Nokia: Yes, we decrypt your HTTPS data, but don't worry about it - <AUTHOR> http://gigaom.com/2013/01/10/nokia-yes-we-decrypt-your-https-data-but-dont-worry-about-it/

<comment><USER2> The Nokia Xpress Browser is not an HTTP web browser. It is a specialized client that talks to transcoding servers. It is designed for low-end phones in emerging markets. These phones have 128MB of RAM or less, they are not capable of running full web browsers. If a user has a phone capable of running a full browser (like the Lumia phones) and they choose to install the Nokia browser or Opera Mini to save on data usage, they are opting-in for the service. The compressing browser is not the default browser for Nokia phone running Windows Phone 7/8, MeeGo, Symbian^3, or S60. [http://www.developer.nokia.com/Community/Wiki/User- Agent_hea...](http://www.developer.nokia.com/Community/Wiki/User- Agent_headers_for_Nokia_devices)

There is no MITM attack. They are not spoofing DNS or forging SSL certs. They are providing a service that users are opting in to use.

If you don't trust Nokia, don't use their phones. Even with end-to-end encryption, the data (including voice calls) is unencrypted on your phone until the software and hardware encrypts it. The maker of the software and hardware always has the capability to add eavesdropping code if they want.

<comment><USER3> I'm sort of confused as how this works. If it is not a MITM attack (i.e. using false SSL certificates), then how is Nokia readily decrypting data? I thought SSL was relatively non-trivial to crack.

<comment><USER4> Your phone is basically just remotely using a browser on Nokia's servers. Their servers are the ones actually initiating the SSL connection.

<comment><USER3> Got it. I think the title of the article is misleading when it says they decrypt the data. It's true of course, since they hold the client certificate. I hope data is ferried to their server in an encrypted format at least.

</comment></comment></comment></comment><comment><USER5> Surely this is a giant target painted on Nokia's proxy servers for any blackhat out there who wants to intercept a whole lot of https traffic? Seems like a horrible security incident just waiting to happen.

<comment><USER6> Sounds like a lot of work just to listen to random web traffic. Why not break into Facebook or Gmail instead? Then you could spy on anyone you wanted.

<comment><USER5> Why go to the work of breaking into Facebook or Gmail when you an just exploit this proxy and get Facebook accounts _and_ Gmail accounts _and_ bank web sites and a million other sensitive things too?

<comment><USER7> Because I would bet that the security professionals working for and contracted by Google and Facebook to be an order of magnitude better at their jobs than those hired by Nokia. I would expect Google and Facebook to be better at closing holes and better at detecting and closing security breaches if and when they do happen.

<comment><USER8> You know you just agreed with the comment you replied to right?

<comment><USER7> Oops... I was distracted while reading and didn't read carefully enough.

</comment></comment></comment></comment></comment></comment><comment><USER9> Now that this is known, how long until Nokia starts receiving government requests for HTTPS interception? I'm guessing less than a year. Of course, we'll never actually know.

<comment><USER10> There's a difference between being the middle man so you can minify for the user, and logging all that goes through you. Just because we can't detect that change anyone who offers that service is a government lackey?

I like Opera Mini, which is just like this. But I hope my bank blocks it.

<comment><USER11> Of course there is a difference between just Mitm for compression and outright eavesdropping. But with this point of attack a government can simply walk to Nokia with a court order, and Nokia will comply, most likely without much of a fight.

Or a little bit more abstract, the technical security is broken and the user relies on social norms for his privacy. The same social norms which forbid my ISP to sniff my non SSL traffic.

<comment><USER12> > But with this point of attack a government can simply walk to Nokia with a > court order, and Nokia will comply, most likely without much of a fight.

Nokia might not even require a court order to let the government have access to your data. A court order is only to force Nokia to give access.

</comment></comment></comment></comment><comment><USER13> The Nokia Express browser and Opera Mini are built this way and technical folks know this. These browsers are used in resource constrained devices that cannot run a full fledged web browser and also conserve on bandwidth which is crucial for countries like India where 3G coverage is still patchy and expensive. I think user has the right to be better informed in this case. So is the case with Google Chrome which relays each and everything you do back to Google servers.

<comment><USER14> Funny there is an article today about how Safari had to run in 128MB RAM when it came out, which is apparently what these phones have. So writing a real browser may well still be possible.

<comment><USER13> A phone's 128MB memory is not same as PC's 128MB. Phones usually have execute in place (XIP) memories, which means the OS and apps share some space. Also each app is budgeted a certain memory (Phones use near real time OSs compared to usual OSs in PCs), so as not to exceed the memory limit anytime. There is no virtual memory to grow to. So the assumption is not correct especially for feature phones that do not use modern smart phone OSs which are more nearer (by no means same) to desktop counterparts.

</comment></comment></comment><comment><USER15> I'd love for Google to block all HTTPS traffic coming from Nokia's server, citing security concerns. That would make Nokia change their tune real quick.

<comment><USER16> it's not insecure if you trust the company.

should google block everypass.com just because it have your banking acount password?

if i'm on a slow connection and have to use this browser to compress my connection to my bank, i will decide if i trust the browser to do so.

I just think nokia should have been even more open about this. and probably gave me an option on the browser. In that they sinned.

<comment><USER17> I don't see how everypass.com is relevant.

In this case when I go to <https://www.google.com> I expect that any traffic can only be seen by Google, the entire reason I typed "https" was specifically so that it was only a conversation between me and the site that I'm connecting to and no other middle men. It is of no consequence what company it is; it would be inappropriate for Google to be seeing my encrypted traffic to hotmail and it would be inappropriate for Microsoft to see my encrypted traffic to gmail.

Google continuing to serve traffic under those conditions is misleading and Google (or any other site that supports https) shouldn't allow it.

</comment></comment></comment><comment><USER18> Bad analogy time: It's like you're SSH'ing into a remote machine, then using w3m to access <https://google.com>. Then you complain that your outgoing local connections are to the server instead of to google.com.

<comment><USER19> It's actually a perfect analogy.

</comment></comment><comment><USER20> Why is this necessary? Shouldn't all encrypted traffic be compressed to begin with?

I'm ignorant of how SSL traffic is actually encrypted, but if you're already crunching the numbers to encrypt something, and a big part of encryption is eliminating redundancy, why isn't the data compressed at the same time?

Seems like you could kill two birds at once and eliminate any reason to decrypt HTTPS data for caching purposes as well. It would cut down on traffic for the rest of us on the internet too.

Or is this like CDN caching, where it's more about limiting latency than bandwidth?

<comment><USER21> > Why is this necessary? Shouldn't all encrypted traffic be > compressed to > begin with?

Compressing and then encrypting is dangerous in a partially chosen plaintext environment like HTTPS (and Nokia is probably putting their customers at risk by doing it).

The threat is as follows: Threat model: Alice is a user on bob.com. Alice also occasionally visits HTTP websites. Eve wants to obtain Alice's bob.com cookie to gain unauthorised access to bob.com. Eve has full access to the network connection between Alice and Bob.com, and can add, delete, or modify packets as desired.

Browser software: HTTPS requests modelled as encrypt(gzip(knownText1 + queryParameters + knownText2 + secretCookie + knownText3)). By injecting a Javascript file controlled by Eve into a normal HTTP transaction, Eve can initiate HTTPS requests to bob.com using XMLHttpRequest where Eve knows the content of knownText* and fully controls the content of queryParameters.

If queryParameters contains a substring also found in secretCookie, then the overall length of the ciphertext will be shorter due to the fact that repeated substrings are compressed. When Eve confirms an initial substring of secretCookie by monitoring the length of ciphertext corresponding to a chosen queryParameters, Eve can then expand that substring in queryParameters iteratively to a longer substring until Eve has determined the entire value of secretCookie, completing the attack.

<comment><USER22> Excellent explanation, thank you!

</comment></comment></comment><comment><USER23> The guy who originally discovered this:

<http://gaurangkp.wordpress.com/2012/12/05/nokia-proxy/>

Does anyone have a reference to a law or regulation this would fall under?

Does PCI compliance apply to this situation? If yes, then Nokia is not compliant to requirement 4.1:

[https://www.pcisecuritystandards.org/documents/Prioritized_A...](https://www.pcisecuritystandards.org/documents/Prioritized_Approach_V2.0.pdf)

<comment><USER24> Even if they had to, they would be. Everything transmitted over a public network is encrypted.

What assume they probably do is: Browser compress data -> Browser encrypt data for transmission to proxy -> Browser transmit encrypted data to proxy -> Proxy receive and decrypt the data -> Proxy decompress de data -> Proxy reencrypt the data for transmission to server -> Proxy transmit encrypted data -> Server receive and decrypt data

I could be wrong but, at no point are the unencrypted data transmitted over a public network. The only places the data are not encrypted is on the client, the proxy and the server.

You are already trusting Nokia party on the client side, they assumed you could also trust them on their proxy without asking you, which is moraly questionable, but surely not illegal.

EDIT: Missing step above

<comment><USER25> Merely touching plaintext data at some point is enough to get scoped into PCI requirements, even if only in memory.

Of course because they're not processing the payments, there's not a damn thing the networks can do to stop them; compliance can only be enforced when there's something to turn off (your merchant account) when you're not compliant. That's not the case here.

</comment></comment></comment><comment><USER26> Why is it that Nokia gets ripped apart for this, but Opera-mini gets a free pass? This is not the default behavior for Internet Explorer, you'd have to opt-in.

<comment><USER19> It's about page views. There's nothing revolutionary or wrong with this. It's specific browser for specific purpose. It's a documented behavior. It's been used for years. Nothing interesting about it.. unless you write and article like this to bait the readers and make them share it.

Another option is the author is an incompetent idiot (news-writing-wise).

</comment></comment><comment><USER27> This will be true for any "server accelerated" browser that needs the server to render or modify content, like Opera Mini.

How could they compress/optimize the pages coming to you, if they can't read it?

<comment><USER28> They could exclude HTTPS-pages, or at least include an option to do so.

<comment><USER29> In case of Opera Mini client part of browser does not have technical ability to parse and render html.

<comment><USER30> Does it have the ability to access HTTPS content?

<comment><USER31> Yes. If you read the terms of service for the Opera Mini browser, they disclose that HTTPS sessions are not end-to-end.

<comment><USER32> It also requires you to OK through a warning the first time you access an HTTPS site, so it's not a fact that's buried in some legalese.

</comment></comment></comment></comment></comment></comment><comment> hn-miw-i <http://gaurangkp.wordpress.com> has this completely wrong. I wished he had published my comment on his blog (I was first post).

Nokia is NOT intercepting https. The actual TLS session is run via a https proxy. No interception occurring. The guy who broke this has no understanding of the TLS protocol or PKI in general. He tried to say the root verisign certs in windows were being proof. bullshit.

its 2 TLS sessions -- or TLS in TLS proxy. No problem. Go back to sleep.

</comment><comment><USER33> They do it for caching purposes? What if some destination HTTPS servers return incorrect caching headers for sensitive data, because, hey, the content is encrypted so public caches have no way to store it. But now, Nokia caches can potentially store such sensitive content and leak it.

<comment><USER24> It's so they can compress the data and save on your data plan. You can't compress encrypted stuff, so they temporarily decrypt it, compress then reencrypt.

They could have turned it off for HTTPS data though, but then all the mails would not get compressed and people would have said the browser doesn't work.

</comment></comment><comment><USER34> People should stop thinking "geek". A mug punter is going to be freaked out that the advice that HTTPS means their data is secure will not care to understand technical BS that excuses the fact that HTTPS is not secure in this instance.

"We" expect HTTPS to mean secure and unbroken along the way. This tells us that HTTPS might not mean secure at all. It doesn't matter what geekery is used to explain it, its not what it says on the tin.

<comment><USER18> The options are:

1\. Trust Nokia (or Opera with Opera-mini) and use the product.

2\. Have no browser on low-end phones.

This is more a case of Nokia's product not explaining the security trade-offs to normal people. By choosing to use this browser, you are making the trade- off that it's impossible to have a secure (unbroken) connection between you and a website. Period.

There's a secure connection between the site and Nokia, and another one between Nokia and you. Nokia (or anyone that hacks Nokia) can listen in the middle since it's not a end-to-end secure connection.

      | It doesn't matter what geekery is used to explain it

Nothing is every truly, 100% secure. People like black-and-white answers. People either want "it's secure" or "it's not secure." People can't normally handle, "it's secure-enough for these use-cases, but not for these other use- cases." A normal browser could easily trust a fake-certificate that was issued incorrectly by a trusted source. I'm unsure how you fit these sorts of things into your world-view, but it would behove you to do so.

      | its not what it says on the tin.

If you can find a tin that says so, you should attempt a false-advertisement claim.

</comment></comment><comment> hn-miw-i Nokia is not intercepting your https! They are doing nothing dodgy here.

Everyone who says "https interception" is hard, you are right. Unless you can install arbitrary trusted root He has presented no evidence of this. All he did was sniff the wire and saw a TLS session to Nokia. It's called an https proxy, genius. Ugh. This mAkes me so mad that people believe this crap.

</comment><comment><USER35> This is a similar vulnerability to WAP. Nokia is providing a service: people with slow connections and cheap phones want it or need it.

Sure, they should be more up front with users from the outset.

But what I'd really like to see is Nokia working more closely with app developers to help them programatically detect these connections so users can be denied more easily in apps where security is critical. Some banks jumped through hoops trying to detect and shut down WAP connections.

</comment><comment><USER36> I work in deep packet analytics and have interacted with several telcos and vendors. If you are developing a packet analytics or metrics product the temptation to tap into your production traffic, if only for validating your product is too strong. In our segment, access to live traffic is the primary "raw material" to develop, test, and enhance the products. So they may not use your data to "spy" but there is no protection against your data making it into packet captures (tcpdumps or pcaps) which then acquire a life of their own. I am not saying Nokia does this, but that any telco/vendor including this one who makes packet analysis products has to fight the temptation not to do it.

I would never ever use a service that decrypts HTTPS traffic. How do we know that the other side is encrypted ? For all you know, the other side of the proxy could not even use SSL for services that offer both modes (google,facebook,twitter, etc etc).

</comment><comment><USER37> I will never again buy a Nokia phone.

<comment><USER38> You do realize Nokia Lumia phones have IE as well as Xpress? This issue affects Xpress alone. You could use IE without any of this affecting you.

<comment><USER39> The Lumias have this Xpress thing?! Why?

<comment><USER38> Essentially, Nokia improves webpage load performances by utilizing data compression algos on their servers through Xpress - similar to Opera and Amazon Silk. In between, Nokia decrypts HTTPS traffic - Opera and Amazon apparently don't.

So, effective use of Xpress could be limited to articles (The Verge), magazines and mailbox use could be done through IE or through the mail app. The problem is limited on the Lumia phones but it is a bigger deal just on their S40 phones.

</comment></comment></comment></comment><comment><USER40> Even if Nokia isn't looking at your information, they're breaking the trust model of SSL even more than it already is. Since they would have to terminate SSL at their proxy server, you lose control of what certificate authorities you trust, and what certificates you trust. Not having one of these phones, I can't speak to the specifics, but it takes a lot of the ability for the user to verify the authenticity of the https connection.

</comment><comment> hn-miw-i Nokia pushed out an update that uses an http proxy for Phone to server TlS. The worst thing about this is that they have diluted their security model (tls in tls is resistant to single interception-- ie tor).

They did this so boneheads that sniff the traffic will see the phone to server TLS rather than having it encrypted inside the phone to Nokia TLS. That's ignorant "researcher" you actually made it easier for the bad guys now.

</comment><comment><USER41> How is this possible? Is there a built-in certificate on Nokia phones that accept the proxy server certificate (which must be a wildcard for everything)?

<comment><USER42> > Is there a built-in certificate on Nokia phones that accept the proxy server > certificate (which must be a wildcard for everything)?

Excatly.

</comment></comment><comment><USER43> I understand that there is an expectation for Nokia to resolve this concern in some manner, but why do endpoint sites not simply block requests from the proxy?

I mean if I was a bank it'd properly be in my interest to protect my customers from using a known insecure proxy (regardless of who manages it).

<comment><USER44> What makes this proxy less secure than any other HTTPS proxy?

</comment></comment><comment><USER45> How do they decrypt HTTPS? That shouldn't be possible? Are they exchanging certificates in the middle?

<comment><USER22> They sold the phone, and so they controlled the browser installed on the phone. HTTPS is only secure if you can trust both ends: the receiving end and your browser. In this case, the browser was unreliable.

<comment><USER26> This is not the default browser installed on the phone.

<comment><USER46> Yes it is, see for example the bit about the browser at [http://www.nokia.com/global/products/phone/asha205/specifica...](http://www.nokia.com/global/products/phone/asha205/specifications/)

</comment></comment></comment></comment><comment><USER47> Is it even possible? HTTPS is used to avoid any possibility of man in the middle attack. How can nokia's proxy servers be able to decrypt that encrypted information unless they themselves have the private key?

<comment><USER48> It's pretty standard for corporate proxy servers - at least in financial companies where theres regulations that tend to require some level of monitoring of external communications.

It's a simple MITM attack, where the endpoint (your browser) has a whitelisted certificate for the proxy, so the browser is happy that it's talking to a correctly signed certificate that it trusts, and the proxy uses the the certificate for the other end of the connection.

<comment><USER49> Actually corporate proxy servers generally use CONNECT to allow HTTPS through.

<comment><USER47> and what is that?

<comment><USER50> Wikipedia describes it briefly at [http://en.wikipedia.org/wiki/HTTP_tunnel#HTTP_CONNECT_Tunnel...](http://en.wikipedia.org/wiki/HTTP_tunnel#HTTP_CONNECT_Tunneling). The most recent standard for it appears to be RFC 2817 section 5.2, <http://tools.ietf.org/html/rfc2817#section-5.2>, and it's also in the HTTPbis Semantics and Content drafts, currently at [http://tools.ietf.org/html/draft- ietf-httpbis-p2-semantics-2...](http://tools.ietf.org/html/draft-ietf- httpbis-p2-semantics-21#section-5.3.6).

<comment><USER47> thats super cool.

</comment></comment></comment></comment></comment></comment><comment><USER51> Now that we know Nokia is doing this, why shouldn't Banks, Facebook and Google reject any traffic coming from Nokia's proxy servers?

</comment><comment><USER52> When Amazon did the exact same thing (offering a browser that had its endpoint on an external server) everybody was euphoric because it allowed a modern rendering engine to "run" on a very limited device. Now Nokia does the same thing for crippled phones and they're the bad guy.

<comment><USER53> No, Amazon Silk routes HTTPS traffic directly to the origin server.

[https://www.eff.org/2011/october/amazon- fire%E2%80%99s-new-b...](https://www.eff.org/2011/october/amazon- fire%E2%80%99s-new-browser-puts-spotlight-privacy-trade-offs)

</comment></comment><comment><USER54> Nokia just killed their brand.

And they can't even blame Android/Apple for it.

Too bad for microsoft, they bet their mobile house more or less on Nokia and vice versa.

Trust is a fragile thing.

<comment><USER55> How is this any more insidious than already trusting the company to remotely update code on the device? Or (in the case of Google) on your desktop.

As for the marginal gains you get from a direct SSL connection, at this stage it's been long demonstrated that the average Joe government can get their hands on CA certificates pretty easily.

So the question really is how you expected to benefit from a direct SSL connection, given the already explicit trust you have in the company to provide secure software on your device with which to make the connection?

<comment><USER54> When a device I own tells me I'm talking to my bank directly, but instead I'm talking to the producer of the device that's a man-in-the-middle-attack in progress.

After that said producer of my device is definitely in my 'to be avoided' category.

</comment></comment></comment><comment><USER56> Actually, I want to say: what the fuck?! Nokia are you that stupid? This is no joke. I used to think that when I use HTTPS my data are encrypted right in the browser, and I send some really sensitive data via HTTPS connections. "We're just compressing stuff... It's ok..." Really? I mean, really? Are you that lame? I don't use anything Nokia's anyway, but I hope other companies are not that stupid.

<comment><USER56> Why is the comment greyed out only because some stupid jerks are not agree? What the hell? What if 99% of the clever people are agree? But clever people are still 5% of the human mass. This is a wrong ranking system, this is a dictatorship of the stupid. I am going to think of this as of the 'rejection therapy'. I am not going to conform the public's opinion anyway, just don't give a rat's ass.

</comment></comment><comment><USER56> In a better world, this would be against the law.</comment>


"Angels and YC encourage building dipshit companies that sell for $25 million" - <AUTHOR> http://venturebeat.com/2010/07/29/angelconf-ron-conway-michael-arrington

<comment><USER2> As I understand it, it is the venture capitalists who are worried that startups can go from the garage to Google acquisition with just angel money without needing venture capital. So some of that criticism comes from feeling threatened.

Michael Arrington, on the other hand, seems to take issue with the fact that some startups are aiming at Google from the start instead of aiming at greatness and landing at Google.

 _Personally, I wouldn't mind creating a "dipshit company" that sells for $25 million_

Would you rather come up with a great idea you are passionate about and see it through to completion, or build something that you know Google (or similiar) will snap up for $25 million?

<comment><AUTHOR> _Would you rather come up with a great idea you are passionate about and see it through to completion, or build something that you know Google (or similiar) will snap up for $25 million?_

I prefer the former. But the latter is not a bad outcome either.

<comment><USER3> Do the latter first, and then the former a few dozen times :-)

</comment></comment></comment><comment><AUTHOR> The title is a paraphrase of sentiments expressed in the linked article and attributed to some unnamed venture capitalists.

Not sure I agree with the assessment, but I do see that, as Michael Arrington said, it holds a "kernel of truth".

What do some of the more experienced HN'ers think of the assessment?

[Personally, I wouldn't mind creating a "dipshit company" that sells for $25 million]</comment>


Mozilla proposes an HTTP header to force HTTPS-only connections - <AUTHOR> http://forcetls.sidstamm.com/

<comment><AUTHOR> Here's the announcement from the Mozilla Security Blog: [http://blog.mozilla.com/security/2009/07/27/locking-up- the-v...](http://blog.mozilla.com/security/2009/07/27/locking-up-the- valuables-opt-in-security-with-forcetls/)

I wonder how the initial request could be made secure. With the current proposal, if you happen to work over a compromised network connection the first time you open a site, the site cannot force your browser to connect over HTTPS and the attacker wins.

Daniel Veditz commented on this concern:

"...[W]elcome to the bootstrapping problem. We're making the assumption that the sites people most want to protect from eavesdropping and tampering are those for which they've set up accounts. That means they connected correctly at least once, and this header could be set at that time. In addition, careful users could always add '<https://'> themselves the first time and avoid that initial redirect." ([http://blog.mozilla.com/security/2009/07/27/locking-up- the-v...](http://blog.mozilla.com/security/2009/07/27/locking-up-the- valuables-opt-in-security-with-forcetls/#comment-106091))

</comment><comment><USER2> I'm not seeing how this is a big improvement over an HTTP redirect (via a Location header) to the HTTPS site -- beyond a single connection for each session, to redirect to the HTTPS site. Nor any improvement over RFC2817 HTTP Upgrade to TLS, which has the advantage of allowing virtual hosting of multiple secure sites on a single port on a single IP address.

<comment><AUTHOR> There is an improvement over an HTTP redirect to the HTTPS site. Such redirects usually occur in the beginning of every session (or, at least, of some sessions). An active attacker could intercept the redirect at any time a-la Moxie Marlinspike's _sslstrip:_ <http://www.thoughtcrime.org/software/sslstrip/> . But once the browser has received the X-Force-TLS header, it will avoid accessing the site over HTTP at all thus preventing that kind of attack. In other words, the browser will now automatically perform the redirect without issuing any insecure HTTP requests to the site.

</comment></comment><comment><USER3> The issue is that people don't always check to see if a site is secure before putting in their login credentials and so if someone does a main-in-the-middle on their bank website, they might not notice that it isn't HTTPS.

I'd suggest that there's another good defense (not that I think this proposal is bad). Right now, everyone turns off that "warn me before sending insecure data over the internet" warning because it would be annoying as all hell. Every form you tried to submit would give you a warning. First, I'd change it to only warn about sending a password field over an insecure connection. That's really what most people are worried about. Second, because we all have non SSL sites with passwords, allow for an exceptions list - continue warning me about sending insecure passwords, except for this site which I realize is insecure, but don't care.

That way the browser is warning people about insecurely sending the information they want being sent secure. It provides them with a convenient exceptions list for places that don't use SSL and the user deems is fine for that exception.

<comment><AUTHOR> Contrary to popular belief, it doesn't make much sense to protect the password without protecting the whole session (that is, without serving most of the site over HTTPS). If just the login page is encrypted, any attacker who is now prevented from stealing your password can still obtain your session cookie that travels over plain HTTP.

A compromise of a single session is bad enough for many services. Set up a filter to forward your email to the attacker's address? Access private information? Post messages on your behalf? Change your user profile, including your email and shipping address? Usually such actions do not require password authentication when the client already has a valid session cookie. A man-in- the-middle attacker could also intercept your attempt to log out and keep using your session for as long as possible.

</comment></comment><comment><USER4> Mozilla's propensity for adding yet another database to your user profile with each new feature they add is really starting to grate on me.

Though now that they're planning to keep knownhosts-like data around for https, perhaps they could be persuaded to use a more SSH-style system for self-signed certificates instead of the intentionally user-hostile asshattery they implemented in FF3.

<comment><USER5> What is it about additional database files in the user profile that bothers you?

Regarding the untrusted TLS certificate warnings, it seems to benefit the users who need the most help: [http://www.goodgearguide.com.au/article/312438/security_cert...](http://www.goodgearguide.com.au/article/312438/security_certificate_warnings_don_t_work_researchers_say)

</comment></comment><comment><USER6> This could be a DNS SRV record, too?

I'm not sure I understand the motivation.</comment>


How I learned to stop programming and love carbon foam - <AUTHOR> http://www.cs.indiana.edu/~jwmills/EAC.ppt.htm

<comment><USER2> Hi, when I return from Unconventional Computing 2009 I will post some more tutorial material. This is a new paradigm, and it was fascinating to see workshop participants turning the EAC board over, trying to find something REALLY doing the computing. They found it hard to belive that a piece of conductive foam was performing complex computations. Thank you all for viewing the PPT. Sincerely, Jonathan

</comment><comment><USER3> I'm confused by the majorty of what's in this presentation, even after reading the whole thing. can anyone post some more detail on the contents?

<comment><AUTHOR> To get a better picture of the whole, there is other material available:

[http://www.cs.indiana.edu/~jwmills/ANALOG.NOTEBOOK/klm/klm.h...](http://www.cs.indiana.edu/~jwmills/ANALOG.NOTEBOOK/klm/klm.html)

<http://www.cs.indiana.edu/classes/b443/notes/EmptySpace.pdf>

</comment></comment><comment><USER4> This is fascinating material I didn't know existed; thank you for posting it.

</comment><comment><USER5> Raw powerpoint: <http://www.cs.indiana.edu/~jwmills/EAC.ppt></comment>


Pin - an all-in-one payment system API for Australian devs - <AUTHOR> https://pin.net.au/

<comment><USER2> awesome! A stripe for australia. Instantly signed up</comment>


Jeffrey Katzenberg Blames Pandemic for Quibi's Rough Start - <AUTHOR> https://www.nytimes.com/2020/05/11/business/media/jeffrey-katzenberg-quibi-coronavirus.html <comment><USER2> The guy made a boring app that nobody asked for or wanted, and assumed he could dump money into advertising dollars and endorsements to drive growth. That's not how social apps grow. It's got nothing to do with Coronavirus.</comment>


Ask HN: What Mailing lists, Google Groups, IRC Channels etc. do you frequent? - <AUTHOR>

<comment><USER2> For IRC channels <http://news.ycombinator.com/item?id=3126728></comment>


Ask HN: Is there a clear, mature discussion of OOP/functional tradeoffs? - <AUTHOR> Since getting into web development I've found myself regularly in contact with folks who take it for granted that OOP as a paradigm has proven itself a failure (typically with the attendant viewpoint that functional programming has proven itself to be superior).
My current perception is that it's primarily bandwagon mentality promoting the above viewpoint. For instance, I was reading an article purporting to explain what object-oriented programming 'really' is, and they cited as part of their motivation for bringing this up the wildly popular "Goodbye, Object Oriented Programming"[0]; and while the first article was not what I would call a particularly deep discussion of the nature of OOP, the popular article it referenced (with 44k upvotes) was just laughably unsophisticated, uninformed, and rhetoric-laden. Every point he put forward had such a simplistic rebuttal that I had to wonder if he was intentionally setting up straw-men or just didn't know better.
So now it's on my mind: "is this the sort of thing folks are reading which has given them the idea that OOP has been disproven as effective?"
Now I feel motivated to take a close look at the issue if there is a serious, well-informed dissection of the efficacy of OOP for modern developers. It would especially be valuable if instead of vaguely referring to inadequacies it also pointed out how alternate paradigms more successfully deal with specific points.
My current suspicion is, regarding OOP vs. functional: both can be used well or poorly, so a lot of it just comes down to the developer's ability to exploit their features—and the rest just depends on the domain you're trying to model. For instance, if that domain deals with a bunch of things that look and interact like objects, then OOP will probably be better; if it's mostly a complex, abstract computation, functional would be better.
[0] https://medium.com/@cscalfani/goodbye-object-oriented-programming-a59cda4c0e53 <comment><USER2> Your last paragraph is pretty much where I stand. I'm not trying to fire a shot in a language war. I'm not trying to build a perfectly-architected Gang of Four masterpiece. I'm not trying to produce a mathematically beautiful perfectly-stateless category-theoretic treatise. I'm just trying to write a program that does something.

So I don't really care about FP ideology or OO ideology. I'll pick the tools that best let me get my work done. If that offends purists, that's their problem.

As to your actual question, a reasonable, unbiased discussion of tradeoffs... sorry, no, I don't have one.

<comment><AUTHOR> Yeah, I think our thinking is pretty similar. I think OOP is very natural fit for thinking about lots of things, and I think there are some great ideas that have come out of the functional paradigm. I still prefer to use a language that has OO organizational structures, but I definitely feel some pain if I can't have first class functions. I also value the idea of functional purity and whenever possible I'll write my functions so they're pure—but I don't adhere super strictly unless in a part of the program that critically needs it. Same with immutability.

</comment></comment><comment><USER3> Maybe try this post, "Object Oriented Programming vs. Functional Programming" by Bill Gathen dated May 12, 2015 [0]

[https://www.codenewbie.org/blogs/object-oriented- programming...](https://www.codenewbie.org/blogs/object-oriented-programming- vs-functional-programming)

[0] [https://twitter.com/ryanbrush/status/999982149901021184](https://twitter.com/ryanbrush/status/999982149901021184)

</comment><comment><USER4> I was only introduced to FP 6 months ago, and I'm no expert on OOP either. Functional Thinking by Neal Ford compares the two (of course it favors FP). Should be a good piece to the puzzle, though, at least worth skimming it.

My opinion is that things like purity, immutability, type checking, and other FP characteristics are incredibly helpful, and they make me write code with fewer bugs.</comment>


How I DOS'd My Cell Phone Using EC2 - <AUTHOR> http://www.memestreams.net/users/jello/blogid10335070/

<comment><USER2> Read this together with this story <http://news.ycombinator.com/item?id=462592> about people using VoIP and caller ID spoofing to prank call 911 and dispatch SWAT teams.

Scary stuff. A sophisticated enough criminal could plan to pull a crime, while at the same time DOSing the 911 call center so any legitimate 911 calls would get lost in the noise.

<comment><USER3> _VoIP ... DOSing the 911 call center_

Wouldn't work. "911" isn't a real phone number; it's special-cased into the phone network so that if the phone network is overloaded the 911 call will get through and a non-911 call will get disconnected. VoIP services don't have direct access to 911 systems but instead proxy (once they figure out where you're calling from and thus which 911 center to route your call to).

If you tried to DoS 911 services via VoIP, you might make it impossible to get a call through to 911 _via that VoIP service_ , but you wouldn't block landline 911 calls.

<comment><USER4> I am he who DOS'd my cell phone.

I don't really understand what you mean - do you mean that 911 won't accept more than X calls from a single VOIP provider, after they proxy the call? Because the limit is humans answering the calls, isn't it? Is that done on a grid too, so operators from multiple regions can handle overload in one area?

Anyway, I would imagine a more likely attack would be on private PBXes. Only terrorists would want to take down 911, which should be resistant to call floods, but a much larger pool of criminals would seek to disable private phone systems.

</comment></comment></comment><comment><USER5> "The voice was me as 'Vinnie' threatening my life. "

It sounds like he's developing harassment-ware.

<comment><USER4> It was a demo promoting a gangster film.

<comment><USER6> Oddly enough, in a recent episode of 'Burn Notice', they caused all of the phones in an office to ring simultaneously in order to make their escape during a con. They presented it more as a PBX hack, but it does sound a lot like the security concerns you mention.</comment></comment></comment>


Rate My Startup - RateMyStartup.com - <AUTHOR> http://ratemystartup.com

<comment><AUTHOR> I noticed a ton of "Rate My Startup" type of posts on here... I thought a site like this should help a bit.</comment>


2019: The year revolt went global - <AUTHOR> https://thefifthwave.wordpress.com/2019/12/10/2019-the-year-revolt-went-global/ <comment><USER3> One thing that's interesting about all this is the media's coverage. The U.S. media has virtually exclusively covered the protests in Hong Kong, and barely mentions any of the other (often larger and more violent) protests.

<comment><USER4> Have any of the protests been anywhere near the scale of Hong Kong? The Hong Kong protests regularly drew as many as 2 million people. That's more than 25% of the entire country. For comparison sake, that'd be like a single US protest drawing 82 million people.

Even comparing to the Chile protests, those were just 1 million people in a country with 18 million. Proportionally that makes them only one fifth the size of Hong Kong. Plus the Chilean protests only lasted for a few weeks before quickly falling to under 10,000 people. In comparison the HK protests have been ongoing for nearly a year.

<comment><USER3> I'm a little late, but maybe Iraq is? I can't find anywhere online that mentions the protest's size, but security forces and militia have killed over 400 protesters so far. In some ways that seems to make it more newsworthy then Hong Kong.

Here's an article criticizing the media for not covering it: [https://www.washingtonpost.com/opinions/2019/11/13/hundreds-...](https://www.washingtonpost.com/opinions/2019/11/13/hundreds- iraqis-have-been-killed-medias-silence-is-deafening/)

</comment></comment></comment><comment><USER5> For anyone unfamiliar, this is Martin Gurri's blog. He's the author of The Revolt of the Public (Stripe press), a book that's making the rounds in the tech industry. I'm part way through with it, but it's main thesis is the rise of the internet and social media has increased and decentralized the public's access to information and this has led to a break down in the legitimacy of traditional authorities (governments, media, academia, elites).

I don't think anyone can doubt that narrative-breaking information is now more readily available and that authorities are more under the microscope than ever. This must have some political/societal ramifications.

The result of all this information is as much a more informed voter population as it is creating a huge swath of just angry people. Whether this burst of protests in 2019 fits this narrative is open to debate and probably unprovable, but to his point calling it all random ends the chance of considering what the effects are of the continuing and accelerating flood of information available to people and the lowered efforts needed to create mass protests.

</comment><comment><USER6> Maybe the masses are saying "This isn't working for us! We don't know what would work for us, but _this isn 't it!_"

And I wonder how long until this comes to the USA...

<comment><USER7> It already did, in 2016.

<comment><USER6> That's an interesting take on both Trump's and Bernie's campaigns. To at least some degree, I think it fits.

But I was thinking about several percent of the country marching in the streets. That's not something we've seen yet.

<comment><USER8> >> several percent of the country marching in the streets

Unlikely to happen here seeing that unemployment is at a 50 year low and wages are rising.

<comment><USER6> But some of those protests are in prosperous places. The economy has been getting better for a long time in Chile. Hong Kong isn't hurting, either - <USER2> at least wasn't until the start of the protests.

<comment><USER9> >Hong Kong isn't hurting

I read some opinions about HK protests, and they were saying, basically, that HK youth has no chance to buy an apartment and live a good middle class life, hence the revolt.

This is something that is not captured in GDP growth metric. To me it makes perfect sense. What is the point of, say, 5% GDP growth if you pay 1/2 of your salary as rent and will never accumulate enough dough for downpayment?

<comment><USER6> Hmm. By that standard, chunks of the US are also tinder waiting for a match - the coastal cities because costs (housing in particular) are too high, and the heartland because incomes are too low.

<comment><USER10> Hence, the rise in both authoritarian and progressive populism in the US.

<comment><USER6> "Authoritarian" and "progressive" are not mutually exclusive. See, for example, Venezuela.

<comment><USER10> "Authoritarian populism" and "progressive populism" are widely-used names of particular political ideologies. While their etymology of course relates to the more general sense of, respectively, "authoritarian" and "progressive" in denoting political ideologies, in both cases the definition is not a simple combination of the general sense of one of those terms with the general sense of "populism", but much narrower. Authoritarian populism is a particular subset of right-of-center populism and progressive populism is a particular subset of left-of-center populism, and they are, in fact, non-overlapping even if, arguably, "progressive" and "authoritarian" are not. (Similarly, "authoritarian populism" arguably is not even a subset of "authoritarianism", though it at least overlaps with it.)

> See, for example, Venezuela.

"Progressive" and "socialist" aren't mutually exclusive, but neither does the latter imply the former; "progressive" and "authoritarian" might overlap, but Venezuela's government isn't an example as it isn't progressive.

<comment><USER6> I don't recall that I've heard "authoritarian populism" as a term before, so I don't think that it's massively widely spread. (I'm not in political circles, but I do pay _some_ attention.)

My main problem is with the connotations. Progress = good, authoritarianism = bad, so "progressive populism" sounds good, and "authoritarian populism" sounds bad. The wording is probably deliberately designed to paint one side as better than the other. In fact, though, "progressive populism" can wind up being every bit as authoritarian and ugly and brutal as "authoritarian populism" can.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> This is a symptom of economic problems. Look up what hedge fund billionaire Ray Dalio has to say about the global debt crisis. [https://youtu.be/5C43i3yclec](https://youtu.be/5C43i3yclec)

Basically we are entering a global depression due to untenable debt levels. WWIII is a distinct possibility.

</comment><comment><USER7> A fairly silly article with a fairly silly thesis. There's always protest movements going on somewhere; it would take a lot of statistics to convince me that 2019 is any kind of outlier.

And there's nothing global about the current grab-bag of movements, they're very much local issues.

<comment><USER12> Agreed. If anything, the Arab Spring was much bigger than the current set of unrelated protests

</comment></comment><comment><USER13> The current power structures are responsible for climate destruction that means many of our children will be forced to spend their lives in an Earth worse than what their parents experienced. Meanwhile, the leaders of those power structures have taken no responsibility, no change of course, and instead have enriched themselves more and more.

The fundamental premise of society is that power comes with responsibility. Today we see billionaires, world leaders, and autocrats amassing ever more power while demonstrating no responsibility.

Is it any surprise people want to tear it all down even if they don't know what they want instead?

<comment><USER14> > The fundamental premise of society is that power comes with responsibility.

Is that typically true? It seems the pattern is often:

person/group amass power -> things are okay for a while -> power corrupts and there's longrunning abuse of power -> [time] -> society eventually makes noise and/group gets destabilized/dies -> repeat

<comment><USER15> Sure. In fact, take any category of power relations; these are categories of people, related by power over one another. Then, the dual category is one of responsibility relations.

To say that Prima has power over Secunda is to say that Prima can alter Secunda's environment arbitrarily. However, this is equivalent to Secunda requiring certain open-ended alterations to their environment, and being unable to establish those alterations without Prima.

No matter how many times one goes around the concept, one cannot be responsible without having the power to enact the responsibility, and one cannot be empowered without having expectations on the use of that power.

</comment></comment></comment><comment><USER16> >So what are we to make of this mess? Why the frenzy of protests – and why now?

Except that many of these countries are always protesting about something. In any year one can find at least a dozen countries that have had protests of some sort. Hong Kong had protests in 2014 too. And Brazil had protests in 2016 over bus fares, and in 2015, 2013, etc.. Brazil has protests every year over bus fares, it seems. The remarkably geopolitical stability of the US and its strong economy , compared to the unrest everywhere else (such as Hong Kong, Lebanon, Turkey, Italy, Spain, Chile, etc.), yet again torpedoes the media narrative in 2016-2017 that Trump would user in an era social unrest and economic instability in the US...the opposite has happened, with America being even more stable and economically successful relative to much of the rest of the world. The media got it all wrong, predicting collapse and instability in the US, when the instability and high inflation occurred elsewhere instead.

<comment><USER17> Given the post-modern reality we occupy, where people can basically pick and choose their reality (read: echo chambers) and not only pick them, but entrench themselves due to the cognitive dissonance felt if you try to exit them, I suspect you're partially correct.

Never before in history have journalists had the analytics tools to carefully guide stories to virality. If it bleeds, it leads has always been true, but now journalists have the ability to not just find stories where it bleeds, but they have the analytics and the tools to massage the story such that a papercut is perceived by the reader as a mortal flesh wound. Everything is exaggerated in the pursuit of eyeballs and ad impressions.

Furthermore, you can get "stuck" in a story by following hyperlinks of tangential information, and assign greater importance than you would in the past when newspapers were read top to bottom, front to back, changing subjects with each article.</comment></comment>


Bump (YC S09) Raises $16 Million Round Led By Andreessen Horowitz - <AUTHOR> http://techcrunch.com/2011/01/10/bump-raises-16-million-round-led-by-andreessen-horowitz/

<comment><USER2> In my opinion, as a Bump developer, a lot of the negative comments reflect our biggest problem: branding. In many people's minds, Bump is a nothing but a contact-sharing app. Long ago contacts were eclipsed by the many other types of things that Bump lets you share. The people who are downloading the app are using it in ways that we couldn't imagine when building initial version. The app's "gimmick" of bumping is still an incredibly useful, and admittedly fun, way of establishing a connection between two strangers, or even two of your own devices.

Obviously, my views are biased, but it is quite clear to me (and our users) that Bump is more than just a contact-sharing app.

<comment><USER3> I'd love to "bump" cash registers for my receipts (straight to an accounting app).

<comment><USER4> We're working on this with FaceCash.

</comment></comment></comment><comment><USER5> We are hiring.

I've worked at Bump for about a year and a half - the classic 'work from the founder's kitchen' story...

I really enjoy coming to work here. Why?

Because the work is engrossing - there are more interesting things to work on here than I have time for.

Because our team works well together - it is a low-ego environment, and we are all focused on building cool stuff.

Because our hardware procurement process consists of mentioning what we need to Andy (our procurement officer/CTO) and shiny things magically appear on our desk within days.

Because our offices are custom-made: <http://imgur.com/qZAc6> (ha!)

Please check out our jobs page: <http://bu.mp/jobs>

Or email me; see my profile.

</comment><comment><USER6> I am visiting India surrounded by over a dozen cousins in 5-15 age range. All but a few are hooked to Bump independently(not through me). One evening the kids literally went door to door in our large extended family searching for iPhones to put the app on.

Seeing such crazy adoption, I wanted to see what they really dig about it. So I tried to played a sucker and kept asking them "Bump sucks, why would you even use it?". Their response: "picture sharing is sooo fast; its quicker than even sms; its just awesome" followed by "want me to put it on your iphone?" :)

Pretty cool!

</comment><comment><USER7> The article says they are going to put physical stations in venues that people can "bump." I love that idea. Making it a physical act that other people can see is really smart. The activity isn't just happening on the phone, it's happening in the real world, people are literally bumping into things.

</comment><comment><USER2> Bump is YC09, for those who don't know.

</comment><comment><USER8> They license their technology to PayPal, and perhaps others. What the rev deal is, I have no idea.

</comment><comment><USER9> Linkedin should buy Bumb

</comment><comment><USER10> $16 million? I'd be happy with a $50k investment...

</comment><comment><USER11> congrats, guys!

</comment><comment><USER12> What do they need that much money for? It's a simple contact sharing app. And how will they make money?

Foodspotting also got 3M today, for a simple photo sharing app that has no revenue model.

This bubble is very close to bursting. Too bad for those pension funds and university endowments.

<comment><USER13> " _This bubble is very close to bursting. Too bad for those pension funds and university endowments._ "

Not even close.

As someone who lived through the very end (and hence the worst of it) I think this does mark the return of the bubble. Bump is a nice idea but they've now raised $3 per active user and still have no real path to revenue. That's bubble mentality.

BUT at least Bump is a good idea. Good ideas that VCs over estimate is the beginning of a bubble not the end of it. Its when ideas like ecommerce stores that just sell pet food or devices that allow web sites to smell start popping up. That's when its about to burst

<comment><USER12> Yes, during normal times. However, we're in a global economic recession, where most countries are bankrupt and overnight any country/US state can default on their debt, causing massive failures in many markets. Any other bubble bursting (education, real estate, stock market, government debt) can cause the other bubbles to burst right away.

<comment><USER14> Most countries are very far from being bankrupt. We haven't been in a recession in a quite some time (more than a year ago). While there are lingering concerns over a couple of specific countries, economic news has been mostly pretty bright for quite some time.

Jobs, particularly labor jobs, continue to be a really big issue. Lets not be hyperbolic, however.

Also, lets keep this in perspective. The amount of money totally invested in startups is (in the scheme of things) pretty small. So yes those endowments and pension funds stand to lose, but not a lot (they tend to be well diversified).

Not all bubbles are the catastrophic crash of the housing market or the general tech bubble that began last decade. Those both saw huge amounts of money invested by millions of individuals dry up overnight. This is very different.</comment></comment></comment></comment>


Why Reinvent the Wheel? Could Ethereum Use Docker, ZeroVM, VirtualBox or JVM? - <AUTHOR> http://forum.ethereum.org/discussion/1203/why-not-use-a-general-purpose-vm

<comment><AUTHOR> Re: Latest response on Ethereum blog ([https://forum.ethereum.org/discussion/comment/6169#Comment_6...](https://forum.ethereum.org/discussion/comment/6169#Comment_6169))

I get it, resource management is a big a problem that applies to CPU, RAM and storage. Capabilities to do such resource management exist, though they may not be refined to the extent the blockchain needs. We will be reaching out to ZeroVM, Docker and other sandboxing projects to better assess the ETA of feature-completeness in this domain.

</comment><comment><AUTHOR> I asked the Ethereum guys this question, thought people here might be interested in the answers. Let's discuss.</comment>


Show HN: Realtime collaborative heatmap hack for you to click - <AUTHOR> http://bench.nowjs.org:9000/

<comment><USER2> Interesting demo, I did a similar one but with mouse movement: <http://www.patrick-wied.at/projects/multiuser-heatmap/> but I think my server wont handle lots of users since I'm using an early version of Ajax Push Engine. nowjs seems to perform really good.

Btw: nice solution for the "too much data" for heatmap.js (at the initial heatmap rendering) issue :)

</comment><comment><AUTHOR> Quick notes:

When there is a lot of realtime clicking it'll get laggy because the heatmap redraws with new data. Sorry about that!

If the page in the Iframe has some kind of redirect, it'll redirect the entire page so just wait 60 seconds for the page to change.

Other than that, have fun!

</comment><comment><USER3> I couldn't figure out what the link was at first, because in Safari, absolutely nothing happens. I had to bring up the page in Chrome to see what it was supposed to be doing (heat marks).

</comment><comment><USER4> It's interesting, but the heat I guess goes away over time? Can't type messages to others or anything?</comment>


VPN Apps for iPhone and Android - <AUTHOR> https://smartphones.gadgethacks.com/how-to/4-best-vpn-apps-for-iphone-android-0193781/ <comment><USER2> For anyone considering signing up for a VPN, Nord has deals where you can get 3 years deeply discounted if you pay upfront for around $100. Right now the site Kickass Torrents has an affiliate link on their site for example. I'm not an affiliate, just a customer and a fan respectively.</comment>


Introducing T: A command-line power tool for Twitter - <AUTHOR> http://sferik.github.com/t/

<comment><USER3> A brief plug for my friend's command line tool TTYtter: <http://www.floodgap.com/software/ttytter/>

super-crazy powerful, has an interactive mode, is scriptable, etc, etc...

Also, I'm glad you are able to manipulate lists in T by just typing names (t list add presidents BarackObama Jasonfinn). This is a _total_ pain on the website where you can only manipulate lists by clicking about 5 buttons per person you want to add/drop from a list. Why can't I just type a list of names??

<comment><USER4> I also built a similar tool around an year ago, much simpler though (was an exercise in implementing OAuth): <https://github.com/ricardobeat/clit#readme>

<comment><USER5> Love the name (though I'm sure many would consider it sexist).

<comment><USER6> (because it is)

<comment><USER7> Can you elaborate on why? It's an honest question, because I genuinely don't understand why. Good to see the 'ole downvote-without-discussion at work, too.

I understand sexism to be about discriminating based on gender. Does it also mean "naming software a body part a certain gender happens to have?" If I name my software "penis", or "testicle" (a great name for a tongue-in-cheek test suite) am I going to be accused of being sexist toward men?

As for "clit", can I understand potentially offensive to certain people who are sensitive to sexual matters? Sure. Demeaning or discriminatory to women? Please convince me of it. I think the sexism brush is getting _really_ loose, and it's such a strong, legally-damaging word to throw around.

<comment><USER6> It's not my job to teach you Sexism 101, so I'll be brief. It reinforces to the minority of women in tech that they will be routinely otherized by their colleagues.

<comment><USER7> I'll ignore the pointless first statement just as you ignored several of my questions. If you don't want people questioning your opinions, don't share them publicly.

How, exactly, does the choice of name minimize women? If a woman wrote 'clit', would you say the same thing? If a woman wrote 'dong', would we call her sexist? I understand the problem, but we're really throwing the baby out with the bathwater here. An effective solution to stamping out sexism in the workplace does not, in my opinion, hinge upon commanding people to ignore the presence of their sexual organs and doing so is, I think, more damaging.

I don't want to live in a world where the mere mention of a body part launches an accusation of sexism. Neither do several women in tech that I know. Can we agree that in certain cases, we're being a touch _too_ sensitive when it comes to fixing the problem, and we should really choose more important battles than accusing a dev of sexism due to the name of a one-off, pointless Twitter client that he's not billing as the next Tweetdeck?

Fix sexism: Treat everybody equally, regardless of gender identity.

Don't fix sexism: Pretend gender identity and, by extension, sex, doesn't exist.

<comment><USER8> With a universe of possible ASCII combinations to choose from - just because a particular iteration is witty, it does not automatically exclude it from offending one or more groups of people (whatever the reasoning).

If you want widespread adoption of your tool, your best bet is to try to offend as few groups as possible.

<comment><USER9> "If you want widespread adoption of your tool, your best bet is to try to offend as few groups as possible."

I don't agree with this at all. Sometimes things are successful for the very fact that they're divisive. If your priority is to not offend anyone, you run the risk of being forgotten by everyone.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Termtter has been around for years. It does bad ass things like automate the Twitter OAuth process, stream live updates, and it has terminal colors:

<https://github.com/termtter/termtter>

Also:

<https://github.com/jugyo/earthquake>

<comment><USER11> I heard about at least a dozen of different command line Twitter client, most of which are just experimental projects. Which one would you _really_ recommend for daily use? (This is a general question, not directly related to projects mentioned in the parent comment.)

</comment></comment><comment><USER12> > Unfollow everyone you follow who doesn't follow you back

> t leaders | xargs t unfollow

This is an interesting way to circumvent the Twitter API guidelines - <USER2> above feature is disallowed and will get your key revoked. However, since each t user has their own key, enforcing this is implausible other than by throttling the rate at which you can unfollow people.

To be clear, I don't support people trying to do this in the first place, but it's a clever hack nonetheless.

<comment><USER13> Why is this bad? It sounds like a great way to clean up. (I don't use twitter much)

<comment><USER12> Unfollowing everybody who doesn't follow you is a sign that you don't actually follow people to read them, but instead follow people to generate spammy emails and increase your followers count.

Some people get agitated by this behaviour because either:

1\. They are only willing to receive follow emails about people who are actually going to read their content - otherwise it's effectively spam

2\. High following counts are a quick signal to help ignore spammy email, but spammy people mitigate this by unfollowing people who didn't follow back due to their spammy emails

If you'd like to clean up your following list to make it more readable, I'd suggest unfollowing a handful of high-volume tweeters, or using a tool like my Unladen Follow <http://www.unladenfollow.com/>.

</comment></comment></comment><comment><USER14> Slightly OT, a little power user tip for people using twitter.com is hit "?" and you'll see there's actually a ton of keyboard shortcuts in there. Much more than j and k for navigation.

</comment><comment><USER15> I've been using this for a while. This lets you effectively search your historic tweets which for me is a killer feature.

Sometimes I think of things I'd like to do with Twitter but I don't do them because it would require writing some custom script. Using t many of these ideas are easy to just do quickly from the command line.

</comment><comment><USER16> Earthquake is my favorite terminal based twitter client with streaming API support. Made with ruby. To tweet it is simply "⚡ Hello World!". <https://github.com/jugyo/earthquake>

</comment><comment><USER17> Does anyone remember mICQ, the command-line ICQ client? Man, it was _awesome_.

[0] <http://en.wikipedia.org/wiki/micq>

<comment><USER18> Bitlbee is a good modern alternative. Text support in IRC for OSCAR (AIM or ICQ), MSN, XMPP, Twitter, Skype etc.

[1] <https://en.wikipedia.org/wiki/BitlBee>

</comment></comment><comment><USER19> Am I the only one who hates how some projects are named like this?

<comment><USER20> The thing that struck me is that there are no one letter commands in UNIX (that I can remember off the top of my head). Not sure if there's any reason for this besides namespace scarcity -- only 26 one-letter commands you can have!

It feels pretty arbitrary, I guess, to decide that Twitter is special enough that it gets to be one of the 26.

<comment><USER21> "w" is standard on most UNIX machines,

At one time, "f" was a link to "finger" on many machines, but I think that's mostly died out now.

And of course there's "X", although you usually don't run that yourself at the command line unless you're debugging something.

</comment></comment></comment><comment><USER22> I wrote a similar but far more simple script in Python to follow all those who follow you and unfollow those who unfollow you. Take a look if your interested: [http://forrst.com/posts/Keep_your_twitter_followers_and_frie...](http://forrst.com/posts/Keep_your_twitter_followers_and_friends_in_sync-0uU)

</comment><comment><USER23> Love at first sight. Now it's easier than ever to appear busy at work while tweeting.

</comment><comment><USER24> Not as powerful, but written in pure C: bti <https://github.com/gregkh/bti>

Does the job as a simple Twitter client.

</comment><comment><USER25> The relationship terminology looks neat, but the ASCII table looks pretty messed up for me.

Maybe an HTML <table> tag is the right tool for the job here.

</comment><comment><USER26> So if someone follows me, and I don't follow them back, I become their leader? /me unfollows everyone

on a serious note: Leaders? too cool for school?

<comment><AUTHOR> I was torn about what to call them. I actually tweeted a request for suggestions: <https://twitter.com/sferik/status/193015186045681665>

I got some interesting replies but ended up going with "leaders" based on the logic that if someone follows you, you are their leader. Simple and easy to remember.

That said, I'm still open to other suggestions.

<comment><USER26> Ah, I see. Makes perfect sense.

</comment></comment></comment><comment><USER27> Hi sferik, This is excellent!, T is just great to remove all of the noise and concentrate on the gist of what you need to do.

</comment><comment><USER28> This is completely awesome! sferik rocks

</comment><comment><USER29> I like the relationship terminology T introduces. Looks like managing lists will be a breeze with this too.

</comment><comment><USER30> I don't know if it still works, but rubygems.org/gems/tit

</comment><comment><USER31> Used this to scrape through past tweets - totally handy!

</comment><comment><USER32> just used this to follow/unfollow automagically. its against Twitter ToS but every now and then never hurt anyone.

</comment><comment><USER33> Wow, this looks awesome. Great job.</comment>


Zen of Palm (2003) [pdf] - <AUTHOR> http://www.cs.uml.edu/~fredm/courses/91.308-fall05/palm/zenofpalm.pdf

<comment><USER2> In my youth, the closest thing I ever had to a gaming console was a Palm. There was a plethora of quirky, indie, and experimental games for Palm OS, here are some of the best I can remember:

\- All games by Naoki Ito. This Japanese genius made simple arcade-style games, always with short levels of increasing difficulty, all of them perfectly balanced and extremely addictive.

\- Space Trader. On the other end of the spectrum, a slow-paced trading and fighting game set in a generative world.

\- Sigma. A weird little game with dice and a bell-shaped cumulative bar graph, unusual but once you got the hang of it, it was impossible to put down. I sort of recommend installing a Palm OS simulator/emulator just to try this one out.

 _Edit: Alright, here 's some more:_

\- Car. A bare-bones version of GTA I. The best part was that the level editor came with the (free) game and ran right there on your Palm.

\- Space War. A turn-based strategy game where you move your (Star Trek inspired) ship on a hexagonal grid, and try to predict what your opponent will do during that turn.

\- Aldon's Crossing. A fairly classical top-down RPG. It seemed like a tiny game, but the more you played, the more you realized that the world was surprisingly huge.

And, of course, tons of remakes of ultra-classic games. Note that I only played a small portion of the palm-game-o-sphere, and I was limited to those that would run on my low-end grayscale Visor.

<comment><USER3> Please do go on! I remember Space Trader quite fondly. The intimacy of games for this platform is something I don't quite find in today's marketplace.

<comment><USER4> It was pretty fun re-playing Space Trader in Classic on an HP TouchPad.

And now I'm searching for that Windows port: [http://ticc.uvt.nl/~pspronck/spacetrader/STFrames.html](http://ticc.uvt.nl/~pspronck/spacetrader/STFrames.html) .

</comment></comment></comment><comment><USER5> > A proposal to add a menu bar that's always visible should be vetoed > reflexively, because the handheld screen is too small.

Practical wisdom from 12 years ago. I have been annoyed by every website that uses a horizontal bar. It takes up at least 1/5 of my phone's screen!

<comment><USER6> Or any other screen. And balloons in size if their third party JS font code don't load...

</comment></comment><comment><USER7> This brings back fond memories of Palm OS development. It wasn't the easiest platform to develop for, but as this document describes, user experience was emphasized and the thrill of making sophisticated tasks simple using constrained resources was satisfying.

</comment><comment><USER8> Funny that his topic would pop up. Years ago I posted to the PalmAddicts web site on this very topic. I see it is still there at [http://palmaddict.typepad.com/palmaddicts/2007/09/return- to-...](http://palmaddict.typepad.com/palmaddicts/2007/09/return-to- the-z.html)

You might enjoy reading it. I had almost forgot about it.

</comment><comment><USER9> PalmOS did a lot of things right. One thing I'd like to see make its way to mobiles again (or iOS at least), is better handling of "app data". PalmOS made it a point to separate the executable and it's data, in the form of a database file that could be easily backed up.</comment>


Khosla's Keith Rabois Aiming to Launch His Magic Home-Selling Site in June - <AUTHOR> http://recode.net/2014/05/23/khoslas-keith-rabois-aiming-to-launch-his-magic-home-selling-site-in-june/

<comment><USER2> Rabois potentially has a massive adverse selection problem on his hands here. i.e. the only ones willing to hit his admittedly low-ball bid are those whose houses have been mis-valued by the Homerun model.</comment>


What time is it? - <AUTHOR> http://www.andreehansson.se/code/wo-clock/

<comment><USER2> Following the author's own advice I have made a Mac OS X dashboard widget version and made it freely available:

[http://experimentgarden.blogspot.com/2009/10/dashboard- text-...](http://experimentgarden.blogspot.com/2009/10/dashboard-text-clock- widget-for-mac-os.html)

</comment><comment><USER3> Nice stuff. As mentioned at the bottom it is based off a production version by Biergert & Funk ([http://www.engadget.com/2009/08/20/biergert-and-funk- qlocktw...](http://www.engadget.com/2009/08/20/biergert-and-funk-qlocktwo- gets-an-english-version-our-sincerest/)) But it is worth noting that an instructable on how to make a lower cost version can also be found here :<http://www.instructables.com/id/A-Word-Clock/>

<comment><USER4> Interesting. The idea looks similar to Art. Lebedev's Verbarius clock, but more low-tech and more pricey.

<http://www.artlebedev.com/everything/verbarius/>

store: <http://store.artlebedev.com/office/gadgets/verbarius/>

I wonder if Biergert & Funk heard of Verbarius. Seems like Art. Lebedev was first with the idea?

</comment></comment><comment><USER2> The code is beautiful: very efficient and understandable. Nice share!

</comment><comment><USER5> Heh, a while ago I saw something similar done in Flash:

        http://www.simonheys.com/wordclock/

...and wanted to try it myself in HTML/JS:

        http://web.aanet.com.au/Screwtape/Toys/wordclock/index.html

The font-sizing code is a bit of a hack, but it seems to be a reasonable approximation, usually filling the viewport +/- a single line.

</comment><comment><USER6> Very slick. Time-telling devices are always interesting.

</comment><comment><USER7> > Please note that this webpage is using HTML5

Does the page uses HTML5 features, or just syntax?

<comment><USER8> _None of the above!_

The only thing remotely html5-ey about it is the use of <!doctype html>, which sane people have been using for years. I don't think he's using any features less than a decade old!

</comment></comment><comment><USER9> IT IS TIME TO GET A WATCH

Just kidding, love the hack, especially the font-face!

</comment><comment><USER10> This would be amazing if it weren't for the theme switcher and text at the bottom.

</comment><comment><USER11> You didn't light up the "A": "IT IS [A] QUARTER TO EIGHT".

<comment><USER12> "IT IS QUARTER TO EIGHT" is perfectly cromulent: <http://www.google.com/search?q=%22it%20is%20quarter%20to%22>

<comment><USER13> Though i agree, "IT IS QUARTER TO EIGHT" is perfectly cromulent. But thats not a justified explanation. Reason: 5,450,000 results for "it is a quarter to" against 226,000 for "IT IS QUARTER TO EIGHT"!!! :)

<comment><USER14> Yes. If we went that way, then apostrophe-s would denote a plural! (It's probably inevitable, anyhow!)</comment></comment></comment></comment>


You May Be Better Off Picking Stocks at Random, Study Finds - <AUTHOR> https://www.studyfinds.org/new-to-investing-you-may-be-better-off-picking-stocks-at-random-study-finds/ <comment><USER2> This has been known for what, 40 years?

[https://en.wikipedia.org/wiki/A_Random_Walk_Down_Wall_Street](https://en.wikipedia.org/wiki/A_Random_Walk_Down_Wall_Street)

<comment><USER3> Try 156 years!

> The concept can be traced to French broker Jules Regnault who published a > book in 1863 [0]

[0] [https://en.wikipedia.org/wiki/Random_walk_hypothesis](https://en.wikipedia.org/wiki/Random_walk_hypothesis)

</comment></comment><comment><USER4> If a random strategy is better than whatever the non-random strategy was then intuitively in most cases the inverse of the non-random strategy is better than the random strategy.

I am currently reading and would recommend "Bull!" by Maggie Mahar for a longer term view on the stock market than many people today seem to consider it on.

<comment><USER5> I think the logic here is flawed.

Take a really simple portfolio... I buy (or go long on) 1 share of GOOG and 1 share of MSFT. Over a decade I make an average of a 7% return per annum, while the random strategy makes, 8%.

What exactly would the inverse of my strategy be? To go short on GOOG and MSFT? That would do even worse and in that case I'd actually lose money.

<comment><USER6> Would it be long every stock except GOOG and MSFT?

<comment><USER7> Boglehead reporting in, you should long every stock.

<comment><USER8> Observation: I find the uptick in stock buying articles just when the market is at it's frothiest quite interesting.

Stay vigilant out there traders, don't eat the 30% haircut that will be visiting global financial markets shortly.

<comment><USER9> I'm confident that haircut will come.

I am not at all confident that anyone can predict when it will come well enough to avoid it.

Remember that the last 3 months of 2018 saw the market drop ~20%, only for it to recover over the next 3. Were you able to sell in September and buy at the bottom in December? Almost certainly not...

<comment><USER8> Yes, our prop group made quite a bit with out-of-the-money AAPL 135 puts (AAPL will hit this strike price again).

Alarms bells are ringing in this market... If your good at risk management and can initiate low cost perma-bearish positions, you will be rewarded heavily over the next year or so.

Alpha chasers that don't have risk management skills should just buy Bitcoin (dont sleep on this, the halvening is May 2020-ish). Dollar-Cost-Averaging will get you a decent entry price.

Warning: Bought more 120,130,140 AAPL puts in prep for next collapse, if your in my way, I will literally eat your lunch.

Good luck guys!

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Isn't the audience for this _individuals unqualified to be investors_?

The UBC press release isn't as advertorial bad as the studyfinds.org piece, but they both seem to implicitly endorse lottery-playing by unqualified individual investors, IMHO.

The UBC release could've segued from "diversify", to pushing unqualified to people to low-ER total-market index investing, or to balanced target funds based on same. Instead, they're just helping pump unqualified people to gamble and be fleeced.

<comment><USER11> indexing is not random but a bet on the market as a whole.

Random is random. In a way picking more varieties may offer protection in a downcycle.

Most stocks go up but bigger stocks push indexes. Betting on bigger players is different than betting on any player to go up.

</comment></comment><comment><USER12> Another recommendation would be to take an approach outside of price-based time series models. Elastic has an article on this 'Generating and visualizing alpha...' [https://www.elastic.co/blog/generating-and-visualizing- alpha...](https://www.elastic.co/blog/generating-and-visualizing-alpha-with- vectorspace-ai-datasets-and-canvas)

</comment><comment><USER13> Isn't this the whole premise of A Random Walk Down Wall Street.

</comment><comment><USER14> How is this not the same conclusion as other studies that find that index funds out perform others?

<comment><USER15> In addition to diversification that reduces risk of overexposure to down sectors or typically over-performing assets, index funds have survivorship bias: underperforming assets are replaced by assets that meet the fund's criteria.

<comment><USER16> Yes its sad that every one jumps on index funds which can be a good idea but its not the right choice 100% of the time.

</comment></comment></comment><comment><USER17> 2 years after the ~2008 crash, I bought stocks in 4 companies that didn't yet recover yet from the crash... 2 of them doubled in value in just a few months and 2 of them went to basically zero... so I just about broke even.

<comment><USER18> A portfolio of four stocks is as good as a single random stock. Diversify more, there's a reason why the S&P500 is 500.

<comment><USER19> i think the utility of further diversification becomes pretty low after you have around 30 stocks in a portfolio. assuming those 30 stocks are actually diversified and are not e.g. 30 tech companies, or 30 companies in the UK.

<comment><USER20> I wonder if there's any advantage to picking 30 stocks versus just investing in some big index fund like VT or whatever.

<comment><USER19> There's a lot to be said in favour of investing into a low cost ETF that attempts to passively approximate the distribution of stocks as they appear in the market.

I think there are potential advantages to selecting stocks or weighting stocks according to criteria other than market capitalisation (unlike passive investment approach) but most people who try to do that do worse than a passive approach.

A passive investment approach like putting money into VT ETF depends upon some fraction of market participants doing the work to actively set market prices. If enough of the market goes nuts and bids up the price of some security far above its actual value (e.g. IPOs for businesses that run at a loss with no obvious path to making a profit) then the downside of a passive approach using market capitalisation as weights is that you will invest some tiny fraction in these companies with irrationally inflated market caps.

Part of it is also a question of how much time and mental energy you want to put into learning about how to value companies and investigating options for investment. Investing in 30 individual stocks vs 1 ETF also creates about 30x as much work at tax time...

</comment></comment></comment></comment></comment><comment><USER21> Yes, variance is reduced by averaging over many uncorrelated variables. This sums up about 75% of investing articles.

</comment><comment><USER22> _May be_? We have known for years (decades?) that beating the market isn't exactly easy even for professionals. So why would amateurs? The only way to beat the market is to know more than the market.

<comment><USER20> Knowing more than the market could work - that seems like winning through skill. Perhaps a second (perhaps even a more likely) mechanism would be winning through luck?

</comment></comment><comment><USER23> Firms like renaissance have and continue to dramatically beat the market.

However, renaissance also has a collection of people that could probably produce a Nobel in physics if that's what they worked on.

</comment><comment><USER24> "Why look for the needle in a haystack, when you can just buy the haystack?"

\- Jack Bogle

The secret to wealth building can be found at bogleheads.org

</comment><comment><USER25> This is a non result. Of course picking singular stocks yourself with little understanding of the financial market or the companies in question is a terrible idea. The real question is: Does this approach perform better than a maximally diversified index fund?

<comment><USER26> I read the article as a "just buy a low cost whole market index" \- which seems to be the most common advice out there.

Assuming your randomness generator was fair and you bought enough stocks, your 'buy stocks at random' strategy, if you bought enough stocks, would eventually get you that maximally diversified index fund, I think?

I mean, I think the difference at scale is all in the weighting; if you bought one share of a random ticker on every throw of your random generator, you'd be overweight stocks with high per-share values vs. just buying, say, a basket of VTX, VXUS and VWO, which are weighted in more reasonable ways.

</comment></comment><comment><USER27> Are they trying to confirm this?

[https://en.wikipedia.org/wiki/Efficient- market_hypothesis](https://en.wikipedia.org/wiki/Efficient-market_hypothesis)

<comment><USER28> Not really, because they're only talking about amateur investors.

</comment></comment><comment><USER29> You'd need international exposure on your national exchange. Also by this logic multinationals should be solid investments but maybe they lack growth potential.

</comment><comment><USER30> Isn't it the same as an index fund?

</comment><comment><USER31> Just not in altcoins. Just don't.

<comment><USER32> In public stocks there are always underappreciated future growth rockets. You can try to find them by analysis, at random, or by buying the entire index.

Altcoins don't have growth fundamentals because nobody uses them, so at best you're betting on holding a coin and selling it to a bigger sucker.

<comment><USER33> Considering that Bitcoin has very high and unreliable fees it's not good to buy things with. Instead Bitcoin Cash has gained a lot of adoption recently, for example all stores using BitPay also accept Bitcoin Cash. Also Monero is far superior in terms of privacy (and fungibility).

These are two examples with much better growth potential than Bitcoin, while being underappreciated by the masses.

</comment></comment></comment><comment><USER34> I read the article and tried to read the linked study (paywall). But I see no mention of the 'random' part of this outside the introductory paragraph. In order for the headline to be true, wouldn't the study have had do asses some performance of 'random' picks?

Rather it seems that people were encouraged to take more 'risky' stock picks, and _that_ led to some improved success, not anything to do with random.

I think the title and introduction are wrong, having extrapolated incorrectly from the study itself. I don't really know since I can't read the study.

But I think I strongly disagree with the premise. I think picking stocks at random is likely to lead to uninterested investors who may lose interest in frequent contributions to their stock accounts as they have no personal connection or awareness or interest in the location or use of their funds.

Yes, diversification is important, but so is awareness. Is it really _better_ for the individual who may unknowingly invest in weapons manufacturing or a declining coal business despite their own morals and indicators of poor picks? I don't even think this was tested for in the first place.

<comment><USER28> If you're interested in the actual study, I found it here: [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2956122&...](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2956122&download=yes)

(If a signup form appears, just scroll down)

</comment></comment><comment><USER35> This is absolute malarky made to make people feel better about sub-optimal returns. There are definitely strategies which provide greater than 8-10% YoY returns, or random walk, or indexes. People that know them, rarely will share the full - but will occasionally share glimpses. It can be hard to do for very large portfolios, say $10B+, but not for smaller portfolios.

<comment><USER36> Notice how whenever someone claims there are ways to consistently beat the market by some incredible amount, they never seem to be able to point to anything specific. It's always "Ohhh, there are these hidden wizards who do it, and they (conveniently) don't tell anyone the ways of their sorcery, but trust me, they exist in dark smoky rooms somewhere!! You're just not invited."

It's like "I assure you, extraterrestrials exist, there's just no visible evidence of them and they never show themselves. But they're out there I swear!"

<comment> B-Con Not a good analogy because the people who hypothetically can best the market have incredible incentive to not share the details.

<comment><USER37> Sometimes they share how they beat the market in the past after their advantage faded, i.e. [http://www.edwardothorp.com/books/a-man-for-all- markets/](http://www.edwardothorp.com/books/a-man-for-all-markets/)</comment></comment></comment></comment>


The coming dollar collapse? - <AUTHOR> http://www.telegraph.co.uk/money/main.jhtml?xml=/money/2007/10/16/bcnchina116.xml My summary/opinion: http://irei.wordpress.com/2007/10/17/will-the-dollar-collaps...
What do you think? <comment><USER2> The fed needs to raise interest rates in order to have a strong dollar. The fed needs to lower interest rates to help the housing market. I have a feeling they will do neither.

This can be good for us, find a angel or VC in Britain where there Sterling is now worth more then 2 of our dollars.

A few years ago I owned the domain ehosting.com, I sold it to a hosting company in Britain they were really happy that they were getting it at close to half price (not that they paid much for it anyway). That has always stuck with me and the value U.S. startups might have to a UK investor.

</comment><comment><USER3> Mike Shedlock has some interesting background data:

[http://globaleconomicanalysis.blogspot.com/2007/10/what- fact...](http://globaleconomicanalysis.blogspot.com/2007/10/what-factors-are- affecting-us-dollar.html)

</comment><comment><AUTHOR> My summary/opinion: [http://irei.wordpress.com/2007/10/17/will-the-dollar- collaps...](http://irei.wordpress.com/2007/10/17/will-the-dollar-collapse/)

</comment><comment><USER4> this scares me. but it's needed.</comment>


Compile-time C++ RNG tricks - <AUTHOR> http://www.elbeno.com/blog/?p=1288 <comment><USER2> It looks like the only source of entropy is the build time. So in his example he's generating a GUID with way too little entropy, especially if builds are generated at predictable times, which would cause collisions. If you go further and attempt to encrypt anything using this random stream you're gonna have a bad time.

<comment><USER3> This sort of reminds me how some IRC servers that engage in hostmask obfuscation can have it possibly reversed via a table lookup because the seed value used to produce that is generated at compile time based on epoch and said time is generally included in the server details, visible to any user at connect--this is specific to Unreal IRCd.

Example:

        16:37:30 [network] -!- Welcome to the ircnetwork.network IRC Network afreak!irc@hostmask
        16:37:30 [network] -!- Your host is ircnetwork.network, running version Unreal22.214.171.124
        16:37:30 [network] -!- This server was created Thu Oct 15 2015 at 00:00:55 UTC

</comment></comment><comment><USER4> It's an interesting approach, but seems far more complex than just generating a random string via a program in the Makefile and importing it into the code as a #define ... this way would allow you complete freedom to pick the random number in any way that you liked.

A simple method would be something like:

RANDOM := $(shell openssl rand -hex 8)

<comment><USER5> Yeah this is one of those C++ template tricks where one wonders if it's really worth it doing it in C++.

Also the purpose seems to be to mark every build as unique. You'd want to store that number somewhere, or it wouldn't be very useful at all. You know, some small database with <who compiled>,<when>,<machine>,<commandline>,<version> and maybe even a diff compared to a known revision number. To really make it useful. That ... just wouldn't be doable in C++.

<comment><USER6> It would be doable, sure.

It just might not be the most efficient solution. ;-)</comment></comment></comment>


Raspberry Pi: An update for element14/Premier Farnell/Newark customers - <AUTHOR> http://www.raspberrypi.org/archives/1081

<comment><USER2> Probably not a good time to tell you I have mine sitting next to me on the desk running Debian!

It's a great little board - it's early days and there are a few rough edges; for example, they're especially fussy about the 5V supply rail and some people are having issues with cheaper micro USB cables and adapters, for example, things work well until the CPU gets a bit loaded, current draw goes up, the 5V rail drops a bit and the network disappears. A lot of this fact-finding stuff is appearing in the wiki though to help out those who come by later.

I predict lots of fun and interesting times ahead.

</comment><comment><AUTHOR> Update: E-Bay UK has them in buckets... about £140 for the leading item right now...

<http://tinyurl.com/7tuotsf>

Great news that the Pi is shipping, there must be a lot of eager people out there, cannot wait to see the first wave of responses, genuinely exciting times ahead :) Oh, and don't forget to add one of these to the order for open audiophile audio out :) <http://nwavguy.blogspot.co.nz/2012/04/odac- released.html>

"We now have in excess of 100,000 confirmed orders for the Raspberry Pi globally and can confirm that everyone who ordered before 18th April (i.e. today!) will definitely receive their Raspberry Pi before the end of June 2012, whatever your existing order confirmation says! "

<comment><USER3> That really gets on my tits that, people buying a product and selling it for a much higher price. I'm all for supply and demand but £100 - £150 more than the retail price is pathetic!

If they didn't want them in the first place they shouldn't buy them!

<comment><USER4> You'll see this same behavior anywhere demand greatly exceeds supply. I know I'll never see a Raspberry Pi in real life because they refuse to meet demand for whatever reason, so it doesn't really bother me.

<comment><AUTHOR> I am not sure they are refusing, I think they know that to grow a large company takes time, and this is the first version of the first device that is available at scale. And as to the taking advantage, well, none of these people have large quantities, one I believe is doing it for charity, the others, sure, a bit of opportunism, but hey, fortune favours the brave, it was not their fault there is high demand, and ultimately high demand is a good thing for Pi and us :)

<comment><USER5> Although it's unfortunate that some people will not get their Pi, the reality of a lack of supply (just scaling up, like you said) leads the market to do the most efficient thing:

Some customers are willing to pay the higher price. If nobody will buy at that high of a markup, you can be sure the prices will come down.

So for whatever reason, those who feel it's worth the extra money can get theirs first.

Since this is such an inexpensive device, it's certain to become widespread. This price bump will be short lived.

</comment></comment></comment></comment></comment><comment><USER6> This is irritating: I still haven't figured out how to buy one and I "registered my interest" with both of the initial suppliers, neither of whom have contacted me with purchasing info, within hours of the release annoucment.</comment>


Most Americans Do Not Want Google-ish Glasses, Drones, Or Lab-Grown Meat - <AUTHOR> http://www.fastcoexist.com/3029381/most-americans-do-not-want-google-ish-glasses-drones-or-lab-grown-meat <comment><USER2> It's cliche, but time to trot out the old Henry Ford line: If he'd asked people what they wanted, they would have said a faster horse.

If you asked people in 2006 what they wanted from their phone, would they have come anywhere near close to describing today's all-powerful smartphones? They probably would have asked for better reception and a new version of Brick Breaker.

<comment><USER3> Depends on whether people actually _saw_ an automobile before they _heard_ about the concept. And of course, people aren't visionaries. They usually do want what they have now--only better. The difference, at least with Google Glass, is that people have seen it and still don't want it. The burden is on Google to show people why they should want Glass. So far they haven't done it.

<comment><USER4> To be fair, even lots of tech geeks don't want Glass. Overall I'd say it's pretty unimpressive. I'd certainly be interested in a more powerful device of that nature, but Glass seems like a pretty niche product that most people have no use for.</comment></comment></comment>