaCl was  the main task of  CACE WP2,
      \"Accelerating Secure  Networking,\" led  by Tanja Lange  (at Technische
      Universiteit Eindhoven)  and Daniel  J. Bernstein (at the  University of
      Illinois at  Chicago, currently visiting Eindhoven). CACE  nished at the
      end of 2010 but NaCl is a continuing project.

      ...Many  of  the  algorithms  used  in  NaCl  were  developed as part of
      Daniel  J. Bernstein\'s   High-Speed  Cryptography  project   funded  by
      the  U.S. National  Science  Foundation, grant  number  ITR-0716498.

I found the funding information for ITR-0716498. djb is listed as the PI for the project.[^1] I could only find the high level funding of ICT-2008-216499.[^2] (wtf EU?) CACE WP2 is only one component of the project. I would love it if someone with better knowledge of EU funding can find the funding for the WP2 line item. The figures are:

      NSF ITR-0716498 funding: (USD)     400,000.00
      EU  2008-216499 funding: (EUR)   4,733,078.00 ***NEED WP2 line item***

The tweetnacl implementation lists two more funding sources. As above it was easy to locate the NSF funding but I totally struck out for the nwo funding:

      NSF 1018836 funding: (USD)        $436,203.00[^3]
      NWO grant 639.073.005 funding:    ???????????

Don't get me wrong, I have a lot of respect for djb and I think he and his coworkers deserve every fractional euro/dollar of funding that they received but they did not work for free. Most importantly they should not be expected to work for free.

[^1]: [http://www.nsf.gov/awardsearch/showAward?AWD_ID=0716498](http://www.nsf.gov/awardsearch/showAward?AWD_ID=0716498)

[^2]: [http://cordis.europa.eu/projects/rcn/85344_en.html](http://cordis.europa.eu/projects/rcn/85344_en.html)

[^3]: [http://www.nsf.gov/awardsearch/showAward?AWD_ID=1018836](http://www.nsf.gov/awardsearch/showAward?AWD_ID=1018836)

NB: This is the nwo funding site: [http://www.nwo.nl/en/funding](http://www.nwo.nl/en/funding) I think the english version may have a reduced set of features. I can not find the this grant information on the site.

<comment><USER3> Wow. I guess "more or less" was not strong enough wording for you?

The point is that using something like NaCl costs you, the developer/user, nothing more than if you are using OpenSSL.

Do you agree?

<comment><USER4> No, "more or less for free" is not close to hundreds of thousands of dollars plus whatever funds came from the EU and NWO.

I have to say I am confused about your reply in the first sentence you seem to acknowledge that the wordingwas related to the cost of "writing and testing" crypto software. However in the second sentence you seem to indicate that your thesis was about the switching costs users face. Which is it? You did not say I get to use nacl "more or less for free" you said that "people have been writing and testing small, auditable and usable open source crypto, more or less for 'free'." That quote seems to be about the cost of creation not the switching costs.

Do you think djb et al produced nacl "more or less for free?"

<comment><USER3> I think you misunderstood what I meant.

I mentioned "free" only to point out that there is no financial cost to switching to it. I guess I did not type the sentence with enough care; words are missing. My apologies.

I imagine people would be willing (and are accustomed) to paying for software of similar quality.

But I'm also wondering why this bothered you so much.

Does it make a difference that grants were received?

Is the funding not transparent enough?

The blog article on OpenSSL mentions payments for consulting and "features" to be added to OpenSSL.

Should I be concerned about what those features are, and who is paying for them? Are you concerned?

I'm just nterested in cleaner code than OpenSSL's. NaCl looks cleaner to me.

Maybe I'm wrong. But I'd rather be compiling programs that use libnacl or some other simpler alternative than ones that use libssl.

We all have to make decisions about what software we choose to use, even if we are not cryptographers.

I see nothing wrong with discussing alternatives to OpenSSL. This bug has been a real PITA.

<comment><USER4>
      > I mentioned "free" only to point out that there is no financial cost
      > to switching to it. I guess I did not type the sentence with enough
      > care; words are missing. My apologies.

It speaks highly of your character that you say this to the jerk on the internet said you were full of shit.

      > But I'm also wondering why this bothered you so much.

Because crypto is important. A lot of harmful attitudes/mindsets are reinforced if people think NaCl was created in the authors spare time and did not require funding:

\- "Why should I donate to GnuPG/OpenSSL/Tor/Mozilla(NSS)? Those NaCl devs wrote NaCl for free."

\- "How hard could it be to implement a crypto library? Nacl was a side project. The Nacl devs 'have day jobs in academia' and created nacl in their spare time. They did it for free, so they obviously didn't need to spend money on testing environment, research material or hire/consult experts. On the other hand look at SelfiesMadeEa.sy they raised serious cash and had to quit their jobs because they _tackle hard problems_."

\- "Obama and the rest of gubmint are taxing me to death. Government should be pay for the military and maybe some roads; not waste money on liberal academics in ivory towers, maplethorpe and those pinkos from NEA or some stupid robot/telescope that cant do metric conversions."

\- "OMG NSA is evil. USA does nothing but invade countries and privacy."

      > Does it make a difference that grants were received?

No it does not make a (negative/harmful) difference that grants were received. I think it is a shining example of modern civil society; you have the US, NL and the EU teaming up to fund strong crypto by top notch folks from a number of countries. Governments should fund research, applied and basic, and they should be encouraged to fund more of it.

Somewhat tangential: Knowledge of the grants also seeks to eliminate the idiocy in the latter two examples above. People need to be reminded that big government is not always an evil force, governments can be a force for good. I do not know if you saw my other comment about tor funding but tor had revenue of \$2+ million in 2012 and 60% came from US government. I don't know where you are from but I bet you have met a simple minded moron wearing a tea party costume or trendy European threads that will not stop complaining about the evil Obama surveillance administration. Blow their minds and ask them to wrap their heads around the:

\- $800k from DoD for "Basic and Applied Research and Development in Areas Relating to the Navy Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance"

or

\- $350k from State for "Programs to Support Democracy, Human Rights and Labor" and "New America Foundation: International Programs to Support Democracy, Human Rights"

      > Is the funding not transparent enough?

If this is in regards to the lack of numbers from NWO or the EU I am sure that I am at fault. (I also think one of djb's EU grant numbers might have a digit transposed) I imagine that the dutch version of nwo.nl is easier to use.

      > The blog article on OpenSSL mentions payments for consulting and
      > "features" to be added to OpenSSL.

      > Should I be concerned about what those features are, and who is paying
      > for them? Are you concerned?

I think we should be concerned that OSF is not doing a better job highlighting sponsors and attracting new ones. It should be easier for someone with check writing authority at big.corp.com to stumble across the sponsors information and think to themselves "hey, we should drop some petty cash on these folks. We use the product and I bet the marketing folks would appreciate the bump in visibility for a fraction of the cost of our latest failed social network branding efforts." If I was OSF I would look at the \$2 million tor brought in and ask myself "maybe we could do a better job of sponsor outreach? Tor is important to these people that wrote checks and tor uses libssl-dev, I wonder if there is an opportunity?"

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Could someone involved with the OpenSSL Foundation and the OpenSSL project maybe pitch in with a quick description of how the project is managed?

* Who owns which subsystems?

* Is there a board of governors or a BDFL or something like that effectively overseeing the whole project?

* What is the process for screening commits from people new to the project?

This whole post seems to be tinged with a bit of defensiveness on behalf of the most active committers to the project. But it wasn't the active committers who introduced this most recent bug.

</comment><comment><USER4> The tor project is a great example of how open source software (OSS) projects can work with sponsors. Trying to find more information on Qualys and PSW Groups sponsorship of openssl is a nightmare compared to tor project sponsors.[^1][^2] Without the tor project's emphasis on transparency and professionalism I doubt they could post numbers like this:

      Since meeting the revenue milestones of $1,253,241 in 2009,
      $1,574,119 in 2010 and $1,681,101 in 2011, Tor has reached new
      heights in 2012 with over $2 million in revenue (unaudited).[^3]

My comment should not be read as a criticism of OpenSSL, it should be interpreted as cause for optimism. The tor project has demonstrated that OSS projects can get sponsored to solve complicated security problems that are difficult to explain to the general public.

[^1]: List of sponsors/projects: [https://trac.torproject.org/projects/tor/wiki/org/sponsors](https://trac.torproject.org/projects/tor/wiki/org/sponsors)

[^2]: Example monthly report for SponsorF's project: [https://lists.torproject.org/pipermail/tor- reports/2014-Marc...](https://lists.torproject.org/pipermail/tor- reports/2014-March/000484.html)

[^3]: Tor Project Annual Report 2012, pg 8, [https://www.torproject.org/about/findoc/2012-TorProject- Annu...](https://www.torproject.org/about/findoc/2012-TorProject-Annual- Report.pdf)

</comment><comment><USER6> It's well and fine that Stephen lives very cheaply, but all of this is an attempt to distract from the OpenSSL project's very real issues by wearing a cilice then bitching about it.

The fundamental facts are these: openssl contains a large quantity of code that, if I where to check into my company's repo, I would have at best a rough conversation with the cto and at worst I'd get fired. Plus a lack of good tests. These combine to create more than hypothetical problems; we've seen some severe security holes and there's almost certainly more to come.

The question that should be discussed is if openssl is, ala sendmail, unsuitable for purpose and, if so, what should it be replaced with.

</comment><comment><USER7> Google Cache version (site is 404ing for me)

[http://webcache.googleusercontent.com/search?q=cache:http://...](http://webcache.googleusercontent.com/search?q=cache:http://veridicalsystems.com/blog/of- money-responsibility-and-pride/&strip=1)

</comment><comment><USER8> OpenBSD has had two holes in a heck of a long time. By contrast OpenSSL has had a remote execute in 2010, and another 4 in 2002, and is regularly patching DOS's resulting from memory corruption that turns out not to be exploitable.

It is 453,000 or so lines, more than five times the size of xv6. It is ten times as big as PolarSSL. Documentation and internal structuring is wildly inconsistent. Features that make static analysis annoying are widely used. The API is far too low level.

Do you believe this is acceptable in a security library? Do believe that aspiring to the security of qmail or OpenSSH is a reasonable goal, even at the cost of features? Why should I use OpenSSL for TLS termination when formally validated alternatives exist?

<comment><USER9> > Why should I use OpenSSL for TLS termination when formally validated > alternatives exist?

Oh please do share! (spoiler: alternatives which enable side channels because the pretty compiled-optimized-code (that is generated from source code that itself may feature immutable data etc. with no side effects) is ripe with leaks via cpu branching, caching, etc etc do not count.) This is not a spiteful rhetorical inquiry, by the way!

<comment><USER2> Those side-channel attacks are largely theoretical. OpenSSL and RSA in general are vulnerable to side channel attacks, because many of the fundamental operations are not constant-time. That can change eventually, but RSA is difficult to write in a constant-time manner. OpenSSL certainly has had its fair of lab-demonstrated side-channel attacks, but I don't think anyone has been able to demonstrate their use in virtualized hosting environments against arbitrary other tenants.

Side channel attacks once you've already got code running on the same operating system as the target are much easier. But if you can get arbitrary code to execute on the same machine running OpenSSL, you probably already have their keys.

So, I think the criticism to OpenSSL is valid. Why use it when it seems there are less bad alternatives? A lot of it comes down to network effects, inertia, and licensing. That's a much better answer than side-channel attack surface area, which all RSA implementations share :)

<comment><USER8> Nope: you can exploit the timing attacks from across a network link in AES. DJB did this long, long ago. Furthermore, I believe OpenSSL has constant-time RSA, but you can always use ECDSA for which constant time implementations in C exist. (I wrote one, but I still need to switch the hash function to SHA256 and add the unnecessary encoding steps to the output, so consider it a PoC).

<comment><USER2> Are you sure? Searching for "side channel OpenSSL" reveals a majority of the attacks are against ECDSA. Of course, searches aren't the best measure of vulnerability, it's just an indication of popularity.

<comment><USER8> [http://cr.yp.to/antiforgery/cachetiming-20050414.pdf](http://cr.yp.to/antiforgery/cachetiming-20050414.pdf) ECDSA is nice because you can use partial nonce recovery+lattice reduction. Furthermore recent Intel chips have AES instructions.

</comment></comment></comment></comment></comment></comment><comment><USER10> Reading about Dr. Stephen Henson reminded me of the article written about Tarn Adams, the creator of Dwarf Fortress.

[http://www.nytimes.com/2011/07/24/magazine/the-brilliance- of...](http://www.nytimes.com/2011/07/24/magazine/the-brilliance-of-dwarf- fortress.html?pagewanted=all&_r=0)

</comment><comment><USER11> Not hard. Just change the license and require commercial use to be paid</comment>


Ask HN: How do I teach my parents to use a computer? - <AUTHOR> My parents are barely able to use a computer. Beyond Google and a few Office programs, they are completely unable to perform tasks that we, as programmers, consider trivial. To put things in perspective, they cannot usually cut and paste text without my help.
I have been living at home due to my own circumstances, so I have been able to help them. However, I am deeply afraid that they will be in deep trouble when I finally move out. I fear that they will have extreme difficulty performing basic tasks as more things go online and paperless.
Anyone here have experience educating their elders on technology? Any resources to help with this? Any classes or books? Any ways to make it seem less intimidating? What are your insights? <comment><USER2> With difficulty! They will never be as good with computers as you are. You just need to accept that.

It is probably not a good idea to try to teach them competencies they do not see the need for. You could help them understand how to do things that they _want_ to do. With that motivation they might be better able to concentrate on the essentials.

People have specific learning styles. When the teacher prefers a different modality to the learner you have a huge obstacle to overcome and often times neither is aware of it. The modalities are often described as: visual; auditory; kinesthetic. There is a massive body of literature on this area. For example; "SuperLearning".

In very brief summary the options are:

1\. Show them how to do things and let them take notes or even record a short video on a smartphone.

2\. Let them sit at the computer and tell them what steps to take. Again letting them take notes might help.

3\. Document the steps required, e.g. screen grabs, and written explanations. Then let them follow those instructions as and when they need to refer to them.

<comment><USER3> > The modalities are often described as: visual; auditory; kinesthetic.

The evidence base for learning styles is very weak [1]. It's fashionable in schools and teacher training to deride them as a neuromyth. You can make a slightly different argument: that different things are taught better in different ways; or having the same concept explained in multiple different ways helps everyone learn; or that we all have learning preferences which make us feel comfortable. The link between teachers accommodating learning styles in classrooms and improved student outcomes is very tenuous.

[1] [https://educationendowmentfoundation.org.uk/evidence- summari...](https://educationendowmentfoundation.org.uk/evidence- summaries/teaching-learning-toolkit/learning-styles)

</comment></comment><comment><USER4> From my experience people who lack basic computer skills don't have them because they don't _want_ them and trying to teach them would be a waste of time.

I've noticed this with my own parents and even some friends (who use a computer at work on a daily basis albeit for very simple tasks).

Some people just don't want to invest a little time & effort to learn how to better use their tools. I don't know if it's laziness, or fear, or something else, but there's nothing you can do to force them.

All the resources have always been there should people want to learn. The only people left in this situation are those that don't want to learn.

Instead of trying to teach them, how about making it so there's _less_ stuff to teach by getting them an easier to use machine like an iPad? My parents swear by it and I haven't had a tech support call in ages.

</comment><comment><USER5> Google and a few office programs seems to be an entirely normal level of computer competency for one's parents. Many of our parents aren't even using a general-purpose computer anymore, just iPads.

Why do they need to use a general purpose computer more than they are today? Is it for their work? The answer to what to do seems like it depends on the answer to that.

</comment><comment><USER6> I got my grandmother to use a computer, but she always used a few predefined paths.

Another elderly relative relied on a relatively inexpensive, patient tech support person (basically an advanced user). There was a cottage industry of techies helping the elderly in my country, maybe there's something similar where you live?</comment>


Show HN: Simple tool to upload and paste URL's to screenshots and files - <AUTHOR> https://github.com/OkGoDoIt/UploadAndPaste <comment><USER2> This might be a silly question but I've honestly tried to Google it without any success. Is there an easy way to put something like this behind a web based "portal". Like, I'd love to have an external facing login site that would allow me to access internal resources like this. I currently use OpenVPN but it'd be neat if this could be done via a web based portal without the need for a heavy VPN solution. Anyone have any suggestions?

<comment><AUTHOR> I think you're asking how to make the public URL shares accessible only with a password, in which case could just use basic password auth on your web server. Something like [https://www.digitalocean.com/community/tutorials/how-to- set-...](https://www.digitalocean.com/community/tutorials/how-to-set-up- password-authentication-with-apache-on-ubuntu-14-04) for Linux or [https://docs.microsoft.com/en- us/iis/configuration/system.we...](https://docs.microsoft.com/en- us/iis/configuration/system.webserver/security/authentication/basicauthentication) for Windows.

<comment><USER2> Hello, I appreciate the reply but I was looking to replace my OpenVPN solution which allows me to visit websites that aren't publicly accessible. Going the htpass route would require opening up each individual service to the Internet and then mapping the internal ports to a unique external port (as they all listen on port 80)

</comment></comment></comment><comment><USER3> Awesome work! I love when people build productivity tools for Windows.

What's the difference between this and ShareX?

Cheers.

<comment><AUTHOR> Thanks!

I wasn't aware of ShareX, perhaps it handles this use case just as well. That looks like a super powerful tool, whereas my project is very focused on a specific workflow I personally hit a lot. I assume ShareX is probably a better tool for general use.</comment></comment>


Apple boycotts German newspaper after Bentgate Video – open letter to Tim Cook - <AUTHOR> http://www.computerbild.de/artikel/cb-News-Handy-Apple-boycotts-COMPUTER-BILD-An-open-letter-to-Tim-Cook-10953399.html <comment><USER2> For those who aren't German and may not know Computerbild or it's publisher. They have about as low a reputation as you can get, so low in fact that sometimes this seems to be the entire goal of what they are doing.

Everything they claim should be taken with a huge grain of salt, in fact one should probably assume their claims to be false until proven otherwise.

<comment><USER3> For international audiences: ComputerBild is a daughter of Bild, the German equivalent of the Sun.

</comment></comment><comment><USER4> > Just to prove that what happens is nothing but the truth.

No, it isn't, except in the most myopic and unhelpful way possible. It would be the truth to measure how much force is required and compare it to other phones on the market. It would be the truth to show that almost all phones bend when exposed to that kind of force.

It is not "the truth" to show a selective amount of the truth that allows people to keep believing a lie in order to sell papers, and I find it hard to sympathise with fake journalists losing privileges only afforded to legitimate members of the press.

<comment><USER5> You sound a touch too salty to be judging what constitutes "legitimate" press.

<comment><USER6> To be fair, anything that's German and has "BILD" in its name cries out "tabloid".

<comment><USER5> Sure, and I'm not trying to defend them, but pulling access over unfavorable coverage isn't the same as never providing it in the first place.

We can argue the relative merits of different reasons to distance yourself from a publication, but unfavorable coverage (even unfair coverage) just seems childish and petty.

</comment></comment></comment></comment><comment><USER7> As an aside, the video that really demonstrates how easily iPhone 6+ can bend is this one: [https://www.youtube.com/watch?v=gJ3Ds6uf0Yg](https://www.youtube.com/watch?v=gJ3Ds6uf0Yg)

Seems to have been bent with considerably small effort, and very quickly.

<comment><USER8> Small effort? According to Consumer Reports, it takes 90 lbs of force to bend an iPhone 6+. That's not small effort. That video just shows the guy was prepared and willing to push as hard as he could. Replace that iPhone 6+ with practically any other modern piece of electronic equipment and he'd probably have damaged that too.

<comment><USER9> He did try another phone, but he couldn't bend it. Was he trying as hard? Meh, dunno. But CR should that 6+ was at least 50% easier to bend than some competition phones.

<comment><USER8> What other phone did he try?

Not all phones take the same pressure. But the iPhone 6+ is hardly the weakest of the lot. Consumer Reports lists it as more durable than the HTC One (90 lbs for deformation of the 6+ vs 70 lbs for the HTC One), and I don't think the HTC One is generally considered to be a flimsy phone (Consumer Reports actually says it's "largely regarded as a sturdy, solid phone").

<comment><USER9> The Moto X.

</comment></comment></comment></comment></comment><comment><USER10> So my wife and I went into an Apple store yesterday and tried to bend a 6+. Using a level of pressure no more than what I'd be willing to use for my own Nexus 5, I couldn't even get it to flex. The bigger issue is that it seems designed to fly out of your hand, between the rounded sides and slick aluminum.

<comment><USER7> > Using a level of pressure no more than what I'd be willing to use for my own > Nexus 5, I couldn't even get it to flex.

Of course, using a level of pressure you wouldn't apply to any phone... no-one in their right mind goes around "bending" phones. The thing is, when you have your phone in your pant pocket... and you squat down or something, the arch on your leg is going to easily create upwards of 50+ lbs of pressure at just the right place to create the bend. That's how my co-worker got a bend in his phone. That's right, a guy I personally know got a bend on his iPhone 6. That's why I think the 'only 9 people' line by Apple is absolute and total bull shit. It's infuriating that news journals are just buying it up like it's truth straight from God's lips.

<comment><USER11> >The thing is, when you have your phone in your pant pocket... and you squat down or something, the arch on your leg is going to easily create upwards of 50+ lbs of pressure at just the right place...

Agreed.

I have bent extremely thick metal keys in my back pocket I assume just by squatting, and I am under 200 pounds in weight.

I only noticed because I went to unlock my door one day and the key didn't fit.

Thankfully I could hammer it back into place, but unfortunately the same is impossible with an iPhone.

<comment><USER10> > I have bent extremely thick metal keys in my back pocket I assume just by > squatting, and I am under 200 pounds in weight.

But doesn't that just prove it's stupid to put a phablet in your back pocket? There's no hope of making a phone stronger than a thick metal key.

</comment></comment></comment></comment><comment><USER12> Am I only one who find these videos moronic ? I mean, ofcourse it bends under what appears to be lot of pressure. My take is you shouldn't be affected if you don't wear too tight a jeans to make it bend.

</comment><comment><USER13> I like Apple products, and I own an iPhone 6 (I also own a 5s, 4, 3gs, 2 iPads, and a Mac). But the level of vitriol directed at anyone even mentioning the obvious problems with the 6 Plus by both Apple and its fanboys is appalling. It only makes the fanboys look even more crazy than they are, and Apple look like it doesn't want to own up to its mistakes.

Apple produced an expensive, high profile product with some serious and obvious design flaws. Trying to convince others that the issues don't exist (example - [1]) or vowing revenge against any media outlet that chooses to report on them is just absurd and wouldn't be tolerated in any other PR department.

[1] - [http://forums.macrumors.com/showthread.php?t=1792559](http://forums.macrumors.com/showthread.php?t=1792559)

<comment><USER14> > _" Consumer Reports test results find iPhone 6 and 6 Plus not as bendy as > believed: All the phones we tested showed themselves to be pretty tough. The > iPhone 6 Plus, the more robust of the new iPhones in our testing, started to > deform when we reached 90 pounds of force, and came apart with 110 pounds of > force. With those numbers, it slightly outperformed the HTC One (which is > largely regarded as a sturdy, solid phone), as well as the smaller iPhone 6, > yet underperformed some other smart phones."_

[http://www.consumerreports.org/cro/news/2014/09/consumer- rep...](http://www.consumerreports.org/cro/news/2014/09/consumer-reports- tests-iphone-6-bendgate/index.htm)

Consumer Reports is hardly sensational. And they came down on the side of there being a problem with "Antennagate". They didn't think this is a "serious" concern.

<comment><USER13> I just addressed this in another comment...

[https://news.ycombinator.com/item?id=8386068](https://news.ycombinator.com/item?id=8386068)

<comment><USER15> Consumer reports needs to be called out for misleading people. Its painfully obvious that they were paid off, probably by Apple or their investors, to release this bogus study where they dont even bend it at the weak point, giving ammo to all the fanbois for them to defend against this issue.

</comment></comment></comment></comment><comment><USER16> Business as usual as far as I am concerned.

Apple had super harsh responses to internal folks giving out bumpers to people during the iPhone 4 release, I know more than one guy who got fired for acknowledging the problem to a customer and helping them out before Apple corporate had an official policy.

</comment><comment><USER17> While Apple is known to be less than open in its relationship with the media, this does seem like an overreaction. Probably on both sides.

I posit that the local German response of Apple was an overreaction, the magazine's response has probably exacerbated the conflict. It will be interesting to see how this resolves itself.

<comment><USER18> Exacerbated the conflict? What else do you imagine Apple is going to do to them?

<comment><USER17> Quietly retract their German employee's accusations. The open letter is a PR disaster for Apple

</comment></comment></comment><comment><USER19> This is the first bendgate video I've seen and am not surprised that when you bend something that is a long and thin piece of metal it deforms and doesn't return to it's original shape. Like a spoon.

What I'm more surprised at is the way Apple dealt with it (if phone call claim is true), for a company that is usually great with PR.

<comment><USER20> This is how Apple PR works. Apple products have so much demand from customers that getting review units is a huge boost to page views. Apple PR has all the leverage and can "punish" publications easily.

<comment><USER18> Given that this appears to have been a legitimately purchased iPhone 6 Plus, I'm not sure what Apple PR could conceivably do to prevent this in the future.

<comment><USER20> Well in the future they won't be getting review units and will have to wait in line like everyone else to review it. By then the embargo would have been lifted on other publications with review units and they likely won't get nearly as much traffic.

</comment></comment></comment></comment><comment><USER21> Apple, that just shows your insecurity.

</comment><comment><USER22> Wow, they were shocked and dismayed? You'd think a newspaper would have had a little more worldly experience. Methinks they are a bit too sensitive.

</comment><comment><USER23> This is a teachable moment for some managers at Apple in Germany; or as they might be saying to themselves, "Today I Learned about the Streisand Effect."

No matter whether or not bendgate is or is not an issue, blacklisting and thumbing your nose at journalists is not a good PR move. I'm surprised people at major corporations keep screwing this up.

<comment><USER8> This isn't the Streisand Effect. Apple isn't censoring anyone.

Instead, Apple is doing exactly what that newspaper should have expected them to do: stop giving them test units and event invites. They're not entitled to that stuff, and Apple is under no obligation to invite hostile media to their events.

And yes, they _are_ hostile. Consumer Reports proved that the iPhone 6 is _not_ super-sensitive to bending, and in fact the 6+ is even more durable than the 6, and more durable than the HTC One (which Consumer Reports says "is largely regarded as a sturdy, solid phone"). That should have been the end of this whole farce. But the newspaper wanted to jump on the media bandwagon, pretending that the ability to bend a phone is somehow unique to the iPhone, and Apple rightfully decided the newspaper was no longer a business they wanted to work with.

<comment><USER24> I believe Consumer Reports should redo with a 4 point bending test to end this controversy once and for all. Then we can compare all products on equal footing.

<comment><USER8> 4 points is not better than 3. If anything, the phone probably withstands more force when you're distributing it over 2 points instead of 1, because those points are (presumably) closer to the edges, and therefore don't have as much leverage.

<comment><USER24> 3 point loading puts peak moment at one point while 4 point distributes the moment over a wider area to find the weakest point. You can do a simple statics analysis to show this.</comment></comment></comment></comment></comment>


The Witness: the creator of Braid talks about his fiendishly difficult new game - <AUTHOR> http://www.polygon.com/features/2015/9/17/9343943/the-witness-hands-on-preview-feature-braid-jonathan-blow-interview-ps4-playstation-4-pc <comment><USER2> I _strongly_ encourage anyone interested in programming languages to watch his series about Jai, the language he is creating for his next game. Starts here:

[https://www.youtube.com/watch?v=TH9VCN6UkyQ&list=PLmV5I2fxai...](https://www.youtube.com/watch?v=TH9VCN6UkyQ&list=PLmV5I2fxaiCKfxMBrNsU1kgKJXD3PkyxO)

It's not released yet, but watching the videos has massively changed the way I think about programming. The notion of "data-driven programming," which I would describe as "only move around the data you have to", has been a real revelation to me. I sort of came out of the Ruby world (and Java before that) where the attitude is more "Abstract all the things!"

I have been trying to apply many of Blow's principles in my JavaScript programming and it has been awesome. I find myself staying closer to the "metal" (which in JavaScript world is pure Node and low-level browser APIs) and it has been incredibly rewarding.

I've also really enjoyed his policy of pragmatism over idealism. I think the React world for example has taken a good idea (immutability can clarify data flows) and turned it into a religion (Everything Must Be Immutable!) Watching Blow work has given me the confidence to steer away from that.

Much in the same way that learning Rails made me a better programmer (even though I don't use it anymore, and I've rejected a lot of its premises) I have found learning Jai has really leveled me up as a programmer and a computer science thinker.

<comment><USER3> See here for a write up up Jai's language features: [https://sites.google.com/site/jailanguageprimer/](https://sites.google.com/site/jailanguageprimer/)

 _John_ is clearly coming in from a C++ mindset and is essentially fixing problems with the language that should have been really been fixed long ago. I think it looks interesting, but I'm not sure it really solves any big problems? Just seems to be a bit better syntax.

<comment><USER4> It's not just a better syntax for C++. If nothing else being able to use the entire language at compile time is a huge step in the right direction IMO.

C++ meta programming IMO was never meant for meta programming. It was intended do to a few simple template things, then someone discovered if you made an array of size [-1] you could basically turn it into a turing complete language. But, the contortions you have to go through are ridiculous. It's like writing photoshop in bash script. I'm surprised someone hasn't written an LLVM pick your language to C++ meta programming compiler just to not have to deal with that crap.

Sure that feature has been around in other languages for decades (lisp) but it's sorely missing from C++. People usually work around it by writing code generators, almost always in other languages.

There were other interesting ideas like using the closure specifiers to enforce function purity including all functions they call. I haven't followed whether that has worked out or not.

On top of that syntax matters. As JBlow pointed out, every time he has to waste time refactoring 50 lines of code for something that should be a 1 character change or spelling things out the compiler should be able to figure out is a huge drag on productivity and motivation.

That was my #1 take away from the videos I watched. How about designing a language for programmer joy. Most languages pick something else (multi- processing, memory safety, ...) but whether or not it will actually be pleasant and fun to program in is rarely considered.

Sure some people get off on solving the puzzles of contorting their language of choice to do something difficult. Especially C++ meta programming gurus. Others of us just want to get shit done. It's not writing the code that's fun for us. It's the result. The faster we can get there the more we can work on polishing and iterating.

<comment><USER5> I watched all his videos and my main take away was that there is actually no high level language besides C (and restricted subsets of C++ that don't use templates) that can be used to tell the computer what to do. Almost every high level language we have already abstracts away the idea that you are trying to control a piece of hardware. Game programmers are in an ideal position to have learned what is actually needed to make talking to a computer more efficient. The fact that J also has the vision to build the language to account for real world development processes is almost like an added bonus.

<comment><USER6> Presumably Rust wasn't stable enough for him to consider because that's the single language that seems to address his complaints.

Once you bar garbage collection, you're pretty much left with C, C++, and Rust (FORTRAN weenies can leave the room, thanks).

<comment><USER7> Also, he doesn't like Rust's stance on safety -- he thinks it's going to lead to too much hand-holding and boilerplate annotations.

<comment><USER8> Yes, that's the main design difference between Jai and Rust.

My _personal_ feeling is that memory safety isn't something I want to compromise on. But, I work on browsers and not games, so I'm perfectly willing to acknowledge that, for games, developers may be willing to sacrifice safety for fewer type system restrictions. Browsers, critical OS components, databases, etc. are security critical, while games aren't. I'm a pluralist when it comes to programming languages, and I'm perfectly willing to accept that there are _prima facie_ valid reasons for not wanting memory safety. One thing I like about Jai is that it's very up-front about not being type-safe or memory-safe, and specifically argues against the usefulness of memory safety for its domain.

It's interesting, though, that whenever I've floated the possibility of relaxing restrictions on an opt-in basis for apps that don't care about memory safety as much the reaction of the Rust community has been lukewarm at best and usually pretty negative, even from the game devs. It's interesting: most people don't want to give up their memory safety, once they see the benefits that it brings in terms of developer productivity (preventing annoying bugs). That's the camp I'm in too, at least for the apps I write.

<comment><USER9> In one of his latest video he show how it is going to work for array access: by default it's checked, but you have a directive to make one (or a block) of array access unchecked and then you have a global directive which can change the default to check all the array access or NOT check all the array access. So you get the full range from safe array access to C-like performance and with the possibility of dropping the checks only where this impact really performance.

Memory safety isn't limited to array access, but I really like the idea of this kind of control (even though for library this could create issue, I think that there are plans to allow the use of an 'ANDF' like format for libraries).

<comment><USER8> Bounds checking isn't as interesting as use-after-free protection (like the borrow check) for a couple of reasons: (1) you can easily opt-in and opt-out on a case-by-case basis (even in Rust), whereas UAF protection is nonlocal; (2) bounds checks rarely if ever show up in profiles with a well-designed iterator library and an optimizing compiler.

<comment><USER9> I mostly agree with you (UAF is more interesting but more difficult that bound checking), but I would nitpick on details:

\- yes you can opt-in and opt-out on a case-by-case basis in Rust for bound checking but can you globally remove checks and globally force checks?

\- as for UAF protection being non local, a true UAF protection true but a 99% solution such as overwriting the data with know garbage on free (0xDEADBEEF) and ensuring that the allocator doesn't reuse virtual addresses may be good enough in practice, no? But yes it's probably too expensive to release with such configuration..

<comment><USER8> > \- yes you can opt-in and opt-out on a case-by-case basis in Rust for bound > checking but can you globally remove checks and globally force checks?

No. Nobody has asked for it, because nearly all bounds checks in Rust just don't matter from a performance point of view, and thus there is no reason to remove them.

> \- as for UAF protection being non local, a true UAF protection true but a > 99% solution such as overwriting the data with know garbage on free > (0xDEADBEEF) and ensuring that the allocator doesn't reuse virtual addresses > may be good enough in practice, no?

You can't avoid reuse of virtual addresses. That would have terrible cache implications.

The only thing that sorta works is something like WebKit's PartitionAlloc, but that only mitigates some exploitation scenarios. There is no easy solution to UAF.

<comment><USER9> > You can't avoid reuse of virtual addresses. That would have terrible cache > implications.

\--> terrible TLB implications

> There is no easy solution to UAF.

Agreed.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Buried lede: " _While it 's been a long and winding road,_ The Witness _is nearing its end. Blow has a little over four months until the just-announced release date of January 26, 2016._ "

<comment><USER11> It's not really the lede, though.

</comment></comment><comment><USER12> My goodness, but that's pretty for a small-studio game.

Its worth noting that, assuming this actually comes through, Blow will have overcome one of the most pernicious traps that wait for successful game designers- that next, wondrous game you make once you have all the resources you could possibly dream of and no excuse not to follow every possible design ambition. Compare Duke Nukem 3D, or 0x10c.

<comment><USER13> Yes its refreshing to see them take a complete departure from Braid instead of just seeing Braid as "formula for success" and re-iterating it. (I am looking at you Angry Birds).

I like how he used his financial freedom to follow through with something he really wanted to build in a way that he feels justifies his dream

</comment></comment><comment><USER10> The web site of the game itself ([http://the-witness.net/](http://the- witness.net/)) seems down at the moment, but their Twitter account has links to more articles:

[https://twitter.com/witnessgame](https://twitter.com/witnessgame)

<comment><USER14> Wordpress. Nuff said.

<comment><USER14> To all you twits downvoting me, proof:

@Jonathan_Blow: "Sadly I did not manage to get us off WP in time, and surprise surprise, our blog gets crushed immediately every time I reboot the machine."

[https://twitter.com/Jonathan_Blow/status/644564200275054592](https://twitter.com/Jonathan_Blow/status/644564200275054592)

<comment><USER15> You're not being downvoted because you mis-characterized the software stack.

<comment><USER14> Care to enlighten me, then? It's as on topic and relevant to the posted story as the rest of the comments here. The best I can figure is people just don't like my tone, which is childish.

<comment><USER15>
      > which is childish.

uh huh

<comment><USER16> [https://xkcd.com/1124/](https://xkcd.com/1124/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> I wish the temporal delta between buzz generation and game release were smaller. By the time the game will be released, I will have forgotten all about it.

<comment><USER18> I've been looking forward to this for an extremely long time. But it looks so promising that I go to the game blog once a month or so to see what's happening

</comment></comment><comment><USER19> I have been following the progress of this game on the-witness.net for a few years. Really exciting that they've got a release date now.</comment>


The Next Generation of Currency - <AUTHOR> http://www.wired.com/partners/bnymellon/futureofmoney/

<comment><USER2> "This program is produced by the Advertising Department of WIRED and sponsored by BNY Mellon. CLICK HERE FOR BNY MELLON DISCLOSURES"

Can someone who work in advertising shed light on how native advertising is sold, produced and evaluated by the stakeholders?

Namely are the article's objectives/editorial aim determined by the advertisers. Who has ultimate editorial discretion?

How does one evaluate the effect of native advertising? Or is it currently mostly used to build "brand recognition" for the advertiser?

<comment><USER3> PR / advertising firms seed articles into major publications like this - "Submarines" [1]

[1] [http://www.paulgraham.com/submarine.html](http://www.paulgraham.com/submarine.html)

</comment></comment><comment><USER4> Comes on very strong with the tale of currency replacing barter as a means of exchange, which I thought was very convincingly challenged in David Graeber's book Debt.

</comment><comment> vezzy-fnord I can't immediately tell if M-Pesa is a digital currency in of itself or a P2P payment platform.

I'd personally be skeptical of any centralized virtual currencies as their inherent lack of tangibility means they could easily be seized, shut down voluntarily w/o compensation or crippled by regulatory interference. There's been several spectacular failures of this sort, including Beenz, Flooz and InternetCash - all examples of dot-com flops, as well. A whole bunch of others are around in the present. These should best be treated as toys, if even used at all.

The cheapness of Bitcoin is significantly overstated by focusing only on high- level aspects of conducting transactions and not on the more deeply technical implications.

Finally, the article's assertion that banks will have to evolve from being mere transferers to providing more services sounds anachronistic, given that this has been the case for quite a long time already.

<comment><USER5> AFAIK M-Pesa transactions are denominated in national currency and thus M-Pesa is not itself a currency.

</comment></comment><comment><USER6> One mistake here is that moving Bitcoin is not essentially free. It is also getting more expensive. The essentially free part is moving value within a private network, but that could be done with any currency.

<comment><USER3> BTC network electrical consumption comparable with Ireland [0]

[0] [http://ieeexplore.ieee.org/xpl/articleDetails.jsp?reload=tru...](http://ieeexplore.ieee.org/xpl/articleDetails.jsp?reload=true&arnumber=6912770)

</comment></comment><comment><USER7> I can't wait until we don't have to deal with printing and scanning receipts.

<comment><USER3> There's great value in tangible non electronic record keeping.

<comment><USER8> Great value lost, you mean?

<comment><USER3> How?

Tangible physical records of transactions can be useful regardless of access to internet or electricity.

</comment></comment></comment></comment><comment><USER9> Now all we can do is hope that this really will become more popular :D</comment>


Boston Red Sox Used Apple Watches to Steal Signs Against Yankees - <AUTHOR> https://nytimes.com/2017/09/05/sports/baseball/boston-red-sox-stealing-signs-yankees.html <comment><USER2> A couple of things about sign stealing, from someone who is not an expert, but has watched a great deal of baseball:

1) The signs are usually not complex, you can easily read them yourself when you see them on TV. One finger might mean a fastball, two fingers some kind of breaking ball, three fingers might be the pitcher's least favorite pitch. Often, the sign is accompanied by a second sign indicating where the catcher wants it. So one finger followed by a hand lifting up-up, means he wants a high fastball. The players will know what the signs mean after one batter at most.

2) The only time the batting team can actually see the signs is when there's a runner on second. In this case, frequently, the catcher will go to the mound and he and the pitcher will come up with some simple obfuscation. Normally this looks like 3-4 signs indicated in quick succession. I assume they've agreed that number 3 is the meaningful one or something.

3) The communication doesn't have to be perfect. In a lot of cases, a batter is waiting for a specific pitch. It would be enough to signal "Yeah, it's gonna be a fastball outside".

The article suggests that a specific camera crew was the original source of the signs, but it's not clear how that worked. It happened in Boston, so perhaps the camera was manned by local people who turned out to be red sox fans. If such a person was watching a continuous feed, and a specific redsox player asked to be alerted when a high fastball was coming, the apple watch would seem to be a practical solution.

<comment><USER3> Do batters bat better with a runner on second?

Actually the relative performance for all the different base combinations would be pretty interesting to know. Only eight possibilities!

<comment><USER4> Baseball statisticians—sabermetricians, as they're known—consider there to be 24 possibilities depending upon runners occupying bases and the number of outs. You can see prior data here for what is called the run-expectancy matrix of these 24 base/out states:

[http://www.tangotiger.net/re24.html](http://www.tangotiger.net/re24.html)

</comment></comment></comment><comment><USER5> Keep in mind, for those doubting the efficacy, its not necessary to know what exact pitch is coming (Fastball, curve, slider, change up,etc).

Just knowing whether it is a fastball or an off speed is enough, at which point, it simply becomes a matter of transmitting a binary signal.

Transmitting the sign, could be as easy as sending a 1 or 2, then the dugout simply yelling, "Let's go so-so" for offspeed, or "C'mon #12" for fastball.

Most major league pitchers not named, Kershaw, Felix, Max, etc, only have 2 ++ pitches,

<comment><USER6> So what is being 'stolen' is something that largely comes down to a 50% probability in most situations?

Is there a history of 'stealing signs' in baseball? ...Since it could be communicated _almost_ as effectively offline as by a smartwatch.

Also, how accurate can the team read the other team's signs from the dugout? Is it a high probability the information between sent to the players is accurate?

<comment><USER7> Another way of phrasing that is: 1 bit of information. In a very competitive sport.

And yes, there is a long history of this, as the article makes clear; and, as the article also makes clear, rules specifically limit the methods by which such information can be acquired and transmitted, which using an Apple Watch violates. Kind of like how part of the strategy of bridge is efficient use of a well-defined and restricted information channel, and using other methods to transmit the same information is considered cheating.

</comment></comment></comment><comment><USER8> It's hard to follow what the Red Sox were actually doing but it sounds like the actual sign stealing was being done with cameras. They were just using Apple Watches to receive messages (probably just plain on SMS or iMessage?) in the dugout. If I've understood correctly it sounds like the "electronic devices" part of the story is kind of peripheral.

<comment><USER9> SMS or iMessage is probably too slow, trainers were probably using physical cues (like if I touch my cap it's a slider) to relay messages.

<comment><USER10> No... from the article "The commissioner's office then confronted the Red Sox, who admitted that their trainers had received signals from video replay personnel and then relayed that information to some players — an operation that had been in place for at least several weeks."

The video replay personnel are sending messages, via Apple watch to the trainers.

<comment><USER9> Ah I see, I'm referring to the message transaction from trainer to player.

</comment></comment></comment></comment><comment><USER11> It's 2017. If on-field only electronic communication systems were legal in baseball, why couldn't pitchers and catchers have some sort of encrypted "Google Glass"-like head-mounted display and chording glove-button system?

<comment><USER12> If it were legal to do so, they would. But they'd be much more likely to just set up an audio system.

</comment></comment><comment><USER13> Given the Red Sox lost 3 out of 4 in that series, the Yankees should just given them a video feed next time.

</comment><comment><USER14> i'd be surprised if this scheme was actually successful.

its very difficult to relay signs from the dugout to the batter in the few seconds between when the sign is given and when the pitch is thrown.

base runners on second base have always been able to see the signs between pitcher and catcher and relay the information to the batter. To counter this catchers use a complex combination of signs that change inning to inning, sometimes batter to batter.

<comment><USER15> Not sure. Batters already look back to the dugout sometimes in order to know if they want a bunt, squeeze play, hit and run, etc. That doesn't take more than 3-5 seconds. If they already coordinate some kind of sign between the trainer (in question) and a player, then it shouldn't take any more time.

<comment><USER2> The catcher throws the sign after the batter has taken his stance. No more looking at the dugout.

</comment></comment></comment><comment><USER16> Is this YC-able? Is there a pending RFS? Neural network/machine learning for major sports leagues and subsequent advantages? The market is huge, guys. Just think of all the cross-platform potential between all major sports.

In other news, here's some stats[0]:

Red Sox with a runner on second at Fenway: 273/373/417

Red Sox with a runner on second at Fenway, April thru July: 269/370/380 (94 for 352)

Red Sox with a runner on second at Fenway, August: 292/392/557 (31 for 106)

Red Sox with a runner on second at Fenway vs the Yankees, April/July: 056/103/056 (2 for 36)

Red Sox with a runner on second at Fenway vs the Yankees, August: 375/448/625 (9 for 24)

The August series is the series in question.

[0] [https://www.reddit.com/r/baseball/comments/6yaos8/boston_red...](https://www.reddit.com/r/baseball/comments/6yaos8/boston_red_sox_used_electronic_devices_to_steal/dmlxdcw/)

<comment><USER17> Not disputing that the cheating was happening, but sample size for August is smaller, not to mention that hitters in general do better during than the summer months than April/May.

</comment></comment><comment><USER18> Good time to remind people about the previously false accusations from the Yankees on the Blue Jays sign stealing using a "Man in White" sitting the outfield with binoculars.

The interesting part here is that the Yankees alleged the "Man in White" was positioned right above the pitcher's head in the outfield seats so that the batter did not have to move his head in order to see the signal.

I can't imagine the logistics and speed required to relay a signal from the outfield -> dugout -> batter in a reasonable amount of time to be able to hit.

[http://www.espn.com/espn/otl/story/_/id/6837424/baseball- tor...](http://www.espn.com/espn/otl/story/_/id/6837424/baseball-toronto-blue- jays-suspicion-again-stealing-signs-rogers-centre)

<comment><USER19> The Red Sox have admitted to the wrongdoing. This is not crying wolf. They are guilty.

</comment></comment><comment><USER20> It's always baffled me that the pitcher doesn't get to decide what pitch to throw.

<comment><USER21> The pitcher has final say, but a good battery (pitcher-catcher combo) is especially valuable because it lets the pitcher focus on throwing his pitches (and tracking runners as needed) instead of also involving him in the batter- pitcher mind games. Smart catchers are very under-rated by most casual fans, and can tell you why they called every single pitch in every single at-bat in a ball game (which will run well over a hundred pitches a game).

<comment><USER22> Don't think meat, just throw!

[https://www.youtube.com/watch?v=TBUS3vQtDCA](https://www.youtube.com/watch?v=TBUS3vQtDCA)

</comment></comment></comment><comment><USER23> Someone finally found a killer app for the Apple Watch!

</comment><comment><USER24> How did they ensure the sign interpretation was correct? Seems like the information/disinformation problem in espionage.

<comment><USER25> You get immediate feedback when the pitch is thrown, which is prior to the next time you need to interpret the signs.

</comment></comment><comment><USER26> What is it with Boston sport teams and their penchant for stealing signs. First it was the Patriots with recording signs from their opponents defensive coaches and now it's the Red Sox stealing signs.

<comment><USER27> The Sox didn't have many choices - you can't deflate a baseball.

<comment><USER26> True, but you can cork a bat.

</comment></comment></comment><comment><USER28> Being a fan of Boston sports must be tiring. Defending the indefensible year after year can't be fun.</comment>


Deviceatlas go wrapper - <AUTHOR> https://github.com/devnexen/deviceatlas-go-mod <comment><AUTHOR> Hi all,

I am working for DeviceAtlas, the mobile detection solution and know some users of the C enterprise API available here [https://deviceatlas.com/deviceatlas-haproxy- module](https://deviceatlas.com/deviceatlas-haproxy-module) were wondering how to integrate it inside golang. Can be taken as it is or at least as an inspiration as I m not necessarily a very skilled go developer but if it can help a little, why not !</comment>


CVE-2013-0871: Linux arbitrary kernel-mode code execution - <AUTHOR> http://seclists.org/oss-sec/2013/q1/326 <comment><USER2> Hah! Where are the Linux neckbeards now? Another day, another Linux vulnerability it seems like.

Honestly, how much longer are we going to build on this house of shaky cards?

Did they really think that letting a race condition happen on PTRACE_SETREGS was a good idea? Just for "elegance sake"? Come on.

Everyone could tell that none of ptrace/jctl callers actually want to wakeup a TASK_WAKEKILL task, but they can't specify the necessary mask.

My startup still runs Cobol on Cogs in DOS (and we serve over 9000 requests per second on a single DigitalOcean $5 box!).

<comment><USER3> not sure if trolling or actually runs DOS

<comment><USER4> COBOL ON COGS is a joke, plus I'm pretty sure a true user would get the spelling and capitalization right :) <http://www.coboloncogs.org/INDEX.HTM>

<comment><USER5> "(c) <DATE OVERFLOW>"

Oh dear!

</comment></comment></comment></comment><comment><USER6> First, this is local exploit. Second, most distributions do not allow access to realtime scheduling by regular users. In particular, a simple for(;;); at the highest SCHED_FIFO priority will lock the box. You can check

       /etc/security/limits.conf

to see which users / groups are allowed a higher than normal rtprio.

That being said, often pulseaudio and/or jackd are given realtime priviledges, so I assume people will be looking at them.

<comment><USER7> RT privilege is not a prerequisite to this exploit, it only makes it 'easier'.

<comment><USER7> As a matter of fact, I also just realized that it may be possible that nice- ing the 'victim' process down to -20 may also make it easier, and is a non- privileged operation almost everywhere.

</comment></comment></comment><comment><USER8> I really like this recent trend where stuff like this is getting posted and (more importantly) getting upvoted.

<comment><USER9> For me a lot of it feels like noise. Back when I was in charge of security at a payment processor I was subscribed to all the relevant mailing lists (as required by the PCI DSS). Now that I'm working with something less valuable I just rely on apticron + nullmailer to notify me of important security updates to system packages, and the rails security mailing list for rails.

It'd be wonderful if something similar were implemented for rubygems. If security updates were marked in some way, a cron job could scan my Gemfiles periodically and then check each gem to see if any security updates have been released.

<comment><USER8> I know where you are coming from but I feel like the exploits that do make it to the front page are pretty saucy.

</comment></comment></comment><comment><USER10> There have been multiple local kernel exploits in the past few years. For somebody who doesn't constantly watch seclists.org or similar security sites, how do I find out whether my kernel is vulnerable to any known exploit? Is there a tool that can help me with checking? Is there a notification tool?

<comment><USER11> Your distro probably has a mailing list for announcing updates.

For debian, you should subscribe to <http://lists.debian.org/debian-security- announce/> \- and you'll get an email as soon as updates are published. These are also published at <http://www.debian.org/security/>

You can also follow security bugs closely on the security tracker. For example, this vulnerability is classified here: <https://security- tracker.debian.org/tracker/CVE-2013-0871> and the full list of bugs affecting the stable kernel is here: [https://security- tracker.debian.org/tracker/source-package/l...](https://security- tracker.debian.org/tracker/source-package/linux-2.6)

</comment></comment><comment><USER12> A lot of uses of ptrace require root on many distros, does this vulnerability work when that's enabled?

edit: as in, does yama.ptrace_scope prevent anyone without root and/or CAP_SYS_PTRACE from exploiting this?

<comment><USER13> No, you can exploit this by ptracing your child. It's not targeting a special process. (Does anybody use yama.ptrace_scope?)

<comment><USER14> Has anyone estimated the probability of success? What is the average number of attempts to get the scheduling conditions to happen?

Assume the user can get access to a CPU core that is otherwise idle. sched_setaffinity(2) will succeed when run by the process to set its own affinity to a specific core, so the attacker can locate the processes on a chosen core. (The attacker could spend a few milliseconds first to find an idle core.)

</comment></comment></comment><comment><USER15> Did centos 2.6.32-279.22.1.el6 address this on Feb 6th or is this something new?

Oh wait, nope, not addressed: <https://rhn.redhat.com/errata/RHSA-2013-0223.html>

I thought the responsible thing to do was not announce it until there was some headstart time?

Strangely it's not in the redhat db yet at all

<https://access.redhat.com/security/cve/CVE-2013-0871>

<comment><USER16> > I thought the responsible thing to do was not announce it until there was > some headstart time?

I may be wrong, but from the report, it seems to be a somewhat difficult local exploit that can lead to privilege escalation. While it's serious in that it allows arbitrary code to run in kernel space, it also seems to pose a low risk due to how hard it is to put all the required pieces in place.

Also, there are already corrections available.

</comment></comment><comment><USER17> Is this a vulnerability across all Linux versions or some of the more recent versions (e.g. 3.7.x)?

</comment><comment><USER15> So correct me if I am wrong, to disable ptrace?

       echo 0 > /proc/sys/kernel/yama/ptrace_scope

Grsecurity kernels also seem to have

       /proc/sys/kernel/grsecurity.harden_ptrace

<comment><USER18> According to [https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening...](https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace%20Protection) setting it to zero would actually restore the more permissive behavior. But, like someone here mentioned, a value of 1 would still allow to ptrace your own process children.

</comment></comment><comment><USER19> Can anyone explain what access is necessary to use this attack?

I'm guessing anyone with shell access (can run arbitrary shell commands from an unprivileged account) will be able to use this to get root. But that's just a guess; kernel experts are welcome to weigh in.

<comment><USER20> There isn't even a working exploit yet. As someone else mentioned, they include a kernel patch with their proof of concept to allow you to reproduce it.

<comment><USER21> A PoC and an exploit are equivalent. Attackers have saved the time trying to figure out how to leverage it.

</comment></comment></comment><comment><USER22> SELinux wouldn't stop this, right?

<comment><USER23> I think you _can_ use SELinux to prevent this attack. See <http://fedoraproject.org/wiki/Features/SELinuxDenyPtrace></comment></comment>


Interview with Wes Bos on how he learned code - Pete-Codes https://www.nocsdegree.com/wes-bos-talks-learning-to-code-without-a-cs-degree/ <comment> Pete-Codes (Author) I took his JavaScript 30 course ages ago so it was really cool to interview him. I didn't realise he didn't have a CS degree which is kind of nuts considering he is one of the biggest teachers of web development on the planet.</comment>


React v16.13.0 - <AUTHOR> https://reactjs.org/blog/2020/02/26/react-v16.13.0.html <comment><USER2> Using react with hooks and typescript and wanted to report I'm happy with it.

The biggest changer to me was TypeScript and DefinitelyTyped covering pretty much every package I end up trying out.

Hooks save a layer of indentation, and in most components, I don't need all the class stuff. In addition I find it harder to manage renders in classes.

Some design decisions, like overextending use of redux-forms can be a pain to back out of. Maintaining typings for these thing break often in my experience. I'm trying to stay away from redux (the data store) in favor of managing stuff through relay mutations.

Nice little comforts like prettier (code formatter) go a long way.

And apparently tslint is being deprecated in favor of eslint ([https://github.com/typescript-eslint/typescript- eslint](https://github.com/typescript-eslint/typescript-eslint)).

Code splitting via React.lazy / dynamic imports working with minimal effort.

The other thing that has helped is webpack's API becoming more stable, editor extensions getting better. I'm getting consistent linting and completion in vim. Stuff is snapping together.

<comment><USER3> Another +1 for Hooks. I was really against it at first, but now I'll never go back. React components should really be nothing more than a view layer and Hooks forces you to stop thinking in the component/class paradigm, which generally makes things a lot more modular and reusable. I've been using XState to handle business logic and MobX as a data store, leaving React to simply render the data. No more huge class files and complicated life-cycle methods.

</comment></comment><comment><USER4> I feel like React hooks even though they provide a concise way to write code. they pushed react 2 decades back. classes had provided a standardized way to do stuff in React land. Now you're going to have places where people use hooks, others classes. n in my personal experience will result in different testing strategies n unknown bugs. this is one of the reasons, I quit working as frontend software engineer. just too much change

<comment><USER5> How do you push a 6 year old piece of software 2 decades back? I know you're exaggerating, but after admitting that you don't work with front end anymore (so I'm assuming you haven't really worked with hooks for very long) it's hard to understand why your opinion is of value here.

I've been working with React for 3+ years now and hooks are a major step forward in terms of both productivity and writing clean, efficient, reusable code. Anyone who spends some time wrapping their head around hooks realizes this and from what I see, a large majority of react / react-native library developers are on board as well.

Hooks can be adopted and implemented gradually along side class based components without issue, and no one has trouble when both exist along side each other. There is no rift in the react community because of this, and to suggest there is just reveals your ignorance, it's only pushing things forward.

<comment><USER6> Best source for learning/grasping/getting-a-feel for hooks in your opinion ?

<comment><USER7> If you're familiar with React then [https://www.robinwieruch.de/react- hooks](https://www.robinwieruch.de/react-hooks) or [https://www.robinwieruch.de/react-hooks- migration](https://www.robinwieruch.de/react-hooks-migration) or [https://reactjs.org/docs/hooks-intro.html](https://reactjs.org/docs/hooks- intro.html) are a good place to start</comment></comment></comment></comment>


A VC: Three Statistics That Lie - <AUTHOR> http://avc.blogs.com/a_vc/2008/07/three-statistic.html

<comment><USER2> Isn't the problem with Feedburner and RSS feed stats that they count "hits" and not actual subscribers (aka unique visitors). So if my RSS reader asks Feedburner 20 times a day for new content it counts as 20 to the total?

Anyone with info on this want to clarify?

<comment><USER3> No. FeedBurner has a basketful of algorithms to deal with this.

In the most significant cases, the readers actually report back to FeedBurner how many subscribers are using that reader. For example, Google Reader. In the user agent string, Google Reader (as well as, I believe, Netvibes, Newsgator, and a few others) says "X subscribers", and that number is then used by FeedBurner. You can check this out yourself if you have access to web stats on a domain that hosts feeds. Check them out. You get to see the same numbers that FeedBurner puts on their charts.

With non-Web / non-centralized readers, it gets trickier, but FeedBurner uses IP addresses combined with user agent strings to get an idea of what's a unique reader requesting multiple times or not. Typically this system works well and isn't wildly inaccurate.</comment></comment>


U.S. Married Men Earn Much More Than Others - <AUTHOR> https://www.bloomberg.com/news/articles/2018-09-19/u-s-married-men-earn-much-more-than-others-demographics-trends <comment><USER2> _The data doesn't necessarily mean that being married increases a man's wages, according to the analysis by Guillaume Vandenbroucke, a research officer at the Fed. It may mean men earning higher wages are more likely to marry and lower-income men remain single_

Also possible (as in my case) that married men are pressured to fight for raises or pursue better paying jobs to better support their families.</comment>


Netflix takes up 9.5% of upstream traffic on the North American Internet - <AUTHOR> http://arstechnica.com/information-technology/2014/11/netflix-takes-up-9-5-of-upstream-traffic-on-the-north-american-internet/ <comment><USER2> Netflix doesn't take it up, paying broadband customers are all requesting individual content that happens to be at Netflix due to the customer benefits.

Netflix just has some files on a server and streams content. Netflix isn't broadcasting but customers are pulling that content. The consumers/customers of Netflix take up 9.5% upstream, granted improvements can probably be made in their software.

There is a disparity how online entities are seen as bad due to taking too much interest from customers where TV numbers don't include bandwidth usage over broadband or spectrum usage and having x number of viewers is seen as good.

This just means Netflix is a popular and big channel or land of content that people spend lots of time in as paying broadband customers using their bandwidth and content customers paying Netflix for access to content. So this can't really be used to justify broadband companies lobbying.

There does need to be improvements to broadcasting on the web which was explored with multicast and maybe SCTP will be more interesting soon as that could help with the TCP problems.

<comment><USER3> > Netflix doesn't take it up, paying broadband customers are all requesting > individual content that happens to be at Netflix due to the customer > benefits.

Consider that "Netflix" can refer not only to the company (the interpretation you're using), but also to the service itself.

</comment></comment><comment><USER4> What this says to me is that people really love content with no ads and are willing to pay for it.

<comment><USER5> Netflix really hits a sweet spot pricing-wise too.

I dread the time when they become cable-ified and start adding different tiers (but it would make good economic sense).

I've been told Cable TV didn't have ads at the beginning.

<comment><USER6> Neither did Youtube.

<comment><USER7> I think everyone knew that Youtube would have to add ads eventually to monetize. Cable was originally an ad-free subscription.

</comment></comment></comment></comment><comment><USER8> From the article:

 _the newest report has Netflix at 9.48 percent of upstream and 34.89 percent of downstream [...] The average Internet subscribing household in North America uploaded 7.6GB of data per month in Sandvine 's report in the first half of this year, increasing to 8.5GB in the latest report, a boost of 11.8 percent. The average household's monthly downloads increased from 43.8GB to 48.9GB, a boost of 11.6 percent._

So the average "Internet subscribing household in North America" downloads 48.9GB * 34.89% = 17.1 GB from Netflix, and uploads 8.5GB * 9.48% = 0.8 GB. If the upstream is all 40 byte ACKs, that's one ACK per 850 bytes downloaded, which is a bit more ACKing than I expected, but not completely unreasonable.

<comment><USER9> I'm sure you are aware of this, but the average here seems missleading. The median household has never Torrented anything, therefore I think that the median would be more representative of the average user's habits.

<comment><USER10> yeah but by averaging the upload and averaging the download and just finding the ratio of the two he's not really substantially affecting his argument vs. using the median, right?

<comment><USER11> The median would be much lower than the average.

</comment></comment></comment></comment><comment><USER12> The article lists the reason for the increase but stops short of putting 2+2 together.

The #1 source of upstream traffic - Bittorrent - has significantly decreased their peak-hour upstream (shifting it to other hours) as described in the article. This rather obviously means that you can go from 7.7% to 9.5% share without any significant changes to Netflix as such, simply because the total peak-hour upstream rate is now slightly lower.

</comment><comment><USER13> All this statistic tells you is that _upstream bandwidth_ is ridiculously constrained compared to _downstream bandwidth_ , when TCP ACKs can fill it up to that degree.

Asymmetric bandwidth isn't particularly high on the list of priorities when it comes to the terrible state of the ISP industry in America. It's just "one more thing".

<comment><USER14> No, all this tells you is that there's not much upstream traffic in general. The amount of traffic could be constrained by available bandwidth, or it could be vastly overprovisioned and there's just no demand for it.

</comment></comment><comment><USER15> Why does Netflix use TCP for streaming instead of UDP? A few missing packets isn't going to meaningfully impact a video stream.

<comment><USER16> TCP deals with congestion and bandwidth allocation automatically. Decades of algorithms work in your favor if you use TCP.

A single missing packet will seriously mess up your video stream. Remember that long sequences of movie pictures are sent as a single whole image plus delta instructions to generate the rest of the images. A single bad packet can screw up a second of video.

<comment><USER17> Depending on the rate of keyframes in the stream, it could be from anywhere from 3 to 10 seconds. And if the GOP[1] is even larger it could be longer.

[1] - [http://en.wikipedia.org/wiki/Group_of_pictures](http://en.wikipedia.org/wiki/Group_of_pictures)

</comment></comment></comment><comment><USER18> Could this be a plan for Netflix to even out the upstream & downstream traffic? Upstream traffic is significantly more expensive for ISPs to absorb (esp at the last mile). ISPs are demanding payment because they claim they're absorbing more traffic than they're sending back [1]. Netflix could just update their client to saturate upstream traffic while maintaining downstream traffic.

From the article: _" But for some reason, its share of uploads went up substantially in the latest measurement while downloads remained level."_

[1] - [http://arstechnica.com/information-technology/2014/07/how- co...](http://arstechnica.com/information-technology/2014/07/how-comcast- became-a-powerful-and-controversial-part-of-the-internet-backbone/3/) _Tier 1 networks have generally exchanged traffic with each other without payment if they send and receive roughly equal amounts of data. Schaeffer has claimed it 's impossible for Comcast to be "in balance" with any other network because its own Internet service is designed for consumers to download far more than they upload_

<comment><USER19> _Could this be a plan for Netflix to even out the upstream traffic & downstream traffic?_

No, because that would not help them.

 _A lot of ISPs are demanding payment because they claim they 're absorbing more traffic than they're sending back._

This is just a misdirection tactic from ISPs who have no intention of offering free peering to Netflix under any circumstances. Backbone peering agreements are irrelevant since neither Netflix nor broadband ISPs are backbones.

</comment></comment><comment><USER20> So if Netflix makes up 9.48% of upstream and 32.39% of downstream, that means for each 10 packets sent, 3 ACK packets are sent back (I know those figures don't represent raw traffic). Does that seem a little odd? I'm not asking as a basis for some conspiracy, I'm more so wondering what that implies for data services I'm working on.

<comment><USER21> no, it just means that you don't have to upload a whole lot of stuff to become 10% of upstream traffic.

<comment><USER22> That doesn't make sense; There isn't one pool of "upload" data and another of "download" data. Rather, there is one pool of data streaming from edges into the core (upload) and back out again (download). You can either attribute each chunk of data to its uploader or to its downloader, but in either case, the pool is the same size.

Edit: or these metrics don't mean what I think they mean, in which case, please tell me!

<comment><USER21> From my understanding of the source article, these traffic numbers don't count servers. It's just the traffic of residential ISP customers.

</comment></comment></comment></comment><comment><USER23> Anyone know what the equivalent upstream/downstream stats would be for all of cable/traditional tv companies? Most of these articles show how large Netflix is now - I'm curious how large they'll get.

<comment><USER24> "Traditional" cable, even digital cable, is broadcast, not streamed.

There are no acks to be sent, a consumer endpoint just tunes to a channel and reads transport stream [1] video off the wire.

[1] [http://en.wikipedia.org/wiki/MPEG_transport_stream](http://en.wikipedia.org/wiki/MPEG_transport_stream)

<comment><USER25> With switched video [1], there is some upstream, as the set-top box requests a channel, and may need to send some sort of heartbeat. For video on demand, there's some amount of upstream for program selection and control as well. But that should be extremely low bandwidth, just control information, not acks for content (although, sending quality feedback to the headend could be very useful to solve delivery issues before customers notice)

[1] [http://en.wikipedia.org/wiki/Switched_video](http://en.wikipedia.org/wiki/Switched_video)

</comment></comment></comment><comment><USER26> The should just deploy instances inside Comcast's network. Much more efficient.

<comment><USER19> They offered that and Comcast refused.

<comment><USER26> Well, they should do it so they don't have to ask.

<comment><USER27> How, exactly, would they deploy their gear inside of Comcast data centers without Comcast approving it?

<comment><USER26> Network, not datacenters. Using this: [https://github.com/stackmonkey/utter- va/#welcome-to-utterio-...](https://github.com/stackmonkey/utter-va/#welcome- to-utterio-and-stackmonkey). Pool is running here: [https://www.stackmonkey.com/](https://www.stackmonkey.com/). It'll be a bit before we can enable significant deployments inside their network, but it will happen eventually.

<comment><USER19> It probably would have been clearer if you just said P2P. Considering Comcast's low upstream bandwidth, I don't think P2P is worthwhile. And of course Comcast would find a way to thwart it.

[http://www1.icsi.berkeley.edu/~nweaver/papers/2009-tprc- cach...](http://www1.icsi.berkeley.edu/~nweaver/papers/2009-tprc-caches.pdf)

</comment></comment></comment></comment></comment></comment><comment><USER28> Can't Netflix acquire Level 3 and solve their issues with ISPs?

<comment><USER29> LOL Level 3 is not the problem here. In fact they are on the side of Netflix.

The regional ISPs are making big fuss, because until now they were sending about the same amount of traffic to Level3 as they were receiving, which allowed them to not charge each other for the traffic. As now there's more traffic coming from Level3 than goes the other way. As per their agreements would make them pay to Level 3 for the difference.

Because of that they prefer to simply throttle incoming traffic from L3, despite the fact that it is the traffic requested by their own users, they also refuse to peer directly with Netflix because Netflix also competes with their services as a cable companies.

<comment><USER28> I realize that Level3 is on the same side as Netflix. The question was can Netflix play the same game the regional ISPs are playing. Let's assume Netflix acquires Level3. Since Level 3 is the backbone for a large portion of the traffic in this country, some Comcast data would have to go through Level3 to reach their customers right? So if Comcast throttles Netflix traffic, then Level3(now Netflix) just blocks Comcast traffic at the "backbone level". The question is theoretical. I know this is really bad for the end consumer.

<comment><USER29> You can't do that. If you are an internet middle man your job is to deliver traffic from one network to another. If you're failing at it then you're failing at your job and quickly someone else will take your place and you get out of business.

On top of that there are peering agreements which might also mention against that.

What's happening here is that ISPs such as Comcast already purposefully hurt their own consumers by providing sub-par service. No one else would normally care about it but to Netflix that's large number of their own customers and they're willing to bend backwards to be able to stream to them.

The problem is that there's really no competition so either we should remove laws and allow once again for competition, provide competition for example by letting cities provide Internet as well or heavy regulation (starting with title 2/common carrier) of existing monopolies, similarly how we do this to other utilities such as electricity/water/gas etc.</comment></comment></comment></comment>


Ask HN: Which tool/workflow is best to describe a JSON/REST API - <AUTHOR> Hi Hackernews,
I'm tasked with defining a new JSON API for an existing tool. Our current API is pretty fugly and we're going to rewrite large parts of it to make it available for use by external tools.
What is the best/standard way to describe a JSON Api? Are there any tools/workflows you can recommend? <comment><USER2> [https://swagger.io](https://swagger.io)</comment>


XFCE running in Windows 10 - <AUTHOR> http://imgur.com/P03MpNK <comment><AUTHOR> Sorry for the image-post, but I definitely thought this was something which made the hacker in me go both "why?" and "that's neat!".

Discussion and original post from reddit found here: [https://www.reddit.com/r/linuxmasterrace/comments/4apdzm/xfc...](https://www.reddit.com/r/linuxmasterrace/comments/4apdzm/xfce_running_in_windows_10/)

Delete/ignore at will :)</comment>


Thoughts on taking things away - <AUTHOR> http://37signals.com/svn/posts/2335-the-art-of-taking-things-away

<comment><USER3> I expected guidelines for how to take things away without angering users -- would be a good (but much harder to write) post. These three bullet points barely state the problem.

I don't think the title over-promised, I think I over-expected :(

<comment><USER4> The title is: "The art of taking things away" and generally speaking there are no guidelines to good art.

<comment><USER3> I think there's plenty of precedent for works titled "The Art of X" to explain how "X" works. Knuth?

(I was going to include an Amazon link for a book search on "The Art of" to support my point, but the first few pages of results were all books of pictures from Hollywood movies. Oh well.)

</comment></comment></comment><comment><USER5> We should take away the tax breaks for small businesses like 37signals. Oh, I mean, all the "entitlement programs" _except_ that one...

<comment><USER6> That is the core of the problem. Nobody likes to say no - <USER2> politicians whose constituents will lose something from it. They might vote for someone else at the next election.

</comment></comment><comment><USER7> Distraction has replaced scarcity.</comment>


Ask HN: Password sharing for remote teams - <AUTHOR>

Hey HN, We are hiring at the moment (linkrisk.com/jobs ;) </plug>) and one of the things that is on my list to sort out is a decent way of sharing passwords between some of our team, we have two offices and at the moment I control all the passwords and that's not scalable.<p>I know many people use LastPass but I'm interested in what startups on HN use. <comment><USER2> You can use keepassx and dropbox to sync between employees.

I also sent you an email as I'm the creator of [https://elipsis.io](https://elipsis.io) ([https://github.com/nherment/elipsis](https://github.com/nherment/elipsis)) and have been interested in implementing such feature for a while. I'd appreciate your input.

</comment><comment><USER3> I'd check out Meldium, but honestly the goal should be to not share passwords at all. Instead, use services that let you grant each user their own account. Otherwise you'll have to change _every_ shared password whenever you fire someone.

</comment><comment><USER4> KISS.

Dropbox and a password-protected spread-sheet. You may want to encrypt it further depending on your needs.

Edit: You may not even need drop-box if you have some sort of shared repository you use (which most do).

</comment><comment><AUTHOR> I've also heard of (but not used) Keepass</comment>