My weekend "project" - <AUTHOR> http://www.williamsonfineart.co.uk/Retrospective.html

<comment><AUTHOR> At short notice my mother-in-law decided that she needs more space in the house, and wants to dispose of some of her paintings. She has decided to have a sealed-bid auction, culminating on June 25th.

She wondered if something "web-like" could be done, so I took a few hours and knocked up this. It's not perfect, and in some ways it's not good, but she seems thrilled by it, so "the client is happy".

Just thought some of you might like to see it. All done in hand-crafted HTML (and almost certainly not standards compliant) and in hand-crafted Python, with no frameworks or libraries.

Comments welcome, but be gentle. Changes are still being made as refinements are suggested.

<comment><USER3> obvious perhaps, but have you considered ebay or etsy?

<comment><AUTHOR> We have, but at such short notice it was less risky to create a site to accompany the live sealed-bid exhibition and sale, than to try to work out how to torture eBay into doing what we want.

We're expecting most people not to be particularly comfortable with computers, nor to have PayPal (or other) accounts, etc, so making it independent seemed the best option. Most are comfortable with a browser, completing a form, and email, so that's all this version requires.

PS: I'm in London(ish) June 23 to 26. Perhaps I could buy you a coffee, or other beverage of your choice.

<comment><USER3> That's very kind! Unfortunately I'm away over those dates. But if in London again let me know.

Good luck with the auction!

<comment><AUTHOR> How can I let you know? There are no contact details in your profile.

Apart from that - thanks again.

</comment></comment></comment></comment></comment><comment><USER3> A minor point, but your thumbnails should be thumbnails, not the full size image rendered small. They'll load much faster, and reduce the strain on your server.

<comment><AUTHOR> Agreed. The scope is there in the code to change that, I'm just trying to sort out some cross-browser compatability problems first. For example, on some browsers the thumbnails aren't clickable, and on others the cells in the Gallery aren't all the same size!

The other point is that once the full sized images have downloaded, the individual page image then comes up _much_ faster, becuase the image is already cached. I'm watching the load to decide when to make the change.

And thank you.

EDIT: Thumbnails now created, loaded and in use. And thanks again.

<comment><USER3> Caching will help you on reloads - depending on browser configurations - <USER2> cannot be relied on. It's good you now have proper thumbnails.

I took a very brief look at your HTML. I don't know why in some browsers the image wont be clickable. Having an <img> nested in an <a> should be fine. However I will say make sure your image tag is terminated properly: it should end with a trailing slash: />.

Also, you have a lot of table action going on. Whilst it's fine for your general tabular layout, there's no reason to have nested tables.

Re the sizing, without a detailed look I don't know. You are specifying td widths. These will only be honoured so far as the browser can conform to these. Resizing the window may break this for example. You could also try specifying a width for each image.

Also, re styling, a little bit of css will get you a long way.

<comment><AUTHOR> Excellent advice and information - thank you.

I've changed the hrefs in the gallery items so now they only surround the img in the table cell, and not the entire table cell. I think you're looking at the more recent version. I'll change the trailing ">" in the img to a "/>" shortly - thanks.

A lot of the layout is generated programmatically - a long time ago I wrote a tool that takes a description of a page and spits out the table formatting. It then populates the cells with the contents of the requested file. Specifically, when fed with this:

       AAAE
       AAAE
       CCDE

it will generate the table layout and put files A.phtml through E.phtml in the places requested. Makes laying out pages like this trivial. Ish.

I think I've worked out what Opera was doing. For each image I'd asked for a height of 120. It correctly scaled the image, but scaled the cell horizontally for the original size, or something similar.

I now also have some css, but it's not being rendered correctly by all browsers. However, it's pretty good on several, so I'm going to work more on content this afternoon. Steve (my mother-in-law) has several more pictures to add to the list.</comment></comment></comment></comment>


Humio raises $9M Series A for its real-time log analysis service - <AUTHOR> <comment><USER2> Link to TechCrunch story: [https://techcrunch.com/2019/01/24/humio- raises-9m-series-a-f...](https://techcrunch.com/2019/01/24/humio- raises-9m-series-a-for-its-real-time-log-analysis-service/)</comment>


Rhodecode - Setup and manage unlimited Git & Mercurial repositories with ease - <AUTHOR> https://rhodecode.com/

<comment><USER2> Oh, they even do Mercurial. I love hg, so we'll see if they are cool.

<comment><USER3> They started with hg, then added git (or GIT, as they call it).

</comment></comment><comment><USER4> Looks like a private beta registration page is running

</comment><comment><USER5> I'm happy we're finally doing this !

<comment><USER4> Wish you good luck!

</comment></comment><comment><USER6> On my own hardware?

<comment><USER3> Sure, if you want!

[http://rhodecode.org](http://rhodecode.org)

But why not pay someone so that they can handle the hassle of setting things up and babysit the server for you?

<comment><USER7> Exactly, that was the idea behind the hosted service :)

The inhouse-version of RhodeCode is already used in thousands of companies all around the world but it still requires admin work, own servers and a deep understanding of the topic.

The hosted service instead makes it so much easier to get up and running with RhodeCode and opens RhodeCode to a broader audience.</comment></comment></comment>


Interview with Cindy Gallop - Super smart but nuts - <AUTHOR> http://howtowriteabusinessplan.com/2012/09/interview-with-cindy-gallop-founder-of-ifwerantheworld/ <comment><USER2> Obviously, I consider this a highly flattering comment :)</comment>


Show HN: Sleep Easy – App to easily track sleep for better health - <AUTHOR> https://sleepeasyapp.com <comment><AUTHOR> Hi,

Creator of Sleep Easy here. I created this app for my own purpose and it has really worked well for me so far. Just thought of sharing it in case if it is useful for others. Feed backs are highly appreciated.

</comment><comment><USER2> Why do you need so much permissions?

Do your app really needs:

run at startup

draw over other apps

read phone status and identity ?

<comment><AUTHOR> Thanks for checking out. 'Run at startup' is needed to schedule sleep reminder notification and to restore notification when the phone is rebooted. I'm not entirely sure on why the other two permissions are being asked. This project is bootstrapped with React native, and may be it is default from that platform. I will check on this.</comment></comment>


Open source android BT software - <AUTHOR> https://github.com/frostwire/frostwire-android FrostWire for Android will let you search and download files from the BitTorrent network and it will let you share files with other FrostWire for Android devices on the same local network (via WiFi)
The local sharing happens through a simple JSON/HTTP protocol (still to be documented, you can look at how it works on the code for now, very very simple)
We'll put the specs of this protocol out for you to implement clients in your favorite platform, this way you will be able to browse, stream media or download files that FrostWire for Android users have decided to share on the local network.
FrostWire for Android also features a simple media player that we'll be evolving with future releases. <comment><AUTHOR> FrostWire for Android will let you search and download files from the BitTorrent network and it will let you share files with other FrostWire for Android devices on the same local network (via WiFi)

The local sharing happens through a simple JSON/HTTP protocol (still to be documented, you can look at how it works on the code for now, very very simple)

We'll put the specs of this protocol out for you to implement clients in your favorite platform, this way you will be able to browse, stream media or download files that FrostWire for Android users have decided to share on the local network.

FrostWire for Android also features a simple media player that we'll be evolving with future releases.

Downloading FrostWire does not constitute permission or a license for obtaining or distributing unauthorized files. It is illegal for you to distribute copyrighted files without permission.</comment>


Are Hacker News Job Postings Successful? What Is a "Rock Star Developer"? - <AUTHOR>

Everyday I see Hacker News job postings, are they successful?  Usually they are looking for the "Senior Rock Star Developers", or they are offering crazy benefits.  I also notice some of the same companies reposting pretty often.  Does that mean these companies are having trouble keeping people as employees, or they are just expanding that fast?   I'm a pretty new developer, 1 1/2 years of professional experience at the same company.  I have no plans of leaving my current company, but I just wonder what exactly a "Rock Star developer" is? <comment><USER2> Rock Star developer is a legend about a guy you hire.

He is the one that closes all the issues so fast you can't believe it, writes clean code, writes the documentation, and then refactors some ugly piece of code on the other end of your app/site into something beautiful.

Every team member understands his code, yet don't know how to implement it, especially in that short time. He does code reviews, writes tests, finds ways to make your site/stack/app/build process better, faster, cheaper, safer. And he does all of that 10x faster than other devs. So when he's out of work, he writes blog posts and conference talks and everyone claps and follows him on twitter and sends him linked-in requests and knows your company because he works there. In his free time, he contributes to open source, works on side projects and his github profile shows full green. You're probably using his libraries.

He's that creature of myth created by the internet that every PM wants to work with, every CTO wants on his team and every recruiter chases. The ever eluding white rabbit of development.

<comment><USER3> This was so well written

</comment></comment><comment><USER4> Coincidentally, right now there isn't a single post asking for rock stars on the jobs page. They are like "X Is Hiring Ruby Developers".

</comment><comment><USER5> 1\. White Male.

2\. Preferrably went to some elite college.

3\. Previous founder or has a passion for startups

4\. Is popular on sites like github with 100+ followers

that's the standard, don't expect a reply unless you fit all of these things.

<comment><USER6> I've found two jobs in the Who's hiring thread twice, both of them remote! And I'm not even in the US. Out of your list, I only meet the "White Male" criterion.</comment></comment>


Ask HN: What is augmented reality? - <AUTHOR>

I somehow missed the bus and have no clue what is augmented reality. And for the past two days, I've been noticing a variety of posts regarding augmented  reality or augmented reality apps.<p>What exactly is it and what are it's applications? <comment><USER2> Augmented reality is a description of devices that overlay (or even replace completely) your view of reality with information from a device.

Examples are cellphone applications that show data layers when pointing the cell phone at a scene and looking 'at' the scene through the lens of the phone, but similar (or even better) effects could theoretically be achieved by displays in glasses or by projecting straight on to the retina.

For a demo of current applications have a look at 'layar', there are plenty of other groups busy in this field.

</comment><comment><USER3> AR technology aims to augment a real world scene with additional data.

From a real world scene, for example a camera image, you first work out the 3D coordinates. Then you can draw your own object (comic, text, 3d graphics....) in this 3D space.

[http://www.technotecture.com/content/mobile-augmented- realit...](http://www.technotecture.com/content/mobile-augmented-reality-sstt- mobile)

In this video printed border on the visiting card is used to workout the 3D space (it is easiest to use specially printed markers). However AR tech also works with natural objects like a street.

Though the tech has been there for sometime, it seems that mobile phones equipped with cameras and web connection are best way to bring the tech to masses.</comment>


Infinite Super Mario AI Source Code - <AUTHOR> http://www.doc.ic.ac.uk/~rb1006/projects:marioai <comment><USER2> Essentially, someone wrote a game that allows you to play randomly generated Super Mario levels of arbitrary difficulty, and the contest was to write an AI that gets as far as possible on those levels, in real time. This is the winning entry.

(They actually ran two separate contests, but the videos of this agent were released around the time of the first contest, which I think would have discouraged new entrants for the second. Independently, the video went viral in Japan and picked up half a million views.)

<comment><USER3> _Independently, the video went viral in Japan_

This doesn't surprise me; Japan has a long internet tradition of Mario-related hacks. One example is the "automatic Mario" videos, specially-crafted Mario levels that are set up such that they will complete automatically if Mario moves continually to the right, and the sounds created will match the background music. A particularly impressive example: <http://www.youtube.com/watch?v=OM0ib4GxLPw>

<comment><USER4> That video of "automatic mario" is absolutely amazing. It boggles my mind just thinking about how much time that must have taken.

And to anyone who didn't check out that link, it's definitely worth watching. If you're not interested in the whole thing (eleven minutes) I recommend starting right at 8:00.

<comment><USER3> And if you like that one, just check the related videos tab for more, like <http://www.youtube.com/watch?v=zt8upKaWzy0> and so forth.

</comment></comment></comment></comment><comment><USER5> The highlight of this post was discovering the WTFPL, although the videos in slow motion of mario following the mouse were pretty incredible.

</comment><comment><USER6> 10 Jump

20 Goto 10

</comment><comment><USER7> There's something fishy about that. It seems unlikely that even a perfectly intelligent bot could, for instance, never have to wait for the flying turtles to line up (as when bouncing across a chasm). They're just always there in the perfect arrangement when mario gets to them.

<comment><USER8> I'm not quite sure what you're saying, but it's worth mentioning that the levels generated by the engine are rather simple. For example, there are never any gaps so wide that they can't be jumped across easily, so no fancy bouncing needed.</comment></comment>


Modeling a Wealth Tax - <AUTHOR> http://www.paulgraham.com/wtax.html <comment><AUTHOR> Paul leaves out one fo the most important numbers in this model.

The threshold. EW's proposed wealth tax only applies to the money you have above $50M.

You can argue it's bad policy, but it seem pretty disingenuous to argue that being taxed on the amounts they earn above $50M would be demotivating for founders.

<comment><USER2> I think the argument is really people would just leave said state. I know I would, even if there isa high threshold.

California is trying to put forth a law that will apply wealth taxes 5 years after you leave. No way am I going to risk moving to California then, when Texas has much fewer taxes and ones that aren't applied _after I leave_</comment></comment>


Why Happy People Cheat - <AUTHOR> https://www.theatlantic.com/magazine/archive/2017/10/why-happy-people-cheat/537882/?single_page=true <comment><USER2> _Priya's affair is neither a symptom nor a pathology; it's a crisis of identity, an internal rearrangement of her personality. In our sessions, we talk about duty and desire, about age and youth._

and...

 _" "You think you had a relationship with Truck Man," I tell her. "Actually, you had an intimate encounter with yourself, mediated by him."_

This article (and others like it) make me kind of think that (A) much of psychology should not be treated as an objective science (2) Objective science is not the only useful contribution. Therapists don't have to be scientific.

People get a lot of relief from being able to narrate their life and their feelings. They find beauty or comfort in exploring motivations (from a subjective POV). It can be liberating (and effective) to act within a narrative, to have names for things. A lot of our best art is dedicated to this sort of thing, especially romantic literature.

For abstract truth, I don't think most of this article describes it. In the abstract, I think the answer to the question is simple: (1) People (on average) are semi-monogomous, like a lot of animals. (2) It's hard to use cultural conventions to restrict people's sexuality. see exhibit I "The Gays."

That doesn't mean that a therapist should just tell this lady "you were just horny."

</comment><comment><USER3> It's simple.

Some people value an exciting encounter over their current relationship, people can have an addiction to the rush or have felt numb for too long.

Over simplifying - there's nothing wrong with their current phone but some people will rush and buy the latest to get the buzz of a new gadget.

They weigh the chance of getting caught and damage it will cause as lower than the excitement and fulfilment of a new fling.

We've all been there, seeing someone attractive from the opposite sex and having thoughts of an encounter. Whether you chose to act on it or not depends on your integrity and empathy. Some people have more than others.

<comment><USER4> I just want to give a name to this for whoever want to Google more: novelty seeking.

<comment><USER5> I think it's part of how we're wired. Some people more than others. To seek that dopamine hit again.

</comment></comment></comment><comment><USER6> Yeah, it might be able self discovery, but it might be about enacting a narcissistic fantasy. The author is right, you reconstruct yourself in the other's gaze, you slake your thirst with the other's mouth. But what kind of self are you constructing here? And what power will your own fantasies have over the person with whom you conduct the affair?

<comment><USER7> Yeah, I don't think the normalization of this obviously selfish and destructive behavior is a positive thing at all.

<comment><USER2> The selfishness and destructiveness of the behaviour is very closely related to the norms it violates. Homosexuality was (and is) destructive to families in communities where it considered abhorent. Premarital sex too. In fact, the ban on premarital sex and the ban aon adultery are closely related.

People have a hard time suppressing their sexual urges. But, many sexual urges we once considered immoral & destructive are now seen differently.

</comment></comment></comment><comment><USER8> The reason it's ostensibly confusing is that the standard narrative of human sexuality—one sexual partner for life after getting married—is, forgive me, completely batshit insane. That's not to say that people haven't done it. People do, of course. And that's not to say that that's wrong or something, either. But the _expectation_ of total 'fidelity' for life is unreasonable.

For more on this subject I recommend the book "Sex at Dawn."

<comment><USER9> I think it's a waste of breath to promote or condemn one mode of relationship over another. All that matters is what you and your partner(s) agree on for the terms of your relationship.

<comment><USER8> Of course. But the problem is the _expectation_ at large in the macroculture (I'm speaking largely of American macroculture, where I live) of monosexuality by participants of all sexes. In other words, it's a sociocultural problem. Are there people who have figured out how to escape it? Yes, but still a minute fraction. Furthermore, the judgement those people (myself included) face by family and sometimes friends is another part of the problem.

<comment><USER9> Agreed about the real problem being societal. My point was that claiming that humans are "meant" to be monogamous or polygamous or whatever is an empty debate when we have free will and can decide for ourselves what sort of relationship we want.

</comment></comment></comment></comment><comment><USER10> > there is always a suspicion … that one is living a lie or a mistake; that > something crucially important has been overlooked, missed, neglected, left > untried and unexplored; that a vital obligation to one's own authentic self > has not been met, or that some chances of unknown happiness completely > different from any happiness experienced before have not been taken up in > time and are bound to be lost forever.

In my opinion this quote sums up not only the thesis of the article but also one of the primary diseases afflicting our society.

<comment><USER11> I tend to agree, but I think it's pretty deeply rooted, and it's _not_ a new thing by any stretch. I reject the idea that this is somehow a particularly modern dysfunction.

As children and young adults people are taught to "pursue their dreams" and "find their passion" and many other aspirational platitudes.

Then, adult life comes along and most of us become decidedly average because, well, that's statistics for you.

But many are then left with this feeling that they've somehow failed. That if they'd taken that other road that diverged in that wood a ways back, maybe they'd be living that fantasy life that they were sold.

What we're not taught is how to be happy in the present. Aspiring to change is vital to improve ourselves and the world around us. But equally valuing and appreciating what we already have is every bit as important.

<comment><USER10> Hm, well, I think it is fair to say the cult of the individual has a pedigree a few centuries long, but it seems to me like the collapse of groups and institutions (everything from religion to social activities like bowling leagues, really) and generally more atomized relationships have removed the fetters preventing it from reaching its most extreme expression. I guess this claim risks veering into "things were better in the good old days" which isn't really what I mean.

<comment><USER11> Yeah, I dunno about that.

Groups and institutions are great for creating additional social pressures that discourage people from violating morays. But unless you couple that with a fundamentally different set of values, I don't see how they are a solution. If anything, they create additional strictures that encourage the kind of rule-breaking behaviour the article talks about.

<comment><USER10> What I'd say is that such institutions help temper the view that the self and short-term utility for the self are the ultimate good.

<comment><USER11> Again, that presupposes a different set of values.

Consider common American Evangelical beliefs that focus on praying for specific material or personal gain (such as good health). This is nothing more than religion blended with "the cult of the individual". As such, I have little reason to believe those institutions would create better outcomes.

<comment><USER10> I think in all but the most extreme cases, even then, there will be an interest in the health and well-being of the whole community, prayer lists for parishioners who are ailing, and so on. Perhaps not for the TV guys who preach out of converted sports arenas but I think it's a little questionable if that really represents a community.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> This is an interesting documentary regarding different relationship structures from the independents themselves. [http://www.imdb.com/title/tt4716560/](http://www.imdb.com/title/tt4716560/)

</comment><comment><USER13> Maybe because the idea you can romantically love only one person is idiotic?

You can love more than one sibling, more than one parent, more than one sports team, more than one... you get the idea. Yet, when it comes to romantic love, nope, just the one.

</comment><comment><USER7> Because shitty people can still be happy people.

</comment><comment><USER12> This is interesting, a old friend once said: "If a woman wants to cheat on you. She will cheat on you while holding your hand"

Now that the chauvinist statement is out of the way. Men cheat too. :)

I don't think anyone can say that monogamy has anything to do with raising children. I do not see why the barbarous requirement for having sex with one person needs to even be there in the first place. I don't have the same car for the rest of my life, don't drink the same thing or eat the same thing every day for the rest of my life either. Why not be able to taste other flowers in the garden as well. That does not mean i don't love or care about the mother of my child. As long as i take care of my responsibilities regarding my children. I see no reason why this requirement is imposed by society. Other than pure culturalism and brainwashing, which one could argue is indirectly the same thing.

Maybe it has something to do with possession. Maybe insecurity that my wife will like John's dick more than mine or love his Porsche more than my Buick. Don't you want to find that stuff out early about your partner vs later... Isn't your partners ability and her/his care for your children more important than who he/she wants to screw every once in a while. I definitely agree that if your partner is a nympho, well maybe you should not have stuck your dick in crazy to begin with or pretend to embody the white knight syndrome to it's full extent.

I think this "monogamy" business matters way more when the people in the relationship are unequal to begin with. If they are equal , financially for example, which i feel matters a lot when you are co-raising your children. You do not feel as betrayed because, as far as your hard earned resources are concerned, she/he is not taking any, only the children are. So who cares who your partners wants to screw in their off time. Which leads me to think of the next possibility, possession. My oh my, this person is mine and mine only. Lol It's 2017, we do not hit women over the head with cave man bats and drag them to our layers. But in some countries i guess we still do and we expect them to shut up when we tell them to and bring our beers over to the couch or else they won't get the credit card the next time they go to the mall. Wait, i just realized i just described some people i know. :) There are only a few feedback loops you can take advantage of. Lol

Parents can parent without marriage or monogamy. Why can't they?

This is leftover idealism imposed by the church and land-rights interest groups from ages ago. It just so happens it was enforced and people attempt to adhere to it. But obviously the statistics are against their success. The more women become equal and educated. The more divorce there is and the less babies get born. If those things are happening, i don't see any reason why changes in the family structure should not happen as well.

Usually a systems homeostasis usually communicates something about the nature of it's processes. The divorce rates should tell us something. Now that the gloves are off regarding divorce being taboo or being shunned by your social circle, this is if you are living in a country which does not look down on you if you don't want to put up with your partners bs anymore and leave. If you do, well clearly you are living someone else's life.

</comment><comment><USER14> I sought professional help to deal with life influencing jealousy and doubts.

What helped me deal with this, is to find out that I undervalued myself and overtly dedicated myself to my partner.

Once you don't view your life as the relationship, but you and your relationship, u will be on a good track.

Most people will notice that if they meet a cute someone and don't see them for a few days, they don't occupy themselves with all these doubt too much.

It's when you sacrifice or throw a big part of yourself onto pleasing the other within an ensuing relationship, is when you lose yourself and become insecure and doubtfull.

</comment><comment><USER15> One is enough for gods sake

</comment><comment><USER16> Oh so people get bored with just one partner for their entire lives? Shocker.

<comment><USER17> This was a long essay that could have just been summarized as "Priya's bored".

</comment></comment><comment><USER18> I'm surprised by the moralistic comments and downvotes...

EDIT: I removed the rest of the comment as it apparently offended many people.

<comment><USER19> _" And I would be fine if my partner saw someone else too."_

So why _cheat_ then and not talk to your partner openly and come to an agreement? I know plenty of couples that let each other to have other partner(s), and that's totally normal. Playing with another human being feelings, on the other hand, is not imho.

</comment></comment><comment><USER20> I wish social experimentation and progress happened at even 5% of the speed of technological progress.. why don't we just get rid of the idea that you 'own' your partner's body? It seems arcane and based in insecurity. If you can't handle even the slightest of erotic competition, how solid can the basis of your relationship be?

(Sorry for the overly controvesial wording if my post, I realize that filing more open relationships under 'social progress' is not obviously right, and would love to hear alternative perspectives, especially from people in stable happy long-term relationships)

<comment><USER21> When I look at polygamous/polygynous societies today and in history, I'm not sure I see "social progress."

In fact, for whatever its pitfalls may be, it appears that monogamy solves a large number of social ills that are perhaps larger than polygyny's own. Like large bands of males cast out with no prospects, so they resort to not-so- progressive behavior.

Like the vikings: 'Polygyny created a pool of unmarried men motivated to engage in risky behavior to increase wealth/status/prob of entering marriage market'

[http://www.ehbonline.org/article/S1090-5138(16)30307-5/pdf](http://www.ehbonline.org/article/S1090-5138\(16\)30307-5/pdf)

Or the Lost Boys: [https://en.wikipedia.org/wiki/Lost_boys_(Mormon_fundamentali...](https://en.wikipedia.org/wiki/Lost_boys_\(Mormon_fundamentalism\))

Or certain other religions and tribal areas that may promote such behavior today as a side ffect, which may promote other lost boys to, I don't know, join ISIS in hope of getting some of those dear wives of their own too, one way or the other.

Perhaps you file this under "not my problem." Maybe its not your problem, but it definitely presents a social problem, and you're suggesting that poly-* may be social progress. I don't think that plays out in history.

<comment><USER22> > it appears that monogamy solves a large number of social ills that are > perhaps larger. Like large bands of males cast out with no prospects, so > they resort to not-so-progressive behavior.

So the acceptable "solution" to this imbalance is to socially force (through normalization of monogamy and marriage) women into relationships with less- desirable men? Why shouldn't men be expected to be more attractive mates? Why not blame the patriarchy for creating a power imbalance that favors polygyny over polyandry?

EDIT: For those doubting that patriarchy plays a role, consider that both the Mormon [1] and Arabic [2] worlds have historically been strongly patriarchal. I don't know about the Vikings.

[1] [https://en.wikipedia.org/wiki/Mormonism_and_women](https://en.wikipedia.org/wiki/Mormonism_and_women)

[2] [https://en.wikipedia.org/wiki/Women_in_Arab_societies](https://en.wikipedia.org/wiki/Women_in_Arab_societies)

<comment><USER23> >> So the acceptable "solution" to this imbalance is to socially force (through normalization of monogamy and marriage) women into relationships

If you read into polygamous societies, it's often that (particularly very young) women are forced into relationships with socially powerful men. Not much to do with attraction.

<comment><USER22> To me, that sounds like a problem caused by patriarchy or other power imbalances: in many societies, men have great power (earning potential), women have little, and hence are forced to marry (preferably the richest man) to gain power.

Of course you can address the symptom (women choosing the wealthier/more powerful men, leaving the men who are less-so without a mate), but the underlying disease remains: womens' choice whom to marry is hampered by lack of societal standing.

Better to address the disease (patriarchy). Women are no longer forced to marry "up" (addressing the power issues polygyny belies); men no longer are forced to focus on being earners, so those who would be low-status under patriarchy (due to lack of earning potential) can instead focus on developing other traits (e.g. homemaking) which would make them attractive to female earners.

<comment><USER23> I don't think you've quite understood my last comment.

It's not really about men being high earners or having some sort indefinable social capital that makes women "marry up" in most examples of polygynous cultures AFAICT, it's literal force. It's not women choosing to marry the man with the most power or wealth, it's cultural and religious forced marriage, on threat of ostracism, familial disgrace or much worse.

Yes, it is a problem caused by patriarchy, they tend to be highly patriarchal societies, the ones where men routinely have more than one wife.

<comment><USER22> > It's not women choosing to marry the man with the most power or wealth, it's > cultural and religious forced marriage, on threat of ostracism, familial > disgrace or much worse.

No, I get that – my point is, there's not much difference between social pressure to marry someone wealthy because you were not raised to be a breadwinner and thus would starve if you didn't marry up, and social pressure to marry someone in high social standing because you'd be ostracized otherwise. Social pressures that prevent women from _gaining_ power and thus being forced to marry to get it, are not that different from social pressures that explicitly force women to marry powerful men.

> Yes, it is a problem caused by patriarchy, they tend to be highly > patriarchal societies, the ones where men routinely have more than one wife.

Which is exactly my thesis: patriarchy is the _cause_ , polygyny is the _symptom_. Applying a band-aid of normalized monogamous marriages to ensure mates for low-status men (as the GP insinuated) addresses the symptom, and ignores the cause.

(You see the same thing with prostitution BTW – prostitution is "bad" because it places desperate women in a position where they are taken advantage of by clients. But banning prostitution doesn't fix anything – you still have women who see no other earning potential than selling sex. The real problem is patriarchy that creates such a large class of women with no independent earning potential in the first place. Fix that, and the problem of prostitution-from-desperation diminishes greatly.)

<comment><USER23> >> No, I get that – my point is, there's not much difference between social pressure to marry someone wealthy because you were not raised to be a breadwinner and thus would starve if you didn't marry up, and social pressure to marry someone in high social standing because you'd be ostracized otherwise.

Sorry there's a f*ck of a lot of difference between choosing a partner that's a breadwinner, and being put through a forced marriage.

>> Social pressures that prevent women from gaining power and thus being forced to marry to get it, are not that different from social pressures that explicitly force women to marry powerful men.

They are significantly different in consequence, IMHO, even if the cause is different only in matter of degree.

>> Applying a band-aid of normalized monogamous marriages to ensure mates for low-status men (as the GP insinuated) addresses the symptom, and ignores the cause.

I don't consider that a band-aid particularly, it seems something a lot of people want out of life, and the question of "status" somewhat orthogonal. I also don't think the parent post advocates any sort of enforcement of this, but just looks at outcomes.

<comment><USER22> So you really believe that physical coercion to marry high-status males is _caused by_ (i.e., is an "outcome" of) the practice of polygamy? Forced polygyny does not just _happen_ , someone has to have the power to force it. That someone exactly he who benefits from the practice: _high-status men_ – by definition, the patriarchy.

Is being physically coerced to marry someone worse than being economically incentivized to? Of course, I'm not arguing that. Is being formally ostracized for refusing to marry someone of high status worse than being informally ostracized for refusing to marry someone of low status? Yes, but by degrees. Yes, you can replace formal ostracism with informal ostracism by normalizing monogamy, but it's still going to happen so long as a patriarchal power imbalance remains in place.

(Doubt that informal ostracism happens? Women who choose not to marry have historically been excluded from mainstream society in western society. Hence the trope of the isolated spinster/widow, and the prevalence of prostitution as a means of earning for women who choose to stay single.)

<comment><USER23> >> So you really believe that physical coercion to marry high-status males is caused by (i.e., is an "outcome" of) the practice of polygamy?

No, I believe that when we look at historical or contemporary examples of societies or sub-cultures in which polygamy is practised, we tend to see forced marriages. I'm not saying either is the cause of the other, but that they are associated, and I agree very much that they both take place in highly patriarchal societies.

I'm also not sure why you keep talking about status and what your issue is with people choosing monogamy. You don't have to if you don't want to, and it's no longer the case that a woman can't support herself adequately.

<comment><USER22> > I agree very much that they both take place in highly patriarchal societies.

Then why are we arguing?

> what your issue is with people choosing monogamy

I have no such issue? You are putting words in my mouth. Perhaps this is why we are arguing.

All I take issue with is the GP's assertion that polygamy is the cause of the "lost boys" problem. I claim it's not, patriarchy promulgated by high-status males is. Remove polygamy and all you've done is democratize power among males, without addressing the problem of patriarchy. Remove patriarchy and polygamy is no longer problematic.

> it's no longer the case that a woman can't support herself adequately.

Western society has made strides in that direction, yes. And beside the decrease in social ostracism of single females, it is argued that the rise of feminism has driven the rise in consensual polyamory [1], supporting my above point.

[1] [https://en.wikipedia.org/wiki/Polyamory#Philosophical_aspect...](https://en.wikipedia.org/wiki/Polyamory#Philosophical_aspects)

<comment><USER23> >> Then why are we arguing?

I'm not really sure.

>> All I take issue with is the GP's assertion that polygamy is the cause of the "lost boys" problem. I claim it's not, patriarchy promulgated by high- status males is.

I'd say it's an intermediate cause, or even an immediate cause and the patriarchy is at the root of it in all examples that we have to look at. If, somehow, consensual polygyny became the norm then we could end up with some of the same societal problems re: pools of unmarried/unattached men.

>> Remove patriarchy and polygamy is no longer problematic.

Well sure, no longer problematic in as much as no longer forcing people to marry others, but it may still cause societal problems. I'm not advocating it be outlawed for those reasons, FYI, just looking at possibilities. I do think it's fairly unlikely that widespread polygamy would happen outside of the patriarchal constraints, and certainly I'm not sure I know of any examples of polygamous societies having existed without such.

Polyamory is a different beast entirely of course.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> So affairs are 'wrong', but who would want to live in a world where there are no affairs?

We excessively police and punish our partners, our friends' partners and our parents, but often hypocritically, when it comes to ourselves and our friends cheating will generally be forgiven.

I am not even advocating abolishing the hypocricy. Without it affairs probably wouldn't be exciting and equally, faithful relationships wouldn't be as meaningful.

What is more, having broken up a long term relationship with children (with objectively plenty of cause), and having not had an affair what I can say is that for a woman this can be even worse, as it leaves them without something to be mad and and just feeling unvalued. (It probably goes both ways for both genders, but in my view it is something that is clearly not symmetrical in Male-Female relationships).

However what I do think is wrong are ill feelings to the point of death threats and hatred (which I experienced) even if there is infidelity. In this situation can someone really claim to have loved someone in the first place if they value their life outside of the relationship so little. When this is the basis of someones feelings then the relationship/marriage is a kind of tyranny in my opinion.

<comment><USER25> Yeah, that's crap.

Let's translate that philosophy to other "wrong" activities, shall we?

"Spending money is more exciting when it's stolen. Saving is much more meaningful if there is the possibility that someone can steal it."

"Life is more meaningful when someone is actively trying to kill you. Murder is much less exciting because it's wrong."

You see the problem? The notion that actively doing something awful to someone else makes what they have meaningful, and what you are doing exciting is just selfishness and justification.

You don't like monogamy? No one is forcing you into it. Unhappy with your [life | partner | marriage | whatever] and you think the answer is outside your agreed upon monogamous relationship? End it. Divorce is legal. Breaking up without marriage is even easier. There is no tyranny is a relationship you enter into of your own volition.

You have children? Don't be an asshole and hurt their other parent because you have issues. End the relationship before starting another one. Be the person your children can respect.

The other person in the relationship? Don't be that. Because you are being a party to deceit. No, you aren't the one cheating, and that justification only goes so far, but it still shows a base selfishness that informs your character. You ought to expect to be hated, because that weakness and selfishness that makes up your character is the instrument that harms someone else. In the pain that is being caused, you are the weapon that is being used by the person cheating to hurt their partner.

<comment><USER24> Yes, but I am speaking as someone who did just break up with someone. Amazing how noone can actually read that part and just jumps to long ranty insults. Confirmation bias is going to be especially common if you delete words when as you read. (I assume you are addressing me when you say 'you' this and 'you' that).

The reality of my case is (well it's a complicated story) that it may well have gone better for them psychologically if there was a clear betrayal on my part. Maybe mine is an extreme case, and in anycase knowing what I know wouldn't have made me cheat - I would rather be in the right - but then again it's easy to say that ...

Everyone seems to be taking such an absolute position. Which is ridiculous really since it really is culturally relative e.g. in france they are much more permissive of affairs - with certain thrown in social conditions about being discreet - and again it is not to say they are saying it is right - neither am I, just that it is not such a huge bad to deserve all the vitriol - like I'm getting for even discussing the matter.

What is clear is I would never make promises to people with such puritanical attitudes like yours. Clearly it would be a one sided contract since I would be much more forgiving and less entitled and on top of that given the way of hypocricy quite possibly less likely to cheat. Again, if I may argue by analogy, like the anti-gay politicians who are gay, I wonder wether the people who are so anti-affair are infact liable to do so or have done so themselves.

Of course there can be tyranny in a voluntary relationship, because you cannot predict the future and you can be bound (by e.g. caring more about the children, or social pressure) to suffer.

Some people are fools when it comes to relationships. They may know there partner cheated in the past, they may know they have generally sexually permissive attitude and are unreliable with their promises. Yet the outrage is still there nonetheless. You cannot make something into something it is not. I may as well get outraged if my partner doesn't become a millionairre or doesn't look like a supermodel after a certain age.

And just because you can make analogies, doesn't make it right. Somethings are better (for some people) with some danger of a bad outcome. e.g. Extreme sports. Yes, I just don't think you can equate murder or theft to having an affair. Both are actions against a stranger. Now if one partner misspends a large sum of shared money then that is an ambiguous situation which is worth comparing.

</comment></comment></comment><comment><USER26> Just be polyamorous (see e.g. [https://polyfidelity.org.au/about/polyamory/education/121-th...](https://polyfidelity.org.au/about/polyamory/education/121-the- diversity-of-love-relationship-concepts), [http://slatestarcodex.com/2013/04/06/polyamory-is- boring/](http://slatestarcodex.com/2013/04/06/polyamory-is-boring/)).

If there is a need to have multiple partners instead of going the "traditional way" (one official partner + cheating or some shady don't ask don't tell arrangement) it seems much healthier to openly discuss needs and boundaries. We shouldn't just accept "system defaults" if they are not optimal for us.

In my local poly community (Warsaw) there is a lot of nerds. I tend to view it as a hacker's approach to relationship.

<comment><USER3> What do you do when someone gets pregnant?

<comment><USER23> From the poly relationships I have observed - you talk about it with all involved, have a discussion about how the kid's going to get raised etc etc. It can get complicated depending on who is living where and such stuff. But then AFAICT everything in poly relationships takes quite a lot of thought and planning.

I think contraception and planning when you're going to have a kid and who with becomes even more critical.

Too much effort for me!

</comment></comment></comment><comment><USER27> Infidelity is as natural as taking a shit. I think we're culturally indoctrinated to get worked up over infidelity, less so for defecating.

</comment><comment><USER28> TLDR; It is possible to like more than one individual.

I for one doesn't understand why anyone would marry except for economical benefits/security.

Personally, I would much rather have 2 or more girlfriends/partners who enjoy me and eachother than a marriage with one. Since I believe that the male sex drive is bigger than that of women, I don't understand why I should be limited to just enjoy one other woman. However, this is hard to do because many women like the idea of marriage and have this impossible romantic view of the world. Love is not static, sometimes you love someone more and sometimes less. This changes over time just like everything else. But in our upbringing we learn from movies and our culture that love should be this static, non-changing thing and of course it will not work in a world that changes all the time.

A lot of marriages fail, probably because people change over time and we don't always like that. Let's just be more open and enjoy ourselves when we have such a short time alive.

EDIT: I understand that my opinions can be controversial, but you don't really have do downvote just because you do not agree with them.

<comment><USER29> _I would much rather have 2 girlfriends /partners_

There always seems to be at least one partner in these relationships singing their praise through gritted teeth.

<comment><USER28> I have no experience of such relationships so I cannot really say anything about it except that I want one :)</comment></comment></comment>


Electr, a language for electronic formulas - <AUTHOR> https://github.com/lkdjiin/electr

<comment><USER2> Interesting idea, particularly the prompting for uknown quantities, but GNU units already does a pretty good job of this.

[https://en.wikipedia.org/wiki/GNU_Units](https://en.wikipedia.org/wiki/GNU_Units)

Calculations aren't quite as short as "1mA 3K", but pretty close to it.

        You have: 1mA 3kohm
        You want: V
                * 3
                / 0.33333333

It has long and short SI prefixes, scientific notation, implicit multiplication, and a history dating back to Unix itself.

By the way, one of the example calculations (calculation of 205 Hz) is too high by a factor 10.

        You have: 1 / (2 pi 0.5microF sqrt(11kohm 22kohm))
        You want: Hz
                * 20.461734
                / 0.048871712

<comment><AUTHOR> Thanks, I should check GNU Units… (and the calculation is now fixed on Github)

</comment></comment><comment><USER3> As a student, I've found the TI-Nspire CAS software to work pretty well with units, but of course it's not free.

[https://education.ti.com/en/us/products/computer_software/ti...](https://education.ti.com/en/us/products/computer_software/ti- nspire-software/ti-nspire-student-software/tabs/overview)

<comment><USER4> Sorry for the accidental downvote, I actually wanted to upvote :(

</comment></comment><comment><USER5> That has probably a lot of overlap with Frink [https://futureboy.us/frinkdocs/](https://futureboy.us/frinkdocs/), though after a quick try the output could be nicer, e.g. like described in this document.

<comment><AUTHOR> Thanks for pointing this one. I don't think java is the right tool for what I have in mind (because of the JVM overhead) but I'll definitely try Frink.

<comment><USER6> We could reimplement it in js to freely mix and match with other js based languages.

</comment></comment></comment><comment><USER7> Not command line (or open source), but we've built most of this capability and more into CircuitLab [https://www.circuitlab.com/](https://www.circuitlab.com/) (disclosure: I'm one of the developers) -- we have to manage units, metric prefixes, all sorts of arbitrary expressions [https://www.circuitlab.com/docs/expressions/](https://www.circuitlab.com/docs/expressions/) , real and frequency domain, etc. We also have schematic-wide parameters, the ability to define functions of those parameters to set component values, and/or to set real-time arbitrary behavioral voltages and currents within the circuit graph, etc. On top of that, iteratively solved non-linear feedback systems, Laplace-domain filter notation.... It gets complicated fast!

One of the cool things about understanding circuits and simulation is that you can use the same concepts and tools to model non-electronics-domain problems: thermal systems, mechanical systems, etc. You can combine these, too: for a simple non-confidential example, we recently did modeling of the fusing of tin whiskers, which involves solving the electrical and thermodynamic properties at the same time.

<comment><USER8> (not-related) I'm happy that you show my twitter post on your homepage. I do love using circuitlab.

<comment><USER7> Awesome -- thanks so much for that! It always makes it a happy day in the office when we hear from happy users :)

</comment></comment></comment><comment><USER9> Why can't Electr detect unit K form "10K + 200"? It's the only unit present in the equation.

Why kilo-ohms are denoted with "K" while milliamperes are using the proper SI unit "mA"? Why not to use "Ω" and "kΩ"? We have that symbol in high ASCII.

Probably just my ignorance of programming language design speaking but I really have to ask.

<comment><USER10> In practical engineering (on circuit diagrams, bills of materials, etc), you almost never see the "Ω" symbol. "K" is used for kΩ, "M" for MΩ, and "R" for Ω (as in 330R is a 330Ω resistor).

It's nothing to do with programming language design.

</comment></comment><comment><USER11> Nice idea. Unit handling can be hard though, there are several problems that you can bump into:

\- It's not always evident what unit you want show after a calculation. (As/Vm or C/Vm, kV/m or V/mm)

\- You should handle fractional power of units (like V/sqrt(Hz))

I recently discovered orpie and that one has unit handling. It has electrical (and all sort of physical) units and handles both of this problems fairly well. For the calculation result's unit it uses the one that comes evidently from the source terms (1kV* 0.5mA=0.5kV* mA), then the user can convert it to other equivalent units or to SI base units. It's an RPN calculator so one has to get the hang of it.

Edit:

Oh, electric engineers like to think of "rad" as a unit (like in rad/s and Hz). I think it's impossible to handle it well.

<comment><AUTHOR> Thanks for the advices ;)

</comment></comment><comment><USER12> Very strange that nobody mentioned relative mainstream language that has the same feature: F#

[http://fsharpforfunandprofit.com/posts/units-of- measure/](http://fsharpforfunandprofit.com/posts/units-of-measure/)

</comment><comment><USER6> I wonder why Frink isn't more popular:

[https://futureboy.us/frinkdocs/](https://futureboy.us/frinkdocs/)

... and why in general programmers like to think about bare numbers and love to differentiate them into floats and ints of various length (like it's the 90-ies) but don't care if they are volts or meters.</comment>


Apple Q&A on gathering and use of location data (Apple Press Release) - <AUTHOR> http://www.apple.com/pr/library/2011/04/27location_qa.html <comment><USER2> I often travel internationally (with no data roaming) and I've noticed that the iPhone's A-GPS is incapable of determining my location when I arrive in a new place, even if I've pre-loaded my route/maps in the maps application prior to arrival. But once I've connected to the internet - even for a few seconds - my phone is permanently able to track itself in that city, even after I've left and returned months later.

It's going to be unfortunate when I can't do this anymore because of people blowing this issue out of proportion. I hope Apple will at least provide the option of caching this data for longer than 7 days.

<comment><USER3> your need is too exotic and mainstream concerns about location/timestamp tracking on iphone are real, valid concerns.

<comment><USER4> The location/timestamp concerns are only relevant when my phone has been stolen or somebody has unrestricted access to my computer. At that point, location tracking is only one of many many terrible things that can happen to me, and frankly it's nowhere near the most terrible. And if I'm concerned about somebody tracking me, I'm going to be most concerned about the last 7 days, not the past year. If you're concerned about the government tracking you for longer than a year, they easily have access to that data without your ever knowing they looked.

The solution is to properly protect your data on your phone and your computer.

<comment><USER5> Your solution is asinine, as I have little way to protect my "cache" of goods... it's unencrypted both on the device and in the backups (though you can encrypt backups now, there might be previous computer backups of mine that have unencrypted location data, now I have to go find and excise those).

Any malicious desktop tool can easily find the location cache in unencrypted backups. Modern Police Forensics tools (<http://www.cellebrite.com/>) can easily extract non-encrypted data from phones in minutes (see Michigan Police).

That Apple stored this growing set of user-data in cleartext on the device was as stupid as Sony storing their customer's personal information in cleartext (or weakly hashed) on their servers.

Either bit-recycle the information that's not immediately relevant, or strongly encrypt/sanitize it. This shit isn't rocket-science, folks. Otherwise it's a liability and potential PR nightmare in the making.

We're now still in the "wild west" of personal data records. Once these issues start to snowball and real-life consequences happen, people will clamor for litigation, which given politicians will be over-reaching and ham-fisted.

Corporations with hundreds of millions of users' personal data should stay in front of these issues unless they want to wade in a regulatory mess (see Google's mis-steps with wifi packet data).

<comment><USER4> I'm sorry, but my solution of "protecting your data" is "asinine"?

You also say that you have little way to protect your data, and then in the next sentence tell me how to do it.

Are you really trying to evaluate the situation, or are you more interested in attempting to criticize in any way that you can stretch words?

<comment><USER5> As of right now, anyone with an iPhone can have their localization data ripped from their device in less than 5 minutes via cellebrite. It could be a coworker, police office, or immigration official.

How is that secured?

<comment><USER4> You need more than 5 minutes, you also need access to the computer associated with the phone: [http://www.cellebrite.com/images/stories/support%20files/App...](http://www.cellebrite.com/images/stories/support%20files/Apple_iPhone_Passcode_Bypass_instructions.pdf)

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> _3\. Why is my iPhone logging my location?

The iPhone is not logging your location. Rather, it's maintaining a database of Wi-Fi hotspots and cell towers around your current location, some of which may be located more than one hundred miles away from your iPhone, to help your iPhone rapidly and accurately calculate its location when requested_

This actually makes sense - looking at the logs on my iPhone and iPad, the locations where pretty far away from the places where I usually roam, and actually there was a very great deal of places where I've never been, not even close.

<comment><USER7> >and actually there was a very great deal of places where I've never been, not even close.

How does that make sense? It should only cache the locations of cell phone towers it was in the range of. Are you seeing data that was more than 100 miles away from the places you were at?

<comment><USER8> Nope. It's a local (geographically speaking) slice of a huge database of hotspots. There is a concentration of points downtown, a few points at the local airport, others at touristic destinations nearby. Most are places I've never been at.

It is nothing but a very neat cache. The nerd in me is sad to see it go.

</comment></comment></comment><comment><USER9> Ironically, shrinking the geolocation cache will result in more frequent requests to the server, making it theoretically easier for Apple to track your location.

<comment><USER10> GPS doesn't require requests to a server, AFAIK.

<comment><USER11> In practice, it does. The reason you get fast fixes is most likely due to AGPS, and that would require getting aiding data from a server.

</comment></comment></comment><comment><USER12> I use location services on an iPod touch almost daily and without a network connection. The location cache is currently limited by size. It seems to hold about a small city's worth of wifi hotspot coordinates, which is downloaded in large blocks at a time.

Reducing the size of the wifi location cache to a mere 7 days could severely reduce the usefulness of that feature.

I really hope they're not killing a great feature because of some hysteria and bad reporting.

<comment><USER13> When the update moves and encrypts the cache, it's really anyone's guess as to how long the history will go back.

If it's going to harm use, I don't doubt Apple would turn that 7 into a 14 or a 30 without batting an eye.

</comment></comment><comment><USER14> This is a perfectly reasonable explanation.

I have seen this more and more lately, the standard reaction to anything Apple in the tech community is pitchforks. I have a feeling subconsciously we all want Apple to fail at something and try to latch on to anything remotely blamable.

<comment><USER7> >I have seen this more and more lately, the standard reaction to anything Apple in the tech community is pitchforks. I have a feeling subconsciously we all want Apple to fail at something and try to latch on to anything remotely blamable.

I think that's a counter reaction to a whole bunch of people who think Apple can do no wrong at all.

<comment><USER13> Funny how those people always come up in conversation, but we never seem to catch them in the act.

</comment></comment></comment><comment><USER15> _5\. Can Apple locate me based on my geo-tagged Wi-Fi hotspot and cell tower data?_

 _No. This data is sent to Apple in an anonymous and encrypted form. Apple cannot identify the source of this data_

I hate it when companies use 'encrypted' like it would somehow make your data more secure in their hands. They mean here they use something like SSL so snooping the traffic is impossible, but of course they can still read what you're sending, otherwise the information would be useless to them.

The claim that apple can't identify the source of the data is also highly dubious. If they wanted to, they could probably correlate your IP with the IP used to access your iTunes account. That they don't do this is one thing, but claiming that they can't is something else.

EDIT: come on HN, since when did we start downvoting stuff you don't want to hear? This is a valid point, if you have critizism just leave a comment. If you want to downvote something, do it on the summary comments. Sheesh.

<comment><USER14> I understand being cynical but in this case the keyword is anonymous. The encryption is for protecting in transit like you said.

In order to populate their wi-fi/location database they really don't have to send over a person's IP to the server. In fact its something they don't want I would assume as it adds absolutely no value to the data. They already know who you are and where you are don't they?

<comment><USER15> They receive your IP address because that's how IP works; otherwise they wouldn't have an address to send data back (and IP packets with a spoofed source IP are dropped immediately). They might not do anything with it, but they definitely have access to it.

<comment><USER16> Sure, that's why they say "anonymous". If they do not delete the IP address as soon as technically possible they are lying about the anonymous part.

This is not about ability. This is about trust. They say the data is anonymous which means they are obligated to disregard the IP address and to not log it anywhere.

<comment><USER15> "This is not about ability"

Sure it is. That's exactly what the following statement means: "Apple cannot identify the source of this data". How can you interpret that as anything else but their ability of identifying the source?

The statement is obviously not true; if they were forced to, by a government agency for example, to track the location information from a user from that point on they COULD; saying they can't is wrong IMHO.

The correct thing to say here is that they can, but they don't, unless forced to. But I guess that isn't the message Apple wants to communicate.

<comment><USER16> If you want to be super petty about it, sure. I don't think that sentence is supposed to be read that way.

</comment></comment></comment></comment></comment></comment><comment><USER17> Oh no, reasonable and accurate information. Plus a list of things they plan to do to fix it.

What will we all hate on Apple about next?

<comment><USER7> So you think the people who were reporting on these issues and caused Apple to fix them did it to hate on Apple? Tthe issues were real and not made up because Apple is now fixing them. Would they have fixed it if every reporter acted like Gruber? Why do some people take it as a personal insult if people point out that Apple can ship buggy software?

<comment><USER18> I think people jumped to the conclusion that Apple was logging your actual location, which would be a big deal, and published it as fact. It's a great story and gets traffic.

That said, I cannot imagine that if they'd contacted Apple about the issue they would have gotten a useful answer without the publicity.

Bottom line though is that any sufficiently sensational story gets traffic regardless of its truth or lack of attempt to even verify the veracity of the alleged problem.

<comment><USER19> There were plenty of sensational stories, sure. There were also many reasonable stories that debated what was being tracked, many of which were discussed on HN. You can't invalidate a story because some people become sensationalist, that _always_ happens on any controversial story.

<comment><USER18> I am sure that lots of people discussed the story; but the original story that kicked it all pitched it as an "Apple is tracking you and the guys in black suits are using it to convict you of crimes" story.

</comment></comment></comment></comment></comment><comment><USER20> _The iPhone is not logging your location. Rather, it's maintaining a database of Wi-Fi hotspots and cell towers around your current location, some of which may be located more than one hundred miles away from your iPhone, to help your iPhone rapidly and accurately calculate its location when requested_

 _Can Apple locate me based on my geo-tagged Wi-Fi hotspot and cell tower data? No. This data is sent to Apple in an anonymous and encrypted form. Apple cannot identify the source of this data._

I think a lot of folks who spent money on Apple products are going to be happy with this, and for that I'm glad.

But I didn't find this release adequate. Apple is not tracking me -- they are keeping a time-stamped list of nearby access points on my device, which effectively is a huge breadcrumb trail of everywhere I've been and when. Apple doesn't know it's me -- because the data is encrypted, which makes no sense at all. Whether data is encrypted or not is meaningless. Can I go to the Apple server logs and track incoming downloads and associate them with the data or not? I strongly suspect the answer is "yes". If not, that's great, but that wasn't described here.

The killer omission? That Apple has been doing all of this -- which is at the very least controversial -- without informing the users in a manner in which they clearly understood it. The response we see is simply a reaction. The "bug" here is getting caught.

I don't necessarily see anything nefarious at work, but I'm troubled with the idea that Apple was keeping a list of my whereabouts (the nearest access point, for those of you who are literally-minded) without my knowing it. That's a pretty serious breach of user trust, no matter how many times it was covered in the 47-page lawyered-up doc that nobody reads.

But like I said, folks are willing to cut Apple lots of slack, and they deserve it. But hell if I'd want to see something like this happen again, from any manufacturer. I'm not so sure that vendors are getting the point.

<comment><USER21> >they are keeping a time-stamped list of nearby access points on my device, which effectively is a huge breadcrumb trail of everywhere

Read again. They are not. Its not timestamped when "you" where there, but when some anonynous iPhone picked up that particular hotspot. It got then uploaded to Apple and subsequently downloaded onto your iPhone, so that your iPhone can find its location easier.

Wasn't that kinda the obvious reason in the first place?

<comment><USER22> I'm pretty sure that's true. I'm going to try find some time this evening to animate the points out of the database from my phone to prove it to myself. I'm guessing the animation will show random segments of trails that anonymous iPhone users have travelled around my neighborhoods, but nothing I'll recognize as a trip I've made. (I'll blog about it at bigiain.com if I find anything interesting)

<comment><USER23> Then you will write a very interesting, but somewhat misleading blog post, just like everyone else has written in the past few weeks.

The point is that the database on your phone is a subset of the greater (global) database mapping wifi and cell access points to location. The local database contains timestamps of when your phone downloaded the information. The global database only contains a list of access points and approximate locations of those access points.

That way, when your phone sees an access point it can look up in the database (locally or globally) and see if this access point has been pinpointed, if it has it will be another tool for your device to provide you with a proper location.

In other words: animating the points in your database will show the first time your phone downloaded information about a specific access point, which will give you a trail of your movements (to a certain extent limited by the factors mentioned above).

</comment></comment></comment></comment><comment><USER24> _Sometime in the next few weeks Apple will release a free iOS software update that:

\- reduces the size of the crowd-sourced Wi-Fi hotspot and cell tower database cached on the iPhone,

\- ceases backing up this cache, and

\- deletes this cache entirely when Location Services is turned off._

Looks reasonable to me. The only thing missing that I'd like to see is an option to opt out of the tracking data (anonymous or not).

<comment><USER25> See, but that would be crazy. If what they're saying is true (and there's no reason to doubt it at this point), they're using this in order to provide you with a service: the ability for your phone to know where you are in your city. Calling it "tracking data" is wrong, even.

Given their description of how the cell tower/hotspot data is used, it seems like deleting "this cache entirely when Location Services is turned off" is the opt-out you are looking for.

<comment><USER26> >Calling it "tracking data" is wrong, even.

I wish people would stop saying this. Of course it's tracking data. There's nothing wrong with that. One of the phone's features is tracking your location so you don't get lost.

Personally I think Apple has overreacted. They just need to provide a configuration setting for the size of the cache, and more importantly not include it in backups. A cache is not important enough to back up. But as far as the size of the cache, the defaults sound sane enough.

<comment><USER27> You could also call the IP address that you're sending email from 'tracking data' if you wanted.

Hell, I get a text message from Rogers the second I land in the US to let me know that roaming rates apply. The fact that I have a device that has to talk to another end point means that I can be tracked.

<comment><USER26> Yes, I would call that tracking data. But unlike IP address headers, this cache contains information that is _by design_ displayed to the user to help track their location.

</comment></comment></comment></comment></comment><comment><USER28> 1\. This explanation seems to ignore the timestamps that are stored along with the hotspots/towers data. What do the timestamps represent? The time when the cache was downloaded onto the phone?

2\. Speculatively, the way this seems to work is, that the phone identifies a tower, say, with ID12345. It then looks up the crowdsourced database for the tower with this ID, and queries it for all towers/hotspots within X miles radius. The result of the query is logged into the consolidated.db file, along with the current timestamp.

3\. I don't know about the 100 miles number, but for me, in an urban setting, it certainly seems to be accurate upto approximately a mile or so, that together with the timestamp, gives a reasonably accurate picture of where I've been, and when.

<comment><USER29> If the goal is to only keep the data around for, say, 7 days, you need timestamps to determine when each piece was last downloaded, no?

</comment></comment><comment><USER30> So it was a bug after all.

This was one of the best responses out of a big corporation I've seen in ages. They even explain the function of it, not often that you see that.

</comment><comment><USER31> _8\. What other location data is Apple collecting from the iPhone besides crowd-sourced Wi-Fi hotspot and cell tower data? Apple is now collecting anonymous traffic data to build a crowd-sourced traffic database with the goal of providing iPhone users an improved traffic service in the next couple of years._

Interesting. Apple generally does not pre-release information about upcoming products, at all. They must have felt their hand forced in this, or Jobs is not at the helm of this press release (which I'm sure he is).

<comment><USER32> IMO the most interesting thing -- I was just daydreaming on the way to work of a mapping app that basically tracked your route, and compared timestamps of movement against expected times to generate an accurate realtime traffic map when shared with a central server.

The problem with traffic info right now is that it's always either laughably late (see sirius/xm traffic info) or it's based on eyes-in-the-sky style updates from radio, which you can only get every period of time.

<comment><USER19> Google Maps on Android does exactly that, it's great. especially in the summer time, makes it easy to find ways around construction.

</comment></comment></comment><comment><USER33> Great clear response from Apple. Patch is a good outcome, turning off location service actually stopping tracking and limitation to 7 days are very good moves.

</comment><comment><USER34> So now the usefulness of my phone gets degraded because Apple has to pander to people that don't understand what the actual situation is.

</comment><comment><USER35> Meh. Everyone sucks at press releases this week (thinking about you, Sony). This just seems so much more bloodless, dispassionate, and frank than it ought to. It's obnoxiously contrary to write "The iPhone is not logging your location."

I mean, really? That's just argumentative. My mom is gonna look at the location history visualizers people wrote and respond "Really, Apple? Cause this looks very much like _log_ of my _locations_ ".

Somebody at Apple's PR needs an ass-kicking. This ought to be a video with a short transcription from someone on the phone team (not Jobs) that just explains it without getting defensive of semantically tricky.

</comment><comment><USER36> I assume that my ancient iPhone 3G will be exempt from this privacy update.

<comment><USER37> As this is a security fix I bet there will be an iOS 4.2.2

</comment></comment><comment><USER38> "The reason the iPhone stores so much data is a bug we uncovered and plan to fix shortly"

A bug _you_ uncovered?

<comment><USER10> Two lies: the "bug" was uncovered a considerable time ago (August 2010 was when I read the first story talking about it) and was first exposed by third- parties (so if Apple did "uncover" it, they've been sitting on this discover for some time).

[https://alexlevinson.wordpress.com/2011/04/21/3-major- issues...](https://alexlevinson.wordpress.com/2011/04/21/3-major-issues-with- the-latest-iphone-tracking-discovery/)

<comment><USER39> You speak of the symptoms of the bug as if they were the bug, consider this one act play:

• The internet claims Apple is tracking all iPhone owners!

• Steve Jobs interrupts family time to exclaim "WTF!"

• SJ: "Minion! Verify this claim!"

• Minion: "It is true, to the extent that we keep large, possibly unbounded, volumes of cell tower and wifi access point in the cache for the purpose of…" SNICKER-SNACK… thump.

• SJ: "Engineering, fix this. Marketing, communicate this.", returns to family time.

• Engineering to engineer: "Fix this."

• Engineer to self: "I do not know why this happens, _I will search and uncover this bug._ " <<<\--- there, that is where the bug is uncovered. He fixes the purge code from whatever simple or broken strategy the first coder used, perhaps deleting the comment that says "// might need to prune the cache, but the OS probably does that when it gets too big"

• Marketing: "What? We were busy hiding the links on the home page until you respect our new iPad2, but ok, we can crank out a press release if it saves us from the vorpal blade."

DOWN CURTAIN // insert character development and pathos before first rehearsal

</comment></comment></comment><comment><USER40> A huge hole in this press release is how apps use location information. An app can easily log a user's location and send it anywhere along with whatever other data the app has access to.

<comment> X-Istence Since you have to individually give each app permission you should go talk to the App developers. The apps use the location API that is available, and don't have direct access to the cache if that is what you are worried about.

</comment></comment><comment><USER41> "You're not slaves - this collar just looks good on you!" (c) Strugatsky brothers, "The Doomed City" novel, 1988

</comment><comment><USER42> > _"The iPhone is not logging your location. Rather, it's maintaining a > database of Wi-Fi hotspots and cell towers around your current location, > some of which may be located more than one hundred miles away from your > iPhone, to help your iPhone rapidly and accurately calculate its location > when requested. Calculating a phone's location using just GPS satellite data > can take up to several minutes. iPhone can reduce this time to just a few > seconds by using Wi-Fi hotspot and cell tower data to quickly find GPS > satellites, and even triangulate its location using just Wi-Fi hotspot and > cell tower data when GPS is not available (such as indoors or in basements). > These calculations are performed live on the iPhone using a crowd-sourced > database of Wi-Fi hotspot and cell tower data that is generated by tens of > millions of iPhones sending the geo-tagged locations of nearby Wi-Fi > hotspots and cell towers in an anonymous and encrypted form to Apple."_

Some are located more than 100 miles away because the database contains every location ever logged. Despite the fact that hotspots and cell towers over the horizon cannot play a role in accurately determining your location, Apple's response is intended to create the impression that they play such a role and thus justify permanent storage.

Furthermore, short of magic, there is no way to send a relevant subset of the crowd sourced data to an iPhone without first knowing both the location of the iPhone and its unique identity.

> _"The entire crowd-sourced database is too big to store on an iPhone, so we > download an appropriate subset (cache) onto each iPhone. This cache is > protected but not encrypted, and is backed up in iTunes whenever you back up > your iPhone. The backup is encrypted or not, depending on the user settings > in iTunes. The location data that researchers are seeing on the iPhone is > not the past or present location of the iPhone, but rather the locations of > Wi-Fi hotspots and cell towers surrounding the iPhone's location, which can > be more than one hundred miles away from the iPhone."_

Apple is trying to create the impression that storing the data from which location can be triangulated is somehow significantly different from storing the actual location and again creating misdirection with the reference to "more than one hundred miles away from the iPhone."

> _"5. Can Apple locate me based on my geo-tagged Wi-Fi hotspot and cell tower > data? No. This data is sent to Apple in an anonymous and encrypted form. > Apple cannot identify the source of this data."_

In an interesting shift of language, Apple's answer is technically about the person's location rather than the location of the iPhone and it could be argued that in this context "source" refers to the person using the iPhone rather than the identity of the iPhone. Given that "cannot" rather than "do not" is used, the limitation does not correlate with something in an algorithm since an algorithm can be changed to identify the specific iPhone.

<comment><USER43> > Furthermore, short of magic, there is no way to send a relevant subset of > the crowd sourced data to an iPhone without first knowing both the location > of the iPhone and its unique identity.

If you consider recording the id of the cell tower the phone is connected to magic..

<comment><USER42> If Apple can do so without tracking the location of the iPhone and knowing its identity, yes. But then the scenario you propose admits that Apple tracks the location of the iPhone to some degree.

The most charitable case would be that Apple only tracks location based on the cell tower to which the iPhone is connected. The worst case is that it tracks location based on every hotspot and celltower the iPhone sees.

Since the most charitable case would produce the least predictive power when selecting a relevant subset of the crowd sourced data and the worst tracking case would produce the most predictive power - and given the level of detail reported to be stored on the iPhone is consistent with the worst case and less consistent with the most charitable case - the worst case scenario regarding tracking would appear to be more likely.

<comment><USER44> The device ID is not necessary for such a query to be successful, though. If you as the device programmer were interested in getting the subset of the cache for your location, the method signature would need be nothing more complicated than:

      +(DBConsolidated) subsetForDevice:(NSArray *)visibleTowers:(NSArray *)visibleHotSpots

So even in the "worst" case described by you no identifying data is sent. This could possibly be statistically analyzed, but given Apple's flat denials, a plausible technical reason, and the public attention this has received, I doubt they are lying here. A whistleblower providing evidence contradicting their "we don't track" claims would be devastating, and possibly open them up to legal action. I don't think they are quite that careless, although it is certainly possible.

<comment><USER42> The "flat denial" is in response to Apple's ability to "locate me" not "locate my iPhone." Elsewhere, Apple is very specifically making claims about the iPhone.

"Anonymous" is pretty slippery and there is no agreed upon technical definition (just ask EFF), but it literally means "not identified by name" so one could argue that sending tracking data based on your device serial number, IP address, phone number, location, contacts list, etc. is still in an "anonymous form." [somewhat similar to debates about the technical meaning of "open"].

I'll add that the information you are proposing to send to Apple is enough to clearly identify your location - or rather the location of the iPhone, and short of Apple using Tor or a similar approach to making the message's route through the network untraceable, the data in "anonymous form" can likely be disanonymized.

</comment></comment></comment></comment></comment><comment><USER45> >Apple is not tracking the location of your iPhone. Apple has never done so and has no plans to ever do so.

Alright...

>Apple is now collecting anonymous traffic data to build a crowd-sourced traffic database with the goal of providing iPhone users an improved traffic service in the next couple of years.

...... The collection of anonymous traffic data involves tracking your location to determine what road you're on and what speed you're going. They can't even get their story straight.

</comment><comment><USER46> "The iPhone is not logging your location. Rather, it's maintaining a database of Wi-Fi hotspots and cell towers around your current location"

So, it's logging your rough location...

<comment><USER47> The intention matters. For example, you could look at my mail client and accuse me of constructing a database of Ruby developers in the Boston area.

<comment><USER48> Heh, that'd probably be worth in the neighborhood of $500K given how many openings there are for Rubyists in the Boston/Cambridge area.

</comment></comment></comment><comment><USER49> > Apple is now collecting anonymous traffic data to build a crowd-sourced > traffic database with the goal of providing iPhone users an improved traffic > service in the next couple of years.

Wow!

</comment><comment><USER50> "In the next major iOS software release the cache will also be encrypted on the iPhone."

Great, thanks a lot! Now I no longer have the option of viewing what law enforcement will be able to get anyways. Nor will I have access to what essentially was a pretty neat database to look through.

<comment><USER51> Not to sound flip, but if you're concerned about law enforcement tracking your movements, you should leave the phone at home.

<comment><USER52> Not flippant at all. Law enforcement can track where you are through your telco even if you don't have a fancy phone. And they can do it live.

<comment><USER15> That probably only works for local telco's. With Apple's info, US agencies can track anyone with an iPhone in the world, even if the telco's there don't want to cooperate.

<comment><USER53> ... After they physically seize your phone or home PC, to read this only- locally-stored file, of course.

</comment></comment></comment></comment></comment><comment><USER3> this q&a is misleading a bit. iphone downloads locations around hotspots u have already been close to by timestamping, and it means ur approximate location+timestamp was logged indefinitely on ur phone and copied to PC, though indirect.

the whole q&a is a simple game words to trick users. `apple is not tracking ur location` but `your approximate location is downloaded, timestamped and stored on ur mobile phone due to a bug`

this whole wording is can't even trick a child.

look at the result.

</comment><comment><USER54> From the press release:

Apple is now collecting anonymous traffic data to build a crowd-sourced traffic database with the goal of providing iPhone users an improved traffic service in the next couple of years.

....

Let me guess...Where, all roads lead to Apple?

EDIT: I posted this fully knowing it will be unpopular. But reading the press release gave me the feeling that Apple was using a sleight of hands by turning the public's focus from the privacy and security issues this incident has amplified and brought to the public's view, and instead is saying "Gee..We were doing y'all a favor by building a better maps app, and now you come along and screwed that up". Security is not an afterthought people. Hasn't the Sony fiasco that is still unraveling taught us anything?</comment>


Significant Changes to Accessing and Using GeoLite2 Databases - <AUTHOR> https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases/ <comment><USER2> Unfortunately it seems like they are also using this as a chance to change the license from a Creative Commons BY-SA to something else.

And the announcement is really short dated as I am sure a lot of services will have to be updated now over the holidays.

At least the last files before the change will stay under the old license forever.

<comment><USER3> > Unfortunately it seems like they are also using this as a chance to change > the license from a Creative Commons BY-SA to something else.

Might this be consistent with their statement:

> We have been advised that any download, including one without charge, > constitutes a sale. Serving GeoLite2 database downloads on a public page > simply does not allow us to communicate and honor valid "Do Not Sell" > requests we receive from individuals.

</comment></comment><comment><USER4> I'm still not sure how a state law in California can be used against a business in another state.

Many sanctuary cities in California are violating federal immigration laws with impunity...so they are going to have a hell of a time enforcing their own state laws across state lines.

<comment><USER3> State governments are weaponizing federal courts to enforce state laws across state borders. The start of the current trend is enforcement of sales tax of all states upon all states but it won't stop there.</comment></comment>


PayPal.com XSS Vulnerability - <AUTHOR> http://seclists.org/fulldisclosure/2013/May/163 <comment><USER2> PayPal should have put the reward into a trust for them for a year if there were legal issues.

Kudos for them being honest with both the bug and their age regardless.

The future is probably filled with teenagers discovering things, good and bad.

Teenagers are still prosecuted as adults but legally treated as less for other responsibilities.

<comment><USER3> As x9k noted on /r/netsec ([http://www.reddit.com/r/netsec/comments/1f3bt1/17_years_old_...](http://www.reddit.com/r/netsec/comments/1f3bt1/17_years_old_student_publicly_discloses_a/ca6euzj))

* a 12 years old found a stack overflow bug in firefox's document.write, in 2010: [http://www.mercurynews.com/san-jose-neighborhoods/ci_1640189...](http://www.mercurynews.com/san-jose-neighborhoods/ci_16401891) (<https://news.ycombinator.com/item?id=1822117>)

* "Pinkie Pie" is an anonymous teenager, he won $60k at Pwnium, and did it again at Pwnium 2

* @CimStordal, 15 (at the time), found XSS in Facebook, Apple, Google and Microsoft sites: [http://www.internet-security.ca/internet-security-news-archi...](http://www.internet-security.ca/internet-security-news-archives-036/fifteen-year-old-teen-discovers-security-issues-in-google-facebook-apple-and-microsoft.html)

Tech has always been filled with teenagers discovering things, now more than ever. Most bounty handlers treat them as valued contributors, Paypal — as usual — shits all over everything.

</comment></comment><comment><USER4> Not the first time I've seen paypal flake on their bounty. Poor excuse.

</comment><comment><USER5> Too young to be a hacker, but not too young to jail for being a hacker :D

</comment><comment><USER6> 1\. seriously, you couldn't just say you're 18? nobody cares in fact.

2\. well, fuck paypal!

3\. not a good way to show PoC. Is there antiCSRF on search form? Can I see the whole flow?

</comment><comment><USER7> Paypal being penny wise but pound fool.

The next person who'll discover something, will probably monetize it on the black market.

<comment><USER8> As so many do.

</comment></comment><comment><USER9> Is there any legitimate reason to discriminate because of age?

<comment><USER10> The Federal Labor Standards Act has provisions about anyone under the age of 18 working for companies whose revenue is greater than $500,000. It sucks to be a kid for a lot of reasons.

This kid just blamed Paypal for one of our country's many idiotic federal laws.

This choice should be considered a career limiting decision by any hiring manager.

<comment><USER11> _This choice should be considered a career limiting decision by any hiring manager._

Are you saying that you're holding a 17 year old student in Germany responsible for not understanding US labor laws?

<comment><USER12> It makes me angry, but the law here in the US is that "ignorance is not a defense." Oh... you didn't know our several million laws when you broke one? Too bad, they say. Lawyers counter that if the law was simpler, they wouldn't have jobs.

<comment><USER13> Ok. Now if only the kid actually was over there in the US.

<comment><USER14> It's not that simple. When you access an American network, your usage is governed my American laws -- period.

You make it sound like if you hacked into Paypal from Germany you'd be completely immune to American law on the matter because you're not in the US.

That's simply not true.

</comment></comment></comment></comment></comment></comment><comment><USER15> The downside of Child Labor laws.

<comment><USER16> The Chromium Security team pays bounties to adults representing minors; Paypal could have done the same.

<comment><USER10> If the feds were to audit the situation you are describing, I would wager they'd come after Google.

Google has a lot more freedom and track record for asking forgiveness instead of permission than Paypal (i.e. wifi sniffing in google cars). They are not a payment processing company.

This stuff is complicated. Never attribute to malice that which is adequately explained by stupidity.

<comment><USER17> Why's that? Minors can receive compensation for work they perform.

<comment><USER18> Also, would it even be applicable to minors working from outside the U.S?

</comment></comment></comment></comment></comment><comment><USER19> Can you explain why this is a real vulnerability? The user himself must put that JS in the search box.

<comment><USER20> Basically you need to put something like this on a page you control (where "xss code" is the code triggering the XSS):

        <form action="https://www.paypal.com/de/cgi-bin/searchscr?cmd=_sitewide-search" method="post">
            <input type="text" name="queryString" value="xss code" />
        </form>

Then, just as the page loads, submit that form and you're executing JS on a paypal.com page. This would work great for phishing or session hijacking.

<comment> hidden-markov Isn't this CSRF?

<comment><USER21> Combination of XSS and CSRF.

<comment><USER22> This seems like it's just plain XSS - it doesn't take advantage of a user's serverside session to forge an action on their behalf.

</comment></comment></comment></comment></comment><comment><USER23> In the last 2 years, I have seen 100's of such on paypal/ebay.

Just to name a few, <http://www.xssed.com/search?key=paypal.com>

</comment><comment><USER24> Can you clarify exactly when you reported this XSS as a personal friend of mine reported it (exact same bug with a slightly different XSS vector) and was told it had already been found a reasonable while back.

(From memory, he also took a few photos of it also).

Would be interested to hear your response as it might give this another angle entirely, haha.

My personal experience with PayPal isn't particularly great, I'm a security researcher who's just turned 18, and even when I was underage I never actually disclosed that but regardless I had the following knocked back;

(Whole heap of non-critical XSS's, and two critical stored ones, The ability to edit titles on some PayPal subdomains (without giving too much information out) - This vulnerability still exists but I was told it was quote "not serious" even though the title field was vulnerable to stored XSS.

Full path disclosures, open administrative panels, whole variety of cookie/SSL/TSL based issues which I was told did not warrant a bounty.

Also had a personal friend (the same guy who found the XSS you've posted here) find a couple SQLi's on a few PayPal domains (post-auth) and he still hasn't heard back from them.

I'm not going to be the guy to accuse PayPal of not playing fair here, but my friend has also reported vulnerabilities I had previously reported and gotten paid for them. (Might be because he reports them from his security company email, whereas I was reporting them as an individual).

Anyway, Sad to hear you didn't get a bounty!

Also, if you don't have it here's a pretty good bug bounty list; <http://bugcrowd.com/list-of-bug-bounty-programs/>

</comment><comment><USER25> On a sidenote, does anyone have a good setup for browsing securely to avoid issues like this? I ran with JS restricted to a whitelist for a while, but many random websites that I have to use require it these days.

Can you use something like Ghostery to allow any site to do its own JS but not external JS, besides whitelisted sites/externals?

<comment><USER26> > Can you use something like Ghostery to allow any site to do its own JS but > not external JS, besides whitelisted sites/externals?

That's exactly what noscript does. Use the option "Temporarily allow top-level sites by default->Base 2nd level Domains".

<comment><USER25> Thanks! This looks like exactly the behavior I want.

</comment></comment></comment><comment><USER27> It looks like the vulnerability has been patched. Can anyone confirm if they can still successfully exploit this?

</comment><comment><USER28> It's weird that PayPal replaced one of the instances of </script> with </skript>?

</comment><comment><USER29> Can somebody explain how that script triggers?

</comment><comment><USER30> Add it to your CV

</comment><comment><USER31> bitcoin user not affected

<comment><USER32> MtGox, BTC-e, among other big bitcoin exchanges have been hacked before.

<comment><USER33> Bitcoin is not mtgox or any other exchange. But to be fair, bitcoin itself had its share of security issues (fixed, but who knows what the future holds)</comment></comment></comment>