Police firing GPS tracking 'bullets' at cars during chases - <AUTHOR> http://news.cnet.com/8301-17852_3-57609416-71/police-firing-gps-tracking-bullets-at-cars-during-chases/?part=rss&tag=feed&subj=TechnicallyIncorrect <comment><USER2> I have two brothers in the highway patrol and they believe that it's imperative that they chase anyone trying to get away, in order to make sure that anyone in the future knows that they can't run from the police, despite the risks of collateral damage to innocent people.

On the other hand, high speed chases frequently end up causing car accidents with innocent people, sometimes fatally.

The question becomes, is there a way to still capture the person trying to escape police without putting innocent people in harms way?

I applaud any efforts to eliminate casualties caused by high speed chases.

<comment><USER3> >they believe that it's imperative that they chase anyone trying to get away, in order to make sure that anyone in the future knows that they can't run from the police, despite the risks of collateral damage to innocent people.

Kinda forgot about the whole "to serve and protect" part didn't they.

<comment><USER4> Not at all. It's a hard question.

If there is no point in running, way fewer people will run. That could mean net fewer chase-miles, and also fewer crimes committed, because fewer potential criminals would think they might be able to get away with it.

The officers likely believe that serving and protecting requires them to always chase. Whether it's true or not is something that has no obvious a priori answer. It'd be great to find the answer empirically, but until then, I'm inclined to defer to the pros.

<comment><USER5> Have the number of car chases decreased over time due to all the chases teaching people its not worth running?

<comment><USER6> You're asking the wrong question. The question is how chase/no-chase policies would trend against a control. These types of social experiments are very hard to conduct, because there are so many confounding variables.

</comment></comment></comment></comment></comment><comment><USER7> > _The system costs $5,000, and each bullet sets the taxpayer back $500._

That's surprisingly not bad. $500 to stop a crazy-dangerous chase? Definitely worth it if it works. I'm used to things sold to governments being a few times more expensive.

<comment><USER8> Yeah, I was expecting him to say at least a 5-figure number for each system and something about one-time-use.

<comment><USER9> If the round is still good, then getting it refurbished is only $250.

</comment></comment></comment><comment><USER10> That's pretty cool. GPS jammers are relatively easy to make however. Funny how hacking skills are quickly becoming the most powerful skills in meatspace as well.

<comment><USER11> Yes, but I expect the _vast_ majority of chase targets were not planning to be chased, and would thus not have counter measures ready.

<comment><USER12> All you need is any electronic devices - FAA Spokesperson

</comment></comment></comment><comment><USER13> Supplement to this device: A 1-watt IR LED beacon that strobes a few times a second, and a fleet of small foam/electric flying wings that will track that beacon from 400 foot altitude at high speed (much cheaper to use CMOS sensors and a beacon than something FLIR could provide for engine heat).

The current arrangement is vulnerable on two fronts - GPS jammers, which could be extremely disruptive to modern society, and jammers on whatever frequency is used to transmit position (GPS itself is a passive receiver technology).

</comment><comment><USER14> They called it a "bullet" about eight times in that article.

The thing is the size of a bloody coffee cup.

<comment><USER15> In all fairness Bullet Bill is half the size of Mario and has Bullet in his name.

[http://www.mariowiki.com/Bullet_Bill](http://www.mariowiki.com/Bullet_Bill)

</comment></comment><comment><USER16> I recall seeing this in Ghost in the Shell, as well. It's not surprising, but it is somewhat disappointing: a GPS tracing bullet sounds like it would still be quite dangerous if it were to miss.

<comment><USER9> It's about the weight of a softball and travels at ~32mph. It hurts but probably won't cause serious injury. You're much more likely to get injured by the vehicles that would presumably be driving at roadway speeds if you were close enough to be hit by the round.

<comment><USER17> Does the gun use less of a charge when the police car is at speed?

If not, it will often be going faster than ~32 mph.

</comment></comment></comment><comment><USER18> This only tells where the car went and may not implicate the real criminal. Imagine a someone borrowing a car, fleeing from the police, getting tagged, and then returning the car to its origin.

The tag may help stop the police from engaging in dangerous driving, but what about the driver of the tagged car? If the driver knows the car is tagged, perhaps the driver will still drive dangerously? I suspect the action of tagging a car still encourages the police and the accused to behave dangerously. What if an occupant of the car returns fire?

</comment><comment><USER19> i am surprised this has taken so long, considering it's been going on in movies for quite a while.

<comment><USER20> Spider-Man has been doing basically this since the 60's!

</comment></comment><comment><USER21> I really like this idea.

A common tactic for people being chased by the police here in the UK is to head for the most densely populated areas they can. This will most likely cause the police to refrain from the pursuit due to concerns of collateral injury.

With a GPS gun they could fire a tracker at the car, let them travel through the town and head them off as they exit. There's always a chance of them bailing but that was always a risk anyway.

</comment><comment><USER22> These require Probably Cause, right? I'd assume so since they also seem a bit dangerous if they hit a human.

<comment><USER23> IANAL but evading/fleeing the police is unlawful in most US jurisdictions (if not all, and there's a felony variant in most) which sounds like it meets the bar for probable cause (though I'm not sure probable cause is required for use of this in all UW jurisdictions, hasn't there been very recent activity on vehicle tracking devices in appelate courts?)

<comment><USER24> It's not fleeing or evading if they're not trying to detain you, which itself "requires" "probable cause."

<comment><USER25> Why would they fire bullets at you if they aren't trying to detain you?

To me, that speaks less of "Sir Please Come With Us Quietly" and more of "This Ain't Working, Let's Cut Our Losses And Try To Disable Their Escape"

<comment><USER26> Why would they fire real bullets at people they're not trying to detain? It's a good question, but they definitely do.

<comment><USER27> What exactly is the fear here, they are going to accidentally hit a different car? Not really a big deal, considering during normal chases they accidentally hit other cars... _with their car_. Is the fear that they are going to sticky innocent law-abiding drivers on purpose? Well they already follow people and pull people over without reason, so I'm not seeing this as something new in that regard.. though this of course leaves a better audit trail.

<comment><USER24> That they're going to use this for illegal purposes, just like all of their other equipment.

<comment><USER27> Right, I'm getting that, but what _exactly_ is the fear? Can you give me a specific scenario?</comment></comment></comment></comment></comment></comment></comment></comment>


Apple Releases iOS 6 Beta 2 to Developers - <AUTHOR> http://www.macrumors.com/2012/06/25/apple-releases-ios-6-beta-2-to-developers/ <comment><USER2> Can anyone confirm if maps is usable on an iPhone 4? I had the first beta on for about 20 minutes before I had to take it off as most of the apps were either extremely sluggish or nothing loaded at all (i.e. mail and maps). And yes, I'm a developer and have had every beta of every version since the first one, so I know to expect beta software to be, well, beta - but I felt that the first release was truly the worst one I've come across. What was your experience like?</comment>


Web Components Github Org - <AUTHOR> http://webcomponents.github.com/

<comment><AUTHOR> My reasoning behind this is to get developers working together to come up with future web components for use on the web.

Rather than have lots of different competing components, lets get a proper discussion going without the need for working groups - we'll just build the damn things, and release them in the wild.

I've put up three ideas already - Calendar, Image Gallery and Lightbox - <USER2> if you have other idea, just raise an issue on the main website issues ([https://github.com/WebComponents/webcomponents.github.com/is...](https://github.com/WebComponents/webcomponents.github.com/issues)) and I'll create it and make sure you join the organisation!

<comment><USER3> I really like the idea, wondering how to make them as simple/un-opinionated enough so as to work with all other frameworks - a big ask (and not easy.)

Do you imagine that they would all have zero dependencies? Perhaps the wiki/homepage should suggest a base way of interacting with said widgets.

<comment><AUTHOR> I would recommend you check out the GoogleIO talk on this: <https://www.youtube.com/watch?v=2txPYQOWBtg>

But yes, the idea is that what we have is zero-dependency, best practice components that could a) be used by any framework b) drive browser vendors to look at the best and most commonly used tags, so they can then be implemented natively.</comment></comment></comment>


Internship Choices - <AUTHOR> Hello, I am a undergraduate student and have recently been fortunate enough to been given the opportunity at an internship at a well known company.  I also have been fortunate enough to go through the internship process at Google and have reached the point where I just need to be placed on a team.  I need to respond to the company that has made the offer by the weekend.  I was wondering if someone could please give me advice on what to do? Please let me know if more information is needed.  I'll try give information without giving anything away. Thank you. <comment><USER2> What are the pros and cons of each opportunity?

<comment><AUTHOR> opportunity 1 : pros: the offer has been offered, would get experience living on own, most projects seem interesting. cons: would have to move, transportation/commute.

opportunity 2 : pros: location, if offered would prefer this opportunity. cons: not definite, project unknown.

If I hear from opportunity 2, most of the issues would be resolved. I am not very good at pros and cons, but these are the ones that I see.

<comment><USER2> Even if there actually was an (opportunity 2), there would still be an opportunity cost.

The only decision right now is yes or no on (opportunity 1). Decide on it's merits.

From your description this mostly boils down to deciding where you want to live. If it's an internship and once it's over you return to where you were, it's not really relocation.</comment></comment></comment>


Moleskine notebooks, the original PDA - <AUTHOR> http://www.moleskine.com/eng/_interni/storie/immagini.htm

<comment><AUTHOR> I find it much easier to keep my ideas in order using a notebook instead of my iphone or other PDA. To me theres a lot of beauty in the longevity and immediacy of a notebook. They obviously fill different roles, but I really find myself reaching for a pen much more than I expected.</comment>


Show HN: Super-size your Twitter audience. Simple afternoon project. - <AUTHOR> http://crowdwoo.com/

<comment><AUTHOR> I have been working on something else in the Twitter-space and then saw a blog post about a concept like this. I decided to take a quick break from my actual project and code up Crowdwoo. It's a simple lottery-esque site except it costs nothing. It's just a fun experiment in potentially viral concepts.</comment>


Show HN: Lexika – Search Engine for Spoken Words/Phrases in YouTube Videos - <AUTHOR> http://www.lexika.io <comment><USER2> YouTube actually had something like this available for a while (or still does this?) through Caption Search.[1] If a video had captions available (either user provided or automated), one could search based on the captions on that video. Results would return the video and the time associated with that clip in question.

I am not exactly sure why they discontinued the user experience, since it seems like it could be really useful for finding relevant parts in potentially long videos.

[1] [http://youtube-global.blogspot.ca/2012/02/captions-for- all-m...](http://youtube-global.blogspot.ca/2012/02/captions-for-all-more- options-for-your.html)

<comment><AUTHOR> Yeah, good point. We knew about this but the accuracy wasn't all that great. Our algorithm is fuzzy and can find results even if they are transcribed incorrectly (even today, every speech transcription technology out there still makes plenty of mistakes).

</comment></comment><comment><USER3> I would love to contact you regarding using this for sales phone calls. Often times, my employees don't remember an important portion of some conversation. This makes it really easy to find that!

tonydiepenbrock[@at]gmail.com

<comment><USER4> Me too!

manu <at> korfmann <dot> info

</comment></comment><comment><USER5> Will this work with videos that aren't already subtitled? I haven't gotten one without subtitles to work yet maybe I'm just not waiting long enough though.

<comment><AUTHOR> We do two things simultaneously. If there is no closed caption, then the video is submitted to our API to be processed (which takes longer on longer videos - a link shows up on the page to let you know the future URL). If there is a CC, then we parse that right away (which gives ok search results) but still submit to our API for processing, so later the search results will purely be from our indexing.

<comment><USER6> If you're interested we can talk about some mutual cooperation. We ([https://pexe.so](https://pexe.so)) have data for every publicly available video on Youtube and other sites (Facebook, Twitter, Vine, ...) including fresh metadata (views, keywords, ...).

</comment></comment></comment><comment><USER7> This only works if you know the _particular_ youtube video the phrase appears in.

Scraping the content would be more useful, but I'm guessing that gets shut down quick.

<comment><AUTHOR> You are right that you need to input the particular video for now, but we are expanding to include multi-video search (constantly indexing in the background). Right now the use case is particularly nice for finding phrases in long videos (look for Donald Trump saying random stuff {wall, tremendous, many many, women}, it is pretty comical - e.g. [http://www.lexika.io/?s=https%3A%2F%2Fwww.youtube.com%2Fwatc...](http://www.lexika.io/?s=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DH- DSfvYCKwY)).

<comment><USER7> Do you have an agreement with Google? I'm guessing this is against their TOS, especially considering they're doing a lot of work in this area themselves.

</comment></comment></comment><comment><USER8> A heads up on the homepage, the video you featured Steve Carrell and Jimmy Fallon with the keyword "pantaloons" is captioned as "the wrong kind pantaloons ah", when the spoken phrase was "the wrong kind of pantaloons on" \- maybe this is me being paranoid and pedantic, but I feel like having a featured video with a pre-selected keyword that returns flawed captions gives a worse impression than just having the video flags without any captions at all. I understand you guys are still refining the product but highlighting one of your flaws (however small) so early on can rub people the wrong way.

On a separate note, when I google "lexika search engine" I get your old homepage lexika.co instead of the one linked here, lexika.io. Consider setting up a redirect from .co to .io?

<comment><AUTHOR> Thanks for the transcription feedback. You can look at this as a problem but we think it's a cute demonstration of our search ability. We didn't really set out to make transcriptions perfect (that's very, very hard), we wanted to make search very accurate. Having a better transcription model would be great though (we are working on that!).

We'll definitely work on the site. (We should have done that earlier.) Thanks again!

</comment></comment><comment><USER9> Nice service! May I ask what machine learning technology you're using? I'm experimenting with neural nets these days, in order to learn the basics of image & speech recognition and would love to hear about your experiences if your'e usikg ANN's.

<comment><AUTHOR> You've got it. Deep neural networks are currently the best performers when doing automatic speech recognition.

</comment></comment><comment><USER10> YouTube is a huge domain - the potential for audio indexing could bring vast improvements to search relevancy. What other audio domains are you experimenting with?

<comment><AUTHOR> The first thing that comes to mind is podcasts. That are a slightly different direction, but a great fit for our service. They're long, have well spoken words, and are regularly released, so there is a mound of searchable audio data out there just waiting to be liberated.

</comment></comment><comment><USER11> I saw this chrome extension a while back that embeds a search button directly in YouTube and searches for keywords/phrases in the video: [https://chrome.google.com/webstore/detail/ytfind/gkeiaihfolc...](https://chrome.google.com/webstore/detail/ytfind/gkeiaihfolcgfgijebiihmmgknapfgpj?hl=en- US)

</comment><comment><USER12> Also, once you've found videos you like, you can then load them by voice command (voice bookmark):

[https://youtube.com/treycent/search?query=youtube](https://youtube.com/treycent/search?query=youtube)

</comment><comment><USER13> Really well executed product in the 'why doesn't this exist already' category!

</comment><comment><USER14> I love this idea - can you shed any light on the technologies you are using?

<comment><AUTHOR> Yeah for sure! This site is basically a demo/test for our backend.

We built an API that processes audio and forms an index for that file. The API search function then goes into that index to look for queries. It doesn't just look for words that match the text you see, but also the way it sounds.

</comment></comment><comment><USER15> The potential for use finding gifs is enormous.

<comment><AUTHOR> I am loving making mashup videos with it. Trump talking about walls: [https://www.youtube.com/watch?v=F38EwKOmDdU](https://www.youtube.com/watch?v=F38EwKOmDdU)

<comment><USER16> How did you construct the mashup - is there a way to feed the search results to a video editor or seamless playlist generator?

<comment><AUTHOR> Not yet but this is a pet project that I would love to get going (time strapped now, though). I used the Lexika API to get the times from query results (i.e. when the words were said), then used some hacked together python along with ffmpeg with a lot of auto-generated seeking command line arguments to splice together the video feed. Then the title screens were done in a normal editor.

I would love to make this an app though. Just search for phrases, choose clips, and output a cute video. You could just have a thousand people saying a "thousand", or something equally weird.

<comment><USER16> A decade ago, SMIL players could perform seamless editing/composition of media streams on the fly, using only a playlist of streams and start/stop times. It's unfortunate that those standards have fallen by the wayside, at least until someone builds an HTML5 equivalent.

</comment></comment></comment></comment></comment><comment><USER17> the Search button is absent (on a mobile chrome). Only the text field. How to submit a request?

<comment><AUTHOR> You should be able to hit enter in the search field on your phone's soft keyboard (or the button might just say search). Which phone/operating system is this?

<comment><USER17> Chrome on android. In Firefox on android I can see the label "youtube video url" (in Chrome I thought it's a query field for words to be searched). But in Firefox the on the page images are not rendered - the page look strange.

I think it's easier for you to try yourself on android phone. Maybe it's only me. But I browse a lot on that phone, only lexica.io works strage.

</comment></comment></comment><comment><USER18> Could this be used for subtitling videos? I have a lot of anime VHS tapes in Japanese.

<comment><AUTHOR> Ah, that would be really nice to do. Our speech transcription only does English at the time but we definitely have our eye on other languages.

<comment><USER19> When it supports other languages, please post a link to it on /r/languagelearning. It would be very helpful for alot of people!

</comment></comment></comment><comment><USER20> What's next after indexing and search?</comment>


Easy Ways to Show Your Employees You Love Them - <AUTHOR> http://mashable.com/2011/02/03/love-your-employees/

<comment><USER3> Why should I want my employer to 'love' me? There are several things I want from my employer, but none of them are anywhere near 'love' and especially not the sort of 'love' that this hints at.

Primarily, I want my employer to provide a structure within which I can do my work with a minimum of hassle. I want to be paid well and regularly. I want no surprises when it comes to health-care or other benefits. I want, within reason, to be able to put my job aside for personal matters that I deem more important - we usually call this 'personal leave' in the US. I want a comfortable, arms-length working relationship where I can work hard as needed to get a job done and then leave.

I do NOT want my employer actively trying to become my friend. I do NOT want my employer asking me to share my taste in music with the rest of the office, nor do I care about everybody else's tastes. I do NOT want "team-building" exercises or structured activities which are meant to help me work better with people. I definitely don't want my employer to 'love' me. To hell with that.

<comment><USER4> "I do NOT want my employer actively trying to become my friend."

Exactly, and a variation on that is on the front page here today (VCs Are Not Your Friends). You might be on friendly terms you your employer, but it's primarily a business relationship. <http://news.ycombinator.com/item?id=2174722>

</comment></comment><comment><USER5> I would disagree with #5 on that list. In my experience a request from a boss will most likely be misinterpreted (to some degree at least) as an attempt to spy on you.

Also, many people are starting to learn that keeping your professional and personal networks separate is a good thing so having a blanket statement of "boss's should friend employees" is a little misguided.

In either case it will create an unnecessarily dilemma for the employee. And its worth noting that there is a growing list of people who have lost their jobs because of Facebook.

<comment><USER6> A friend and I just had a discussion about this last night. I can't say I've bothered to do it, but she says she just adjusts her privacy filter so that everyone in her company network can only see her picture and where she lives. I've been nervous to friend anyone I've met through work, but she doesn't seem to stress at all about this issue. Thoughts?

<comment><USER5> If you take the time to group your friends and carefully tend to your privacy settings its not a problem. Facebook is actually highly configurable in this sense, its very easy to maintain multiple networks on it if you really want to.

The reason I don't try to do this is because of Facebook's track record of change privacy settings first, ask questions later. I wouldn't want to have all my carefully filtered information exposed for any period of time, no matter how brief, but there is no way to guarantee this won't happen as long as Facebook places privacy games.

<comment><USER6> Thanks, and interesting. I hadn't thought of that. I suppose the fact that I didn't even know I could do that--and that it's actually quite easy, functionally, as you say--also suggests some marketing issues? I just felt it was weird that I've been hearing so much hullabaloo about the facebook quandary of business contacts learning too much about your personal life and vice versa due to blanket "friending," but yet, it took only 2 seconds for my friend to shut me up, saying, "I don't have that problem, here's why."

</comment></comment></comment></comment><comment><USER7> The list is quite revealing - it gives away some of the "command and control" tendencies in some (US?) businesses.

Some of the suggestions are astonishing (I work in Europe and can't conceive of a non-customer facing/low security role where personal phones are, or even should, be banned).

Others are appallingly cheesy, friending your employees on Facebook, really?

What about the ones that I personally really appreciate:

1\. Personal recognition from management for work well done

And I don't mean "employee of the month" plaques - more a senior stakeholder that pops by with the mission to shake my hand and mention why the work was important for our shared business goals.

2\. Acknowledgement of serious commitment to shared goals

Even better is the PA to the CEO who wanders through the building after the early shutdown time on Christmas Eve or other local equivalent to find out who's still working, and comes back with a small gift hamper full of little items like gourmet jam, already wrapped with easy-remove numbered stickers and a master list of the contents, to take the stress out of last-minute shopping. Honestly, I would have taken a 20% paycut from them after that with a smile.

3\. Flexibility flexibility flexibility

Most of my work experience has been in organisations that ask for flexibility from staff - illegal (only in parts of the EU!) numbers of hours to be worked during crunches, "temporary" incomplete or unfit-for-purpose work process changes, spontaneous and badly thought through changes of focus and priority to keep the financial markets happy etc.

I really appreciate the flexibility right back: a parent suffering terminal illness on the other side of the world demands significant blocks of time away from project activities. I was extremely gratified that my direct HR line manager and program leads let me know that they'd move heaven and earth to make it possible. I worked while I was away to keep things on track and committed to stay on board for significantly longer than I'd planned.

4\. Fair pay for hard work

Enough said.

5\. A little thought about impacts of business decisions

Sometimes there are problems. You need to fly out at short notice and it may be that you'll be on the road for a month or two. This isn't part of your job description.

What really worked for me was when my boss asked about the impact on my home life. And when HR asked me whether to send flowers every Friday on my behalf to my spouse. And our local logistics people offered their help if we needed someone to be at home for things like visits from the gas company.

These things cost very little, are genuine and not cheesy and are not sensible removals of dumb authoritarianism.

This is how you show your employees that you value them and their commitment to your shared goals.

</comment><comment><USER8> A single easy way to show your employees you love them: don't actively try to interfere with their lives or attach unnecessary restrictions on their work patterns.

I'll only comment on one specific suggestion: _The varied music taste of your staff will no doubt surprise you._

Ok, my playlist consists of Yngwie Malmsteen, Rammstein and NIN. Another employee's playlist consists of Dido and Celine Dion. This is going to end well.

</comment><comment><USER9> Every employee should blog? The horror. The author needs to keep in mind:

1\. Not everyone is an extrovert 2\. Not everyone philosophizes about his job 3\. There are tons of companies doing fine without a blog - and they don't blog about it ;)

</comment><comment><USER10> In the tech world, if blocking social networks means your employees can't access social networks, it means you've hired the wrong employees.

</comment><comment><USER11> I'd add "2+ monitors for all knowledge-workers and above" to that list.

<comment><USER12> The first four are basically "get the best tools for your employees, and stay out of the way".

And location-based achievements? No thanks, I'm not here to punch a time clock.

The rest of these seem like an odd choice. If you're going to get into these sorts of specifics (share a music playlist!), there's probably hundreds, if not thousands of possible suggestions (eat lunch together! respect your employees privacy! flexible working hours! nice chairs! holiday party! etc. etc. etc.)

</comment></comment><comment><USER13> #1 - Agreed. #2 - Mandate a set of browsers if you work in a tech company that produces a web app, otherwise in a large enterprise you'll have a lot of security concerns and the bearded suspenders in IT will lunch you. #3 - <USER2> parents the opportunity to shirk work and burden their childless colleagues? Awesome idea. If you make #3 a company-wide policy for everyone, you'll make redundant the other nine items in this post. #4 - Only works with serious, well-trained and educated employees. If you have a ban on them in the first place, aside from security reasons, you're not working in a place that puts the employee ahead of anything. #5 - You're out of your mind. #6 - Will be used with less frequency as a normal social network but can easily be used to facilitate offline communication, but also subjected to the same hierarchy forces found in the org chart. Not a long-term solution. #7 - This only works if you have a small group of people with similar interests. Can easily become a distraction. #8 - I'm not child, don't treat me like one by suggesting I engage in games that have hidden morality lessons. #9 - Great, phone and email from random recruiters will increase tenfold. #10 - Great if you can get the c-level to think that they don't have all the answers. Also, as soon as tickets pile up, they'll assign handling it to the IT manage it via HR and they'll treat it like yet another ticketing system.

Overall, I see these recs as 2-3 out of 7.</comment>


Ask HN: Does a sitle like vocabulary.com make money? - <AUTHOR>

the site in question is : http://www.vocabulary.com/
It works well, gives you a daily quiz, and has achievements and graphs to keep you going.
I'm considering building something similar for my native language, when I started thinking about money.
I can't find ads, premium memberships. Yet I assume their user base is substantial. They also bought a great domain name. So do they have a business model? Or just a hobbyist on steroids? <comment><USER2> It is run by thinkmap.com and doesn't look like a for-profit project.

Here is the launch press release: <http://www.thinkmap.com/pressrelease.jsp?id=1290></comment>


WeWTF - <AUTHOR> https://www.profgalloway.com/wewtf <comment><USER2> I really enjoyed the acerbic and colorful style of this article, but wouldn't have enjoyed it nearly so much if it were all style and no substance. He's clearly knowledgeable, though I know the style of writing isn't the usual fare for HN.

He's correct that really good businesses tend to start during recessions. Starting a business during a Roaring Twenties style economy when you could literally support yourself with a ridiculous idea like selling pet rocks will not test your business model and help you find its weaknesses. A la some African saying to the effect that "Calm seas don't produce skilled sailors."

I learned a lot and I am a bit envious of his acerbic wit. I feel like that's more acceptable from a man, but _sarcastic contempt_ was pretty much my default as a teen and I sometimes think I've become a bit too PC over the years.

<comment><USER3> > I've become a bit too PC over the years.

What's "PC" ? Did you mean PC as in "PC vs Mac" boring/conformist vs cool?

<comment><USER2> Politically correct.

<comment><USER3> Ah, makes sense. Thanks. Somehow the obvious was escaping me.

</comment></comment></comment></comment><comment><USER4> I don't understand why all analysis of the craziness that is The We Company is filled with opaque language and colorful mind bending terms. The company is a fraud, it should be explained with facts, and clear simple language. Everything else is just muddying the water.

<comment><USER5> A lot of the behaviors of the founder seem outrageously fishy, however they are legitimately filling a rapidly growing need. At this very moment I have the WeWork Toronto locations page open as I contemplate biting the bullet on a private office there just to get out of the home office occasionally.

<comment><USER6> I think the author's point is, that in a recession, you wouldn't bite the bullet, because you (the average consumer) become cost-conscious. The idea is that therefore, WeWork's revenue model can turn on a dime but their debt obligations go nowhere when that happens, and then they are in a hole.

Moreso, the author's point is that other businesses that have these long-term depreciations trade their equity at a much smaller revenue multiple. He's basically saying, you can't escape the fundamentals.

<comment><USER7> Recession could be hedged with stock options, no? At their scale they will get custom-tailored option product to match their liabilities.

<comment><USER8> it'll be super expensive to hedge -- the higher the volatility of the underlying asset (here, the number of people who pay for a desk or whatever), the more valuable/expensive an option on that asset is. but I also don't think it makes a ton of sense. in effect, WeWork would reduce their cash flow growth, with payments going towards hedging. their entire pitch is that they are a fast growing company, which justifies an insane multiple, any hedging would reduce that risk.

you don't hedge against decreases in demand via financial instruments, instead you: 1\. hedge against decrease in demand through diversification of services; if wework sells some property management software (for example) then that might be more recession-resistant than their actual leasing business. 2\. hedge against decrease in demand through long-term contracts: getting IBM to sign a 10 year lease (for example) is usually a safe bet that you'll have a tenant through the recession; on demand hot desks are much less safe 3\. hedge against cost increases using financial instruments: most corporations doing hedging are hedging against commodity price changes, e.g. airlines buying oil futures or mcdonalds buying beef futures. similarly, wework might buy kombucha or aluminum cup futures, but there is no derivatives market for on-demand desks :)

of course, there are different perspectives on this. matt levine has a really interesting column about the different philosophies of where diversification belongs, at the corporate level or at the investor level: [https://www.bloomberg.com/opinion/articles/2019-04-09/ceos-l...](https://www.bloomberg.com/opinion/articles/2019-04-09/ceos- learn-something-in-business-school). my finance classes were relatively recent so you might be able to tell my bias.

<comment><USER7> Patent post suggested drought of renters due to a recession. Recession can be hedged against by purchasing e.g. 12 months options that are far enough out of the money to be cheap yet close enough to cover a major recession event.

I don't know if the math adds up, but I think it deserves studying.

I'm not looking to hedge against all kinds of customer flight with an instrument, that's clearly foolish as you noted. But particular events can be hedged.

<comment><USER9> The cost of consistent recession hedging is prohibitive and larger than the benefit you'd receive, because of arbitrage (if it was cheaper than risk, you could invest risk free).

See: [https://www.aqr.com/Insights/Research/White- Papers/Pathetic-...](https://www.aqr.com/Insights/Research/White- Papers/Pathetic-Protection-The-Elusive-Benefits-of-Protective-Puts)

If you could hedge a recession, we'd have no recessions :)

Hedging only works if you have short time durations (eg you wanna hedge specifically in October, because you have a big bill due then), or if you're the one providing the hedge and capturing the Volatility Risk Premium.

<comment><USER7> I'm not looking for a blanket hedge though.

"We Work" can have a built-in cushion against smaller recession events - long- term leases, being able to predict which percentage of short-term leases will dry up, cash reserves, some sort of counter-cyclical lease agreement (e.g. with repo companies), counter-recession marketing/education/etc program (e.g. "let's beat recession together by sticking together!" or some such).

Where the hedge is coming in is making sure that the company does not end up upside down if recession hits harder than the built-in cushion can absorb. They could be buying 12 month S&P500 options on a rolling basis - buy a new batch every month as the previous batch expires. The idea is not to get paid each time SPY drops 5% down, but to get paid when it drops 35% down signaling an actual market crisis and have enough time/money to survive the hit.

I don't know if it makes sense as I'm just making this up as a I go, but your criticism is selling the idea short. Ahem.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> > Adam also owned the rights to the "We" trademark, which the firm decided > they must own and paid the founder/CEO $5.9 million for the rights. The > rights to a name nearly identical to the name of the firm where he's the > founder/CEO and largest shareholder.

Really? How is this sort of shenanigan allowed?

<comment><USER11> Adam controls the majority of voting right to the company and the board (made up of VCs) doesn't want a messy legal fight since they stand to lose money if We tanks. So a moderate amount of graft is tolerated since the alternative is less desirable.

<comment><USER12> Breach of fiduciary duty can be a criminal matter in addition to a civil one.

<comment><USER13> I am not a securities lawyer (or any other type of lawyer), but: if this all blows up, I believe that self-dealing by the executives is an excellent way for creditors to pierce the corporate veil.

</comment></comment></comment></comment><comment><USER14> The most interesting part of this article is the term "Community Adjusted EBITDA". It's not a term invented by the Prof but something used by WeWork. I remember Warren Buffett/Charlie Munger calling EBIDTA as bulls* earnings [1] but community adjusted EBITDA just smells like someone in Enron got hired by the We company recently. It almost feels like We IPO is the bellwether for an upcoming crash :-(

[1] [https://www.forbes.com/sites/brentbeshore/2014/11/13/ebitda-...](https://www.forbes.com/sites/brentbeshore/2014/11/13/ebitda- is-bs-earnings/#4f0539e56070)

<comment><USER15> > "More than its cash-burning ways, WeWork's IPO will test investor tolerance > for made-up accounting metrics. You might recall "Community Adjusted > EBITDA," the gauge WeWork devised to measure net income before not only > interest, taxes, depreciation, and amortization, but also "building- and > community-level operating expenses," a category that includes rent and > tenancy expenses, utilities, internet, the salaries of building staff, and > the cost of building amenities (which WeWork has described as "our largest > category of expenses")." [0]

Hahaha. I think its pretty fair to say that this is not a Generally Accepted Accounting Practice measurement. (non-GAAP)

I've only visited a We Work location once, but it really felt like a VC funded startup - particularly the amenities. Without the amenities, it would have been just another depressing office.

0 - [https://qz.com/1685919/wework-ipo-community-adjusted- ebitda-...](https://qz.com/1685919/wework-ipo-community-adjusted-ebitda-and- other-metrics-to-watch-for/)

<comment><USER14> Imagine if Netflix says it won't expense content :-) . That's one of the hundreds of analogies I have read about this creative accounting practice.

</comment></comment></comment><comment><USER16> When bonds worth $14 trillion are in negative territory and when the 30-year US treasuries are at historical lows this is what happens, i.e. people are ready to throw money away at almost anything that flies and moves, as long as there's a chance of double-digit returns. In other words we live in crazy times, and as such crazy prospectuses like the one published by WeWork fit the current financial narrative perfectly.

</comment><comment><USER17> Has anyone seen good coverage of WeWork as an investment?

All my favorite finance meme accounts are tearing this to shreds too.

The only people I've heard be excited are the WeWork employees, and you can practically never get the employees to have a counter view on this even if they don't get stock. I dont mean in like "I dont want to rock the boat" way, but more in an common ignorance of personal finance let alone investing way. They also arent really the investing class, so far they dont really understand the memes aside from the comments like "is this company run by Congress?" Not WeWork specific they just arent investors or financial professionals.

What do the "members" think? Is there any "yes I cant wait to align my interests with my favorite coworking space by investing in their future growth" sentiment? Im just not around those people so I dont know

WSJ and Bloomberg have been ripping on this for over a year, and now with the S-1 out Hackernews and finmeme accounts are ripping it too

Think they'll retract the S-1 and stay private?

<comment><USER18> The problem they have is that you can't save this business by clapping louder. Either it starts generating profits or it'll go out of business. I am just personally surprised that Adam Neumann isn't getting the kind of negativity Elizabeth Holmes got. Perhaps after it goes down, who knows, but his activity has been sufficiently shady that it should be drawing more fire.

<comment><USER19> Holmes was deceptive in her fraud and flat out lied to investors. Neumann's fraud is disclosed and well documented. No skin off my back if he pockets hundreds of millions of Saudi money.

<comment><USER18> I've got no idea what he's said to investors but it sounds like they've been repeatedly surprised by things like his real estate holdings and ownership of the trademark.

<comment><USER20> Curious for evidence of this.

</comment></comment></comment></comment></comment><comment><USER21> I think I might be the only person on HN optimistic about WeWork.

Remote work is on the rise here in the US. Startups and entrepreneurship continue to grow. Finding traditional office space sucks and is a massive waste of money, and probably always will. Co-working spaces make sense, and it's baffling to me that it wasn't the default way to work in 2010, when I started programming, let alone 2019.

I feel like if somehow fast food hadn't been invented til now, and MacDonalds just got started, we'd be reading pessimistic threads about how it's a real estate business masquerading as a food business and is destined for collapse.

But like, it actually does work, as a business, to provide some necessary service (office space, food) at scale with a big central marketing apparatus. The fundamentals here seem sensible to me.

<comment><USER22> WeWork != Coworking

Coworking will grow and prosper. WeWork, I don't know. I don't know how long any company can survive the egregious investor-fleecing WeWork's founder seems to wantonly engage in. Perhaps if a clear stop is put to that, and if every other part of the business plan goes flawlessly, then it has a future.

But coworking is about alot more than WeWork, and the industry will do fine whatever WeWork's shenanigans imply for the latter's future. There are currently around 20,000+ coworking spaces worldwide, of which less than 5% are WeWork's:

[http://www.deskmag.com/en/2019-state-of-coworking- spaces-2-m...](http://www.deskmag.com/en/2019-state-of-coworking- spaces-2-million-members-growth-crisis-market-report-survey-study)

[https://www.wework.com/locations](https://www.wework.com/locations)

<comment><USER23> I'm surprised churches aren't involved in coworking. Many of them have great downtown locations with space that's only used on weekends.

</comment></comment></comment><comment><USER24> The current system was ripe for a fantastical display of absurdity, and maybe this is it. It's startingly familiar given the current US political situation.

All this reminds me of Blackadder 2, Ink and Incapability. [https://en.wikipedia.org/wiki/Ink_and_Incapability](https://en.wikipedia.org/wiki/Ink_and_Incapability)

Blackadder finds himself in a situation that quickly becomes increasingly unbelievable. Finally he recognizes he is in a dream, and he wakes up in disappointment. I'm still waiting to wake up.

<comment><USER25> Compared to the relative stability of the 1990s and early 2000s, the current political and economic situation does seem somewhat absurd.

But history is littered with turbulent times, and compared to those times the present is a pleasant dream. Whether it turns nightmarish remains to be seen.

</comment></comment><comment><USER26> bull hypothesis: the office space industry is very large but fragmented. wework becomes the central hub in a worldwide network of tenants and landlords.

bear hypothesis: wework is an overhyped-regus with a frail capital structure, no scale or network effects, and dangerous liabilities. it will likely collapse during a recession.

questions for investors:

1\. how much flexibility/escapability does wework have regarding leases and liabilities? in particular, how much control do they have over cash flows to avoid disaster during a recession?

2\. how much does it cost and how long does it take for enterprises like cisco and ibm to open new offices: (1) with wework; (2) with regus or another wework competitor; and (3) without any outside assistance? how about for companies with 100-1000 employees?

3\. what is the current breakdown, lifetime value, and retention rate for wework members among solos, startups (2-99 employees), mid-sized companies (100-1000 employees), and enterprises (1000+ employees)?

4\. cashing out $700mm seems like a red flag if you believe the company is worth much more. what percentage of equity does this represent for the founder? is cashing this much out normal for large IPOs? by comparison, how much did zuckerberg, hastings, and bezos cash out at IPO?

question for others: what are the first questions you would research on wework?

<comment><USER26> 5\. what are the unit economics for the average wework location, where revenue is projected at 10%/25%/50%/80% occupancy?

<comment><USER26> note: unit economics should be model as profit/sq. foot.

<comment><USER26> one way to model wework during a recession is to treat recession regus as a baseline. how has regus fared during recessions? what was the impact on occupancy rate, sales, and profit?

</comment></comment></comment></comment><comment><USER27> speculation on the origins of this ... in the San Francisco Bay Area, over the last twenty years, many ordinary downtown office+retail buildings became empty, due to some combination of suburban sprawl, loss of mom+pop retail, excessive rent-seeking and urban decay. Meanwhile, tons of twenty-somethings were arriving with a backpack and a laptop .. it was too fast and fluid for anyone to want an "address" .. so, the idea of flexible techie office "pop-up" shared spaces was obvious. Some tried it alone, and some tried to brand it with extras .. and FAILED FINANCIALLY.. practical people, who did try. If you have not failed this way, then you do not know how painful it can be, at the small business level.

At any rate, from one point of view, this WeWork thing is just the oversize "winner" from New York City, in this dog race. Like commercial fishing, and some kinds of investments, lots of ordinary efforts fail for no good reasons, then some pig comes along and gets the momentum.

</comment><comment><USER28> Can anyone knowledgeable talk about what happens in a severe business downturn with We? They have most likely setup separate LLCs for each building's 10-15 yr lease. Do the LLCs isolate We enough so that LLCs can declare bankruptcy and the building owners or banks or creditors don't go after the mothership We?

<comment><USER29> > _Can anyone knowledgeable talk about what happens in a severe business > downturn with We?_

No. This is a known unknown.

On one hand, contracts get cancelled and WeWork defaults. On the other hand, WeWork's aggregated buying power lets it renegotiate leases, passing the pain to landlords.

<comment><USER30> True story: I once worked for a company that rented 3 of 4 floors in a building. The top floor was empty, and we were expanding, and we wanted it, and it should have been easy.

It took years. The property company would rather that floor to be empty earning no rent, than to cut a deal on it. And they won, the company paid their price and signed the long lease they wanted.

Property companies don't blink. They will not cut WeWork any slack.

<comment><USER31> This is sometimes the case. Other times renting the last few units brings in significant cash flow as it increases the NOI disproportionately to leasing the initial units. For example you're probably not hiring more custodial staff and you're probably able to make draws from your debt as you've increased property value by being fully stabilized

</comment></comment></comment></comment><comment><USER32> Loved this article. Entertaining and informative (as someone not very informed on WeWork).

> Ms. Neumann created controversy when she went on CNBC and said: "A big part > of being a woman is to help men [like Adam] manifest their calling in life."

In what kind of twisted society does a statement like that create "controversy"? I'm a man, and I've always felt that in my relationship it is my duty to bring out the best of my woman and enable her to reach her full potential. Are my fellow men outraged as well? Only in America does an innocuous statement like that generate controversy (unless of course this is just a couple random tweets that the media is trying to turn into a big controversy to generate ad revenue).

<comment><USER33> Of all the controversies regarding WeWork, this is one of the smaller ones, really.

</comment></comment><comment><USER34> The author of the article is a professor of marketing so I'd be interested to learn his opinion on WeWork's marketing instead of accounting, corporate structure and governance.

Adam's unconventional moves appear extremely outlandish when spelled out in the S-1 disclosures, but because I have no position I just find it entertaining. I'm looking forward to the conference calls.

I worked for WeWork for a short period of time during one of the SoftBank rounds, and one positive unconventional thing the company did was give employees with vested options the opportunity to cash out alongside Adam, rather than being forced to wait until post IPO lockup.

</comment><comment><USER35> Well, I live in the mountains in Central Arizona, so no WeWork offices near me (Phoenix and Los Vegas are the nearest). I would be tempted, even though I am mostly retired, to use a shared office space. I have a great home office but I still like to go to the library, or to a coffee shop, to write or work.

It just seems like WeWork should charge a little more to nail down profitability.

<comment><USER36> For what it's worth, there are non-WeWork coworking spaces all over. I'm not sure if you're near Flagstaff, but there are several in the area.

I think this business model will continue to survive regardless of WeWork's success or failure here.

</comment></comment><comment><USER37> For a contrasting view, consider this tweet from @patio11 [https://twitter.com/patio11/status/1161796809741627392](https://twitter.com/patio11/status/1161796809741627392)

> In 2025, every Fortune 500 company will have 10k+ remote workers, and every > purchasing department will approve a reimbursement for WeWork with no > questions asked.

The actual bull case for WeWork is similar to Uber: there may be a massive trend, and WeWork is positioning itself to be the winner. With Uber it's the push to self-driving cars, and with WeWork it's the corporate move away from massive campuses and office buildings. In this new landscape, WeWork has extremely strong branding, experience, and a valuation that suggests it is the biggest player in the space.

<comment><USER30> _In 2025, every Fortune 500 company will have 10k+ remote workers_

But what does that mean, exactly? I mean, imagine I'm an employee of BigBank in BigCity. My options are work from their office in the centre of town, work from my house wearing my pyjamas or... get dressed for work and commute into the centre of town, and sit in a WeWork instead and then charge it back on expenses because... reasons? I have better coffee and better wifi at my house...

<comment><USER38> Imagine you are an employee of MidSizedBank in MidSizedCity but happen to live and work in BigCity because your company has enough business with BigCity companies that it makes sense to have a local presence for face to face meetings. MidSizedBank isn't quite sure how much business they will actually be doing out of BigCity over the next five years and do not want to commit to a space just yet but currently have six people in BigCity and have teams day- tripping in for 2-3 days every couple of weeks. WeWork provides the space and general office infrastructure and MidSizedBank has flexibility for this remote team.

The WeWork I am at in London is filled with companies like this. Docker's UK team, PagerDuty's EU branch, more small quant teams than you can shake a stick at, etc.

You may have better coffee and wifi at your house, but the rest of your team is not interested in crashing in your kitchen all day...

<comment><USER39> But what differentiates them from any other company that rents out commercial real estate and re-leases it on a shorter term?

I can totally believe that their line of business will grow by a huge factor, but I don't believe that they will ever earn the out-sized margins to justify their current valuation. Their business can be replicated by anyone with a bit of capital to spend on leasing office space. They don't actually own most of their office space; they just lease it.

<comment><USER38> Nothing specific differentiates them other than scope. I can bounce among a hot desk at a variety of locations around the city, do the same in cities across the EU/US, and my company only needs one service provider account to manage. And we can do so with a generous subsidy from US VCs...

<comment><USER40> > I can bounce among a hot desk at a variety of locations around the city, do > the same in cities across the EU/US ...

what about a consistent user experience? that might differentiate We from competitors: ease of use and familiarity of environment for the workers. I mean, I go into a Starbucks or a Target store and it looks familiar and I already know what I'm gonna get (another Starbucks).

</comment></comment></comment></comment></comment></comment><comment><USER41> I skimmed at the S-1 filing .. they list 400k members for 2018, and revenues of $1.8B, so Average Revenue Per Member is $4500 USD.

Now the gross margins look terrible, but the sell is probably this: how hard is it to monetize 500k users (Q1 2019 numbers) who land up and work out of your managed premises everyday?

</comment><comment><USER42> If you enjoy this, please checkout Scott's podcast Pivot [0]. He shares all kinds of analysis like this.

[0] [https://pod.link/1073226719](https://pod.link/1073226719)

</comment><comment><USER43> To me, it's as simple as they lose $5200 a customer: [https://beta.trimread.com/articles/78](https://beta.trimread.com/articles/78)

We all can poke fun at the marketing BS and founder antics but it's just another investment to avoid for me.

</comment><comment><USER44> OT but saying "hot take" on twitter is like saying "i m going to pee" in a toilet.

</comment><comment><USER45> Just short it.

<comment><USER46> I thought this would be a good idea on that super hot hamburger chain a few years ago. I then learned that short interest changes based on short demand for that stock. I was putting 120% interest per year to short the stock. Be extremely careful with shorting, Warren Buffett himself says he won't touch it.

</comment></comment><comment><USER47> > ...it was a porn site. 22-28% of users were seeing adult content

No, it wasn't a porn site. It was a site where you could also find porn, which some people find objectionable and killed it, so the traffic dwindled. Calling Tumblr a porn site is a crude oversimplification.

</comment><comment><USER48> "Occasionally, red flags marry each other"

I'm glad I read this article.

</comment><comment><USER49> I have a couple of friends working for WeWork. Should they be worried about their jobs?

</comment><comment><USER50> It all really comes back to Trump in the end.

<comment><USER51> I thought this was a weirdly off topic comment, until I read the full article. Towards the end it goes off on a wild tangent claiming Union Square Ventures are the reason progressives could lose the 2020 election to Trump. (?!)

A shame, because the first half of the article is great.

</comment></comment><comment><USER52> I get that the author doesn't like WeWork, which is fine. But the throw-away comment that there is some tertiary connection to Goop seems unnecessarily personal.

Goop is a bunch of nonsense but I'm not sure why its relevant to why WeWork is nonsense.

<comment><USER53> I took that as a poor attempt at humor. I don't think the author actually implied a connection.</comment></comment>


How to destroy a hard drive - <AUTHOR> http://www.zdnet.com.au/insight/hardware/soa/Video-How-to-destroy-a-hard-drive/0,139023759,339293877,00.htm?feed=rss <comment><USER2> Shame they didn't test The Great Zero Challenge: <http://16systems.com/zero/></comment>


Ask HN: Why aren't Gov's doing anything about Facebook, Google etc? - <AUTHOR> Is there any specific reason?
I mean I understand that I sign up with a service and agree that they can use data to advertise on me... but they go into the extend of monitoring my private messages and present me with stuff that I've confidentially shared with another person or a group but not with them.
Is there nothing we can do as a whole to force GOV's to regulate those companies when it comes to advertisement? <comment><USER2> Not directly related to private messages monitoring and advertisement, but leaders like Angela Merkel have said that the Internet is not "a space that is free from the law." She was mostly referring to legislations that would combat fake news and hate speech on Facebook ( [http://fortune.com/2017/01/17/facebook- germany/](http://fortune.com/2017/01/17/facebook-germany/)).

If such regulations can be made, I'm sure if there's enough push, governments would (hopefully) regulate social media advertisement to a certain degree? With that said, there's so much money involved in that I highly doubt that governments can do much or would do much about it...

</comment><comment><USER3> Here's the thing. You agree to let those companies do that. They provide you with a service, and in exchange they collect data about you. That's the trade you're making. Without that data, they can't make any money as they rely heavily on advertising.

</comment><comment><USER4> "When the service is free, you are the product" or something similar.</comment>


Ask HN: Tell me about your dev machine - <AUTHOR> For the last 12 years I've been running Thinkpads as my main machine. Lately I've been doing some heavy Photoshop lifting and my poor x280 i7 is spinning it's fans out trying to cope with it. I started looking at building a desktop machine only to realize I have no clue about what's what anymore.
HN, tell me about your dev machine and help me decide on my next build.
Bonus content: here's what I'm looking at right now https://www.inet.se/datorbygge/bild/b1164307/datorbygge <comment><USER2> I have a custom built PC with 2 monitors. It runs Windows because I do lots of Windows development - despite getting to .NET Core we still have some older components that need visual studio. The gaming spec works quite nicely, the main thing I need is 32gb of RAM for running numerous VMs.

It also doubles as my gaming rig but I'm going to be moving us to a more strict device management strategy soon so I will have a dedicated work PC, and this will likely be a top-end Dell Precision. I recently bought a couple for some new developers (latest core i9, 32GB of RAM, NVME SSD) and they're very happy with them.

I also have a very light macbook air for travelling and taking notes in meetings etc. I couldn't actually develop software on it though, it's far too tiny.

I couldn't go back to developing on a laptop and definitely couldn't go back to 16gb of RAM. It does seem that with many laptops you must choose between >16gb or it being portable.

<comment><AUTHOR> Those Precision's looked very nice. How much are you paying per station?

<comment><USER2> About £1,400. The main saving comes from not going for any graphics card over an Intel Iris given that's not a requirement, but we can add an aftermarket card later if needed.

Doesn't include monitors though (£600ish for 2 27" monitors). It's a pretty beastly workstation, great for development.

</comment></comment></comment><comment><USER3> 2012 macbook pro with 16gb ram and SSD, I purposely got the last one without the ram soldered to the motherboard to allow me to upgrade it. It's about at the end of usable battery health and the screen is only 720p so I am thinking of upgrading soon.

</comment><comment><USER4> Running a 2020 MBP 512gb/16gb, small jump from a 2012 with 512gb/8gb

<comment><USER3> I'm looking at exactly this, as far as I can tell the cpu should be at least 10x but idk what that means for real world.

A nicer screen and nicer graphics card is going to be a boost for the odd game and just generally easier on the eyes.

I suspect better support for the latest macOS.

What else have you noticed?

<comment><USER4> So I've only had it for a few days now. First reactions are:

> Super small compared to my tank of a 13in 2012, but when compared to my work > laptop (17in 2020), it is also smaller in the direct comparison.

> Screen to Bezel ratio has consistently thrown me for a loop because I > accidentally touch the screen when trying to open and close it.

> True tone has definitely helped with having it be easier on the eyes. I used > to use Flux for that.

> Compile times for large projects have sped up visibly in my eyes.

> So I haven't been able to truly benchmark graphics wise but in comparison to > running Civ 5 on either computer, the 2020 edition blows it out of the > water. Along with it not having a terrible lag when switching from game to > browser.

> Even with the ARM conversion, I suspect that I'll have at least 3-4 good > years out of this as a side project / light AR development mobile computer > so I'm happy that it'll handle an OS update gracefully.

> I've been able to use the Macbook/Macbook Air/Macbook Pro (2016-2019) > keyboards, and I'm glad that that did not carry over to MBP 2020. It's the > closest to having my 2012 keyboard with responsiveness (jury is still out on > reliability)

> TouchID is a bonus but I haven't used it past auth'ing into my laptop or > sudo sessions.

> Still acclimating touchbar, multiple taps to access items has taken some > getting used to mentally.

Previously I was using a Refurbished 2012 MBP for 6 years (with HDD/RAM upgrades, battery replacement), throughout college and my first job. So this jump to a retina display, faster processor, lighter form factor is a whole new world for me.

<comment><USER3> Thanks for taking the time to write this up!

I might get one instead of waiting for the ARM update. My user requirements are not that much!

</comment></comment></comment></comment><comment><USER5> 1\. Pick a processor you like in your budget

2\. Pick a form factor. Regular size/smaller?

3\. Now you have specs for motherboard.

4\. Rest of the stuff is what you need/want. Stuff like memory sticks, onboard or separate gpu, onboard or separate WiFi card.

<comment><AUTHOR> The jump from i9 to something like ThreadRipper is like 5x. Will I even notice it?

</comment></comment><comment><USER6> Thelios Major from System76.

      64GB memory
      8 GB GeForce RTX 2070 Super with 2560 CUDA Cores
      A couple of NVME SSDs.

I install Centos as the OS. Setup, including Nvidia drivers was very easy.

Probably could be built from components cheaper, but I appreciated just making an order and having a box show up later.

My past machines have been Thinkpads, then six years with a Macbook Pro that I wiped and installed Debian on. I made the move back to desktops for a variety of work-related reasons.

</comment><comment><USER7> Every 4 to 5 years I buy a new laptop for 1000 euro that looks nice and put xUbuntu on it, that's all.

</comment><comment><USER8> I mostly use a laptop, specifically a zenbook.

This LTT video is probably more useful for you though: [https://www.youtube.com/watch?v=Kua9cY8q_EI](https://www.youtube.com/watch?v=Kua9cY8q_EI)

</comment><comment><USER9> second-hand MacBookPro 2015 retina 13" with measly 8Gb of RAM, but i replaced the SSD for a Samsung EVO 840pro ( 500Gb with an adapter ).

I use it daily for Java/C#/Golang ( with jetbrains IDEs ) and reactNative ( with vscode ). Sometimes it lags a bit, but i still like it for its lightweight feel in general.

( oh, on my desk i also have a 4k phillips 27" external monitor for those times a 13" retina would not be enough )

</comment><comment><USER10> My generic recommendation are Dell Precision workstations. Powerful, well supported, and rather unexciting. Which is what I really want when I'm honest with myself.

</comment><comment><USER11> Using a MacBook Air for web dev, and it's plenty. For photoshop I'd probably want something with a faster CPU and better GPU, tho.

<comment><AUTHOR> That's my thinking. However, a 100 kLOC project in Visual Studio is pretty heavy handed as well

<comment><USER11> Can't comment on that as I don't generally use IDEs.</comment></comment></comment>


Horcrux: A Password Manager for Paranoids - <AUTHOR> https://arxiv.org/abs/1706.05085 <comment><USER2> I am pretty sure the code is reusing IVs for AES-CTR[0] (i.e. the encryption is worthless), because it doesn't specify an IV and Node seems to derive the IV from the key.[1] This seems like a massive footgun in Node.

I don't think their scheme results in different keys for each site, but I could be wrong.

[0] [https://github.com/HainaLi/horcrux_password_manager/blob/mas...](https://github.com/HainaLi/horcrux_password_manager/blob/master/utils.js#L20)

[1] [https://nodejs.org/api/crypto.html#crypto_crypto_createciphe...](https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password)

<comment><USER3> Wow. This is yet another example of the fatal combination of Rolling Your Own Crypto + Using OpenSSL Directly And Blowing Your Own Foot Off Because It Lets You.

      var cipher = crypto.createCipher('aes-256-ctr', key.toString('hex'))

Besides the completely fatal error of using derived and non-unique IVs (fatal as in, if you encrypt more than 1 item with it, it is exactly as good as plaintext because any two items encrypted with the same key+iv in CTR mode cancels out to plaintext), isn't using hex encoding vastly constraining the possible complexity-per-byte of the key?

A single hard-coded salt for key derivation:

      const key = crypto.pbkdf2Sync(auth, '0945jv209j252x5', 100000, 512, 'sha512');

Again, the salt is only lowercase alphanumeric. This makes this 120-bit salt really just a 77-bit salt. But since it's hard-coded and not randomly generated, it's a 0-bit salt.

Can everyone who is developing crypto apps Just Use NaCl/Libsodium?

<comment><USER4> As an infosec guy, I'm honestly getting really tired of this. Virtually every time someone submits some new security tool to Hacker News, the author has made trivial, catastrophic, and what should be _completely avoidable_ security mistakes.

So for the hundredth time, if you're not a cryptographer or experienced security engineer, _please stop releasing and promoting your crypto-related projects_ before they have been vetted by someone who is. If this is something you intend to release, ideally run the basic idea by someone qualified _first_. By not doing so, you are doing _active harm_. Someone's life and/or liberty may very well depend on the software you write, and when you fail them in this regard you are ethically and morally responsible when these things are taken from them.

<comment><USER5> Is there a good way to find people who are qualified to do such a review? This paper was written by a Ph.D. student and professor of Computer Science at a respected university. The professor teaches a crypto course on Udacity ([https://www.udacity.com/course/applied-cryptography-- cs387](https://www.udacity.com/course/applied-cryptography--cs387)). If they don't meet the criteria for being cryptographers, I wonder how many people in the world do?

<comment><USER6> I'm going to push back on this a bit.

Thomas responded alongside this comment to talk about how academic cryptographers are not necessarily qualified to implement original crypto, and I largely agree with that; however, I don't actually think that's the issue here. Rather I would pin this on a lack of _peer review._

I could be wrong, but I don't believe the author of this paper has had it published or at least accepted in any journal or conference proceedings. Being an eprint format with endorsement rather than peer review, you can expect mistakes like this to happen often, even if the authors are ostensibly qualified. When you submit original research for publication you generally go back and forth a bit with adjustments as needed, and as long as there is nothing egregious you don't need to redo it all.

In this specific case, I believe the author fully understands the issue (or would, were it presented to them) and is fully capable of fixing it. A qualified peer review would (hopefully :) have caught this and other latent issues if an HN commenter did.

We see this in the broader mathematics and computer science communities, and we especially see it in sub-disciplines like machine learning as well. It's absolutely true that academic cryptographers should not be assumed capable of rolling their own crypto _a priori_ , but in my (educated) opinion I would certainly place far more weight on crypto developed by an academic cryptographer than a software engineer without any particular training.

My platonic ideal for someone who is capable of developing original crypto is something like an academic with a PhD in math or computer science (focusing on crypto), who can develop software very well and who joins an applied lab for crypto engineering and development (like NCC's) or a top cryptanalysis firm like Riscure. Failing that, I'd probably place the most weight on someone who had a lot of training in crypto engineering or practical cryptanalysis over an academic with no implementation experience.

(I apologize if any of this is patronizing, I don't know what your background or familiarity with the academic process is w/r/t peer review, etc).

<comment><USER7> > A qualified peer review would (hopefully :) have caught this and other > latent issues if an HN commenter did.

Would the qualified peer-review necessarily be reading the NodeJS code, or just checking the theoretical soundness of the paper? I'm not so certain about the former...

<comment><USER8> Almost certainly not the former, no. At best the code would be "supplementary material", which reviewers are not required to go over.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> The trick of entering a dummy username and password, which is then modified in the post request sounds a whole lot better than playing clipboard roulette or messing with the DOM.

<comment><USER10> This sounds pretty cool! What I'm wondering, is how they are intercepting the POST request and at what level?

<comment><USER11> I have not read yet, but my guess is they are taking all HTTP requests from the page and looking for their dummy username/password and replacing that. Not every login form (though we would like it) is in a form tag w/ an explicit action. Some SPA's will do an AJAX post of JSON w/ the credentials embedded (which is bad practice, but happens).

Actually, the more I think about it, I don't think I want this extension to do that...how does it know how long between when the fake fields are entered and when I press submit? Now I am going to read the paper...

Edit: Yup, the extension intercepts all network traffic even before you click submit. If you, e.g., hash on the client side this password manager will break. If you never click submit, this extension will continue to read all HTTP bytes from the page going back to the server it seems, looking for some strings...not sure the perf implications of this.

<comment><USER12> Out of curiosity, why is an AJAX post of JSON with credentials embedded bad practice?

<comment><USER11> Not bad practice from a security perspective per se, just annoying to users that don't want JS, or like the non-password fields to support their browser's features like autocomplete, etc. Granted if it's a SPA, some of that usability shop has sailed. And while any AJAX post is secure normally, many JS implemented login solutions open themselves up to CSRF and other problems.

<comment><USER10> You can have the form submit to a real address when js is disabled, and disable the form's behavior when js is enabled.

</comment></comment></comment></comment></comment></comment><comment><USER13> Repository of the project:

[https://github.com/HainaLi/horcrux_password_manager](https://github.com/HainaLi/horcrux_password_manager)

</comment><comment><USER14> If you are paranoid, then there is only one option, you are the password manager. Certainly not a piece of software you didn't author yourself. Else you are not truly paranoid.

<comment><USER15> If you can audit the code yourself, you can treat it as code you authored. (assuming you are competent to perform the audit)

<comment><USER14> True, in theory, though in practice, i know plenty of capable people but almost none of them bothers to read the openssh source (or even a subset, like recent changes) before updating or recompiling.

<comment><USER16> Make sure you read the code of the compiler you're using as well, and bootstrap/compile it from that source instead of trusting an existing compiler binary.

<comment><USER17> Why stop with compilers? Inspect the circuit diagrams for all your hardware and then make sure the actual manufacturing followed the designs to a tee.

<comment><USER18> I mean I know it hyperbole but I am pretty sure there are hardware bugs that allow access, see that Intel or IBM remote management disclosure. It might not a real backdoor but it's as good as one. As people above are mentioning keep your paranoia inside your threat model

</comment></comment></comment></comment></comment></comment><comment><USER19> Speaking of, why is there still no standard protocol for changing passwords? That's 90% of the barrier to managing passwords.

<comment><USER20> There's several. LDAPv3 ja kpasswd are some examples.

</comment></comment><comment><USER21> I haven't looked at the security of it yet, but the name alone is a winner for something you want to keep secret.

</comment><comment><USER22> Why on earth isn't the industry moving away from per-site passwords? They are terrible. The fact that you need your own app to "manage" them is just evidence of how terrible they are.

People should be able to use their phones, Yubikey, TouchID, etc. as their authentication, without needing a password (except a master password for the phone/Yubikey/TouchID).

And yet I see no movement towards this from the industry. Are we stuck in this terrible state forever?

If I could see into the future I would dearly hope that in 10 years we are not seeing HN front page articles about the newest innovations in password managers.

<comment><USER23> I'm not sure I actually agree with this. Do you know of any studies that go into this?

My concern is around having a single source of failure/attack. Which, to be fair, is probably not that different than most people's scenarios. That is, most people just let their browsers and phones remember passwords. So, in practice this already happens. I just don't feel like it is safe. I'm highly interested in being challenged on this.

<comment><USER22> I think the only way you avoid a single source of failure is if your brain is actually capable of remembering a separate, high-entropy password for every website you visit.

If you use the same password (even a high-entropy one) on every website, any hack of a single site compromises you on every website.

If you use a password manager to store high-entropy passwords for every site you visit, then the password manager is a single point of failure.

Both of these attacks happen in the real world. But securing a single authentication system like a phone app/Yubikey/TouchID/etc. seems more tractable than securing every website that you visit.

Password managers are available today, but since the websites you are using don't actually know about them, the integration and ease of use are not as great as they could be.

My vision is that you can use a phone app/Yubikey/TouchID/etc. to create as many identities as you want, and then you can use these to robustly authenticate to any website. To the website you would just be a GUID: an opaque identifier that it doesn't know anything about unless you tell it more. And all the app/Yubikey/TouchID does is let the website know (securely) that you are the same GUID that logged in last time.

<comment><USER23> I primarily rely on resets, oddly. Drives me crazy when folks think I will actively try to remember a password that I do not use daily for more than a few days. If you have my email, you have everything you need to let me initiate a reset.

Which, I fully cede is also a single point of failure. Basically, I think we have plenty of weak links in the chains. I'm not too keen on codifying any new ones. If you have something that increases the strength of everything, I'm game to try it. And I am highly interested in studies that look into different strategies.

</comment></comment></comment></comment><comment><USER24> I think all password managers that store passwords are flawed. Storage is a burden. The store must be synced between devices, secured, backed-up, etc. and it can be stolen. I believe that passwords should be deterministically generated when needed, not retrieved from a store. I'm not sure why this approach is not seen more often.

 __ _Edit: It seems people don 't understand what I mean... I just put some code here to better explain: [https://github.com/w8rbt/dpg](https://github.com/w8rbt/dpg) ___

<comment><USER25> How could you generate passwords that satisfy arbitrary password constraints? Say example.com has a 20 character limit, must contain a capital letter and symbol (but not certain symbols), and can't contain a dictionary word. It seems to me like your generator would have to have an option for each constraint to satisfy, and you'd have to remember them at the time of retrieval (unless you store the settings).

Is there a different solution?

<comment><USER26> I solved it in WebPass[0] by encoding the constraints for special (i.e., not generic) sites into rules associated with a unique ID, then only valid password are considered.

[https://webpass.rkeene.org/](https://webpass.rkeene.org/)

</comment></comment></comment><comment><USER27> For those interested in related work, Mark Currie designed and patented one around 2008 that intercepts logins, injects correct credentials, and handles the TLS on a USB device. He described it to us on Schneier's blog as follows:

"The device is a small USB gadget that effectively acts as a SSL proxy, allowing it to have direct and first access to the clear text data to and from the host. It has a small user interface so it can accept (and optionally store) specific user input (PINs, passwords, credit card no, etc) and display specific user/server output data fields. This allows it to insert either pre- stored or on-demand passwords etc. into the outgoing stream. It also allows specific confirmation data fields from the server to be displayed e.g. a beneficiary account no., balance amount, etc.

So the actual passwords are only available in the comms path and PC-side in SSL-encrypted form and any confirmation fields (beneficiary account no., balance amount) are confirmed to the user via the integrated display just before being SSL-encrypted, so they cannot be manipulated before going to the server.

In terms of inserting a password, it automatically detects the standard HTML password form field and the corresponding response message (used by all secure web servers), and substitutes a dummy password for a real one. I have confirmed that this function works on all the major web sites e.g. PayPal, Amazon, E-Bay, Google, LinkedIn, etc. and at least four banks that I have checked (probably most).

For displaying server confirmations, it might require a little help from the host server in terms of detecting the HTML display field, or else it would need to store a profile for each website (not ideal). However, it costs the host service very little to tweak a bit of HTML.

I agree with you whole-heartedly about the user being in the loop. That is what my aim was with this device – The gadget directly authenticates the server through normal SSL and displays the server validity directly to the user via the integrated display. In Internet banking the main threat is the beneficiary account number. As long as the user is satisfied that the account number displayed on the device is correct then it cannot be manipulated other than by breaking the SSL crypto. In this it is almost identical to the IBM ZTIC. The difference is that it also allows the user's password to be sent securely to the bank and therefore does not require the use of a client cert (so no private key needed)."

</comment><comment><USER28> Perhaps this helps with trusting the password manager but it looks a bit complex to me.

Personally I'm more concerned about when I enter a master password that if there's a Trojan on my computer it's game over.

As most password managers are an encrypted database of sorts once it's encrypted all your passwords are out.

The only protection against that is some sort of 2FA.

<comment><USER17> I guess if your system is compromised then password security becomes gravely threatened, no matter how secure the password manager may be. The only partial solution I can think of is to have the OS sandbox every application from every other.

<comment><USER29> Yep, pretty much. It really reminds me of this: [https://xkcd.com/1200/](https://xkcd.com/1200/) for obvious reasons.

The only ways I can think that would be able to prevent this are:

         1. Physical non-networked device password manager
         2. Really creative usage of SELinux
         3. QubesOS

And in reality, #1 is kind of how RSA tokens are used. Of course, physical can be lost, stolen, and all that. QubesOS takes a ton of resources to run effectively, given everything is VM'ed and contained with a capability system.

In all honesty, I could see buying an Android at a Pay as You Go place, and repurpose it to be a offline password manager. Never connect it to wifi, BT, cell. And any APK's you need you load via microSD card and USB.

</comment></comment></comment><comment><USER30> Too many problems with passwords, oauth and other things. There should be a standard auth protocol that is secure and works with everything out there. Why isn't there a successfully adoptef one yet?

This is my attempt in progress:

[https://github.com/Qbix/auth](https://github.com/Qbix/auth)

</comment><comment><USER31> Does anyone else think it's cool that Harry Potter fans are now old enough to be getting crypto papers published?

<comment><USER32> You are assuming Harry potter fans are all ≤12?

<comment><USER31> Well, I assume that there's a bell curve, with the median around 8, because I was eight when the books were first published in the US. (Scholastic is often associated with publishing kids books, too.)

</comment></comment></comment><comment><USER33> _a password manager that is designed holistically_

Honest question: what does 'holistically' mean in this context?

<comment><USER34> (co-author here)

Good question - it means the whole system (that is, both the client and server) were designed with the goal of limiting the exposure of the user's passwords in all ways we can - including time (not exposing them in the DOM and having the minimum possible exposure to the browser with acceptable user experience), code (minimizing the amount of code that has access to the user's credentials), and organizations (minimizing the trust the user has to put in any one provider).

</comment></comment><comment><USER35> It's fun that the authors readily admit that the idea is for paranoid people.

[https://xkcd.com/538/](https://xkcd.com/538/)

<comment><USER36> Being vulnerable to blunt objects does not mean you shouldn't care about other attack vectors.

<comment><USER35> Overly focusing on one attack vector still leaves you vulnerable to many others. System designers need to consider risk:reward and effort:reward for users.

The paper offers an interesting but extreme extension into one aspect of security that users control. That is great to offer an extreme solution for the paranoid. If implemented well, even the less paranoid could use it.

Sadly this solution still offers less security than systems integrated into SSO/OAuth and 2FA.

<comment><USER36> > Sadly this solution still offers less security than systems integrated into > SSO/OAuth and 2FA.

OAuth implementations very often have vulnerabilities. Just look at how many Facebook had!

Not to mention 1) it doesn't scale like passwords and 2) all the privacy implications.

As for 2FA it's in addition to primary authentication scheme, like a password, not instead.

</comment></comment></comment></comment><comment><USER37> Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it.

My biggest problem these days is dealing with sites that don't allow 30+ char passwords with full range of special characters. Almost exclusively, banks.

<comment><USER38> What is it with banks and their annoyingly terrible "security" requirements? My old bank once sent me an email saying I had to reset my password. The email seemed legit, but upon following the link therein something didn't seem quite right. So I use another device to visit my bank's site directly. Upon trying to login, I get redirected to the same form I reached from the email link and had a sinking realization that my bank did indeed expect me to fill in my name, address, SSN, DOB, debit card number, and PIN just to reset my password.

I sent a strongly worded email to a handful of people at the bank asking them if they really thought it was a good idea to teach their customers that its okay to click a link in an email claiming to be from their bank and provide that much personal information. I never got more than a canned response back, but several months later they did overhaul their password reset procedure to a more typical one.

<comment><USER39> I suspect it's the same reasons nuclear launch facilities use floppy disks -- the solution is approved, and getting a new solution approved is viewed as too expensive/infeasible.

Not saying the argument is valid, just that it may be the reason.

<comment><USER40> That and its proven to work, has a ridiculously long track use history (for software) so the bugs are fixed or well documented, and pretty damn hard to exploit. It's not like anyone is going to plug an 8 inch floppy disk they found laying in the rural Wyoming dirt parking lot into the nuclear silo master computer to check what's on it.

<comment><USER41> Yikes! Last time I looked, the intercontinental nuclear launch codes of any major power have not yet been proved to work.

But OK, I assume they still pass whatever dry-run test procedures exist. But if it is true that they are based on floppy-disks, then I don't think sticking with them is a net win for reliability and safety.

Bits rot, especially on floppies. So if they are still using them they have created procedures for refreshing the bits from backups. By now the floppies might be little more than ceremonial objects inside the systems that _really_ determine the launch procedure.

And those systems would have evolved informally over time and might be ever- changing, poorly understood and poorly tested.

</comment></comment></comment></comment></comment><comment><USER42> I use hashicorps Vault for keeping all my secrets. And never looked back.</comment>


Ask HN: Which messenger do you use on your phone? - <AUTHOR> <comment><USER3> Facebook Messenger for friend and family that can't use SMS (or understand texting.) Google Voice for everything thing else. I really like Line, Quidd (don't judge) and Telegram. But I use them more as BBS services then a true messenger app.

<comment><AUTHOR> What's quidd?

</comment></comment><comment><USER4> Franz on desktop. It uses 3GB of RAM and doesn't allow shortcuts to open individual services, but this is where we are in 2018. The slow death of interoperability has ruined messaging.

</comment><comment><USER5> On my android: Threema, Slack, HipChat, Telegram, Hangouts & WhatsApp - <USER2> is the only option to reach 99% of chatting. In Germany / my list of WhatApp user is decreasing.

<comment><AUTHOR> So what's the reason behind people flocking from WhatsApp?

<comment><USER5> In Germany, people are very concerned about ongoing data scandals on Facebook and this is one reaction.

</comment></comment></comment><comment><USER6> IRC, and matrix. I use trillian5 with a custom skin as the client on my laptop, and riot on my phone.</comment>


Microsoft Invented Google Earth in the 90s Then Totally Blew It - <AUTHOR> http://motherboard.vice.com/read/microsofts-terraserver-was-google-earth-before-there-was-google-earth <comment><USER2> We were trying to use terraserver back in the day to provide additional value to our business offering which was highly terrain based (we were doing 3d terrain analysis and wanted imagery to add to it).

But let's be honest it isn't just that Microsoft didn't see the value in the data, it was they weren't very friendly in the terms they offered for using the data. Not saying Google is a panacea, but Google realized if they let small businesses generate some traffic (with no to minimal costs) that the end result was "addiction" and revenue as those small businesses grew.

Microsoft was too focused on dollars and proving their engineering chops. Not that I have anything but respect for the engineering chops, but still. Ironically, we were also based on Digital Alpha servers running Windows, damn was that weird but fun and oddly extremely powerful.

</comment><comment><USER3> Microsoft: Always reinventing the wheel, never making it round.</comment>


Kill Sticky Headers - <AUTHOR> https://alisdair.mcdiarmid.org/kill-sticky-headers/ <comment><USER2> Oh the irony... on mobile that site has a sticky header...

<comment><USER3> And a button that lets you kill it, which is presumably why it's there.</comment></comment>


Can a startup be successful outside of "tech hub" cities? (SF, NYC, BOS) - <AUTHOR>

Considering a move out of one of these cities and wondering if that spells doom for my dreams of starting a company. Any suggestions/feedback would be appreciated. <comment><USER2> Yes, of course it can. Consider the alternative statement "No startup can succeed outside of (SF,NYC,BOS)." It only takes one counter-example to disprove that statement. Can you find one startup that launched outside of those cities that succeeded? Ok, done.

Now the bigger question "does operating in one of 'those cities' have advantages?" or "is it _easier_ to succeed as a startup in one of 'those cities'?" is a different issue. Certainly there are reasons why so many startups come from certain areas. But if you really are wanting a binary "yes/no" answer to "Can I - at least theoretically - succeed somewhere else" then there's really no question. Yes, it's been done [1] and it's being done.

FWIW, I'll point you to some examples of the kind of stuff that's going on in one area (Raleigh/Durham/Chapel Hill/RTP, NC) that's outside of the traditional "tech hub" areas you mention:

<http://news.ycombinator.com/item?id=2233892>

<http://news.ycombinator.com/item?id=2233666>

<http://news.ycombinator.com/item?id=2129698>

<http://news.ycombinator.com/item?id=2222813>

<http://news.ycombinator.com/item?id=2116846>

<http://meetup.com/RTP-Hackers-Founders/>

<http://www.meetup.com/lsc-rtp>

<http://southcap.eventbrite.com/>

<http://eseriesmarch2011.eventbrite.com/>

<http://www.joysticklabs.com/>

<http://www.launchboxdigital.com/>

[http://www.newsobserver.com/2010/07/21/590526/american- tobac...](http://www.newsobserver.com/2010/07/21/590526/american-tobacco- gives-startups.html)

[http://blogs.newsobserver.com/business/five-companies- join-a...](http://blogs.newsobserver.com/business/five-companies-join- american-tobaccos-basement-space-for-startups)

<http://www.vcic.unc.edu/>

And just for a little additional context:

<http://en.wikipedia.org/wiki/The_Triangle_(North_Carolina)>

<http://en.wikipedia.org/wiki/Research_Triangle_Park>

[1]: <http://www.redhat.com> \- maybe the best known of the Triangle area startups from over the years.

And NC is just one area that has a lot going for it, outside of Boston, NYC, Bay area... there are plenty of places you can launch a startup, you'll just need to do your research and evaluate the relative merits and advantages and disadvantages of them. One example of a disadvantage frequently cited here in the Triangle NC area is that it's generally considered harder to raise Angel / VC money here than out West or in Boston / NYC. It _is_ possible of course, it's just harder.

</comment><comment><USER3> Perhaps you've already seen this:

[http://techcrunch.com/2011/02/14/can-you-really-build-a- grea...](http://techcrunch.com/2011/02/14/can-you-really-build-a-great-tech- firm-outside-silicon-valley/)

I am currently investigating two cities away from my home in San Francisco.

<comment><USER2> Suster makes a good point, there are interesting assets outside of Silicon Valley. And to spin off from one of his own points, about the content industry being centered around Hollywood, I'll just throw this out there:

[http://www.essortment.com/film-industry-city-wilmington- nort...](http://www.essortment.com/film-industry-city-wilmington-north- carolina-33166.html)

<http://www.wilmingtonfilm.com/>

<http://www.ncfilm.com/>

Believe it or not, but NC (Wilmington and Southeast NC in particular) have a thriving film industry. So if you're looking to do something that requires people with skillsets around filming, there's a whole other world here on the East coast that can provide that.

</comment></comment><comment><USER4> As a Chicago native and presently being at school in Ann Arbor, MI, I can tell you that there are definitely opportunities in other cities.

</comment><comment><USER4> It would certainly be easier to answer you if you had specific places you were thinking of!

</comment><comment><USER5> I guess it depends on your definition of "doom". You can start a company anywhere. The "tech hubs" are just places where it has better odds of going big (very, very big).

Why are you considering moving? What are you looking for, either personally or professionally, in a new location? You might get better feedback if folks had a little more to go on.</comment>


OS X 10.6 may use FreeBSD's ULE scheduler to boost SMP performance - <AUTHOR> http://neosmart.net/blog/2008/os-x-snow-leopard-to-use-ule-scheduler/

<comment><USER2> It would be great if this were true... but I doubt it. I've never heard any indication that Apple's scheduler has much in common with any of the FreeBSD schedulers -- my recollection is that their scheduler comes from the Mach side of things. They might borrow a few ideas here and there, but schedulers generally tend to be pretty tied to their parent kernels, so I'd be surprised if any ULE code migrated to OS X verbatim.

File this one under "cool story, too bad it's not true".</comment>


Google Buying Land for Future Data Centers - <AUTHOR> http://www.datacenterknowledge.com/archives/2011/07/18/google-buying-land-for-future-data-centers/

<comment><USER2> Just out of curiosity I searched for a reference and apparently T-Mobile spend 1.9 bn USD in 2008 in Europe on capital expenditures for its mobile segment. Not sure if those numbers are comparable though.

(url: [http://www.geschaeftsbericht2008.telekom.de/en/konzernlagebe...](http://www.geschaeftsbericht2008.telekom.de/en/konzernlagebericht/geschaeftsentwicklung- der-operativen-segmente/mobilfunk-europa-und-mobilfunk-usa/index.php?page=75) )</comment>


DNS conformance test program - <AUTHOR> http://www.standcore.com/services.phtml <comment><USER2> >This package is available under a Creative Commons License. You can download the source code here.

Peculiar choice of license for software. Also, having downloaded the package and done a quick grep, I don't see them mentioning _which_ CC license. It's important to mention. Also, the package includes a lot of IETF RFC documents, the license of which are still not quite clear to me.

I suggest that they use the ISC license [0] for the next release of their source code and that they make the license of the included IETF RFC documents clear.

This all being said, it looks to be a nice project and I wish them good luck with it.

[0]: [https://en.wikipedia.org/wiki/ISC_license](https://en.wikipedia.org/wiki/ISC_license)</comment>


Ask HN: Could profitable Zombie companies be combined like CDOs and sold off? - <AUTHOR> <comment><AUTHOR> I could be using the term wrong. I assumed it meant a company that is still functioning but isn't growing fast enough to attract more capital.</comment>