Facebook developing AI to flag offensive live videos - <AUTHOR> http://www.reuters.com/article/us-facebook-ai-video-idUSKBN13Q52M <comment><USER2> First thing that comes to mind is that live video that poor lady filmed while her boyfriend was sitting in the car next to her being shot by police. It was a very important piece of news. How will Facebook or AI prevent flagging that video?

> "These are questions that go way beyond whether we can develop AI," said > LeCun (FB's director of AI research). "Tradeoffs that I'm not well placed to > determine."

I don't want to be alarmist, but this this is symptomatic of something that's a little bit terrifying. This reminds me of essays I've read about the development of nuclear weapons. Lots of the people who developed those things said things like "Oh, I'm just the guy who built the bomb, I'm not well-placed to determine whether or not it gets used".

I can't directly say that this sort of attitude is going to directly lead to rogue AI wiping out humanity, but you have to be able to see how this sort of thing is a little worrying.

A quote comes to mind:

""The nation that will insist on drawing a broad line of demarcation between the fighting man and the thinking man is liable to find its fighting done by fools and its thinking done by cowards."

When you draw a demarcation between the people developing AI and the people deciding on the trade-offs...?

I'm usually idealistic and hopeful (I think), but I thought this needed to be said.

<comment><USER3> > _" The nation that will insist on drawing a broad line of demarcation > between the fighting man and the thinking man is liable to find its fighting > done by fools and its thinking done by cowards."_

Off-topic, but makes me think of the broad line of demarcation between developers and those talking to customers/end users, practiced by so many companies...

<comment><USER2> It's totally on-topic. It's a planning/execution gap.

<comment><USER4> He's not wrong about it being off-topic. He's wrong about trying to put something kinda like it in the same conversation. It's typical. We get it all the time here.

</comment></comment></comment></comment><comment><USER5> It's like something out of the hitchhiker's guide.

A group of talented, well compensated engineers are developing a machine to be offended on my behalf. Hopefully it will also generate a sternly worded letter for the offender.

Yesterday's science fiction is today's technology. I just didn't imagine that particular book being such rich fodder for realization.

<comment><USER2> > A group of talented, well compensated engineers are developing a machine to > be offended on my behalf

and their leader openly states that he isn't well-placed to make the necessary trade-offs

</comment></comment><comment><USER6> Why can't I just stop watching something I find offensive, at most flagging it for later review (to determine if it is actively dangerous in some way) rather than living in a world where some stupidly biased "intelligence" (whether human or artificial) gets to determine what is "offensive"? Facebook already is a massive filter bubble, where my own biases bias who I allow as friends: isn't that enough to ensure that I effectively only see content I find reasonable?

I mean, really: I do _not_ find nudity offensive, and nor do _most_ of the people I know (I would say " _any_ ", but maybe someone is just keeping quiet). I _definitely_ never found breast feeding offensive, and would even say I find the notion that Facebook had previously been removing such content and calling it offensive itself extremely offensive (and it isn't clear to me that they have truly stopped, though their official policy is now to accept it).

Are they really going to take the time to correctly retrain all their algorithms to deal with policy shifts? Is it even correct to try to do this "live" given that context later in the video might change peoples' ideas about what the content was showing, where what looked like exhibitionism turns out to be a political protest? The difference between a live "unedited" news broadcast (as is being increasingly done: the local TV station and newspaper where I live have been using Facebook live streaming) and an opinion segment or narrative is also subtle: will it flag and block live footage of a riot as "violence"? What happens when the algorithm says "President Trump's State of the Union is hate speech"? Will they be proudly letting it stop the stream?

Gah.

<comment><USER7> And so freedom of expression slowly gets chopped away piece by piece with "the best intentions". If freedom of expression weren't "offensive", at least to some people, it wouldn't need to be protected in the first place. And, whoever decides what can or can't be said at FB doesn't make that decision based on a democratic process.

<comment><USER8> In a certain sense, our freedom of expression is intrinsically chopped away by reliance on private platforms with no democratic control and no authentication of content.

</comment></comment></comment><comment><USER9> From the article:

"Facebook said it also uses automation to process the tens of millions of reports it gets each week, to recognize duplicate reports and route the flagged content to reviewers with the appropriate subject matter expertise."

Everyone who is slightly or highly annoyed by FB's policies surrounding how hard it is to leave their ecosystem should take note. They already get millions of reports each week. So just go around randomly flagging all kinds of harmless videos. I bet in short order you will get banned from their site.

Once that happens, then tell your friends FB banned you for no good reason... IMHO it is the best possible answer to "What? How can you not be on Facebook? Are you crazy?"

<comment><USER10> Why be dishonest to your friends, though? Besides, seeing how rare it is for someone to be banned from FB for no good reason, I don't think most people will believe you; they'll think you did something bad, which you did by flagging harmless videos, but they might even imagine that what you did to get banned was much worse.

If you don't like FB and don't want to be there anymore, I suggest instead removing most things you have on your profile and writing a post explaining that you want to remain in touch with your friends so you are keeping your profile in order to still be reachable but that you won't be as active on FB as you used to any longer because you've come to realize that you don't want FB to have all this data about you (or if your reason is different then write that instead). Just keep the motivation really short so that people see that you have a reason but they don't feel that you are bombarding them with a long argument that they can not relate to.

<comment><USER9> >> Just keep the motivation really short so that people see that you have a reason but they don't feel that you are bombarding them with a long argument that they can not relate to.

OK, I will definitely keep it in mind because I do have a tendency to waste other people's time. While I am at it, I will also send a personal note to Mark Z expressing my profound sorrow that I am not dedicating more of my life to FB's mission to connect people. Since I am not cheap, I will also attach a $20 bill to the note to compensate for his loss.

</comment></comment></comment><comment><USER11> Here's an algorithm in python that detects if a video (or image) is offensive to anybody:

        def is_offensive(content):
            return True

<comment><USER12> the shell version is much more concise:

</comment></comment><comment><USER13> Did anyone else watch the Bloomberg video posted yesterday about technology in Russia[0]? On how VK (Russia's Facebook) has had its CEO replaced twice (once directly, second time by removing its new owner, mail.ru's CEO) due to political pressure and censorship.

It seems to me this is entirely something to be concerned about when it comes to censorship and state controlled media. This is very much to appease the likes of China and Russia, it will also benefit places such as the USA where Facebook doesn't want to make those in control look bad (police, elected officials, oligarchs, autocrats etc). It's bad for business to be against the rulers, and Facebook has to contend with a lot of different rulers if it want to expand throughout the world. A benign, bland shade of beige that everyone buys into and is inoffensive, is more likely to be appreciated by rulers and advertisers—just look at network television.

[0] [https://www.bloomberg.com/features/2016-hello-world- russia/?...](https://www.bloomberg.com/features/2016-hello-world- russia/?cmpid=BBD113016_BIZ)

<comment><USER14> The cynic in me sees this as a way to appease many of the dictatorships in the developing world FB operates in as a defacto telecom by offering free-wifi through Internet.org type shenanigans for only FB apps.

These regimes would love FB to offer ways to shut down a live feed being passed around of a political disaster being broadcasted by local journalists using FB live, like all those Periscope riot broadcasts in the US. FB can then avoid the responsibility and bad PR of disabling it and just let their bot kill it instead.

</comment></comment><comment><USER15> I wonder how many ethicists FB has on staff, and how they feel about the ethics of getting paid to tell the decision makers what would keep them awake at night if they were the sort of people who lost sleep over such things.

</comment><comment><USER16> Solution: Stop using Facebook

<comment><USER17> This is at the bottom of the thread right now so I'm going to assume people don't agree with this. However, you're completely right, by continuing to use Facebook you validate their platform and keep feeding them your data. The solution is to seek alternative platforms that respect your freedoms or to abstain from social networks. (<smug>personally I find them to only suffice for navel-gazing and status signaling</smug>) I understand that due to network effects it will be really difficult to make friends follow you elsewhere or to find others, but the alternative is continuing to let Facebook dictate what you see and feel. For many people, Facebook is "the real world": it's how they get all their news and find out what's going on with people. We shouldn't underestimate the power Facebook holds to affect people and the importance of considering not participating.

<comment><USER8> There are three things I want from an alternative:

1) Decentralized, preferably democratic-by-the-users, control. No centralized server where everything is kept in plaintext.

2) Privacy. I share what I want, and only that. People with whom I don't connect don't know I exist.

3) Authentication. My online identity is unique to something about me that exists in meatspace. Whom I connect with can be restricted to people I know in meatspace. Note that this is the opposite of our normal standard of anonymity: 4chan can be as anonymous as it likes, but a social network for groups of friends ought to prevent anonymous trolls or ads from flooding into my feed.

Basically, I want a social network on which I own and control my own info, and on which I keep my IRL identity strictly separated from, for instance, the anime avatar I pretended to be on various bulletin boards.

Do any existing alternative social networks meet these criteria?

</comment></comment></comment><comment><USER18> Facebook is rapidly turning into a censorship tool.

<comment><USER19> It's also turning into one of the most boring things on the Internet, I would say all that's keeping it alive is chat.

</comment></comment><comment><USER20> For those who don't have the time / capacity to develop this internally, and who feel they need to moderate visual content, we have a SaaS offering. We flag offensive images and videos (including live-streams in private beta) using Deep Learning.

We are Sightengine ([https://sightengine.com](https://sightengine.com))</comment>


What is the performance impact of using int64_t on 32-bit systems? - <AUTHOR> http://stackoverflow.com/questions/16841382/what-is-the-performance-impact-of-using-int64-t-instead-of-int32-t-on-32-bit-sys <comment><USER2> When the discussion was ongoing about what the 'native' length for an int should be in Java the group did some profiling on machines to compare 32 bit, 64 bit on 32 bit, and 64 bit native, and 32 bit on 64 bit performance. Generally 32 bit on native or 64 bit platforms was pretty much the same. Emulated 64 bit (where the compiler had to generate extra code to do the math operations) was about .1% slower. (yes one tenth of one percent). In investigating it the dominant factor in program execution was not instructions per second but fetch time from DRAM into the cache. All of the math operations fit in the cache and so executed at full clock rate. As the typical CPU at the time was 1Ghz with an execution efficency of 1.2 to 1.5 IPC, during the 110ns where the CPU was waiting for the next bit of data from the RAM to get into the cache it could execute 60-80 instructions. So generally the "extra" instructions were essentially free for the most part. So Java got 64 bit integers regardless of the underlying processor architecture.

Footnote: I have mis-remembered the system performance numbers, the SS10 was a 50Mhz machine. The R4000 (native 64 bit machine was only 100Mhz. That said, the CPU being 'starved' while it waited for the cache to fill was the proximate analysis of why the performance differed very little.

<comment><USER3> Java has both int (32 bit) and long (64 bit) types. What did you refer to as 'native'?

Lucene, the popular core search library, has always used int as internal document IDs. As a result, the number of documents in one Lucene index is limited to 2 billions (Java int are signed). It's even worse if there are many deleted docs in the index as they are are just marked as deleted and consume up IDs. There are a number of reasons why no one is keen on moving internal docIDs to long, and performance is one of them.

<comment><USER2> Wow, and thanks for that. You are absolutely correct that Java exported all of the various integer sizes. Odd that I can clearly remember the debate and mis- remember the final outcome. Bill Joy was pretty adamant about "fixing" the various sizes of integers problem that C had been going through on x86 with the whole sizeof(int) != sizeof(ptr) code and we benchmarked it and it did not affect performance hardly at all. Wow it sucks getting old.

</comment></comment></comment><comment><USER4> Something not mentioned there is locking. For the specific use case (timestamps) that the OP wants, it might not be important, but for many common use cases, like 64 bit counters, you can suddenly hit consistency problems in programs. I think that older x86 processors couldn't atomically write 64 bit numbers, so you might have to add locks around all the accesses. This could be a huge performance hit.

ISTR this was a problem for Linux kernels? There used to be several kernel counters that were stuck at 32 bits because the overhead of making them 64 bits was just too much. I think one example was network byte counters for NICs? I might be misremembering this, though.

<comment><USER5> The x86 instruction for this would be LOCK CMPXCHG8B and would allow atomically writing 64 bits. (The x64 version would be LOCK CMPXCHG16B for writing 128 bits.) Instruction goes back a while, there was a bug on pentium [https://en.wikipedia.org/wiki/Pentium_F00F_bug](https://en.wikipedia.org/wiki/Pentium_F00F_bug)

<comment><USER6> Yep, but first you have to load this counter and increment it manually in some CPU register. And you also need to repeat the whole sequence in case CMPXCHG8B fails.

With 32 bit integers you just execute XADD and move on with your life.

</comment></comment></comment><comment><USER7> > [Using 64-bit registers in 32-bit mode] is not possible. If the system is in > 32-bit mode, it will act as a 32-bit system, the extra 32-bits of the > registers is completely invisible, just as it would be if the system was > actually a "true 32-bit system".

That's not entirely true. Under Linux, with the x32 ABI (see [https://lwn.net/Articles/456731/](https://lwn.net/Articles/456731/)) you have access to the entire register file, but still use 32-bit pointers.

In many ways, it combines the advantages of 32- and 64-bit mode code.

<comment><USER8> As addressed in the comments on SO[1], x32 mode is actually still long mode. It's just a change in ABI to use the upper and lower 2GB of address space so that you can fit pointers in 32bits. It doesn't really act like a 32bit system because it isn't it's a 64bit system with a restricted address space.

That said it can be useful for certain loads where you aren't consuming large amounts of memory but are doing lots of calculations.

[1] [http://stackoverflow.com/questions/16841382/what-is-the- perf...](http://stackoverflow.com/questions/16841382/what-is-the-performance- impact-of-using-int64-t-instead-of-int32-t-on-32-bit- sys#comment24292419_16841814)

<comment><USER4> x32 mode can be a huge win if your data structures contain lots of pointers/references. It can shrink the memory usage and speed up computation by surprising amounts (compared to running the same process in a 'full' 64 bit mode). It's not just for when you are writing your own intricate code, either. An x32 build of perl sped up some of my programs dramatically, and let me run stuff on a 4GB machine that previously couldn't fit the data in.

Ubuntu has some x32 packages available for their standard 64 bit distribution, but the selection is limited.

<comment><USER6> Did you compare x32 versus the old fashioned i386?

<comment><USER4> Nope, other stuff on the machine needed 64 bits so unfortunately it would be difficult to do the comparison.

In _theory_ , x32 should still be faster because the code gets to use all the other x64 features, like a larger register set and so on. I've no idea how big a difference that actually would make though.

<comment><USER6> You can run 32 bit binaries on 64 bit system. I bet Ubuntu has several 32 bit packages available because they are needed by Wine and and closed-source 32 bit binaries.

The theoretical possibility for speedup is exactly why I asked. The x32 website has benchmarks where it's as fast as i386 and 40% faster than amd64 on pointers or as fast as amd64 and 40% faster than i386 on 64 bit math, but what's missing to really justify x32 is some "20% better than either" case.

<comment><USER4> Sorry, I see what you mean now! For some reason, I completely forgot about running a plain 32 bit version... sorry but I don't have the chance to easily run the code again right now and compare.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I seem to remember Agner Fog mentioning that the `adc` x86 instruction (add with carry) was considerably slower on many CPUs than `add` (regular addition) because it essentially had 3 dependencies (2 operand registers and carry flag), and had to be decomposed into 2 instructions with 2 inputs each for register renaming purposes. Adding 2 64-bit values on x86 is an `add` followed by a dependent `adc`, so that's considerably worse than 2 regular, independent 32-bit additions.

<comment><USER10> IIRC that limitation was lifted in haswell (the then new fused multiply-add would also otherwise be pointlessly inefficient), though I have no idea about how or whether that affects things like adc.

<comment><USER11> In the case of the carry flag it was only lifted in Broadwell, which also introduced ADCX and ADOX to let you perform two carry chains concurrently. Conditional moves were also improved; you can do 2 per cycle now.

</comment></comment></comment><comment><USER12> The original question was in the context of storing times, and that makes me wonder: how many freaking operations are you doing on time stamps that you even care about this?

<comment><USER13> Original poster from SO here: there are some components that are doing schedule calculations, so in some parts there are quite a lot of time-related calculations, and performance can be important in these parts.

Also, I see now that the sentence "Our C++ library currently uses time_t for storing time values" might have been misleading; by "storing" I meant "keeping in RAM and registers, for calculations" rather than "keeping in non-volatile memory, for archival".

</comment></comment><comment><USER14> Where would one encounter a 32-bit system today?

<comment><USER15> You probably have one in your pocket.

Most ARM chips are 32bit, so most phones are 32bit. There is little reason for mobile chips to be 64bit.</comment></comment>


Ask HN: I want to have a basic familiarity with C, shoudl I read K&R? - <AUTHOR> I don't plan (at this time) to use C professionally, but I do feel like understanding C well would benefit me professionally (I mostly do Typescript/JS)<p>I've been trying to settle on a good text to get a "good enough" understanding of C but many of them are much longer than I am motivated to invest in at this time, while K&R is very succinct/short. <comment><USER2> I like K&R but it's so incredibly dated that it would be like reading the HTML 2.0 spec (from '95) to understand web frontend development today. Wouldn't recommend it.

<comment><AUTHOR> Thanks for the feedback! Any more brief texts that you recommend?

<comment><USER2> The common suggestion seems to be Gustedt's "Modern C" ([https://modernc.gforge.inria.fr/](https://modernc.gforge.inria.fr/)) which is available in print but has a free ebook version. Just stop at the end of chapter 14 and it's probably around the same length as K&R. It's a bit heavy- handed on the prescriptiveness for my taste but decent material.

<comment><AUTHOR> Great, thank you!</comment></comment></comment></comment>


Ask PG/HN: Apply to YC no-idea? - <AUTHOR>

We are a team of two applying to the S12 batch. We have had early success with a web application. We won a major venture competition, got accepted into a couple of high profile incubators (though we didn't enter for various reasons) and managed to get a bunch of users signed up. We have nailed the cool factor of our service, however not the habit forming requirement to make it a huge success. We are considering doing a pivot on our app or abandoning it all together. We have four other projects cued up with varying levels of progress that we believe users will adopt. We just need to validate them.
As a team, we work very well together, can execute and believe we are relatively smart (and modest). We believe the spirit of the no-idea application is to find incredible teams. However, we are concerned that the truncated application doesn't sufficiently allow enough space to articulate the progress we have made on past and current projects.
YC states, "A lot of the startups we accept change their ideas completely, and some of those do really well." We may be at this point right now.
Any thoughts on if we should apply via the no-idea application? Is it a catch all for not only people who have "no-idea" but also if you have an idea you are close to pivoting on/abandoning or if you have several valid ideas? We have both applications ready just in case. <comment><USER2> In the FAQ it says if you wish to apply with multiple ideas use one of the other founders accounts. Maybe you should apply as 'no idea' with one founder and with your idea with another founder. Hopefully PG can clarify if this sounds reasonable.</comment>


Don't Name Classes After Patterns. Mostly - <AUTHOR> https://sender.cloudy.email/campaigns/paxjhchaiasjoifsiw/webversion/jdnapfbdgjegdqmdeduwc <comment><USER2> > The problem with including the name of a pattern in the name of a class is > that this permits you the feeling of having created a useful name without > actually having done so. Pattern names don't generally reflect concepts in > your application

I thoroughly disagree. In my experience, the domain of the app doesn't really matter when you're trying to make sense of the architecture of a software to fix that bug you were commissioned for, especially when you had never heard of that software two days ago and you'll never hear of it again in two days.

On the other hand, having a way to very quickly know which class does what in a software sense (through the patterns in the name) allows to make a rough diagram of the software in 5/10 minutes just by looking at the class list which is to me crucial to get an understanding of whatever mess is happening in there

</comment><comment><USER3> > I mean, if I see a class named ReportVisitor, I immediately know what the > author's intent was, and what the structure of the code is.

[https://blog.cleancoder.com/uncle- bob/2015/07/05/PatternPush...](https://blog.cleancoder.com/uncle- bob/2015/07/05/PatternPushers.html)

</comment><comment><USER4> I generally agree with the rule and the reasoning given for it. But I think the worry about the "Fake" suffix here is missing a crucial point.

This is test code. In test code, the "business" at hand is exercising the production code. To put it another way, test code doesn't have the same business domain as the application code.

Therefore, in test code "Fake" _is_ a domain-specific term, and it is perfectly appropriate as part of a class name.

</comment><comment><USER5> This classic rant by Steve Yegge gets shared almost every time object oriented design pattern debates come up on HN, but I'll share it again since new members join regularly: [http://steve-yegge.blogspot.com/2006/03/execution-in- kingdom...](http://steve-yegge.blogspot.com/2006/03/execution-in-kingdom-of- nouns.html)

You may or may not agree with it, but it does frame the debate in an interesting way.

</comment><comment><USER6> I think naming should reflect whether a class encodes business logic or is 'glue' to make that work.

Nowadays, many people use languages with huge libraries. Consequently, most logic is business logic. There, name classes (and functions, and argument names) after their business use, not after their implementation.

However, parts that aren't business logic such as wrappers of external libraries or generic containers you have to implement because they aren't available in the language's ecosystem should use generic names, and can use pattern names, because those tell callers what they do.

As a made up (and not _that_ good) example, one would have

       def pow(a,b)

but

       def valueAfterNYears(initialValue, interestPerYear)

(Yes, these aren't functionally equal. That's part of why I said it wasn't that good of an example)

</comment><comment><USER7> This blog reminds me of one of the most frustrating naming patterns I see among coworkers, former students I TA'd, and open-source code: reversing the adjective or adverb with the noun. I attribute it to language barriers but seeing, in this blog, "VerseFake" instead of "FakeVerse" peeves me.

Its a VERSE class, not a FAKE class. It just so happens the class is described as a "fake" so...FakeVerse. Its like saying "Hey look a person tall!". While it sounds silly in english its incredibly pervasive in programming.

Another common pattern that drives me nuts is when people prefer nouns over strong verbs in functions. doDatabaseRestore instead of restoreDatabase.

<comment><USER8> It just makes sense, because you have the "parent class" in front and can order classes in docs etc. "AnimalLand", "AnimalWater", "AnimalAir" instead of "LandAnimal", "WaterAnimal" and "AirAnimal".

In fact I would probably prefer databaseRestore to restoreDatabase for the same reason because it would allow to cognitively group database methods in your flat namespace instead of grouping restore methods.

<comment><USER9> > _In fact I would probably prefer databaseRestore to restoreDatabase for the > same reason because it would allow to cognitively group database methods in > your flat namespace instead of grouping restore methods._

This is especially important in pure C. If OOP-style programming is adopted, databaseRestore() can be strictly interpreted as a method of the Database class without ambiguity, and its first parameter is the object the operation is applied onto. In a sense, even old C & POSIX functions such as fopen(), fclose(), fseek() can be seen as a rudimentary form of OOP. On the other hand, restoreDatabase() may perform other operations that change the state outside of the database object.

<comment><USER10> > restoreDatabase

It may do anything because it was probably written by an intern

</comment></comment></comment></comment><comment><USER11> > Good Morning/Afternoon/Evening as the case may be.

This is very inefficient. Try this instead:

> Good day.

Although once you do that, you start to recognize that the entire construction might be unnecessary in this context.

</comment><comment><USER12> First three lines of the article were so unnecessarily wordy.

For an article that is supposed to be about effective communication.</comment>


Quobyte 1.3 – Parallel Container File System with Erasure Coding - <AUTHOR> https://www.quobyte.com/blog/2016/08/12/announcing-quobyte-1-3-parallel-file-system-with-erasure-coding/ <comment><USER2> Disclaimer: I saw a presentation from these guys @ MesosCon and it is not open source or free.

Here is a link to the video for anyone wanting to learn about it: [https://www.youtube.com/watch?v=2-VRsu0tios](https://www.youtube.com/watch?v=2-VRsu0tios)

Pretty offput by this company tbh.

<comment><AUTHOR> EMC storage isn't free or Open Source, and yet people use it each and every day for mission critical infrastructure. If you are off put by Quobyte's technology, you should say why. I would note they are based in Germany.

<comment><USER2> EMC storage is established and pretty good. I find it pretty hard to see a serious competitor to glusterfs, orangefs, and cephfs (all open source) and also question how a small startup could do a filesystem better than so many much larger firms struggle at today.

<comment><USER3> CTO of Quobyte here.

I'd like to mention that we don't come out of nowhere. We are working on this since 2006, already built an (open-source) parallel file system before (XtreemFS), and have quite some background in distributed systems. I hope this helps you to put our technology in context.

You are also invited to play with our system yourself. It can be installed in an hour or so. Just send me an email (see profile) or get access via our web page.</comment></comment></comment></comment>


From Boy Geniuses to Mad Scientists: Americans and Science (2017) - <AUTHOR> https://www.collectorsweekly.com/articles/how-americans-got-so-weird-about-science/ <comment><USER2> > _You can see this phenomenon when the media goes wild for any child who > makes a significant scientific breakthrough. Onion thinks the pressure on > kids to hit on a groundbreaking discovery is not only unrealistic but also > contrary to how most advances in science happen.

"We tend to see science as this mystical beast living in the sky that, somehow, children see more clearly because they haven't been clouded," Onion says._

Does anyone really see science or children that way? Kids make the news for science because science has a reputation for being hard and children have a reputation for not being very organized or driven compared to adults.

<comment><USER3> "We tend to see science as this mystical beast living in the sky that, somehow, children see more clearly because they haven't been clouded," Onion says.

In tech you clearly see this. A lot of people believe that innovation can only come from people who are at max 30 years old because anyone with some years experience can't innovate anymore.

<comment><USER4> But if you look at great scientists/inventors, isn't it true that they are generally making their biggest discovery before the age of 30?

<comment><USER5> Isn't that the stereotype for mathematicians? Not so much about scientists and inventors, I think.

<comment><USER3> Newton and Einstein did their greatest work when pretty young. I am not sure about others.

<comment><USER6> What about Feynman or Leonardo Devinci?

Besides science and math build and progress slowly. Sometimes there's a new discovery and suddenly there's a whole explosion of progress. Think calculus or the even the computer. Which we're living in right now. But look at quantum mechanics and computing, that's been progressing for the last the century or so but it's progressing through continued and shared effort built upon previous generations work.

</comment></comment></comment></comment></comment></comment><comment><USER5> It's an interesting article, albeit somewhat incoherent. And much of it could be summarized as "America has always been fundamentally racist, sexist and borderline anti-intellectual". That's surely an exaggeration. And it's not as bad as it was some decades ago. Just maybe a little worse, just now.

But anyway, the Heinlein references remind me how much I love Joe Haldeman and John Scalzi.

<comment><USER7> > That's surely an exaggeration.

Not as much as you mught think! See: [https://en.m.wikipedia.org/wiki/Anti- intellectualism_in_Amer...](https://en.m.wikipedia.org/wiki/Anti- intellectualism_in_American_Life).

</comment></comment><comment><USER8> > While researching her American Studies master's thesis, Onion noticed that > at the turn of the 20th century, children were portrayed as having a > particular affinity for animals and the natural world in general, whether > they're catching fireflies, climbing trees, or digging in the dirt. At other > times—say, 2017—children are thought to intuitively understand very > unnatural modern technology like smartphones and laptops. "At different > times in our history, people were invested in the ideas of children as being > modern or as being anti-modern, which is a weird paradox I find > fascinating," Onion says.

It may be that the 'paradox' in our ideas of children being modern or anti- modern at different times is just due to to the fact that at the turn of the 20th century children were often playing outside, and now they are often playing with technology. I think generally when an academic misses something as obvious as that, it's because they're straining to fit the data into a probably not very good theory.

> "And then it came to me: Science is the link that connects man-made > technology and the primitive natural world." After all, scientists have to > use microscopes to view and fully understand organic cells and microbes.

I had to laugh out loud here. Someone for whom it's a revelation that science is the link between the natural world and technology is maybe not the best person to attempt making the grand characterizations put forth in the article.

> The vast social project of science is ignored in favor of celebrity > scientists mythologized as stubborn individuals—similar to cowboys on the > frontier—who strike out on their own and discover unexplored territory. We > see Thomas Edison as a relentless, pioneering entrepreneur and Albert > Einstein as an out-of-the-box thinker. Steve Jobs, Steve Wozniak, and Bill > Gates were the swaggering "pirates of Silicon Valley" who created personal > computing as we know it in their garages.

You could maybe say we _focus_ on Edison, Einstein, et al over your typical scientist—but 1) It's obvious that we would do that—we admire the greats over the regulars in every field 2) The phrasing of 'We see X as Y' is implying that the attribution of Y to X is mistaken. But in all of those cases the attributes given are uncontroversially accurate. It makes more sense in the next sentence—but really, we only "see" Einstein as an "out-of-the-box thinker"?

> Upper-middle-class white Victorians started to view childhood as a sacred > time instead of seeing their kids as little adults who were put to work as > soon as they could walk. Wealthier adults became smitten with images of cute > white kids and chubby-cheeked cherubs. Black children, meanwhile, were > depicted in ads and pop culture as wild, innately criminal, and precociously > sexual.

While that is very unfortunate, it also bears zero connection to the article.

It appears that the quality bar on that site is appallingly low.</comment>


Ask HN: Do startup accelerators have any correlation with success? - <AUTHOR> I'm not seeing the ROI from startup accelerators including YC, Techstars, etc. As I see it reasons for possible failure of startup accelerates include:
1. Focus of accelerators of picking founders based on gimmicky characteristics like their age over vital characteristics like their domain expertise.
2. Emphasis of accelerators on coding rather than sales solving all problems. Maybe this is unfair and rather, accelerators simply don't do a good job of realizing which founders want to code vs sell their way out of the trough of sorrow.
3. Accelerators picking startups based on some insider connection. I'm no financial guru but shouldn't you NOT let emotion control your money? <comment><USER2> Not sure what data you're looking at but YC is likely the most successful seed stage investor (in terms of ROI) at scale in the world.

<comment><USER3> In addition YC is very systematic in how they choose what to invest in. I doubt there is much bias towards.the wrong things.

Success rate as a discrete count is low, but in $ terms one unicorn pays for many dead mules, and then some.</comment></comment>


How Game Theory/Strategic Voting Can Decrease Odds of a Trump Presidency - <AUTHOR> http://www.huffingtonpost.com/entry/57f35f4ce4b0f482f8f0bca4? <comment><USER2> It's frightening how many people on the left feel so morally superior to others, they'll excuse any authoritarian practice that complies with their political views, or goals.

<comment><AUTHOR> OP Here. Why do you consider votetrading to be an "authoritarian practice?" If anything I would consider it significantly _more_ democratic than a system in which voters in "safe" states have no effective say in the presidential election.

<comment><USER2> Vote trading by itself, i don't think is an issue, as long as individual states deem it legal.

My comment is in the context of the article, and the way it was written. A frightening number of people on the left seem to be willing to go to any lengths, just to enforce their ideology on others, and they'll excuse it by convincing themselves they're superior, and thus right.

<comment><AUTHOR> Thanks! Are there specific word choice or phrases in the article that you think I should change to be less offensive to those on the Right?

<comment><USER2> Oh, you're the author! No, i don't expect, or want, any change from a site that ends every post about Trump with:

"Note to our readers: Donald Trump is a serial liar, rampant xenophobe, racist, misogynist, birther and bully who has repeatedly pledged to ban all Muslims — 1.6 billion members of an entire religion — from entering the U.S."

I don't care about you offending people on the right, and they don't seem to be taking offence in the first place.

<comment><USER3> I'm no fan of Clinton, but that seems like a fair description of Trump.</comment></comment></comment></comment></comment></comment>


Oracle asserts non-existent open source trademark - <AUTHOR> http://www.theregister.co.uk/2010/12/03/oracle_doesnt_own_hudson/ <comment><USER2> "but US labor law says assets created by employees using their employer's resources and time are owned by their employer."

True - but trademark is not automatic like copyright, so it's a moot point.</comment>


Ask HN: whither Billmonk? - <AUTHOR>

My roommates and I have been happily using Billmonk (http://www.billmonk.com) for years.  Today, it appears to have vanished.  I knew the service wasn't really being actively developed since the Obopay acquisition, but that's OK, it was perfect for us as it was!  I don't recall seeing any "we're shutting down" message, and there's no status blog I could find - the company blog has been dormant for over a year.
So, with that:
1) Does anyone here know what's up with Billmonk - are they just having a nasty server problem that they're not motivated enough to fix, or has the plug been pulled sans announcement?
2) Anyone have contact info for the [former] Billmonks?  (I believe they were a YC company? Not 100% sure.)  My roommates and I have some valuable (to us, no one else) data in there... at a minimum, we'd like to have our final totals so we can settle up; ideally, we'd love to have our history. <comment><USER2> Thanks for posting this question here kgrin. I'm one of the co-founders of BillMonk, and like you, am disappointed to see that the service is down without any warning or follow up information.

I haven't been at Obopay since late 2007, so don't have much knowledge about how BillMonk is being handled today. However I reached out the company and will be speaking with them this week. I can't promise that there will be any sort of resolution, but I will strongly encourage the company to (a) clearly communicate to users about what's happening with the service on the BillMonk blog (outage or shut down), and (b) if the plan is in fact to shut down BillMonk, to provide users with a way to export their data.

Please check the BillMonk blog (<http://blog.billmonk.com>) over the next week or two for updates - hopefully the company will post an update there. I'll also monitor this post to answer any follow up questions.

<comment><USER3> Gaurav, [http://billmonk.wordpress.com/2009/01/29/billmonk-now-on- twi...](http://billmonk.wordpress.com/2009/01/29/billmonk-now-on- twitter/#comment-37419) lists you as the author of the comment.

However, I'm assuming that you didn't write that comment. In case, that comment was spoofed, you may want to write a disclaimer

<comment><USER2> Woah, thanks for pointing that out. How unfortunate and confusing. I took your advice and posted a clarifying comment. Sigh...

[http://billmonk.wordpress.com/2009/01/29/billmonk-now-on- twi...](http://billmonk.wordpress.com/2009/01/29/billmonk-now-on- twitter/#comment-37430)

</comment></comment></comment><comment><USER4> Thank god for the cache.

If you grep through your cache files for "layout.addDataset", that line of code is what draws the pie chart of what you're owed on your dash.

That page is likely to have your biggest debts and loans. Good Luck.

</comment><comment><USER5> I was an active, very satisfied Billmonk user with 9 or 10 friends. It was aggravating when Billmonk started choking; worse still when the degradation made the app more or less unusable.

If you're in the same boat, we've since moved to <http://www.splitmybill.ie> \-- a service that has more or less duplicated Billmonk's use cases. Very basic, but meets our needs.

<comment><USER6> I'm glad my roommates switched to splitmybill.ie last month when it seemed billmonk was really beginning to die. I still prefer the billmonk interface, but splitmybill works.

The ability to get export history from billmonk would be great though.

</comment></comment><comment><USER7> I just received word...

"We just received the latest word that BillMonk is targeted to be back up and operational by Monday (9/20/2010) afternoon. We have done some upgrades and modifications to the software that will make it better than before."

</comment><comment><USER8> I don't really care if billmonk comes back up or not, as long as I'm given back my data! There are umpteen number of sites out there which provide a similar (and now I can say, more reliable) service....

<comment><USER8> No offense meant Gaurav.

</comment></comment><comment><USER9> Unfortunate...

I've noticed they've been more and more unrealiable over the last few months - i.e. random fatal errors, recurring bills going weeks without occurring.

I even recently started developing a clone for my flatmates and I to use in Django, shame it couldn't wait until it was ready :)

</comment><comment><USER10> My friends and I have been happily using Mr. Moneybags for some time now. Give it a try:

[http://itunes.apple.com/app/mr-moneybags- iou/id342122272?mt=...](http://itunes.apple.com/app/mr-moneybags- iou/id342122272?mt=8)

<comment><USER11> "public shaming" is an amusing feature

</comment></comment><comment><USER12> Although it's not really under development anymore (due to lack of time), <http://billpad.com> is another alternative.

[Disclosure: I'm one of the founders of BillPad]

</comment><comment><USER13> [http://billmonk.wordpress.com/2009/01/29/billmonk-now-on- twi...](http://billmonk.wordpress.com/2009/01/29/billmonk-now-on- twitter/#comment-37419)

A comment has been posted on their blog.

<comment><USER2> That comment was not written by me, Gaurav Oberoi. I've posted a follow up: [http://billmonk.wordpress.com/2009/01/29/billmonk-now-on- twi...](http://billmonk.wordpress.com/2009/01/29/billmonk-now-on- twitter/#comment-37430)

</comment></comment><comment><USER14> It was up for a little while this morning and I was able to get a screenshot of the front page (so I know totals) but I couldn't download the actual transactions. Back down again.

</comment><comment><USER15> I am in the same boat. Though the site has been unstable for a while it totally died today. @goberoi please convince them to let users export all the transactions. Thanks

</comment><comment><USER16> They got bought by obopay.com in 2007, so you could try contacting Billmonk through them. Both their blog and twitter (@BillmonkFriends) are long dead.

<comment><USER14> Obopay's contact info:

Obopay, Inc. 350 Marine Parkway, Suite 100 Redwood City, CA 94065 Main Office - 650-264-2000 General inquiries: firstname.lastname@example.com Support: If you can't find the information you need, please contact us by calling our customer support hotline at 888-8-OBOPAY (888-862-6729) or 650-264-2100.

<comment><USER17> I called the 650 number and spoke to customer support at Obopay. The lady told me that they are actively working on getting Billmonk up and running and that it should be up today (Monday Sept. 13th). I also recommended she let the concerned folks @ Obopay (no pun intended) know that there are rumours out on the internet that billmonk is down for good and that a lot of people, who maintain their accounts and have money owed to them, are getting antsy. Hopefully there will be official word from the guys @ Obopay very soon. HTH.

</comment></comment></comment><comment><USER18> Hmmm... I actually just loaded billmonk.com last night after a couple of years of not checking on it and it loaded fine. Today, no dice.

</comment><comment><USER19> I would gladly pay to use this service. Maybe they should monetize it with a subscription service.</comment>


The Codeless Code – Fables and kōans for the software engineer - <AUTHOR> http://thecodelesscode.com/

<comment><USER2> i really love this site.

For a while now I've had one of these parables earmarked to conclude an article about the follies of my youth.</comment>


Weekly digest 7 – x64dbg - <AUTHOR> http://x64dbg.com/blog/2016/10/09/weekly-digest-7.html <comment><USER2> I love reading your weekly digests!</comment>


Your Equity Isn't a Payment, it's an IOU - <AUTHOR> http://www.gobignetwork.com/wil/2008/4/30/your-equity-isnt-a-payment-its-an-iou/10253/view.aspx <comment><USER2> I think the post is misleading:

What you buy when you invest in a startup is the opportunity to make your investment back tenfold or more within a relatively short timeframe. With that kind of potential payoff there is obviously a huge risk. So if the founders have done whatever they could to make it work and it still tanks, well bad luck to everybody. But it's part of the deal.

If you want a safe investment buy government bonds.

<comment><USER3> I guess that depends on everyone's perception of "done whatever they could to make it work." As the article implies, they might have forgotten as simple a thing as actually listening to what other people suggest.

</comment></comment><comment><USER4> Damn, I read the whole thing hoping to learn what an IOU is, but he didn't say. What could it be? Initiation of Underlings? Investment in Ultra-High- Returns? Intent of Usurpation?

<comment><USER5> IOU = "I Owe U"</comment></comment>


Ask HN: How do you organize sysetm admin notes - <AUTHOR>

How do you store system admin notes and how to guides for your own reference?
I being an Emacs User, use org-mode to organize. Emacs org mode contains an org to html mode which generates static html files. The generated static html files are stored on github or bitbucket which are available via the web.
It's not a blog, just dump of steps and commands I keep to duplicate something or jog my memory.
I have tried to use wikki, tumblr, ghost and wordpress, but none of them stuck.
Curious to learn of any hacks <comment><USER2> For my own reference only, a completely unorganized plain-text file I call "scratchpad".

For information that others (may) need to refer to, an internal-only Dokuwiki instance with a separate page per host works pretty well.

</comment><comment><USER3> +1 for Dokuwiki</comment>


Linked lists considered harmful - awinter-py https://www.google.com/search?q=std%3A%3Alist <comment><AUTHOR> Uhm... What?

What is a random internet search on Google supposed to show?

</comment><comment><USER2> Link unrelated to title.</comment>


New Artificial Intelligence RPA Tool - <AUTHOR> https://www.nlsql.com/blog/post/rpa_software/ <comment><USER2> RPA is mostly buzzword these days but this doesn't seem to be RPA. But "BI chatbot" probably sounds quite a bit less exciting...

Also, it's quite obvious that setup costs will realistically dwarf the 99$/month it costs to keep a running instance around

<comment><AUTHOR> Agree, "BI chatbot" is more precise, as well as cognitive automation</comment></comment>


ObjectiveSync – A thin Java object persistence layer for JDBC - <AUTHOR> https://github.com/l3nz/ObjectiveSync?a

<comment><USER2> I've greatly enjoyed using jOOQ [0] for this purpose in the past. Incredible powerful and easy to use. All without the stuff that hibernate pulls in...

[0] [http://www.jooq.org/](http://www.jooq.org/)

<comment><AUTHOR> JOOQ is nice, but it is more aimed at writing SQL in a portable way than at reading/writing objects.

</comment></comment><comment><USER3> How does this compare to MyBatis [1]? Based on a very brief read, it looks like ObjectiveSync requires me to write more code, but does some interesting things that MyBatis doesn't, like deferred loading.

[1] [http://mybatis.github.io/mybatis-3/](http://mybatis.github.io/mybatis-3/)

<comment><AUTHOR> You write maybe more code, but you control how you want objects serialized. And when you find yourself fighting against the database layer, you know you are doing something wrong.

</comment></comment><comment><USER4> What would've been great is having code snippets/examples in the main readme page.

Over all it looks like a useful library but I think a lot of developers would prefer seeing how the API is used.

<comment><AUTHOR> Examples are here: [https://github.com/l3nz/ObjectiveSync/tree/master/tests/ch/l...](https://github.com/l3nz/ObjectiveSync/tree/master/tests/ch/loway/oss/ObjectiveSync/maps)

<comment><USER4> That's great. Thanks! Though I would consider putting some of them in the main readme or the wiki.

<comment><AUTHOR> Opened up a bug [https://github.com/l3nz/ObjectiveSync/issues/2](https://github.com/l3nz/ObjectiveSync/issues/2)

</comment></comment></comment></comment><comment><AUTHOR> It looks like I'm not alone in hating Hibernate.</comment>


How Shazam Works (2015) - <AUTHOR> http://coding-geek.com/how-shazam-works/ <comment><USER2> [https://web.archive.org/web/20150713235721/http://coding- gee...](https://web.archive.org/web/20150713235721/http://coding-geek.com/how- shazam-works/)

</comment><comment><USER3> How Shazam Works (1999)

When they started beta in London there was no mobile data network and no smartphones. You would call up a number while the song was playing and they would send you a text message back. I used to see marketing slides with Shazam as an example use case for 3G rollouts and it truly succeeded.

afaik Shazam is perhaps THE original Mobile App and is certainly one of the only ones to make it this long still in use.

</comment><comment><USER4> Posting this before reading the article :-

Back in circa July 2016 I was fascinated with both Shazam and Prisma, with the latter being newly launched and being quite the rage on the internet.

I found a paper which described how Prisma worked (believe that was released by the makers themselves), but Shazam remained elusive.

This post should get me upto speed.

PS - kindly correct me if I am grammatically wrong anywhere _ /\ _

</comment><comment><USER5> How Shazam works has always fascinated me.

</comment><comment><USER6> does Shazam work on vinyl or cassette? Or does the track have to be digitized to mirror the footprint?

<comment><USER7> It does. Not sure why it shouldn't since it gets digitized on the mic ADC anyways.

</comment></comment><comment><USER8> I guess it just does pattern matching for spectrograms with some basic filters for background noises? At least that would be sufficient, IMO.</comment>


A closer look at the iOS 7 App Switcher - <AUTHOR> http://vpdn.github.io/articles/iOS7-card-view/

<comment><USER2> Wow, I had never thought of this, but it seems completely obvious now. I wish music players took advantage of this (rdio in particular) so that they would better signal what's playing.

Definitely something I will think of including in my next app.

</comment><comment><USER3> Adam Bell (@b3ll) just hacked together a working, interactive prototype: [https://www.youtube.com/watch?v=ub3OuEREu2c](https://www.youtube.com/watch?v=ub3OuEREu2c)

</comment><comment><USER4> Nice hack will definitely apply to my apps, and thanks for sharing

</comment><comment><USER5> This is actually something worth mentioning. Very nice UX concept.

As expected from HN, no upvotes, no comments.

<comment><USER6> It was posted barely 2 hours ago. Don't need to be so negative about it.</comment></comment>


Ask HN: Best book to get into iOS and Mac programming? - <AUTHOR>

I've been eager to get into learning Cocoa and Objective-C. I do have some basic knowledge on programming because I've worked with Python before. So i was hoping you guys can help me out here with choosing a good book to assist me in Mac/iOS development.
I've been told that the following 2 books are great books to get started:
Cocoa Programming for Mac OS X by Aaron Hillegass (http://www.amazon.co.uk/dp/0321774086)
Programming in Objective-C: Updated for iOS 5 and Automatic Reference Counting (ARC) (Developer's Library) by Stephen G. Kochan http://www.amazon.co.uk/dp/0321811909
Can you tell me which one you think is 'better'? Feel free to make your own suggestions.
Thanks! <comment><USER2> The head first book is good, but the people that I have taught with it, that have had development backgrounds tended to outgrow it's linear approach before they got to the end of the book. That can either be looked at as good or bad, it definitely get's you up and running quick, but it is a poor substitute for a book that can be used as a reference after you learn the platform. I remember reading that one of the books was updated for the new IOS and xCode, which is important because a lot of stuff changed. You can get lost in a tutorial due to the fact that so much has changed. Make sure you either use the old xCode or get a book that covers the new xCode.

<comment><AUTHOR> Thanks for your response.

I do have some programming knowledge, but I would not want to learn from a book of reference. I would prefer to have a book that explains the programming concepts well and teaches you on how to write good code.

I have looked over several other books but like you said its easy to get lost in tutorials, because of the new Xcode 4.2 and its new features (like ARC).

<comment><USER2> I can't recommend it because I have not used or even looked at it but the Sam's book is updated for xCode 4.2 [http://www.amazon.com/Teach-Yourself- Application-Development...](http://www.amazon.com/Teach-Yourself-Application- Development-Hours/dp/067233576X) . A lot of times the Sam's books are good for people like you and I that have development experience, they a fast moving, but they give you the basic's to get you going. I have used other ones to teach with before, but I can't give you a recommendation on this particular one. The user reviews on the second edition are 4 stars on Amazon, so it does have pretty good ratings, I would assume the 3rd edition is just update for the changes to xCode and maybe some tutorials added for the new features in IOS 5.

<comment><AUTHOR> Thanks. I'll have a look into this book.

Also, the 2 books that I mentioned are updated for Xcode 4.2 and iOS5.

</comment></comment></comment></comment><comment><USER3> You might want to start with the latest Aaron Hillegass book, which is an intro to Objective-C. It's really intended for folks new to programming, but it works. [http://www.bignerdranch.com/book/objective- c_programming_the...](http://www.bignerdranch.com/book/objective- c_programming_the_big_nerd_ranch_guide)

<comment><AUTHOR> Thanks for your reply.

I have just recently borrowed this book. I've been skim reading through the first couple of chapters because I understand most of the stuff from my experience with Python.

</comment></comment><comment><USER4> Not a book, but fantastic video lectures from Stanford iTunesU:

[http://itunes.apple.com/ca/itunes-u/ipad-iphone- application-...](http://itunes.apple.com/ca/itunes-u/ipad-iphone-application- development/id473757255)

<comment><AUTHOR> Thanks for your response.

I have already started watching some of the lectures and doing some of the assignments.

</comment></comment><comment><USER5> Reading document from Apple is the best way to start.

For books, I found the following are very helpful:

1) Cocoa Programming for Mac OS X (by Aaron Hillegass) 2) Cocoa Design Patterns (by Erik M. Buck and Donald A. Yacktman)

<comment><AUTHOR> Thanks.

I am looking over the Apple documents now. I haven't come across Cocoa Design Patterns until you mentioned it. It seems like a good book.

<comment><USER5> Comparing to C++/Java, I felt that Design Patterns are more tightly integrated with Objective-C. So it is a very important subject to learn in Objective-C, imho.

And that is very good book for this important subject.

Good luck!</comment></comment></comment>


Historical Documents – MozillaWiki - <AUTHOR> https://wiki.mozilla.org/Historical_Documents <comment><AUTHOR> 20 years and one day ago AOL started buying Netscape, which was already in the process of open sourcing their core product. Since Mozilla depended on that, Netscape's acquisition triggered some uncertainty for Mozilla.

This wiki-page links to some background of what that meant for them.</comment>


Forbes profiles Alvin Roth on applying game theory to real-world problems - <AUTHOR> http://www.forbes.com/forbes/2010/0809/opinions-harvard-alvin-roth-freakonomics-ideas-opinions.html

<comment><USER2> The real solution to many of the problems lies in communication, effort and understanding. External tools, simple models and mathematicals tools are not enough.</comment>


Good list of books for the newbie entrepreneur - <AUTHOR> http://www.centernetworks.com/holiday-guide-2007-books

<comment><USER2> Any list with The Secret on it can't be a serious good list of books.

</comment><comment><USER3> the 7 habits? too many pages, not enough value.

here are some that i found valuable: maximum achievement, the 13 strategies of war, the 22 immutable laws of branding, founders at work, how to get rich (felix), and a speed reading book/class.

please add yours here too.

</comment><comment><USER4> I'd skip the Covey books as well, there are a lot more worthy books that aren't on this list.

</comment><comment><USER5> You should read stuff that tells you the most important stuff you don't know. So -- what do you know? Depending on that you should read different material.

I liked "A Good Hard Kick in the Ass" when I read it a few years ago. I've also read many of the books in that article. The business book business is strange: seems like you can read a lot without really learning much of anything.

The laws of marketing and laws of branding books are good, as is "The Innovator's Dilemma" (The sequel didn't seem as good to me for some reason).

Something I've tried that might be a good gift idea is business CDs -- you can load them up in your I-pod and take them on your morning run. Hard to do that with a book.

One thing to remember is the rule of 3: read at least three books attempting to solve the same problem that you are facing. Not only will it give you more perspective, different authors will connect to you in different ways, and sometimes it takes a while for the light to go on. But the main point I'm trying to make is to read based on what you need to know, instead of just randomly wandering around from one book to the next.

</comment><comment><USER6> My experience is that none of the self-help books ever did very much for me. This includes Steven Covey, Dale Carnegie, Tony Robbins, Zig Zigler, the Secret, etc., etc., etc. Some were entertaining, but that was it. I understand that these books do help many people who need their messages; I'm just not one of them. I prefer books that inspire me and tell me what to do.

My favorites?

How to Get Rich by Felix Dennis.

[http://www.amazon.com/How-Get-Rich-Felix- Dennis/dp/009192166...](http://www.amazon.com/How-Get-Rich-Felix- Dennis/dp/009192166X/ref=pd_bbs_sr_1/104-5439339-2846362?ie=UTF8&s=books&qid=1193580295&sr=8-1)

Differentiate or Die by Jack Trout

[http://www.amazon.com/Differentiate-Die-Survival-Killer- Comp...](http://www.amazon.com/Differentiate-Die-Survival-Killer- Competition/dp/0471028924/ref=pd_bbs_sr_1/104-5439339-2846362?ie=UTF8&s=books&qid=1193580333&sr=1-1)

Art of the Start by Guy Kawasaki

[http://www.amazon.com/Art-Start-Time-Tested-Battle- Hardened-...](http://www.amazon.com/Art-Start-Time-Tested-Battle-Hardened- Starting/dp/1591840562/ref=pd_bbs_sr_1/104-5439339-2846362?ie=UTF8&s=books&qid=1193580387&sr=1-1)

The 22 Immutable Rules of Marketing by Al Ries and Jack Trout

[http://www.amazon.com/22-Immutable-Laws- Marketing/dp/1861976...](http://www.amazon.com/22-Immutable-Laws- Marketing/dp/1861976100/ref=sr_1_2/104-5439339-2846362?ie=UTF8&s=books&qid=1193580441&sr=1-2)

Digitial Aboriginal by Mikela Tarlow and Philip Tarlow

[http://www.amazon.com/Digital-Aboriginal-Direction- Instincti...](http://www.amazon.com/Digital-Aboriginal-Direction-Instinctive- Ever- Changing/dp/0446528250/ref=sr_1_1/104-5439339-2846362?ie=UTF8&s=books&qid=1193580598&sr=1-1)

and, of course

Founders at Work by Jessica Livingston

[http://www.amazon.com/Founders-Work-Stories-Startups- Early/d...](http://www.amazon.com/Founders-Work-Stories-Startups- Early/dp/1590597141/ref=pd_bbs_sr_1/104-5439339-2846362?ie=UTF8&s=books&qid=1193580514&sr=1-1)

Hackers and Painters by Paul Graham

[http://www.amazon.com/Hackers-Painters-Big-Ideas- Computer/dp...](http://www.amazon.com/Hackers-Painters-Big-Ideas- Computer/dp/0596006624/ref=pd_bbs_sr_3/104-5439339-2846362?ie=UTF8&s=books&qid=1193580545&sr=1-3)

Before you do anything else, go to paulgraham.com and read all of the essays! I don't want to sound like a shill or hero worshipper for pg, but, understand, these essays are the very best thing out there for anyone on this forum. I am here because of the essays, not the other way around.</comment>


Can Silicon Valley Survive? [video] - <AUTHOR> http://techonomy.com/2013/12/can-silicon-valley-survive/

<comment><USER2> "The reports of my death have been greatly exaggerated." -Mark Twain

I live in Dallas so I may not have a leg to stand on in this discussion, but I don't find any value in these sort of discussions. I guess they are valuable to some who want to always ensure that they don't become the next Detroit, but these discussions rarely turn into something productive.

</comment><comment><USER3> One of the leading causes to Detroit's failure in the automotive industry is because it could no longer compete with the manufacturing capabilities of car companies abroad. If we want to determine whether Silicon Valley will last, I think we need to ask, what is the competitive advantage of Silicon Valley? And what would it take for SV to lose it's advantage?

Perhaps what SV has which is unique is a disproportionally large tech infusion. Let me elaborate. Many large tech companies reside in SV and the Bay Area including Oracle, Apple, HP, Google and Intel. It could be argued that these companies are so large at this point that they have cultural effect on the surrounding communities. In tech right now, the largest competitive advantage is good engineers because almost everything else has become easy to obtain thanks to the internet. In order to compete with SV, you may need to duplicate the cultural effect that SV created, and that isn't happening anywhere else on the same level right now. Maybe there is hope in Chicago where students K-12 will start learning Computer Science as part of their core curriculum fairly soon.

</comment><comment><USER4> The font seems to have trouble displaying a lower-case 'a' in Chrome on Windows 7. If I zoom in to zoom level 150%, it's fine, and it's fine in IE11, but not in Chrome. Very difficult to read!

<comment><USER5> I'm glad it's not just me! I saw the same thing, and yes, it was very distracting.

</comment></comment><comment><USER6> I think Silicon Valley got its boost from all the big chip makers in the early days, which led to an excess of resources (so you could get stuff at a discount, or get high-tech services at a reduced price as well) an abundance of talent either camping at the gates, leaving companies, or being cast off.

It was those factors that created the microcomputer industry. It wasn't some planned educational push or government mandate, it was mainly a bunch of individuals finding a inroad to do some cool stuff and building up from that.

Actually Detroit has some opportunity it is a place with lowering costs and a pre-installed big utility/service infrastructure, depending on what resources are available I am sure some creatives will start building some sort of niche there.

<comment><USER3> A big problem with Detroit is that the local transportation isn't too hot, particularly because the train system is basically non-existent. I think this is because the car companies pushed back against rail development so that people would have to drive everywhere. It's pretty hard for young people to get around right now, at least until Google releases its self driving vehicles.

<comment><USER7> Everyone in Detroit has a car.

</comment></comment></comment><comment><USER8> This is nothing more than an advertisement for this conference next year that I have never heard of.

</comment><comment><USER9> Is "Silicon Valley" really just the VC-driven startup system (as the article implies)? Or is it something bigger?</comment>


Mobile - First, last and always - <AUTHOR> http://christianheilmann.com/2012/04/01/mobile-first-and-last-and-always/

<comment><USER2> I get the satire but like most effective satire there is truth there. Like it or not we currently live in a world were money is the biggest driver of innovation and creation. This is especially true for works that require teams to create. Maximizing consumer surplus with digital goods isn't necessarily a net good if the collapse of profits drives away innovation and creation in the field. Free software, whether it is open source or provided by a giant tech company, can cause stagnation.

</comment><comment><AUTHOR> From the comments I guess you guys don't recognize the name. Chris Heillmann, AKA, @codepo8, has been a long time evangelist. First at Yahoo and now at Firefox. I don't think he really meant to fool anyone, but I can see how you would take it if you weren't aware of his background.

</comment><comment><USER3> The troll is strong in this one.

</comment><comment><USER4> I frankly can't help but think fuck this guy.

He makes some valid points about closed innovation (the number of browsers we have to support means the open web must necessarily evolve less rapidly) but overall his attitude is just total shit.

I can't tell if he's being a jackass for April Fool's or is honestly just throwing in the towel on a short-term call to make more money. Fuck the rest of us. Go join Apple and let the open ecosystems die.

</comment><comment><USER5> Native Mobile developer has been great not liking the way javascript works it has been a heaven sent to have relevant platforms to develop on. Whether it's iOS, Android, or Windows Phone 7 I way rather learn all three languages than one I just don't like. I still have to do web mostly for websites for mobile apps, but I am glad mobile is catching on as it has.

<comment><USER6> I call April Fool's.</comment></comment>


Github'd genome license has interesting restrictions for cloning - <AUTHOR> https://github.com/kennethreitz/genome/blob/master/LICENSE#L3

<comment><USER2> My first thought was "do clones count as kin for the 'closest of kin' statements in that license?"

Last thing this guy needs is _more_ reasons for his clones to kill him.

</comment><comment><USER3> First, if this data has been obtained via a service such as 23andme cloning wouldn't be possible anyway, as the identified SNPs are only a small subset of the full genome.

However, lets assume that this is a full genome - in regard to cloning there may be some interesting legal consequences in some countries: For example, in European countries there have been some cases where sperm donors have been sued to pay alimonies. It wouldn't suprise me that if someone clones your DNA, one of those courts would define you as legal father and force you to pay alimonies.

<comment><USER4> Oh, it's much worse than that. Not only would the original be the father, it would also be the same person. Hence, the original could be tried for any and every crime the clone commited.

<comment><USER5> That fails the identical twin test: is one half of a pair of identical twins who share the same DNA able to be tried for any crime that the other commits? The answer is obviously no.

</comment></comment></comment><comment><USER6> I read this as restrictions on cloning the git repo rather than the person, I'm obviously too deep in the code!

</comment><comment><USER7> Outside of a few circumstances, it's not so interesting to clone a whole organism. A gene? Absolutely, yes. Do it all the time. A cell? Sure, especially if we can create a novel cell line. But a whole multicellular organism? ...I really can't see much scientific use for that.

</comment><comment><USER8> Well, this makes that lock of Justin Beiber's hair I bought on eBay even more valuable - it's Royalty Free!

I don't really own that... but seeing as bits of ephemeral DNA-containing material from famous people tend to be collectible, it's a plausible future possibility.

</comment><comment><USER9> Interestingly unenforceable :P

<comment><USER10> True, but it isn't all that dissimilar from the genetic patents that Monsanto and similar hold.

<comment><USER11> Can you elaborate?

<comment><USER7> Monsanto clones in genes that are resistant to its herbicide, Roundup, which is a simple glycine derivative. These molecules bind tightly to a key enzyme in three amino acid synthesis pathways, and since these molecules bind with such affinity, the enzyme can't dislodge it within a reasonable timeframe/equilibrium. Without the AAs, the plant dies.

Due to patents, Monsanto owns the rights to any plants with the gene-- including offspring. Farmers have to continually license the plants to grow them. One unfortunate soul had a neighboring farmer's crops cross pollinate his own, and Monsanto came down hard on him--it was a pretty big incident.

</comment></comment></comment></comment><comment><USER12> Read more about Kenneth Reitz at

[http://files.promethease.com/reports/genome_kennethreitz.htm...](http://files.promethease.com/reports/genome_kennethreitz.html)

<comment><USER13> This is awesome! Thanks :)</comment></comment>


Lessons learned from writing and launching a WebApp in 23 days - <AUTHOR> http://wildfalcon.com/archives/2011/01/07/lessons-learned-from-writing-and-launching-a-webapp-in-23-days/

<comment><USER2> I wonder if 30daysyoanewhabit.com wouldn't be a better URL than habitualapp.com? Then again it does sound very infomercial-ish.

I'm one of those people who won't use it as a Facebook thing. Give me a Twitter login and option to have my progress reported there and I'd give it a whirl.

<comment><USER3> Habitualapp is at least composed of recognizable lexemes, while 30 Days Yoanne Wabbit sounds more like a failed Loony Toons fanfic site.

So, no, I think your proposal is even worse than the original as it allow too many ambiguous parses.

</comment></comment><comment><USER4> sorry, if I have to spam my facebook contacts to start doing something, I'm not going to use it.

<comment><AUTHOR> I expect hacker news readers to take this line. However most non-techies tell me this is the feature they love most about the app. I guess different things work for different people

<comment><USER5> I also really want to use this app - it's like the Seinfeld calendar - but the Facebook login turned me away.

I can understand, though, how this would be a selling point for 'normal' people.

Is there anyway to turn off the 'tell everyone on facebook about this' feature if I login using my FB account?

<comment><AUTHOR> Yes, this is a very much requested change, so I'm going to move it to top of my list

I just created a MailChimp list so if you sign up (<http://eepurl.com/caXRn>) I will send out a newsletter when its done

</comment></comment></comment></comment><comment><USER6> The layout is a bit off for me (FF 3.6.13, Mac OS X). Screenshot: <http://imgur.com/dHYGY>

<comment><AUTHOR> Thanks, I will take a look at it over the weekend :-)

</comment></comment><comment><USER7> Getting a database error here. Some new lessons to learn on receiving large numbers of visitors from Hacker News?

<comment><AUTHOR> Totally! :-)

I just tweaked the server settings and I think its holding up now, fingers corssed

</comment></comment><comment><USER8> I'll surely give it a try as I plan to learn tennis. What's the stack you are using and where is it hosted?

</comment><comment><USER9> Did you open the floodgates for anyone to sign up or did you do a limited beta launch first?

</comment><comment><USER10> url is dead already

<comment><AUTHOR> The server is struggling under the load a bit. I will see what I can do.</comment></comment>


Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf] - <AUTHOR> https://bug1134506.bugzilla.mozilla.org/attachment.cgi?id=8566794 <comment><USER2> I went to Best Buy as well today and picked up a laptop to look into this further. The Superfish software is not properly passing the validation state of the public cert when it connects to a website like Bank of America as an example. There's no need to export their private and use it in a MitM transparent proxy. The software is simply not triggering appropriate warnings when provided an obviously fake certificate that has been generated in a way to bypass browser warnings. It's also not properly validating revoked certs. Both of these situations are very bad. Allowing any self-signed cert would lead me to believe that this could have easily been exploited in the wild without prior knowledge of this vulnerability.

I'm not going to provide a how-to guide on how to exploit users here. I have notified both Superfish and Lenovo of this issue and here's an example of the improper status pass through based on doing something that might be quite obvious to some:

This is what the browser should do when it encounters a self-signed cert delivered by an SSL/TLS MitM solution:

[http://defaultstore.com/six.png](http://defaultstore.com/six.png)

However, it's not doing this for this self-signed public cert:

[http://defaultstore.com/four.png](http://defaultstore.com/four.png)

Note both certs show "verify_fail." at the beginning and those who know how browser cryptography works will understand what has gone wrong with their implementation.

<comment><USER3> I suppose they were relying on the prepending of "verify_fail" to the hostname (with an invalid character - '_') to cause the browser to fail the certificate name check, so Superfish is doing certificate checking? Shouldn't the browser then complain with a "certificate's hostname does not match the site's" warning?

...Or am I looking at this in the wrong way?

<comment><USER2> You're close. I'm not in the business of telling people how to exploit this and am assuming those who already know were already doing it based on what would be a "best practice" (for a bad guy that is) when it comes to generating a self-signed cert.

<comment> ryan-c ...is it blindly copying _any_ x509v3 attributes present on the certificate, or just the one that you seem to be carefully not mentioning? Can you email me (one is listed in my HN profile)? I just thought of a pretty horrible exploit. 2199399413f2e63e6291a3f3e60f3475518aaf88215434222c65d6bc6fe41f34

<comment><USER3> After a little more thought, it seems obvious to me now what the problem is. :-)

The shocking thing is that the certificate name matching algorithm has been standardised for over 15 years and yet those who wrote the cert generation code weren't aware of how browsers implement it.

<comment><USER2> Ding, ding, ding. ;-)

<comment><USER4> This is bumming me out. I'm really curious about what the exploit is but cannot quite put the pieces together...

<comment><USER5> Looks like someone already wrote a post about it: [https://blog.filippo.io/komodia-superfish-ssl-validation- is-...](https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER3> While this whole Superfish/Lenovo thing is certainly quite scary, let's not forget the very important fact that, currently, the user ultimately still has the ability to modify the software on the machines he/she owns, which includes among other things (un)installing software like Superfish, and also adding/removing trusted certificates. There will be those who advocate locking down the certificate stores and other areas of the OS (e.g. only "approved" software can be installed) in an effort to prevent companies from doing things like this, but I think that could lead to an even worse situation - imagine if this was preinstalled on a locked-down system that made it nearly impossible to remove (or perhaps even discover!)

To put it bluntly, I'd still prefer to buy a system "infected" with Superfish but which lets me reinstall the OS and configure it however I choose, than one which is locked-down so much that, even if such malware was not present initially, if something similarly undesirable is eventually installed by default, it would be nearly impossible to remove. Of course buying an open system that has no malware/adware preinstalled is even better, but given the way things seem to be going with "smart TVs" adding ads and whatnot, it feels like that might not be an option in the future.

<comment><USER6> Welcome to the War over General-Purpose Computing.

[http://boingboing.net/2012/08/23/civilwar.html](http://boingboing.net/2012/08/23/civilwar.html)

[http://boingboing.net/2012/01/10/lockdown.html](http://boingboing.net/2012/01/10/lockdown.html)

The future really scares me. And yes, backlash from Superfish fiasco will probably only make things worse.

<comment><USER7> I don't understand how this would be the conclusion reached. If you asked a person on the street, would they not think that Lenovo is a entity of authority? That they were the ones dictating the computers configuration? That they were any more or less fallible/malicious than Sony or Microsoft or HP?

If you asked anyone, would they not follow the line of reasoning that, if the manufacturer was releasing hardware in a default state of compromise, that we could not trust the default state of released hardware? Why would you conclude the opposite after this?

I can't see a way to construe this as "We need to ensure that machines must stay as the manufacturer ordained to protect us from security threats introduced by the manufacturer!"

I don't understand the rational here.

</comment></comment></comment><comment><USER8> Computing is genuinely becoming scary. If I didn't browse tech sites or spend my days on HackerNews, I probably wouldn't know about these things. I'm getting older and more disinterested in the constant maintenance -- I just want the shit to work. It sucks the most for those who learned "don't install anything fishy, run a virus scan, don't open attachments, and you'll be fine." They bought a computer and followed the rules and are still being fucked over. I've seen a high number of comments that say "oh man, I never trust OEM software, clean installs only for me." So it looks like there is another rule for the pleb/peasant/uninitiated computer users to follow. I can barely keep up, I wonder how nontechnical people do.

<comment><USER9> This.

I can tell several stories of trying to set things up for my parents, only to have to call them/wait until I fly home next to fix something. Lessons have been learned the hard way on dumb email chains/anti-virus software, but trying to give them a list of browser settings (among other things) to do is getting to be too much.

So, now what?

<comment><USER10> I'm in this situation too.

We're at an impasse now too where my mom wants a new laptop. She doesn't want to learn anything new (Mac OS) and both she and I don't want to deal with Windows 8+. I'm skeptical about just installing Windows 7 on a newer laptop (...driver/hardware support).

If I could get her to switch to Mac (she's in her 70s), I could set her up with a non-admin user account and set it up easily so that I can securely do remote support. The funny thing is that she would probably do it if not for my brother, who does support for a living and doesn't want to learn to fix Macs...smh

<comment><USER11> Windows 7 is going to be absolutely fine. If it's what she's used to, and you have the license and media, just go ahead.

And something like TeamViewer does the remote support nicely.

I'm all for Linux otherwise, but in this use case I'd let old people use whatever keeps them going.

<comment><USER10> Yeah, it's just an insecure mess.

She always makes a mess of Windows machines. If her first instinct weren't always to call my older brother for help, I'd have gotten her the Mac ages ago.

<comment><USER11> Well, perhaps it would be good to give her a non-admin account to Windows? The same approach you'd do with a Mac, but leaving her with a familiar UI.

<comment><USER10> Privilege escalation, even with UAC at its strictest, is trivial on Windows with the malware that's floating around these days.

I worked full time for 5 of the last 6 years on Windows malware research. Windows is a swiss-cheese joke of an operating system that won't progress because of a(n at this point pathological) need for 20 years of backwards compatibility. Microsoft: make use of that XP mode VM and extend that trend forwards, you fools.

<comment><USER11> Perhaps so, but at least it would keep _some_ of the malware out.

Another option would be to put her regular use to a VM that you control (remotely) and can restore to a clean state at any time...

<comment><USER12> I'd like to see some kind of way to lock the system for older folks. I'm tired of troubleshooting my dad's computer. He doesn't even do so much as adding bookmarks, his machine exclusively browses the web.

I'd like to get everything he needs installed and lock out modifications. Needs cookies obviously, but not much else.

Somehow he manages to have video player issues in every single browser that I can't figure out. He has to watch youtube in chrome, live streams in firefox, etc. It's really dumb. Buying him a chromecast improved it some, though, by avoiding it.

<comment><USER11> Such limitations are of course possible. Perhaps you should look up what you can achieve by running secpol.msc.

(Myself, I find that model complex and unintuitive, being used to the Unix way, but everything has its learning curve.)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> I originally discovered this issue a month ago when debugging my friend's Lenovo laptop. Neither chrome nor IE can render battle.net correctly because the HTML injection is not properly escaped. Since the problem persists after a fresh recovery, I guess it's from some pre-installed software. I almost reported it to FBI.

<comment><USER14> Shouldn't Lenovo be guilty of hacking and illegal wiretaps?

<comment><USER15> To be guilty of wire fraud, Lenovo must have intent to defraud the user out of money. It will be tricky to prosecutte.

<comment><USER16> Placing their ads on a site where the user believes they are something else (e.g. Google search ads) has to qualify.

</comment></comment></comment></comment><comment><USER17> Not only did I have to remove the certificate from my root authority in the control panel, I also had to remove it from my list of certificates in Firefox. This was after uninstalling Superfish. Once I did all of these things, and cleared my history and cache and all that, the website that folks have been linking said that it didn't detect Superfish (sorry, I'm typing this from a phone).

So my explanation wasn't very technical, but I feel as though the part of the process where you also remove the certificate from Firefox had been left out, and I wanted to share it in case it helps out another person.

This news took me by surprise, as I just received a brand new Lenovo Yoga 2 for work last week, and it had this vulnerability.

<comment><USER18> _the website that folks have been linking said that it didn 't detect Superfish (sorry, I'm typing this from a phone)_

The website you're referring to, is [https://canibesuperphished.com/](https://canibesuperphished.com/)

<comment><USER19> Another useful website is: [https://filippo.io/Badfish/](https://filippo.io/Badfish/)

<comment><USER17> This is the one I was thinking about and implicitly referring to. Thanks for posting.

</comment></comment></comment></comment><comment><USER20> This is a PDF attached to this issue, requesting blacklisting of the Superfish certificate:

[https://bugzilla.mozilla.org/show_bug.cgi?id=1134506](https://bugzilla.mozilla.org/show_bug.cgi?id=1134506)

<comment><USER21> From what I understand of Superfish, Mozilla (and other browser vendors) can't just blacklist the certificate. That would make all HTTPS connections error out. A message notifying users of the issue is all they can do.

<comment><USER22> They definitely can blacklist the certificate.

They have the choice of having HTTPS effectively useless (by leaving the certificate there), or making HTTPS not work (by removing it, thus prompting action from the user to fix it -- perhaps by calling their tech savvy nephew).

Browser vendors should (and usually do) err on the side of security.

<comment><USER23> Or the users just switch to a browser that works. IE or Chrome :(

<comment><USER22> Most Firefox users switched away from those (or didn't switch to them) because it works better for them - including security wise. I suspect that won't be their first course of action.

</comment></comment></comment></comment></comment><comment><USER24> Shouldn't Lenovo be issuing a recall and pulling all the inventory in their distribution channel? In other words, Best Buy shouldn't be selling these things!

<comment><USER25> I believe Lenovo's official statement previously said "We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns." However, it now has a link to LEN-2015-010, a high- severity security vulnerability.

[http://news.lenovo.com/article_display.cfm?article_id=1929](http://news.lenovo.com/article_display.cfm?article_id=1929) [https://news.ycombinator.com/item?id=9074676](https://news.ycombinator.com/item?id=9074676) [http://support.lenovo.com/us/en/product_security/superfish](http://support.lenovo.com/us/en/product_security/superfish)

<comment><USER26> They didn't even close all their parentheses.

</comment></comment></comment><comment><USER27> Bullet point 4 is what I'd been wondering about:

 _• The Superfish proxy accepts its own certificate, so now that the private key has been leaked, an attacker can mimic an arbitrary site in Chrome and IE_

I thought there might be a chance that despite all the other idiocy here, they might have refused external certificates from their own CA, mitigating the risks somewhat. But no suck luck for Lenovo customers!

<comment><USER28> The Superfish proxy accepts _any_ certificate. If you're being MITMed (before Superfish MITMs you), Superfish will _help_ them by replacing their certificate with Superfish's.

<comment><USER27> I don't believe that's true, but if so – for example if it replaces self- signed certs, or certs from any untrusted CA, with its own (force-trusted) cert – then that would be worthy of another scary explicit bullet point.

(It might just accept all CAs locally-configured, and it's accepting its own because they didn't special-case a rejection.)

<comment><USER28> It is true. I can't remember where I read it, but I remember seeing it either here on HN or on Twitter.

<comment><USER29> Komodia's own info says that it will generate an invalid certificate if the real certificate was invalid or untrusted "so it will not cause a security problem". They may be lying, but that page is fairly open about the way it works:

[http://www.komodia.com/wiki/index.php?title=SSL_Digestor#Cer...](http://www.komodia.com/wiki/index.php?title=SSL_Digestor#Cert_creation)

<comment><USER2> I wouldn't go as far as say lying, they just failed to consider the SAN. Unfortunately they pulled the doc, possibly due to what they claim to be a DDOS but it's still in Google cache:

[http://webcache.googleusercontent.com/search?q=cache:XUbVSX8...](http://webcache.googleusercontent.com/search?q=cache:XUbVSX81n_YJ:www.komodia.com/wiki/index.php%3Ftitle%3DSSL_Digestor+&cd=1&hl=en&ct=clnk&gl=us)

<comment><USER27> 'SAN'?

<comment><USER30> [http://en.wikipedia.org/wiki/SubjectAltName](http://en.wikipedia.org/wiki/SubjectAltName)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER31> I find it a bit weird that it can MITM [https://www.google.com/](https://www.google.com/) on Chrome. I thought Chrome did CA-pinning for Google-domains.

<comment><USER32> Chrome does do pinning, but ignores pins when the cert parent is a privately installed cert (because this is a "feature" used by many enterprises).

"""

Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor.

A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites.

'Data loss prevention' appliances, firewalls, content filters, and malware can use this feature to defeat the protections of key pinning.

"""

See: [http://www.chromium.org/Home/chromium-security/security- faq#...](http://www.chromium.org/Home/chromium-security/security-faq#TOC-How- does-key-pinning-interact-with-local-proxies-and-filters-)

<comment><USER14> TIL Google is ok if you get backdoored by your boss.

<comment><USER33> The company I work for has a strict policy of no direct outbound connections from the corporate network. This is to prevent (or just make harder) for compromised machines from "phoning home".

This has the unfortunate side effect that all internet traffic must go through a proxy, they have to MiTM SSL traffic.

I just use my smartphone's data for any personal internet browsing.

<comment><USER34> Well you don't have to MITM SSL in order to proxy it, it can be done in other ways. They probably choose to do so in order to see the details of the request.

<comment><USER33> Correct, the firewall intercepts all traffic looking for potential compromises and blocks it. Given all these corporations getting hacked, such measures seem necessary.

<comment><USER35> Conclusion does not follow from premise. Once an attacker's code is running on machines that have access to sensitive data, you've already lost - there's no way to prevent it smuggling the data out in legitimate-looking requests. The right way is to stop the bad stuff getting in in the first place.

<comment><USER36> Not all attacks are perfect. It's true that an attacker can potentially do anything once in control of machines with sensitive data, but it doesn't mean that all hope is lost. If an intrusion detection system catches some x% of potential threats, it can easily be worth it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER37> This isn't right though.

I got a Lenovo Y50 a couple weeks ago, and when I downloaded Firefox and looked at the certificate, it was Superfish.

I've since uninstalled Superfish and deleted the keys (I exported them first though). I know I probably should reinstall Windows but I'm too lazy.

</comment><comment><USER38> I will never again consider buying a Lenovo neither for myself, nor any company I am with. I'll also make sure to recommend another brand to anyone who asks my opinion. What an absurdly stupid business decision.

</comment><comment><USER39> Shouldn't the content providers strike back, in order to stop such things as a business? E.g., a class action against those vendors who pre-install said software. Determine the average share of traffic of these machines, use average Adsense-earnings to determine the damage ... Globally, this might add up to something that would be suitable to take even a major corporation out of business ...

</comment><comment><USER40> It would be interesting to try any of the Lenovos at a Microsoft Store (say at San Francisco Center) and see if they also contain this malware.

</comment><comment><USER41> Lenovo too smart in laying down the removal instructions under their security advisors today!!

</comment><comment><USER42> Any idea why it doesn't affect Firefox?

<comment><USER43> Firefox has it's own certificate store. Both IE and Chrome utilize the Windows store.

<comment><USER44> But as pointed out in other comments, it looks like SuperFish does install the extra cert in Firefox's database too, but only after a restart.

</comment></comment></comment><comment><USER45> Great research and I like the level of detail

But why take actually photographs of the computer screen instead of just using native screen capture? The lights and reflections are super distracting. A minor nit, yes but still...

</comment><comment><USER46> This article crashed my browser.

</comment><comment><USER46> PDF

<comment><USER46> Article is a PDF

</comment></comment><comment><USER46> PDF

Didn't Hacker News used to mark PDFs?

<comment><USER47> It marks PDFs if the URL ends in .pdf.

</comment></comment><comment><USER46> Flagged for being unmarked PDF.</comment>


Why are you doing? - <AUTHOR> https://sivers.org/why <comment><USER2> Derek's writing feels sincere, dry and witty. He's well versed in making those mundane, yet profound insights. The kind of stuff that always seems obvious _in hindsight_. If you're an aspiring writer, I _highly_ recommend you to read his other posts. His bit on Vonnegut is one of my favorites: [https://sivers.org/drama](https://sivers.org/drama).

<comment><USER3> I'd recommend his book. Very short to read and the tone is the same - [https://www.amazon.com/Anything-You-Want-Derek- Sivers/dp/193...](https://www.amazon.com/Anything-You-Want-Derek- Sivers/dp/1936719118)

One of my favourite books about start-ups but here are a few more - [https://medium.com/@KatAlexPas/an-hour-and-a-half-a-day- of-r...](https://medium.com/@KatAlexPas/an-hour-and-a-half-a-day-of-reading- business-books-db503a79fa0f#.qute1q7ni)</comment></comment>


Hardware in 2014 and Beyond - <AUTHOR> http://octopart.com/blog/archives/2014/1/hardware-in-2014-and-beyond

<comment><USER2> Don't forget Kickstarter too. More hardware stuff seems to be showing up on Indiegogo also (eg Canary).</comment>


Ask HN: what's the legal status on Uber? - <AUTHOR>

I read somewhere that the founder of Uber might have some tens of thousands of jail time in front of him for violating certain laws. Yet Uber lives on and apparently keeps on innovating.<p>1. What's the legal status for Uber? 2. At what point do you say "screw it, i might be breaking the law but this is how it should be done." ? <comment><USER2> I'm also curious about the whole taxi vs not-a-taxi legal issues after reading:

<http://news.ycombinator.com/item?id=2675975>

Searching HN for "uber" gives further insight such as:

<http://news.ycombinator.com/item?id=2584140>

but it isn't conclusive.

I think we need to turn on the grellas bat signal.

<comment><AUTHOR> /\ . . /\</comment></comment>