Intel Management Engine cleaner - <AUTHOR> https://github.com/corna/me_cleaner/ <comment><USER2> I remember the furore when Intel introduced a unique CPU identifier in the Pentium 3. Now they have a microprocessor and OS running as a computer subsystem on every Intel server and laptop which is able to do pretty much what it likes with your system and people don't bat an eyelid.

Don't get me wrong, I love some of the benefits like remote control of my servers, fan speed control, monitoring of temps and voltages etc. but I do think we've given up a LOT of security for the sake of convenience. It wouldn't take much for a well crafted worm or heck a simple script to disrupt a whole network of ME/AMT enabled clients and servers.

<comment><USER3> > but I do think we've given up a LOT of security for the sake of convenience.

Worse: There is no reason you couldn't have both. For a start: A simple "off" switch for Intel ME would please a lot of people.

<comment><USER4> >A simple "off" switch for Intel ME would please a lot of people.

But not a corporate security team, of course. It's not that simple.

<comment><USER5> Sure it is, it's just that "off" needs to be done by Intel and sold under a different SKU.

<comment><USER6> It doesn't even need to be that. Expose it on a header on the motherboard so end users can add/remove a jumper. Same as should be in place for the write enable pin on the system's firmware EEPROM. The fact that the end user has no way to prevent firmware updates on most motherboards is a fucking travesty.

Businesses can simply tell their employees to leave it enabled or find another job.

<comment><USER7> But when it gets stolen, the thief just switches the jumper.

</comment></comment></comment></comment></comment></comment><comment><USER8> A story:

One of my coworkers told me he previously worked on the motherboard team for Intel and was regaling the office with stories about testing the motherboards against the latest games. Apparently many of the Intel engineers personally tested overclocking the processors to see how much they could take before they fried.

At some point I asked him if he knew anything about the Management Engine. He said that they were starting to become a thing right around the time he was leaving, so he didn't know too much about them. I said, "Well, there's a bunch of paranoid people that are uneasy about it because, to my understanding, it's a blackbox second processor and we really have no idea what it's doing."

Without prompt, he replied, "Oh, you mean like the FBI using it to listen in? Yeah, that happened. It happened on AT&T's when I went over there as well."*

That's my story. I apologize if it looks like I'm spreading FUD here, since I'm not going to give up my name or my coworker's to verify the story, but I sincerely doubt that Intel would acknowledge such a capability anyway, so, take it as you will. Libreboot, the Management Engine cleaner, and other such projects _need_ to exist. My coworker's comment convinced me of that.

* I'm not sure what he's referring to here. Maybe someone else can shed some light. Does AT&T make processors?

<comment><USER9> I'm skeptical that the FBI have the technical capabilities to turn the IME into a trojan horse (in the biblical sense). More likely NSA-levels of sophistication. Plus there's also the issue of doing the actual implants (either via postal intercepts, physical access, or breaking into networks) which are illegal for the FBI to do but semi-legal for the NSA to do against foreign targets.

<comment><USER10> Can't the FBI request services from the NSA?

And there have been versions of the Intel ME in the wild with known remote exploits AFAIK.

<comment><USER11> Isn't this a two edged thing in legal courts - if there is a widely available backdoor to hack Intel systems, how can any digital evidence be taken without some measure of doubt?

<comment><USER12> That is the whole "parallel construction" debacle. Once they have the evidence, they come up with a cover story for how they could have legally obtained it.

</comment></comment></comment></comment></comment><comment><USER13> Background, ie why you might want to clean Intel ME: [https://recon.cx/2014/slides/Recon%202014%20Skochinsky.pdf](https://recon.cx/2014/slides/Recon%202014%20Skochinsky.pdf)

<comment><USER14> Also, [https://libreboot.org/faq/#intelme](https://libreboot.org/faq/#intelme)

<comment><USER15> And an obligatory link to CoreBoot, which I believe has a bit more history than Libreboot:

[https://www.coreboot.org/Intel_Management_Engine](https://www.coreboot.org/Intel_Management_Engine)

<comment><USER16> Libreboot is just a more strict about freedom coreboot from what I understand. As in it is literally a fork/derivative of coreboot.

<comment><USER15> Ah got it. With the recent GNU drama of libreboot I wonder how viable it really is as an ecosystem.

<comment><USER17> Personally I think the FSF ideology taken too far is pretty ridiculous anyway.

<comment><USER18> Yet here we are, discussing the secret OS that runs on its own chip and can't be disabled by the end-user.

The world is a pretty ridiculous place, even with the best efforts of those ridiculous FSF zealots. I don't always agree with them and their methods and communication skills aren't perfect, and it's a shame to see coreboot/libreboot get fragmented etc... but imagine how backwards the world would be without some people taking things 'a bit too far sometimes'.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> The ME causes problems for embedded system makers too. If you are making physical devices with Intel CPUs you probably want to replace the Intel MAC addresses with your own. Then you have to fight with the ME to keep it from trying to talk to the internet by itself, using the Intel MAC. If it does, that will freak out some corporate routers. They see two MAC devices on one port and assumes someone has plugged in an unauthorized ethernet switch, and disable the port.

<comment><USER20> Hmm, that behavior might enable a neat non-firmware mitigation: replace the Intel MAC address with your own and block all packets originating from the Intel one.

</comment></comment><comment><USER21> Doctorow's Law: "Anytime someone puts a lock on something you own, against your wishes, and doesn't give you the key, they're not doing it for your benefit."

</comment><comment><USER22> > It should work both with Coreboot and with the factory BIOS.

So, basically any computer?

Also, how safe is it?

EDIT:

> Bricking is very likely to happen! Just in case you didn't hear me the first > time

<comment><USER22> It looks like its wiki sheds some light on the details:

[https://github.com/corna/me_cleaner/wiki](https://github.com/corna/me_cleaner/wiki)

</comment></comment><comment><USER23> One thing I asked before but didn't get a definitive answer on: IIRC the IME images are cryptographically signed, right? If so, how can they modify the images without breaking the signature? Or can they resign it?

<comment> mid-kid As far as I know, only the code is signed, not the partition table. This means that you can freely modify the partition table and completely remove some modules.

<comment> mid-kid Please check the wiki for more detailed information: [https://github.com/corna/me_cleaner/wiki/How-does-it- work%3F...](https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F#why- does-it-work-arent-the-partitions-signed-how-can-you-modify-them)

</comment></comment></comment><comment><USER24> One thing that concerns me is that it says it removes parts of the ME responsible for "silicon work-arounds". In other words, microcode patches. These are important for patching processor errata.

It would be better if there was a way to allow retaining/updating microcode patches for errata, while eliminating all the other nonsense.

<comment><USER25> It is my understanding that those microcode patches can be applied by the OS as well at runtime.

<comment><USER26> Sort of. Removing the firmware-provided microcode update would likely kill Intel SGX support, though. And if UEFI is set for secure boot _and_ its implementation happens to uses SGX or TXT for that, it probably will brick the box until one restores its system FLASH to a valid state.

You can further update the processor microcode later, from UEFI or from the operating system. But the all-important initial processor microcode[1] update has to be done from a trusted path [for Intel SGX to be available].

And no, it is not UEFI early boot updating the microcode as it used to work in the past: when doing a secure Intel SGX boot path, the microcode looks up the FIT table in system FLASH, to get the address of a microcode update table in system flash. If found, the microcode then proceeds to self-update from FLASH.

This whole auto-load-microcode-from-FIT thing seems to have started with Skylake. Since Intel SGX is almost entirely implemented in microcode, it makes a lot of sense.

ON INTEL SKYLAKE AND LATER, you can notice whether the current microcode update came from FIT or not by reading its revision number. If it is odd, it came from the FIT. If it is even, it came from regular UEFI or O.S. updates.

[https://review.coreboot.org/cgit/coreboot.git/commit/?id=504...](https://review.coreboot.org/cgit/coreboot.git/commit/?id=5042aad4ded1651638ae9b60e34114b65e4f211e)

As for recent Intel systems without Intel SGX (or with it disabled), you still likely need a firmware-provided initial microcode update or it will be hopelessly buggy. Chances are it won't be stable enough to actually boot the target O.S.

[1] Intel has been shipping its processors with shamelessly incomplete/buggy factory microcode for a while now. You pretty much _have_ to install a microcode update, or what you will get might not even qualify as a X86-64 compatible processor. The factory microcode doesn't need to know how to do paging or hardware-assisted virtualization correctly at all, for example, or even implement SIMD and floating point math instructions. All it has to do is to be able to run enough of BIOS/UEFI to get the initial microcode update.

</comment></comment></comment><comment><USER27> I wonder if this would work on a Mac. Looked around briefly but did not see anything indicating support.

</comment><comment><USER28> This is admittedly unfounded speculation, but if the ME were compromised, one of the most valuable things an attacker would want would be AES keys. So _IF_ this binary blob is up to no good, we should expect one of its tasks to jot down AES keys (remember, intel has had specialized AES instructions for a while now) and hide them somewhere for later retrieval.

Perhaps it would behoove people to run a "keyscrubber" daemon that constantly generates random numbers and AES-encrypts a few kb of data and sends it to /dev/null. _IF_ the ME is jotting down keys, and _IF_ there is only a finite amount of space for it to store them, such a daemon might be able to flush out _real_ keys and overwrite them with junk to hamper any retrieval efforts.

Again, two big hypotheticals, but, if it were stealing keys, the buffer would have to be pretty small, otherwise people could eventually detect it changing sizes or hashes in NVM. I wouldn't expect such a thing in standard redable NVM anyway, it's probably on a die somewhere and only a few kb.

<comment><USER29> > This is admittedly unfounded speculation, but if the ME were compromised, > one of the most valuable things an attacker would want would be AES keys. So > _IF_ this binary blob is up to no good, we should expect one of its tasks to > jot down AES keys (remember, intel has had specialized AES instructions for > a while now) and hide them somewhere for later retrieval.

If you want to get into the speculation rabbit hole, it's far more fun to assume that instead of calculating something_truly_random(), RDRAND actually returns `AES-CTR(something_truly_random(), NSAKEY, counter)` as random output - which then becomes P & Q for your RSA keys. This'd be a far easier attack to mount, and wouldn't require any exfiltration of keys; just being able to see any current RNG state would expose all the previous states.

This might not be a problem for Linux, since RDRAND is mixed in, but for a while RDRAND was the exclusive entropy source for TCP sequence numbers, ASLR offsets, etc: [https://cryptome.org/2013/07/intel-bed- nsa.htm](https://cryptome.org/2013/07/intel-bed-nsa.htm)

Who knows how Windows or OS X handles this.

<comment><USER28> >just being able to see any current RNG state would expose all the previous states.

wow, that's insidious. I'd never even considered something like that!</comment></comment></comment>


Mayor Ed Lee: 'Tech Workers Are Not Robots' - <AUTHOR> http://www.nytimes.com/2013/11/17/magazine/mayor-ed-lee-tech-workers-are-not-robots.html

<comment><USER2> Pity, no questions about the lack of affordable housing in the city, and the squeeze middle class SFers are feeling from the influx of highly paid tech workers driving up real estate and rental prices.</comment>


What can you do with a web in your pocket? - <AUTHOR> http://www.docstoc.com/docs/6934559/What-Can-You-Do-With-A-Web-In-Your-Pocket

<comment><USER2> In case you were wondering...

Sergey Brin, Rajeev Motwani, Lawrence Page, and Terry. Winograd. What can you do with a web in your pocket? Data Engineering Bulletin, 21:37–47, 1998.

[Hey Larry, who's Lawrence Page? :p]</comment>


Ask HN: Connect Laptop to TV without HDMI - <AUTHOR>

Hi,
I am looking to use my Samsung Smart LED TV as an extended display for my laptop but wirelessly.
I am surprised that there is no option available to me except connecting via HDMI wire or purchase a WIDI device (which will only allow streaming videos). I also read a lot at http://www.dlna.org/ but it seems there is no option available.
Does any of you have any experience building a Raspberry PI based device which can help me extend my screen via wifi. If you can guide me to correct
resources, I would love to work on this
Naveen <comment><USER2> There's splashtop 2 , which lets you remote desktop your pc to an android tablet , and will work for games if your pc is strong enough. As far as i can tell(from some google research) it's the best one for games in the market.

If your TV can run android apps, you might be set. If not, there are plenty of set top boxes or hdmi plugs that run android. But choose one that would be fast enough.

Regarding doing it alone: as far as i can tell, efficenly compressing the video on a pc with low latency and decoding it on the other side is a hard problem, not a side project.

And if you try,i think it would be wise to use something stronger than raspberry pi ,as least for starters.

</comment><comment><USER3> You could turn the problem around somewhat. Have a small but powerful enough computer on your LAN that's connected via HDMI to your TV. Now log in from your laptop over your LAN to the small PC and have the TV be (one of) the small PC's display device.

X.

</comment><comment><USER4> The upcoming OS X Mavericks release will support external displays over AirPlay and AppleTV.

[http://www.apple.com/osx/preview/#multiple- displays](http://www.apple.com/osx/preview/#multiple-displays)

<comment><AUTHOR> again, this si restrictive to Apple eco-system. Apple TV + Mac based machine.

Any idea about alternate technologies?</comment></comment>


Straw Hat Riot - <AUTHOR> https://en.wikipedia.org/wiki/Straw_Hat_Riot <comment><USER2> A nice demonstration of the theory that riots start when a well-known signal synchronizes the actions of a critical mass of would-be rioters: [https://scholars-stage.blogspot.com/2020/05/on-days-of- disor...](https://scholars-stage.blogspot.com/2020/05/on-days-of- disorder.html)

> 1\. An event occurs that signals to would-be rioters that they may soon be > able to riot.

In this case, the end of straw hat season.

> 2\. This event gathers a crowd. A significant percentage of this > crowd—though rarely, it seems, the majority—are eager for destruction.

In this case, teenagers on the lookout for people wearing straw hats.

> 3\. An entrepreneurial would-be rioter tests the crowd for the presence of > other rioters by engaging in a minor (yet easily perceived) act of carnage.

In this case, by knocking the straw hat off someone's head and stomping on it.

> 4\. Other rioters follow suit, and as the number of offenders grow so does > their willingness to take increasingly brazen acts of vandalism, theft, or > violence.</comment>


Data Exfiltration from Speakerless Air-Gapped Computers via Hard Drive Noise - <AUTHOR> https://arxiv.org/abs/1608.03431 <comment><USER2> Simple general extrapolation: if your device contains any software actuated part whose emissions of any form can be detected via passive sensing, or whose operation can be detected via active sensing, then the device cannot be air gapped.

<comment><USER3> Clive Robinson on Schneier's blog came up with a thorough notion years ago: energy leaks plus "energy gapping" systems. He said if any form of energy or matter could transfer from one system toward anothet device then it should be considered a potential leak. So, you have to physically isolate them then block the whole spectrum practically.

Each new story supports his model. Energy gapping for the win.

<comment><USER4> Yeah, you could probably modulate some CPU load and emit noise from the capacitors that are sitting on the power stage of the CPU.

Scary stuff...

<comment><USER5> [https://www.tau.ac.il/~tromer/acoustic/](https://www.tau.ac.il/~tromer/acoustic/)

</comment></comment></comment></comment><comment><USER6> So this isn't a thing on SSDs?

In all seriousness, this is nothing new. People have been exfiltrating data from the moving parts of drives for years. Even humble floppy drives can send messages at a great distance. Here some vids of them transmitting sound files to external receivers.

[https://www.youtube.com/watch?v=bGSTYvx5c78](https://www.youtube.com/watch?v=bGSTYvx5c78)

[https://www.youtube.com/watch?v=G081hD0nwWE](https://www.youtube.com/watch?v=G081hD0nwWE)

And this guy is does the same with a single HDD.

[https://www.youtube.com/watch?v=_kYlZC7hSV0](https://www.youtube.com/watch?v=_kYlZC7hSV0)

If you have control of any moving part you can tap out messages to either a microphone or someone watching your power consumption.

</comment><comment><USER7> If someone has sufficient physical access to an airgapped computer to both install malware and place detection devices around it, wouldn't there be far simpler ways to exfiltrate data?

<comment><USER8> I believe the point here is you don't need to be able to physically touch the computer. You can be 6 ft away from a server locked from physical access (via lock or other mechanism), although I'm not sure how containers around the airgapped computers affect this data transmission.

</comment></comment><comment><USER9> A few years ago I thought air gapping was foolproof. Now we've seen so many different attacks:

\- HDD noise

\- Ultrasound via speakers

\- Electric capacitor sounds

\- Power supply analysis

\- USB file system

\- LED blinking

\- EM radiation (CPU, monitor)

\- Wireless mouse/keyboard

<comment><USER10> Anything that is interesting at a bank, health or national security level should already be fairly well protected:

* underground or otherwise well shielded facilities

* dedicated server rooms, switch rooms, comms rooms etc etc

* manned 2 stage gates for entry into facility + (electronic) access going into any department inside.

* strict regulations on what kind of equipment goes into the facility. (Wireless anything has been taboo since it came I think.)

What this doesn't handle is mostly:

* hostile sysadmins. You can only do so much about hostile insiders. Pair work, swapping peers, only allow updates once they have been vetted by a second crew etc can reduce the risk as can something as simple as being nice.

* hostile contractors that makes it through despite your extensive vetting. They must also be cold enough to bring fancy surveillance gear despite the risk of getting caught.

* stuxnet-levels of effort from a resourceful and determined opponent, piercing your firewall carefully from the inside. Still then it would take time to get anything meaningful from electronic noise (and at this point the attacker can likely just read the data from memory, Target Credit Card style.

<comment><USER11> All of this equipment needs power so that could be another attack vector. For example, we already have powerline networking. In theory you could include something like that in a power supply, after all it does connect to the motherboard and expansion cards. Of course it would require collusion among many different companies but it may not be out of the realm of a nation state attack.

<comment><USER12> No it wouldn't, it would just require intercepting the computer / parts en- route:

[http://arstechnica.com/tech-policy/2014/05/photos-of-an- nsa-...](http://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade- factory-show-cisco-router-getting-implant/)

<comment><USER10> I remember reading about this.

You are right. But to our defense: at this point we are again beyond the passive eavesdropping scenario I think we discussed above.

When you own the networking gear it is more or less game over for the victim anyway, isn't it?

</comment></comment></comment></comment></comment><comment><USER13> Awesome!

Could this attack be defeated by pumping white noise into a space, or would it have to be too loud to be practical?

<comment><USER14> Perhaps. I would just put the equipment in the "Band Room". i.e. Sound proof, you can't even hear the drummer. Power conditioners will stop most signal leakage. There are no windows in the band room, so LED's aren't an issue.

Not enough? Have folks play heavy metal with 12 4kw amps. Anyone trying to monitor will have their ears bleed.

<comment><USER15> Unless the hard drive holds data in the petabyte area, I think it just might be more cost effective today to use SSD. Although the SSD route might exceed the cost for the options you mentioned, SSD has other advantages including being future proof.

</comment></comment></comment><comment><USER16> So, this is the practical version of using your hardware to play music?

(Example) :) [https://www.youtube.com/watch?v=w68qZ8JvBds](https://www.youtube.com/watch?v=w68qZ8JvBds)

</comment><comment><USER17> Yet another reason to move to SSDs...

<comment><USER18> "Data Exfiltration from Speakerless Air-Gapped Computers with SSDs via CPU Fan Noise"

<comment><AUTHOR> The inertia of the fan blades rotating probably limits the data rates you can get with this method, assuming rotation speed correlates with sound frequency (to distinguish between 1 and 0). I would guess it might be a few bits/minute.

};-)

<comment><USER19> And the hysteresis of the cooling policy.

<comment><USER20> "Data Exfiltration from Speakerless Air-Gapped fanless Computers with SSDs via screen brightness variation."

"Data Exfiltration from Speakerless Air-Gapped fanless Computers with SSDs via subtle screen color-temperature variation."

<comment><USER21> I remember reading, in a computer magazine about 15 years ago about a technology, or else an area of research that claimed to do just this. To infer what is being typed on-screen from subtle variations in radiation emitted from the monitors. Apparently some degree of success was possible even outside a building. It probably related more to the CRTs of the day, and the less noisy UIs.

<comment><USER22> Van Eck Phreaking: [https://en.wikipedia.org/wiki/Van_Eck_phreaking](https://en.wikipedia.org/wiki/Van_Eck_phreaking)

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> Flashing LEDs is a possibility too. Like Morse Code, you could flash a dit and a dah (1 and 0) to represents bits. More advanced techniques using proper timing and spacing to form letters and words may allow for more data extraction. I bet you could get about 60 characters (bytes) per minute. Maybe more. Would need a smart phone or camera to read it.

<comment><USER24> LEDs can be pretty darn quick. My friend was able to use a status LED on his FPGA board as a toslink transmitter.

</comment></comment><comment><USER25> You know where this is going?

iPads. Kept in a Faraday cage and provisioned with apps over a cable from a neutered host (read-only drive, maybe? Anyway: locked down and firewalled to prevent unapproved software updates).

Alternatively: the market for refurbed LSI-11s is booming.

<comment><USER26> I don't get it… What is it about LSI-11 is that makes it useful in this context?

<comment><USER25> ... It pre-dates TCP/IP (not to mention most of the bells and whistles malware can get its hooks into, not to mention not generally having any audio i/o at all, or a bunch of other surplus doodads people expect these days that expand the threat surface of the machine).

<comment><USER26> Ah, I see :)

</comment></comment></comment></comment><comment><USER27> Given that stuxnet was probably delivered through USB, the only way forward is not going to be prevention but detection by having both automated gaurds and "physical" guards.

</comment><comment><USER28> a white or pink noise generator may overcome this, seems strange to consider, but then again, the vector even sounds trange.

</comment><comment><USER29> That's just crazy! Such cleverness!</comment>


Still Starting Up - <AUTHOR> http://www.nytimes.com/2014/04/28/business/still-starting-up.html <comment><USER2> This comment thread and the article itself are like parodies of all of the detachment from reality that the tech industry faces. Only in this community do you increase in investment size by 200% over a 4 year period and still see people questioning whether your market is becoming more viable. New York's investment share is apparently more than 1/4 that of Silicon Valley and climbing. That's a big deal for a city that was once seen as tied exclusively to old money.

"The amount of venture, angel and private equity money invested in New York soared about 200 percent from 2009 to 2013, to $3 billion from $799 million, according to CB Insights, a data analysis firm that specializes in venture capital trends. Silicon Valley, by contrast, took in $11.4 billion in 2013."

<comment><USER3> I don't think anyone questioned if it was becoming more viable, but if you are concerned with macro figures I think this one is much more telling:

SV: Largest exit so far 2014: WhatsApp: 19B

NY: Top 5 exits since 2009: Tumblr: 1.1B Indeed: 1.0B Buddy Media: 745M Shutterstock: 570M Ascend Health: 500M

Not sure where the parody or detachment from reality factors in.

<comment> k-mcgrady Is it really fair to compare the exit of WhatsApp with Tumblr? Tumblr has been around much longer, is used regularly by a lot of people, and isn't too hard to monetise via advertising. WhatsApp was purchased by a giant with a lot of money simply to prevent it's competitors from getting it. Obviously WhatsApp provided a lot more value to it's investors but the comparison just doesn't seem fair to me.

Edit:

It's also important to realise that our idea of a huge exit has changed rapidly over the last few years largely because of Facebook. A couple of years ago Instagram's $1bn astonished people. And yet Tumblr's $1.1bn isn't considered huge?

<comment><USER3> I wasn't trying to compare WhatsApp to Tumblr, I was trying to compare one exit this year vs the top exists from an entire ecosystem over the past 5 years.

I think New York is great, and I think Tumblr is great, but I think if Tumblr were perhaps in SV, things could have went differently.

</comment></comment></comment></comment><comment><USER4> Let's stop with the comparisons to the Valley. Let's stop trying to be like the Valley. NYC's edge is the fact that we're exposed to so many different industries and cultures, many of which have not yet been "modernized" with tech. Let's focus on that.

<comment><USER3> In my experience that makes it a better place to live -- but not necessarily a better place to try to build a (very large) technology company.

The difference between NYC and the Valley was unclear to me when I lived in New York, but after spending just a few months out west, it became very apparent to me that there is an order of magnitude difference between the two -- and I believe that will translate into an increased chance of success.

There are lots of reasons that New York just doesn't compete with SV, mostly to do with people and networking, but the difference that really struck me was the openness and positivity in the Valley. Yes there's an echo chamber, and yes you need to keep your BS detector on at all times, but when you are just 3 or 4 people trying to crack into a behemoth of an industry you need all the help you can get. I felt lots of people in New York were looking for weaknesses in what we were doing or trying to figure out who would acquire us, whereas people in the Valley were looking for ways to help us really succeed.

The combined operating experience is not only greater in the Valley, but much more accessible too. I felt like larger companies like Tumblr and Foursquare were silo'd off from everyone else, whereas you can barely shake a stick in Mountain View without hitting someone at Google.

Personally, I believe New York is the greatest city in the world and due to it's culture and array of experiences, a great place to start a company -- but if you want to build a big tech company, you should move out west. In fact, it's one of YC's indicators of success after going through the program.

As a side note, the closest thing I've seen on the east coast with a similar vibe to the valley is Waterloo, Ontario. Although very, very small, they've somehow captured that same feeling.

<comment><USER5> > I felt lots of people in New York were looking for weaknesses in what we > were doing or trying to figure out who would acquire us, whereas people in > the Valley were looking for ways to help us really succeed.

NYC is a weary, jaded and cynical metropolis, it's inhabitants perpetually cranky from six months of winter in their cramped, expensive, rented domiciles.

It's not your company, it's their depressed mood coupled with feelings of inferiority constantly triggered by the immense glittering wealth that surrounds them, always just out of their grasp.

<comment><USER6> Here's another hypothesis.

It's the finance industry culture. Why?

Finance is a zero-sum game. That leads to a set of incentives where what you need to do is beat the next guy.

Tech is almost the opposite of a zero-sum games. That leads to a set of incentives where what you need to do is crack a complex problem. Cracking complex problems requires collaboration.

<comment><USER7> "Here's another hypothesis: It's the finance industry culture."

I have been on boards in the valley and in NYC, and I can see this very directly. The NY VCs were far more transactional, and more aggressively willing to drop a company and take the loss early.

Not that it's rainbows and unicorns in the valley! The VCs, after all, work for their customers (err, "LPs"). I've noticed that as the valley VCs are more and more frequently finance rather than former operating guys that they are more like this. I saw it in the dot-com boom, and guess which VCs got shellacked? Mostly the finance guys.

</comment></comment></comment></comment></comment><comment><USER8> According to Brad Feld's book "Startup Communities" you have to be committed to a place for 10 years to see any real change. He mentions politicians as being too short sighted for not being able to carry thru for that long. I'm not sure if it's been 10 years for the New York Startup scene, but maybe NY Times is being a little hasty. If the current political establishment keeps it's support up and so does the next batch, I think the NY has a very decent chance indeed.

However, it's the tough times that will tell whether NYC Startup Culture endures, especially when the hype has died down and the economy has had another mood swing. I remember after the 90's .com boom people in the city acted like tech was over (the boom and subsequent bust was surreal on the people's part too, I thought), but what it proved was when the party's over, all the riff raff falls away and only tech companies that were fairly strong not only made it thru, but thrived.

NYC, shouldn't be Silicon Valley, only Silicon Valley can be that! The city, despite it's many "issues" is one of the most amazing places on earth. I hope the tech that comes out of there is just as amazing and real. Cheers!

<comment><USER9> It's also a question of if you are looking in the right places. NY startups tend to be less pure technology plays that need lots of VC money, and tend to be tied to information intensive industries like advertising and finance. Fintech startups frequently are cash flow positive by the time they hit 20 employees. These aren't game breakers that will get multi-billion dollar valuations, but they build from strength and don't need to become monsters.

The biggest hold-up is actually the cost of living in NYC. It's worse than the Bay Area, and there is less pride in being a starving entrepreneur.

</comment></comment><comment><USER10> non paywall (at least for me) [https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=newss...](https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=newssearch&cd=1&cad=rja&uact=8&ved=0CD4QqQIoADAA&url=http%3A%2F%2Fwww.nytimes.com%2F2014%2F04%2F28%2Fbusiness%2Fstill- starting-up.html%3Fhpw%26rref%3Dbusiness&ei=r-ZdU9zKJ- bisAS6-oKYBg&usg=AFQjCNHhlRPLcSkACDdPvUpB0lAkc0i-ag&sig2=PCUy- OYv9cHhq4z4baUTEQ&bvm=bv.65397613,d.cWc)

</comment><comment><USER11> 'No New York startup has been a breakout hit with a multi-billion valuation'

'Tumblr, the blogging service based in downtown Manhattan, made headlines last May when Yahoo acquired it for $1.1 billion. '

I don't know where the writer hails from, but 1.1 billion isn't exactly chump change.

It's unlikely that any one city can overtake anotner for a specific industry. It's unlikely that San Francisco coudl ever supplant Wall St, despite San Francisco having a large financial centre.

The top people will want to go to Wall St for finance, and the Valley for tech companies. Very hard to reverse that, and I don't see a lot of reasons why anyone would want to.

<comment><USER12> I'll bet you 0.5 bitcoin that in 20 years the financial industry is bigger in San Francisco than in New York.

<comment><USER13> How about 500 USD to be settled in bitcoin (or similar virtual currency)? The metric for winning will be where the top (by market cap) 10 finance companies are headquartered at midnight Apr 28, 2034. If more are in NYC, I win. If more are in San Francisco, you win. If it's a tie, the "next highest" will be added until it isn't a tie.

Deal?

</comment></comment></comment><comment><USER14> > "Being in the San Francisco area, he said, helps start-up founders know the > right people to pick up on bits of gossip about new product releases or > venture financing rounds."

I'm based in Dallas, so I am wondering from a Sillicon Valley/SF perspective, how beneficial is this data point?

Or is it one of those data points that keep the overall investor excitement of early stage startup investments going, but doesn't actually help early stage start ups with their own companies?

<comment><USER15> This does boil down to a point: do media and blogs write about startups that are interesting and/or important, or those who they can grab coffee, beers etc with. Quite often I've found being in the same city with someone covering helps you immensely, as many European startups can attest to. Hard to build those relationships from another city. Same goes for investors, biz dev partners etc.

<comment><USER16> Do you even have to ask the question? Of course it helps being able to meet someone in real space to win them over to your cause.

</comment></comment></comment><comment><USER17> I wonder how much employment laws play into this also? I moved from California (born and raised) to New York three years ago and currently work for a "Start up". I've been stunned to find the differences in employment laws, taxes, non- compete, cost of living etc.

<comment><USER18> I think some of us may really like to hear specifics regarding these stunning differences. I grew up in NY and as far as I can tell both NY and SV are high tax areas with extremely high costs of living.

</comment></comment><comment><USER19> If someone could be so kind as to paste-bin this, I'd be grateful. The NYTimes paywall has been in full force lately (probably due to me being on uni IP?) considering that I rarely visit the site.

<comment><USER20> If you open the article up in incognito mode in chrome it will get you past the paywall.

<comment><USER21> Appending '?share' to the URL will do it as well.

<comment><USER19> cheers!

</comment></comment></comment></comment><comment><USER22> I loathe all the armchair sociologists here, trying to blame the status of NYC's tech scene on everything from NYC's finance culture, to the supposed unfriendliness of New Yorkers, to the colder weather. Get over yourselves. We don't know what makes for a good start up community. You might have some hunches, but you're just as clueless as the rest of us.

Besides, I for one am glad NYC is not the valley. Who says you folks in the valley are right about everything?

<comment><USER23> `Also glad NYC is not the valley. But there _is_ reason for it. It's not random. I think SV was first to market. This is more or less in keeping with my sentiments about it: [http://www.evanmiller.org/marketing-startup- hubs.html](http://www.evanmiller.org/marketing-startup-hubs.html)

</comment></comment><comment><USER24> Like everyone's been saying I think these kind of things take time. I think all in all the shift in startup culture has been dramatic over the last ten years in NYC. Its only a matter of time for an iconic tech company to come out of NYC, especially if investments keeps growing.</comment>


Instapaper like article extractor demo now online - <AUTHOR> http://jimplush.com/blog/goose

<comment><USER2> Nice! I worked on something similar a year ago but for the Ruby world. If you're on a Unix with Ruby installed (e.g. OS X), you can mostly repeat the linked demo like so:

        gem install pismo
        pismo http://techcrunch.com/2011/06/09/twitter-ios/ title lede author datetime body

And then enjoy the output. No image pick out, but it's the first IMG tag in the 'html_body'.. just never got around to implementing it as I didn't need that feature.

The downside is I haven't worked on it for months and it's in sore need of improvements. For its current in-production use though, it's proving sufficient and a reasonable option for Rubyists. More info at <https://github.com/peterc/pismo>

Not knocking Jim's work on Plush, btw, he's actively working on it so if Java works out for you, stick to him! :)

</comment><comment><USER3> One thing I've always wanted is something to extract multi-page forum threads and render them in a normalized readable way. For example, Reddit comment threads like IAMAs.

Anyone know of a service or library that does that?

<comment><USER4> I actually started playing with the concept one weekend for IAmAs specifically. I was trying to do it all client-side and the issue I was running up against was reddit's jsonp responses get VERY slow on large threads.

</comment></comment><comment><USER5> it didn't extract images for the sites i tried. all wordpress blogs. EDIT: i just realized why. those blogs are pulling images from flickr.

</comment><comment><USER6> How is this different from the myriad of other text extraction services, APIs and libraries out there?

<comment><AUTHOR> 1\. it's open sourced 2\. it's embeddable 3\. it extracts images 4\. it's one of the most accurate ([http://www.readwriteweb.com/hack/2011/06/head-to-head- compar...](http://www.readwriteweb.com/hack/2011/06/head-to-head-comparison- of-tex.php)) 5\. it's named after the best top gun character

<comment><USER7> I agree. It works quite well! If it can be formatted to look like Readability's default (which is really quite plesant to read) it would be nice.

</comment></comment></comment><comment><USER8> Cool! I really like how accurate it is; works with almost every site I try. :)

</comment><comment><USER9> Nice work!

</comment><comment><USER10> Everything I try gives a 404.</comment>


Ask HN: What non-work task have you automated? - <AUTHOR> <comment><USER2> I have semi-automated the process of creating XML files for podcast episodes and tagging the MP3 files for upload.

I'm using BBEdit and bash on MacOS X to do both; I have a "worksheet" which is like the old Macintosh Programmer's Worksheet, if anyone remembers those - it's a text document in which you can select text and execute it as a shell command, and the results are piped back into the document.

It's "semi-automated" because I have a block of boilerplate text for each episode, and I type out the text for a short and long title, filename, and info fields. These go into bash variables. Then I just select the lines one by one and execute them. This allows me to sanity-check the results. Then I can just copy and paste the block of generated XML for each episode, paste it into the staging feed file, sync it via FTP, test the staging feed to verify that I can download the episode and that the tags all look correct, then, when I'm satisfied with it, put the XML in the production feed file.

This saves me a considerable amount of hand-editing of the XML and MP3 file metadata, which is quite error-prone. "Fully automated" was not really going to help in this case since very likely that would just automatically publish metadata and XML with errors.

</comment><comment><USER3> I kept forgetting my keys at work, so I automated my lock. You can see it in action here: [https://www.youtube.com/watch?v=B-9hKzVNNs0](https://www.youtube.com/watch?v=B-9hKzVNNs0)

<comment><USER4> This is great! Could you please provide any instructions on how you achieved it?</comment></comment>


Can stock photography be sexist? - <AUTHOR> http://www.racked.com/2015/11/5/9648598/stock-photography-sexist-getty-images-shutterstock <comment><USER2> Trick question, anything can be and in fact is sexist.</comment>


Gene-testing company 23andMe is sharing its users' data with Pfizer - <AUTHOR> http://www.vox.com/2015/1/13/7536805/23andme-privacy

<comment><USER2> A lot of 23andMe customers want their data shared in order to find cures and treatments for diseases. I think this is a good thing.</comment>


Greeks are rushing to Bitcoin - <AUTHOR> http://money.cnn.com/2015/06/29/technology/greece-bitcoin/index.html?iid=hp-stack-dom

<comment><USER2> Ofcourse Greece has full capital export restrictions so to buy bitcoin one needs pigeons that can fly from Greece to Europe with GPS precision to carry the money.

</comment><comment><USER3> They are replacing one unstable system with another. Bitcoin is a great idea..but the ups and downs are so massive right now, it's just not a good replacement.

Not to mention all of the exchanges that have gotten robbed in the last 6 months..</comment>


Ask HN: Sites, guides, videos to learn math by programming? - <AUTHOR> <comment><USER2> I think your question is underspecified. What are your _concrete_ goals? What kind of mathematics do you want to learn, and how do you want to apply it? Given that information we can make more prescriptive suggestions. As stated, your question doesn't give us any information on your current level of mathematical maturity or background knowledge. Do you already know discrete mathematics? Do you know calculus? These are meaningful questions that impact how appropriate any given answer is.

I also disagree with the implicit premise of the question. I wouldn't recommend you try to learn any kind of nontrivial math by trying to program it. Learning e.g. _linear algebra_ as opposed to just _matrix multiplication_ implies understanding the theory of vector spaces and linear transformations. You can certainly implement algorithms based off of results in linear algebra, and you can implement operations (like scalar-vector multiplication), but programming doesn't really make sense as a tool to help you learn the mathematics unless all you want to do is computation.

</comment><comment><USER3> [https://github.com/Jam3/math-as-code](https://github.com/Jam3/math-as-code)

Take a look at this. It translates a whole load of maths notation into Javascript, which makes it all surprisingly straightforward and non- mysterious, at least as far as the symbols are concerned.

</comment><comment><USER4> Learning math for programming or by programming? Not sure about the usefulness of programming to learning Math. For Statistics, I can see the added value ([https://speakerdeck.com/jakevdp/statistics-for- hackers](https://speakerdeck.com/jakevdp/statistics-for-hackers)).

Do you have any examples?

<comment><AUTHOR> there's the smart ppl on hn that had talked about how math was way easier when learned by programming

link is somewhere in my massive notes

<comment><USER2> I don't think that really makes sense. Most mathematics cannot actually be learned by programming. They're just different things.

You can _illustrate_ some mathematics (especially set theory and discrete math) with code, and you can _implement_ some mathematical algorithms in code. But to learn mathematics you have to implement the algorithm, not just see it used with examples. In order to implement the algorithm you have to first understand it. To understand it, you have to first build up to it in theory.

If you attempt to learn math by programming it, your understanding of that math is going to be very "shallow". Tools like SageMath and Mathematica are good for computation, but the goal of learning is generality, and that's diminished if you learn through computation. Ideally you'd learn the mathematics _first_ , then apply it - then you can choose to apply it by programming specific results, but that won't be relevant to whether or not you've learned it.

I'd be curious to see the links you're talking about, because I've never heard math people say they learned math by programming. I've heard of people implementing mathematical operations and algorithms in code, but that's not the same thing.

<comment><USER5> Broadly I agree; also I'm no maths professor.

But the talking as if _understanding_ can't be helped by programming, seems wrong to me, if only because I've been doing it all my life. Maybe we have different definitions of _deep_ and _shallow_ , but you can memorize a formula with no understanding. Playing around with it with a program, and seeing what happens, you get a hands-on experience that no amount of ..abstract generality can replace. I keep reading about how the great mathematicians have gotten their results not by doing mysterious genius things only they can, but by getting their hands dirty, playing around with base and border cases, seeing what happens with pencil and paper, in a way identical to mucking around with programs.

To give a couple of concrete examples: I wrote a program that had planets orbiting a central mass, and playing around with it I gained for the first time a gut understanding of _orbiting_ , and how natural it is in 3D space - it's something that just doesn't happen in the normal human environment. Fiddling around with fractal formulae, _seeing what happens_. Drawing the distributions of prime numbers, prime pairs etc. On and on, I could give hundreds of examples, you get the idea.

Sure, it would be silly trying to recreate 2000 years of mathematical progress on your own without reading textbooks, but exploring, getting a feel for things, learning for yourself, is an important part too, to say the least. And one equally deserving the name 'learning', if not more.

Read Oakeshott's essay _Rationalism in Politics_ for the best explanation I've seen for this modern affliction where only things that can be explicitly written down are counted as knowledge. (It's super-enlightening - I was embarrassed how much I learned from it, always a good sign. I even learned a lot about piano teaching—my day job at the time—from reading it.)

<comment><USER2> _> Playing around with it with a program, and seeing what happens, you get a hands-on experience that no amount of ..abstract generality can replace._

That's not really correct. I think we're talking about two different things. I'm not stating that you can learn mathematics without actively doing it. I'm stating that programming is a poor medium with which to actively do mathematics _until_ you've already learned it. Active learning is absolutely important, which is why solving problems is important. But those problems rarely take a form that are straigtforward to implement in code.

The reason is because the broader theory of mathematics does not translate into code without significant difficulty. You can do _computation_ of particular formulas by implementing them in code, but it would be strange to e.g. reason about what a field is by writing code to generate an array of numbers that technically adheres to the field axioms for addition and multiplication. You can do it, and it would help you a lot for operations over fields, but that isn't going to help you prove that the set of all rational numbers is a field. You're already past that if you're implementing the code, because the computer is implicitly accepting that all _xy_ and _x + y_ are in _Q_ if _x_ and _y_ are in _Q_.

I'm a fan of using something like SageMath or Mathematica in a learning environment for computational math homework. But I honestly can't imagine learning from a textbook and following along by writing code. The code is very useful for deriving insights about _what_ something is, but it's not as useful for insights about _why_ something is.

<comment><USER5> Sure. A couple of comments only:

The example you give of fields is a good one, but one counter-example of an area where playing around doesn't help much if at all, doesn't really affect the question whether you can learn maths by programming, to which the answer 'No' seems wrong to me. If one person is blind, it doesn't mean nobody can see. Sure, you can't learn all of it. But the other extreme, where you seem to be saying, you can't learn anything—which saying things like that you can't learn a particular piece of maths from programming "until you've already learned it" seem close to—seems equally wrong to me. In the area you're talking about, sure, it's hard to see how computers would help ones intuition. But that's very far from meaning that all areas are like that.

Also, you're talking about problems, homework - answering other peoples' questions. I didn't have that in mind, but learning, exploring for oneself. And in areas where _no-one_ knows the why, one is exploring the what, how things work. I think you're just thinking of abstract areas where that's not really possible, but in a lot of areas it absolutely is.

But yes, I think we're not disagreeing so much as talking and focussing on different aspects/areas of mathematics. And probably you know muuch more maths than I do, and possibly mucking around with computers is of less use in the higher realms than in the lowly plains I inhabit. But still, I can't help thinking that the problem with thinking that knowledge is exhausted by _know- that_ ( _know-how_ disregarded as not real/important because can't be written down explicitly, as diagnosed in _Rationalism in Politics_ ) is a part of thinking that the things that you say, correct as they are, fit together into any kind of argument that programming is of no use in learning mathematics. But it seems we have entirely different levels/areas in mind.

Thanks for the comments, very interesting.

</comment></comment></comment></comment></comment></comment><comment><USER6> I would recommend Brilliant [0], it contains courses and exercises on math, science, and computer science. This site also offers weekly challenging problems.

[0]: [https://brilliant.org](https://brilliant.org)

</comment><comment><USER7> Project Euler [0] comes to mind, although it's more of a collection of math problems to be solved by programming. Definitely not a guide or tutorial.

[0]: [https://projecteuler.net/](https://projecteuler.net/)

</comment><comment><USER8> This is something I've been interested in as well. I have dyscalculia and struggled in school with math and formal notation but have never really had a problem when it comes to understanding code. I wish someone smarter than me would teach stuff like algebra, calculus and statistics in something like javascript.

</comment><comment><USER9> Check out this book called "Doing Math with Python". [https://nostarch.com/doingmathwithpython](https://nostarch.com/doingmathwithpython)

</comment><comment><USER10> Coding Math ([https://www.youtube.com/user/codingmath](https://www.youtube.com/user/codingmath))

</comment><comment><USER11> If you want to learn Math, Kahn Academy is very good.

</comment><comment><USER12> Coding the matrix (book)</comment>


Davidw's wildly off topic guide to the Veneto region of Italy - <AUTHOR> http://padovachronicles.welton.it/2008/09/05/visiting-italy-places-to-see-things-to-do

<comment><AUTHOR> A while ago, pg asked about places to visit in Europe:

<http://news.ycombinator.com/item?id=294321>

which got me to thinking that I ought to write down some of what I know about Italy. This series of articles is the result. I know it's completely off topic, but I figured someone would be interested in them, and near as I can tell, there's not much of politics/religion/monetary theory in them, so they oughtn't be very controversial.</comment>


China's Race for Patents to Build an Innovation Economy - <AUTHOR> http://www.nytimes.com/2011/01/02/business/02unboxed.html?src=twr

<comment><USER2> Aaaaah this is so frustrating. Now we have another country clamouring to build useless and vague "ideas" as patents. When will the madness end?</comment>


Sell the Right to Immigrate - <AUTHOR> http://www.becker-posner-blog.com/archives/2005/02/sell_the_right.html <comment> patrickg-zill Canada did/does this sometimes.

It is part of the reason that Vancouver is nicknamed "Hongcouver" - lots of rich Hong Kong residents got worried over the handover from the British to China, and bought themselves a guarantee of being able to live in Canada, should something bad happen.

<comment><USER2> Ah yes, racism with a little "r". I shake my head at the "witty" folks of my home town. :(

</comment></comment><comment><USER3> This sounds like a horrible idea. I think it would tip the scales even further towards only allowing the rich in (for which the current system is already biased).

You want the best and brightest. It seems he's using this money as a metric for determination, but I suspect it'd be more a discriminator for wealth. I think Paul's idea of allowing founders in and his terms suggested sound like a better predictor of determination.

<comment><USER4> 50.000 dollars (or any similar number) is an unimaginable amount of money outside US, EU and few other happy countries. No one can afford that, no matter how hard he would try, even a plane ticket is worth savings of whole family for just one person.

I guess only organized crime would profit -- provide the money and then blackmail everyone. The immigrant whose whole family is in giant debt, the family... For US it would mean communities of hopeless immigrants from poor countries, entrapped by a vision of better life, held as captives by a mafia. This already happens, and it could only worsen.

<comment><USER5> Even in that case, we'd be more likely to get an electrical engineer with a PhD than an illiterate farmer.

What would happen in a system like this is that the employers would pay for it. If GE, IBM, or Microsoft got the chance to bring in people like this, they would take it.

<comment><USER6> These people probably already get H1-B Visas - which is one of the few (only?) work visas that also implies intent to become a permanent resident, so they can file for a green card if their company sponsors them.

H1-B Visas aren't exactly what's being proposed because there's still a limited number of them each year, but there is a cost to the company for sponsoring someone.

</comment></comment></comment></comment><comment><USER7> I particularly like this quote: "For example, if skilled individuals could earn $10 an hour in a country like India or China, and $40 an hour in the United States, by moving they would gain $60,000 a year (before taxes and assuming 2000 hours of work per year)." And also assuming that the cost of living for said young person is equivalent in both Silicon Valley and, say, India.

This guy is a loon.

<comment><USER8> this argument isn't that bad. he makes a bad assumption that living expenses are the same in both countries, but this can easily be remedied.

say skilled individuals make $1 an hour in India or China, after expenses. say those skilled individuals make $10 an hour in the United States, after expenses. In one year, they'd gain about $18,000. If you set the fee lower, that's not too bad for a skilled worker.

problem is, the bigger issue with immigration is unskilled labor. these people wouldn't be able to pay back loans for entrance fees, and its there that most of the issues with enforcement arise.

maybe this would work, but it seems like its solving only a small part of the problem

</comment></comment><comment><USER9> The US is already selling the right to immigrate, in the form of H1-B visa holders who are willing to accept indentured servitude in the hope that they'll eventually get a green card. The difference is that, unlike the scheme proposed by this author, the benefits flow to a few private companies rather than to the state.</comment>


Things Every Aspiring Entrepreneur Should Know - <AUTHOR> http://postmasculine.com/33-things-every-aspiring-entrepreneur-should-know

<comment><USER2> Honestly if you are starting a startup to get rich, just quit and get a real job because you'll get richer quicker. Unless you are a consultant (and thats not really a startup), you will most likely not end up rich, and stats show this. You may bring in a modest salary of 100k+ (That you can pull in anyways in the valley as an engineer), but you'll work far harder for that cash than that other engineer who just has a job. Find something you are really passionate about, and work towards either working on it or start working on it if its possible. I get it, I'm 23 with a wife and kid, but I don't let it stop me from making things, and I certainly don't complain about the choices I made. Yeah, a kid takes time, but that doesn't mean I can't make time. A wife takes time, but I still have 2+ hours per day at least to work on my ideas/read and workout. Thats with a job that eats up 9 hours a day. Being an entrepreneur is a mindset rather than an occupation. If you want to build something (and I mean really want to build it), nothing will stop you.

</comment><comment><USER3> I agree with much of what the OP talked about but there are a few things that I 100% disagree with. For example: "Burn the boats behind you". Absolutely the worst advice I have ever heard. I have hopped around from agency to agency and have good relations with them all and I do sometimes call on those relationships for business reasons. DO NOT BURN YOUR BOATS OR BRIDGES!

<comment><USER4> I dont think OP meant burn all your personal relationships. I think he may have meant to make the jump to working for yourself fulltime, rather than having the cushion of a salary job.

</comment></comment><comment><USER5> I think these are good advises about the mindset you need to be a successfull entrepreneur. But I do believe you need even more luck if passion if your main driver. I admit you need to like what you do but if you want to create something big you need to have a business focused approach and constantly analyse/test how technology can transform your product into the best fit for your clients. To stick to this methodology you need more ambition than passion.

</comment><comment><USER6> What a silly and misleading article...shame

</comment><comment><USER7> Disagree with "do what you love" and "follow your passion" type advice. Do the stuff nobody else wants to or thinks to do.

</comment><comment> clark-kent You lost me at Frank Kern... if you listen those characters then we are from the opposite sides of the business world.

</comment><comment><USER8> actually very interesting and well said; I did read it word by word till the end, and didn't felt like skipping even once. I think a lot of people will feel the same :)

btw, yeah I'm scared to death right now of failing, and I hope it works no matter what for me, what I'm doing.</comment>


White House launches tool to report political censorship on social media - <AUTHOR> https://whitehouse.typeform.com/to/Jti9QH <comment><USER2> How is it censorship if a private company does the moderation? We've long been told that we have freedom of speech, but nobody has to listen, and most definitely nobody else has to pay for it. There are, of course, exceptions. Some private entities operate "common carriers" and aren't allowed to moderate what they carry, but as far as I can tell, twitter, Facebook, etc, are not common carriers.

The USA got rid of the "fairness doctrine" in broadcasting over just such issues, as I recall. Why the sudden about face?

This effort to collect complaints seems a little anti-free-market, and a little like government overreach if the point is to make Twitter and Facebook and whatever other company carry particular political speech.

<comment><USER3> >Why the sudden about face?

The current narrative by Trump, his supporters and the Republican party is that all social media sites are controlled by leftist ideologues and globalists and are currently engaged in a coordinated effort to suppress and purge Conservative, Christian and Republican speech, because they're terrified of the threat that he poses to the deep state and the establishment.

There is also a second narrative, put forth by white supremacists and the alt- right, which attempts to push the Overton Window of normalization on such views by implying that deplatforming or censoring anyone on the right, however extreme, hateful or lunatic fringe, should be interpreted as an attack on mainstream Conservative or Republican politics.

This form, like the wall, is an expression of propaganda and nothing more.

<comment><USER2> I agree completely, but I find that if I express less than absolute doctrinaire capitalist opinions on Hackernews, they get downvoted pretty rapidly. I am experimenting with posting non-doctrinaire capitalist opinions as questions about contradictions, like my question above, where I state that I'm a firm free market capitalist, just confused about why there's a contradiction in a government or corporation's actions.

</comment></comment></comment><comment><USER4> Vouch'd as this is relevant to HN discourse

<comment><USER5> The web form looks like horrible, looks like a prototype of some sort.

Also they should make a version that does not require JavaScript, for this type of form, this should not be difficult.

I am also not clear, to be honest, what remit/legal framework/ US agency remit is involved in setting up this kind of complaint collection.

Would this fall be FCC, DOJ or something else?</comment></comment>


Change your passwords: Comcast hushes, minimizes serious hack - <AUTHOR> http://www.zdnet.com/change-your-passwords-comcast-hushes-minimizes-serious-hack-7000026118/ <comment><USER2> I really dislike Comcast I wish there was a viable competitor for Internet in my area.

<comment><USER3> Really? I am new to the US but I have been really happy with my Comcast. Self install was easy and quick, billing has always worked out fine, and while not super affordable, 50mbit is the fastest internet I've ever had at home. IPv6 too!

<comment><USER4> Wait until you need something fixed. I'm in a residential neighborhood and have their Business service (faster response, higher speeds, more expensive). I'm often the first one to report a problem. What kills me is that 99% of the time it's not anywhere near my modem, but they insist on sending someone to my location before they'll even do a traceroute and see where the real problem is.

I usually just keep calling until someone knows what traceroute is. Then, I plead with them to run it before making me do all the things I already did ("Please power cycle the modem" ... and wait several minutes).

And, I haven't even gotten to when they started charging me $10/mo for the router, when they told me it was included in the service. Their reason? It's not required equipment. But it is. I have a static IP and I have to use their modem. However, I didn't find this out until I bought two different modems at the suggestion of different CSRs. Thankfully I bought them from Amazon and didn't have to pay a restocking fee or postage.

So, yeah, when it works and you're in the first year, it's all good. Otherwise, they suck ass.

<comment><USER5> When I was considering switching from very slow DSL to Comcast in 2010, I looked at the Comcast business class contract for my home office. OMG that is a bad contract. You can get free or reduced installation charges for longer contract terms, but if you stop using the service during the term (e.g., you move), you still owe Comcast for 75% of the charges you would have paid for the entire term. Here is that clause:

"Termination Charges: Charges that may be imposed by Comcast if, prior to the end of the applicable Service Term (a)Comcast terminates Services for cause or (b) Customer terminates Services without cause. Termination Charges with respect to each terminated Service Order shall equal, in addition to all amounts payable by Customer in accordance with Section 5.3, seventy-five percent (75%) of the remaining monthly fees that would have been payable by Customer under the Service Order if the Services described in the Service Order had been provided until the end of the Service Term. In the event the Agreement is terminated as herein described during the initial Service Term, Termination Charges shall also include one hundred percent (100%) of any amount paid by Comcast in connection with Custom Installation, as that term is defined in Section 2.6, for the Services provided by Comcast under the Service Order."

This and some other weird clauses totally freaked me out for business class. I backed off and ended up getting normal consumer class, and then relayed anything needing a static IP off a $15/yr VPS. That has worked out really well and I am a happy Comcast customer, which is a pleasant surprise for me. (Fingers crossed!)

</comment></comment></comment></comment><comment><USER6> It's impossible for me to change my Comcast password ... let me explain. I have a "custom" email address for my Comcast account. I have never used the Comcast provided email or login (customer for 10+ years). Many years ago when I signed up I managed to setup my own email and have used it ever since.

Fast forward 5 years and I'm attempting to authenticate an iPad TV app with my Comcast account and I have a brain freeze on my password. I attempt a reset and it doesn't' work. I try again, and again, from differing machines and finally call. Long story short they have no record of my email and can't reset the password. My only option is to revert to the Comcast supplied email which I have never used and don't even know.

Luckily I remembered my password and was able to simply move on but was shocked that there was simply no official way for me to retrieve or reset my password yet I have an account that still works (even for billing)

<comment><USER7> Support will reset your password if you verify your information with them. I just had to do this for my mom so she could watch the Olympics on her ipad.

<comment><USER6> I tried (via telephone) and they basically told me it was impossible, they had no record of my email in their system. This could have been simply incompetent support, however as I successfully guessed my old password I didn't feel like wasting another hour explaining my situation to a new rep with a small likelihood of solving or even improving my situation.

</comment></comment></comment><comment><USER8> I haven't been a Comcast subscriber in years, but I wonder if my credentials from ages ago could have been compromised?

<comment><USER9> Set them up with a unique password; then, even when this situation repeats, you'll only have exposed your Comcast account (likely not that important).

</comment></comment><comment><USER10> Apparently they did more. On 8th Feb, I had these two IP addresses checking out my who.is page.

184.108.40.206

220.127.116.11

I was certainly only curious, because it was a unpublished website with deny- all for all robots., so tried a reverse-ip using Who.is; To my surprise, the who.is page for the above two I.P. didn't load, thought it was maybe my connection, but then, when I used Whois.net to end up with the same result, I knew something was going on.

It was only after I googled the I.P address I found some dutch reverse I.P sites that said it was from comcast servers. Though I have nothing worth hiding, and it was just a testing ground for me, this was apparently not nice. I only got to know about the hack yesterday.

Perhaps they bulk collected data, using comcast servers?

<comment><USER11> Those IPs have nothing to do with Comcast; they're not owned, hosted by or routed through Comcast. They both resolve to whois.sc -- a whois lookup site; indexing whois records is what they do.

        # nslookup 220.127.116.11
        10.165.246.64.in-addr.arpa      name = www.whois.sc.

        # nslookup 126.96.36.199
        22.214.171.124.in-addr.arpa     name = www.whois.sc.

</comment></comment><comment><USER12> Can someone confirm exposure level? From article it seems only comcast email and forum servers were hacked.

Comcast user here, wondering if I need to change comcast account password.

<comment><USER13> Just do it; assume the worst; save yourself real trouble.

<comment><USER14> I have comcast, but have no idea what my account credentials are. I have never logged in to anything for them...

<comment><USER15> [https://login.comcast.net/myaccount/lookup](https://login.comcast.net/myaccount/lookup)

Use that with your service location to get your username and from there do a password reset.

</comment></comment></comment></comment><comment><USER16> Free HBOGO for everyone!</comment>


Florida Current is weaker now than at any point in the past century - <AUTHOR> https://www.whoi.edu/press-room/news-release/florida-current-weakening/ <comment><USER2> There is a nice video explaining the AMOC (Atlantic Meridional Overturning Circulation) by Just Have a Think [https://www.youtube.com/watch?v=6Yz8nZbZPE8](https://www.youtube.com/watch?v=6Yz8nZbZPE8)

<comment><USER3> Wow, incredibly informative video. That was actually worth 10 minutes to watch!

</comment></comment><comment><USER4> Please read the original paper to look at the data otherwise there is not much to discuss

[https://www.nature.com/articles/s41467-020-17761-w](https://www.nature.com/articles/s41467-020-17761-w)

<comment><USER5> Thanks for the link, the thing I wanted to know and this paper answered was _how_ they measured the current and this was the cool part! They used voltage induction caused by salt water flowing past abandoned submarine telephone cables. [1]

[1][https://journals.ametsoc.org/jtech/article/31/5/1169/262](https://journals.ametsoc.org/jtech/article/31/5/1169/262)

</comment></comment><comment><USER6> From the conclusions:

> I applied Bayesian data analysis to observations from submarine cables and > tide gauges to infer the changes in the Florida Current transport at 27°N > during 1909–2018.

These are important techniques for deriving a proxy for missing historical flow data. I have no confidence that the algorithms model a real-world trend but it seems to have promise as one component of a decent future model.

<comment><USER7> I did open the article/Ctrl + F for submarine cables(where did that come from?)

But was curious what can you tell from those cables? Aren't they inaccessible? Is it a strain thing or do they somehow have positioning?

<comment><USER6> I followed qserasera's link to the Nature paper. The Methods [1] section says:

> I also use Florida Current transport from submarine telephone cables at 27∘N > between West Palm Beach and Grand Bahama (Figs. 1b and 2). Using > electromagnetic theory, one can estimate changes in the flow from voltages > induced across the cable due to the transport of charged particles by the > variable current.

[1] [https://www.nature.com/articles/s41467-020-17761-w#Sec8](https://www.nature.com/articles/s41467-020-17761-w#Sec8)

<comment><USER7> What... wow. I was thinking maybe resistance (fiber?) or something but wow. Anyway thanks for that, very interesting.

</comment></comment></comment></comment><comment><USER8> Is this implication of this that the gulf stream will weaken and Northern Europe will cool?

<comment><USER9> Just a theory there is not enough information

[https://en.wikipedia.org/wiki/Shutdown_of_thermohaline_circu...](https://en.wikipedia.org/wiki/Shutdown_of_thermohaline_circulation)

</comment></comment><comment><USER10> Would be really interesting to have a qualitative description of where global ocean flows are increasing, if they are decreasing here? Or if in general, ocean circulation / transport is undergoing some change?

Or watching the video commented below, maybe it's the weakening that's happening _because_ of the warming and freshening of arctic waters like around Greenland.

<comment><USER11> There isn't a "conservation of flow" principle for liquids, so there's no need to go looking for a flow increase somewhere else because this flow is decreasing.</comment></comment>


How Apple hides new functionality in iOS: isYoMamaWearsCombatBootsActive - <AUTHOR> https://github.com/JaviSoto/iOS7-Runtime-Headers/commit/6ccf9c4526992fec0dc414d48e4a3f7446e9822f#commitcomment-4059894 <comment><USER2> I definitely love those kind of easter eggs.

There are also similar methods in the Android SDK:

UserManager.isUserAGoat() link: [http://developer.android.com/reference/android/os/UserManage...](http://developer.android.com/reference/android/os/UserManager.html#isUserAGoat\(\))

Log.wtf() link: [http://developer.android.com/reference/android/util/Log.html...](http://developer.android.com/reference/android/util/Log.html#wtf\(java.lang.String), java.lang.Throwable)

AdapterViewFlipper.fyiWillBeAdvancedByHostKThx() link: [http://developer.android.com/reference/android/widget/Adapte...](http://developer.android.com/reference/android/widget/AdapterViewFlipper.html#fyiWillBeAdvancedByHostKThx\(\))

<comment><USER3> There's been balmy little bits of stuff like this all the way through OSX and iOS for ages, though maybe not quite as flippant.

Every Mac has the kernel extension "Dont Steal Mac OS X.kext" for example, which loads into RAM a short poem.

        There once was was a user that whined
        his existing OS was so blind,
        he'd do better to pirate
        an OS that ran great
        but found his hardware declined.
        Please don't steal Mac OS!
        Really, that's way uncool.

<comment><USER4> Every Maccard on the planet seems to think pirating OS X is an oh so terrible thing to do (to the point that parent post is bringing up poems about it like its a cute, non-weird thing). At the same time pirating everything else on the planet seemingly is OK.

I've never understood the rationale behind this.

Keep in mind I'm a software developer myself and run strictly non-pirated software, and open-source as much as possible. You could never make me replace a Linux desktop with a limited OS X experience, and I see no reason what so ever to put in the effort to pirate it.

But why is it worse to pirate a OS with bad hardware-support out of the box than pirating... say Microsoft Office? I'm just curious what's up with that.

<comment><USER5> What is a Maccard? I've never heard anyone say that pirating OS X was more ok than any other kind of piracy.

<comment><USER4> Maccard = Mac user.

And the attitude I've seen (especially in the OSX 86 community) is that general piracy is completely OK, but you have to buy OS X from Apple, otherwise you are doing something super-duper wrong. Then they move on to pirate Photoshop.

It's a mind-bending sort of ethics, and I was curious about what the reasoning behind it was.

<comment><USER6> You know 1 person doesn't represent a community right?

<comment><USER7> Sample size of one seems sufficient to establish a general pattern.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> BeOS had is_computer_on() and is_computer_on_fire() APIs:

      int32 is_computer_on(void)

      Returns 1 if the computer is on. If the computer isn't on, the value returned
      by this function is undefined.

      double is_computer_on_fire(void)

      Returns the temperature of the motherboard if the computer is currently on
      fire. If the computer isn't on fire, the function returns some other value.

[http://www.tycomsystems.com/beos/bebook/the%20kernel%20kit/s...](http://www.tycomsystems.com/beos/bebook/the%20kernel%20kit/system.html)

<comment><USER9> Another Good one from Objective C:

2012-08-31 00:26:19.773 App[1676:907] __* -[__NSCFCalendar components:fromDate:toDate:options:]: fromDate cannot be nil

I mean really, what do you think that operation is supposed to mean with a nil fromDate?

An exception has been avoided for now.

A few of these errors are going to be reported with this complaint, then further violations will simply silently do whatever random thing results from the nil.

Here is the backtrace where this occurred this time (some frames may be missing due to compiler optimizations):

</comment></comment><comment><USER10> Without getting into the IT-sexism-blah-blah, 'your mother wears combat boots' isn't just a folksy turn of phrase: it's a fifties-era impugnment of lesbianism. So unless you want to sound a lot more Republican than you were probably intending, you should probably stop wondering why you don't have more female friends, coworkers, and partners. And by the way, a foot in the mouth is _so gay_.

</comment><comment><USER11> Here's another easter egg - it's a sarcastic warning if you try to perform date operations on a nil date:

" -[__NSCFCalendar components:fromDate:]: date cannot be nil

I mean really, what do you think that operation is supposed to mean with a nil date?

An exception has been avoided for now.

A few of these errors are going to be reported with this complaint, then further violations will simply silently do whatever random thing results from the nil. Here is the backtrace where this occurred this time (some frames may be missing due to compiler optimizations):"

Source: [http://stackoverflow.com/questions/12505833/what-kind-of- sar...](http://stackoverflow.com/questions/12505833/what-kind-of-sarcastic- error-is-this-xcode)

</comment><comment><USER12> I don't understand, what does this function do? Is it a reference to something? Or just a simple easter egg?

<comment><USER13> Apple ships iOS beta builds before announcing new hardware. They obviously don't want to leak information about new functionality like HDR support too early. So they use a special string "YoMamaWears..." meaning of which is known only to people in the appropriate team. Then, when iPhone 5s is finally released, they easily find-and-replace the obfuscated methods with proper identifiers.

<comment><USER14> It does look like an HDR placeholder, or one hell of a coincidence.

From `AVCaptureFigVideoDevice.h`

        -- (BOOL)isYoMamaWearsFancyGlasses;
        -- (void)setYoMamaWearsFancyGlassesDetectionEnabled:(BOOL)arg1;
        -- (BOOL)isYoMamaWearsFancyGlassesDetectionEnabled;
        -- (BOOL)isYoMamaWearsFancyGlassesDetectionSupported;
        +- (BOOL)isHighDynamicRangeScene;
        +- (void)setHighDynamicRangeSceneDetectionEnabled:(BOOL)arg1;
        +- (BOOL)isHighDynamicRangeSceneDetectionEnabled;
        +- (BOOL)isHighDynamicRangeSceneDetectionSupported;

<comment><USER15> It's funny because "Fig" was supposed to be replaced by CM or CoreMedia at some point but it was so integrated into the code that it never happened. So here we have a rare case of double export obsfucation.

</comment></comment></comment></comment><comment><USER16>
      - (BOOL)yoMamaWearsCombatBootsAutomaticallyWhenAvailable;

priceless!

</comment><comment><USER17> I wonder whether Apple will decide to change their strategy of aggressively guarding upcoming products before they are launched, under Cook's leadership.

I was following a couple of 'rumor' blogs prior to the iPhone launches earlier this week and I believe they had managed to 'leak' and publish details on the iPhone 5C and 5S pretty spot on.

EDIT: rather than referring to the variable names in the OP, I'm referring to the more overarching strategy of guarding the features of their to-be-launched products.

<comment><USER18> I doubt it, that's more of a cultural thing instilled by Jobs, it's sort of entrenched as the "Apple way" of doing things. Big Cultural changes in an org typically come about when things are going badly.

The leaking is going to be hard to stop because Apple largely outsources its manufacturing and is now closely watched (compared to pre-ipod and iphone days). It's hard to enforce secrecy along the entire process when the process is run by third parties and spread around the world.

</comment></comment><comment><USER19> Also isYoMamaWearsFancyGlassesDetectionEnabled

</comment><comment><USER20> if you ever investigate the call stacks when there is a crash in their stuff from wrong parameters you can find all kinds of weird names. I'm still wondering what the purple coloured port is :)

<comment><USER21> "Purple" was one of the code names for the first iPhone - [http://allthingsd.com/20120803/apples-scott-forstall-on- how-...](http://allthingsd.com/20120803/apples-scott-forstall-on-how-project- purple-turned-into-the-iphone/)

I've seen PurpleEventCallback show up in different stacks.

</comment></comment><comment><USER22> The method's name is actually "isYoMamaWearsCombatBootsSupported". That being said, it's nice to see developers at big companies having fun.

</comment><comment><USER23> Fancy Glasses = iPhone5S Combat Boots = iPhone5C ???

</comment><comment><USER24> Must be a tradition, the old Newton had some interesting names for functions in its API dealing with horses.

</comment><comment><USER25> Well, that Myriam dude's going to be upset.

</comment><comment><USER26> I think it is a nice way to do it. :)

<comment><USER27> Yo Mama thinks it's a nice way to do it, too!

</comment></comment><comment><USER28> I'd be interested to see the "easter eggs" that drain the battery within 12 hours.

<comment><USER6> 12 hours is a good battery life is it not? Admittedly, the iOS7 BETAs have cut my own down to the point where I have to make sure my phone is on 100% before a 4-5 hour night out so I know I'll have battery to use it by the end of the night.

Although I suspect that'll be fixed post-beta

<comment><USER29> If you mean standby time, it is absolutely horrible.

<comment><USER28> That is exactly what I mean.

<comment><USER30> My Nexus 4 lasts about 4 hours of usage, about 10 hours of standby time. I really wish it had a replaceable battery. Phones these days just don't last very long.</comment></comment></comment></comment></comment>


France to require suspects to disclose usernames, steep penalties for forgetting - <AUTHOR> https://gist.github.com/SirCmpwn/5079c907eaa63da7629b1f534246bcbb#france-will-require-disclosure-of-usernames-45000-3-years-jail-for-forgetting <comment><USER2> >One forgotten ID, three years in prison and 45,000 euros in fines

What if you don't have an account to start with? Not having an account would be the same as 'forgetting' your username.</comment>


HN Charity: H2O Project Needs A Mobile App  - <AUTHOR>

I don't have mobile app skills or I would try to help. This charity: http://www.theh2oproject.org/ is looking for a simple app that can keep track of the money you save by forgoing beverages. The work would be for recognition and a link. <comment><USER2> whom to contact ?

<comment><AUTHOR> I think there is an address listed on the About page. Get in touch with Brenda.</comment></comment>