AwSnap – This link crashes Chrome - <AUTHOR> https://github.com/jlblatt/AwSnap <comment><USER2> I'm pretty sure this is [https://code.google.com/p/chromium/issues/detail?id=464270](https://code.google.com/p/chromium/issues/detail?id=464270), which was fixed by [https://codereview.chromium.org/1007323003](https://codereview.chromium.org/1007323003).

<comment><AUTHOR> Wow, that's an even better guess than the other (not mine) I posted: [https://news.ycombinator.com/item?id=9326350](https://news.ycombinator.com/item?id=9326350)

<comment><USER2> It's not just a guess, I broke it and I fixed it :)

Can I ask why you took the approach of making a Github repo to post this rather than filing a Chromium bug?

<comment><AUTHOR> I did file a Chromium bug last week, #472347. I filed under security (as I was unsure) so it's not public, but it was pretty much immediately marked as 'Won't Fix'. Hence the repo ;)

<comment><USER3> Now this is interesting, especially the lack of a reply.

<comment><AUTHOR> The dev reached out to me privately, I wouldn't infer anything based on the responses here.

<comment><USER3> Good to hear! Thanks for updating me.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> Tangentially related, I was performing an analysis of the billions of links available in Common Crawl[1] and ran across an interesting error: there was one link where the port number was 18779690999[2].

The library I was using converted the port text into a 32 bit integer but the library didn't account for the possibility that someone supplied a port well over the 32 bit int limits. I was curious how many tools that use URLs would suffer similar fates and whether there might be any interesting security vulnerabilities.

Just goes to show, no matter how much crazy you've seen, there's likely crazier things hidden from you across the Internet ;)

[1]: [http://commoncrawl.org/](http://commoncrawl.org/) [2]: [https://twitter.com/Smerity/status/576339945041707008](https://twitter.com/Smerity/status/576339945041707008)

<comment><USER5> The port number is supposed to be a 16-bit number though. So, anything above 65535 is malformed.

[http://en.wikipedia.org/wiki/Port_%28computer_networking%29](http://en.wikipedia.org/wiki/Port_%28computer_networking%29)

<comment><USER4> Agreed that it's malformed. My point was more that I'm curious how many other libraries fail badly when confronted with an unexpectedly large port. It's the edge cases / "no-one would ever be silly enough to do that" that quite frequently lead to security issues =]

<comment><AUTHOR> Yes, that's why I feel like this is more significant than a simple crash at first glance- no one would purposefully craft a 256+ unchecked character URL, unless they are being malicious, in which case they absolutely will craft a 256+ unchecked character URL.

<comment><USER6> URLs can definitely get rather long if they contain lots of query data, and the de-facto limit seems to be around 2KB[1]. It's still not acceptable for such URLs to crash the browser though.

[1] [http://stackoverflow.com/questions/417142/what-is-the- maximu...](http://stackoverflow.com/questions/417142/what-is-the-maximum- length-of-a-url-in-different-browsers)

</comment></comment></comment></comment></comment><comment><USER7> I've created something similar but for Firefox: [http://crashfirefox.com/](http://crashfirefox.com/)

Have added new crash options for users with NoScript (even if you're blocking 302s - try right clicking).

<comment><USER8> And it just keeps going, love it

        ➜  ~  curl http://crashfirefox.com/

        ....................../´¯/)
        ....................,/¯../
        .................../..../
        ............./´¯/'...'/´¯¯`·¸
        ........../'/.../..../......./¨¯\
        ........('(...´...´.... ¯~/'....')
        .........\.................'...../
        ..........''...\.......... _.·´
        ............\..............(
        ..............\.............\...
            SNITCHES GET STITCHES

        ....................../´¯/)
        ....................,/¯../
        .................../..../
        ............./´¯/'...'/´¯¯`·¸
        ........../'/.../..../......./¨¯\
        ........('(...´...´.... ¯~/'....')
        .........\.................'...../
        ..........''...\.......... _.·´
        ............\..............(
        ..............\.............\...
            SNITCHES GET STITCHES

        ....................../´¯/)
        ....................,/¯../
        .................../..../
        ............./´¯/'...'/´¯¯`·¸
        ........../'/.../..../......./¨¯\
        ........('(...´...´.... ¯~/'....')
        .........\.................'...../
        ..........''...\.......... _.·´
        ............\..............(
        ..............\.............\...
            SNITCHES GET STITCHES

        ➜  ~  curl http://crashfirefox.com | wc -l
          % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                         Dload  Upload   Total   Spent    Left  Speed
        100 3613k    0 3613k    0     0  2020k      0 --:--:--  0:00:01 --:--:-- 2019k
          120000

<comment><USER9> Hah, I did the same thing, but it's not too hard to get past:

        curl -i -H 'User-Agent: Firefox' crashfirefox.com | head -n 80 | cut -b 1-100

</comment></comment></comment><comment><USER10> I hope this doesn't come across as negative but why post this on HN? Why not just file a bug on crbug.com? Browsers have bugs, all them. It seems kind of negative to turn it into a spectacle rather than just be kind and report the bug to the team.

<comment><USER9> Browser makers need pressure to prioritize robustness. Otherwise, to be competitive with each other, they will prioritize features much more highly, and we can see the results today. "Browsers have bugs, all of them." ...but we're not talking about very-tricky-to-trigger bugs found a couple of times a year, we're talking about 30 every 6 weeks, in various subsystems.

I was initially turned off from Chrome in its early versions because it seemed that tabs crashed much more easily, since it wasn't as big a deal to have a tab crash. Firefox crashes as a whole, so it has much more motivation to diligently make sure its subsystems are not prone to crashing on high-level documents / languages, however malformed they may be.

But as was posted below, it's still quite easy to lock up Firefox. So I applaud crashfirefox.com as well as this Chrome demonstration, they're needed to keep the balance between robustness and new features.

</comment></comment><comment><USER11> Interestingly enough the links on Reddit don't seem to crash Chrome but the cortexture.net link from Github does. I'm running Chrome 41.0.2272.101 m (64-bit) on Windows 8.1

<comment><AUTHOR> It seems hit or miss so far- Shardj just pointed out that [https://](https://) doesn't seem to crash at all.

<comment><USER12> That might make sense, since I'm seeing the same behaviour but have SSL enabled for Reddit.

<comment><AUTHOR> Could be. My concern is:

1) Most people don't have SSL enabled for most (if any) sites that are optional.

2) Most normal users are using the standard build for MacOS/Win, not the dev channel, and not Linux.

3) This requires no XSS or anything remotely tricky. Just a couple hundred bytes of HTML, and that's it.

4) Most web forum filters and formatting code (including Markdown) let this thru just fine.

Maybe I'm blowing it out of proportion, but if you wanted to be a jerk to a whole lot of people very easily, you probably could.

EDIT: Grammar

<comment><USER12> Oh, for sure. There are plenty of attack vectors for this sort of thing, I just find the SSL behaviour interesting.

</comment></comment></comment></comment></comment><comment><USER13> Interesting. Confirmed crash on Ubuntu 14.04, version 42.0.2311.50 beta (64-bit). It crashes only the tab ("He's dead, Jim"), not parent Chrome process.

<comment><AUTHOR> Yup, it's not "serious", but could be used to DOS I believe.

</comment></comment><comment><USER14> It doesn't work on Latest Chrome beta or hacker news.

But a HK clone was crashed.

[http://news.dbanotes.net/](http://news.dbanotes.net/)

<comment><USER15> >or hacker news

Its because HN defaults to https. Https rendering of a site seems to be unaffected by this bug.

<comment><USER14> Yup.

</comment></comment></comment><comment><USER16> Hello World!</comment>


The 'Winners' of the Wired News Saddest-Cubicle Contest (post your workplace in this thread) - <AUTHOR> http://www.wired.com/culture/lifestyle/multimedia/2007//11/gallery_saddest_cubicle <comment><USER2> I wish somebody would have told me they were having a contest.

Here's my entry from my last job: <http://darkcalgary.com/mydesk.jpg>

My workspace is the grease stained chair with only one arm. I chose that one on purpose because if I had a nicer chair it would be stolen every two days.

I worked at that desk for more than five years.</comment>


Ask HN: You're fit and you work startup hours (9+), how do you do it? - <AUTHOR> <comment><USER2> I work 80 hours a week, and I'm happy with my social life and fitness level. To be and to stay fit you need to eat right, exercise and... have good genes. Nothing you can do about your genes, but here're little hacks that helped me to not only stay in shape, but also lose 20 lb in 6 months and maintain it. There's nothing new, it's very easy, but you need to be disciplined about this.

1) Eat 4-5 small meals a day with plenty of veggies and protein. Exclude any processed food and ANYTHING with corn syrup. Read the ingredients. If there are words that you don't know - don't eat it. I never starve, never diet. But I also don't eat more than I need. If you drink alcohol, try to stay away from beer and cocktails. When I drink socially, I usually either have a glass of wine, or go straight to hard liquor (cognac, tequila, vodka).

2) Work-out 3-4 times a week (every other day) for only 20-30 minutes. To be effective you can work out with you weight: push-ups, pull-ups, sit-ups crunches, etc. The key is to go with no breaks, and do 3 sets to maximum repetitions, while alternating different exercises. When I'm short on time, I do 10 pull-ups, 20 jumping push-ups, 30 jumping lunges, 40 sit-ups. And I repeat the cycle 3 times without breaks. It takes me 15-20 minutes. Then I shadow box, or, stretch, or lift weights, depending on my time and mood.

So, this routine works well and doesn't require much time.

P.S. And have lots of sex! It's kind of "refills" your social and exercise points all at once. :))))

<comment><USER3> You're telling me you work approx. 12h every SINGLE day (weekends included) and that has no effect in your social life, mental and physical health? 3 options:

1) Your social life's definition is different from everyone's else.

2) You only sleep 2h a day

3) This is a load of bs

<comment><USER4> 4) definition of "work" is different than everyone else's

<comment><USER3> Good point, missed that one.

</comment></comment></comment></comment><comment><USER5> I cycle to work, 10 miles each way. Plus try to do 25 to 50mile rides one day at the weekend.

I wouldn't say I was that fit though, and though my thighs are pretty rock, I'm not muscled elsewhere. I'd love to also have the energy to swim at lunch, but I'm too busy and tired generally.

Cycling is good as it is actually a bit quicker than the tube, and is a great place to clear my head.

<comment><USER6> I agree that cycling doesn't really make you fit as much as it seems (it's an incredibly efficient mean of transportation!). It is _well_ worth it for me though, for that "head clearing". Biking is pretty awesome: you sort of relate much more to your surroundings/city than in a car, you have time to look around and interact, it's great.

I do miss simply walking sometimes too though (it does feel painfully slow when you get used to cycling around!), but if the distances are large (not too large o/c) the bike can be your best transportation friend.

</comment></comment><comment><USER7> Ive a 30 min walk round trip to work and normally manage to get an 60/90 mins of exercise in the gym/football about 3 times a week. I eat pretty healthily but drink probably more than your average bear (though prob less than your average Irishman!).

However, I think 9+ hours a day is crazy and if you think you're being effective for 9+ hours then you're mad. However, I do think its possible in short bursts (about 3-4 weeks absolute max).

I've worked in startups for about six years so have plenty of personal experience in this.

Anyway, here's your latte.

</comment><comment><USER8> Finding an extra hour a day isn't difficult if it's important to you.

6 am wake up, finish work out around 7, get to work by 8, get off work at 6 pm meets all your requirements and is very reasonable.

You can squeeze that hour in by preparing food in advance 2-3 times a week to cut down on cooking time, taking a few hours on the weekend to do cleaning / grocery shopping so you don't need to during the week, etc. There are infinite ways to optimize your time to squeeze an extra hour a day for a workout.

No excuses if you want it.

</comment><comment><USER9> I am a student but I have classes Tuesday through Thursday, and than I work nights on Saturday - Monday.

During the week while I am at school I usually will wake up 5 am on Wednesdays, to run with my neighbor. I don't even have class till 5 pm but I get up and run. It really clears my mind up and starts the day off right. I usually will run on Saturdays or Sundays depending on my schedule, I always try to run 3 or 4 times a week but sometimes I cant.

Sunday - Thursday I will do push ups and some core exercises, like planks and etc to work the core. To make sure I do it, I X off that day and write the number of pushups I did, so I can see how I am doing at the end of the week and to check my progress.

I am now buying fruits and veggies and making salads for my lunches for each day of the week, I usually will prepare them at the beginning of the week to make it easy as throwing tuna into the salad and leaving for class.

It is basically the same thing a lot of people have said, at first it seems like a hassle but now I am in the routine and its nice. I love feeling good and eating well. The hardest part was starting though, I was out of shape and it sucked but it has gotten a lot easier.

</comment><comment><USER10> I ride to and from work and at lunchtimes every work day. I probably do at least 30km a day with 500m climbing. Here's how...

Block out 2 hours of your calendar at lunchtime every day. That's a non- negotiable slot for your exercise. Do something you love (for me its mountain biking) that makes it easy to motivate yourself to get out (having a group of similar minded friends helps too).

Work to 6pm - there's an extra hour that takes you back up to 8. For me after that is home and family time. If I need another hour I can work 9 to 10 or 10 to 11 when the others are in bed. It's a good quiet time to get a lot done without interruptions.

But here's the thing, I don't often need that extra hour because, having got out and cleared my head at lunchtime my afternoon is so much more productive that if I was stuck in the office all day.

</comment><comment><USER11> It takes ~6 weeks to form a habit. So all you need to power through is 1.5 months of consistent exercise, then you will feel weird when you don't exercise.

I've found the best way to get through the first 1.5 months is to go through it with someone. Get a partner to go to the gym with. Find someone who also rides their bike to work. Join a running/fitness club that meets early in the morning several times a week. Etc. It only takes about 30-60 min to exercise enough to be fit.

Also, keep in mind that your mental health depends on exercise. You won't burn out nearly as quickly if you are physically active. Exercise makes the startup life much more sustainable.

<comment><USER12> This is true. Like most human habits, once you establish routine, whatever it is you're doing becomes natural. Running is fantastic as all you need literally is a good pair of running shoes and you're good to go.

</comment></comment><comment><USER13> There are 24 hours in a day. Assume you don't have kids.

sleep: 7-8, eat/shower/shit: 2, commute to work: 1, chores/shopping/errands: 2, work: 9 ... you still have 2-3 hours left.

That ought to give you 45 minutes or an hour 3 times a week easy. +Weekends. You can work at your business even more (if you can manage that..but if you aren't really working, why?) and still make the time for fitness.

The point is... fitness generally isn't a time issue. It's a time management/motivation issue. Maybe cut out some video games or screwing around on the internet? Oh, and watch what you eat.

<comment><USER14> Commit to work takes 1,5 * 2 hours in İstanbul. You still have 0 hours left.

<comment><USER13> If you have a 2 hour commute time, you can't work 9+ hours a day and have time for fitness. Or much of anything else for that matter.

</comment></comment></comment><comment><USER15> I would like to say that my business is my top priority. But it's not. Taking care of myself – body, mind and spirit – is. But when I take care of myself then the other parts of running my business fall neatly into place.

Three times a week I meet my personal trainer at 7AM for strength training. I usually dread having to wake up this early and it doesn't come cheap either. But I know that the money, time and effort I spend here at the gym will let me sustain the crazy output needed to keep my startup running afterwards.

</comment><comment><USER16> I use myfitnesspal to track all of my calories and workouts. I work 6-12 hour days, and usually take 1-2 days per week off. I workout 30-90 minutes 5 days a week doing HIT training. I'm in great shape, feel great look great.

Its a pretty simple mathematical equation: if you are trying to lose weight, just calculate your calories + energy burned, don't eat too many bad carbs, bad fats and eat lots of protein, fresh foods, and get fresh air.

</comment><comment><USER17> Well, you just do it ! It's just a matter of priorities - you can always find an extra hour every other day, or go to the gym during lunchtime (that depends on the country you live).

Also, a very important thing to remember - staying fit is as much about eating right as it is about physical training. And eating right takes no extra time as compared to eating bad (but it may be a bit more expensive, again, depending on the country you live in).

</comment><comment><USER18> I bike to work 1 hour each way, five days a week. (15 miles per day, 75 miles per week) It forces me to exercise (need to commute) and keeps me awake and fresh at work. I also eat right.

Ask yourself, do you want to get fit or get ripped for the ladies? They are really very separate things.

</comment><comment><USER19> I go to the gym 4 times per week for an hour. I make the time for it. Healthy body, healthy mind. There needs to be period of times which you escape reality, as in no connection to the working world, no phones, nothing. The gym is that time for me.

</comment><comment><USER20> One word. Burpees. But seriously, you do circuit workouts similar to crossfit, you can get away with working out for about 30-45 minutes. Just get the most out of that time instead of having to spend all day at the gym.

</comment><comment><USER21> 3-4 Days/week I get up at 5:15am, work out 6-7 (Crossfit), and I add in a weekend day too (30+ minutes of endurance/cardio).

Eat lots of vegetables and lean meats, lightly processed.

I work out of my house, so I have 0 commute.

</comment><comment><USER22> Track caloric intake (I use myfitnesspal.com / rippedrecipes.com (shameless plug)

Do crossfit 5 times a week... rest takes care of itself.

</comment><comment><USER23> This hasn't been mentioned in the comments below, but I think that enjoying your work and being deeply inspired by it makes a ton of difference. When I love my job I find that I interact more with people, snack less, find the energy to do more sports, more often, deal better with the stress, sleep better, etc. When I hate my job, I snack more, move less, etc.</comment>


Requests for PHP - <AUTHOR> http://requests.ryanmccue.info/

<comment><USER2> An old classic that does something similar is Snoopy: <http://snoopy.sourceforge.net/>

Not sure if/why Requests is any better, but it certainly seems to have better documentation which is reason enough to use it I suppose!</comment>


GraphQL in Use: Building a Blogging Engine API with Golang and PostgreSQL - <AUTHOR> http://alexandrutopliceanu.ro/post/graphql-with-go-and-postgresql/ <comment><USER2> I feel that GraphQL is a lost cause for any sort of mass adoption, especially outside of dynamic languages. Working with it using statically typed languages is incredibly tedious. Also, security scopes/boundaries are also challenging to enforce (restriction certain relationships).</comment>


Why are We Still Talking about LucasArts' Old Adventure Games? - <AUTHOR> http://www.gamasutra.com/view/feature/189899/why_are_we_still_talking_about_.php <comment><USER2> Because, like a lot of old games which were made in a period with comparatively severe technical limitations, they made more with less. They managed to squeeze emotion out of orders of magnitude less pixels than the standard game today. And you've got to admire that.

LucasArts's adventure games in particular were brilliant examples, and I think their defining characteristic is that they never took themselves too seriously. From a guy called Guybrush Threepwood wanting to become a pirate, to time traveling kids trying to stop a mutated tentacle from taking over the world, the settings just kept getting weirder and funnier.

They had their more serious games too, like Loom which is unique in its tone and gameplay mechanics, and The Fate of Atlantis which, as far as Indiana Jones goes, beats the tripe Lucasfilm was trying to push a couple of years ago.

<comment> dorian-graph > .. they never took themselves too seriously. From a guy called Guybrush > Threepwood wanting to become a pirate

How they chose the character name is an example of this:

> The origin of the name "Guybrush" comes in part from Deluxe Paint, the tool > used by the artists to create the character sprite. Since the character had > no name at this point, the file was simply called 'Guy'. When the file was > saved, Steve Purcell, the artist responsible for the sprite, added 'brush' > to the filename, indicating that it was the Deluxe Paint "brush file" for > the "Guy" sprite. The file name was then "guybrush.bbm", so the developers > eventually just started referring to this unnamed 'Guy' as "Guybrush".

The Monkey Island series are my favourite video games. Loom is up there too.

<comment><USER3> Didn't know Steve Purcell (for me, of Sam and Max comics fame) was also an animator for LucasArts. Neat, this explains some things... And why S&M hit the roadway was so close to his comic style

</comment></comment></comment><comment><USER4> This is a good question as the answer should be self-evident -- i.e. they were just great, well-written fun games -- but it's not. As pure gaming, they weren't "great" in the classical sense. I mean, after you've finished them, you can't keep playing them over and over because there's nothing really to "play."

And story-wise...I would think that today's games _should_ have better writing. I mean, games are a _huge_ industry now, and so, theoretically, the writing talent should be much better (in the same way that game budgets can now bring in big name actors to do voices).

So maybe the answer doesn't lie _just_ in the quality of the programming or writing, but in the execution and the way things just _fit_ , despite the limitations of the genre. Hand-drawn cartoons are "limited" in their ability to depict reality, yet the Disney classics will still stand the test of time no matter how good CGI gets.

Maybe there's just something innately appealing with how adventure games, designed during the technological limitations in the LucasArts era, clicked in our brain. Limits are often _good_ things, especially when it stretches creator and player alike to imagine things outside the boundaries.

Of course, bigger budgets/production quality don't linearly translate to "better" -- Raiders of the Lost Ark vs. Indiana Jones IV (I can't even remember the title of it) is a good example. And there's always the power of nostalgia to exaggerate how good things really were back then...

<comment><USER5> _I mean, after you've finished them, you can't keep playing them over and over because there's nothing really to "play."_

Yet people did. And still do. People read some books over and over again. People watch some movies over and over again. The same music, over and over again. And some people, the same games, over and over again.

<comment><USER6> Grim Fandango is at the top of my short list of games I replay once a year, at least. Followed closely by Mega Man 2 and Wind Waker.

There aren't any surprises to it, just a good story, style, music, and humor. Some people like to watch certain movies over and over. I like going back to Rubacava and feeling like an ace detective when I remember Tuesday is Kitty Hat Day.

<comment><USER7>
      > Wind Waker

People were mad at Nintendo for going cell-shaded, but the cell-shaded graphics hold up much better to the test of time, than say The Ocarina of Time.

<comment><USER6> Agreed. Plus, I think the only people who worry that they're going to look like kids for enjoying it are kids.

<comment><USER8> > the only people who worry that they're going to look like kids for enjoying > it are kids

Exactly. Well, adolescents, really: People who are insulted by being considered childish because they still think they _are_ and they don't want to be. They're trying to transition into the new role of adulthood and confusing them with their former role of child makes them insecure because they think they're failing.

They're also embarrassed by the less self-conscious actions of older people, who _are_ less self-conscious precisely because _nobody_ is going to mistake a 50-year-old for a child.

</comment></comment></comment></comment></comment></comment><comment><USER9> Why? Easy. The kids who are now in their early 30s are feeling nostalgia for an institution that meant a lot to them, which is forever lost.

I felt the same way about Sierra adventure games from he 80s.

Fact is, gaming sucks these days because the audience has shifted to the younger equivalent to the millions if people who watch "NCIS: Kansas" on tv. In the 80s and 90s, the gaming market was this demographic slice that allowed for more creative risk in gaming. Now we have Medal of Honor 12 and whatever version Madden is up to, and the whole industry is imploding because they cannot sustain the movie-like budgets.

<comment><USER10> > _Fact is, gaming sucks these days because the audience has shifted to the > younger equivalent to the millions if people who watch "NCIS: Kansas" on > tv._

I'm calling selective "get off my lawn" bullshit on this one. There are many, many, many brilliant, beautiful, incredibly well written and well executed games being released every year that will have the same effect in 20 years that these games have now. Saying that games today suck because "Now we have Medal of Honor 12 and whatever version Madden is up to" is ridiculously cynical and very selective.

Sure those games are being churned out as easy money making machines. But while you're complaining about them, you're forgetting games like Portal and Portal 2, two of the funniest games released in the past 15 years. Games like Shadow of the Colossus and Read Dead Redemption, both of which are regularly used as arguments for why games are art. Magnificent indie games like Braid and Fez and Limbo.

To say that gaming sucks these days is to ignore all the wonderful things being done and instead take a dried up, cynical view that is out of touch with reality.

<comment><USER11> I think some of us lament the loss of certain genres. Turn based strategy, flight sims, space sims, turn based RPGS. I stopped playing games in the mid 2000. There haven't really been any games in my favourite genres since then.

<comment><USER12> While there's certainly not mainstream, there are still some quality game (already published or upcoming) that are of "forgotten" genres:

\- XCOM: Enemy Unknown - turn-based strategy

\- Star Citizen - space sim lead by Chros Robert (of the Wing Dommander fame)

\- Project Infinity, Torment Tides of Numerena, Wasteland 2: isometric RPG

\- Kerbal Space Program - non-combat space sim (it's less of a game and more of an awesome space-nerd sandbox, but I think it should deserve a mention)

<comment><USER13> Of those, XCOM is the only game that exists. Star Citizen, Project Infinity, Torment Tides and Wasteland 2 are all Kickstarter-funded games in development. Kerbal is available, but not finished, and as you say, not really a game.

Sure, there are some interesting games in development (I'd add the Elite remake and Double Fine's untitled adventure game to the list), but who knows what they will be like. We don't know if they will be "quality".

</comment></comment></comment></comment></comment><comment><USER14> LucasArts old games were essentially perfect adaptations of 90s cartoons that never existed. With everything from the exaggerated art and sound effects, to dialogue that caters to both childish and adult humor, LucaArts games perfectly took the _feel_ of 90s animation and packed it into a couple of floppies.

I don't think it's unusual that games like Day of the Tentacle are still popular today when people still talk about 90s cartoons like Rocko and the Batman, and 80s action movies like Terminator and Die Hard. Media today tries to emulate that nostalgic feeling, but there's this undefinable element that distinguishes the time period. Years from now, people will yearn for early 2000's FPSes and we'll remember how games like HL2 and CoD defined this period.

</comment><comment><USER15> I'm in a good position to answer this: because they're AWESOME.

My girlfriend's never been a gamer, but she's been playing some games recently (specially Minecraft spiked her interest).

I finally convinced her to play some Lucasarts classic adventures some months ago. She loved them. Went through the whole Day of the Tentacle in three days on her own! No walkthroughs. I didn't even help her once. She was obsessed with it! Now she's eager to play more adventure games and looking forward to the new release of ResidualVM (Grim Fandango's engine reimplementation) which she left halfway through because she met a nasty blocker bug.

Lucasarts adventures are and will be all-time classics because they're genuinely good. The plots are engaging, the dialogues are real fun and they're good intellectual challenges.

I play the games regularly, at least once a year (the whole collection!) and I still enjoy them. There's always something left to explore, an action you didn't try, a line you didn't pick... and just like The Simpsons, you can re- experience them several times as you grow older (the funny jokes are not the same when you're 8 then when you're 21).

</comment><comment><USER16> There was always something very accessible about SCUMM games (not just LucasArts ones, but they certainly had some great ones). The story lines were simple and playful enough for kids to enjoy--even 8 year olds can understand the humor in an evil purple tentacle trying to take over the world, or a talking dog and rabbit solving crimes, or a quiet biker trying to repair his motorcycle.

It didn't take an intricate story or fast-paced action to set the LucasArts games apart from the competition. It was how simple, yet outlandish the plots were. 15 years later, I can still remember using a crowbar to remove a coin from the ground that was stuck there by chewing gum in Day of the Tenacle, or Ben Franklin naming a sandwich after a main character (Hoagie). I remember SCUMM games much in the same way I remember the plots of my favorite books I read as a kid. For me, they were much more like interactive novels or comic books than they were like video games. I remember Full Throttle, Dig, Loom, Monkey Island, and Day of the Tentacle in a very different way than I remember the other video games I played at the same age (Final Fantasy, Link to the Past, Super Mario World).

If you haven't had a chance to play any of these wonderful titles, I would highly recomend you grab the ScummVM and play some of the freeware titles (even if they aren't LucasArts): <http://wiki.scummvm.org/index.php/Where_to_get_the_games>.

</comment><comment><USER17> Here is the article on a single page rather than split across 6 pages.

[http://www.gamasutra.com/view/feature/189899/why_are_we_stil...](http://www.gamasutra.com/view/feature/189899/why_are_we_still_talking_about_.php?print=1)

</comment><comment><USER18> I don't even know why people are having this conversation. Most of those guys from Lucasarts' golden age left to form a studio called Double Fine.

<comment><AUTHOR> It was just a good excuse to talk about our favorite games. I haven't played any of the Double Fine games yet, but to my knowledge they haven't made any classic point-and-click graphic adventures - before the kickstarter-backed Broken Age that is [1]. I hear the old talent is still evident in the DF games though, and they seem to be story and character based.

[1] <http://www.brokenagegame.com/>

<comment><USER12> While not a point and click, Psychonauts is widely considered to be a worthy successor of the golden age Lucasarts craziness. Let's have a look at the synopsys: a runaway circus boy goes to a summer camp for psychics lead by a international team of superspy. He discovers that a mad dentist is stealing everyone's brain by making them sneeze, and in order to get him he has to travel into the mind of several deranged persons. Certainly on par with the purple tentacle trying to take over the world or the deathly travel agent, if you ask me :) .

Also, while not being a point-and-click game stricto sensu, you should really have a try at Stacking. It maybe not as brilliantly written as Psychonauts, it has some pacing issue but it's a really charming adventure (with Matryoshka dolls !) from the start to the end !

<comment><USER19> I would not consider Psychonauts a worthy successor, nor do a wide section of people who have tried it. A good deal of the issue seems to be exactly because it's not a point and click - it's actually a 3D platformer with a number of playability issues. Most point-and-clicks have major playability shortcomings as well, but they're such different breeds that the appreciative audiences are distinctly different.

</comment></comment></comment></comment><comment><USER20> FWIW I've been a huge fan of indie developer Wadjet Eye Games, who have continued to make old-school adventure games in the modern era (all available on Steam). <http://www.wadjeteyegames.com/>

<comment><USER13> Ooh, they are the ones who made Gemini Rue [1], which is _great_. It's a low- rez game that looks a lot like Beneath a Steel Sky. Impeccable cyberpunk design, interesting story, very well written. (Gemini Rue is for Windows, but it's playable on the Mac via Wine. Happy to explain how, if anyone is interested.) I didn't know about their other games.

Edit: Oh, they are a publisher. Gemini Rue was not created by them. Anyway, looks like they have quality stuff. Will be checking out their other games.

[1] <http://www.wadjeteyegames.com/gemini-rue.html>

</comment></comment><comment><USER21> I think the most interesting bit is on the last page:

 _While other game companies of the 1980s had to rely on the income from their games to survive, we had the unheard-of luxury of taking our time to get our games right, with years to experiment, try new things, push the envelope, and with no pressure from marketing, focus testing, or even George Lucas. We also had time to develop our company culture, starting where the Lucasfilm culture left off.

So we'd spend months thinking about our games... brainstorming with the other brilliant designers, refining, reworking, revamping, tossing out the parts that didn't work (or the entire concept) and starting again. One of our edicts was "don't ship shit" and we wanted to make sure we never did.

Maybe working in a creatively supportive environment like that, one that wasn't just focused on the bottom line, enabled us to think outside the box, take time to add tons of backstory and detail... tune, tune, and tune again. Until WE felt it was time to ship. Unheard of then and I'm sure even more unusual now (other than with indie games done by people in their spare time)._

</comment><comment><USER22> Point-and-Click Adventure is my favorite genre... LucasArts made great games but I'd have to hand the crown to Sierra for King's Quest VI.

</comment><comment><USER23> For the same reason we still talk about Planescape: Torment - quality writing is quality writing.

<comment><USER24> I'm not sure if I should mention this here, since it looks like an ad, but that also happens to be on sale this weekend (along with a bunch of other D&D games) at gog.com. It's $1.99. I'm not sure if that's the price for it by itself or if it's in the bigger bundle.

</comment></comment><comment><USER25> The games you played as a kid will always be the best ones.

</comment><comment><USER26> Not mentioned in the article (strangely) was the innovative music system in X-wing, iMuse, where the music dynamically and seamlessly shifted depending on the situation. It's surprising how useful and immersive that was from a game play perspective and it was often my only cue not only that enemies were inbound, but how large the threat was (squadron vs capital ship). I admit there's some nostalgia here, but how often do you play games scored by John Williams?

Perhaps not the first time it's ever been done, but their execution of it was amazing. Lucasarts was literally a game changer.

</comment><comment><USER27> From the LucasArts final final party tonight: [https://www.dropbox.com/s/1u95h9n5y9ytv8j/2013-04-05%2017.20...](https://www.dropbox.com/s/1u95h9n5y9ytv8j/2013-04-05%2017.20.20.jpg) [https://www.dropbox.com/s/1jyp0i5cvpuujhm/2013-04-05%2017.22...](https://www.dropbox.com/s/1jyp0i5cvpuujhm/2013-04-05%2017.22.20.jpg) [https://www.dropbox.com/s/x9j2x7g6wfqavlj/2013-04-05%2017.19...](https://www.dropbox.com/s/x9j2x7g6wfqavlj/2013-04-05%2017.19.04.jpg)

</comment><comment><USER28> I'm of two minds when it comes to LucasArts. In both graphic adventures and in space shooters, they owned the genres with quality games, which is great. The problem is that because they so totally dominated, all competition left to pursue other branches (mostly to FPS, it seems). When they stopped development in those genres, there was nobody remaining to fill the void. Those genres are now the sad, atrophied remains of what used to be pillars of computer gaming.

<comment><USER29> Sierra was just as big if not bigger in graphic adventures. Same with Origin in space shooters.

</comment></comment><comment><USER30> I was not a Sierra adventure fan (except Gabriel Knight), but I loved EVERY ONE of the Lucasfilm Games. Why? I think they managed perfection in these four areas:

ACCESS, FUN, CHARACTERS, DESIGN

ACCESS: You fired up the game and could immediately start playing. Most of the games had no or very short intros or cutscenes. Lucasfilm was very strong at telling the story throughout the game. "I'm Guybrush Threepwood and I wanna be a pirate" -> There you go!

Controls were also very easy, I think they were even the first games that you could play through by only using your mouse. That's important, because you could just literally lean back and play.

FUN Maybe it's just me (obviously not) but Gilbert's and Schafer's writing style, that's my idea of fun! Well written, perfectly executed and timed. Often with very few or no words at all. Sometimes Bernard or Guybrush just turned to you and said nothing…all said!

CHARACTERS The teams put a lot of effort in creating unique characters. Why the hell do I know names like Guybrush, Elaine, Stan, Bernard, Hoagie, Laverne, Ben, Bobbin, Manny, Glottis; but I can hardly remember any other adventure game character names. It's because I was emotionally bounded with them. They were mostly struggling with their environment but managed their obstacles often with unorthodox methods.

DESIGN Especially Ron Gilbert and Hal Barwood established adventure game design that is still considered standard today. Brought to fame by Ron's article "Why adventure games suck – And what we can do about it" (<http://grumpygamer.com/2152210>). This article still inspires me today and I'm throughout checking my designs against it.

</comment><comment><USER31> Here's a provocative thought: RPG games have boomed because they're the descendants of point&click adventure games. I'd like to have the name "cRPG" changed to "Adventure". It describes much better what the game is about, the majority of players doesn't care about role playing, and many cRPG games don't even support that. Diablo is often called Action RPG for some reason despite not offering a choice at all, the story always unfolds in exactly the same way.

Anyway, old point&click games were usually about a story. Now cRPG games are the vessel for that. Exploration is also crucial to both genres, I know of no cRPG game which takes place in the same area, where variety comes from changes, events, new people arriving rather than unlocking new zones. Baldur's Gate 2 and Planescape: Torment are a good example of what I'm talking about - both have big cities, but what you're really doing is getting access to new areas within them.

</comment><comment><USER32> I remember even the copy protection puzzles of these games! This attention to detail and charm is hardly found anywhere today.

<comment><USER33> the DIAL-A-PIRATE!

I still have it somewhere!

</comment></comment><comment><USER34> There was an episode on the topic of resurrecting the adventure-game genre (and what exactly made it so special to us) this week on Extra-Credits: <http://penny-arcade.com/patv/episode/raising-the-dead>

I highly, and wholeheartedly recommend checking the rest of extra-credits series, for anyone interested in game design, gamification, and the gaming industry in general:

<http://penny-arcade.com/patv/show/extra-credits>

And specifically those of you creating experiences: <http://penny- arcade.com/patv/episode/gamification>

</comment><comment><USER35> Going to go and play Indiana Jones and the Fate of Atlantis after reading this post... For the 5th time.

Today's game are total crap. Just kids shooting and killing each other, DRM issues and a corporate veil set out to destroy the experience. Bullshit

<comment><USER36> Does anyone remember what the "in my time, everything was better" fallacy is called? I forget.

Anyway, if you really think today's games are total crap, you haven't played masterpieces like Braid, Fez, Limbo, etc. Stop playing total crap.

</comment></comment><comment><USER37> All that and no mention of _Rescue at Fractalus_, _The Eidolon_ (An 8-bit FPS 11 years before Doom), _Koronis Rift_, or _Ballblazer_? I'm getting old...

<comment><USER38> Koronis Rift and Ballblazer are mentioned on page 5:

> > [http://www.gamasutra.com/view/feature/189899/why_are_we_stil...](http://www.gamasutra.com/view/feature/189899/why_are_we_still_talking_about_.php?page=5)

"LucasArts games have always had a special place in my heart; from Loom to Koronis Rift to Ballblazer and the Monkey Island series. [...]"

<comment><USER37> I post corrected!

Still, relating this to storytelling, I continue to believe that the single most terrifying moment in a video game, to this day, occurs in _Rescue at Fractalus_. Everyone I know has literally fallen backwards in their chair at _that moment_.

But since all the people I allude to are now old fogies, it would be interesting to see the reaction of someone a lot younger who went into the game unaware and played up to that point, a point integral to the gameplay, and to see if they instinctively do the right thing to address it.

Good times, good times...

</comment></comment></comment><comment><USER39> DOTT sold me to PC games.</comment>


Google's Waymo risks repeating Silicon Valley's most famous blunder - <AUTHOR> https://arstechnica.com/cars/2019/02/googles-waymo-risks-repeating-silicon-valleys-most-famous-blunder/ <comment> B-Con > In his influential 2011 book The Lean Startup, Eric Ries advises companies > entering a new market to develop a "minimum viable product"—the simplest > product good enough to attract paying customers. This strategy allows a > company to begin selling real products to real customers—and get real market > feedback—as quickly as possible.

I think the problem is that they're only interested in selling fully autonomous self-driving vehicles. There's very little market advantage in selling a "mostly" self-driving car, and Waymo doesn't want to be in generic car sales for years until they're ready. So they have to hold out for the 0 to 100 switch flip.

And they don't get to make mistakes and iterate on core functionality, so they have to wait. People's lives and schedules will be at the mercy of these vehicles, in a wide variety of operating contexts. They have to get it 100% right. If they kill people the brand itself is potentially dead.

So the picture is they need to go 0 to 100 with near 100% accuracy. Anything less is at best brand dilution or at worst corporate suicide.

Tesla's approach matches the MVP idea more closely since they can add small features incrementally. Presumably their eventual goal is to be able to say "with this update your car is now fully autonomous". But they're in the business of selling cars to begin with, so every release short of full autonomy is A-OK. Autonomy is a feature, not the product.</comment>


Facebook Releases Data, Including All National Security Requests - <AUTHOR> https://newsroom.fb.com/News/636/Facebook-Releases-Data-Including-All-National-Security-Requests <comment><USER3> I may be part of the minority here, but I have/see no reason to believe the Facebook is lying about these numbers, or lying about the fact they actually check every request, and don't have a NSA backdoor. If I am correct, they only thing that shows Facebook has given the NSA/government agency access to their servers is a leaked PowerPoint presentation. I believe it is more than likely that one of the following two options is true. (1) The PowerPoint is just wrong, and was made it up someone working for a government contractor. (2) The PowerPoint is inaccurate in that these corporations have complied with the government, when asked to and required by law too, through the use of warrants, both secret and otherwise.

Personally I think option 2 is the most likely scenario. Facebook (and Google and most of the other named corporations) have done nothing to lose my trust in them. The only party that at this time, I know is to blame is the NSA/government for conducting a cloaked surveillance operation on the entire US population. Until there is proof, or a reasonable argument, showing that these corporations willingly complies with the NSA and were a part of PRISM, I don't think they have lost any substantial part of my trust.

<comment><USER4> The problem is that before these leaks, the Director of National Intelligence was asked point-blank in a congressional hearing whether or not the NSA was conducting surveillance on Americans, and he unequivocally said no. Given that history, I think it's prudent to approach the veracity of further denials with caution.

It's true that Facebook is not the US government, so perhaps we should be less hesitant about the claims _they_ make. However, Facebook does have a history in this area that gives me some pause. Their former CSO was Max Kelly, who is ex-FBI, and would give talks about shit like the need for "uniting" military and commercial "cyber defense." So to the extent that we're dependent on Facebook's internal narrative to determine how they respond to the US government, my sense is that at Facebook, much of that narrative was set by someone who is largely sympathetic to government cooperation.

I think you're correct in pointing out that the NSA is ultimately to blame. However, I think we should acknowledge that while companies like Facebook obviously do not have malicious intent, they are still in the surveillance business. What they are building does have some inherent danger, and will continue to attract the interest of the US government, foreign governments, and attackers.

<comment><USER5> I wish I saw more people hammering home the point you made in the first paragraph. Too many people are looking for ways around discussing what is just as an important piece of this puzzle as the leak itself: The director of National Intelligence _lied to the Senate_. To their faces, through his teeth, on camera, in front of the American people.

I'm in the camp that Senator Wyden asked the question in such a way because he _knew_ what the answer was going into the thing.

At this point, you need to start looking at everyone as a suspect. It's an uncomfortable notion, we might not like it, but it's a reality pill ya gotta swallow.

<comment><USER6> And also Obama promised no surveillance before winning the first election. It took him weeks to change his mind.

<comment><USER5> I'm sure it's all shrouded in "classified" and "top secret" tape, but I'm intensely curious to know what President Obama knows that Candidate Obama doesn't.

Maybe it's the same thing all presidents learn their first couple of months in office. Maybe it's a memo that gets placed on the desk in the Oval Office by some shadowy figure. Whatever the case, the honeymoon is over, folks.

<comment><USER7> I suspect that it was much like the "too big to fail" scandal. President Obama was new to the game and let the people who said they knew what they were doing run the show. On one hand he's got the feel-good speeches he made as a candidate and on the other hand he's got agencies and contractors with billions of dollars of budget on the line all pushing as hard as they can to justify their existence and their budgets. The inertia alone was probably impossible to defeat given how divided his focus was (the economic collapse and the two years of obamacare politics come to mind).

</comment></comment></comment></comment></comment></comment><comment><USER8> You can't believe anything these companies say. If they are ordered to misreport info to the public, they will. Remember that companies are not monolithic things. They are made of people, and if anyone or a group try to make a stand they will be hunted down. It's easier to follow along than be honest.

Personally, I won't trust any of these companies until the entire Homeland security dept is dismantled and its component agencies restored to their pre-9/11 statuses.

And although the TSA is not directly part of this spying issue, they need to go away as well. It's all part of the same shadowy cabal and its time for a clean slate.

I'm not against the principles of the FBI and NSA. They do a lot of good work. But there's too much dry brush and weeds cluttering up their mandates and it needs to be burned out.

<comment><USER9> And it's very easy to release misleading statements like this. It's great to know about all the "user data requests" from law enforcement, but they mention nothing about the allegation that NSA didn't need to submit these requests.

<comment><USER10> If there's slipperiness in this statement, I think it's probably in the use of the term "user data requests".

>The total number of Facebook user accounts for which data was requested pursuant to the entirety of those 9-10 thousand [ _user data_ ] requests was between 18,000 and 19,000 accounts.

Is a "user data request" a request for data about a specific user? Would the request "give us the names and birthdays of everyone that has searched for 'discontent with government'" constitute a user data request? Or would that be a "search term request"?

I'm not sure I think this is slippery language, but there's definitely room for that interpretation.

<comment><USER11> If there is slipperyness it's the fact that the guy who wrote this and is Facebook General Counsel, Ted Ullyot, use to be G.W Bush's right hand man.

<comment><USER12> If character assassination is wrong when they do it to Snowden, why is it right when you do it to Ullyot? Did he lie or did he not?

<comment><USER13> I don't view it as character assassination so much as suspicion by association. He was part of the group (Bush + Obama Administrations) that pushed for these programs. It makes him _more_ suspect to be lying than a random person. It's not proof of a lie, just reason for scepticism (grain of salt and all that).

The stuff about Snowden doesn't even make any sense. The fact that he's a high school drop-out doesn't matter. Some people who drop out of high school have a lower intelligence, but that doesn't imply the Snowden does. The fact that he worked for the CIA, the NSA, and as a NSA contractor actually implies that he is either intelligent or the CIA/NSA are incompetent. Even _if_ Snowden was of lower intelligence, it would imply that there is less likelihood that the documents are elaborate fakes, and more likely to the be the real deal.

</comment></comment></comment></comment></comment></comment><comment><USER14> A great deal of the comments here border on being ridiculous conspiracy theories. I know that when it was "revealed" to us that the NSA had direct access to Facebook, it was a green light for many to share their formerly private conspiracy theories as if they were now completely validated. With the revealed claims being bogus, the "validated" conspiracy theories are once again naked.

Of course, it comes as no surprise that when the sensationalized Greenwald claims were walked back we'd hear that it was all a cover-up and the NSA is threatening to throw Zuckerberg in jail and drone strike Snowden, etc. There is literally nothing that could possibly happen that would convince some people that Greenwald was full of shit.

</comment><comment><USER15> I hope Edward Snowden sees this. He and Glenn Greenwald should be proud.

The economics of surveillance have now changed because it comes with reputation effects on US based companies.

<comment><USER16> That's a massive load of shit, the 'economics of surveillance' is a drop in a _very_ large bucket.

Most people don't give a shit about surveillance and half the people that do care think it's great.

This blog post is damage control to avoid getting banned across the world since it's become painfully clear that Facebook is inseparable from the US Government.

<comment><USER17> Most people don't give a shit because it does not effect them. If we can show them that it does effect them, their opinions will change. And it does effect everyone, because if you have to worry about explaining what you say to other people or face consequences then freedom of speech and freedom of conscience is effectively dead.

</comment></comment></comment><comment><USER18> From first-hand experience, Facebook is overly protective of user data when it comes to state and local law enforcement requests (I obviously don't know about the NSA side). They provide very little on initial subpoenas and require warrants for anything more. In fact, most law enforcement are angry at how little Facebook will reveal about a suspect.

<comment><USER3> If you don't mind me asking, what level of law enforcement are you involved in? Are you a officer or are do you work more on the DA/attorney side?

Just curios, that's all.

<comment><USER18> I support Crimes Against Children investigators on the tech side. I'm a civilian.

</comment></comment></comment><comment><USER19> With all of the secrecy and secret gag orders, and all of the blatant, proven lies, how on earth are we supposed to trust anything anyone says about this issue?

Why aren't people getting fired and prosecuted for lying to the American public?

<comment><USER20> Because the American public simply doesn't care.

As a Brit this is the attitude the US is currently projecting.

Of course as a brit I suspect our programs are far more invasive than anything the NSA has cooked up (so far).

<comment><USER21> *insert reference to 'Spooks' here.

</comment></comment></comment><comment><USER22> While I've never believed their statements...

..by their own account this is ~50 "intercepts" per day, on facebook alone... that's more than 2 per hour, every hour, for 6 months.

<comment><USER23> That's a remarkably low rate, considering that it includes all levels of law enforcement. For instance, around 2000 children are reported missing in the US every day. I would expect a lot of those to lead to local police to ask to see the child's Facebook data, and that alone could account for most of the requests.

Now throw in all the other ordinary crime local police deal with every day, and I'm completely astonished that Facebook only deals with 50 requests a day.

</comment></comment><comment><USER24> All this conspiratorial thinking is all very X-Files "I Want to Believe" and stunningly short on rational thinking. Consider:

1\. Let's accept that Facebook, Google, Yahoo et al are rapacious profit- oriented corporations who could give a crap about anything but their own self interest. Fine.

2\. At this point, given the statements made, in order for there to still be some kind of "back door" direct access to all of their DBs by the NSA, it would involve direct, bald-faced, massive lies to the public about its existence by top management.

3\. What would the _cost_ be to these companies be if these were revealed to be massive lies? I'm not talking about the government granting immunity from prosecution, which most commentary seems to focus on. I'm asking, how would customers react?

Answer: _Their business would blow up._ Revelations of lying at this scale, completely destroying their credibility, would literally threaten the entire existence of their companies. It would be a stupendous business risk to take on.

4\. What is the _probability_ that such a massive lie would be revealed? Consider that to facilitate broad access to company datasets there would need to be a bunch of technical staff in on the conspiracy -- and not just at one company. This allegedly involves _most_ of the major Internet companies. A whistleblower at any _one_ of them would blow it for everyone.

So, in order for any one company to participate in the conspiracy, they would need to take a bet-your-company risk that _all the other companies_ would keep a lid on it.

5\. Finally, now that we've reviewed the downsides, what's the upside? What would the _benefit_ to these companies be of lying? Some commentary has suggested they obtained privileged information about competitors or foreign attackers (e.g. Google & China). Ok. How does that benefit compare to the risk of _nuking billions of dollars in value overnight_ if your company's credibility with customers is utterly destroyed?

I am all for more public oversight of the secret courts governing these requests for data. The Verizon order is extraordinarily broad, and we can't have much confidence that even the relatively small number of monitored Facebook accounts aren't abuses. But this idea that Facebook, Google etc. are lying to the public about their role just doesn't stand up to scrutiny.

<comment><USER25> Large companies keep government secrets every day. What do the employees have to gain? It's called not going to prison. There are ~4M cleared individuals in the US right now. They keep secrets every day. It would not be hard to put a team into place of cleared workers and literally seal them away in contained rooms and tell everyone else to go away. They're called SCIFs. You go in and leave your cell phones outside with any other electronics and do your top secret work. On the outside they appear as normal offices. My point is, this industry already knows how to work without you knowing anything. You're basing your hunches on faith and naivety about how intelligence agencies work.

<comment><USER24> I think frankly it is you who doesn't understand how intelligence agencies work. Massive conspiracies have leaks. No agency would set up something as broad and involving as many people as you describe and expect it to stay secret.

Also problematic is your theory about motivation. That Mark Zuckerberg and his chief legal officer are compelled to take bet-the-company risks and lie to their shareholders under threat of prison. There is no such law. They are only restricted in how much they can reveal about the requests for info.

<comment><USER25> 1\. It wouldn't have to be a massive conspiracy. It would just require access to the data through a few people. It's called compartmentalizing and it's how they work.

2\. There certainly _are_ laws that govern classified information and the gathering of it. Leaking US government secrets is against the law, period. Are you arguing that's not the case? Verizon was _required_ to assist the government by law. What makes FB and Google+ exempt from the same rules?

You can dig further and find out I'm not just making stuff up. This really is how they work, frankly.

</comment></comment></comment></comment><comment><USER26> A fraction of a percent of US citizens are wrongly incarcerated. I'm not sure what relative numbers even mean here. 19,000 people under scrutiny is still scary to me.

<comment><USER27> Unfortunately it's not a fraction of a percent.

2.2 million people in prison in the US at the moment.

That's probably about 1.5 million that are "wrongly" incarcerated (extrapolating based on the number of people in prison before the war on drugs began, and what it should be today based on population growth). They're political prisoners.

This graphic nicely sums up the obviousness of that:

[https://upload.wikimedia.org/wikipedia/commons/6/67/US_incar...](https://upload.wikimedia.org/wikipedia/commons/6/67/US_incarceration_timeline- clean-fixed-timescale.svg)

<comment><USER26> Well that's my whole point; half a percent of the population, which is what I also calculated when writing my original comment and consider a fraction, being wrongly incarcerated is an atrocity so Facebook's "fraction of a percent" means nothing to me.

</comment></comment></comment><comment><USER28> The trust is gone. They shouldn't have waited until they were caught red- handed to come up with some numbers. Doesn't even matter if it's correct now. No one will believe them.

<comment><USER12> If there is no way for them to regain trust, or make people whole in any way at all, then what reason do you leave for them trying to improve transparency? What should the Zuck do, commit seppuku? Is that what would make people happy _going forward_?

<comment><USER29> There is no way.

The government has already shown us how they are fully capable of lying, and even worse - forcing companies under their control to lie.

<comment><USER30> Yes, it's pretty clear that the DNI lied to Congress. But it is untrue that FedGov can force companies to lie. Neither AT&T nor Verizon lied: [http://news.cnet.com/8301-13578_3-57589012-38/nsa- surveillan...](http://news.cnet.com/8301-13578_3-57589012-38/nsa-surveillance- retrospective-at-t-verizon-never-denied-it/)

<comment><USER29> Did you read the PRISM denials?

It was very obvious that the companies were told exactly what to say. They might not be lying in a grammatical legal sense if you parse their words, but they were clearly told by someone how to deny everything.

<comment><USER30> I've read all of them. I've written about them. They're categorical.

</comment></comment></comment></comment></comment></comment><comment><USER31> > a tiny fraction of one percent of our user accounts were the subject of any > kind of U.S. state, local, or federal U.S. government request (including > criminal and national security-related requests) in the past six months.

Nice try, Facebook. Key words, _in the past six months_. The NSA could've requested a continuously updated copy of all user data more than six months ago.

<comment><USER32> But it says " _were the subject_ ... in the past six months".

<comment><USER31> "were the subject of [a] request", not necessarily the subject of the data the NSA is reading.

</comment></comment></comment><comment><USER10> I'm pretty surprised they've been given the go-ahead to release this. Typically, these agencies would never consider such a thing, especially under pressure.

If I were more trusting, I suppose I would see this as a nice evolution toward a more transparent state of affairs. But it's uncharacteristic of these agencies and the state of affairs that has been going on.

I find it hard to believe they would move so quickly to pull back some of the secrecy they've imposed if they weren't expecting a great deal of scrutiny for what we've yet to learn.

<comment> brown9-2 It's already been reported that you can expect to see more disclosures from the DNI and NSA next week. I think the government understands that the past week has been bad for them - and that it's bad for all of us if Americans have recent to doubt their government.

You can also look at it as they would like a chance to correct bad impressions given by inaccurate or incorrect reporting (we can't really judge this yet).

</comment></comment><comment><USER33> Am I to understand that this:

>The total number of Facebook user accounts for which data was requested pursuant to the entirety of those 9-10 thousand requests was between 18,000 and 19,000 accounts.

Is global? As in, 19,000 accounts in total across the globe over the past six months? The description of the requests is "all U.S. national security-related requests (including FISA as well as National Security Letters)." Or is this just the number of persons 51% likely to be a US citizen?

<comment><USER34> It says " the total number of user-data requests Facebook received from any and all government entities in the U.S. ", which I take to mean the target accounts may or may not be US citizens, but the requests came from US government agencies.

International government agency requests, which I assume they also comply with in certain situations, would be not included.

</comment></comment><comment><USER11> Ted Ullyot, Facebook General Counsel

[http://en.wikipedia.org/wiki/Ted_Ullyot](http://en.wikipedia.org/wiki/Ted_Ullyot)

"From January 2003 to January 2005, Ullyot worked in the White House as associate counsel and as a deputy assistant to President George W. Bush. He then served as chief of staff to U.S. Attorney General Alberto R. Gonzales."

<comment><USER3> What point are you trying to make here? Are you just saying that Facebook's general counsel has ties to the Government? Because if so I fail to see how that relates to the current controversy. Many people have connections, and previously worked for the Government, and didn't have any knowledge or control over any of this.

<comment><USER11> People were discussing the legitimacy of this release. I read the release, googled the authors name and I thought his history relevant to the conversation. Not just ties 'deputy assistant to President George W. Bush'.

</comment></comment></comment><comment><USER35> Is there any practical way for them to actually prove this is the complete number, rather than the number they're allowed to tell us about?

<comment><USER36> What would you accept as proof?

<comment><USER37> Vivisection. Public vivisection.

Strap these organizations down and cut them the fuck open with no regard for their wellbeing. If the procedure kills them, then so be it.

There is a threshold past which live dissection ([https://en.wikipedia.org/wiki/Stasi#Recovery_of_the_Stasi_fi...](https://en.wikipedia.org/wiki/Stasi#Recovery_of_the_Stasi_files)) is the only way that trust can be restored. I assert we have _run_ across that threshold. _And before anyone whines about it_ ; no, we are not as bad as the Stasi yet. The Stasi do not represent the position of the threshold, they were miles past it.

<comment><USER35> Incidentally, this would be a great advance on Zuckerberg's professed goal of making the world a more open place. Safer or better would be arguable - <USER2> open would not be.

<comment><USER37> Oh, don't get me wrong, we certainly should not start with Facebook.

Going after Facebook would probably be unnecessary after we were through with the accused government organizations. At that point Facebook's innocence would either be clear, or it would be clear that Facebook was a victim in this. If we found reason to believe both of these were not true, then we could pursue them as well.

</comment></comment></comment></comment></comment><comment><USER38> Assuming we believe the numbers, it seems pretty clear PRISM was not the drag net it was originally portrayed as. 19k accounts over 9k requests is not mass access.

There is,however, a readily confirmable and some what plausible alternative: Facebook's numbers are low because no one the NSA is interested in (e.g. AQ, China, Wikileaks, maybe even Occupy) uses Facebook heavily.

If Google and Microsoft aren't allowed to release numbers, than we should actually be concerned about this possibility.

</comment><comment><USER39> It makes me kind of cynical that suddenly the security agencies get all friendly and start being "flexible" when they suddenly realise it's in their own political interest to do so. Until exactly this point they would have put people in jail for even mentioning these numbers. Now, oops, that was a stretch too far, we can all be reasonable can't we? So was it about security in the first place? or not?

</comment><comment><USER40> The issue to me is if the so-called "upstream" actually stores all the raw SSL data, and how fast it's decrypted. This is apart from any corporate cooperation, except for the Mark Klein AT&T splitter variety. (Unless of course Google, Facebook, etc are handing over their private SSL keys.)

</comment><comment><USER41> > a local sheriff trying to find a missing child

As worthy as these cases might be... this is not a national security issue. This kind of case should never use any law regarding national security. This is a regular police investigation, and as such, should require a regular old subpoena or warrant.

<comment><USER23> They did not say that those requests use national security laws. They are just giving us the total number of accounts they have released information on regardless of what law was used to compel release.

<comment><USER41> Ah, you're right, now that I read it closer, that is the case. Thanks for the clarification.

</comment></comment></comment><comment><USER42> > "We hope this helps put into perspective the numbers involved, and lays to > rest some of the hyperbolic and false assertions in some recent press > accounts about the frequency and scope of the data requests that we receive"

God Damnit! When did we start using the total number of violations of the fourth amendment as the yardstick by which we measure it's importance or relevance to a reasonable expectation of privacy? "Hey, hey, hey... we _ONLY_ violated 'x' number of people's rights. Not the 'x' times 'y' you are accusing us of doing, therefore..."

Putting that aside for just a moment, their response lumps in and equivocates the well-intentioned, and IMHO well-justified, search for a missing child with fourth amendment violations of millions of American's under the guise of national security and terrorism.

They still don't get it. The government still doesn't get it. Feigning outrage is not a good transparency policy.

I've never once considered myself a Libertarian. It's never so much as crossed my mind. I'm not even an excitable or rash person. But the recent exposure of the breadth and scope of the shielded activities of the NSA has caused me to give a long, hard, well-reasoned review of how I vote.

<comment><USER42> [http://www.theverge.com/2013/6/15/4432368/google-opts-out- of...](http://www.theverge.com/2013/6/15/4432368/google-opts-out-of-fisa- disclosure-deal-made-by-facebook-and)

Apparently, it was an agreement based on negotiating between the companies in question and the US Government. It makes me sick to my stomach that in spite of the relative uselessness of the exact count of requests, that the Government is just as interested in presenting a positive spin as they are claiming that the acknowledging the mere existence of the requests presents a risk to national security.

</comment></comment><comment><USER43> "the total number of user-data requests Facebook received from any and all government entities in the U.S."

It's common for 3 letter agencies to set up a corporation to handle their dirty work. I wonder if a front organization would be considered a government entity?

[http://en.wikipedia.org/wiki/Front_organization#Intelligence...](http://en.wikipedia.org/wiki/Front_organization#Intelligence_agencies)

<comment><USER44> But Facebook does not need to answer any request from a non government entity.

<comment><USER30> More than that, they vigorously oppose such requests in court, as my article here revealed: [http://news.cnet.com/8301-13578_3-57518086-38/facebook- fight...](http://news.cnet.com/8301-13578_3-57518086-38/facebook-fights-for- deceased-beauty-queens-privacy/)

</comment></comment></comment><comment> grey-area Great to see these numbers from Facebook - hopefully now Google can do the same, and report numbers that should have been public in the first place (and that they probably would have liked to make public). I can't see any justification for saying that they're lying, and frankly think it is verging on conspiracy theory to say they are, why would they bother releasing anything at all? Though broader in scope than many (including myself) would like, this tallies with their initial statements, and with a system as described in the PRISM documents (which are pretty vague anyway). Of course this isn't the entirety of the information the NSA is collecting, and probably not the entirety of data from FaceBook if they are also harvesting traffic, but it could very well be everything FaceBook knows about.

The thing that worries me most about all this collection is that the NSA probably never deletes any of its data (as evidenced by their massive storage facilities being built), so eventually they can build up quite a large store of complete data on people if they just keep collecting from various sources gradually over time.

<comment><USER45> Google already publishes this: [http://www.google.com/transparencyreport/userdatarequests/US...](http://www.google.com/transparencyreport/userdatarequests/US/)

<comment> grey-area They don't publish all requests including fisa requests, I think they're still negotiating about that. See the first sentence of the page you linked.

</comment></comment></comment><comment><USER46> I wonder if this is something that Google and Co. will also be allowed to do?

<comment><USER47> They already do. Google have been publishing statistics and reports about this stuff for a while:

[https://www.google.com/transparencyreport/](https://www.google.com/transparencyreport/)

None of this is relevant though. These are _legal_ requests. The issue that people should remain focused on is whether or not the NSA has _illegal_ , ongoing, unfettered access to wholesale data under PRISM or other programmes.

<comment><USER48> Google does not publish information about requests which come with a gag order. They were the first to request the ability to publish that data several days ago, followed by Facebook and others shortly after. Facebook is the first to publish updated statistics with the numbers from National Security Letter and FISA warrants included after being granted permission. Google presumably will do so soon as well.

<comment><USER30> Incorrect. Google disclosed NSL summary stats months ago. As you say, FISA stats are next. I'd expect them this evening.

<comment><USER48> I stand corrected. They do indeed have the NSL stats, in the somewhat useless 0 – 999 range, here:

[https://www.google.com/transparencyreport/userdatarequests/U...](https://www.google.com/transparencyreport/userdatarequests/US/)

<comment><USER30> Yep, but it was more than any other company in the history of this country has ever disclosed. And give them another 48-72 hours from now to divulge more info.

<comment><USER48> Oh, I agree. I think it's great they're disclosing what they can and pushing to be able to disclose even more. The "somewhat useless" remark was directed more at the restrictions preventing them from divulging more than at Google themselves.

</comment></comment></comment></comment></comment></comment></comment><comment><USER49> The whole concept of a secret warrant is repugnant. A pox on both of them.

</comment><comment><USER50> They don't have to be lying.

19k over 6 months is still quite a large number, I think.

</comment><comment><USER51> All you need to remember about Zuckerberg and Facebook from his quotes here:

Zuck: Yeah so if you ever need info about anyone at Harvard Zuck: Just ask Zuck: I have over 4,000 emails, pictures, addresses, SNS Friend: What? How'd you manage that one? Zuck: People just submitted it. Zuck: I don't know why. Zuck: They "trust me" Zuck: Dumb fucks

<comment><USER52> Zuckerberg, perhaps. Facebook, as in the current Facebook entity, absolutely not.

<comment><USER35> The principle still applies: the information has been submitted, collected, and is accessible to those who ask persuasively enough.

<comment><USER52> You say those who ask persuasively enough, but we only know they've given data to governments, they are legally obliged to do so. I wouldn't say that's the same in any way as giving it to friends.

</comment></comment></comment></comment><comment><USER6> I'm waiting to see what the EFF says about this. Is all the information there? I hope that's the case.

<comment><USER53> Good call. This whole situation is so messed up that the EFF is one of the few agencies I trust. I'm glad to see there's healthy skepticism about the validity of this release though.

</comment></comment><comment><USER43> Why are they only offering figures for the last 6 months?

</comment><comment><USER54> If it's anything like the last 6 months stock market volumes well it doesn't mean shit; it's probably intended to mislead everyone from the mega volume spikes that often do occur. 5 years data might be worthwhile.

</comment><comment><USER55> It is interesting to note what the number of requests is, however, it shouldn't put anyone's mind at ease. This is as much about what the government _can_ do than it is about what they _have done_.

Even if the program has been used "judiciously" by the government to this point (if such a case can be made), it is ripe for abuse. Our protection should come by the law itself, not by the judgment and whim of the Executive (i.e. those executing the law).

Otherwise, we are not much different than a monarchy, hoping for a just king or queen.

</comment><comment><USER56> I would be interested in what Facbook and other internet companies (or anyone else who has a clue) have to say to this article:

"PRISM: Here's how the NSA wiretapped the Internet" [http://www.zdnet.com/prism-heres-how-the-nsa-wiretapped- the-...](http://www.zdnet.com/prism-heres-how-the-nsa-wiretapped-the- internet-7000016565/)

It's a very convoluted and speculative article, but I wonder how much of it is realistic.

</comment><comment><USER57> CNN's news report is pretty good, with coverage of MS' and Google's responses. [http://edition.cnn.com/2013/06/15/politics/data-tech- giants/](http://edition.cnn.com/2013/06/15/politics/data-tech-giants/)

</comment><comment><USER30> I'm surprised that Microsoft's own statistics released about an hour ago haven't made their way to the HN front page: [https://news.ycombinator.com/item?id=5883894](https://news.ycombinator.com/item?id=5883894)

</comment><comment><USER58> Based on everything else I've read, NSA is still sniffing traffic off the wire or something similar.

It's nice that Facebook is pushing for a little more transparency, but they could be telling the absolute truth here and the NSA could still be getting all the data.

</comment><comment><USER59> From Mark Zuckerberg:

      > I want to respond personally to the outrageous press reports about
      > PRISM. ...

Mark Zuckerberg should apologize for calling the activities of the free press "outrageous".

</comment><comment><USER60> 1% of 1.1 billion is ~ 10 million? Doesn't seem like a tiny amount.

<comment><USER61> A fraction of 1% the release says.

</comment></comment><comment><USER62> The "less than one percent" claim is based on the total number of _GLOBAL users_ and the total number of _requests made by U.S. officials_. It is misleading.

</comment><comment><USER63> I think these are true numbers. I assume that everything I put on Facebook is prone to public dissemination anyhow. The whole point of site is to share your data.

</comment><comment><USER64> > from things like a local sheriff trying to find a missing child

So ... why do they need to hide a request for something as 'innocent' as this?

<comment><USER35> They don't, but were either not allowed or not willing to publish the number of requests excluding the non-secret ones or the breakdown of the total number into "innocent" and otherwise.

</comment></comment><comment><USER65> So if people don't trust them, figure out how to verify this. Hint: they are publicly traded companies.

</comment><comment><USER66> Those numbers seem odd. So almost 2 persons are the subject of every request?

<comment><USER12> "Submit profile data for user $FOO and all users $FOO has messaged from $DATE_1 to $DATE_2". I'm assuming it's something like that.

</comment></comment><comment><USER67> How much longer till a similarly-worded release from Google?

</comment><comment><USER47> Everybody here seems to be distracted. The law abiding requests disclosed here could still be served alongside a covert operation. This has no impact on the PRISM scandal.

</comment><comment><USER68> I think this is intended to be comforting, especially for corporate entities as they feel scrapegoated into bad light by the government, but there's very little for the public to acknowledge these numbers. I'm not saying Facebook is lying, I'm saying the people giving Facebook the numbers are probably lying. There's no way to tell.

<comment><USER52> Facebook know how many requests they've responded to. If there is any dishonesty here, it's coming from Facebook. They might have been told to give false numbers, but they've got the correct numbers.

<comment><USER35> There's the shared-private-keys argument, by which they wouldn't actually know how many requests were made. I haven't been followed very closely so I don't know if private keys thing was specifically denied - was it?

<comment><USER52> As far as I know, they deny any sort of blanket availability of data - so a shared private key would seem to be denied under that guise. I think claiming a number as they have, and a number of affected users, would also be denial of that. Circular logic, but we can't do much better. If they're lying and just made up these numbers, there's nowhere to really go with that.

</comment></comment></comment></comment><comment><USER69> Well this is 100% bullshit</comment>


Show HN: SlidesUp API – Quickly build custom experiences for your conference - <AUTHOR> https://apidocs.slidesup.com/ <comment><AUTHOR> Hey HN! We're excited to launch the SlidesUp API. SlidesUp is the hub for all your conference planning activities. With our API, you can now build on top of our platform to power your website, app, digital displays, and whatever else you can dream of.

Event organizers have always wanted to collaborate with their team and market their conference as soon as they confirm speakers. With our organizer tools, anyone can build an agenda, add speakers, and manage those last minute changes. Real-time updates and synchronization across your experiences make sure your attendees know what's going on.

We're excited to see what you build with it!

Try SlidesUp for free by signing up here: [https://slidesup.com](https://slidesup.com)

Come support us on Product Hunt too: [https://www.producthunt.com/posts/slidesup- api](https://www.producthunt.com/posts/slidesup-api)

Happy to answer any of your questions!</comment>


Why it's time to dump the Web 2.0 sobriquet once and for all - <AUTHOR> http://www.news.com/8301-10787_3-9929415-60.html

<comment><USER2> dupe... I posted this earlier.</comment>


Why Startups Suck - <AUTHOR> http://www.entrepreneur2be.com/2008/02/28/experience-the-down-moments-of-entrepreneurship/ Anyone else in that situation? <comment><USER2> Your blog post seems to focus on a dwelling feeling of hopelessness, uncertainty, financial insecurity, without a clear certainty of what to do next. With only a couple hundred bucks and a burn rate of $400 (or 3 months at the most), you're really playing against the odds. I mean, I'm sure there are a lot of people interested in getting $60,000 besides your group. On the bright side, you have a bunch of ideas, and seem to have a willingness to push your limits. These qualities don't go away quickly.

Here's some sage advice I got from one of my mentors: "A good opportunity != a good opportunity for you." Also, it's ok to not start a start up right away. Without knowing all the facts of your circumstance, I would suggest focusing on making your long-term situation better by getting your finances in order, and getting indispensable skills/experience by working at some job (depending on what skills you want to get) and hoarding your money. Spend your nights and weekends figuring out how to spot good opportunities for you, getting a team together, mentors, etc. Six months to a year from now, you should have $10k-15k and be ready to rock. Then you can quit and pursue a good opportunity, reduce unnecessary stress, and increase chances of success.

<comment><AUTHOR> I generally think stepping back for a little bit is ok. After all, this is why I am not a banker like most of my friends around.

I just feel that I have decent chances this time around and I am willing to take the extra. Once those 2 things I am betting on unwind, I will have time to relax and rethink.

Thanx though, considered.

<comment><USER3> Don't listen to the quitters. Your money situation sucks but there are much more limiting, harder to recover from factors that you could be up against, possibly in the near future. Maybe what you should look at now is what you have to lose.

I've worked a day job before which gave me lots of time for a startup but that's not an easy find.

</comment></comment></comment><comment><USER4> I love your music blog. The tracks are smartly chosen but it's not MY music, so it has the new and exciting factor.

Are you guys looking for seed money, by any chance? I'd love to hear your business plan, although I understand your reluctance at spreading it around too much.

<comment><USER5> Send us an email and we can talk. contact at thefeelgood dot com.

<comment><USER4> Sounds great. I'll email you after work (they frown at using company email for outside business activities). I'll even be in the area next week so we can meet if preliminary discussions go well.

</comment></comment></comment><comment><USER6> Hey pepeto,

Taking a long term perspective, it can only go uphill from here. If you do take a job, try to get one that's either brain-work and pays well (build up reserves) OR physical and not brain-work (work on your startup ideas at night). My company was started while I was working a minimum wage job as a movie theatre usher.

Try to stay physically active, that will help with depression.

Remember, others want you to succeed!

</comment><comment><USER7> Man, I wish I could get down to $400 per month. But you don't even get a room in the town here for that. Even cheap apartments are at $600 and as I'm living in germany it's also rather hard to get around some insurances - so make that another $600. Some other costs like water, electricity and internet will make another 150$ and then add the normal living costs (about 450$). Ok, part of the reason is the currently low rate for $, but I don't think it would even be possible for me to get down to 400 € in any way.

</comment><comment><USER8> Yep. I've worked at big companies, and they never had "downs", and our products always launched (on time, even!), and nobody ever got fired.

</comment><comment><USER9> "So funding is planned through winning the the Merrill Lynch competition and if we don't win it (which I feel we have decent chances) I will be totally lost."

Was this part a joke? I find it hard to believe that a back-of-a-napkin biz plan would have "win a contest" as the only bullet point under "financing".

<comment><AUTHOR> You're right. All I wanted to say is that generally I am leaning towards making product rather than looking for financing, but I still decided to go for the competition first with this specific idea. Also it's not a "back-of-a- napkin" but it's 6-9mo thinking/research on brains, learning, market etc.I also have real chances since it's down from 41 teams to about 7 now and I have won other competitions, so I have a feeling of what judges are looking for, which is different than what investors are. So yeah, badly described there.

</comment></comment><comment> daniel-cussen He's going to make it big in a few years.

</comment><comment><USER10> To anyone struggling who thinks that $15 = 3 meals, I have one word:

ramen

<comment><USER11> <http://news.ycombinator.com/item?id=106506>

<comment><AUTHOR> =) The first 5 comments of that recipe are:

1\. YUCK!

2\. gross

3\. no way i would eat this or anyone in my family

4\. that sounds gross!!!!!!!!!!!!!

5\. That spunds so nasty. This will not be something that I will be trying to make. Yuck!

but thanx, I will try it...

<comment><USER11> This was on Yahoo and they just don't have the quality comments that news.yc has :)</comment></comment></comment></comment>


Hackers could have taken over AWS - <AUTHOR> http://www.theregister.co.uk/2011/10/27/cloud_security/ <comment><AUTHOR> I do find it odd that they encourage you to use the same account to sign into Amazon the store and AWS. That seems a bit like asking for a Subway loyalty card to buy a gun.

<comment><USER2> From the article, one problem is that even if you don't use your AWS account on the Amazon store, you _could_ , and so XSS vulnerabilities in the store can be used to hijack AWS accounts. Unfortunately the store is large and complex and so has a large attack surface area.

<comment><USER3> Amazon offer security token authentication for accessing AWS account resources, which can limit the impact of a breach in another part of their system.

</comment></comment></comment><comment><USER4> WS-* and XML cryptography is such a clusterfuck. It's ironic to see Amazon injured by use of "standard" constructions; they'd have been better off rolling their own here.

<comment><USER5> You shouldn't really be surprised though; especially after Yegge's rant the other week. Software quality at Amazon is pretty mediocre, and pales in comparison to Google's (I worked at both places.)

</comment></comment><comment><USER6> Is it just me, or does the article seem like gobbledygook. What is EC4 authentication anyway?

</comment><comment><USER7> So we can assume that the cloud security is as strong as the security at weakest link in one of the centralized access component.

Can we have a workflow or multi-level authorizations for critical actions like delete or terminate actions of cloud resources?.

</comment><comment><USER8> Did I miss something, or this basically trying to call out something that Amazon fixed before anyone actually discovered it. Reads like FUD

<comment><USER9> The attackers reported the problem to Amazon and allowed Amazon to fix it prior to their public disclosure.

I don't see how that's FUD. There was a problem, they found it, they let Amazon fix it, then they reported what they'd found.

</comment></comment><comment><USER10> Glad the Reg is sensationalist enough to spark a discussion (seriously). The orig item didn't do so hot.

<http://news.ycombinator.com/item?id=3160301>

</comment><comment><USER11> Headline wildly inaccurate.</comment>


Air travel shows what happens when we give companies ruinous power over us - <AUTHOR> https://www.washingtonpost.com/outlook/air-travel-shows-what-happens-when-we-give-companies-ruinous-power-over-us/2019/11/26/6e3ce96c-0bb7-11ea-bd9d-c628fd48b3a0_story.html <comment><USER2> What a disaster. There is no doubt that was an epically awful experience.

Yet I fail to see at all how it was everyone else's fault. You pay the landlord and uber the price that the market sets and you are free to not do so. The points about being a tenant vs. owner, of your John Deere, your phone, your car are more accurate, but all of these are totally off-topic.

To travel with inadequate funds, to not be able to afford a couple days in a hotel if need be, or a rental car, is just foolish. To do so during a huge storm on some of the busiest travel days in the year is asking for trouble.

What does the author expect that with 50,000 or 100,000 other travelers delayed due to weather, that American (who he paid a couple hundred bucks) is going to magically part the clouds, make aircrew and equipment show up, and fix his personal planning problem?

Or maybe they should comp everyone hotel rooms for a weather issue? If they did that they'd be out millions and soon be out of business. And as irritating as the airlines are, they are way better than walking.

Lesson #1: whenever you travel, have contingency plans. Don't expect the airlines to have them for you. I learned that on 9-11-2001. Good thing I had a rental car and could drive home.

Lesson #2: don't expect businesses to set prices and/or provide services based on what _you_ desire or need.</comment>


G-Suite Gmail bug question - <AUTHOR> I am trying to figure out why Google believes this "by design" feature is good for the user. When using Gmail, specifically only when using Gmail as part of the G-Suite applications (the problem does not exist in the free version of Gmail) does this issue arise and I can't imagine that we are the only company frustrated by the problem.
When creating a signature for emails, if you want to insert an image in your signature (i.e. a company logo) you are only presented one option to insert the image from a URL (in the free version you can upload images and link from images in your Google drive). You cannot use URLs from images stored in your Google Drive, even if you have the permissions set to anyone on the web can see. If you attempt to use a Google drive image it will show as a broken image in the signature.
Google has confirmed that this is "by design" and that you are supposed to only use images hosted on your website or elsewhere on the web. While that's fine, I am more curious why they think this is the best option. If you use a regular old free Gmail account everything works fine. Thoughts? <comment><USER2> Don't put images in your signature. It fattens your message, clunks up your formatting and leaves an awkward hole in clients that don't display images.</comment>


Google tops tech industry pay scale  - <AUTHOR> http://www.computerworlduk.com/news/careers/3285568/google-tops-tech-industry-pay-scale/?cmpid=sbycombinatoranguyen <comment><USER2> But are they happy? A simple question, but one that no doubt should be answered. Pay is just one variable, and perhaps the least important of all.</comment>