UN climate science body condemns report leak - <AUTHOR> http://www.rtcc.org/un-climate-science-body-ipcc-condemns-ar5-report-leak/ <comment><USER2> Rightly so. They're not complaining that someone has leaked an internal report, this is a _draft_ report which will be made public. Selecting snippets from an un-reviewed paper is silly, taking it potentially out of context and drawing your own conclusions is downright irresponsible.

<comment><USER3> Sorry, but isn't science about more than one person getting access to the data and re-running the experiments? While I understand that it is politically inconvenient for the scientists, that shouldn't really be what decides what the public gets access to (especially since this is a tax-payer founded study).

In fact wouldn't it be fair that they are to check their report into a public subversion repository as it is being written?

<comment><USER2> > Sorry, but isn't science about more than one person getting access to the > data and re-running the experiments?

Yes, but that's not happening here. They've not released all the data with explanations of how thing were measured, caveats, and context.

> While I understand that it is politically inconvenient for the scientists, > that shouldn't really be what decides what the public gets access to > (especially since this is a tax-payer founded study).

You're making it sound like this will never be released. It's not like they'd hide it if the data showed things weren't as bad as expected, in which case a leaked report would be important. This is a leak equivalent to grabbing a corner from the notes on someones desk and then _turning it into a news story_. This is in no way a report about leaked information that should be public, it _will_ be public. It has nothing to do with "it's my taxes", it'll all be made public. What they want to do first is have it reviewed and checked before slapping their name on it and saying "we're confident in the data and the analysis".

What happens if there's a problem with the way this data was captured, which means there's a particular correlation with something else that must be accounted for before it makes sense? What if there are conclusions that aren't supported by the data, which could be found in review and amended?

> In fact wouldn't it be fair that they are to check their report into a > public subversion repository as it is being written?

Fair? Why? Unless you're acting as a reviewer there's no reason to see the paper before it's in its final form. In fact, knowing how bad we are at thinking things are true even when shown to be false, seeing anything that people aren't really quite sure about is an extremely bad idea.

If they were to shelve the whole report, then yes, a leak would be interesting. Otherwise it's a massive waste of time, which can seriously harm the credibility of the final paper.

</comment></comment></comment><comment><USER4> When science becomes this politicized it ceases to be good science.

<comment><USER5> I don't mind the skeptics; what drives me crazy is how many people see global warming as some sort liberal/one-world-government conspiracy. While government funding _could_ be distorting the research, oil and coal companies have plenty of reason to incentivize findings as well, so I'd call that a wash. And while scientific opinion is sometimes proven wrong, to say that climate skepticism is dimissed fails to understand the culture of science and the way professional scientists think.

Maybe we'll get lucky, and climate change will be a mere inconvenience. I'd rather not take that chance, especially when there are so many other reasons to diversify from finite carbon energy sources. Meanwhile, I trust the scientific community to do what they do best, and keep digging deeper, whatever the answer may be.

<comment><USER6> I don't think it's a conspiracy in the sense that liberals have a secret convention where they decided to make up Global Warming.

I do believe though that global warming feeds into their belief that industry, growth and capitalism are somehow evil and confirms their pre-existing prejudices.

<comment><USER5> I don't self-identify as liberal, but I'd say that corporations and oil are the villains to mainstream liberals; you have to go pretty far left (as in, farther than Chomsky) to find those against all forms of capitalism.

That said, you're right about confirming pre-existing prejudices; in that sense, every ideology or belief is a conspiracy. Climate scientists are not immune to this phenomenon, but the act of science is to proactively try to correct for these kinds of biases, with the added constraint of having to "show your work". While mainstream science can get it wrong, 95+% consensus is very hard to achieve due to either ideology or external influence, especially worldwide. Those scientists might be wrong, but they're not all duping us as part of some plot.

<comment><USER6> You don't have to go very far to find people against "growth" in western societies. Friends of the Earth, Greenpeace, Oxfam etc all seem to think that growth is an evil that should be opposed.

I don't think they are duping us, but a mixture of pre-existing biases combined with enormous funding certainly helps to create the idea of a consensus.

<comment><USER7> Growth can't continue forever: [http://physics.ucsd.edu/do-the- math/2012/04/economist-meets-...](http://physics.ucsd.edu/do-the- math/2012/04/economist-meets-physicist/)

>Before we tackle that, we're too close to an astounding point for me to leave it unspoken. At that 2.3% growth rate, we would be using energy at a rate corresponding to the total solar input striking Earth in a little over 400 years. We would consume something comparable to the entire sun in 1400 years from now.

<comment><USER8> 400 years ago humans didn't have usable heat engines, mobile chronometers, thermometers, and numerous other technologies essential to living a life differentiated from that of the Neanderthals. It isn't for certain that we'll make similar progress in the coming 400 years, but it's plausible. I don't think it will take that long to construct a Dyson swarm, for instance. The physicist you link really begs the question when he forbids "space cadets".

It's also questionable to equate growth in economic well-being with growth in energy use. They have certainly been related for a long time, but advances in materials, miniaturization, automation, and other engineering will make the environmentalists' goal of stabilizing per-capita energy use feasible.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> This might be a good place to ask this. My mind is mostly made up, due to the fact I believe that the energy sector has a much higher profit motive to distort the facts than the academic one, but in any case:

How is a layman to interpret this science? Heck, how are reasonably smart people who are not climatologists to interpret it? _How are time-starved politicians who are responsible for the related policy to interpret it_?

<comment><USER10> > "My mind is mostly made up, due to the fact I believe that the energy sector > has a much higher profit motive to distort the facts than the academic one, > but in any case:"

The "we're all gonna die" faction gets four orders of magnitude more funding each year than the global warming skeptic faction. Oil company spending on climate science propaganda consists of a few $million here or these, and the best skeptics don't even take any of their money. The best ones are unpaid amateurs (like Steve McIntyre) or they achieved a position in academia decades ago before belief in global warming became required to advance. I suggest you read some skeptics like Steve[1] and see if you think he is as evil as Phil Jones thinks he is[2].

Moreover, the environmentalists control the institutions which create public opinion - namely the media and the universities. I'm guessing this is how your opinion was formed[3]. It's remarkable how utterly dominant cultural forces can see themselves as underdogs.

[1] [http://climateaudit.org/2012/05/06/yamal-foi-sheds-new- light...](http://climateaudit.org/2012/05/06/yamal-foi-sheds-new-light-on- flawed-data/)

[2] [http://www.therightplanet.com/2011/11/phil-jones-for-your- ey...](http://www.therightplanet.com/2011/11/phil-jones-for-your-eyes-only- email-to-michael-mann/)

[3] [http://anomalyuk.blogspot.com/2013/07/the-modern- structure.h...](http://anomalyuk.blogspot.com/2013/07/the-modern- structure.html)

<comment><USER9> I find it interesting that you didn't cite your most pertinent claim.. namely _" The "we're all gonna die" faction gets four orders of magnitude more funding each year than the global warming skeptic faction."_

Further, the fact that you referred to people who believe the climate change theory as the "we're all gonna die" faction tells me squarely which camp you're in, and I'd thank you to avoid further such sneaky pre-framing of the argument if you wish for me to take your claims seriously.

<comment><USER10> The biggest skeptic propaganda organization that I know of is the Heartland Institute, which has an annual budget in the single millions. Greenpeace alone has an annual budget in the $hundred millions and there are dozens of other substantial environmentalist non-profits. The NOAA has a budget in the $billions, of which $hundreds of millions are dedicated to climate research, and that is not the only federal organization that deals with climate research. And there are other countries which have budgets allocated for this stuff. For example, all of the choicest anti-science quotes from climategate came out of the UK's University of East Anglia Climate Research Unit[1][2] and their struggle to prevent skeptics from accessing data.

I don't know that the global warming hypothesis is untrue. But I do know that our current process is not a method designed to find truth. Scientific data should be open to all humanity, and not hidden for the sake of advancing political agendas.

[1] "Why should I make the data available to you, when your aim is to try and find something wrong with it?"

[2] "The two MMs have been after the CRU station data for years. If they ever hear there is a Freedom of Information Act now in the UK, I think I'll delete the file rather than send to anyone."

</comment></comment></comment></comment><comment><USER11> Whoops!

This does beg a question... Does science deserve a higher standard of opacity for publicly funded research than our government overall? My sense is "let the process work to separate the signal from the noise" but I'd like to hear what others say.

<comment><USER12> I'm not sure what you're getting at (higher standard of opacity?) but in general, the consensus has been shifting toward open data and more open publishing (eg, ArXiv).

But regardless of the level of openness, it's quite possible for Science to be wrong, badly wrong, for years. Check out the story of Dr Moniz, for example: [http://www.nobelprize.org/nobel_prizes/medicine/laureates/19...](http://www.nobelprize.org/nobel_prizes/medicine/laureates/1949/moniz- article.html)

<comment><USER11> What I mean is, should we allow scientists a couple years to interpret the data from their experiments and models before forcing them to share it? Should we (as taxpayers funding the research) require them to disclose results before the peer review process?

I hear you on science being wrong. One of the best things about science is there is a self-correcting mechanism, though it takes a while. As one physics professor said, "A change in paradigm doesn't wait for the old masters to retire, it waits until they die."

</comment></comment></comment><comment><USER13> There's been so much controversy, zealotry, and fraud around this topic that it alienated a lot of people. And rightly so.

</comment><comment><USER14> UN is bunch of Climate Change denialists! They sold their souls to oil lobby !!!!</comment>


Ask HN: Post your best GEEK T-Shirts - <AUTHOR>

<comment><USER2> [pic] [http://www.giftag.com/clip/the-one-electronic/thinkgeek- sudo...](http://www.giftag.com/clip/the-one-electronic/thinkgeek-sudo- clip.jpg)

This one is my best geek tshirt. Just completely out of box for people who don't know linux and I like confusing them. :D

</comment><comment><USER3> [http://shop.kneadle.com/product/httpster-tee-squid- edition-g...](http://shop.kneadle.com/product/httpster-tee-squid-edition- green)

(they also have other colors.)</comment>


Ask HN: How to Business Manager and be a decent Developer both? - <AUTHOR>

I work in small web development firm. Since we are just starting out with our product / service aside for bootstraping, I have to take care of all the responsibility of business aspects (searching clients, communicating with them, managing projects etc) and my most day hours are involved in working as a developer too.<p>I'm getting tired of this double role. But, one thing is sure most HNers were once solo founders and  have got pass these sentiments. Any suggestion to keep oneself motivated in such ? or should I quit working double roles and focus more on development, which i enjoy most ? <comment><USER2> A coder who can do sales and management work are worth their weight in gold. I would look at the situation in two ways:

1\. Your value in the startup is far greater as you get better at all those different roles.

2\. Even in the worse case scenario if the startup doesn't take off, your experiences place you in a super elite group of developers that can manage and sell.</comment>


What it's like to live on the International Space Station - <AUTHOR> http://www.bbc.co.uk/news/resources/idt-c1dffc35-fe53-492d-a4bf-752a22bd1ebc <comment><USER2> There's a great 25 minute tour of the ISS by Sunita Williams on NASA's YouTube channel along with commentary on how life works up there. [https://youtu.be/doN4t5NKW-k](https://youtu.be/doN4t5NKW-k)

</comment><comment><USER3> Swallowing your toothpaste. Yuck. Sometime I think human will never get anywhere near deep space if we don't solve our gravity-bound biology. The only way I see is when we digitize our brain. Eliminate biology altogether.</comment>


What's really behind Twitter's staff exodus - <AUTHOR> http://money.cnn.com/2011/12/19/technology/twitter_exodus/ <comment><USER2> "Company insiders say the old guard is being wiped out by Twitter's new leadership team. They also say that's probably a good move."

What's not said in the article is that those insiders (even those who left) must still have company stock. What else are they going to say?

The article sounds too favorable, I wouldn't be surprised if a PR agency had a hand in it.

<comment><USER3> > _(even those who left) must still have company stock._

The ones who are no longer there should prepare for punitive dilution.

</comment></comment><comment><USER4> One of twitter's engineers has been accused of attempting to rape a female speaker at ApacheConf. That's the reason two friends of mine have quit Twitter last year. Their culture is incredibly broken.

<comment><USER5> This is a very serious accusation that implies a lot about how the company handled it, and after a handful of searches I've found no other references to it.

<comment><USER6> That would be Noirin Plunkett. Her account [1] and the discussion that went about the same way all posts on HN that touch on sexual assault or misogyny do... [2].

[1] <http://blog.nerdchic.net/archives/418/>

[2] <http://news.ycombinator.com/item?id=1875718>

<comment><USER5> Thank you (and noste) for providing links.

Shameful.

</comment></comment></comment></comment><comment><USER7> I really don't know what Twitter's next move is. They've done a great job of building a successful platform. But the product is very simple (by design), and it seems they've largely exhausted the obvious extensions to it. How are they going to stay relevant for the next 5-10 years?

</comment><comment><USER8> FWIW, I hate the new design and feel like it's a major step backwards, both from a design standpoint and from a usability standpoint.

The bigger question I'd like to see answered is what's the story with the board shakeup?

</comment><comment><USER9> Twitter has 800 employees? Just say'n...

<comment><USER10> Apparently, many are in ad sales if they're up to 2400 advertisers on a platform where you don't have to see the ads if you're on mobile.

</comment></comment><comment><USER11> The new web interface appears very ad driven (sidebar left, for instance). And all Twitter did with Tweetdeck / Chromedeck is destroy it. It's near unusable.

</comment><comment><USER12> Contemptible. This emphasis on "culture" is fatuous horse excrement. Whenever you hear that word, reach for your resume. It means that a cohort of smug self-satisfied untalented didactic mansplainers is about to institute a policy of competent mediocrity. I used to think that anyone who presumed that the rest of the world was as intellectually limited as themselves was merely mistaken. I was wrong: if they have any power at all, it becomes a self- fulfilling prophesy as they kick anyone with ability out. The new twitter is a dreary testament to the deceased neurons of the new management. Color me unemployable for saying so.

<comment><USER13> _This emphasis on "culture" is fatuous horse excrement. Whenever you hear that word, reach for your resume._

 _The new twitter is a dreary testament to the deceased neurons of the new management._

This sort of comment doesn't belong on Hacker News. There's nothing here besides insulting Twitter in a way that uses interesting words.

</comment></comment><comment><USER14> What's with the annoying video advertisements?</comment>


Social Engineering from Kevin Mitnick - <AUTHOR> http://henrikwarne.com/2015/12/27/social-engineering-from-kevin-mitnick/ <comment><USER2> Kevin Mitnick's first book, "The Art of Deception", was an eye-opener for me as well.

I guess I should read "Ghost in the Wire" too :)

I hadn't thought about those books in a while. If anything, "social engineering" should be WAY easier in the Facebook age - that's what should be keeping IT security people at night these days.

[https://en.wikipedia.org/wiki/The_Art_of_Deception](https://en.wikipedia.org/wiki/The_Art_of_Deception)

<comment><USER3> I highly recommend "Ghost in the Wire". It's pretty light on the technical details, but it's really entertaining if you're interested in the "Golden Age" of hacking.

I was amazed at how much more he leaned on his social engineering skills than his technical skills when he was in his prime.

</comment></comment><comment><USER4> I used to work at a large organization with annual security training requirements for all employees. It consisted of hours of ridiculous scenarios where the correct answer was always "don't open attachments from people you don't know and report anything suspicious to IT." I've often thought that requiring everyone to read "Ghost in the Wires" would be a much more effective way to show people how social engineering and phishing would actually work.

</comment><comment><USER5> Mr. Mitnick signed The Art of Deception for me in the early 2000s. I told him it was for a friend who at the time was 'interested in the dark side of computer security'.

He wrote: Don't do anything I wouldn't do.

<comment><USER6> > Don't do anything I wouldn't do.

Christ, what would that be? He didn't shy away from much.

</comment></comment><comment><USER7> Even to this day one can obtain quite a lot of info from the person at the front desk in many companies. You are as secure as your weakest links...your users. I've seen clients both large and small fail to enforce policy.

Money is better spent educating users and enforcing policy than acquiring the most expensive equipment.

Btw, The Art of Deception is a good read.

</comment><comment><USER8> I snuck into a Banking security conference; forged a badge, and stayed down the road to hear Kevin give a very lengthy speech.

It can be found here: ([https://soundcloud.com/michael_graf/kevin-mitnick- speech-201...](https://soundcloud.com/michael_graf/kevin-mitnick-speech-2013))

I gave him my forged badge, and told him I really like the speech - he signed my book and spoke with me for around 10 min... Really nice guy

</comment><comment><USER9> How does he remember so much details (abbreviations...) from years back? He keeps diary?

</comment><comment><USER10> The only think notable about Mitnick is that he was the first to get caught/prosecuted. Sloppy opsec.

<comment><USER11> It might be easy in some case to mistake "sloppy" for "pioneering". It's harder to defend yourself and cover your tracks when you're one of the firsts to actually have been there and done that.

I think the notable thing about Mitnick was just this: he became notable. He put these activities on the radar of the law enforcement and of the media when they weren't all that much concerned about it.

</comment></comment><comment><USER12> #spoileralert

</comment><comment><USER13> It's a shame that hackers are so glamorized in the media... Hacking is actually pretty easy. Most hackers just use vulnerabilities which other people have discovered and they rarely innovate themselves.

Even discovering new vulnerabilities isn't that hard. Once you know a particular codebase well enough, it's pretty easy to find new vulnerabilities. The average programmer will likely identify and fix many such bugs/vulnerabilities each day as part of their regular job but they don't get the same recognition that hackers get.

Also, social engineering is hardly engineering - It is just another name for deception/trickery.

I fully support hacking where the intent is to improve a system but doing so with the intent of achieving personal fame and fortune is just wrong and the tech media should make more effort to distinguish between the two.

<comment><USER14> In what world do you live?

Hackers are vehemently demonized by the media; by no means is there any sort of glorification occurring.

<comment><USER15> Demonization can be a form of glorification. Consider for example the following two paragraphs:

"He was slick, convincing several security guards he was a wayward contractor on his way to meet the department head. Thermal cameras in the server room defeated by a homemade polyester shield, it took only twenty minutes to extract BigCo's financial records. Having slipped in under the noses of corporate security like the most adept of rats, he skittered away in the anonymity of directions to the bathroom leaving no trace of his visit."

"The felon broke into the store through its back door window using a crowbar. They stole two empty registers and a safe, ransacking the building in their search for anything of value. Ramir was frustrated when he came in the next morning after, yet remains optimistic. "We may have been robbed, but we know that we're going to come out on top in the long run." The suspect is known from security footage to have fled the scene in a green pickup truck. If you have any information related to this crime..."

You get a very different picture of these two peoples competence just from the way they're depicted and the kind of crime they commit.</comment></comment></comment>


Rigging any vote-based social website to keep the "early spirit" - <AUTHOR> http://alimony.github.io/ideas/rigging-early-spirit.html

<comment><AUTHOR> Readers will hopefully notice the semi-sarcastic sub-tone of the text :)

<comment><USER2> > For example, any user could ask for content weighted towards an arbitrary > date, like "Show me content to the taste of people who registered in > December 2008" or "What do the 1,000 newest users like?"

That sounds like an incredibly interesting way to navigate a social news site.

Why do we have to be afraid to simply admit that, in a social news setting, the majority community gears content toward their own likes and interests? I actually wholly agree with the premise you dismiss as "semi-sarcastic".

<comment><USER3> >> For example, any user could ask for content weighted towards an arbitrary date, like "Show me content to the taste of people who registered in December 2008" or "What do the 1,000 newest users like?"

> That sounds like an incredibly interesting way to navigate a social news > site.

Except that votes aren't stochastically independent events - on the contrary, exposure to the first page, which is determined by any vote (not just your chosen cohort), determines most of the votes of a story.

I guess that with that kind of weighting you could perhaps have a different order of the stories that went to the home page, but the stories would still be the same - ie, you wouldn't find all the stories that would have come to the home page in the old days, and were instead pushed out by some kitten- stories.

</comment></comment></comment><comment><USER4> Better yet would be to rig the vote based on usage. So if you have 500 comments your vote is worth more than someone with 10, you could even scale it precisely on a curve. This way, rather than having a static seniority-based system the site can still develop based on who uses the site the most. You'd still have herd mentality, but there would be more insulation from it.

<comment><USER5> Not sure I buy that people who make lots of comments are better qualified to pick good content.

</comment></comment><comment><USER6> This idea would naturally develop into personally curated site based on your voting preferences, i.e. Amazon for news.

</comment><comment><USER7> HN has something like what the article proposes:

[https://news.ycombinator.com/classic](https://news.ycombinator.com/classic)

Although I think it just filters by account that are older than a couple of years, obviously becoming less useful over time.

<comment><AUTHOR> Didn't know about that, cool feature. For more discussion on this, also see [https://news.ycombinator.com/item?id=607271](https://news.ycombinator.com/item?id=607271)

</comment></comment><comment><USER8> unfortunately this wouldn't work very well because generally speaking there is attrition involved and the original "early users" base will slowly deteriorate as people die, retire or change interest, etc. and are replaced by newer users

so like it or not, under a weighted voting scheme, the site will still migrate away from its "early spirit" because the exact same people won't be around but replaced by newer people

with the inevitable march of time, the complete userbase will be replaced several times over and the site can completely change its tone and "early spirit" in spite of such measures

</comment><comment><USER9> Try an additional weight or graph based on your elections.

</comment><comment><USER10> I think this is a fantastic idea. It's worked out really well in America with the way we've treated each new wave of immigrants...

<comment><USER11> Don't forget about congress too! I always look forward to what old man such and such has to say about modern law</comment></comment>


Turn Up for Work Sneezing and the Sick-Shamers Swing into Action - <AUTHOR> https://www.wsj.com/articles/you-sneezed-go-home-11548346062 <comment><AUTHOR> [https://outline.com/EKdJML](https://outline.com/EKdJML)</comment>


Why America is flunking science - <AUTHOR> http://www.salon.com/env/feature/2009/07/13/science_illiteracy/

<comment><USER2> Most western countries are "flunking" science because it's hard work, lacks prestige, pays poorly, and you're unlikely to discover anything new even if you put in the necessary hours.

As we discover more and more about the world the more dedication it will take to make progress in a field. So it makes sense that you want fewer and more dedicated people.

Does Hollywood caricature scientists? Of course. But Hollywood isn't exactly know for its nuance. Business men are always evil (unless the business is failing, in which case the owner is the sympathetic underdog). Politicians are corrupt or incompetent. Is Hollywood to blame for the general indifference to science, I doubt that.

To summarize:

1\. fewer people devote their life to science. I don't think this is a bad thing.

2\. (young) people are indifferent about politics, the world, science, and most "stuff that matters". This probably is bad, but it certainly does not have a simple identifiable cause.

<comment><USER3> 1\. Few other topics (specifically, art, literature, dance) really contribute to the sum of humanity as well as science does. When we're young, we want to be firemen, ballerinas and astronauts. Only later do we get talked into fields with higher personal ROI.

2\. Really, indifferent? I spent quite a few years at protests and rallys with quite a few other students the last few years. Hardly indifferent.

</comment></comment><comment><USER4> "Crichton had little patience for scientists' complaints about ridiculous sci- fi plots and wild scientist stereotyping. In a 1999 lecture before the annual meeting of the American Association for the Advancement of Science, he countered such gripes with his own perspective on why scientists will probably never be very happy with the products of Hollywood. As Crichton advised, there are at least four important rules of movies that just don't mesh with the real process of research: '(i) Movie characters must be compelled to act. (ii) Movies need villains. (iii) Movie searches are dull. (iv) Movies must move.' Crichton argued that real science, with its long, drawn-out intellectual processes and frequent dead ends, simply can't be reconciled with such exigencies. 'The problems lie with the limitations of film as a visual storytelling medium,' he concluded. 'You aren't going to beat it.'"

The other important message of this article is that being smart doesn't prevent people from having mistaken ideas about science. Smart people can fall for plausible but scientifically incorrect statements about topics debated about in politics, because not all people, and not even all smart people, devote much time to examining evidence and making sure that conclusions are supported by evidence.

<comment><USER5> _...not all people, and not even all smart people, devote much time to examining evidence and making sure that conclusions are supported by evidence._

I'm extremely guilty of this, and it bothers me. But what bothers me more is knowing how much time and effort would be required from me to be capable of making evidence-backed claims about everything I'm interested in. You make time for what's important to you, and the truth is definitely important to me, but so is family, building my django skills, learning Scheme, reading GEB, considering ideas for a possible startups... The choice then is what/who to trust, the majority of scientists? The smartest ones (identified how?)? My own perceptions and ideas? The government-backed scientists?

Sceince suffers because people don't have time for it, and because they can't necessarily trust those who do.

</comment></comment><comment><USER6> Because science is boring. There are too little interesting opportunities out there. For every "dream" "fun" science job, there are millions of monotone, low paying, grinding positions that suck the life out of you.

</comment><comment><USER7> And there's more scientific research than ever and more in the US than anywhere else in the world. Please use reddit for mass emotion articles.

</comment><comment><USER8> > Why America is flunking science

Two words: Intelligent Design

<comment><USER3> Thanks for making me cry on the inside, dick.

:-)</comment></comment>


Open Source Ventilator Project - <AUTHOR> https://opensourceventilator.ie/ <comment><AUTHOR> Welcome to Open Source Ventilator (OSV) Ireland. This project was initiated by the COVID-19 global pandemic as a result of a community discussion within a Facebook group called Open Source COVID-19 Medical Supplies (OSCMS). This group rapidly grew and currently is targeting the development of a number of different COVID-19 related medical supplies.

OSV Ireland was formed by Colin Keogh, Conall Laverty & David Pollard, with the goal of building a focused team in Ireland to begin development of a Field Emergency Ventilator (FEV) in partnership with the Irish Health Service. To date we have formed a team of engineers, designers and medical practitioners to develop new, low resource interventions, all working collaboratively online. Bag Valve Masks (BVM), 3D printed and traditionally manufactured components are being considered to maximise potential manufacturing capabilities. We will also include other challenges and problems as they arise from frontline healthcare workers, which we will encourage our volunteers to tackle.

We have a core developer team publishing open source designs with ongoing communication with medical professionals regarding needs requirements, testing and validation processes. The developer team is led by OpenLung in Canada in collaboration with an Irish based engineering and operations team. The developer team is led by Trevor Smale, Dr. Andrew Finkle, and David O'Reilly from OpenLung as well as Conall Laverty and Dr. Keith Kennedy from Ireland. Work is well underway with hundreds of worldwide contributors.

<comment><USER2> Have you heard of Polish open source ventilator VentilAid? [http://www.ventilaid.org](http://www.ventilaid.org)

</comment></comment><comment><USER3> What is the point of all these? Large scale manufacturers have already been sent blueprints of ventilators and have the engineering ability and production lines to make them. Then you need trained nurses and staff to operate them.

<comment><USER4> Open source designs could help scale up production in times of need by allowing manufacturers to self-assess whether they're capable of providing additional capacity.

Yes, we assume blueprints have now been shared and that production is scaling up - but it has required a lot of time, effort, communication and bargaining.

That said, open source alone is not a panacea. Questions should be asked of open source designs:

\- Do the designs meet regulatory standards for the market(s) they are intended for?

\- Is the quality assurance process equally open, so that manufacturers & recipients can verify whether products are authentic and fit-for-purpose?

It looks like the OSV project are aware of these questions and provide their working assumptions and information about work-in-progress on their homepage.

</comment></comment><comment><USER5> I made some remarks about ventilator alternatives here:

[https://news.ycombinator.com/item?id=22624959](https://news.ycombinator.com/item?id=22624959)

To pull out some pertinent details:

Ventilators for covid19 seem to be mostly for inflammation and fluid in the lungs (aka pneumonia), not lung or chest paralysis.

If you need a ventilator due to inflammation or fluid build up, you can do other things to address those issues.

If you are doing home care for serious lung issues, a downside of mechanical intervention is that you probably don't know how to adequately sterilize your equipment. This means nasty stuff grows on the equipment and then this nasty stuff gets delivered directly into the lungs.

So I'm not thrilled to pieces to see the emphasis on "ooh, shiny!" homemade technical solutions in place of non-invasive home care.

You can do lung clearance without mechanical intervention. This can make a ventilator unnecessary.

You can do lung clearance easily on your own in the shower by standing with your feet shoulder-width apart or a bit wider, bending over as far as you can and coughing hard.

If you bring up a lot of fluid from the lungs, it looks and feels a whole lot like vomiting. My sons and I call it "puking up a lung."

Inflammation can be combated with commonly available non drug remedies, like caffeine, lettuce, avoiding pro inflammatory foods (avoid peanut oil like the devil himself made it for you, limit or avoid bacon as it is hard on the lungs).

Etc.

Please see my previous remarks about best sleeping positions, etc.

I am very concerned that homemade ventilators are going to become a source of secondary infection and this secondary infection will be worse than covid19 because it will be bacterial or fungal and it will be antibiotic resistant.

If I had any idea how on Earth to start a counter movement, I would be all over it. I have no idea how to do that, so I occasionally leave a comment on HN giving some of my thoughts, which isn't likely to exactly catch fire. This is today's comment in that vein.

<comment><USER6> Please don't be silly. You cannot physically cough hard enough with dropped O2 sats like that, and even strong healthy people will be unable to fully evacuate matter from lungs, especially biofilms. Next time you propose an alternative, provide actual data supporting it. As a test, start doing it at say peak of a 2200 meter mountain. (That would be 90% with no acclimation.) See how far you can go.

Sleeping positions are irrelevant.

A positive pressure mask or cannula with O2 concentrator or supply is likely sufficient, not necessarily a full blown ventilator, and is much easier to sterilize. Still, it does carry risks. And it's the O2 concentrator part that's expensive.

<comment><USER7> Reduced efficiency and inability to evacuate matter _fully_ (which you claim) does not seem to make the method useless. Severity of the condition is likely a spectrum too.

</comment></comment></comment><comment><USER8> Anyone pitching in seems like they're doing a good thing, but isn't the problem one more of political organization and scaling production?

In other words, the US president (he is the only one authorized to do it) needs to activate the Defense Production Act, and get existing companies to mass produce existing designs. Something similar needs to happen elsewhere. This is a matter of days or weeks, not months.

Please gently correct me if I have this wrong.

<comment><USER9> My understanding is that the various open source ventilator projects are attempting to use readily-available COTS parts (by, for example, using a constant-speed blower and valves operated by RC hobby servos instead of a variable-speed blower). So that should, at least partially, solve the scaling problem.

As for political organization, I would think that almost takes care of itself if someone presents a turn-key, scalable solution.

<comment><USER10> So if these open source ventilators are needed in any number, it's going to be dependent on the RC hobby servo motor supply chain?

</comment></comment></comment><comment><USER11> Went over many comments. I see many people who are worried about an opensource project because its going to throw the apple cart of existing price gouging players in the market, but they are not open about it

This is an excellent foray of opensource into a space thats currently extorting people to live, i.e medical industry

</comment><comment><USER12> > 15-20% of infected people require hospitalization for respiratory problems

This is wrong - it's 15-20% of _identified_ , _diagnosed_ and _subsequently monitored_ infected people, isn't it?

I thought there was a mass of unidentified infected people, and even basically diagnosed but told to just deal with it at home with no further contact as they're low risk and minimal symptoms, and (obviously) 0% of these groups are going into hospital? This is what Wikipedia says at the moment.

Or am I wrong?

<comment><USER13> You're absolutely right. But does it _really_ matter ?

A lot more ventilator are going to be needed, not in % but in hard cold real absolute number. Isn't that more important ?

<comment><USER12> > But does it really matter ?

Yes - I think we should challenge misleading information wherever we see it in this situation. Fighting panic is part of the problem and bad numbers cause panic.

I mean, if we don't really care that the numbers aren't accurate because it's more important to emphasise why the project is important, we might as well go all the way and say 99% of people need a ventilator and really sell the project.

There was a news report recently implying a 50/50 survival rate, due to this same kind of assuming everyone realises that you're talking about some group that's already in a bad way, but not actually saying that in the text.

<comment><USER13> I don't think this project wants to create panic. To me it rather is trying to help and be prepared. I'd rather have too many than too few.

Plus, we don't know when the site was set up. Two weeks ago ? Four weeks ago ? Our collective knowlegde is changing every day. Could just be they have been busy and did not find the time to update it ?

And finally, blueprint for a cheap OSS FEV will always be useful. COVID or not.

<comment><USER14> They're not arguing against having an open source spec, they're just pointing out that you can do the open source ventilator thing while not spreading misinformation.

Please don't confuse the two. It's hard enough to fight the misinformation as is without well-intentioned people such as yourself introducing red herrings.

Again, your point is coming from a good place. But we need to be really careful about not accepting misinformation.

<comment><USER13> This is one line on a whole page. And if usually people should cross-reference at the very least 3 reputable sources before accepting an informations as true. Maybe it is a good time to ingrain that message along the "wash your hands"

</comment></comment></comment></comment></comment></comment><comment><USER15> Please, stop with these. As experts have shared many times on here, once you need a ventilator, the ventilator is the _least_ of your problems. Trying to apply a ventilator to a COVID-19 patient who needs one when you have no idea what you're doing can create the same lung injuries as COVID-19 itself.

<comment><USER16> Just treat it as harmless hobbyism, which is what it is. When engineers are nervous, they build things. That is natural!

Will these open source designs save many lives? I doubt it. Large scale manufacturers working with existing vent makers will do a much better job. But... if it gets thousands of people thinking about artificial ventilation, we might get a lot of interesting new ideas that we can use in the decades to come.

<comment><USER17> > Just treat it as harmless hobbyism

Any other time, yes. In a time of widespread panic? Dangerous.

People are going to try to build and use these at home in an act of desperation to "do something", and end up killing their loved ones.

<comment><USER18> Think back to Wuhan. Imagine the hospitals have closed their doors because they are already backed up. Your grandparent is dying in the room next door because no doctor is available to treat them.

Who the hell cares if you build a ventilator and try it then? They're going to die anyways. You are doing nothing except increasing their chance of survival by _acting_ instead of _waiting._

Should you use this while hospital beds are still available? Obviously not. But any care is better than no care and being treated by a Wikipedia doctor is better than being treated by no doctor when you're already on your deathbed.

<comment><USER15> Doing something may well be worse than doing nothing.

Concrete example: you get impaled by something. Do you: (a) do absolutely nothing and leave it in, and seek help or (b) rip it out as you see in movies because doing something is better than doing nothing.

(b) will kill you and (a) will save your life.

By doing something you have no business doing, no understanding of the mechanics and consequences you may will make it worse.

If everyone in Wuhan hooked up their loved ones to leaf blowers, the death rate probably would have been massively higher.

</comment></comment></comment></comment></comment><comment><USER19> I like the effort and project. I tried looking at it and the techcrunch articles and was disappointed by this and the open source mask efforts. This is going to sound horrible but I think there is something that needs to be said. We shouldn't have to hack/make our way out of this shortage. I say this as a diehard hacker/maker. A factory can put together high quality and high volume versions of these two items. It is a national shame (I'm in Canada but lived in the US for years) that we don't have domestic capacity and ability to surge on these items. We can still surge. This is not bloody rocket science. If we start today, we can have factories in a month. We should be surging on this today. We should have been surging on this since January and not have to deal with a shortage of bloody test swabs. I know raw materials and equipment are in short supply. But if our economies are truly unable to find the necessary parts in our just-in-time inventory or storage, we as a generation should hold our heads in shame and leaders accountable.

</comment><comment><USER20> Loosely related threads from recent days:

[https://news.ycombinator.com/item?id=22453100](https://news.ycombinator.com/item?id=22453100)

[https://news.ycombinator.com/item?id=22573188](https://news.ycombinator.com/item?id=22573188)

[https://news.ycombinator.com/item?id=22573656](https://news.ycombinator.com/item?id=22573656)

[https://news.ycombinator.com/item?id=22573926](https://news.ycombinator.com/item?id=22573926)

</comment><comment><USER21> The page isn't loading so I'm not sure what they've got, but I'm still trying to get answers to a question I have. I did research Tuesday and it seems like ventilators are positive pressure only, and they cycle between a low pressure and a high pressure. If this is the case, could an air compressor with a regulator be used as the pressure source? If so, a small device with just two pressure regulators and an electronic valve could be used to cycle between high and low pressures for each patient. I keep seeing open source ventilators that use a fan and a motor, but those seem likely to fail. Air compressors are abundant and could literally be taken from construction sites to be used. You put a pressure regulator to go down to the (very low) pressures one might want as a maximum for any patient, then you can gang that up to a whole bunch of hoses. Finally a little box with a couple of regulators can adjust the per patient high and low levels.

This to me seems much simpler and more reliable than ventilators with their own fan. But I don't have a good way of reaching anyone. I've created a thread on my website with my sources, thinking, and some questions. If anyone knows about this please reply here or there and let me know. Thanks.

[https://reboot.love/t/coronavirus-towards-a-cheap-and- easy-t...](https://reboot.love/t/coronavirus-towards-a-cheap-and-easy-to- manufacture-ventilator/281/11)

<comment><USER16> To quote an earlier comment of mine:

So there are four main ways for breathing machines to be powered: 1) By compressed air from a wall port (majority of ICU machines)

2) With bellows (anesthesia machines)

3) Turbine, either dynamic or constant speed with a proportional valve (home use or patient transport)

4) Piston

Let's assume that we use a pneumatic device driven by centrally purified air as that is simplest. The parts then are:

-Gas blending to mix O2 and HP air. In many designs this is done using two solenoid valves.

-A fast, precise, and accurate proportional solenoid valve. This turns the constant pressure into the desired waveform

-another valve for controlling exhalation pressure. Can be another proportional solenoid, alternatively a manually adjustable valve to ensure constant minimum end exhalation pressure (PEEP)

-Flow sensor (range of options, typically variable orifice or hot wire anemometer but other type exist)

-Pressure sensor (silicon waver transducer)

-Overpressure valve

-O2 sensor (highly desirable, arguably you can estimate from O2 blending settings but that will work better on a very well characterised design which this would not be. Anyway O2 sensors are widely used so this will never be a constraint.

-Piping to connect it all together

-A control and alarm system to drive desired waveform based on user settings and sensors

-Patient circuit: Humidifier / heat exchanger, patient valve (one time use), viral filters for intake and exhalation air (one time use), ET tubes (one time use) Probably the limiting factor as far as parts go are the valves since this is a niche application. Here's the problem: as a civilisation, if we had to make a hundred million vents by the end of the year it would be easy. Expensive, sure, but not that hard in an emergency. It is much harder to make an extra 50,000 in a few weeks because it just takes time to turn the machinery of mass production in a different direction.

Let me know if you want me to send my list of ventilator reading. I'm not an expert either, just trying to soothe my Corona-madness by thinking about building things.

<comment><USER21> Thank you! I will copy your comment to the thread on my website and link back to your comment here. Feel free to share your reading, but the stress of feeling like I can help is a bit much. I'm going to collect information but for now I'm hoping the major manufacturers committed to ventilator manufacturing are going to pull through.

</comment></comment></comment><comment><USER22> Has anyone looked at Cuirass ventilators? The (seemingly only) manufacturer says they are great for clearing lungs and breathing. They even seem to indicate them for use with Covid. They are basically iron lungs revamped. They look easier to amateur build than invasive ventilators and with no intubation, anyone could apply one.

</comment><comment><USER23> Sure, have some home made barotrauma and pneumonia to go with your COVID.

</comment><comment><USER24> This is a project based in Ireland. For a similar US-based project, see [https://www.projectopenair.org/](https://www.projectopenair.org/)

</comment><comment><USER25> I am 90% sure there will be a useful antiviral therapy available soon, whether it is remdesivir, favipiravir or even chloroquine. This will change the game in humanity's favour. Antivirals are also the only solution which can actually scale to the problem, unlike these ventilator projects or even vaccines (at least not for a very long time, bear in mind that under ideal conditions the supply of seasonal flu vaccines is often dicey). The first use for antivirals will be to reduce the number of patients with severe infection requiring ventilatory support.

Making these antivirals as useful as possible is of great importance, and that means going all in on mass producing a quick and reliable and broadly applicable diagnostic test.

I would much rather see open source projects targeting diagnostic tests or manufacturing nasopharyngeal swabs. Admittedly, this is much harder to achieve for people not involved in life science research or without access to virological specimens.

</comment><comment><USER26> There are a few other open-source and crowd-source projects like this that I've seen. It's interesting to see so much volunteer response to the crisis.</comment>


Twitter, Reddit challenge US forcing visa applicants to say social media handles - <AUTHOR> https://techcrunch.com/2020/05/29/twitter-reddit-visa-social-media-handles/ <comment><USER2> Its insane indeed that they want to collect your data and meta-data from social media handles as a "background check". If you are not active on any of the social media platforms, that would raise a red flag: Why is this person not like everyone else? (reminds me of Black Mirror rating episode) If you only use forums or social media under anonymous accounts, you could say you do not use any of those platforms because in theory that makes it harder for them to link those accounts to you. However, if they indeed link an existing account to you, then you are "caught" lying in your application which raises a red flag.

Its a vicious cycle. I liked it better when the agencies would let you "I do not want to answer this question" choices.

</comment><comment><AUTHOR> Original title was too long. It was:

Twitter, Reddit challenge US rules forcing visa applicants to disclose their social media handles

[http://www.documentcloud.org/documents/6932957-Twitter- Reddi...](http://www.documentcloud.org/documents/6932957-Twitter-Reddit- amicus-brief.html)</comment>


Password prompts are annoying - <AUTHOR> http://danbirken.com/usability/2014/02/12/password-prompts-are-annoying.html <comment><USER2> What is he talking about? Amazon.com prompts me for my password _all the friggin ' time_. Every time I click "check out". Every time I click "my orders". It asks me _again_ in the _same_ session if I go back to add something to my card, and click "check out" again.

(I agree with the rest. I just think Amazon's a bad example here.)

<comment><USER3> Have you enabled "1-click" ordering? That doesn't require a password (for me). Whereas doing a checkout cart flow, does.

However I agree with you that there are some flows on Amazon.com (or especially AWS Console) where you're seeing that sign-in form every 10 minutes, it feels like.

<comment> robinson-wall My experience with the AWS console is that I get a 12-hour session upon logging in, and I never have to reauthenticate.

</comment></comment></comment><comment><USER4> Using long-term cookies to keep people logged in all the time can be dangerous in certain circumstances. After all, there's a reason why we used to tell people to log out when they're done, although Google and Facebook are doing their damnedest to make people forget this ancient wisdom.

\- There are many more opportunities for an attacker to reuse a stolen cookie.

\- There are many more opportunities to exploit a CSRF vulnerability if users are always logged into the target site.

\- Users might be under the impression that when they close the browser, they'll be logged out. Breaking this expectation can have privacy implications. For this reason, I think it would be good to have a "Keep me logged in" checkbox, even if it is checked by default.

\- Many people, especially the poor, still use computers that are either shared (with family and/or friends) or public (schools, libraries and Internet cafes). Although these people probably only make up a small minority of your userbase, I think it's important to afford them no less security than you do your other users.

<comment><USER5> > There are many more opportunities for an attacker to reuse a stolen cookie.

Why would an attacker wait to use a stolen cookie? Does this actually increase the attack surface, or simply just put the bad guy on a shorter timetable?

Also every time someone visits your site you could delete their old token and save a new one. That way stolen cookies only last as long as until the page is re-visited.

> There are many more opportunities to exploit a CSRF vulnerability if users > are always logged into the target site.

That argument is valid for most sites, even sites who's sessions only survive until the browser is closed. At this stage in the game it is barely a real argument as so few sites log you out within a reasonable time frame.

> Users might be under the impression that when they close the browser, > they'll be logged out. Breaking this expectation can have privacy > implications. For this reason, I think it would be good to have a "Keep me > logged in" checkbox, even if it is checked by default.

Aside from banking sites, how many sites log you out right now when you close the browser? I cannot think of many. I'm all for having a logout button. I would expect public computers to be set up to clear the browser's history, cache, and cookies when it is closed like every modern browser supports.

> Many people, especially the poor, still use computers that are either shared > (with family and/or friends) or public (schools, libraries and Internet > cafes). Although these people probably only make up a small minority of your > userbase, I think it's important to afford them no less security than you do > your other users.

Most shared/public computers are set up specifically to delete browser information upon exit for this very reason. If you are going to design every website on the internet for the one or two places who have their machines set up horribly poorly, then you really are targeting the lowest common denominator.

Alternatively just add a logout button.

<comment><USER6> _Why would an attacker wait to use a stolen cookie?_

Every now and then I see a sentence which only makes sense in the context of the 21st century...

<comment><USER7> Well, not really, many people got mugged at stolen-cookie-point in the twentieth century too.

</comment></comment></comment></comment><comment><USER8> I think that #3 (Log users in from emails clicks automatically) is the most important here. I hate it when I click a link in an email, then immediately have to log in. Half the time it's not worth the effort and I close the tab. I would guess that conversion ratios can be improved by a large amount by automatically logging users in via a token in the email link.

<comment><USER9> OKCupid puts login tokens in their links used in their notification emails, so that when you click on them, you're automatically logged in. Convenient, right? But what if a novice user copies the link and sends it to a third party ("hey, take a look at this match!"), not knowing the significance of the extra data in the URL?

[http://edelsont.livejournal.com/14163.html](http://edelsont.livejournal.com/14163.html)

<comment><USER10> Authentication tokens should expire after first use; other sanity checks:

1\. Tokens should expire after no more than five minutes.

2\. Embed a 1-pixel image in an HTML-based e-mail also contains the token. When the e-mail is first opened, the server associates the IP address from the e-mail with the token. Only subsequent authentication requests for that token/IP address pair pass validation.

3\. Log IP addresses used by an account. Additional new IP addresses outside the usual geographical area (GeoIP) should fail validation. This assumes that the first person to click the link is the intended recipient.

Any other ideas?

<comment><USER11> These are all ideas which would cover maybe 80% of use cases, but severely annoy the remaining 20%. Is that a good idea?

<comment><USER12> The fallback can be that you have to log in with a password. Which is bad, but apparently tolerable.

</comment></comment></comment></comment></comment><comment><USER13> Password prompts are annoying, agreed.

I like the idea of delaying it as long as possible, even if sometimes it gets annoying. If I have to go through several steps just to register to a site, then I'll probably not register.

But remember that e-mail is not a secure protocol. Anyone could be sniffing your traffic to find a random generated password, an url that automatically log you in, and similar content.

I'd love to see a solution based on certificates, like how ssh works. Your browser and the server agree on a key pair over a secure (https?) connection, and then you use it to login.

This add a whole layer of complications to the browser, like how you sync those, take them into another browser ecc... But it would sure be a very cool way to totally remove the password prompt, while staying secure.

By the way, Amazon ask for my password every time I try to place an order, even if it's with a saved credit card and with on a registered address. Maybe it's an American thing?

<comment><USER14> This exists: [http://pilif.github.io/2008/05/why-is-nobody-using-ssl- clien...](http://pilif.github.io/2008/05/why-is-nobody-using-ssl-client- certificates/)

<comment><USER15> StartSSL (a reasonably priced Israeli PKIX CA) does. Some Banks do too, but tend to wrap it all up in a hardened browser instance or app. As for why no- one else does:

      * installing a client cert is way too complicated for "average" users
      * being directed to change settings you don't understand may appear scary
      * moving a your client cert from one box to another is unnecessarily complicated (browser sync may help there)
      * if more than one person uses the OS account, they'll need to mess around in the browsers config option each time they authenticate
      * not having to provide a password will "feel" insecure to many users
      * running a PKI is hard[er than storing passwords]
      * I'm not sure we want people installing any kind of certificates as a normal part of their workflow -- more often than not they might stumble upon a malicious CA cert

</comment></comment></comment><comment><USER16> >This convenience is possible because this is hard to abuse. If a malicious person gets access to my computer, the worst thing they can do is order a whole bunch of stuff to my saved address, which I could easily cancel or return.

Based on the number of services who will reset logins given only the last 4 digits of a card, this person is hopelessly misinformed.

Not asking for a password on registration means one needs to be emailed to the user, in plaintext. Given users' habits, a vast majority of them will then not change from that one - a security disaster, and likely to land you on plaintextoffenders.com .

As for this three flows, 1 is someone who wasn't interested, fine - but he advocates spamming people who haven't double opted in, which is just about the worst thing you can do from an email perspective.

Oh, and email click logins are another terrible idea, as intercepting an email then gives account access - even partial access means your security model has failed.

I'd rather have regular password checks with the 3 seconds it takes to input it from KeePass than lose an account or personal details.

<comment><USER17> "Not asking for a password on registration means one needs to be emailed to the user, in plaintext."

Not really. You can just create the account without a password and let them create it with the 'forgot my password' flow later.

</comment></comment><comment><USER18> 500px.com does something very interesting. They allow you to start a live account using a temporary "guest" account. No email, no passwords, no nothing. After you start, you realize, shit, I want to save this stuff, so you create an account and you've already started. Brilliant.

<comment><USER19> For a website like a forum, you could go ahead and display the "New Post" textarea to guests and then prompt them for registration on submit.

<comment><USER20> If you do, make it very clear that you will ask for a password after submit, and what kind of password that is. There's nothing as annoying as thinking "these guys accept feedback", spending time typing feedback and then getting some weird options ("log in using Facebook, Disqus, …)

</comment></comment></comment><comment><USER21> The craigslist flow also has plenty of annoying edge cases. I ended up with an account at some point... I can't recall why exactly. I was maybe posting to a category with a lot of fraud in it so they made me? Anyway, now every time I post the process STARTS as an accountless posting, but ends up linked to my account.

It ends up not saving any steps. I create a posting, get a POST/EDIT/DELETE email, click that, log in using my username/password (or more realistically: reset my password, then log in).

Craigslist's accountless posting is a great thing, but managing a hybrid approach as they have ended up having to do seems messy and confusing for those of us who get accounts.

<comment><USER12> How is CL identifying you as an account-holder? Maybe you could just delete all their cookies? If it's by phone number, I guess you're out of luck...

<comment><USER21> email address

<comment><USER12> Maybe it would be less annoying to set up a new account that simply forwards to your current one, and post your notices using that new account?

</comment></comment></comment></comment><comment><USER22> Should use Launchkey.co and logging in is not only easy but secure!!

</comment><comment><USER23> Too bad the cited example is the result of a patent.

</comment><comment><USER24> Requirement of email is even more annoying.

</comment><comment><USER25> You don't need passwords with LaunchKey

<comment><USER26> Yeah, but then you'd need LaunchKey, which is worse. Nothing against them personally, but handling your user account protection with a for-profit third- party seems far worse than having a password prompt.

</comment></comment><comment><USER27> Film at 11.

</comment><comment><USER28> Controversial. First, it's nice to have new thoughts. But I am not a closed- mind person, plus I am new to security so I am fairly open to new ideas.

> It might seem strange, but a sign-up flow in which people set the password > as late as possible (or never at all!) are generally going to convert at a > higher rate.

I am not interested in conversion rate. Amazon does not lock you in to sign up if you are just browsing. If you want to purchase, you might. I am sure there are sites out there do guest checkout or add to cart and sign in later. That's great. So about the number of users who are going to sign up and not sign up depends on the situation.

> simply keep a user logged in for a very long time (1 year+), but require a > password to change key account information. Simple and effective.

We trade too much security for convenience. Having long time session for Amazon-like site? That's a bad idea. Imagine me telling you your computer will now log in Citibank for 365 days. And we tell people don't save password for such high-profile site? If you lose your computer and the theft was able to access your browser, that cookie can do a lot of harm.

> But my favorite site is craigslist.

As you noted later, your solution works for certain types of website. Using Amazon to establish a story and propose a solution makes the solution weak and confusing.

> I realize that there are also security trade-offs, but it isn't a > coincidence that the #1 online retailer, the #1 classified ad site, the #1 > daily deal site all trade-off a slight amount of security for convenience.

You are talking about a site which handles transaction with banks and merchants, vs a site that handles text ads display.

In your final lines:

> An email/password prompt should not be the first thing on your sign-up form.

Sorry, what? You just said it would be nicer to just send an email to the user. Now you are suggesting, let's not. Also, the downside of providing a password later is that people will not do that later. You can, of course, force them to provide a password when they do critical things like "to checkout, please provide password." So why save that headache? Is the use case about "I want to save my watchlist on Amazon but I don't yet want to provide my password to Amazon?" This is the only usecase which I think is fair but severely limited and thus may well be considered unimportant in the end.

> Use long term cookies to keep people logged in. Like Amazon or Groupon, if > somebody has logged in once on a computer, let them do common hard-to-abuse > things without a password.

> Log users in from emails clicks automatically.

No. How can you verify it is ME clicking it? Because i am the only one who can access the email? So if such link is leaked (or the link generation is hacked), I can log in as anyone without even trying to hack your database.

If my email is doom password reset is doom? Okay, fine. But we are all advocating to implement better, more secured multi-factor authentication, why are we now falling back to minimal authentication again?

While I agree password cannot verify one's identity entirely and email is also hackable, I think simple design like AUTHENTICATION all the way is simpler. There might be cases in which authentication is unnecessary - but I probably won't recommend myself even thinking about this new idea.

</comment><comment><USER29> The lock on my front door is annoying.</comment>


A gentle introduction to isogeny-based cryptography [pdf] - <AUTHOR> http://www-users.math.umn.edu/~math-sa-sara0050/space16/slides/space2016121503-costello.pdf <comment><USER2> My group theory is far too rusty to gather what is really going on here, but having looked at the Wikipedia article on SIDH the reason this might be of particular interest is it is a "post quantum" crypto algo - i.e. thought to be secure against attack using a quantum computer.

<comment><USER3> What would have been good to call out on the Diffie-Hellman Instantiations slide is that SIDH supports forward secrecy.

<comment><USER4> Isn't that more a property of the protocol than the underlying crypto? What DH exchange can't support forward secrecy?

<comment><USER3> Agreed, but the distinction you draw between kex and keys doesn't exist on the slide, which was my point. I could have worded that better.

The slide I referred to mentioned the instantiations, not all of which provide pfs.

</comment></comment></comment></comment><comment><USER5> Not gentle

<comment><USER6> Might be more gentle with the speaker actually presenting, instead of just slides :)

<comment><USER4> Do we have a link to the talk?

<comment><USER3> This paper may be helpful until then. [http://eprint.iacr.org/2016/413.pdf](http://eprint.iacr.org/2016/413.pdf)</comment></comment></comment></comment>


Life indoors exacts toll on children in Koriyama, Fukushima [Mar. 2014] - <AUTHOR> http://www.japantimes.co.jp/news/2014/03/10/national/life-indoors-exacts-toll-on-koriyama-children/#.VgGiGpcvaDl <comment><AUTHOR> I'm submitting this as a contrast to recent discussion about the disaster in Japan four and a half years ago and nuclear disasters in general. This shows the current, human condition at play in these situations and what the effect is on people who live through it, rather than viewing a disaster from the lens of history or merely looking at abandoned structures.

When debating issues about how disaster can be handled and how responses can be made faster with better decision making, it's great to understand how this process has played out and where it leaves people living afterward. It's also important to think about what we can do to help people in less than ideal circumstances in the present.

In general, the hacker mindset is one of developing creative solutions and solving problems. Let's try to foster the kind of thinking that allows us to help people by solving their problems, rather than point out how other people's thinking might be wrong.

Additionally, in situations like these where the most important aspect becomes the human element, it is also reasonable to simply hear from other's experiences and to try to learn from those most directly affected.</comment>


What's Wrong with Meritocracy - <AUTHOR> http://the-diplomat.com/china-power/2011/02/24/what%E2%80%99s-wrong-with-meritocracy/

<comment><USER2> I wish HN had a "Move it to reddit" button.

<comment><USER3> I wish HN had a ``show only informative replies'' button, if you'll excuse this cheap shot at you.

Perhaps I don't understand and/or notice some of the ways the article fails. I lurk here to learn something new, so I wish fellow HNers would explain the reasoning behind their critique.

But if you were referring to the submission title only, that's another story...

<comment><USER2> Feels highly political, especially with the original title.

We're not trying to get into Harvard, so not particularly relevant.

While you may be a lurker here, and so may not have it, many of us have a "flag" button. This will delete the article from the site if a pretty small number of us click it.

 _Therefore, I wish, in addition to this button, I also had a button that said "has some value, just get it out of the curated HN space, and transfers it to reddit"._

So if it's interesting to hackers, it's via politics (which HN tends to be flag happy about), and about a stage in life where pretty much everyone here is past (college admissions), to an institution which isn't really that common for the startupy type of person to strive for (usually preferring Stanford or MIT).

I do think it's interesting, I just would prefer to see it on a site where the politics can be discussed without the stink of political opinion interfering with the startup community.

I view sticking stuff like this on HN is akin to having heated political discussions before interviewing for a job or partnership: a universally bad idea.

I wasn't being glib. It _is_ an interesting article, just not one I want to see change my opinion of people I discuss technical things with all the time. People tend to be more blind to assumption about politics than many other topics, so it's a good way to make yourself think less of people.

Things close to this I would think on topic for HN:

A blog post going into how the hacker community isn't like this.

The ways that scions of tech are different than other parents when the second generation comes around.

Etc.

<comment><USER4> The article isn't really _about_ university admissions at all, they're merely provided as one cause of an environment which also has its parallels in startup life.

Arbitrary illustrative excerpt:

 _Whether American or Chinese, individuals who focus too much on 'achievement,' and who believe the illusion that they've achieved everything simply through their own honest hard work, often think very little of everyone else as a result._

<comment><USER2> Yes, the article repeats examples of the fundamental attribution error then draws some conclusions about it. However, the subject matter is the founders of the testing moment, and their failure to achieve their goals.

Again, the only _interesting_ part of the article is highly political which is basically stating "be nice to the proles before they eat you". Aka, it belongs on reddit, not here.

If it makes you guys lay off, I _agree_ with the blog post, I just don't think it belongs HERE.

</comment></comment></comment></comment></comment><comment><USER5> Please don't editorialize in the submission title.

<comment><AUTHOR> Changed, thanks.

</comment></comment><comment><USER4> A very good article, though I wish the author weren't so enamored with David Brooks clichés.</comment>


IAMSKILLED – The next level of IT-interviews - <AUTHOR> https://www.iamskilled.me/ <comment><USER2> You should double-check the grammar and writing on your site; have a native English professional do the writing. Also, the screenshot shows an "I'MSKILLED" logo (vs IAMSKILLED). My opinion (remember, _opinion_): the name is silly, which won't resonate with your target audience.

Also, what on the homepage tells me what the product is? "next level", "simple", "functional", "platform", "automatically", "easily", "next generation"; remove all of those and replace with the features of the product.

<comment><USER2> Good luck with your business!

<comment><AUTHOR> Thank you so much for the valuable comments and opinions. We'll fix and improve our product -)

</comment></comment></comment><comment><USER3> The website doesn't scale well on mobile

<comment><AUTHOR> Thanks, we will add mobile version at few next days</comment></comment>


QUANTIFIED SELF: If you own a smart device, we need your help! - <AUTHOR> https://healthsurvey.typeform.com/to/Oh5LUE

<comment><AUTHOR> If you own & use a smart device (fitness or activity tracker, smartwatch, smart scale, glucometer, blood pressure monitor etc) we'd appreciate your input and feedback regarding your gadget(s).</comment>


What Pair-Programing is Not - <AUTHOR> http://misko.hevery.com/2009/06/12/what-pair-programing-is-not/

<comment><USER2> Misko says that the productivity hit of pair programming in minimal because most programmers program only 10-25% of the time; the rest is spent reading email, going to meetings, and the like. Huh? I thought we flattened the management hierarchy and instituted agile programming to get rid of that nonsense.

He gives an extended example where pair programming enabled a new hire to configure his work environment in a half day (plus Misko's half day). I have found that a well documented setup procedure enables a new hire to set up his environment in half a day without involving a senior programmer. The second example of walking the new programmer through his first bug fix seems quite reasonable, but that is not pair programming in the large.

The comments seemed to be divided into two groups: those who were doing pair programming and loved it and those who were skeptical but were not pair programming. I admit I am in the second group. I would be interested in the experience of HNers.

<comment><USER3> That probably wouldn't work for me. I learn better by reading (good documentation; failing that, code) than by listening. Conversation can be erroneous, but code (even bad code) never lies. I think optimal learning methods differ from person to person.

<comment><USER4> But code isn't setting you up, human-written documentation (or, in the case of the article, humans) are.

</comment></comment></comment><comment><USER5> "Even when you are coding, you spend a lot of time testing what you have just coded, and realizing what you have just done does not work."

This is not my case. Over years I developed a habit to write correct code at (almost) first attempt. Am I qualified for pair programming?

</comment><comment><USER6> I think the article side steps the value in learning something well by doing it yourself (in the case of the new hire). I appreciate the confidence gained by pair programming and hand holding. But oftentimes even though they were able to be productive with a senior team member, that does not translate to having confidence or being productive when alone. Depending on how the pair worked together, the new team member could have blindly nodded their head. They'll still need to take the additional time to relearn or do it again themselves. In that case, I'd rather pair program to get them ramped up, work on something by themselves, then come back later to review what they've done without side stepping the value in self learning and exploration, which enables them to take ownership of the idea/methodology. Perhaps they'll even have a new approach which is healthy for the team at large.

<comment><USER7> When pairing, my recommended approach is to switch who is driving for every new test or method being written (sometimes called 'ping-ponging'). I can attest that, done correctly, this is extremely valuable when learning an unfamiliar technology. As a newb, you get to watch how the experienced developer does it, then it's turned right around and you have to do it yourself.

You can tear through some code pretty damn fast, and it is an awesome way to learn.

</comment></comment><comment><USER8> Thats a great article! I'm lucky enough to learned programming long years ago in a similar environment. Since then I've tried that in different companies but working culture or ego stopped these efforts at most of the time. After longs years I've found my perfect pair again just to loose him soon after as he moved to the other part of the world.

What is your experience with pair programming?

<comment><USER9> I spent two full days with my (soon to be) girlfriend writing Scheme for a college assignment using two keyboards and mice on a big desk.

It was awesome and not only because of the sparks.

Her ideas worked, but were complex. I typed faster, but my solutions were incomplete.

So we attacked the problem from two sides and it had to surrender.

The code that emerged was beautiful, clean and bug free.

I'm still trying to get her to code with me again :)</comment></comment>


Backyard Chickens Carry a Hidden Risk: Salmonella - <AUTHOR> https://www.nytimes.com/2017/09/04/health/backyard-chickens-carry-a-hidden-risk-salmonella.html <comment><USER2> The headline reminds me a little of Troy McLure's educational film "Firecrackers: the Silent Killer".

Which is my roundabout way of saying that anyone considering backyard chickens _really ought to_ know about salmonella already.</comment>


Qusim.py – A toy multi-qubit quantum computer simulator written in Python - <AUTHOR> https://github.com/adamisntdead/QuSimPy <comment><USER2> For the uninitiated - to simulate a basic quantum computer, all you need is the following:

* A product state vector, which is a vector of size 2^n filled with complex numbers where n is the number of qbits you're using. You derive the product state from a series of individual qbits by taking their tensor product; this exponential term is why simulating quantum computers takes exponential space.

* A set of common quantum logic gates, which are (2^n)x(2^n) matrices you multiply against the product state vector to derive the new product state vector; these matrices must be _unitary_ (their conjugate-transpose is their inverse) (edited, see [0]) and therefore reversible (quantum computers are reversible computers). The full (2^n)x(2^n) matrices are derived by taking the tensor products of several 2x2 and 4x4 matrices.

* The measurement logic, where you calculate how the product state collapses by taking the square of the absolute value of each entry in the product state (these entries are called amplitudes).

This project is an implementation of those three things in Python. There is nothing special about the above mathematical constructs save that they match the observed semantics of a quantum system. This is good! Quantum computing is accessible to anyone who has taken a basic undergraduate course in linear algebra.

[0] I previously believed all quantum operators were their own inverses (Unitary and Hermitian) but apparently that is not the case; see comments below.

<comment><USER3> Thanks for the description but that made very little sense to a 'regular' developer like me. Any chance you could break it down and bring it down to my level?

<comment><USER2> I recommend the textbook Quantum Computing for Computer Scientists.

<comment><AUTHOR> I would also have to recommend "Quantum Mechanics, The Theoretical Minimum" by Leonard Susskind, if you wish to go a little bit further into general quantum mechanics

</comment></comment></comment></comment><comment> da-bacon Cool! My April fools day joke this year was a quantum programming language made up entirely of "entanglement" and "superposition": [https://github.com/dabacon/qsel](https://github.com/dabacon/qsel) The simulator takes about 150 lines of python as well.

<comment><USER4> Hey Dave, your lecture notes [0] helped us a lot when we were building our simulator [1]. Thank you!

[0]: [https://courses.cs.washington.edu/courses/cse599d/06wi/](https://courses.cs.washington.edu/courses/cse599d/06wi/)

[1]: [https://github.com/QCHackers/qchackers/tree/master/software/...](https://github.com/QCHackers/qchackers/tree/master/software/kite/qvm)

<comment> da-bacon That class was so many careers ago. Glad you enjoyed the notes. I wonder if I taught it today: maybe I'd start by having students use a simulator, or maybe trying to write a simple simulator themselves!

</comment></comment></comment><comment><USER5> There is this quote by Jürgen Schmidhuber, director at the Swiss AI Lab IDSIA , creator of LSTM Neural Nets that power many of our current machine learning applications.

" General purpose quantum computation won't work (my prediction of 15 years ago is still standing). Related: The universe is deterministic, and the most efficient program that computes its entire history is short and fast, which means there is little room for true randomness, which is very expensive to compute. What looks random must be pseudorandom, like the decimal expansion of Pi, which is computable by a short program. Many physicists disagree, but Einstein was right: no dice. There is no physical evidence to the contrary randomness.html[[http://people.idsia.ch/~juergen/randomness.html](http://people.idsia.ch/~juergen/randomness.html)].

For example, Bell's theorem does not contradict this. And any efficient search in program space for the solution to a sufficiently complex problem will create many deterministic universes like ours as a by-product. Think about this. More here computeruniverse.html [[http://people.idsia.ch/~juergen/computeruniverse.html](http://people.idsia.ch/~juergen/computeruniverse.html)] and here.

"

I am out of depth with regards to quantum theory and quantum computation. If anyone with better knowledge with regards to quantum computation can clarify it would be great.

Is there any rationale to support Schmidhuber's argument, and has any advance in making actual quantum computers disprove his theory?

<comment><USER6> Hint: "There is no physical evidence to the contrary" isn't really a proof.

<comment><USER7> You are getting down-voted because you are shifting the burden of proof.

<comment><USER6> It wasn't me that was shifting the burden of proof!

It was the original quote from Schmidhuber, claiming as if it were a known fact "The universe is deterministic, and the most efficient program that computes its entire history is short and fast", backed by the (arguable) argument "There is no physical evidence to the contrary."

</comment></comment></comment></comment><comment><USER8> Is it possible that a massive array of GPUs might be more economical than a few real quantum chips that need to be cooled to absolute zero?

<comment><USER9> That depends on the number of qbits you want to simulate. Doing the calculations on classical computers has an exponential slowdown as you need 2^n classical bits to store n qbits. It's pretty unlikely that you will ever be able to simulate a quantum computer with more than a few dozen qbits.

<comment><USER10> Indeed. I'd expect this to top of at about 64 qbits with smart maths. (Mostly due to pointer limitations.) You could try to extend addressing but it'll be even slower...

<comment><USER11> Just as a data point: Current state-of-the-art methods for Lanczos-type methods on state vectors are around 40 spins/qubits incorporating many symmetries and additional shortcuts one does not have in a generic "quantum computer simulator". Without those symmetries/shortcuts, the limit is likely closer to 30 qubits (i.e. approx. 16-64 GB per state vector), as it's not only necessary to store these beasts but also do operations on them.

If you don't insist on a single dense state vector but a sparser tensor network-based formulation, you can go to much larger systems (hundreds or thousands of spins) but will be limited by the amount of entanglement you can represent in your system.

</comment></comment></comment></comment><comment><USER12> If you're interested in quantum tech, here is my newsletter [https://medium.com/quantum-tech](https://medium.com/quantum-tech)

You can subscribe here [http://eepurl.com/c10FJz](http://eepurl.com/c10FJz)</comment>


An Adaptive Replacement Cache Written in Go - <AUTHOR> https://github.com/alexanderGugel/arc <comment><USER2> ARC (adaptive replacement cache) is the best generic caching strategy I know of, but the patent status is problematic.

[https://en.wikipedia.org/wiki/Adaptive_replacement_cache](https://en.wikipedia.org/wiki/Adaptive_replacement_cache)

      In 2006, IBM was granted a patent for the adaptive replacement cache policy.

[http://patft1.uspto.gov/netacgi/nph- Parser?Sect1=PTO1&Sect2=...](http://patft1.uspto.gov/netacgi/nph- Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.htm&r=1&f=G&l=50&s1=6996676.PN.&OS=PN/6996676&RS=PN/6996676)

IBM's patent will take quite a while to expire. It's truly a shame this can't be used by operating system page cache policy because of patents.

<comment><USER3> Holy crap, _that 's_ the reason this algorithm isn't all over the place? That seriously irks me, and this one seems like a great patent to look for either Tesla-esque giveaway or just invalidation (EFF, anybody?).

Smart generic caching could do _so_ much for the global infrastructure with all the data we move around these days.

</comment></comment><comment><USER4> Had implemented this for a grad school project long time back. We had compared the complexity and effectives of this algorithm and compared it with lru, by the end the results of both were comparable unless in certain special conditions arc works well, whereas lru fails like a virus scan etc. But the simplicity of lru triumphs. For anyone interested, here's a paper which was an assigned reading for the project - [http://www.cs.cmu.edu/~15-440/READINGS/megiddo- computer2004....](http://www.cs.cmu.edu/~15-440/READINGS/megiddo- computer2004.pdf)

(Outperforming LRU with an Adaptive Replacement Cache Algorithm)</comment>


Experts less likely to create disruption - <AUTHOR> http://www.inc.com/naveen-jain/why-non-experts-are-better-at-disruptive-innovation.html

<comment><AUTHOR> The post, well written by Naveen Jain, is arguing a 'fresh eyes' theory, and while it's wonderfully optimistic, I can't help but think it's somewhat naive.

Instead of attacking his position, however, I think it just needs a slight correction.

Innovation and disruption comes from people aggressively seeking innovation and disruption, regardless of their expertise. An innovator's expertise in their field can be a crucial part of iterating through possible solutions, previously failed attempts, and innovations in the pipeline. Imagine if Edison, while doggedly pursuing the light bulb filament, hadn't had his knowledge of current, metals, and energy.

Innovation is completely tied to a mentality of change, which I'll agree can exist in anyone. Innovators can quickly learn that their capabilities aren't up to the task and enlist experts to aid the project, or finance an initiative, and even have the 'fresh eyes' that help to find a better solution.

That being said, however, as we all preach time and again, it is in the execution, not the concept, that a true disruption will be judged, and for that, you need experts.

<comment><AUTHOR> Disclaimer, I'm a lay person (marketing/business) with a tech company aiming for disruption, however, the market we're disrupting is one I have deep expertise in. I was smart/lucky enough to partner up with an expert on the tech side to ensure the execution will keep up with the innovation.</comment></comment>


Rocket and App Container 0.2.0 Release - <AUTHOR> https://coreos.com/blog/rocket-and-appc-0.2.0/ <comment><USER2> Very exciting to see multiple App Container Spec implementations showing up this quickly!

> This last week has also seen the emergence of two different implementations > of the spec: jetpack (a FreeBSD/Jails-based executor) and libappc (a C++ > library for working with app containers). The authors of both projects have > provided extremely helpful feedback and pull requests to the spec, and it is > great to see these early implementations develop!

I think this is really telling of a great (and necessary) thing. Standardizing a container specification was long overdue; a standard and portable app container spec will really propel containerization to the next level.

</comment><comment><USER3> "we've taken care to implement these lifecycle-related subcommands without introducing additional daemons or databases" oh I love you rocket. I mean, I'd be scared to implement that myself (FS based concurrency control always seems hellish), but I guess that's the joy of ACI; I can just use another implementation if you scare me too much.

Reading the signing and verification stuff, the section on "Distributing Images via Meta Discovery" reminded me of my personal dream: bittorrent based distribution. How hard would this be? Seeing as the ACI tarballs seem to be just stored on disk, would it simply be a case of telling my bittorrent client to dump all my ACIs in some folder and then getting rocket to look there? Or is there a need to write some kind of rocket plugin for that kind of thing?

<comment><USER4> Bitorrent was mentioned in the original blog post as a nice to have feature in the future:

> Image distribution. Discovery of container images should be simple and > facilitate a federated namespace, and distributed retrieval. This opens the > possibility of alternative protocols, such as BitTorrent, and deployments to > private environments without the requirement of a registry.

There is an open issue if you want to help out or follow along: [https://github.com/coreos/rocket/issues/405](https://github.com/coreos/rocket/issues/405)

<comment><USER3> Subscribed, though I was thinking of it rather more generically: how hard would it be to have some service that magically puts images in the correct place, and have rocket look there? The idea of rocket having a bittorrent client on board rather scares me :)

<comment><USER5> There are certainly a few ways this could work; for example, since Rocket currently uses a generic CAS backend to store assets, and is designed to expect multiple simultaneous invocations (using filesystem locking etc), it's feasible for an external service to be pulling down images out of band that Rocket could then consume.

</comment></comment></comment></comment><comment><USER6> We just published a conversation with Alex Polvi (CoreOS CEO) all about Rocket and the App Container Spec. Check it out if you want to hear more:

[http://thechangelog.com/138](http://thechangelog.com/138)

</comment><comment><USER7> Another announcement about containers went largely unnoticed: Ubuntu released Ubuntu Core, a Ubuntu variant optimized for cloud and IoT security. But the documentation and developer adoption seems to be behind CoreOs currently.

I haven't done anything with CoreOs yet, but from my personal feeling I'd prefer Ubuntu over something that is based on Gentoo. I may be completely wrong on this though.

<comment><USER8> I also not a guru but I've been locking on Ubuntu Core and it seems even more simplistic than Core OS. The great thing on Core OS is the etcd (for exchanging key values across clusters) and fleet (for managing e.g. containers on systemd and etcd). So Core OS has better management tools for things like Docker. Ubuntu Core is missing both parts and it seems better for embedded systems than for cluster management IMHO. And many people are using Ubuntu INSIDE the container. CoreOS is a good minimal layer... no need to have Ubuntu there... also Ubuntu Core does not have tools like apt-get ;)

</comment></comment><comment><USER9> Here's the open specification for Docker's standard format: [https://github.com/docker/docker/blob/master/image/spec/v1.m...](https://github.com/docker/docker/blob/master/image/spec/v1.md)

<comment><USER2> Curious why you think it's OK to try stealing the thunder of CoreOS' announcement?

Based on me and your previous encounters, I'd wager you would flip your lid if they did the same to you.

The Docker "standard" format was brewed up overnight immediately following the App Container Specification announcement and has had only spelling fixes since then. I'm not aware of any other implementations of the Docker format other than Docker itself.

<comment><USER9> My understanding is that Docker's lack of an open specification was advertised as a primary motivation for rocket. So it seemed relevant to point out efforts by Docker to provide such a specification.

The reason the specification document isn't moving very fast is simply that it's stable and already deployed at large scale, via Docker's implementation.

<comment><USER2> > The reason the specification document isn't moving very fast is simply that > it's stable

Say's who? To my knowledge, nobody has attempted to build a container platform using the docker spec. For all anyone knows, there's large gaping logic holes needing to be filled. It's simply untested and unproven.

> and already deployed at large scale, via Docker's implementation.

I think you mean to say "Docker is deployed", because again, nobody has tried to implement the docker spec as-of yet.

The docker team spent so long actively avoiding introducing any sort of standardized container specification out of fear someone would come along and eat docker's lunch, that it's hard to believe miraculously overnight you were able to develop a rock-solid specification that clearly addresses all scenarios and is extensible for any 3rd party to implement cleanly.

The docker spec technically has zero implementations, since it was only created (overnight) as an afterthought after your "implementation" was already completed. If anything, the docker spec is an (untested) implementation of docker.

As-of today, the App Container Specification has 3 times more implementations than the docker spec, has far greater adoption, has been refined more significantly over multiple iterations, and has accepted far more community input into it's development.

Let's be genuine here shykes. Your purpose in this thread is to get people talking about docker and cast some shade on the CoreOS team. The very thing you got so upset about when they first announced Rocket and the App Container Specification.

<comment><USER9> I'm not sure what to reply in the face of so much bile. Hacker News used to be the home of people who built cool stuff and wanted to show it to each other. Now it's the home of people like you. Docker and CoreOS might be competitors, and we might disagree on many things (ethics in particular), but at least we're both building things and sharing them with others. That's our contribution to this community. What's yours?

<comment><USER2> > Docker and CoreOS might be competitors, and we might disagree on many things > (ethics in particular)

I can't believe you, the founder and creator of Docker and Dotcloud, just called the CoreOS team unethical.

<comment><USER10> Strictly, shykes didn't call the CoreOS team unethical. It might be implied, but he did not "just [call]" them that.</comment></comment></comment></comment></comment></comment></comment>


Audible.com sneaky and suspicious billing tactics - <AUTHOR> https://www.youtube.com/watch?v=w-0AKHwfLyc <comment><USER2> Dark patterns - I got signed up for audible, they never send you anything as long as your credit card charges keep going through, getting a refund required a lot of screaming and cursing.</comment>