Firm pays $950,000 penalty for using Wi-Fi signals to secretly track phone users - <AUTHOR> http://arstechnica.com/tech-policy/2016/06/advertiser-that-tracked-100-million-phone-users-without-consent-pays-950000/ <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=11956304](https://news.ycombinator.com/item?id=11956304).</comment>


A Molecular View of HIV Therapy [video] - <AUTHOR> http://pdb101.rcsb.org/learn/videos/a-molecular-view-of-hiv-therapy-video <comment><USER2> Pretty cool visualization.

HIV integrase is used a lot in many gene therapies. It is very good at 'inserting a genetic payload' into a human's genome. So we often co-opt it to insert desirable sequences (see sickle-cell disease discussion [1]). Everyone's favorite Cas9 is able to cut DNA at particular sequences, but is not of much help actually getting a payload to load inline at the location that it homes in on. The HIV integrase is about the opposite, it's great at getting a payload to load inline, but it inserts relatively randomly (which is dangerous - an insertion at random spots could put code in the middle of an important oncogene). Ideally we'd have a kind of hybrid integrase/Cas9 that is able to _both_ target, and insert a payload dna inline into the genome - at a specific site only.

The therapies described in the video are all small molecules. Some of the more interesting, newer therapies however are instead protein mimics that actually play a higher-level role in 'deceiving' rather that just trying to 'jam' the virus (see the eCD4-IG synthetic protein [2]).

[1] [https://news.ycombinator.com/item?id=13781549](https://news.ycombinator.com/item?id=13781549)

[2] [https://serotiny.bio/notes/proteins/ecd4ig/](https://serotiny.bio/notes/proteins/ecd4ig/)

<comment><USER3> I'm curious, have you heard any talk about using a CRISPR/Integrase combination to insert extra RB gene(s)? I feel like inserting extra copies of a tumor supressor gene would really help decrease some cancers, especially those like RB that involve the two hit hypothesis.

<comment><USER2> My background is not clinical, so I'm not familiar with many of the current trials. Though it does appear that most gene therapies are starting with easier and more accessible targets with a higher risk/reward ratio than a prophylactic against cancer.

Also, though it may seem obvious that having more tumor suppressor proteins like retinoblastoma protein [1], or Brca [2] or p53 [3] should be a good thing, I don't think it is always so straightforward. On the other hand, elephants do have 20 copies of p53 - and they have way more cells than humans without getting a proportional amount of cancer.

Also if you think about 'where' you'd have to target the excess protein with the therapy it would be 'everywhere that might develop cancer', which is a much more difficult target than asking where to put the gene that encodes for hemoglobin.

tldr; we'll get there, but we're starting with more mechanistically determined/constrained problems before we move on to a cancer prophylactic.

[1] [https://en.wikipedia.org/wiki/Retinoblastoma_protein](https://en.wikipedia.org/wiki/Retinoblastoma_protein)

[2] [https://serotiny.bio/notes/proteins/brca1/](https://serotiny.bio/notes/proteins/brca1/)

[3] [https://serotiny.bio/notes/proteins/p53/](https://serotiny.bio/notes/proteins/p53/)

</comment></comment></comment><comment><USER4> This is a really amazing visualization. One of the things that I like about it is that the visualization shows representative random, nonproductive interactions (the other molecules that bounce off of the enzymes, for example) and the enzymes don't typically "magically go straight to" where they're supposed to do, they're often doing a little bit of fumbling around first.

This is in contrast to a videos like this one, where the molecules move with a purpose: [https://www.youtube.com/watch?v=bbbbbcAeCa4](https://www.youtube.com/watch?v=bbbbbcAeCa4)

or this one, where you watch protein helixes magically self-assemble by zooming into exactly where they needed to be - a process so statistically unlikely it boggles the mind,

[https://www.youtube.com/watch?v=B_zD3NxSsD8&list=PLj1EIndZcO...](https://www.youtube.com/watch?v=B_zD3NxSsD8&list=PLj1EIndZcOLKapv29qpv5J-WMYkPDEb1Y&t=2m42s)

</comment><comment><USER5> Lovely. A similar style of animation to that of Drew Berry (also the sound- design is similar). I wonder if the rotations of the atomic chains are accurate: Drew Berry's visualizations show some of the translational thermal noise, but little rotational noise.

What's hard in these animations is to depict the mechanisms without using the motion-graphics equivalent of intentional stance ("x evolved _for_ y"). Molecules don't have intentions, only electric fields (which are never shown) by which they move. That's not including quantum effects...anyway many molecular animations give the false impression that the molecules have agency.

</comment><comment><USER6> Last week there was a study on ice baths. You can't really find clear signal for more than 24 hours. Info is moving to fast.</comment>


What if I went to a Java school Joel? - <AUTHOR> http://thinkingdigitally.com/archive/what-if-i-went-to-a-java-school-joel/

<comment><USER2> He says that "if American Universities are going to keep up, they need to switch back to ... using C in the classroom."

Unfortunately, he doesn't understand the goals of most American schools. The goal is _not_ to give the students a well-rounded education to serve as a foundation of lifelong achievement. The goal is to _get paid_.

A lot of schools used C because it was popular, and because the industry would support a system that produced C programmers. Now Java is popular and the industry supports schools that produce Java programmers.

If Haskell becomes the next big trend in enterprise development, then kids will start getting good CS educations again.

<comment><USER3> Exactly.

At some point [I'm assuming based on legend and claims it once was] the american "higher" education system became a business, rather than a true academic institution. The purpose has nothing to do with giving students a solid education: it has entirely to do with getting their money, and giving them a good "social" experience that convinces them to convince friends, family and offspring to go to the school.

In some cases, I suspect there is genuine "let's use Java because it's heavily used in industry." But in most cases, it's "Let's use Java because Java is EASY, and our students don't want to take hard classes with things like pointer math and C".

</comment></comment><comment><USER4> My advice is to just teach yourself the stuff you want to know. If you want to learn C, pick up "The C Programming Language" and start writing programs in it.

I have never even heard of fixed point theory either. Instead of blaming my college I'm going to take charge and learn about it myself. We are truly fortunate to be living in a time where information is available at the touch of a button.

As a side note, the ability to learn by teaching yourself is much more valuable than the ability to learn in a classroom. Getting practice now will put you ahead in the future.

</comment><comment><USER5> I tried to post a comment on his blog, but it's inaccessible.

Short version: pick a systems programming project to learn C. I think implementing a memory allocator is a good one. You can code a brain-dead simple memory allocator in less than a few dozen lines. It will perform horribly and waste resources, but it's still functionally complete. As you learn more, you can make the allocator more sophisticated.

(Although I'm biased since memory allocation was a research project of mine.)

</comment><comment><USER6> Any serious CS program should have a class like this:

<http://moodle.cs.huji.ac.il/course/view.php?id=66>

Workshop In Computer Construction - From Nand to Tetris

(book page: <http://www1.idc.ac.il/tecs/>)

CS students need to be exposed to the lowest possible level of how computers work at least once, just to know that it exists. After that, it depends on each individual's curiosity.

<comment><USER7> Not only does this give a sense of the lowest levels, but you also get to build your own Object Oriented language and write your own kernel and Operating System! This is one of the best and most practical ways of getting the whole enchilada I know of.

</comment></comment><comment><USER8> I have to say, UC Irvine (the school discussed in the article) isn't really a Java school. Introductory students are taught Scheme, and the required curriculum includes language design, algorithms, and operating systems. Optional courses that I took included cryptography, computer graphics, computational geometry, and artificial intelligence. Some of these classes used Java, others didn't.

That being said, the threshold for just passing the classes never seemed very high. The education was there if you wanted it, but most students didn't seem to, and were happy to get by with a barely passing grade. This is obviously a problem, but different from the one discussed in the Spolsky article.

</comment><comment><USER9> One way to get some C-learnin' in Java school is to get a Computer Engineering degree instead of CS or Software Engineering. Microcontrollers and embedded stuff still has a lot of assembly and C.

That's what I did, anyways. Now I'm an embedded software engineer, writing in C++, and able to handle pointers and memory and such.

My issue is how to learn functional programming. Can't learn it on the job, as this is a C++/Java/C# shop. And I haven't found a decent way to learn it as a hobby.

Hobbies are for scratching an itch, which usually means Python frankenscripts to make some mundane piece of work easier, or quick one-offs in PHP to amuse friends, or python/html/css projects that'll never be finished but seemed cool when I started.

Maybe someday the dirt cheap shared web hosting space will have RoR or Erland or Arc...

<comment><USER10> Not dirt cheap, but you can get decent VPS hosting from Slicehost for $20/month

<comment><USER11> Yeah... Slicehost is what I use, but linode.com offers plans with more RAM for the same price, though their service isn't as "mature".

<http://news.ycombinator.com/item?id=258958>

</comment></comment></comment><comment><USER12> "In addition, there are very few things that actually need to be written in C. Operating systems and compilers are the two big areas where use of C is nearly always required. Both are territory that I am not interested in venturing into at this point."

First, why is C nearly always required for writing compilers? I've written one in C and a few in higher-level languages, and the HLL ones were easier due largely to garbage collection.

Second, those two things, if learned, would teach him vastly more about computer science than just learning C. For a better understanding why, Steve Yegge's essay "Rich Programmer Food" is what you want to read.

<comment><USER13> _First, why is C nearly always required for writing compilers?_

Because the author is clueless. Sure, you might want to compile your language _down to C_ , but there's no point in writing the compiler in C, unless you want to make your life difficult for no good reason. Nobody cares how fast your compiler runs. (What I should say is, tokenizing the input, building the AST, and traversing the AST is going to be just as fast implemented in Lisp/ML/Perl/Ruby as it is implemented in C. Except you'll get a more correct compiler in less time. "malloc" is for chumps.)

But, these days, there's no point in compiling down to C. It's much easier (and yields a potentially faster runtime) to compile to LLVM or the JVM or Parrot.

<comment><USER5> _Nobody cares how fast your compiler runs._

I take it you've never written a C++ program which depends on heavy template metaprogramming.</comment></comment></comment>


You Won't Believe the Reason Google Pulled Ads from These Big Sites - <AUTHOR> http://www.inc.com/erik-sherman/you-wont-believe-the-reason-google-pulled-ads-from-these-big-sites.html <comment><USER2> Good article, clickbait title.

TL;DR: Google's automated systems tend to unfairly ban accounts.</comment>


Cross Chess - <AUTHOR> https://en.wikipedia.org/wiki/Cross_Chess <comment><USER2> There's a version of draughts, Wikipedia calls it International Draughts, which is quite popular in Europe but not very well known in English-speaking countries, played on a 10x10 board. Apparently the world champion hasn't yet been defeated by a computer. The world champions have always been Europeans, with the exception of a couple from French colonies: [https://en.wikipedia.org/wiki/List_of_Draughts_World_Champio...](https://en.wikipedia.org/wiki/List_of_Draughts_World_Championship_winners)

<comment><USER3> >> The world champions have always been Europeans ...

A bit of nit picking: 1956 champion is a Canadian.

[https://en.wikipedia.org/wiki/Marcel_Deslauriers](https://en.wikipedia.org/wiki/Marcel_Deslauriers)

<comment><USER2> From Montreal; alright, it was a former French colony by then.

</comment></comment></comment><comment><USER4> I think chess is an appealing game because it's touted as the sport of the brain. Once one knows the rules they imagine they have the same chance of winning as anyone.

The truth is chess performance depends tremendously on training, practice and number of games played. At my first job as a software developer they had an internal chess championship which I joined expecting to be beaten badly (there were programmers who were participating afterall), even though I spent most of the previous summer playing chess in the local park. I won that championship, positioning myself as a "smart guy" within the company. I don't think I was actually smarter than them. I barely had more exercise.

I think that these chess variants can cancel most of the training one has and level the playing field, making that chess game a brain game again.

<comment><USER5> > there were programmers who were participating afterall

Programmers vs mathematicians, I'd bet on the latter.

Programmers aren't all that good at chess as a rule. They universally _think_ they are.

<comment><USER6> That's a ridiculous stereotype. Mathematicians as a group would tend to be better at chess, given similar level interest, because it takes a lot more memory and pattern recognition to pass the filter of getting to be a professional mathematician than a programmer. Meanwhile programming is much more broadly accessible to all ranges.

</comment></comment></comment><comment><USER7> Here's a huge list of chess variants: [https://en.wikipedia.org/wiki/List_of_chess_variants](https://en.wikipedia.org/wiki/List_of_chess_variants)

</comment><comment><USER8> Anyone: please make an online playable version!

</comment><comment><USER9> Vanilla chess is tremendously captivating. I think only a narrow segment of hyper experts crave a variant.

<comment><USER10> The problem with chess is that what makes it so addictive is the effect of memorizing openings. Opening theory adds strategic depth, flavor, and a landscape to what would otherwise be a dry, abstract, overly tactical game. It also allows psychological warfare and an element of surprise which isn't possible in variants with randomized starting positions. At the same time however everybody bemoans the fact that you need to memorize openings. I don't see an easy way to solve this conundrum. I understand the situation in Bridge is somewhat similar but I know nothing about Bridge.

<comment><USER11> Class B player chess here.

Yes and no. What would make you think that memorizing openings is so addictive? Unless you're playing chess for a living, master 2 or 3 openings (queen or kings side) is more than enough and usually so much more effective than knowing superficially a wide range of openings.

Not that true also that defined openings will put the game in a more tactical rather than strategic position. It depends on the opening, and mostly the strategic vs. tactical approach depends on the middle game and on the type of players. Look at Casablanca (strongly strategic) and Tal/Morphy (strongly tactical).

While most people concentrate on memorizing as much as openings the possibly can, I do recommend to learn more end-game variants. Even average chess players (Class C, B, A) don't usually have a good understanding of end-games and that's what makes the different between a good players and a very good player (ie. IM).

<comment><USER12> > While most people concentrate on memorizing as much as openings the possibly > can, I do recommend to learn more end-game variants.

That cannot be emphasized enough.

I've even had players offer me a draw in a classical king vs king+rook situation.

When I learned chess in the GDR we practiced endgames ad nauseum but openings were left until very late.

</comment></comment></comment></comment><comment><USER13> Looks like the guy who invented the game also prosecuted Ted Bundy. Can't say I expected that.

</comment><comment><USER14> There is something particularly asymmetric about the way the board looks in this one</comment>


Ask HN: Are there any books, sources that outline system vulnerabilities? - <AUTHOR> I'm reading Ryan Holiday's - "Trust me, I'm lying" where he decides to speak openly about a vulnerability in the media system, that has been exploited times and times again.<p>This brought me to the question: Can we make a list of sources, books that outline vulnerabilities in any system (technical, human, inter-human etc.)? <comment><USER2> The Common Vulnerabilities and Exposures (CVE) system provides a reference- method for publicly known information-security vulnerabilities and exposures.

<comment><USER3> Just an addition, 'Common Weakness Enumeration'</comment></comment>


Ask HN: Ideas for network where members pay? - <AUTHOR>

I have recently been inspired by SitterCity.com which parents and babysitters both used to pay a monthly fee.<p>If you could create any network to connect people (who pay for the service) what would it be?<p>- Bicyclist looking for riding partners? - Crossfit buddy finder? - Any kind of niche-dating network?<p>... ideastorm! <comment><USER2> First of all, having used sitter city, I don't really like their model. Once you find a sitter or 2 you like, there's no reason to keep paying for the site.

Differentiating between a "network" and a "marketplace" can be tough (I'd call sitter city a marketplace because its buyers & sellers pretty much). That being said, here's some things that popped into my head recently:

\- collect class schedules from all the different gyms (spin, Zumba, step, yoga, crossfit, etc) and let people browse them. Try to negotiate deals with some to sell drop-in passes OR charge a monthly fee for X passes and share some of the $ with the gym they choose to go to.

\- Better than sitter city's model, I think, is to have an Uber-like model where you just text a number (Twilio!) and they'll line up for a qualified person for the time you need.

\- Dating service where you pay monthly and that $ goes towards a weekly blind date lunch with someone they've matched you with. (Married 8 years so sorry if this exists or is utterly stupid)

\- A decent upcoming.org replacement still doesn't exist (save some niche alternatives). Create a network to somehow crowdsource a local events guide.

\- Youth sports and summer rec. activities. Our kids do a lot of stuff and its hard to keep track of what's going on every day. Also, finding things for them to do during the summer is a pain here (we have multiple cities, each with their own programs-all in friggin PDF form).

\- text restaurants/bars at 2-3pm (Twilio!) and ask what their happy hour, dinner and drink specials will be for the night. Broadcast that to a web page/email list/app. Boom, eventually you could have something like Groupon but that restaurants can get behind better.

</comment><comment><USER3> here's an idea that you can build and then pay me lots of money for: A site that fixes the commuting problem, at least for some jobs. No, not teleworking. Consider this scenario:

Let's say you are a web developer, living in city Z, and every day you spend 2 hours commuting to your web development job in city X. Unbeknownst to you, there's a web developer living in city X, who commutes 2 hours to her web development job in city Z. So my idea would be to connect these two, and see if their bosses agree to a web developer swap. Boom, 2 commuters less in the world. Granted, that's a huge "if", and this system won't work for all jobs. But might be something worth exploring.

<comment><USER4> The one issue I see with this is that there are too many variables outside commute that make these employees not very swappable (i.e. cultural fit, skillset, etc.).

It's hard enough when it's just one employer and employee involved. Now add another set? If any of the four parties involved aren't good to go... then it won't work.

I could be wrong, but just seems a working scenario is too rare to justify this as a variable business/network.</comment></comment>


Hackers say Friday's massive DDoS attacks were just a dry run - <AUTHOR> http://www.cbc.ca/news/technology/hackers-ddos-attacks-1.3817392 <comment><USER2> The elephant in the room is:

Probably these attacks would not be possible if all the money put into governmental surveillance activities would have been invested in building a secure and resilient internet.

This attack is the logical answer to the governmental attacks on all networked infrastructure.

The root cause for these problems is a primitive way of thinking that is a wrong recipe for the path humanity has to take to not destroy itself.

Competition, dominance, control, surveillance, fear vs. cooperation, consistency, trust, freedom, love.

This is not about ethics or morality. It is about the fact that this way of primitive thinking just does not work - it is a stupid recipe for complicated problems and just fails.

Neanderthalers that like to imprison themselves into hierarchies and dominate the whole world should be put into mental hospitals, but never into governmental institutions or positions.

We must stop the domination and hierarchy adoring primitives with their non- working and self-destroying ideas to find an appropriate way to prepare for the future and its challenges.

An important first step is to put the military dog back on the chain and show it the place where it belongs to and never ever allow it to infiltrate politics.

Military solutions must only be the last step of self-defense that we need to use when all politics failed.

A society that allows military thinking to penetrate or even dominate political ideas will be destroyed in the long run, as destruction is the only solution that militarism knows.

Again this is not about ethics or morality, it is about logic. If you throw a stone into water, it will make waves.

<comment><USER3> First off, putting a negative spin to competition already tells me you have either a very narrow view or see something I dont. When iojs forked from nodejs, it was a competitor. Linux is a competitive landscape. Browsers are a competitive landscape. The idea that cooperation and consistancy leads to the best possible product is only as accurate as who is trusted to be the leader. There are some pretty dumb leaders out there but convincing enough to be trusted with millions of dollars.

Second off, the government didnt force all devices to be vulnerable. "Agile" development practices which we trust so much are what led us here. Build first, worry about security later. The fact that a persons information is valuable to the creator of these devices and they provide a direct gateway so they could be accessed by a third party. And the fact that consumers ignore any possible issues that may arise because they see the benefits.

You talk about logic, well logically we wouldnt have computers or any of this if it wasnt for competition abd the desire to evolve. And logically trust and freedom allowed these vulnerabilities to ho unchecked because the software is not open source and companies are free to do whatever they want since its up to the consumer to judge whether its worth it or not.

I understand why you want to make this political and pro-love because arguably any problem can be answered by pro-love. But logically, you should think before you dpeak and attempt to frame your argument with a consistant locigal tree than start blaring out hatred for the capitalist system

<comment><USER4> > "Agile" development practices which we trust so much are what led us here. > Build first, worry about security later

Hardly. It's not like everyone stopped caring about security once they moved to Agile flows. The industry never cared about security.

This last attack on Dyn appears to be Mirai again, so devices with unchangeable default username/password combinations. The same poor practices that have existed since there were engineering practices at all.

<comment><USER5> >"This last attack on Dyn appears to be Mirai again, so devices with unchangeable default username/password combinations"

The credentials can't be changed on these? Ouch. I didn't know this. Has Mira released any kind of firmware upgrades for their set top boxes and IP cameras?

<comment><USER4> Many, if not most, can not. Sometimes even if the user thinks they have.

[https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs- powe...](https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered- todays-massive-internet-outage/)

'That's because while many of these devices allow users to change the default usernames and passwords on a Web-based administration panel that ships with the products, those machines can still be reached via more obscure, less user- friendly communications services called "Telnet" and "SSH."

...

"The issue with these particular devices is that a user cannot feasibly change this password," Flashpoint's Zach Wikholm told KrebsOnSecurity. "The password is hardcoded into the firmware, and the tools necessary to disable it are not present. Even worse, the web interface is not aware that these credentials even exist."'

</comment></comment></comment></comment></comment><comment><USER6> Some things to do right now:

\- If you don't have a very well defined need for a short DNS time to live, set your time to live to a large value, perhaps a day. Then, as long as someone can get at least one DNS request through, they can reach your site all day. (Ycombinator.com, why do you have a TTL of _12 seconds?_.)

\- Get multiple DNS services now. Not just two. Get four or five, some of which are not widely used.

Those two things will probably get you through future DNS attacks.

<comment><USER7> Can anyone comment on the best way to run multiple DNS services?

Is this as simple as setting up the same records on multiple providers and updating your nameservers to point to the different providers? Or is there more involved?

Are there any providers which will replicate records from your 'master' provider, or is this going to be manual?

<comment><USER8> DJB suggests using rsync over ssh: [https://cr.yp.to/djbdns/tcp.html#intro- axfr](https://cr.yp.to/djbdns/tcp.html#intro-axfr)

But I guess this excludes many of the popular DNS services that are used today.

<comment><USER9> I have an ansible script that ships all my zone files around. Functionally equivalent, I suppose.

<comment><USER8> Smart!

</comment></comment></comment></comment></comment><comment> wes-k Ignorant thinking out loud here. Is it feasible for certain infrastructure providers to team up and collect the ip addresses of the requests. This gives us a list of IPs with bots. THEN google, Facebook, Twitter, etc (major web properties) use this list to notify any of its users that one or more of their devices have been compromised and point them to a how to guide for securing it. Or more simple a script to patch it.

My thinking is that the only way to stop this is to get users to lock down their insecure devices.

A constant banner would annoy most people to action. Especially if it was really easy to issue a fix. Download and run. Script determines the actual device causing the harm and patches it. Possibly asking for a new password from user. I guess this assumes that a script could be written to issue a patch for the majority of cases. If not, then how is this device connected? Script could detect router and apply fix at that point.

So we need:

1\. IP addresses for the sources of the attack load.

2\. A way to distribute patches for those IP addresses.

I propose:

1\. Those suffering the attacks can provide this.

2\. Notify users via websites coordinating on displaying an alert with tools to patch.

Alternative solution to #2:

Can some part of the ISPs that connect these IPs be patched to detect and block malicious attacks?

<comment><USER10> This is an attack over UDP. The source address is likely spoofed. Simply blocking an IP will do nothing but banning somebody not related to the attack at all.

<comment><USER11> I don't think you understand how spoofing works. And no, this attack was not spoofed. It was just hundreds of thousands of IoT devices each pushing a small amount of traffic (0.5-1mbps).

<comment><USER12> I don't believe this Mirai IoT attack is using spoofing. But on the topic of spoofing: if an ISP doesn't follow BCP38 and allows spoofed packets to leave their network, then there is truly no traceability in where a packet came from. See this talk from Strangeloop about how spoofed packets are a problem [0]

[0]: [https://idea.popcount.org/2016-09-20-strange-loop---ip- spoof...](https://idea.popcount.org/2016-09-20-strange-loop---ip-spoofing/)

</comment></comment></comment></comment><comment><USER13> Imagine if all those IP cameras, routers, NAT boxes and what-have-you had been designed with one simple policy: the internet port doesn't work until the user sets a password.

Even very lame passwords might be expected to reduce the effectiveness of this attack approach by an order of magnitude or two.

<comment><USER14> I was just saying to a friend yesterday that this would be a great policy. I think it would go a long way.

But the problem remains that these devices, more often than not just don't get updated. So in a year or two, there will probably be a handful of exploitable issues that won't ever get patched...

<comment><USER15> Given that all these devices were 'hacked' using just the default credentials, exploits in the software aren't as relevant here.

<comment><USER16> Today they aren't. Once the fruit lying on the ground is exhausted, they'll get serious about the low-hanging software exploits

</comment></comment></comment></comment><comment><USER17> This DoS attack kills the Internet Of Things as a cool new phrase.

There is already [https://twitter.com/internetofshit](https://twitter.com/internetofshit) of course. But that is more whimsy and fun "Oh look my toaster is tweeting, that's silly".

This attack is more like "Oh-oh, my toaster killed Twitter".

So even though as a thing IoT is here to stay, I think the phrase itself will sound negative and will be avoided.

<comment><USER18> There's also a subreddit of the same name that has some good articles from time to time.

</comment></comment><comment><USER19> What's most concerning to me is that as hackers get more sophisticated with regards to tech, the US judicial system isn't and this is providing a lot of low hanging fruit for said hackers to use draconian laws like the Computer Fraud Act against innocent Americans by pwning their PC's and utilizing torrenting against them.

I have a friend that is pretty much being persecuted by the state of Oklahoma for this very thing right now because the DA, OSBI (oklahoma state bureau of investigations.) and defense attorneys didn't understand how somebody can coincidentally be innocent of the illegal torrenting that appears to being going on from their IP, albeit said activity being totally unbeknownst to them.

</comment><comment><USER20> Maybe someone should create an exploit to brick all of these IoT devices. Than perhaps people would wake up to the problem..

<comment><USER21> My experience from talking with non-techies suggests that they'll never understand the problem is the lack of security in their devices & network. All they do is act victim and get enraged about hackers. The thought that they should demand security from the companies who sold them the vulnerable devices doesn't cross their mind, and if try to sell them such an idea, they will protest and call for justice on the principle that it is the hackers who are being criminal and it's not the victim's or his devices' responsibility to keep themselves safe. Just as they don't expect to have to live in a bunker with inpenetrable locks to stay reasonably safe from burglary.

<comment><USER22> Many locks in real life are symbolic. Interior doors for instance are hollow and can be breached with no trouble. They serve mostly to keep the law-abiding from snooping casually, and to provide evidence of theft (forced entry).

A pity we can't have digital locks that 'break' when used, leaving some fingerprint from the perpretrator.

</comment></comment></comment><comment><USER23> It's kinda silly to make a dry run like that, because people in charge of the attacked systems will harden them and the attack is much less likely to work next time.

<comment><USER24> Not at all the case with IoT. See Bruce Schneier's recent article on the matter, where he makes the case that government regulation is the only feasible remedy at this point, as "The market can't fix this because neither the buyer nor the seller cares." [1].

[1] [https://www.schneier.com/blog/archives/2016/10/security_econ...](https://www.schneier.com/blog/archives/2016/10/security_econom_1.html)

<comment><USER23> I meant the servers being attacked. The owners of them definitely care.

As for the IoT, the appliances could have their firmware in ROM instead of flash. Then, the malmare would not survive a reboot. Many customers are large scale enough (Microsoft, Google, governments, etc.) that they can demand it of vendors and vendors will deliver. Really, how often do you desire to update the firmware on your hard drive, your USB stick, etc.?

(Another way to do it is to have the write-enable line controlled by a physical switch or jumper.)

The only thing I can figure is everyone has forgotten what ROM is.

<comment><USER25> If there's a ROM with non-editable software it will just get instantly compromised as soon as it comes back up. For your standard "internet of things" device there is no room, physically or in the bill of materials, for things like connectors for people to physically deliver updates.

<comment><USER23> This is not a difficult problem to solve. The ROM cannot be overwritten - hence it can be designed so that malware cannot run.

Also, jumpers are cheap. Just set the jumper to enable writes, and download the update.

Are you happy with it being unknowable which of your appliances are compromised or not? Would you pay $1 more for a disk drive with firmware in ROM? I would. If you were running a banking system, would you pay extra for code in ROM that cannot be compromised?

<comment><USER26> You would. But you're not the market - 99.99% of other people, who don't even know what a "jumper" is, are the market. So your preferences don't matter. Yes, even in most technology products.

As for IoT devices, I can't imagine average Joe or Jane prying off their smart whatever, destroying the pretty plastic casing it's hidden in, and manually setting jumpers to flash firmware.

<comment><USER23> Isn't it ironic that the means of updating firmware to prevent installation of malware is the vector for installing malware?

I don't think the current scheme is working very well. Even worse, there is no way to tell if your appliance has been compromised or not. There are a lot of companies that care whether their machines are infected or not.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> Is there any evidence whatsoever actually linking the people who claimed responsibility with the person/persons who actually perpetrated the attack?

<comment><USER28> I think its just the good old 1990s scenario repeating itself, only this time with IoT, rather than usual IT.

First, a mad rush towards the IoT where every startup and their dog wants to setup their business on IoT. Then comes fear as the hackers try to exploit every hole in IoT devices. And finally, once people realize the importance of keeping with the software upgrades, the market will settle somewhere in between.

<comment><USER29> The thing is there will be no upgrades for the IoT. Just look at all the Android phones abandoned by their manufacturers. Do you think Phillips is going to pay someone to produce patches for a 5 year old light bulb, or smoke detector, or whatever?

<comment><USER30> If it becomes to bad and people start to pay attention, yeah. If there were more malware doing (edit: very visible) stupid shit around, people would learn quite quickly (instead of malware that tries to hide and do things that don't effect the device owner), this way we'll see where it goes.

<comment><USER25> Most compromises in things like this are going to be invisible almost by accident. Unless your light bulb is maxing out your upload for extended periods of time, or the police come knocking on your door when your light bulb does something very illegal and very loud, nobody is ever going to notice.

<comment><USER30> I meant "stupid shit" that's intended to be noticed. The equivalent to malware of olden days that would intentionally bluescreen your machine, display a stupid image or something. Brick devices, turn all lightbulbs into disco mode, replace video camera images with static or porn, de-auth all WLAN devices around...

But nowadays malware is less about "hijinks" and more about criminal enterprises that profit from staying hidden, so pressure on device owners and makers is going to have to come from somewhere else: ISPs, governments, ...

</comment></comment></comment></comment></comment></comment><comment><USER31> Default passwords need to be made illegal. We all try to think of technological solutions to these problems but this really is a problem of policy not technology.

The factory default setting should require a password to be set before the device functions.

</comment><comment><USER32> So does this mean there's a huge cloud of IoT devices that will be usable as a DDOS monster, forever?

It sounds like they never get patched, and if you have some camera or small device, how likely are you to throw it away?

<comment><USER31> I wouldn't say forever. Technologies become outdated and people upgrade to new, more powerful IoT devices with default passwords.

<comment><USER33> I would say forever. What kind of devices do you think they're being replaced with?

The people buying these things aren't buying quality or security minded devices. They're buying the cheapest device they can find. Their next device will be the same.

</comment></comment></comment><comment><USER34> How do these devices make themselfes reachable from the public internet in the first place?

As far as I know, my router does not forward incoming traffic. How would it know which device to forward it to anyhow?

<comment> mike-cardwell UPNP

</comment></comment><comment><USER35> Or maybe it was a distraction while they did some nasty stuff we'll hear about (or not) on Monday... Big linux vuln announced day before, right?

</comment><comment><USER36> Ok so I don't know that much about how DDoS attacks work besides that it's basically a large influx of input that makes it impossible for 'legitimate' users to get through.

But in a block chain, a Sybil attack—imagine voter election fraud, where numerous fake IDs are made to vote for a candidate—is blocked by making the cost of generating hash values (government ID is pretty hard to counterfeit) extremely high.

Can the same methodology be applied to blocked DDoS attacks?

Like using Dyn to find a domain is similar to making a phone booth call to yellow book call center, why not just raise the price of calling from 25c to $1.00?

<comment><USER37> Because the whole internet would become unusable if DNS lookups cost you a dollar.

In the first place, the requests are being made by owned IoT devices. So making the requests more expensive (in time, bandwidth, or actual money) would just hurt the owners of those devices. The people operating the botnet wouldn't care, they'd just get a larger botnet.

<comment><USER36> I don't mean an actual dollar cost but computing power.

Is there a way to enforce a limit on requests from IoT, or a way to increase costs of running a botnet but not have that cost transfer to the owners of IoT?

<comment><USER37> IoT botnets are a problem because they're massively distributed. Even if a single device could only issue one request per second you'd just need to own more devices. There are millions and millions of vulnerable boxes out there, sometimes dozens in one home or office.

<comment><USER25> Things get crazier once you have one compromised hole-punched device that is behind your NAT/firewall too. You can end up in a situation where you have a local C2 server on your light bulb, controlling a sub-botnet of your fridge, washing machine, and wifi controlled doorbell. It's not unreasonable to think that this could compromise orders of magnitude more devices than the original botnet itself, considering how many things are just saved by their interface not being routable or accessible from the wider internet.

Something I've wondered is how much of an impact large botnets have on other systems they rely on. If you had a million compromised CPUs in a small geographic area suddenly jump from a low power state into doing a massive amount of work, could it cause localized brown outs? Some napkin math says probably not, but it's not something I've heard considered much before.

<comment><USER38> A few hundred megawatts is well within the amount of power peaker plants can produce and the vast majority are idle >> 90% of the time. You'd need millions of air conditioners to cause a brownout. Most states fine utilities heavily for any disruption of service (to the tune of $10s or 100s of millions per company per incident) in exchange for a govt granted monopoly so they all have extensive capacity built out, capable of providing for huge extended spikes in consumption.

<comment><USER39> What about other countries?

</comment></comment></comment></comment></comment></comment></comment><comment><USER40> Could someone connect to all the vulnerable cameras/iot devices and lock them down so that they can't be used in botnets in the future?

<comment><USER41> presumably when Mirai botnet compromises them, it changes the passwords.

<comment><USER42> A lot of the passwords can't be changed. They're fixed from the factory. That's one of the really difficult things about dealing with this.

I bet that a greyhat will find a way to brick a lot of these cameras.

<comment><USER43> > I bet that a greyhat will find a way to brick a lot of these cameras.

A chaos monkey for internet security - now that's an interesting thought!

That could actually work. Market forces aren't strong enough currently to force manufacturers to get security right, since the average user doesn't really care that much about it. But if it became common for any poorly secured product to turn into a brick as soon as you connect it to the Internet, users would pretty quickly figure out what brands to buy and bring some serious pressure to bear on the others...

</comment></comment></comment></comment><comment><USER44> Couldn't they create a completely separate IOT protocol, so only connections expecting to receive connections from that protocol would receive it--so essentially a IOC device could only ping specific IP's that use a different spec like 255.255.255.255.255 or something.. Essentially a separate internet that can't mess up networks on the main internet? It could still use the internet as a gateway, but would give ddos' protection more ability to block things.

<comment><USER45> What about a special set of bytes that are standardized that all IOT machines should send in every request. Some sort of IS_IOT signature. That way if there's a huge influx, all messages containing the signature could be filtered.

<comment><USER46> RFC 3514 seems appropriate here:

        1. Introduction

           Firewalls [CBR03], packet filters, intrusion detection systems, and
           the like often have difficulty distinguishing between packets that
           have malicious intent and those that are merely unusual.  The problem
           is that making such determinations is hard.  To solve this problem,
           we define a security flag, known as the "evil" bit, in the IPv4
           [RFC791] header.  Benign packets have this bit set to 0; those that
           are used for an attack will have the bit set to 1.

[https://www.ietf.org/rfc/rfc3514.txt](https://www.ietf.org/rfc/rfc3514.txt)

<comment><USER47> This RFC was published on April 1.

<comment><USER46> Quite correct, but nonetheless, that RFC _does_ explore the topic of "why not just mark the traffic?" One basic objection which detaro pointed out is that there's nothing to stop attackers from clearing such marks.

As Wikipedia puts it:

> The evil bit has become a synonym for all attempts to seek simple technical > solutions for difficult human social problems which require the willing > participation of malicious actors

[https://en.wikipedia.org/wiki/Evil_bit](https://en.wikipedia.org/wiki/Evil_bit)

</comment></comment></comment></comment></comment><comment><USER48> Sometimes it feels we are being herded. If Brian Krebs a single person can identify so many dubious operators and script kiddies in the US then how come significantly larger and massively better equipped government teams known to be using sophisticated surveillance do not have any clue or response while leading US companies go offline.

Just the other day Cisco announced a partnership with a company in the UK to detect and disable copy protected streams in real time all over the internet.

Surely if they can pull something like this off there would be some serious solutions and proposals by the networking industry on how networks themselves can mitigate massive ddos attacks.

The whole focus on IOT and client side devices seems to be a deflection of the real problem because any attempt to solve this client side is likely to introduce serious controls and constraints on machines joining the network apart from the fact you end up in a never ending cycle to 'wack a billion moles'

</comment><comment><USER49> I spent the last 4 years integrating with various hardware vendors (non-iot market but the problems are the same) for my employer's Saas offering. Hardware companies are great at making reliable hardware but they have very little to no understanding of security or heck, even software in general. Most of the time we find that their hardware engineers are writing software and and the entire protocols are wide open usually without any built in security mechanisms. Some transmit sensitive information completely in the open. If we ever come across a vendor who understands SSL that's about as good as it gets.

</comment><comment><USER50> Suggested targeting:

"...attacks were merely a test, and claimed that the next target will be the Russian government for committing alleged cyberattacks against the U.S. earlier this year."

<comment><USER51> What a BS. When you target Russian government you don't test on completely unrelated infrastructure it doesn't use.

</comment></comment><comment><USER52> * 24 days since the release of the botnet source code.

* 3 days since the latest major DDoS attack.

No device has been bricked so far. No counter attack yet. Waiting for the next news...

</comment><comment><USER51> Is there a better source? The whole article seems sucked out of a single tweet with no link to it.

Also hilarious:

>Anonymous didn't respond to a request for comment via Twitter

</comment><comment><USER53> How can I test a device I own to see if it's vulnerable? Just telnet in and try passwords?

<comment><USER54> I have the same question. Countless articles explain these attacks are being carried out via IoT devices but I've seen no mention of specific brands/models. Are there worst offenders? Are common devices like Nest, Wink, etc vulnerable?

</comment></comment><comment><USER55> Too bad this will lead ISPs to blocking ports 23, 22, breaking telnet and ssh to those ports.

<comment><USER39> IMO it's already a bad practice to have SSH listening on a publicly accessible interface on port 22.

<comment><USER55> Yeah? Then privision a new box and try to ssh to it with port 22 blocked. I could of course run fail2ban or a firewall rule in order to block at 3 failed attempts to connect and still run on port 22. Or use port knocking.

<comment><USER39> Or just use an alternate port. There are, what, 65533 alternate ports available?

> Then privision a new box and try to ssh to it with port 22 blocked.

Shouldn't be a problem if you've got your provisioning stuff set to configure ssh on an alternate port.

> I could of course run fail2ban or a firewall rule in order to block at 3 > failed attempts

A good idea, but still an additional step beyond simply using a different port.

> and still run on port 22

And you'll still end up on the receiving end of more malicious traffic than if you'd not used port 22.

> Or use port knocking.

Not necessarily a bad idea, but still far more complex than simply using a non-default port. Same reason that many ISPs (including Amazon) place more restrictions on port 25 than other ports commonly used for SMTP traffic.

</comment></comment></comment></comment><comment><USER56> [http://www.anonintelgroup.com/2016/10/21/twitter-down-its- no...](http://www.anonintelgroup.com/2016/10/21/twitter-down-its-not-the- russians-its-the-new-world/)

<comment><USER51> Perhaps this should be the source link instead of CBC.

Worth noting:

>we are in Russia

Also their website default page looks like DDoS UI.

</comment></comment><comment><USER57> When is someone going to make a robin hood malware that helps resolve these issues and fights off other malicious tools trying to use these insecure devices?

<comment><USER58> The Mirai source is up on GitHub if anyone's considering doing this: [https://github.com/0x27/linux.mirai](https://github.com/0x27/linux.mirai).

Regardless of any good intentions, it'd be a pretty grey area to deploy a tool that cleaned and then protected against future attacks on a device. The exploit (well, at least the one currently drawing attention) is targeted at devices running BusyBox that are compromised over telnet with a embarrassingly small dictionary attack. If you could clean any existing instances, the protection for future exploits is simple - set a randomly generated password.

The downside is doing this (without approval) to remote devices would likely break device functionality. The majority of users/owners of these devices are likely completely unaware they have been compromised today as it has little to no effect on anything they can see. Sure, a robing hood malware could clean up this mess pretty effectively, but the little side effect of stopping devices from, you know, working is probably undesirable.

<comment><USER43> > I bet that a greyhat will find a way to brick a lot of these cameras.

It's draconian, but it would sure make users sit up and take notice of which manufacturers are slacking on security.

</comment></comment></comment><comment><USER59> I think these statements are bogus. Russian government is a much smaller target than Twitter. Besides, it does not rely on the Internet to function.

<comment><USER60> > "I think these statements are bogus. Russian government is a much smaller > target than Twitter."

It's not about the size of the infrastructure, it's about the size of the political statement. Targeting larger infrastructure first appears to have been a move to demonstrate the power of their botnet.

</comment></comment><comment><USER61> "Anonymous wants DDoS attacks legalized as form of protest."

Yet protests aren't comprised of participants who have been forced into attendance.

</comment><comment><USER62> Since the exploit is known: I wonder, is it possible to hack all these devices and let them DDOS localhost?

<comment><USER55> It would be almost useless since localhost doesn't even generate outside traffic. It will only drive up the electricity consumption and heating the device. One could run a fork bomb and temporarily brick or permanently damage the device (due to overheating) or disable networking altogether.

<comment><USER63> Not local _host_ : have the device make a nuisance of itself on the local network.

</comment></comment></comment><comment><USER64> How are all these iot devices and their ip address found by hackers?

<comment><USER65> IP space is limited. If you have a botnet already, you can scan all of IP space.

Also, a lot of them expose web interfaces that Google has already found...

</comment></comment><comment><USER66> Who are these people init'ing the attacks? They seem like talented folks.

</comment><comment><USER67> The USA elections are right around the corner. Nuff said.

<comment><USER68> The article said they would be targeting Russia.

<comment><USER59> After Madonna delivers her pre-electional promise.

</comment></comment></comment><comment><USER69> Crackers _

</comment><comment><USER70> Hackers?

<comment><USER71> > Meanwhile not much is required in the way of resources or skill to mount a > botnet attack...

You mean they don't qualify?

<comment><USER72> This was a claim (according to the article) of specific group who goes by the name _New World Hackers_.

The word _hackers_ has very wide meaning and this title can be considered to be insulting to multiple subgroups who like to think of them as hackers in a good sense.

<comment><USER73> That is a passed station at this point.

<comment><USER74> Just don't call them painters.

</comment></comment></comment></comment></comment><comment><USER75> Mr. Robot? Is that you?

</comment><comment><USER76> Just bring it, hackers! Drop 100Tbps on every critical service to show them what's up! Hit all of them with everything you got!

I've been waiting for a good illustration to regulators of why POTS, leased lines, and satellite must continue to get investment & kept separate. On top of the small cases I have. All these people's shit is going down whereas the people using dial-up to BBS's or leased lines between critical sites are still doing just fine. I mean, they do gripe about speed or pricing more than the rest of us but that's the kind of problems they're used to living with. ;)

Note: The major attacks will also get regulators' attention to IoT risk. I have recommendations of techniques and existing products ready for that, too.

Note 2: I think someone will see this saying, "OMG! He's encouraging crimes and damage to happen! WHY!?" Actually, apathy by consumers and suppliers is why it happens and will get worse regardless of what I say. I'm just waiting for the inevitable as an opportunity to improve the situation.

<comment><USER77> "Due to increased DDOS attacks, the U.S. and European nations' governments felt their hand was forced. Swift and sweeping legislation was passed to 'keep you safe' online, including deep tracking and identification of every activity taken online. The number of personnel hires for citizen monitoring increased tenfold in the pursuit of catching hackers, in a new global program that governments are calling, 'no stone unturned'.

Private contractors were swift to step in with their offer, providing ever more efficient and penetrating tools to get this job done. Citizens never felt so safe!"

<comment><USER78> I was expecting that to be a quote from a book or a story and was surprised that it wasn't. Good job, it's scarily plausible. Especially in the UK.</comment></comment></comment>


Mock API? - <AUTHOR> I'm curious to hear what everyone uses  or does whenever they are developing and need to interact with an API that hasn't been created or whos actual contents doesn't necessarily matter yet. Do you tend to hard code responses that an api can return? Do you mock the API another way? <comment><USER2> For early stage and hackathon-style API mocking, JSON Server is pretty cool. You implement a JSON file of objects that gets inferred as endpoints and served up as an API.

[https://github.com/typicode/json-server](https://github.com/typicode/json- server)

For a fancier solution, Swagger / OpenAPI spec is useful. It has a feature called API Auto Mocking which you can serve with SwaggerHub. [The free tier includes this feature by the way.]

[https://app.swaggerhub.com/help/integrations/api-auto- mockin...](https://app.swaggerhub.com/help/integrations/api-auto-mocking)

[https://swagger.io/tools/swaggerhub/](https://swagger.io/tools/swaggerhub/)

You can also use Swagger Codegen to generate server stubs and API clients as code in various languages once you're ready to break out of the mock API.

[https://github.com/swagger-api/swagger-codegen](https://github.com/swagger- api/swagger-codegen)

That's the route I'd go personally as this tooling is available for free, is fairly mature, and has a strong community behind it at this point.

There are a few other similar alternatives that I know less about such as WireMock ([http://wiremock.org/](http://wiremock.org/)) and Stoplight ([https://stoplight.io/](https://stoplight.io/)). Postman also has a mock server feature if you happen to already use that.

</comment><comment><USER3> If you need a public HTTP endpoint to test different response code but not payloads feel free to use mock.codes[1].

I built this a couple of years ago when I wanted to experiment with AWS API Gateway. The entire project is hard-coded definitions in API Gateway with a domain (I don't log anything). It costs me a trivial amount to host (~$0.51/mo, 99% of which is the R53 hosted zone + domain cost) so I'll be keeping it up indefinitely since I use it for some projects of mine.

[1] [https://mock.codes](https://mock.codes)

</comment><comment><USER4> I've done this a couple times in the past for projects where I owned the back- end and the front-end was outsourced. I documented the API spec, mocked the API to return hard-coded values, and wrote tests to cover the expected test cases.

It was a bit of work up front, but it made the eventual integration almost seamless. In this case, I manually created the endpoints and mocked return values. If I did it again, I'd probably use something more automated like some of the other posters have mentioned.

</comment><comment><USER5> I personally will usually mock out the api using Node/Express and link endpoints to hardcoded json files.

</comment><comment><USER6> Flask app with programmatically generated mock data with variations. nginx to connect the whole thing.

</comment><comment><USER7> When I just need to read some response content I chuck some JSON on pastebin.com</comment>


Show HN: PJON – Open-source Arduino multimaster communications bus system - <AUTHOR> https://github.com/gioblu/PJON <comment><USER2> When you say 'one wire', I assume the Arduino's on both ends need to have some common ground?

Secondly, is there a way to passively power an Arduino and potentially layer your PJON over it? I actually have an application where I have 2 wires between two point, power (mains) at one side, yet I need to transfer the state of two switches from the powered point to the other side. (it's a switch for an electric curtain that normally needs 3 wires to operate but I have only two). Any way I can use this for that?

<comment><AUTHOR> Yes gound is necessary for every connected device.

Actually passive power on the same communication wire as 1-Wire has actually is not part of the functionalities of PJON, could be developed and is something I am considering to add in future.

<comment><USER2> But quite often the ground isn't the same level at all points in an installation, so you need to run two wires between the two Arduinos.

Not picking on you, I'm just saying that this is a very confusing item for an electronics amateur like myself. Modbus is the same - many manufactures claim 'works with two wires' but then leave out that you need a ground, so that in pretty much every real-world application you end up running three wires.

So as a constructive feedback, I'd like to suggest that you either make the term very explicit or talk about '2 wire' instead of '1 wire' (I realize that that makes it harder to 'compete' against 1-Wire (which also needs two wires...) before people who don't really understand what's involved, but I think that that price is paid back by the goodwill you get from being 'honest', because 'dishonesty' is what it often feels like when people claim 'one wire' systems that turn out to require two wires, even if for an EE it's obvious what is meant by 'one wire')

<comment><USER3> "A ground loop is the result of careless or inappropriate design or interconnection of electrical equipment that results in there being multiple paths to ground where this is not required, so a complete loop is formed.":

[https://en.m.wikipedia.org/wiki/Ground_loop_(electricity)](https://en.m.wikipedia.org/wiki/Ground_loop_\(electricity\))

<comment><AUTHOR> Really interesting article thank you!!!!

</comment></comment></comment></comment></comment><comment><USER4> I think you should list all the flaws of I2C and SPI and say if PJON also suffers from them:

* How easy is mixing 3.3V & 5V? * Can I always program the address of a slave? (If not, how do you resolve address clashes?) * Can slaves initiate communication?

etc.

<comment><AUTHOR> Hi there, this is really a good suggestion, why don't you open a issue on github related to this?

To have it working with mixed 3v3 5v you have to choose main channel voltage and consequently use converter modules.

There is not an autonomous packet id assigner, is the user inside the program code to assign which board has which id

</comment></comment><comment><USER3> It's 'baud', not BAUD/S.

Your signal timing is 20 microseconds which equals a signal rate of 50000 baud, or 50 kBd.

There are 12 signals in each frame holding one byte. So the byte rate is 50000/12 = 4.2kB/s.

<comment><AUTHOR> You are right, I exluded from the calculation the padding bits, that in the baud measure is not correct, I will correct the readme as soon as possible. Thank you again

<comment><USER3> What do you mean by 'bandwith'? I would suggest you rather used maybe 'data throughput'?

"Channel bandwidth may be confused with useful data throughput...":

[https://en.m.wikipedia.org/wiki/Bandwidth_(computing)](https://en.m.wikipedia.org/wiki/Bandwidth_\(computing\))

<comment><AUTHOR> Thank you so much, I corrected the readme as you suggested :)

</comment></comment></comment></comment><comment><USER5> > Accuracy: 99.95%

What does "accuracy" mean here? Successful transmission rate?

<comment><AUTHOR> Accuracy is the ratio between packets correctly received / packets received with an error expressed in percentage.

This error obviously is detected with CRC, data trashed and NAK sent to inform transmitter of uncorrect packet reception (all in background)

</comment></comment><comment><AUTHOR> What do you think about it?

<comment><USER6> What does the `accuracy` measurement on your benchmarks show ? How did you estimate max transmit distance of 50m.

I know I am pretty negative but to me once you reach this level of complexity in your applications it is time to move on to microcontrollers with proper networking capabilites such as CAN, Ethernet, etc.

<comment><AUTHOR> I'm sorry I forgot to anwer you your firsts questions:

\- Accuracy is the ratio between packets correctly received and packets received with an error expressed in percentage.

\- I tried physically with a 50 meters long copper wire.

<comment><USER3> 50 m might definitly lead to problems in other settings.

"Because both ends of the RS-232 circuit depend on the ground pin being zero volts, problems will occur when connecting machinery and computers where the voltage between the ground pin on one end, and the ground pin on the other is not zero. This may also cause a hazardous ground loop. Use of a common ground limits RS-232 to applications with relatively short cables. If the two devices are far enough apart or on separate power systems, the local ground connections at either end of the cable will have differing voltages; this difference will reduce the noise margin of the signals. Balanced, differential, serial connections such as USB, RS-422 and RS-485 can tolerate larger ground voltage differences because of the differential signaling.", cited from:

[https://en.m.wikipedia.org/wiki/RS-232](https://en.m.wikipedia.org/wiki/RS-232)</comment></comment></comment></comment>


Why a Six-Hour Flight Now Takes Seven  - <AUTHOR> http://online.wsj.com/article/SB10001424052748703575004575043143789789222.html

<comment><USER2> I guess this makes sense. If the flight takes 2.5 hours, what's the point of pretending that it will take 2? If you schedule it for only 2 hours, you'll just cause a delay which will cause somebody to get stressed and cause another delay.

</comment><comment><USER3> Whoa, what happened to that site? It keeps loading and loading... Total page load time: 35 seconds.</comment>


Alternatives to GoDaddy - <AUTHOR>

In light of GoDaddy's support for SOPA I'm looking for another domain host. I've heard good things about gandi.net and moniker.com. Gandi.net is supposed to be really attentive to their users.<p>What are your experiences with these registrars? Who would you recommend as a domain registrar? <comment><USER2> Some earlier posts:

<http://news.ycombinator.com/item?id=3384764>

<http://news.ycombinator.com/item?id=3384679>

<comment><AUTHOR> Thank you.

</comment></comment><comment><AUTHOR> I will probably move some of my domains to gandi.net and some to Moniker. Why keep my eggs all in one basket?</comment>


Three Guys Built a Better Healthcare.gov - Connor Simpson - The Atlantic Wire - <AUTHOR> http://www.theatlanticwire.com/technology/2013/11/three-guys-built-better-healthcaregov/71195/ <comment><USER2> Please read the HN submission guidelines. There's a link to them at the bottom of every page.</comment>


This is what happens when one guy practices art every day for nine years - <AUTHOR> http://www.conceptart.org/forums/showthread.php?t=870 <comment><USER2> The site seems to be under a lot of load. In case anyone (like me) is having trouble viewing the images, I wrote a quick script to scrape the images:

<https://s3.amazonaws.com/markerdmann.com/paintings.tar>

The naming format is "page_X_image_X.jpg".

EDIT:

Here's a video slideshow of the images:

<https://s3.amazonaws.com/markerdmann.com/Paintings.mov> <http://vimeo.com/29510470>

<comment><USER3> This video illustrates his progress much better then the original thread.

Could you do the same thing for this guy: <http://conceptart.org/forums/showthread.php?t=114449>

<comment><USER2> Here's the result of running the same script for that thread:

<https://s3.amazonaws.com/markerdmann.com/algenpfleger.mov>

<http://vimeo.com/29565241>

<https://s3.amazonaws.com/markerdmann.com/algenplfeger.tar>

</comment></comment></comment><comment><USER4> This is fascinating. I think a really interesting project for someone (other than me) would be to collect each image, and have a whole bunch of people rate each one on a subjective scale from, let's say, 1 to 100. Then, draw a scatter plot of the ratings against time. I wonder what curves might show up? I also wonder whether there are any other datasets that might be used to determine if there's any common thread between learning processes like this.

</comment><comment><USER5> I've started something similar 1.5 years ago, but with drawing, as painting is not really my thing (maybe it will). It is kind of my concept that to learn any skill/art/job/whatever, you have to want it really really hard, copy/copy/copy/copy the masters, and not judge yourself at all while doing it. I think that's one of the big reasons that kids learn so fast, they want it, they have no apprehension whatsoever about what they are doing, and very importantly too, nobody tells them anything about the quality of the stuff they do, while with adults it's all to easy to get nervous about not being good, or being too good, or whatever.

I didn't capture my output all to regularly, but I filled about 18 notebooks (that's about 3000-4000 pages) + a shitload of drawings. Because I never keep anything I produce, it's hard to measure, but I think I did an additional 500 drawings on different media. My very early stuff is at: <http://flipflipflop.tumblr.com/archive/2010/5> , in fact the very first picture I drew when I set out to do this. Please note that a lot of stuff that looks "good" is copied from somewhere on the internet.

I joined a local figure drawing class, but that's about all the "formal" training I got. I read about 80 books from the library though, got a lot from the internet, followed a lot of lectures from TAD, etc...

Here is stuff that I do currently: <http://larvecode.tumblr.com/>

The journey is super cool, and my ideas kind of seem to come together as well.

<comment><USER6> I personally didn't take formal training until several years into my drawing and even then it's wasn't great training (High school art class).

Although I'm sure it helps I personally have always found that I learn far more by just spending more time bashing my head against the wall trying to do it myself. The trick is to just do it a _lot_ and don't ever give up. Eventually it works.

I like your new stuff, interesting style.

I agree wholeheartedly that to learn a skill and do it well you have to really want it and spend a lot of time doing it.

I really wanted to be an artist when I was 8 through about 16. I stopped drawing cold turkey and didn't keep anything I drew but I did end up drawing two things in the last twelve years (!). The lessons I took from learning how to draw were invaluable though. You can learn anything you want as long as you a) really want it; and b) bash your head against the wall long enough to achieve it.

Here are the two drawings I mentioned: [http://www.facebook.com/media/set/?set=a.17270830489.47657.6...](http://www.facebook.com/media/set/?set=a.17270830489.47657.635750489&l=f005e0ee23&type=1)

After not picking up a pencil for half a decade for the first one I was fairly happy with the result.

Good luck on your journey.

<comment><USER5> Nice ones :)

The thing that annoys me about this hacker / painter stuff is that it really boils down to: do something with passion, and you will discover unknown depths, whatever the field may be. That's pretty much where every comparison stops.

Recipe to learn a new skill:

1) get the book called "the art of XXX", written by someone who has been doing XXX for the last 60 years, and which has good typography (no shit)

2) skip the intro and first chapter, which is almost always "XXX has taught me a new way to see the world, XXX is a way of life, blablabla"

3) do the exercises that seem incredibly futile in the second chapter, and do them over and over and over and over all your career. In music, that's your scales / hitting just one note deliberately / tempo exercises (I studied jazz bass), in drawing its those shading exercises and figure drawing or just hatching that you can see the guy in the mentioned thread doing over and over (cast drawing / painting). That's stuff you still see masters doing after 60 years. They don't do the crazy fancy whizzbang stuff, they practice pretty much what the beginner has to practice on the first day. Also, it's almost always something very physical, not mind-related. My only real comparison in programming would be: "practice typing", but that only helps for the first few months I guess. After that, more like having a routine of learning new things or practicing existing data structures or so.

4) do it and do it and do it and never worry about finding your own voice or not being good enough or being better than someone else or having envy or getting frustrated. Just do it and when you don't feel like it then at least do the boring exercise stuff and then go out and enjoy the sun or something.

that's it. nothing magical to it. no silver bullet. don't buy the expensive guitar, go for the one that keeps in tune and the amp that doesn't distort. go for the ballpoint pen. you will know when the expensive tool is right when you know it's right.

<comment><USER7> > 3) do the exercises that seem incredibly futile in the second chapter, and > do them over and over and over and over all your career.

I got halfway through that paragraph thinking it was crap because it didn't apply to programming, then realised that you're absolutely right.

In programming, the thing we do every day is we write tiny algorithms to do simple things. The abstractions come and go, but the simple "I need to remove a trailing slash on this string" sort of problems are (to me) the everyday practices. Everything else falls out of those little problems - the need for abstraction, the need for tools, the need for tests, the need for libraries, etc.

Imagine I offer you two applicants. They're both fresh out of collage applying for an engineering role. The first one has never heard of MVC and has never actually used TDD. But you ask him to implement a binary search on a whiteboard and he goes to town. The other one will happily explain all the details of the visitor pattern, but when you ask him to manually reverse a string in his favorite language, he can't do it.

I don't know about you, but I'd hire the first programmer in a heartbeat. Its much easier to learn design patterns when you know how to code than the other way around. Maybe its the same with shading in art, and scales in music. But, thats definitely how it works with programming.

</comment></comment></comment></comment><comment><USER8> Very impressive stuff. His work is reminiscent of some of the best stuff I see in my charcoal classes at RISD.

A very important thing worth noting is he switched from mostly digital art to completely traditional; there is just no matching with a tablet/mouse what one can do with real materials.

<comment><USER9> All of the life drawings, anatomy lessons, and lighting studies were incredibly important. He was able to easily apply these understandings to a new medium, so by the time he switched over he quickly excelled. I feel that if he'd started earlier with paint he would have blasted off once he saw the impact of his own work.

I appreciate this from a technical standpoint. It sort of shows the "man behind the curtain" of creating two dimensional visual art pieces, especially because you can see it in such a condensed format. We've all seen progressions of an artists body of work in art publications and curated shows, but what makes this rewarding is we get to see all of the early, average attempts. It's not like we could pick up a book on Picasso and see his first 2000 drawings, but if we could, we would gain the instructive aspects of watching an artist progress.

</comment></comment><comment><USER10> Check out his website[1] for quicker loading examples of his more recent work.

[1]<http://www.jonathanhardesty.com/>

</comment><comment><USER11> This reminds me a lot of Penny Arcade, I started reading it 10 years ago for the video game commentary but I've really enjoyed watching the quality of the writing and comics improve to such a world class level over time.

<comment><USER12> Reading that first year of Penny Arcade is night and day from the material they put out now.

<comment><USER13> This is not uncommon in comics all over the world. There are also a number of mangas exposing this evolution of the artist, two of the most flagrant ones are Kazushi Hagiwara's Bastard!! and Kentaro Miura's Berserk.

</comment></comment></comment><comment><USER14> This is basically how I learned one of my great loves, composing music.

Ten years ago, I was goofing around with an old copy of Cakewalk and clumsily aping elements of cinematic soundtracks in General Midi with a keyboard at my parents' house. I just kept at it, though, observing how the pieces worked together in music I liked, developing an ear for harmony, composing lots of throwaway stuff and a few occasional good ones. Over the years, I acquired a bit of synth hardware, took a tiny bit of music in college, later moved from hardware to soft synths, picked up bits of music theory and sound engineering, and never stopped making things (at least for long). I still don't consider myself a master by any means, but I enjoy what I compose. Perhaps most importantly, it's a creative process I find incredibly rewarding, even if I'm not scoring any indie games or films.

</comment><comment><USER15> "Nothing in this world can take the place of Persistence. Talent will not; nothing is more common than unsuccessful men with talent. Genius will not; unrewarded genius is almost a proverb. Education will not; the world is full of educated derelicts.

Persistence and determination alone are omnipotent.

The slogan 'Press On" has solved and always will solve the problems of the human race. ~ C Coolidge

<comment><USER16> I've read many quotes by a variety of famous people about persistence (see below). But none of them have had a tenth of the impact of seeing this artist's 9 year effort compressed in to a 17 minute slideshow. What he has achieved, how far he's had to travel, how hard he must have had to work, and how persistent he clearly was is nothing short of inspiring.

\----

 _"Godlike genius.. Godlike nothing! Sticking to it is the genius! I've failed my way to success."_ \--Thomas Edison

 _"What I had that others didn't was a capacity for sticking to it."_ \-- Doris Lessing

 _"Let me tell you the secret that has led me to my goal. My strength lives solely in my tenacity."_ \-- Louis Pasteur

 _"enough shovels of earth, a mountain. enough pails of water, a river"_ \-- chinese proverb

<comment><USER17> "It's not that I'm so smart, it's just that I stay with problems longer." - Albert Einstein

Y'all right, only I just don't have the energy. I say. But maybe I have. You know, it sounds great to be a good painter (or musician or stuff) but then you (at least me) ends with "how is this worth the energy spend, isn't everything irrelevant in the end? why would i care? it is not relevant."

Sometimes i conclude that the only goal of being a good xyz is to be admired by others. If it wouldn't be for others then it would be for me. But, say, when i was the last man on earth, would i say "yeah, 40 years of painting every day.. i'm good now, that was worth it"... Would I?

Working on my skills just to get better would lead me to the (maybe right) feeling that I am better than others, making me looking down on others. I really don't want end up looking down to others (and envy those who are better than me). Can someone understand me?

I read the forum that the artist was really frustrated often. I know that. Is everything really worth the hassle? :/

</comment></comment></comment><comment><USER18> Interestingly, he's pretty close to (but still under) the ten year mark for getting mastery that Peter Norvig wrote about in an essay about mastering programming. (<http://norvig.com/21-days.html>).

(This was before the rule changed to 10,000 hours.) It could be interesting for someone more knowledgable about art to indicate at what point he hit 'mastery' (assuming that has already happened) and to then estimate how many hours it took him to get there.

<comment><USER19> From my standpoint looking at his current work, he's definitely at mastery.

<comment><USER20> Maybe compared to your personal skills, but do you really think he is a _master_ painter now? Not to criticize his work in any way, but I was always under the impression _mastering_ a fine art was essentially a life's work.

<comment><USER21> If you want to be _completely_ pedantic about it, a _master craftsmen_ is simply a person who has created, and successfully defended, a _masterpiece_ (basically the medieval craft/trade-guild equivalent to a, well, Master's thesis.) This happened pretty early in life (you didn't enter a guild in full good standing until you became a master), so an arbitrarily-selected "master" wouldn't be nearly as experienced/talented as the few that come to mind when you think of the term.

</comment></comment></comment></comment><comment> Su-Shee This is so immensely interesting and useful what the guy documented here... and thanks to Mark Erdmann, it's perfectly illustrated.

What you really see here is not just "his progress" but how he actually did it:

* He went back to the classics (greek statues, classic poses, perspective etc) to really learn the ropes

* he practiced over and over again, often the same subject again and again

* even if his taste seems to lie with those scifi/fantasy-style figures, he nevertheless trained to sketch poses, the human body, faces, muscles and so on

* his strokes become more confident year by year

* he needs less strokes on a sketch to make the viewer see something recognizable

* he judges his work repeatedly

* he lived with being a beginner for quite some time but didn't give up

If some of you might remember Douglas Crockford's JavaScript lessons series - he stressed the "knowing the history" quite a lot - quite similar to many "how to become a great developer" howtos stress to know a language like Lisp. (Basically our version of "learning the classics"...)

The same applies btw for what writers documented about their progress and journey to become good writers: "know the classics" and "do it every day".

For the folks interested in the science side of "becoming an expert", please consider Ericsson's "Expert Performance" (Cambridge University Press) - that's the source/foundation of the notion of "a decade" and the "10000 hours of deliberate practice" comes from. (And a very interesting read...)

</comment><comment><USER22> Can someone convert this into a readable format?

The image hosting appears to be spotty, it's on a message board, it's paginated, the dates are unclear, there are now hundreds of comments congratulating the guy, etc. etc. etc.

<comment><USER23> TL;DR Guy is impressed by painters (and it sounded like a family member that was a painter too) so without any kind of art training he decided he wanted to learn the craft. He decided to make one new piece of art per day, and sometimes 2 per day on weekends. If you look at his first few pages of posts you see the 3d cube drawings he started with while he learned how to sketch and whatnot, and then skip to like page 50 which is years and years later you will see these masterful portraits of his wife, jugs of wine and grapes, all kinds of stuff. Apparently now he is a fulltime artist and doing the best he's ever done despite the economic climate.

Also, you might want to disable flash on this forum it's posted on. Flashblock chrome extension is nice to have in this kind of situation.

</comment></comment><comment><USER23> Pretty impressive. Just keeps pounding the 10,000 hrs rule into my head. I need to make a program a day for 9 years.

<comment><USER24> Indeed. It's all too easy (for me) to fall off the horse and all too hard to get back on.

<comment><USER25> <http://calendaraboutnothing.com/> is a neat tool for staying motivated

</comment></comment></comment><comment><USER26> There are internal and external roadblocks when trying to learn a new skill as an adult and sadly both become reinforcing. Externally I think there's a lot of cynicism from other people wondering why you are bothering trying to learn something new as an adult. They doubt that you can do it for various reasons including the favorite that you're too old to learn and that you must have started when you were five because the brain is so ripe.

But I always thought that belief was illogical, especially if you believe learning itself is an actual skill. If learning is a skill as much as say drawing, then you should only become better at trying new things as you get older.

</comment><comment><USER27> Atelier.

I had to look that up. Turns out it's French for _"artist workshop"_. [0] Why not just use the plain English equivalent? But that's not what was interesting. Digging around I noticed <http://www.classicalartonline.com> Did everyone miss this?

Making a dollar in art is difficult. It's so difficult that markets exist to make art to order, to solve some problem. Usually selling a product. Advertising. This really isn't art but design. Fine art doesn't solve any problem other than the artists own. As a result, fine art can be an acquired taste and difficult to sell. So how would you go about making a business online with fine art? That was an idea pg had and became _"The Artix Phase"_ [1] before Viaweb. Art galleries online. At the time the idea didn't work.

That's what makes _"classical art online"_ interesting. Learning art online would be difficult though. A lot of the learning happens as a tutor looks over your shoulder, sees the result & makes suggestions in technique, subject and a multitude of other related tasks that make up the craft. The learning happens in the dynamic of pupil, tutor. It's personal and I don't know how you make this process scale without a tutors presence.

[0] <http://en.wikipedia.org/wiki/Atelier>

[1] <http://www.paulgraham.com/bronze.html>

<comment><USER28> But atelier is already a perfect valid English word. Sure, it came from French, but it is now part of English language. Complaining about it would be like complaining that word 'Robot' is a Czech word for work/worker.

<comment><USER27> _"... Display of superior knowledge is as great a vulgarity as display of superior wealth — greater indeed, inasmuch as knowledge should tend more definitely than wealth towards discretion and good manners. ..."_ [0]

Perfectly valid Adam, but clearer if you use a simpler non-romantic, common use replacement. The objective is to communicate, not impress.

[0] Fowler, [http://en.wikipedia.org/wiki/A_Dictionary_of_Modern_English_...](http://en.wikipedia.org/wiki/A_Dictionary_of_Modern_English_Usage#Quotations)

<comment><USER29> I think the flawed assumption you're making here is that because the word is new to you the motivation behind the author using it is to impress. It's entirely possible that this is a word well known and in standard usage within the original target audience (which is not us)

<comment><USER27> _"... It's entirely possible that this is a word well known and in standard usage within the original target audience (which is not us) ..."_

 _'Us'_ , isn't _'me'_ who does come from a fine/technical art background.

The distinction is subtle. If the writer means train artists with zeal then _'Atelier Method'_ would be the correct term but Atelier as a place to work? I would have thought _"studio"_ would have been a better choice, derived from Italian, "studio" and Latin, _"studium"_ (and _"studere"_ , to _"study"_ & _"zeal"_ ). Note the French derivation, Atelier also translates to studio of _"fashion designer"_ and _"alchemist"_ or _"wizard"_. This use is old and not used much.

</comment></comment></comment></comment></comment><comment><USER30> He mentioned getting a Wacom Intuos tablet. I've been considering getting one, or maybe this new device:

[http://9to5mac.com/2011/08/30/wacom-introduces-inkling- table...](http://9to5mac.com/2011/08/30/wacom-introduces-inkling-tablet-for- sketchy-people/)

This video turned me on to the Wacom:

<http://www.ctrlpaint.com/home/category/hardware>

He discusses tablets at about the 2m mark.

<comment><USER31> If you're just getting started and don't need any professional features that the Wacom might have, consider Monoprice's line of tablets:

[http://www.monoprice.com/products/subdepartment.asp?c_id=108...](http://www.monoprice.com/products/subdepartment.asp?c_id=108&cp_id=10841)

They cost a small fraction of a comparable Wacom tablet.

<comment><USER32> Can it be used as a mouse in Win7 and does it even work with Ubuntu? Cannot seem to find the info..

</comment></comment></comment><comment><USER33> So inspiring... and... I want to cry when I look at what I've done with the last nine years. Tagged with "inspiration" in delicious

</comment><comment><USER34> I found the detail on this face: [http://www.conceptart.org/forums/showpost.php?p=2660638&...](http://www.conceptart.org/forums/showpost.php?p=2660638&postcount=2018) to be really good. If you go to later posts you can see how the painting evolves.

<comment><USER35> His wife here, painted in a similar style (2 hours): <http://www.youtube.com/watch?v=GIP_ACdivFQ>

</comment></comment><comment><USER36> Its great to see this person's progression! He is obviously very talented and has a real gift.

I went through a similar progression as a child. My mother worked as an art teacher at the local YMCA while I was growing up. After school each day I would take the bus to the Y and sit in on her art classes. I became a pretty proficient artist -- technically speaking anyway -- but I never really developed into what I would call a creative artist.

I just didn't have that "gift." My brother did (and does) however. The lesson I learned is that anyone can learn to draw and be able to reproduce what they see fairly well (it is really just techniques) but to actually create takes something beyond technical skills. You have to have a vision and courage to express it. MindCandyMan has it.

<comment><USER16> _"Its great to see this person's progression! He is obviously very talented and has a real gift. ... I just didn't have that 'gift.'"_

I very much doubt that anyone looking at this guy's early drawings/paintings would say he had any kind of artistic "gift".

For me, the great lesson of looking at his progress is that it's a result of dedication, persistence, and hard work.

As an artist, it's incredibly frustrating for me to hear non-artists tell me how they "just can't draw" or "don't have the talent" and therefore won't even bother to try.

You can do it! But you have to want it enough to walk the long, difficult road.

 _"anyone can learn to draw and be able to reproduce what they see fairly well (it is really just techniques) but to actually create takes something beyond technical skills. You have to have a vision and courage to express it. MindCandyMan has it."_

It's true that his later art especially shows a certain vision that goes beyond mere technical skill. He is fortunate to have managed to tap in to it, as not everyone does. However, I do believe that some sort of artistic vision is latently present in most everyone. But you have to strive to discover and express it over many years of hard effort. It's not something that's handed to anyone on a silver platter.

<comment><USER17> Oh, gnosis, I just read this comment of yours.

I believe you are right and it's all about "dedication, persistence, and hard work", as you very well sum it up.

Maybe I'm looking a bit whiny overall, but as you see from my other two comments on this news, I did not found a reason for walking the long, difficult road.

Don't get me wrong, I'm sure that, as you say, i can do it (especially as I fortunately have good starting conditions, always having enough money for food etc) but why? How do all these people (you may be included as far as I see), get their, "power" focused?

Why are you for example painting and not for example dedicating your life to the poor? There are so many things to dedicate your life to. I could be a judoka, painter, musician, father, researcher at university, owner of my own little "internet business"... But not everything parallel. I tried that a bit (Okay, I just started. I didn't went so far to actually be a father... But none of the other things either, as you may have expected). Alone the many different "peer groups" would be kind of giving me that feeling that I cannot "take a break" and thus am not free. Or so.

Alas, I guess this is not a counseling board, and I will shut up for now. Maybe some day I will have figured out what is really important to me. Hopefully before I'm old, gray and sitting in a wheelchair.

</comment></comment></comment><comment><USER37> His initial drawing are much, _much_ better than anything I could currently muster.

<comment><USER6> Have you tried? I used to draw, a _lot_. As much as this guy but I was a lot younger. People often told me the same thing "I couldn't even draw a cup that looks like a cup!" Sometimes I'd get them to try and if they were a little bit patient they drew something that looked a lot like the first drawing of that mug (Usually not including the shading).

I'm fairly confident that most people could draw that first mug if they really wanted to. The drawings 30 pages in though, that takes much more skill and patience. And it takes a long time to learn it.

<comment><USER38> I'm fairly confident most people could do most things if they really wanted to, but it seems like most people don't. This is partially a function of time—no one has the time to do everything in the world—but I do wonder about the people who seemingly don't do anything well, or who don't believe they can do anything well. It often seems like they haven't _really_ tried.

<comment><USER16> A human lifetime is obviously too short to learn to do _everything_ well.

But many people waste a lot of the time they do have in their life -- playing mindless games, reading/watching absolute trash, surfing the web or any number of other absolutely useless activities.

It's very difficult to really dedicate yourself to getting better even at a single skill over many long years. There are always distractions and a lot of boredom and self-criticism to overcome. It's painful and hard, and many people just don't have the willpower to do it.

</comment></comment></comment></comment><comment><USER39> Wow, now that I think about it, I haven't committed 9 years to _anything_ remotely productive yet.

Coming on 5 years with electronics, programming, and guitar/music (started all of these in college!). The electronics and programming are part of my job(s) but I'm at least happy to be pursuing music purely out of my own interest and doing it nearly every day. Would be interesting to see how I've progressed in these fields in another 4 years or so...

</comment><comment><USER40> For those who keep mentioning the 10,000 hour rule, I wonder if anyone has heard of any tools for tracking this number? As in, a tool for logging hours spent practicing different subject areas with the specific goal of reaching 10,000 hours. I wonder, too, if you could quantify smaller subsets of the 10,000 to provide more immediate feedback and goals along the way.

</comment><comment><USER41> I've been looking for that thread for a long time. I remember seeing it a few years ago when I was getting into drawing myself. But I sort of got lost along the way. Ended up spending more time on coding than drawing. I guess one can only focus on so much. But it's still definitely something I want to get into.

</comment><comment><USER42> The lesson I'm taking from this is be ok with slow progress and early failures. The trap I fall into is being discouraged too easily and giving up. What this guy has done is the opposite. He just kept going and got good.

</comment><comment><USER17> read on page 5 or so that he was 22 when he started. i'm 22, too. shit i will really stop wasting time with pc games and stuff.

time is the fire in which we burn...

edit: of course this are just my thoughts right now. i suppose i won't have the persistence

</comment><comment><USER43> Definitely Inspiring!!

</comment><comment><USER44> someone should do the same with programming

<comment><USER45> I went from 0 knowledge of Python to what I feel is quite a good handle by working on Project Euler nearly every day for just over a year now. Highly recommended!

</comment></comment><comment><USER46> cool

</comment><comment><USER47> Absolutely fascinating, and inspiring me to get out the sketch pad I've had laying around for years...

</comment><comment><USER48> This is exactly why i come to HN for. Stay classy HN

</comment><comment><USER49> How is this relevant to HN?

<comment><USER50> I need to build a bot that detects and replies to these comments:

"Because n people voted it so.

'On-Topic: Anything that good hackers would find interesting. That includes more than hacking and startups.'"

<comment><USER51> +1, and Honestly this is much more in topic for hackers than "how to avoid to get gamed by your VC in ten rules".

<comment><USER52> Wait, there's more to hacking than funding and getting acquired?

<comment><USER51> hacking has nothing to do with money. It is a side effect that _a few_ hackers will get rich. May will just contribute a lot of interesting things for a normal salary, possibly doing this great things in their free time.</comment></comment></comment></comment></comment>


NFC, Credit Cards and exposed data - <AUTHOR> https://blog.flameeyes.eu/2014/04/nfc-and-payment-cards-be-scared-now

<comment><AUTHOR> I tried to make the title less link-bait-y, hopefully it's an improvement.</comment>


Topic that I not should have posted here in Hacker News - <AUTHOR> Administrators and moderators of Hacker News, please sorry me I have posted the topics that I not should have posted here in Hacker News.
Several people complain about topics that I posted in several mailing lists. marc.info/?a=140224970600003&r=1&w=2
This is the reason of I apologize.
I ask this because I probably be in future a good programmer famous and I do not want to talk about the topics that I should not have posted here in Hacker News.
I decided prevent substantial harm to important relationships that probably I will have in future with other developers. <comment><USER2> Does this mean that I can't have your autograph after all?</comment>