I don't know what to do with life - <AUTHOR> I enjoyed computer science in school... but I have had 8 jobs in 8 years... I get stressed out from programming... I enjoy talking and also solving problems. I get depressed and think of killing myself.., I have always been handed everything in life.., please help me... I no longer know what I want to do career wise <comment><USER2> If your depression is to the point that you think about killing yourself, the only thing you need to do is seek professional help.

No amount of job switching or career advice will fix that issue.

If you keep chasing the magic job that will make you feel fulfilled and content with life, you will spend your whole life searching.

</comment><comment><USER3> All you need to know about suicide is it's a fleeting thought that enters your mind usually after you've consumed a lot of alcohol/drugs, and if you don't call anybody to talk you down from doing something embarassing, you'll regret it, because everybody I've ever talked to who tried to kill themselves was completely embarassed and swore it wasn't them, it was just a temporary mental illness who ruled their existence for all of 30 minutes or so before they changed mood.

Anyway, if you enjoy solving problems go work for academia, they're always hiring programmers, they pay next to nothing, but you won't be stressed (unless you fuck up somebody's thesis) but otherwise it's pretty easy. I did it for 5 years and it was the best decision I ever made: working with post- docs and grad students bleeding information from them, total autonomy to do what you want, union position so impossible to get fired, you get a letter from the post-doc's shilling your abilities you can use for grad school. Look at your local universities for these positions, guaranteed no local student will take them because they don't pay enough.

</comment><comment><USER4> I think I know what you mean about programming being stressful. It's not the code per se but programming boils down to getting something with the intelligence of a fly (a computer) to anticipate all the needs (known or unknown) if users while coding in tech stacks that actively encourage things to go wrong, in a world where hackers are one step ahead of everyone, and if anything goes wrong you need to cycle up your brain to 100% to quickly fix it or the business is in trouble, while just being a salaried employee.

Even when working for a laid back company I feel stressed with all this.

I'm sure the same stress is in other jobs. Sales people have their targets and seem to get fired more easily. Support people deal with irate people all day.

Not sure how to solve your problem but if you can live more cheaply, try to do 30h a week or less, maybe figure out what kind of programming job would be less stressful, and scratch some side project itches in your spare time with friends. I reckon that might help.

As for the depression - go see a professional right away. That's the #1 priority. Book it now.

</comment><comment><USER5> > I get stressed out from programming

Deleted code is debugged code. There is a fallacy that more lines of code means a better world. Why not try doing things that don't require coding skills, and try doing more point-and-click things. Personally I only code if I _really_ have to and my livelihood depends on it (but luckily I can now afford not to code and focus on other things). I recently switched to doing social media marketing for a small handful of clients. It's good money for what is essentially managing a few Twitter & Facebook accounts :)

</comment><comment><USER6> Get a road bike (I recommend a Cannondale CAAD12) and get into cycling... it'll change your whole perspective man.

This stuff is just bits and bytes - don't take it too seriously.

<comment><USER7> I did the same, and I agree it works.

</comment></comment><comment><USER8> Please seek help right away if you're thinking of killing yourself. Go see a professional.

</comment><comment><USER9> Don't worry too much about a career. Worry about being happy. Life isn't supposed to be about work. We work so we have money to live. Our identity should not be defined by how we earn income. I know that's easier said than done but we are more than what we do. I agree with heyoni, chill out awhile. Your overall well-being should be your top priority whenever feeling down. There isn't anything you HAVE to do.

</comment><comment><USER10> > I get depressed and think of killing myself...

Are you familiar with the State → Strategy → Story framework?

Before you can solve the work/career piece, get out of your mind and into your body.

Simple hack is transformative. > [https://medium.com/@BogdanYZ/how-to-start- your-day-better-in...](https://medium.com/@BogdanYZ/how-to-start-your-day- better-in-30-minutes-or-less-f2d396b0a622)

</comment><comment><USER11> Is it an option to take a "chill" job and take a break from climbing the ladder? Programmers are in such high demand, there are places where you can go and clock out at 5pm, take an hour for lunch and never take your work with you...as long as you're ok taking a pay cut.

<comment><AUTHOR> Meaning at this point I don't care about money... and I don't like C#. I think java is a far superior language and Microsoft sucks...

<comment><USER4> ? I'm sure there are easy Java jobs too. Microsoft is getting less sucky by the way. I haven't heard Microsoft sucks for a long time now. Makes me nostalgic.

</comment></comment></comment><comment><USER12> Sounds like being burnt out. Which in turn leads to depression and all the negatives that go with it.

"Programming" is a very broad category. Since you enjoyed CS and working on problems at university, there could be specifics of your current work situation that are stressing you out. You could analyse your situation and identify which aspects are stressing you out. Is it the technical issues, the management's expectations, the lack of peer support, the constraints of the environment, etc?

Once you have identify what specifically causes the stress, you can plan changes that give you more of what you like and none of what causes you stress. And, yes, there is more to life than programming.

</comment><comment><USER13> Why do you get stressed out from programming? Where are your team members? They should be there to give you support. And maybe you are trying to hard. You don't have to program at breakneck speed every day. I have a feeling you are being too hard on yourself and you are trying to write perfect code. Don't do that. Don't have an ego. Work with your team. Allow yourself to learn and get better, and learn how to take criticism. You are one of the luckiest people in the world to have the occupation that you have. Everyone else has so much more of a tedious, stressful and tiring work life. Appreciate your gifts and what you have.

</comment><comment> d--b Please go see a psychiatrist tomorrow. You are depressed. It's a disease. They'll give you treatment that's appropriate. It will remove the bad feelings while you figure out the career stuff.

</comment><comment><USER14> Better title: "I don't know what to do with my life"

</comment><comment><USER15> your problem seems to have little with your career and a lot with with your depression. I suggest that you visit [https://brokenbrain.com/](https://brokenbrain.com/) to listen to what Dr Hyman has to say about the root causes of depression. And guess what... if you can find your root causes you can solve your depression.

</comment><comment><USER16> Have you thought about breaking into Management/Business Analyst? If you like talking to people, solve problems, and have some programming experience I bet you will be an excellent asset for any company. Good luck.

</comment><comment><AUTHOR> My parents don't care what I do... as long as I am happy I only enjoyed ai work but that requires statistics which isn't my strong suit...

<comment><USER17> you can try focusing on ai implementation then, there are a lot of implementation tasks you can still do regarding ai with just basic college level math and high school stat skills.

<comment><AUTHOR> Nowadays I lack motivation to do anything...

<comment><USER17> Excellent, now you know your real problem; motivation, this is easily solved by thinking hard and deep on the one change you will like to see happen in the world(humans living forever, space travel, e.t.c), once you figure that one thing you want to see happen try and find a way to contribute to it even a little bit, motivation will come then.

You can either work normal jobs(preferable) and work part time on that goal or you focus mainly on trying to help see that change happen.

Takes things slow though and remember it does not have to be a grand goal or better you can try working on a very small part of a grand goal, for example if you are interested in climate change being solved you can help this happen by eliminating one of the bottle necks that people have to believing climate change in the first place; access to verifiable data, you can build a platform that collects this data from goverments and institutions around the world and make them available to the average Joe in visual parsable form.

<comment><USER17> Here is where that take it slow advice comes into play, also prioritizing all your interest in relation to your level of interest in them, your skill-set, and your network is definitely the key here.

It is either that you are definitely more interested in one than others or you are more suited skill-wise to another one or you are a 2nd degree connection with someone entrenched in another. One of these should come into play and be the deciding factor.

</comment></comment></comment></comment></comment><comment><AUTHOR> Another reason I enjoyed college was because money didn't matter... it was the fun of working on problems with friends. It was fun

</comment><comment><USER18> Don't do anything stupid. You might want to quit your job and take some time off. Maybe even start a business.

</comment><comment><USER19> Maybe you can work for a while for hotlines. For peoples who are in an extremesituation. National Suicide Prevention Lifeline maybe? So you can talk with people who think/feel same and maybe you have a solution for their problems. Maybe this could be a solution to your problem, too. Or invent a hotline for stressed programmers. Depressions can have different roots. When you know its because youre stressed by programming,then dont do it for money. Do it only for yourself and try something new. I now ask my self, what would they answear to you when you call them and ask for a job?

And if you had always been handed, maybe you should go on a trip. Go visit other countrys, see other peoples problems maybe you could solve, go see how they live. The whole world needs different solutions for many problems.

<comment><AUTHOR> I have lived in London and India when I was younger... I never wanted to move to the us but did because my parents moved here</comment></comment>


Tutorial – Arduino and ILI9325 colour TFT LCD modules - <AUTHOR> http://tronixstuff.wordpress.com/2013/04/26/tutorial-arduino-and-ili9325-colour-tft-lcd-modules/

<comment><USER2> Doesn't this take the fun out of generating an [analog] video signal from a microcontroller though? Where's the cycle-counting timing goodness?

Kidding aside, this looks like a fantastic toy to play around with.

<comment><AUTHOR> Gotta start somewhere ;). I'l see how it goes, have two LCD's ordered and on the way now.</comment></comment>


Worst Tech article ever written  Microsoft "i-Pad"? - <AUTHOR> http://www.techietweet.com/microsoft-to-launch-the-long-awaited-ipad-soon/

<comment><USER2> Why bother posting it?</comment>


CPython: GitHub migration scheduled for Friday - <AUTHOR> https://mail.python.org/pipermail/python-dev/2017-February/147341.html <comment><USER2> As a Python user, I have mixed feelings about this change.

I think this move to corporate hosting is acknowledgment of usability and ease of use at the expense of political purity -- for a project as important and major as Python, this further solidifies GitHub's positioning as the place where open source coding "happens" (consider what a move to GitLab would have done for the legitimacy of their platform), a position that they've very successfully used to up-sell "free" into paid accounts.

Python preceded and will outlive GitHub, but this now implicitly means Python is amplifying and promoting the various political positions[0] of GitHub by driving more traffic and money to their platform, which is run by a company that currently employs at least two people to be politically active who have publicly made questionable/racist statements[1]. If you personally agree with GitHub's politics, great, but some do not or would prefer their work to have more apolitical side-effects.

That said, as someone that "source dives" on the semi-official CPython mirror on GitHub, then verifies on hg.python.org, this makes my life easier, and I'm only a casually interested party of the CPython source. I do wonder about the increase in (people) management overhead the ease-of-use will bring in filing "issues" with the project though, as the prior mechanism acted as a filter for non-technical people and those unable to follow instructions.

[0] [https://action.github.com/](https://action.github.com/) ; [https://github.com/blog/2039-adopting-the-open-code-of- condu...](https://github.com/blog/2039-adopting-the-open-code-of-conduct) (in contrast with PSF's [https://www.python.org/psf/codeofconduct/](https://www.python.org/psf/codeofconduct/) );

[1] "some of the biggest barriers to progress are white women" \- GitHub's VP of "Social Impact" ; "don't think we'll succeed teaching white, male middle managers empathy and compassion anytime soon ... so let's limit their scope of damage" \- GitHub's Technical Director for "Social Impact"</comment>


Ask HN: What do you think is the point of education? - <AUTHOR> <comment><USER2> <semi-snark-on>

0\. daycare

1\. interact in social environment

2\. conformity to economic structure

3\. degree = show you can stick it out

?. learn

</>

But really everyone should have the opportunity and incentive without crushing debt. It can advance understanding and yes "reduce suffering."

</comment><comment><USER3> Reducing the suffering of humanity.</comment>


Ask HN: What are micro problems in Biotech? - <AUTHOR> I'm new to HN and I loved the idea that there are so many hackers over here. Enough with the thanks, I really want to know how the biotech industry is going. What I see on the internet, and the book "Zero to One", it's pretty much way opposite to the tech industry.
 There are huge problems like anti-aging, curing cancer, genetic diseases, and etc. But are there any problems in the lab? Like any reason why the experiments can be slow, hard to reverse engineer biology, and etc.
 I know this question is pretty vague and hard to understand, but I hope to find some discussions about the problems in biotech. <comment><USER2> Honestly, my biggest surprise is that histological sample preparation has not been completely automated. That is, making slides of biological tissue for further analysis. It's an incredibly repetitive job that could benefit from the precision of a well-tuned machine. Whoever seriously tackles and solves this problem would capture a very thankful and eager market.

<comment><AUTHOR> Woah thanks for your shares!!! I really, really appreciate it. Could you give me what kind of things to study to actually experience the problem myself? Or is it a real hard job to get?</comment></comment>


Shit Programmers Say - YouTube - <AUTHOR> http://www.youtube.com/watch?feature=player_embedded&v=8WZr6fvtEgk#! <comment><USER2> love this version. Been coming cross all kinds of different "shit * say" lately and most of them were pretty pretentious.

Love how this video depicts programmers as people who value "shut up and get things done" :)</comment>


Indie Game Fez is Eurogamer's Game of the Year - <AUTHOR>

eurogamer.net seems to be tripping HN's spam filter, so here's the link: http://www.eurogamer.net/articles/2012-12-30-eurogamers-game-of-the-year-2012 <comment><USER2> Saw Fez on Indie Game: The Movie. Glad to see it worked out, I'd recommend the movie to anyone that hasn't seen it yet either its a great watch.</comment>


Announcing The Dark Mail Alliance – Founded by Silent Circle and Lavabit - <AUTHOR> http://silentcircle.wordpress.com/2013/10/30/announcing-the-dark-mail-alliance-founded-by-silent-circle-lavabit/ <comment><USER5> I appreciate the cheekiness of calling it the "Dark Mail Alliance", but from a purely PR perspective, it would make sense to reconsider your name if you are taking the position that encrypted end-to-end email is not solely an interest of those pursuing shady or deviant activities.

<comment><USER6> I totally agree, I _really_ think you should change the name.

Some suggestions:

\- Locke Mail [from John Locke]

\- Mill Mail [from John Stuart Mill]

\- Hobbes Mail

\- Liberty Mail

<comment><USER7> Freedom \ Liberty \ Patriot \ Constitution Mail would be very effective in blocking political speeches and biased headlines from cheap attacks. My personal favorite is Lincoln Mail... Seems highly appropriate on many levels and should be FOX News proof.

<comment><USER8> As a non-American, all of these terms remind me of irritating American flag- waving rhetoric (the kind used to justify the types of things that the NSA is doing right now, for that matter), and I would wager most of the world would feel the same.

<comment><USER9> So why not use multiple brands? I don't think the name is to be taken lightly at all, and naming it in such a way that doesn't make it such an easy target could do some real good. They just need to bring the tech, and then we can have a whole laundry list of names suitable for different languages/cultures.

</comment></comment></comment></comment></comment><comment><USER10> I hope they are successful. For a long time I have wished that someone with the expertise and time would be motivated to create a new email system from the ground up, and make that system widely available and 'open' (in the sense of open protocols).

There are many challenges, but if they can pull it off there are many benefits as well. And perhaps the nicest part is that it is hard to actively oppose such efforts without revealing an intent.

<comment><USER11> I think the biggest barrier to entry of any new and secure email protocol will be GMail. GMail (and similar services) are what most people seem to use at this point.

And GMail won't update to 3.0 in any meaningful way, no matter what, since they want to be able to mine the data in your email, so they will still be storing it on their servers "in the clear." Which means the next time NSA hacks their servers, they'll still be able to read all the email.

Best case is that email 3.0 will interoperate with 1.0, or GMail at least accepts 3.0, if only to unencrypt it on their servers. Short of that, it would take a compelling use case to convince people to leave GMail, so we'd be right back to where we are with email 2.0: No critical mass of adoption, meaning 98% of the email you receive and write is unencrypted.

<comment><USER12> > GMail won't update to 3.0 in any meaningful way, no matter what

Perhaps this problem can be addressed by having a plugin/add-on/extension that decrypts the mail within the browser. GMail, Yahoo, or other mail providers that don't adopt this new and secure email protocol won't get the plaintext of your message, and preferably not the metadata either.

This requires that the new protocol use a converter or proxy or something to be able to talk to the existing email infrastructure. I'm sure this idea has occurred to the Silent Circle and Lavabit guys.

<comment><USER13> Maybe people could run a local app/filter that extracts keywords from our own mail and shares them with google. Leave the power completely in our hands to give to google what we feel like giving them.

<comment><USER14> This patchwork approach to attempting to solve a large broken system has visibly failed analogously to politics, in terms of preventing the threat of mass-surveillance.

I don't see how this is any different. We need new technology to solve new problems. Decentralization. Changing behavior is not easy, but sometimes necessary. Everything else being proposed seems half-assed (for lack of a better word) and easily circumventable by a resourceful adversary.

As long as Google (or whomever) holds all the cards and has a lot to lose by not complying to threat of force (for ex. shareholders and stock prices), then we won't get anywhere.

</comment></comment></comment></comment></comment><comment><USER15> I am definitely no security expert, but from my feeling it seems as if unsecure protocol + secure messaging layer is much more successful in practical applications than purely secure protocols. Therefore my believe would be that improving existing secure messaging layers would help the world much more than creating another secure protocol which nobody will use because it would require to replace the whole infrastructure. Especially Email seems to be something that is unlikely to go away, because of its long history, huge infrastructure and simplicity.

<comment><USER16> The problem with e-mail is that gathering the meta-data is almost as valuable as looking inside at the message contents. Secure messaging layers aren't going to help you there - unless everyone starts using something like Tor.

<comment><USER17> Why Tor? We have had mix-nets for many years, and they do an excellent job of protecting metadata. Even old-fashioned cypherpunks remailers do a fine job at that.

<comment><USER18> Appologies for the spelling errors in this note below - it's an OCR of an old printout (I've been unable to find a current archive of cypherpunks going back this far):

Cypherpunks archive-96.02.29-96.03.06: List of reliable remailers

List of reliable remailers Anonymous Remail Service (firstname.lastname@example.com) Sun, 3 Mar 199609:18:03-0500

( Messages sorted by: [date][ threa4][ subject][ author] ( Next message: Adam Shostack: "Re: NYT on Crypto Bills" ( Previous message: Raph Levien: "List of reliable remailers" ( Next in thread: Black Unicorn: "Re: your mail"

Thought that this was worth reposting:

>1 attended last weeks "Information, National Policies; and International >Infrastructure" Symposium at Harvard Law School, organized by the Global >Information Infrastructure Commission, the Kennedy School and the >Institute for Information Technology Law & Policy of Harvard Law School.

>During the presentation by Paul Strassmann, National Defense University >and William Marlow, Science Applications International Corporation, >entitled 'Anonymous Remailers as Risk-Free International Infoterrorists" >the questions was raised from audience (Professor Chaarles Nesson, >Harvard LAw School) - <USER2> a rather extended debate - whether the CIA and >similar government agencies are involved in running anonymous remailers >as this would be a perfect target to scan possibly illegal messages.

>Both presenters explicitly acknowledged that a number of anonymous >remailers in the US are run by government agencies scanning traffic. >Marlow said that the government runs at least a dozen remailers and that >the most popular remailers in France and Germany are run by the >respective government agencies in these countries In addition they >mentioned that the NSA has successfully developed Systems to break >encrypted messages below 1000 bit of key length and strongly suggested >to use at least 1024 bit keys. They said that they themselves use 1024 >bit keys.

>J ask Marlos afterwards if these comments were off or on record, he >paused then said that he can be quoted.

>So I thought I pass that on. ft seems interesting enough, don 't you > think?

>Best

> Viktor Mayer-Schoenberger >Information Law Project >Austrian Institute for > Legal Policy

email@example.com

( Next message: Adam Shostack: "Re: NYT on Crypto Bills" ( Previous message: Raph Levien: "List of reliable remailers" ( Next in thread: Black Unicorn: "Re: your mail"

I of 1 05.09.96 01:58

</comment></comment></comment></comment><comment><USER19> My Fucking Mail would be a better name. As in, it's mine, do fucking not read it. Sorry for the profanity but I think it fits how many people feel about this.

<comment><USER20> I do share your sentiment! The shorter "MyMail" makes the same point without needing the profanity, and your more emphatic name would then be available for the most desirable MyMail client...

<comment><USER21> MeMail

<comment><USER22> That's the Irish version, as in, "Do not read me mail."

</comment></comment></comment></comment><comment><USER23> To everyone complaining about the name: it is just the name of the advocacy/development group. You don't call SMTP mail 'IETF mail', nor should you call call whatever they come up "dark mail alliance mail".

<comment><USER24> "Well, Bob, as your viewers may know, 'Smith Mail' came out of a group that calls themselves 'The Dark Mail Alliance'. This is a group of anti-government hackers that..."

<comment><USER25> "... keep their software in a so called 'subversion' repository, clearly for nefarious ends."

<comment><USER26> "... it's worse than that. They used git. They can git your kids, git your job, git your family; all with one command. They can even clone you. These hackers will be pulling and pushing this country apart!"

<comment><USER27> Interesting! I hadn't considered that connotation of git.

To Euro-English speakers, 'git' is a rather coarse pejorative term for a person:

[http://www.etymonline.com/index.php?term=git](http://www.etymonline.com/index.php?term=git)

It's fairly vulgar, of a similar coarseness to calling someone a 'stupid fucker' in US terms.

The in-joke being that Mr Torvalds chose the name specifically to cause offense.

</comment></comment></comment></comment></comment><comment><USER28> Anyone gone through the checklist yet? [http://craphound.com/spamsolutions.txt](http://craphound.com/spamsolutions.txt)

<comment><USER29> What's the relevance? This isn't a spam fighting endeavor.

<comment><USER30> When you go through the trouble of reinventing email to provide proper security, you should also solve the spam problem as part of the protocol.

It would be great if the recipient could specify the amount of proof of work required for example. Or ask for a certain amount of bitcoin in exchange for accepting promotional material. Or a mail attribute that indicates it's a newsletter. Lots of interesting possibilities.

<comment><USER31> > you should also solve the spam problem as part of the protocol.

I disagree. Different problems sometimes require mutually exclusive solutions.

In fact, receiving lots of unsolicited mail provides some plausible deniability. So a spam free-for-all might actually be a useful part of the new network.

<comment><USER32> Or you know, renders the system completely worthless because no one can sort through that much spam.

Which also makes it completely trivial to DDoS into oblivion. And the problem gets worse then that: the more anonymous it is, the less it's possible to stop someone from spamming.

Though I suppose you could attack this problem from the email address side: make it computationally expensive to general an email address, to make address-hopping as a spammer more difficult.

</comment></comment></comment></comment></comment><comment><USER33> This is very good news. An interesting not here: In Norway the official postal service, Posten, has introduced something called DigiPost. Post means mail, so DigiMail. This is essential a secure way of sending information and it is approved by the Norwegian government for sending and receiving sensitive information. So you can ask to get your sensitive government stuff through DigiPost.

My point being: There is already a big market for sending secure emails. If this Dark Mail, or whatever it is called, is secure enough for a government to use then the adoption will be huge.

This probably means that it should be called something else than dark. "Normal people" don't know what encryption is, what NSA is or even why it is bad that companies like Google read and use their email. They won't know why or even that their email is insecure. They might have ssl in their Web browser showing a small lock, so they think they are already secure and don't need this "SecureMail". It is absolutely critical that the name of this thing is something that a normal person will feel that he/she needs. Something as simple as "New Email". Yes, the nerds will rage, but the nerds already knows why this is a big deal. The name does not need to cater to them. What is important is to get adoption of this new email platform. And naming it secure mail will probably not help. And having a dark alliance behind it all is the worst idea so far. Both words have negative annotations and sounds like a untrustworthy hacker group or even a terrorist organization. Needless to say, they need some serious re-branding, and fast.

<comment><USER34> "An interesting not here: In Norway the official postal service, Posten, has introduced something called DigiPost." "This is essential a secure way of sending information and it is approved by the Norwegian government for sending and receiving sensitive information." "There is already a big market for sending secure emails."

So there are already working solutions for the problem. I wonder - does it really have to be created some new group of "privacy innovators [that] have [to be] partnered to lead the charge to replace email as we know it today"? A descriptive alliance to measure the adherence to a new solution may be a useful thing, but some new group to reinvent some existing solution is just political in my view.

</comment></comment><comment><USER35> And this is how committees fail to achieve results ;) The top 20 (?) comments (or at least the most voted comment thread) is a discussion/argument on just the name...

</comment><comment><USER36> Terrible name.

<comment><USER37> I submit, "Envelope." It's a good analogy, since now we're essentially sending all of our email on postcards.

<comment><USER38> I'd posit that the French already have our backs. A few years ago, the official body that governs standardized French attempted to wean French- speaking people from the borrowed English terminology. Et voila! "Courriel," a portmanteau of courrier and electronique was pilfered from the Quebecois for the benefit of francophones everywhere. Sadly however, if Google Translate is any indicator, then "courriel" never made the leap from official to commonplace.

Now, the electronic part is a given. But what about the courier part? Here's what Wikipedia says:

> Couriers are distinguished from ordinary mail services by features such as > speed, security, tracking, signature, specialization and individualization > of express services, and swift delivery times, which are optional for most > everyday mail services. As a premium service, couriers are usually more > expensive than standard mail services, and their use is typically restricted > to packages where one or more of these features are considered important > enough to warrant the cost.

Speed, security, individualization, premium? Those all sound like adjectives that I like!

Let's do the L'Académie française a solid. Let's adopt Courriel and apply the label only to our fast, secure, individualized, premium electronic communiques.

<comment><USER39> If you're curious: courriel has become the standard term in Quebec, where adopting English terminology is a little bit more culturally / politically sensitive.

</comment></comment></comment></comment><comment><USER30> From the talk that just finished at Inboxlove, it appears they will use XMPP for transport, some JSON and encrypted cloud storage.

You receive a message via XMPP that an email is waiting for you on the cloud storage (similar to MMS). This is also a good solution for the spam problem, I think.

They have a working prototype, a whitepaper is forthcoming and the community is welcome to improve the new standard.

<comment><USER40> Sounds like the cloud storage could help solve the large attachment problem. Cool.

</comment></comment><comment><USER41> For those who didn't know already (I didn't, this is new territory for me), Silent Circle is co-founded by Phil Zimmermann (the PGP guy).

</comment><comment><USER42> "Stay connected with the Dark Mail Alliance

[Enter your e-mail] "

<comment><USER43> And over an unencrypted channel no less, www.darkmail.info doesn't have ssl, so the NSA will know if you are interested.

<comment><USER44> It is not a crime to be interested in something like this.

<comment><USER18> Not yet it isn't.

Remember what happened with "Anarchist's cookbook" and recipes for thermite and such that used to be readily available on the net, and relatively uncontroversial. It was just "information" after all. These days it seems knowing how to do some basic chemistry is considered intent to do harm or something.

</comment></comment></comment></comment><comment><USER45> I hope to see this magic new mystery protocol as something similar to TextSecure, where we have forward secrecy from the OTR protocol.

The current e-mail protocols are far too centralized, which doesn't make sense. Mail is delivered, and after that, it is no longer in possession of USPS. This is unlike how E-mail works (even though it kind of seems like that's what happens).

I hope to see some kind of client being required to run on my computer to decrypt e-mails at rest and receive e-mails that are delivered to me from the central server.

<comment><USER46> The protocol is based on SCIMP[0] which supports forward secrecy.

[0]: [https://silentcircle.com/web/scimp- protocol/](https://silentcircle.com/web/scimp-protocol/)

<comment><USER45> Aha, very good find. Okay then I am pleased.

</comment></comment></comment><comment><USER46> I'm really interested in their solution for solving metadata leakage. I just looked over the SCIMP white paper, and it didn't mention anything about metadata.

<comment><USER37> I think not sending all of the data in cleartext will still be a huge improvement.

<comment><USER47> I think this is one of the fundamental misunderstandings: Metadata includes such interesting things as "who has been sending messages to whom at what time" and potentially also from where (ip address). This is an avenue to reconstruct social networks and behavioral patterns, especially if you can crosslink the data with other public sources. I recommend this visualization of the movement profile only derived from the collected data of one german politician (sorry, german only but fairly easy to understand) [http://www.zeit.de/datenschutz/malte-spitz- vorratsdaten](http://www.zeit.de/datenschutz/malte-spitz-vorratsdaten)

<comment><USER48> English version: [http://www.zeit.de/datenschutz/malte-spitz-data- retention/](http://www.zeit.de/datenschutz/malte-spitz-data-retention/)

</comment></comment></comment></comment><comment><USER49> The site [http://www.darkmail.info/](http://www.darkmail.info/) is served over http and not https. If someone has access to the pipe, it would be easy get the email addresses of people who submit their email addresses at that site.

<comment><USER50> The marketing system they're using is Mailchimp which I'm sure is also easy to access for anyone who might've been able to snoop emails off the HTTPS version of DarkMail.info

</comment></comment><comment><USER51> Not sure I understand. Both SilentCircle and Lavabit have ceased offering their services. Are they now combined in an advocacy group to design a new email protocol and get it adopted by the IETF?

<comment><USER52> IETF has become less relevant of late, they don't get stuff adopted and have been taken over largely by architecture astronauts.

<comment><USER53> What do you mean by architecture astronaut?

<comment><USER54> See "Don't Let Architecture Astronauts Scare You" by Joel Spolsky: [http://www.joelonsoftware.com/articles/fog0000000018.html](http://www.joelonsoftware.com/articles/fog0000000018.html)

</comment></comment></comment></comment><comment><USER55> As much as I hate promotion emails, I do hope they make sure that companies can still send mass "dark mails" securely, rather than sending the one by one...

<comment><USER56> Wait wait wait!

Requiring _very strong_ encryption may help make spam email computationally infeasible.

That alone might be worth it!

<comment><USER57> I thought even extremely strong encryption was computationally quite light- it's cracking the crypto that takes computing muscle.

<comment><USER58> Maybe they are going to require "Proof of work" \- [https://bitcoin.it/wiki/Proof_of_work](https://bitcoin.it/wiki/Proof_of_work)

<comment><USER59> If only there was some way to make spammers do the work of Bitcoin miners....

</comment></comment></comment></comment></comment><comment><USER60> They mentioned having a "web of trust" to help fight spam. But if you use that, doesn't it mean someone like NSA, who can get everyone's public keys (which I assume is what they're going to use for this, just like for PGP), could then identify who are the people talking to each other, and essentially invalidate all their metadata gather protections? Or would that key be ephemeral, too?

</comment><comment><USER61> you can listen to more here [https://www.youtube.com/watch?v=IgV_Z6V_llk](https://www.youtube.com/watch?v=IgV_Z6V_llk)

started at min 30 or so

</comment><comment><USER62> Can we stop with 'the name sucks' meta discussion and focus on the topic? I for one would _love_ to see this work out. It'd be goddamntime someone clever did something about it and I could not imagine two better parties starting this.

</comment><comment><USER63> Since it hasn't been mentioned yet, OS X and iOS already support S/MIME encrypted email, and having the private keys live on users' devices and doing encryption of outgoing messages on users' devices is probably the safest setup.

<comment><USER64> Hmmm, I don't know if I'm being outrageously paranoid, but I'm resisting the temptation to put my PGP private key on my iPhone - because it'd be _way_ too easy for Apple to extract the key/passphrase if they were coerced by someone powerful enough, and those "powerful enough" have shown that they consider a court order granting them the private key used to secure 400,000 people's email is an appropriate tool when targeting a single individual.

Once that's known, is it really such a stretch to assume that an already complicit PRISM partner might be convinced/coerced to monitor downloads of crypto-capablea app from their respective app-stores, and provide or allow backdoors to their OS that leak private keys?

Maybe that's being overly paranoid, but in the "post Snowden" era, it might just be a sensible and pragmatic view…

<comment><USER18> It's good to be paranoid - but if you don't trust Apple -- you'll have to be quite paranoid with your (and every other) iPhone you encounter. After all they might be recording all sound within range of the mic, for example. Or all text typed. Or both.

AFAIK Apple is close to best in class when it comes to handling secure information (keys, pins etc) -- even if they're not perfect.

<comment><USER64> My assumption is that if the NSA takes a specific interest in _me_ - <USER3> Apple and/or Google could be requested/coerced into making any iOS or Android device I was suspected of carrying do that.

If I held a top security clearance in a country the US was interested in, or was a politician, diplomat, drug-dealer, or Occupy Movement organiser - <USER4> wouldn't be happy using a modern smart phone.

As a "nobody", I doubt the NSA would burn those resources on monitoring me.

On the other hand, I wouldn't be _too_ surprised to find the NSA take special interest in anybody who's downloaded a PGP/GPG app from the App Store or Google Play - and if I worked for the NSA I'd certainly have entertained the idea of working out how to subvert iOS/Android to expose private keys and passphrases using privileged vendor-provided OS access.

And I doubt I'm anything like as smart/creative/evil as the best people working at the NSA…

(And Apple definitely talk best-in-class talk about secure data handling, but there are some interesting questions about how your old passwords/iMessages/keys re-appear on a new iOS device when you replace them…)

</comment></comment></comment></comment><comment><USER65> Sounds like another reinvention of the wheel, the "email" part of [http://retroshare.sourceforge.net/](http://retroshare.sourceforge.net/)

<comment><USER66> Dismissing or deriding a project because it is not completely novel is unhelpful.

Since 'retroshare' hasn't taken the world by storm, maybe that wheel _needs_ to be reinvented.

<comment><USER65> FYI, RetroShare has a solid and solidly growing community.

Of course, if you want to talk about "taken the world by storm" as in "Microsoft Windows 95": You're right, no encryption software has ever taken the world by storm. And that has to do with the fact that the general public doesn't care about privacy, b/c they have no clue how it works and most of all what the mid- and long-term consequences of losing privacy will be for their lives.

</comment></comment></comment><comment><USER67> Email is so broken from a security standpoint I doubt that email 3.0 would even make it off the ground. You would be better off taking something like IM which silent circl allready has a secure solution for and adding the store and forward capabilities that make email email. Then u could have email clients use that protocol. But asking the entire world to change / upgrade it's email servers and clients with a fundamentally different protocol. I don't see that being successful.

</comment><comment><USER68> What's wrong with bitmessage?

<comment><USER69> Bitmessage doesn't scale, it's POW doesn't solve any spam problems, and it's largely insecure. There's been quite a lot of public discussion about just how hilariously insecure it is.

<comment><USER68> I didn't know that. Is anyone working on an improved version? It seems like a great idea in principle.

<comment><USER69> There's room for improvement, but there's a lot of core issues that just can't be flushed out.

The concept of the POW is to stop spam, as all addresses are inevitably public, it doesn't really work though, as spammers typically have access to botnets which can spam all day long. Normal users just have to wait minutes to send a message.

The scale issue is a weird one, they plan to split the network into different "streams" with different address types, which just sort of muddles the entire setup. Ultimately the limit is how much CPU and bandwidth the network can survive with while mirroring the entire content of the entire network.

There's lots of problems with timing attacks that have been "resolved" with random sleeps, though nobody is really convinced of that too much.

<comment><USER70> >The concept of the POW is to stop spam

Your other points are good, but this one is wrong. Bitmessage is currently bundled with a client because that makes adoption easier, but ultimately, Bitmessage is first and foremost a protocol. POW increases the cost of flooding attacks on the network. Clients like Thunderbird (it was easier for me to integrate Bitmessage with Thunderbird than my regular email provider) stop spam.

The scaling is a rather hard problem, since, for anonymity, "everyone gets everything." If you have any ideas about how to scale a network like that, OR have any comparable methods for hindering traffic analysis, you should publicize them.

The timing attack mitigation via sleeps /is/ a rather ineffective substitute for constant-time decryption.

In summary:

1\. POW is a non-issue, and part of the design at least the way you've put it.

2\. Scaling is inevitable given the tradeoffs being made, unless you have a better idea, for which I will pay money

3\. Timing attacks are a temporary problem, but they can certainly be "flushed out."

</comment></comment></comment></comment></comment><comment><USER71> "Dark Mail" reminds me of Chrono Trigger...

<comment><USER72> I was going to say something about it providing 5 points of magic defense :P

</comment></comment><comment><USER73> I don't understand how anyone of you can say "it's never going to take over email 1.0". Success is a lot about realisation. We have to start somewhere and this is a good start as any.

Having a standard is certainly a necessity. I definitely see secure email starting as a niche and if the user experience is at least as good as gmail I don't see any reason why a new email system would not take over.

It's not going to happen overnight but there definitely is a need for it. Lavabit and Silent Circle are proofs that this need is real.

There are major issues with replacing the current email:

1) there is no good open source email interface (if I'm wrong, please point me to this gem). Roundcube is good but not good enough when you come from gmail. I don't know of anything better than roundcube.

2) the threshold for a company to implement secure email is too high. Having a secure standard with secure libraries certainly lower that threshold

3) the current open source mails are GPL like licenses. This sucks for companies and individuals. Give them the ability to do what they want, including money. Replacing email is not going to happen without investment. Technology investments are mainly done by companies, only exceptionally by individuals.

Anyway, if anyone wants to take a shot as implementing an easy to use & opinionated (ie standardisation vs customization) webmail, chime in: [https://github.com/nherment/dolphyn](https://github.com/nherment/dolphyn)

(edit: form & typos)

</comment><comment><USER74> Why did Lavabit ever need to have my messages in the clear?

The problem is manufactured and the solution is missing the point.

</comment><comment><USER17> What exactly remains to be developed? We have Mixmaster, Mixminion, Sphinx, etc....

</comment><comment><USER75> SPOILER: A year from now we find out this is an NSA black ops project.

<comment><USER76> Ladar is a hero. I would trust him over myself.

<comment><USER18> Which is why he would make such a great front for a black op... ;-)

</comment></comment></comment><comment><USER77> "dark mail alliance" group, here is what you need to do...

1\. get a new website, terrible design even from a 1995 point of view it is bad. Drop shadows on tag-lines are tacky. Not that tech people care, but if you want to take over the world. Try starting by having a decent designer on your team.

2\. the only way to "truely" fix this for good is to not use email. instead, use a different form of communication (im thinking of...)

3\. work with a few "enterprise companies" 4\. get some capital 5\. lastly, email is really still on 1.0, there was really no 2.0... unless you consider the time before the internet as 1.0 when the government used internal mail. But as we know mail today technically its still 1.0

</comment><comment><USER78> Has anyone actually confirmed that Ladar Levison is behind this?

<comment><USER79> Here he is on video discussing it:

[https://www.youtube.com/watch?v=IgV_Z6V_llk](https://www.youtube.com/watch?v=IgV_Z6V_llk)

I guess I wasn't actually there in person to witness it so I can't confirm he wasn't one of those Tupac holograms[1].

1: [http://www.youtube.com/watch?v=TGbrFmPBV0Y](http://www.youtube.com/watch?v=TGbrFmPBV0Y)

</comment></comment><comment><USER80> I wish they would give some sort of freebie to prorated Lavabit users that were were SOL due to the shutdown.

</comment><comment><USER81> This is awesome, but will it be open sourced so that everyone can inspect the code and verify its sanctity?

</comment><comment><USER82> In all seriousness my opinion can be summed up as; Open Source Or GTFO

</comment><comment><USER83> Can we not just do this with an open alliance and pick up a name ?

</comment><comment><USER84> LinkedIn to announce Dark Mail support.

</comment><comment><USER85> Maybe better yet, EncMail.

</comment><comment><USER86> If you were interested in seeing any details whatsoever about the protocol there are none either in the article or on the official website.

<comment><USER87> They appear to be talking about this thing:

[https://silentcircle.com/web/scimp- protocol/](https://silentcircle.com/web/scimp-protocol/)

I thought we didn't want to use the NIST curves (like ECC-384?) anymore... seems something like Curve25519 might be better.

<comment><USER29> We're working on moving away from NIST curves as a default.

[http://silentcircle.wordpress.com/2013/10/17/this-one- goes-t...](http://silentcircle.wordpress.com/2013/10/17/this-one-goes-to-414/)

</comment></comment></comment><comment><USER88> The name "Dark Mail" is going to automatically be associated with the "Dark Net" which brings up thoughts of drug dealing and child pornography. This is their first problem.

The second is their approach. Overcoming the install base of current email, no matter how much better your new offering, is practically impossible. So instead secure layers on top of existing email is your only feasible option.

</comment><comment><USER89> Something like Secure Mail, Safe Mail, Trust Mail, Private Mail sounds better than Dark Mail</comment>


Ways to make money online, 200 of them - <AUTHOR> http://www.makeuseof.com/tag/200-ways-to-make-money-online/

<comment><USER2> Rather than a huge, unsearchable image imagine if all of this information were in web form.

<comment><USER3> Really, I don't quite get this sudden trend to show everything in an infographic. Personally, it is harder to read, harder to store. A simple table would work fine.

<comment><USER4> Obligatory: [http://xkcd.com/1273/](http://xkcd.com/1273/)

</comment></comment></comment><comment><USER4> Very depressing how most of this is marketing.</comment>


CuratedAI: A literary magazine written by machines, for people - <AUTHOR> http://curatedai.com/ <comment><USER2> This is beautiful:

      The deeper the hustle the deeper the pain
      I wish I could play the Violin
      The thought of you is driving me insane

Go to [http://villanellebot.tumblr.com/post/148629267135/so-many- th...](http://villanellebot.tumblr.com/post/148629267135/so-many-thoughts-it- makes-my-head-spin) for the entire poem, and [https://avoision.com/2015/08/26/villanelle-bot-poems-in- the-...](https://avoision.com/2015/08/26/villanelle-bot-poems-in-the- villanelle-form-created-using-random-posts-from-twitter.php) to learn how it was done.

<comment><USER3> That actually is incredibly beautiful. It's crazy to think that the machine that generated it was devoid of the emotions behind this assembly of words.

<comment><USER4> Well is it? At some point, either we become like machines, or the machines become like us. There is a limit to how many times we can redraw the lines.

<comment><USER5> The common distinction between machine and life seems arbitrary. Suppose for instance you had essentially infinite resources to design a machine that self- replicates by stealing blood from mammals, etc etc. You would end up with something very much like the mosquito. Why is it a machine only when man designs it?

This is perhaps more apparent with viruses. They aren't living per se, but are halfway there. The assertion that the virus is not a machine seems to be a difference without a distinction.

<comment><USER6> The expression is "a distinction without a difference"

<comment><USER5> Oh yes! Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER7> Followers of computer generated literature may recall "The Policeman's Beard is Half Constructed" [1], ostensibly written by the program Racter [2] (though that authorship was never conclusively proven).

[1] [http://www.ubu.com/historical/racter/index.html](http://www.ubu.com/historical/racter/index.html) [2] [https://en.wikipedia.org/wiki/Racter](https://en.wikipedia.org/wiki/Racter)

<comment><USER8> Racter was quite impressive for its time.

</comment></comment><comment><USER9> When you just set an AI to generate content based on input text, you get garbage like this. You need to set restraints and create a form to work in. An "AI" (i.e. probably a markov chain) spewing out word salad just isn't interesting in 2016 unless it has conceptual weight.

</comment><comment><USER10> Fairly awful stuff but it would be fascinating to keep that experiment running for a decade to watch AI evolve.

</comment><comment><USER11> Ugly and nonsense. But over time I expect it evolving into something we could read.

</comment><comment><USER12> I Ate Curly Fries And Shaker Fries has been stuck in my head all morning... and I am still waiting for the rain to abate.

</comment><comment><USER13> Very poetic

The best part of my job is the weight I lost. Found the truth beneath your lies. And I am still waiting for the rain to abate.

</comment><comment><USER14> The code behind this is probably more poetic than the output. Perhaps the union of technology and culture is farther than we think.

Although, this really shines a light on the fact that it probably isn't necessary for technology to attempt to optimize _every_ human experience.

</comment><comment><USER15> SCIgen - An Automatic CS Paper Generator - Note: one of the papers was accepted to SCI 2005

[https://pdos.csail.mit.edu/archive/scigen/](https://pdos.csail.mit.edu/archive/scigen/)

</comment><comment><USER16> This reminds me of that AI-written screenplay earlier this year [1]... it's interesting, it may be progress, but it's partly carried by its presentation and production value and the promo value of "who" it was authored by. (This is also true, to a lesser degree, of human works.) Fingers crossed for progress.

[1] [http://arstechnica.com/the-multiverse/2016/06/an-ai-wrote- th...](http://arstechnica.com/the-multiverse/2016/06/an-ai-wrote-this-movie- and-its-strangely-moving/)

</comment><comment><USER17> Reading the prose is like reading James Joyce, without the twee construction.

The poems I actually enjoyed, if only because they were funny to read out loud.

</comment><comment><USER18> I really don't see the literary merit in a lot of these pieces, but obviously this is an interesting step forward...

<comment><USER19> "I Ate Curly Fries And Shaker Fries" wouldn't be out of place in well-regarded literary magazines. That slice-of-life with references-only-the-author-gets but maybe-sometimes-they-resonate-in-an-oblique-way-with-the-reader poetry is pretty common. Get an author with a decent bio[1] to submit it and I bet you could get a similar-quality machine-generated work published in Ploughshares or similar.

[1] MFA, edits a local poetry magazine with a circulation of 100, accepted submissions to some mid-level publications, one or two "chapbooks" out.

<comment><USER9> Try submitting it. It will get rejected immediately becasue a) villanelle's are hokey and played out and b) it's obvious this was written by a machine. There's no poetic turn, there's nothing worthwhile to derive from it. It's word salad. There's a reason why Oulipo, whose members have written many algorithmic poems plays and novels, despised chance generations of text.

</comment></comment></comment><comment><USER20> If the aim is to land somewhere within the style of Edward Lear, then this is a job well done.

</comment><comment><USER21> Love the caption. Straight out of the future!</comment>


Yahoo shutting down Message Boards and other services - <AUTHOR> http://ycorpblog.com/2013/03/01/3553567/ <comment><USER2> Now if they could shut down Yahoo! Answers so that its useless Q/As stop showing up in Google results that would be perfect.

<comment><USER3> Google search has a built-in tool for filtering sites out of your results. I haven't seen an experts exchange result in years. Just remove answers from your search results.

<comment><USER4> ... no it doesn't.

It once did, briefly. Lasted about six months if I recall correctly, then was deprecated.

<comment><USER3> Thanks. I'm surprised. Experts exchange hasn't come up since. Guess that was the only site I ever wanted to blacklist.

<comment><USER5> I've been seeing expertsexchange again. That's how I discovered the google blacklist had disappeared.

There was as chrome extension, but google removed it. Then it was built into google, and they removed that too.

</comment></comment></comment></comment></comment><comment><USER6> Cleaning up the services of Yahoo! as a CEO must feel like going through your parents' stuff in a dusty, derelict attic.

</comment><comment><USER7> Some of the earliest mainstream general discussion of REST took place in the still-active "rest-discuss" board going back to 2002. I hope that history is preserved.

</comment><comment><USER8> What about Yahoo! Answers? Asking for a friend.

<comment><USER9> I hope they do close it - its useless unless you are dredging for comedy.

Citation for the downvoters: [http://answers.yahoo.com/question/index?qid=20110910190628AA...](http://answers.yahoo.com/question/index?qid=20110910190628AAfMjpT)

<comment><USER10> It maybe useless to you or me, but its very much active and used by a lot of people. I think this is one of the few Yahoo Services that organically grew over time and started having a name for itself.

I do think there is plenty of room to make it much much better. It looks the same for as long as I can remember.

</comment></comment></comment><comment><USER11> I'm confused from the announcement - is that Yahoo Groups as well?

<comment><AUTHOR> The release doesn't mention Yahoo! Groups.

</comment></comment><comment><USER12> Considering that Yahoo has products ranging all the way from horoscopes to web hosting — this does not feel enough.

<comment><USER13> Yahoo is a content company, no matter what label she gives them now. They need content.

<comment><USER14> What content does yahoo have?

Other than their "Answers"-garbage polluting my search results I don't think I have been in contact with any yahoo property for about 10 years...

<comment><USER13> licensed or not they have a News section, finance, weather, travel, sports, shopping, gossip, etc.

</comment></comment></comment></comment><comment><USER15> I think this is well overdue, if you go out and look at the content on these boards it is basically people trying to sell credit card dumps, and random spam.. Most folks have moved on to the major social networks.

</comment><comment><USER16> Interesting: they are shutting down the Blackberry app. Either the app was terrible and never used, or they see Blackberry as a dying platform.

<comment><USER3> The yahoo! App on android is simply an embedded browser widget and only provides one actual feature. You can share the current URL on Facebook. Confounding how they could release an app that is both pointless for the user but beneficial to a competitior.

I'm surprised they only discontinued the blackberry version.

</comment></comment><comment><USER17> The biggest wrong about Yahoo is that they don't have a core business anymore, a one that earns them money, like google search is for google.

<comment><USER18> The Google's core business is advertising.

<comment><USER17> I believe its search, without search, they would not have anyone to watch their adverts.

</comment></comment></comment><comment><USER19> What a horrible sounding url

</comment><comment><USER20> This is great. The lesser the product line the more one can focus.

<comment><USER21> Yep. It's about time they shed some some of this Geocities era junk.

<comment><USER22> you are advocating the destruction of historic content, not unlike suggesting that a library should just burn its oldest books. there were tons of fantastic websites on Geocities.

</comment></comment></comment><comment><USER9> good. There is nothing I hate more than having to sign in to yahoo for something such as a support group for a bit of software or freecycle. Its just horrid from end to end.

</comment><comment><USER23> Yahoo has a message board?

</comment><comment><USER24> Who at Yahoo decided that a 12px font size was readable? Maybe start by firing that person?

[http://hn.explodie.org/writings/stop-using-small-font- size.h...](http://hn.explodie.org/writings/stop-using-small-font-size.html)

<http://contrastrebellion.com/>

<comment><USER25> In case you're too young to remember, 12px was the standard for a very long time.

It's only in the last 2-3yrs that font-sizes have grown.

I'm sure that if the website was redesigned today, a larger font would be implemented.

<comment><USER24> > 12px was the standard for a very long time.

Yeah, errrr....there is no "standard" on the web. Make your font sizes readable. It's really not hard.

<comment><USER25> Standard (Adjective): Used or accepted as normal or average.

12px was very readable for a very long time. FYI, screen resolutions weren't always as good as they are now.

In fact, if you go further back in time, many "webmasters" (what we called ourselves because you young'uns decided you were "engineers" of usability) even _gasp_ used 11px. Oh the days of the CRT... good times... good times.

<comment><USER24> Dinosaur (Noun): A person or thing that is outdated or has become obsolete because of failure to adapt to changing circumstances.

I'm not sure why you think I'm a "young'un" but, please get over yourself, "old timer."

So because 12px font was super readable on 640x480 CRT on Win95, we should continue to use that and never update our blogs?

Are you seriously trying to defend shitty readability in 2013? What a weirdo.

<comment><USER25> > So because 12px font was super readable on 640x480 CRT on Win95, we should > continue to use that and never update our blogs?

Nope.

> Are you seriously trying to defend shitty readability in 2013?

Nope, not as far as I can tell. Do read my original post.

In case you're too young to understand why I wrote... I was explaining a possible reason why the site has the font-size it currently has. I went on to say that I'm sure that were the site redesigned today, it would have a larger font... JUST LIKE ALL THE WEBSITES YOU LIKE THAT HAVE 16px FONTS... YES, THEY PROBABLY HAD 12 or 13px FONTS IN THEIR PREVIOUS ITERATIONS.</comment></comment></comment></comment></comment></comment>


Gif's inventor says ignore dictionaries and say 'Jif' (2013) - <AUTHOR> https://www.bbc.co.uk/news/technology-22620473 <comment><USER2> I've been saying "Hif" for a few years because that's how it's pronounced in Spanish[0], which I'm learning..also because it's funny. (Also I say "Himp" for Gimp.) Come to think of it, that started around the time I read it should be pronounced "Jif".

[0] g before e or i in Spanish, like j, has a guttural h sound.</comment>


A.D. 2035: Rich people will be thousands of times smarter than poor people - <AUTHOR> http://venturebeat.com/2016/08/02/a-d-2035-rich-people-will-be-thousands-of-times-smarter-than-poor-people/?utm_content=buffer1d0ea&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer <comment><USER2> Why stop at the financial difference between a poor african boy and Elon Musk? Assuming this tech scales at the rate the article is proposing (spinning up N amazon services for N neocortices), why would the top dogs stop their competition for resources at the lower beasts of the earth besides in-group trust or paranoia? I'm sure the meat that makes a million dollars a year is just as prime material if not more interesting for the borg as poor indian children.

Oh right, they need techno-serfs or lab rats to actually implement or test these technologies on, hmmmmmmm.

</comment><comment><USER3> Reminds me of a core principle of Sir Patrick Geddes: "its task is to find the right places for each sort of people; place where they will really flourish."

Vivendo discimus</comment>


The Rise and Fall of American Growth - <AUTHOR> https://www.youtube.com/watch?v=B-Tia-LcLxI <comment><AUTHOR> This is a rational and sober look at the current economic landscape. I found it quite interesting and thought provoking at least. It's notable here in that he briefly praises the current state of American venture capital.</comment>


Lego CEO breaks out in song and dance over record breaking fiscal year profits - <AUTHOR> http://www.dr.dk/Nyheder/Penge/Video/2015/02/25/110952.htm

<comment><AUTHOR> A better article in terms of details (but without video)[1]

[1] [http://www.telegraph.co.uk/finance/newsbysector/retailandcon...](http://www.telegraph.co.uk/finance/newsbysector/retailandconsumer/11433891/Lego- enjoys-record-year-and-gets-closer-to-reaching-every-child-in-the-world.html)</comment>


The Horror of the Baltimore Police Department - <AUTHOR> http://www.theatlantic.com/news/archive/2016/08/the-horror-of-the-baltimore-police-department/495329/?single_page=true <comment><USER2> I will not / can not read articles with that type of advertising.</comment>


Making Sense of My Google Analytics' Stats - <AUTHOR> https://medium.com/@laurent_sabbah/making-sense-of-my-google-analytics-stats-fbffae16eae1

<comment><AUTHOR> Installing Google Analytics isn't enough. Properly reading and acting on your stats is what we should all be doing. What I've learnt from an hour of analyzing my stats.

What has Analytics helped you learn?</comment>


Off the clock? Hyperconnected workers sue employers - <AUTHOR> http://arstechnica.com/tech-policy/news/2009/08/wheres-the-off-switch-hyperconnected-workers-pushing-back.ars

<comment><USER2> My paraphrased read:

If you require hourly/non-salaried employees to attend concalls and check ticketing systems during off-hours, expect to pay OT for that time. Smart hourly employees will find the broadest interpretation of your requirements to rack up maximal OT comp for minimal work. Serves you right.

If you employee non-hourly ("exempt") workers, there is nothing here for you to be concerned about. That's why they call it "exempt".

</comment><comment><AUTHOR> I certainly sympathize with employees who are normally horuly and called up extensively outside of hours, however they certainly have an obligation on their part not to check their e-mail or do other work related activities when they are not on the clock and most companies require hourly employees to receive approval before working overtime hours.

For salaried employees, this seems a nonissue in most cases. Unless they are specifically told otherwise, they can normally expect to work more than 40 hours, and they are also normally in either management or creative roles both of which can face deadlines requiring far more than 40 hours to finish the necessary work.

</comment><comment><USER3> Heinlein suggested in his last novel (To Sail Beyond the Sunset) that telephones in the home killed house-calls by doctors, it became too easy to contact the doctor for any little thing that was bothering you. So it would not be surprising to find even easier and "more connected" versions of the phone having similar effects.

</comment><comment><USER4> When I was an hourly contractor, and was on call I would charge for calls I received outside of work (rounded to the nearest hour, so if the call took 5 minutes I would charge for the full hour) my boss approved all those hours. Of course answering an email that is not urgent is something I would wait until the next day to do. Also I will admit that if i was taking a call it was typically nothing mundane usually something was blowing up.</comment>


Ask HN: Tax issues with failed startup? - <AUTHOR>

I've always done my own (simple) taxes but in 2014 I did a startup full-time for most of the year and had a lot of expenses relative to what I made the other months.  My main concerns are getting personal deductions for the expenses incurred, figuring out how to report for the LLC we formed, and making sure we close that entity up with no outstanding reporting requirement.<p>Does anyone know any accountants who have any experience cleaning up this sort of startup mess? I'd also appreciate any advice in general about pitfalls in resolving this sort of thing or transactions that you were able to expense.  Thanks! <comment><USER2> Find a local tax accountant that handles small businesses. Really your situation isn't likely that complex (to a tax person that is) and even probably an H&R Block can do it quite well. You will sit with them and go through things and provide all the details and they'll help you get it together. I have used a variety of people, but now have one that is a firm that is medium sized and handles both public and private companies and is honestly really fairly priced for a small business but they also help me with regular accounting chores too.

I will say, I actually used H&R Block a number of years back when I had partial income from a 1099 and a lot of losses from a business that failed, plus some income. They actually did really good for me, and were really detailed, plus they provided audit protection which was awesome, and thankfully I didn't need it.

<comment><AUTHOR> Thanks, I hadn't seriously considered them.

<comment><USER3> I had a good experience with H&R Block as well my first year in business. I've since moved on to an independent CPA.

</comment></comment></comment><comment><USER4> In my experience, it pays to print out something formal stating that the business is closed and the entity is dissolving; then file whatever you need to with the Secretary of State. Then, reach out the FTB, the BOE, the IRS and anybody else you might owe money to, and see if they'll just close the records on that entity. That worked for me when I wound-down a failed C-Corp, saved me a few thousand dollars in the end (the FTB just wrote off the minimum- franchise-tax as uncollectable, etc). But getting a good tax guy is obviously a high priority as well.

</comment><comment><USER5> an accountant doesn't usually close up the various state and federal accounts. sales tax, workers compensation, unemployment, etc. make sure you do it. most of them are pretty easy to work with later if you can show you went out of business but it's alot easier to do it now.</comment>


PasswordBox Acquires Legacy Locker To Grow Its User Base - <AUTHOR> http://techcrunch.com/2013/11/20/passwordbox-acquires-digital-afterlife-service-legacy-locker/

<comment><AUTHOR> Question: I am not able to find much info about how PasswordBox does their security. Since they must by design have reversible encryption to be able to send passwords to third parties, it's important to understand how PasswordBox implements their security.</comment>


"Single?" Lawn Signs Conquer the American Landscape (2008) - <AUTHOR> https://blog.rjmetrics.com/2008/11/06/single-lawn-signs-conquer-the-american-landscape/ <comment><USER2> I remember seeing one of these signs in 2013. I was immediately intrigued since, outside of facebook and craigslist, there was very little web activity in my state, much less my impoverished hometown of 4000. The fact that the town's name was misspelled in the URL was even more interesting.

I also tracked the source down to NuStar Solutions. After a bit of digging, I found that just before the signs went up, a Craigslist ad was posted looking for a local to place signs around town. Not long after, there was a "response" ad posted by the person who had placed the signs, warning others that it was a scam and that they hadn't received payment for it.

<comment><USER3> Seems bit odd to risk a scam (and the attention it brings along) if you are generating $45M revenue. I would rather just pay out and keep under the radar, considering that the company seems shady enough as-is.

<comment><USER2> That's a good point. Most likely that would have been the work of some low- level employee at a regional office trying to boost their numbers.

</comment></comment></comment><comment><USER4> That's a really interesting read. FTA:

"My first stop: WHOIS. The WHOIS database is designed to serve as a master directory of all domain name owners, although in my experience there are no controls enforcing the submission of valid information. Moreover, most domain name registrars now allow registrants to register anonymously by serving as a proxy for the registrant. Despite these shortcomings, it's always a good place to start."

I know on balance the GDPR is a good thing, but we are really going to miss WHOIS.

<comment><USER5> Who is going to miss WHOIS?

I'm not. If it was opt-in I bet nobody would even reveal their details at all.

At worst, you're just accidentally doxing yourself and setting yourself up for a social engineering attack.

For example, name, email, and (wrong but close) address were enough to get someone into this guy's Amazon account: [https://medium.com/@espringe/amazon- s-customer-service-backd...](https://medium.com/@espringe/amazon-s-customer- service-backdoor-be375b3428c4)

<comment><USER6> Many interested in mitigating abuse.

<comment><USER5> They can report the domain to the registrar.

Doing something with WHOIS info sounds more like a cloak and dagger fantasy.

In reality, having your personal info in your WHOIS sets _you_ up for abuse.

<comment><USER6> Tying together multiple domains to a single authority (as here) is useful.

Essential? Dunno. But definitely useful.

Source: used WHOIS extensively in abuse mitigation and reporting.

Registrars tend to DGAF, though I suppose blanket blocks of all domains from a given registrar, practiced widely enough, might have impacts.

</comment></comment></comment></comment></comment><comment><USER7> This was a fascinating read! I was pretty blind to these signs until recently when my 5-year old son started asking me what they say. There are a number of "We Buy Houses (xxx)-xxx-xxxx" signs where I live. I bet it's a similar type of operation.

<comment><USER8> I've been seeing those signs for 20 years.

<comment><USER7> The article is 10 years old, and the company it focuses on had 45 million in revenue 12 years ago.

</comment></comment></comment><comment><USER9> I figured these were a step further towards MLM: a single company selling individuals signs and a generic dating site for $3000 or whatever and promising them a portion of the proceeds. That way the central company never has to plant signs or study the local market, etc.

There's also a handwritten sign for a dating site in my city I've seen a couple places now. It's not obviously hyperlocal so I imagine it's someone's actual "I'm going to be the next Zuckerberg" project.

</comment><comment><USER10> I never saw any "Single?" signs, but I do wonder about all the signs I see around here offering cash for diabetic test strips... I'm guessing those are given out free by some program and then sold, but don't you kind of need those if you are getting them?

<comment><USER11> My assumption with the diabetic strips is that well insured people can get large quantities from their doctors at the expense of the insurance provider and then sell them for a profit for cash. Alternatively, people in the medical supply supply chain likely have good sources for large amounts of test strips they could offload at a profit.

This is purely my guess having seen the same signs and wondered the same things.

<comment><USER12> Could also be a ploy to get diabetics in the door for some other sales program.

</comment></comment></comment><comment><USER13> How is Together Management Group, Inc thus not a criminal enterprise for mass littering for profit?

<comment><USER14> Buddy wait til you hear about oil companies

</comment></comment><comment><USER3> > company charges their customers from $3,000 to over $15,000 for their > matchmaking services

Wait, what, how?!

<comment><USER15> High-pressure sales tactics. They target people who are feeling vulnerable due to not being able to find a good relationship. They get them in a room, pitch them on a match telling them how perfect it is and how lucky they are to make this connection. Then they say: you have to pay $3,000 or we won't give you the name or contact info. And the offer is only good until you leave the room.

edit: I can't find a good link, but if you search for "imasucker" there are some details. [http://webcache.googleusercontent.com/search?q=cache:5TqEWNF...](http://webcache.googleusercontent.com/search?q=cache:5TqEWNFLg9sJ:https://blog.rjmetrics.com/2008/11/06/single- lawn-signs-conquer-the-american-landscape/&num=1&hl=en&gl=us&strip=1&vwsrc=0)

<comment><USER16> There's another reply there that talks about the service more in-depth by a user named "Crumb."

What's interesting is that he got the same $3,000 service for $500. And he actually got to have some low-quality dates! I figured these were full-blown scams. They also sell their leads to other dating companies.

</comment></comment></comment><comment><USER17> As an aside when I see those "Single?" signs, some quirk of my brain thinks of an alternate version for devorce lawyers:

"Single? Would you like to be?"

</comment><comment><USER18> The article states: "Remember when I said that certain dating businesses can print money? This is one of them. A 2006 reveals that the company was then bringing in about $45 Million of revenue a year."

I'm wondering what the missing word is after "2006". Any clues? Where did the revenue figure come from?

<comment><USER19> Annual report?

</comment></comment><comment><USER20> The town I'm at is infested with so-called "bandit signs" advertising "Soandso buys houses. Soandso pays cash." with a phone number to call.

It strikes me as odd that there's little to no enforcement of not only the signs but of the _extremely_ shady business practices therein.

<comment><USER21> I just knock them down. The ones that block my view when making a left turn anyway, plus any others in the vicinity for good measure. I have relevant sections of the county code bookmarked on my phone but no one has ever stopped me.

</comment></comment><comment><USER22> This was a nice bit of observation and sleuthwork, but he kinda punts at the end with his conclusion. Who is paying $3000-$15000 for matchmaking in the era of internet dating?

I fully believe there are a lot of desperate low-info lonely people out there who would try a dating website from a random lawn sign. And I believe that there are a lot of desperate wealthy people out there that would pay 3-15k for a dating service. But I really doubt these sets intersect at a high enough rate to make this a profitable endeavor. And the people willing to pay 3-15k are not looking to pay a random lawn sign caliber company.

Most likely the majority of their revenue comes from reselling the info they acquire in various shady methods.

</comment><comment><USER23> I've seen a sign in San Diego recently for a neighborhood in the uptown area. I didn't go as deep as as the author of the article, but after seeing the site I figured it was either a scam or a more traditional matchmaking venture.

</comment><comment><USER24> > Why the scattered infrastructure? Is it possible these identical road signs > that all appeared within 100 miles of each other are actually operated by > different companies?

When I used to be into SEO there was a theory going around about owning multiple sites and linking them together. Different IPs and locations 'looked' better to Google than all these sites linking to each other from the same IP address. Maybe this theory motivated the different servers.</comment>


A Google Surprise — Worldwide Alternative Reality Game Ingress Revealed - <AUTHOR> http://singularityhub.com/2012/11/17/a-google-surprise-worldwide-alternative-reality-game-ingress-revealed/ <comment><USER2> There was a long discussion on HN on friday, you can find it here : <http://news.ycombinator.com/item?id=4788902>

</comment><comment><USER3> I wrote an article about the purpose of the game. Why it was built. you can check it out here if you like: <http://news.ycombinator.com/item?id=4805229>

<comment><USER4> I came here to say exactly the same thing. My thought was they were going to be collecting WiFi info. Anyone know if that is even possible (I guess everything is possible, since they created the platform)? Hadn't thought of the pedestrian info angle. Also love JulianMorrison's comment that takes it to the meta-level: automated game generation based on the Gplex's needs.

Also how long until players must visit Brand X store as part of the game. Probably won't be so obvious, but say a target is right next to Brand X store, and then gameplay pauses for 15 minutes.

<comment> xor-ed-wolf Oh, well, even if they won't it'll be implemented at some point in AR-enabled software anyway. _wrote it to the notebook_

</comment></comment></comment><comment><USER5> Must be amazing with google glasses.

<comment><USER6> It might eventually be, but right now it's just an overlay on Google Maps. Now if you'll excuse me, some alien scum are attacking my Health Science Library.

<comment><USER7> Can you spare an invite, good sir?

<comment><USER6> Players aren't getting any invite quota yet, so I have none. I would recommend hanging around their IRC channel. That's where I got mine.

<comment><USER7> I will, thank you.

<comment><USER8> [http://widget00.mibbit.com/?settings=ba98b0e263309da29de2045...](http://widget00.mibbit.com/?settings=ba98b0e263309da29de2045992f403c4&server=webchat.irchighway.net&nick=&channel=%23invites)

That's the invite channel. Read up on your lore, first.

</comment></comment></comment></comment></comment></comment><comment><USER9> Somewhere in the brightly lit but somehow still dark recesses of Google, I am sure someone is writing a program right now that algorithmically generates games in order to distribute real world tasks onto humans. Just give it a spec in some map-reduce type query language, and up pops a new game on the Android store.

<comment> xor-ed-wolf Ah, that idea to gamify real work. It was there for ages but still so difficult to implement.

</comment></comment><comment><USER10> So the Daemon has started its darknet. However unlike the book version, this one wants to enslave instead of setting us free.

</comment><comment><USER11> Doesn't work to me... it just shows the booting screen, then it does nothing.

</comment><comment><USER12> I was starting to lose faith in augmented/alternate reality apps picking up. But Google has nailed it here, and at a time when ARM chips are starting to be able to easily handle this sort of stuff, too, like with OpenCL and higher GPU performance. It also seems to be at least one of the "killer apps" of Google Glass.</comment>


Why Peter Thiel Is Leaving Silicon Valley - <AUTHOR> http://money.cnn.com/2018/02/15/technology/peter-thiel-leaving-silicon-valley/index.html <comment><USER2> _Peter also thinks the Valley has become too mono-cultural and the cost of living is making the whole area more sclerotic, less vital._

This is a big problem with many big cities. The cost of living, primarily due to property and rent prices makes them less innovative and stagnant places to live. You need to be able to breath, not be stifled.

<comment><USER3> > makes them less innovative and stagnant places to live. You need to be able > to breath, not be stifled.

I accept the critique about cost of living, especially the Bay Area for those with families, but this statement lacks a coherent line of reasoning, and seems like a compound non-sequitir. The vast majority of innovations in recent times have emerged from cities.

<comment> racer-v Without cheap rent, it's very difficult to experiment. In places where space is plentiful and inexpensive, you can try setting up a quirky shop or cafe. In an overcrowded and expensive market like SF, you can't rent commercial property without a proven business plan. Where rent is cheap, you can spend a summer "funemployed", work on your hobby project and pick up a couple bucks doing odd jobs. If you pay $4,000/mo for an apartment, you need to be employed full-time all the time.

Personally I find that innovative ideas can be brought to maturity in places where you can find people to develop them, often in cities. But the germ of the ideas will happen when you have some time and space to yourself. I think there's a happy medium where there's access to people and infrastructure, but not the oppressive overdevelopment of Silicon Valley.

<comment><USER3> > In an overcrowded and expensive market like SF, you can't rent commercial > property without a proven business plan.

Unless you have capital from another source (usually arbitraged between industries or by geography), you can't really do this anywhere without a business plan. Even in a cheap area, nobody is going to open a deli or cornershop without a plan for paying the rent.

> If you pay $4,000/mo for an apartment

You don't have to pay this much for housing, unless you are completely inflexible about the location, the size of the place, or having roommates. And if that's the case, it's a bit of a lifestyle choice.

> Personally I find that innovative ideas can be brought to maturity in places > where you can find people to develop them, often in cities. But the germ of > the ideas will happen when you have some time and space to yourself.

Those sound like very idiosyncratic requirements for innovation, and it sounds like it's mostly a lifestyle choice. If it works for you, that's truly great.

Many people find that the germs of ideas come from participating in environment where related ideas are constantly being shared among a group of people. This can happen in any thriving community. That could be a dense city, or it could be (and often is) a university campus or research lab. Also, it's not limited to technology. The same could be said of music, literature, etc.

And if you are in a city, there's nothing stopping you from heading to open spaces for inspiration. That's also a common practice.

> but not the oppressive overdevelopment of Silicon Valley.

SV has it's issues for sure, but I wouldn't throw all cities under the bus with it.

<comment> racer-v > Even in a cheap area, nobody is going to open a deli or cornershop without a > plan for paying the rent.

Sure, the question is how experimental of a plan can you attempt. In SF 2018: not very. I know people who pooled their money for an experimental space in SF several years ago at $1/sq. foot, and broke even. At 5x or 10x those rates today, this is now a lot harder.

> SV has it's issues for sure, but I wouldn't throw all cities under the bus > with it.

My critique is specifically of the negative effects of overcrowding and overcapitalization in the SF Bay Area. By extension this would presumably apply to other places like Manhattan with similar conditions. I'm definitely interested in finding other cities with the networking advantages but that manage to strike a balance with livability. Austin has been mentioned already, although some folks will complain they're headed in the same direction.

</comment></comment></comment></comment></comment><comment><USER4> > L.A. is also less out of touch and it's a better place to connect with the > rest of the country.

Never thought I'd ever hear that coming from anyone, much less Peter Thiel.

</comment><comment><USER5> Tim Ferriss has mentioned his move from Silicon Valley Ron austin a few times on his podcast. But hasn't gone into detail as to why.

Not being in Silicon Valley, what is the best way to evaluate the environment?

<comment><USER6> This article from BI goes into detail why. It's basically just ripped from his Reddit AMA: [http://www.businessinsider.com/why-tim-ferriss-left- silicon-...](http://www.businessinsider.com/why-tim-ferriss-left-silicon- valley-for-austin-texas-2017-12)

I've lived in Austin for a decade and don't really find it open minded. I mean the local Republican group on meetup.com has a private membership because they are too scared of being doxxed...

FWIW I've always voted Democratic but now the party is getting overwhelmed by those leaving the Republican party and diluting what was once the workers party with tiny little neoliberal solutions to every large problem.

</comment></comment><comment><USER7> I had thought that he was moving to New Zealand, I guess that was temporary? Is LA that politically different than SF, or are there other reasons? This is all coming from an anonymous source, and not Thiel himself which surprises me, as he doesn't seem to be one who shies away from making his opinion known.

<comment><USER8> I think he got NZ citizenship as a "the world has gone to nuclear hell/the proletariat are uprising" backup plan, but never intended to move their full time.

</comment></comment><comment><USER9> Good riddance, if we're lucky he'll move to another _country_.

</comment><comment><USER10> tl;dr: he's moving to Hollywood to work on a "media endeavor," and also he's a pariah for backing Trump.

</comment><comment><USER11> Great so what policies does his political ideology have to fix the problems he's whining about?

</comment><comment><USER12> Good for him. I guess he's moving from a politically correct place (obviously negative) to the place that's correct enough, politically, for him (obviously positive).

/s</comment>


A structured search engine  - <AUTHOR> http://exploresion.org/#United%20States

<comment><USER2> The search itself does not look terribly exciting (search for Esperanto, the left category is a bit confusing without context).

But a making-of blog article explaining the data structure and import process would be quite interesting. Is this backed by Solr (the lists could be facets, I guess)?

<comment><USER3> You really just need a wikipedia dump, then construct a graph, wouldn't be too hard. I am a bit curious how it's stored in memory and what technology it uses though.

</comment></comment><comment><USER4> Where are the external links? It just keep me searching. PS. The footer will overlap a long list.

</comment><comment><USER3> It's a visual representation of Wikipedia article categories.</comment>


The lonely pretty girl syndrome and invite-only websites - <AUTHOR> http://eduardo.intermeta.com.br/posts/2013/7/8/lonely-pretty-girls-and-beta-lists <comment><USER2> I can't guess how many web apps have lost me because, instead of signing up right then and there, they waited a few weeks to put a beta link in my mailbox. By then, I'd moved on.

You don't sell anything by telling your customers to come back at an indeterminate time later. I'm here now, so let me give you my attention (and possibly money).

</comment><comment><USER3> Couldn't agree more, this is also why doing some capacity planning before your post it to hn or slashdot or whatever is a great idea. The first thing I do on an invite only website is say "oh cool, I cant use this." The second thing I do is anything else because I am not coming back to that website. Same goes for products rendered inoperable by the traffic slam, I know it sucks, but if there is nothing to try to keep me, you need to have the best idea ever for me to visit your page ever again(and I still probably wont).

</comment><comment><USER4> tl;dr DN is really HN with a better interface, but the same type of comments you'd read here and a similar format.</comment>


Show HN: Asymmetricfs – An Asymmetric, Encrypting Filesystem for Userspace - <AUTHOR> https://github.com/ckennelly/asymmetricfs

<comment> jude- Hi ckennelly,

Looks interesting! I have a couple of security-related questions. Now, I've only skimmed the code, so you may have addressed these already, but I was hoping you could clarify a few things:

* Do you take any measures to ensure that the gpg binary loaded is the "correct" gpg binary? Could an attacker trick the filesystem into using a poisoned gpg binary that leaks secrets?

* Do you deal with the keys in any way? If so, do you mlock() them so they won't get swapped to disk unencrypted?

* Do you ensure that data written into your filesystem can't get swapped to disk before it's encrypted? For example, you might have to mlockall() before handling writes.

* Do you take any measures to prevent file descriptor exhaustion attacks? In your subprocess module, you fork() and exec() without closing the file descriptors held by your filesystem (including e.g. ones fed into your page_buffer implementation). Since the gpg binary would inherit the descriptors from the parent, could the gpg binary do Bad Things to your filesystem with them? Also, could gpg be e.g. unable to open /dev/random, or other important files, due to file descriptor exhaustion?

Thanks!

<comment><AUTHOR> Thanks for taking a look.

To go through your points:

* If the "wrong" GPG binary is loaded, the game is likely already up: If an attacker has that degree of control over your machine, they're already on the other side of this airtight hatchway. They can attach to your running programs, read memory contents, and so forth, so compromising the GPG binary isn't necessary.

* Keys are handled by GPG, which normally should mlock key material.

* Part of my plan to switch to handling pages (rather than allowing data to be managed via a std::string) was to be able to use mlock() properly. I'll be adding that soon.

* Since the GPG binary is running as you, it could do Bad Things to the underlying filesystem (or filesystem exported by FUSE), but you do raise a point about closing file descriptors for general cleanliness.

<comment> jude- Thanks for your reply. Just a couple of other things:

First, I see from your code that you don't specify an absolute path to gpg. If I can write to a directory in your PATH that gets searched before the location of your desired gpg binary, then I win. Depending on your PATH, I don't need privileges or even a user account--for example, using a browser exploit or some social engineering, I could drop a poisoned gpg into your Downloads directory (or anywhere in your /home or /tmp), and if your PATH searches in your /home first (or searches '.' first), I could get you to use my gpg instead.

Second, regarding preventing plaintext from getting swapped to disk before writing, you have to keep in mind that libfuse will obtain the plaintext from the kernel and then call your write() callback--you're not safe if you only mlock() the data that FUSE gives you, since the data could have swapped to disk between libfuse reading from the kernel and calling write(). Now, I don't know if libfuse mlock's the write buffer first (maybe it's a side-effect of FUSE splicing pages between the kernel and application?), but it is something to keep in mind.</comment></comment></comment>


'Highly Irregular' Backdoor Found in Oracle Databases - <AUTHOR> http://www.forbes.com/sites/thomasbrewster/2015/01/20/glaring-oracle-backdoor/ <comment><USER2> "Leon Panetta, former US secretary of defense and former director of the Central Intelligence Agency (CIA)"

Interesting board of directors for a database software company, isn't it?

</comment><comment><USER3> "Yes, we backdoor all of our products," an Oracle spokesperson said, "it's company policy".

</comment><comment><USER4> Wow, a backdoor in the software used by the nsa to enable the surveillance state? Will wonders never cease...</comment>