Boeing Fought Lion Air on Proposed Max Simulator Training Requirement - berkut
https://aviationweek.com/air-transport/boeing-fought-lion-air-proposed-max-simulator-training-requirement
======
mcv
Boeing was already plenty culpable for these disasters, but this underscores
just how much they pressured they pressured their customers to avoid training
that could have mitigated the problems and prevented the crash, just to keep
up the illusion that they wanted to present to the world: that it was
effectively identical to the NG when it really wasn't.

~~~
rob74
On the other hand, Boeing was also under pressure from other customers
([https://www.reuters.com/article/us-boeing-airplane-
southwest...](https://www.reuters.com/article/us-boeing-airplane-
southwest/u-s-lawmakers-question-boeings-1-mln-rebate-clause-for-
southwest-737-max-orders-idUSKBN1X92D4)) who wanted to avoid simulator
training for their pilots. Which doesn't excuse them of course, but I think
it's important to see the whole picture...

~~~
CaptainZapp
Sorry, but: So what?

If you're not able to keep promises you shouldn't make them in the first
place. The buck stops with you, period.

No pilot training was often used as an argument. But I think the problem was
actually much more severe.

If Boeing would have designed a completely new plane (which they should have)
they would have lost a decade to Airbus' offerings in their most important
market.

That, in my opinion, was the real reason for that shoddy hack of a plane.

~~~
Entalpi
So Boeing was slow to react to the market forces at play and lost out to a
faster moving more adaptive competitor. When that happens in a market you
typically lose money and try to stage a comeback by reinventing yourself or in
some way try to work your way back. Boeing chose to rush and is now paying the
price for being a slow and complacent behemoth of a company at a market where
others are innovating and competing.

~~~
wu_187
This has nothing to do with markets and everything to do with ethics. It is
not ethical for a company to knowingly risk lives to rush out a new product.
In the airline industry, it is unheard of for this to happen. Everything is
triple redundant for a reason. Typically you would cut corners elsewhere that
is not a risk for human lives. Boeing already tried that by outsourcing the
construction of the 787 and it was riddled with failure. They should have
learned their lesson there.

------
ameen
In a way, Boeing’s plight underlines American work culture vs. European and
other relaxed but stringent work cultures.

American businesses are constantly churning output with not much to show for
(relative to effort vs results) as the employees are burned out, investors and
C-suite demand more of the middle-management and they in-turn pressure
engineering and sales teams, etc.

The results have spoken about which one works and which doesn’t. Toxic work
culture starts from the top.

~~~
datenhorst
I believe Harvard Business School and its ilk deserve a lot of blame for the
instilling of a profit-at-any-cost culture across the US.

~~~
neuronic
I studied abroad in the US as a European and the first sentence the
microeconomics professor blurts out: "Greed is good."

At that point I wasn't as gobsmacked anymore because several days before some
17 year old girl yelled in a 300 person biology lecture at the professor to
stop telling lies about evolution (first week of college).

But "greed is good" struck me as an oddly American way of viewing the world.
Europe isn't free of greedy people, by any means, but it's sort of not the
first rule you learn in school.

~~~
msiemens
I guess it depends. I have a German engineering degree and took a business
administration course as a part of that. And in one of the first lectures our
professor told us that _The formal goal of the company is to maximize profit_.
Which seems to be just a more formal way of expressing _Greed is good_. But
then again, this might be influenced by American business culture…

~~~
neuronic
Agreed, and I obviously suffer from some bias since I could not experience
college in both countries.

But the microeconomics angle seemed more personal - as in attempting to
describe interaction between people with some extrapolation to larger
entities.

------
toast0
Even if Lion Air had done simulator training, it seems unlikely to have
helped, unless there was specifically material on MCAS or at least stabilizer
runaway by the electric trim system.

One airline demanding and getting simulator time doesn't help if the decision
has already been made to not inform pilots about MCAS. Boeing's flight rules
model has always been around the pilot(s) having situational awareness and
being in absolute control; the problem with MCAS is not what it does, or that
it's needed to avoid stalling, the problem is that it was not known to pilots,
that it operates without any clear indication that it's operating, and that it
can only be disabled by disabling electric trim, and that manual trim is
extremely difficult to impossible to use if the stabilizer is at full nose
down (there was an old 737 procedure for this, but it was removed some number
of redesigns ago, it was reportedly not in the 737 NG manual)

~~~
willyt
Here is a video explaining how difficult the manual trim procedure is:
[https://www.youtube.com/watch?v=aoNOVlxJmow](https://www.youtube.com/watch?v=aoNOVlxJmow)

~~~
tzs
Note that the video is about manual trim in extreme conditions.

If pilots knew about MCAS and that in the case of a runaway trim due to MCAS
they need to disable electrical trim and switch to manual trim early and keep
it manual for the rest of the flight, they would not get into the conditions
where it is hard to turn the manual trim wheels.

~~~
willyt
But even if they had known about MCAS, I think I read somewhere that they had
30 seconds to diagnose the problem before it put the trim in this
configuration.

------
jakobegger
Can someone explain how Airplane Simulators for pilots work?

Do simulators have the same hardware as real planes, or do they have a
software model of the airplane?

If you simulated a broken AoA sensor, would the simulated plane behave similar
to the real plane? Would the MCAS system have the same bugs in the simulator
as in the one in the real aircraft?

Can you try new scenarios in a simulator, or can you just try scenarios that
the simulator was designed to run?

~~~
phugoid
> Do simulators have the same hardware as real planes, or do they have a
> software model of the airplane?

If you're looking at the highest fidelity level D simulators, the instruments
and controls in the cockpit are either the same parts as the aircraft, or
functionally identical (but cheaper).

> If you simulated a broken AoA sensor, would the simulated plane behave
> similar to the real plane? Would the MCAS system have the same bugs in the
> simulator as in the one in the real aircraft?

One of the big costs in building a simulator is buying the data package from
the aircraft manufacturer, with the aero model and details of system
internals, things like electrical and hydraulic schematics. Sim makers build a
software model of these internals at a pretty low level. For the most part, if
you introduce a fault in some part of the system it will behave the right way
as an emerging property, not because you're forcing the system to have the
right outputs.

Some software components from the aircraft get installed on the simulator with
the same hardware platform from the aircraft, others get run as executables on
the simulator's computers, and others get re-implemented from scratch (lots of
FORTRAN and C).

That kind of detail comes into play when the instructors introduce multiple
failures at the same time - pilots have to take corrective actions to make the
faults go away or manage them - if you don't model the systems at a pretty low
level you'll never high fidelity.

> Can you try new scenarios in a simulator, or can you just try scenarios that
> the simulator was designed to run?

There is a list of malfunctions available to the instructor, who runs the
session from the back of the "cockpit" on touch panels. For the most part,
these malfunctions cover failures that are anticipated by the aircraft
manufacturers, and the corrective actions / system behavior are well
understood. Each fault is tested to make sure it works properly. You don't go
and fail some random component in the system.

When an important failure happens in the real aircraft, it might get added as
a training scenario to simulators already in operation.

~~~
NotCamelCase
> You don't go and fail some random component in the system.

I always wondered if they did that, something akin to fuzzing tests in SW.
Wouldn't it be useful to detect unexpected situations that'd be catastrophic?
Or the benefits from it wouldn't outweigh the cost/time loss?

~~~
phugoid
Even with a pretty good model, if you introduce new failures that were not
anticipated/tested, there's a risk that the system will not behave as per the
aircraft. Now you're giving "negative training" to your pilots, maybe worse
than no training at all.

Also, imagine you're an airline with thousands of pilots and dozens of
instructors: you're running an airline and a school at the same time. You need
to build a curriculum of training and testing that will standardize your
pilots. There's room for thinking outside the box but not too much.

~~~
NotCamelCase
Good point, thanks for your insights!

------
hhas01
Jesus.

Pardon my French, but seeing that photo makes me fully appreciate two things:
1. Just how incredibly low 737 sits to the ground (obviously a feature from
back in the days when luggage was manually loaded), and 2. How _anyone_ would
think pushing those enormous engines forward like that could be any less
disruptive of its proven design than lengthening the undercarriage to give
them the clearance they so desperately need.

Death of a thousand cuts. Indeed. Hope the monster never flies again.

~~~
amyjess
> how incredibly low 737 sits to the ground (obviously a feature from back in
> the days when luggage was manually loaded)

People, not luggage. Specifically, the 737 was designed to cover short-haul
routes between regional airports that didn't have gates, where people had to
get on the plane by walking up portable steps.

Boeing never expected the 737 to be the low-cost plane of choice between major
aviation hubs.

~~~
alistairSH
Not always portable steps. The 737 has (optional?) steps built into the
chassis.

[https://www.youtube.com/watch?v=oQ-6PDYRj80](https://www.youtube.com/watch?v=oQ-6PDYRj80)

------
konspence
This whole thing looks like a disaster. As other commenters are pointing out,
even if the pilots did the MAX simulators, would they have been trained to
respond to the AOA failure? Unlikely.

It seems like Boeing completely missed serious cases on the testing of the
plane, and is hoping that the "UAT" phase (simulator training) would have
uncovered the issues.

But UAT never underwent the condition of an AOA sensor failing.

------
_Codemonkeyism
Key take away

"There is absolutely no reason to require your pilots to require a MAX
simulator to begin flying the MAX,” the Boeing employee replied. "Once the
engines are started, there is only one difference between NG and MAX
procedurally, and that is that there is no OFF position of the gear handle.
Boeing does not understand what is to be gained by a three-hour simulator
session, when the procedures are essentially the same.”

~~~
Athas
I still think it's interesting to reflect on the mindset that leads to this
conclusion. As far as I have been able to determine (although I'm not in the
aerospace field), the 737 MAX _is_ procedurally identical to the NG, _except
when something breaks_. The failure modes are slightly different, with
potentially lethal results. As a computer scientist, I'm not accustomed to
thinking about functional equivalence in the presence of hardware failure, and
maybe this Boeing employee was not sufficiently drilled on the need to
consider such aspects for aeroplanes. It is of course the fault of Boeing
corporate culture and internal procedures that this can be overlooked.

~~~
salawat
>As a computer scientist, I'm not accustomed to thinking about functional
equivalence in the presence of hardware failure...

How are you not?

I mean, I get it 90% of the time we screw up the programming somehow, but as a
computer scientist, I never ignore the possibility of hardware failure. Memory
goes bad. Devices fail. Networks die. Semiconductors transiently in strange
ways if you don't take the right precautions...

It's the entire impetus behind GIGO. If you shove garbage into a perfectly
working software system; (corrupt data from a malfunctioning input source),
you still get out garbage.

It's why life and safety critical automation is so fundamentally different
from lower stakes programming tasks where "reboot the damn thing" is a viable
option.

If your sensor goes bad, and you're in the air, you can't do squat to fix it.
You have to detect the error, and fail the system gracefully by taking it out
of the loop, informing the operator of the system failure, and most
importantly, _never allow that system to do anything that could jeopardize the
ability of the operator to continue operating_.

This is or at least I thought it was basic Control Systems 101...

~~~
Athas
> How are you not?

I research compilers and type systems. If the RAM dies while the compiler is
running, you rerun the compiler on a new machine. A lot of computer science
abstracts away the notion of hardware failure, because otherwise it becomes
enormously cumbersome to talk about anything. This is fine as long as you
don't actually build real high-reliability systems with the same approach.

~~~
acqq
>> How are you not?

> I research compilers and type systems.

I hope it's obvious that the software you work on is not supposed to be run
during the flight.

The critical software is supposed to do as little as possible, and everything
is expected to be in already compiled (and thoroughly verified) state.

And even for the product of yours, as soon as it is not used only for the
research but as a production compiler which produces a firmware for the plane,
it would have to be proven much more than what is expected from it while it is
just an artifact of a research.

In short, even if you are lucky to just do the research, you should be aware
(and thankful) that the critical software has other expectations. Including
how it responds to failed sensors: different response to the external inputs
is _a fundamentally different_ software, even if you never thought about it
before.

~~~
gknoy
I think his main point was that for most of us, hardware failure is considered
an adequate excuse for why something works -- most of us are not expected to
have software that _continues working_ when things break.

~~~
acqq
The "failures" of the sensors are simply the "less common" inputs. The proper
control software should simply be written for all possible inputs, which
include inputs from faulty sensors, and the result of the processing should
not have some catastrophic consequences.

Compare to the web app that awaits the username, but when the username is not
the "most common" (e.g. contains some new unicode symbols, or is of zero
lengh) it allows catastrophic security failure and intrusion.

------
GenericsMotors
Around the time just before the MAX was grounded, I remember there being lots
of unfounded speculations (here on HN as well!) that Lion Air's and
Ethiopian's pilots were somehow substandard and lacking the training of their
first world counterparts. Meanwhile it was Boeing actively keeping vital
information and training from pilots.

The lesson from this is still not learned, and can see at least one apologist
on this thread repeating this same BS again...it's infuriating.

------
ummonk
On the specific issue of simulator time though, if the simulator behaves
basically the same as a Boeing 737 NG, what is the point of putting them
through the MAX simulator? It does seem like a pointless exercise that
wouldn't have provided the pilots any extra practice (or crucial knowledge of
actual differences like MCAS).

Obviously, now that they're adding checklist practice for emergency scenarios
relevant to the 737 MAX, it makes sense to require simulator practice, but I
don't think that would have previously made a difference.

~~~
inferiorhuman
Here's the ASRS entry I was thinking of:

 _I had my first flight on the Max [to] ZZZ1. We found out we were scheduled
to fly the aircraft on the way to the airport in the limo. We had a little
time [to] review the essentials in the car. Otherwise we would have walked
onto the plane cold.

My post flight evaluation is that we lacked the knowledge to operate the
aircraft in all weather and aircraft states safely. The instrumentation is
completely different - My scan was degraded, slow and labored having had no
experience w/ the new ND (Navigation Display) and ADI (Attitude Director
Indicator) presentations/format or functions (manipulation between the screens
and systems pages were not provided in training materials. If they were, I had
no recollection of that material). _

[https://www.theatlantic.com/notes/2019/03/heres-what-was-
on-...](https://www.theatlantic.com/notes/2019/03/heres-what-was-on-the-
record-about-problems-with-the-737-max/584791/)

~~~
ummonk
Wow, that is pretty damning.

~~~
inferiorhuman
Yeah, I'm curious which airline this was. For obvious reasons ASRS anonymizes
data but this seems like an end-to-end failure and it's pretty disappointing
that the pilot(s) didn't feel comfortable rejecting the plane.

------
Brave-Steak
I'd _really_ be interested in knowing at what level these two employees were
at. How deep does the rot go? Even if the CEO is gone, these people are still
around.

------
vmchale
What a shitshow. The entire thing is graft, and the US government turned a
blind eye because it's deemed an important industry.

~~~
mrtksn
Isn't it also unfaithfulness to capitalism to protect an industry in such a
way? I would have assumed that if someone believes in the mechanics of
capitalism would have let it be.

------
triceratops
Can anyone experienced in aviation ballpark how much retraining a pilot on a
new plane costs? How does it compare to a pilot's annual compensation or other
figures of importance (e.g. annual airline revenue or profit, operating
expenses of a plane etc)? Helping airlines avoid retraining seems like the
driving factor behind all these apparently shortsighted decisions that led to
the MAX but, assuming everything had gone well, what were the actual potential
savings? I'm just trying to understand the stakes.

------
Entalpi
What ever happened to ”safety first”.

~~~
xiphias2
If you ask the Boeing CEO about it, safety was always the top priority.

------
epicgiga
Lion: "we'd like to practice using this plane so we don't crash it". Boeing:
"no". Lion: crashes it. Hundreds die. Boeing: "not our fault, their pilots
were untrained".

How is no one is prison again?

~~~
mattacular
The Boeing CEO exited the company with just 60 million dollars, which is a lot
like being sent to prison.

~~~
Aloha
In fairness to the guy, he came from the Military side of the house, the
program was basically ready for flight by the time he took over the CEO slot.
Basically all of the fatal design decisions were made before he became CEO.

The 737 MAX was a failure of process, not by specific choices made by a leader
- he was fired however for his poor response to the crashes, he committed many
tactical and PR errors, which made the restoration process longer than it
should have been.

If still you want to lay blame at any single persons feet, lay the blame at
the feet of James McNerney, the CEO who ran Boeing while the bulk of the
development of the MAX was done, he's the one who kicked the MAX program off.

~~~
stefan_
What do you mean? The policy set here was literally set at the highest level,
a specific choice - "no training, no certification" was the precise goal for
the 737 MAX. How can you claim that is a failure of process.

~~~
Aloha
I'll argue that making the MAX behave the same as a non MAX 737 is a reachable
and reasonable engineering goal, the process failed because it didnt do it
safely.

Airbus absolutely uses its fly-by-wire system to change the handling
characteristics of its airplanes, to make them fly the same - I see no reason
why Boeing couldn't do the same thing.

~~~
acqq
> I'll argue that making the MAX behave the same as a non MAX 737 is a
> reachable and reasonable engineering goal

And I argue the opposite: it can‘t be made to behave exactly the same as soon
as the failure scenarios are considered.

In computer speak, you just look from the point of view of a “most common”
run, not all the special cases, exceptions etc.

There are other impossibilities too, directly related to the certification
requirements, already documented in the news articles before.

~~~
YawningAngel
The normal failure scenario for safety critical electronics on an aircraft is
that you have an entirely redundant system that takes over. I don't see why
that approach wouldn't have been sufficient here.

~~~
acqq
It is documented in the articles: failure modes have to be trained if they
aren’t the same, and with MCAS as it should be (not as if was and failed
catastrophically twice) they can’t be the same. New devices have to be
recertified. Two sensors can’t be redundant, three would be again not the same
plane. Newer computers won’t be the same plane etc.

Wait to see what the final opinion of European agencies are once the latest
changes are evaluated and you’ll see that it’s not the same plane, even if
Boeing all the time bent over backwards over the dead bodies of others.

------
hurricanetc
They wouldn’t have trained on an MCAS failure so this is irrelevant as far as
the actual crashes are concerned.

It’s just more evidence of Boeing being a corrupt organization.

------
justinclift
This is why Boeing shouldn't be allowed to have anything to do with new Space
contracts (ISS, etc) until this MAX issue is a solved, faint memory. eg for
decades

~~~
tzfld
Space hardware development is heavily supervised, and there are no issues
induced by mass production.

~~~
justinclift
So, exactly like aviation, and it hasn't worked out there. :(

------
tzfld
The way Boeing seems more and more evil as the story is folded out, makes me
think that all these article may be heavily one sided and never hearing
Boeing's own version and motivations.

~~~
cjslep
You can always read the prime source material yourself: Boeing's own internal
emails and chats they released about the 737 MAX.

And do note: those released items are Boeing putting its best foot forward.
And it's a low bar. Imagine the emails and chat transcripts that were not
released.

~~~
wahern
> And do note: those released items are Boeing putting its best foot forward.
> And it's a low bar. Imagine the emails and chat transcripts that were not
> released.

My guess was that the new CEO was trying to get out ahead of developments by
airing the remaining dirty laundry. It makes him and Boeing look sincere and
starts the clock on the public forgetting the bad news. The constant drip of
bad publicity made the previous CEO look like an idiot.

I don't expect Boeing to actually clean up their act, but I bet they're going
to be smarter about things going forward. I doubt there are going to be any
more damning reveals about the 737 other than what can be mined from these
latest disclosures. 777X is another matter, but I bet any revelations will
occur more quickly and cleanly.

------
redis_mlc
To give you an idea how big a tragedy an airliner accident is in Indonesia ...

The average Javanese person I've talked to knows 900 relatives by name.

------
WalterBright
> and that an erroneous MCAS activation would be quickly diagnosed as a
> runaway stabilizer. The 2013 memo casts doubt on the former, and the two MAX
> accident sequences disproved the latter.

This does not mention that an Emergency Airworthiness Directive was sent to
all 737MAX crews after the LA crash explaining exactly how to resolve the
runaway trim issue, which is:

1\. restore normal trim using the column trim switches

2\. cut off the stabilizer trim with the console cutoff switch

The text is:

Boeing Emergency Airworthiness Directive

"Initially, higher control forces may be needed to overcome any stabilizer
nose down trim already applied. Electric stabilizer trim can be used to
neutralize control column pitch forces before moving the STAB TRIM CUTOUT
switches to CUTOUT. Manual stabilizer trim can be used before and after the
STAB TRIM CUTOUT switches are moved to CUTOUT."

[https://theaircurrent.com/wp-
content/uploads/2018/11/B737-MA...](https://theaircurrent.com/wp-
content/uploads/2018/11/B737-MAX-AD-1107.pdf)

Both the LA and EA crews repeatedly successfully countered the runaway trim
with the electric trim switches. The LA crew never took the next step of
cutting off the trim. The EA crew did cutoff the trim, but did not trim to
normal first.

Dealing with runaway trim is a "memory item" for the 737, meaning the pilots
are supposed to know about the cutoff switches that are prominently placed on
the center console in easy reach.


Peter Thiel aims to purchase Gawker's archives - scandox
https://www.washingtonpost.com/news/posteverything/wp/2017/12/12/if-you-miss-gawker-dont-let-peter-thiel-buy-its-archives/?utm_term=.dc77956cc23a
======
scandox
Is this a case where a quick scrape and an IPFS version might make the whole
thing moot? I presume that isn't legal - but is it viable and will it prevent
the loss of the material?

Not that I have a strong moral view either way. Just interested.

~~~
QAPereo
To be fair, if you find yourself taking a strong moral stance opposing Thiel,
you’re probably in the right.


What contextual information would best improve HN discussions understanding? - antpls
Hello! I'm from France. I find myself misinterpreting some of user's comments because of lack of context or introduction to the comments or personal experiences of authors. Comments currently have 4 pieces of information so far beside text : author's username, vote count, date time and, implicitly, parent comment. According to you, what 5th piece of information would help to better understand author's point of view? As an example, each post could also have the continent or country where the author is currently living in (at the time of writing and posting)
======
antpls
To better explain why I suggested country : with that information and the
date, we can for example infer what was the political system at the time of
writing the comment, among many other inferences we could imagine.

~~~
antpls
Another example could be the field in which one declares working in : legal
(no more IANAL required :-)), science, driving, engineering, programming,
cook-chief, investment, etc


Why Healthcare.gov was sunk by "Iceberg-style" delivery - rjmarvin
http://www.sdtimes.com/content/article.aspx?ArticleID=66402&page=2

======
sqqqrly
One of the less useful links on HN.


Hackers went undetected in Citrix’s internal network for six months - marcc
https://techcrunch.com/2019/04/30/citrix-internal-network-breach/
======
benmarks
> Citrix said in a later update on April 4 that the attack was likely a result
> of password spraying, which attackers use to breach accounts by brute-
> forcing from a list of commonly used passwords that aren’t protected with
> two-factor authentication.

How did Citrix not have 2FA in place?

~~~
SCHiM
Haven't read the article, don't know anything about their network. Assuming
they use a Windows domain for their corp infrastructure.

Lower level Windows authentication mechanisms can't be configured for 2FA. If
your active directory domain is functional at all then at the very least your
systems need to be able to talk via SMB and ldap to a domain controller. With
sufficient privileges you're able to execute code on other machines via either
protocol.

You only need an infected machine, not even user credentials, to be able to
perform password spraying or kerberoasting attacks.

~~~
sbr464
Not sure what you meant by lower level mechanisms, but you can protect console
logins and RDP with 2FA: [https://duo.com/docs/rdp](https://duo.com/docs/rdp)

[https://help.duo.com/s/article/1084?language=en_US](https://help.duo.com/s/article/1084?language=en_US)

~~~
w8rbt
net commands, kerberos tickets, etc. You can really only 2FA web interfaces,
VPNs, RDP and interactive console logons. You can 2FA LDAP, but it's a real
pain to do so (I've seen it done).

Just think of any backend protocol that the system uses. The vast majority of
those can't be 2FA'ed. This is not Windows specific either. The same is true
for most all protocols.

This is why most companies buy firewalls and VPNs and only 2FA the VPN. That
meets most compliance requirements and is simple to do. Is it secure? Probably
not, but it checks the box (makes audit happy), so buy compromise insurance
and move on.

~~~
ynniv
You can firewall the backend services and use 2fa to temporarily open them for
a specific workstation.

------
todd3834
I fully assume there are more hacks we don’t hear about that ones we do. Not
only because of cover ups but it can’t be that hard to cover your tracks if
you know what you are doing.

~~~
pandapower2
Its an interesting question. If someone unauthorized was on your network
exfiltrating data how would you know?

~~~
cmroanirgo
Even more interesting is how the FBI knew they'd been infiltrated before they
themselves did? (There's the obvious conspiracy style accusation in that they
were already in there poking around... but that doesn't seem to ring true in
this regard)

~~~
auiya
Same way any criminal investigator uncovers stolen goods.

------
m3nu
Security is hard. On the upside, every breach is a chance to learn for
everyone else. I hope they release more details on how it happened.

Is there any blog or news that summarizes such post-mortem lessons? Could be a
nice project to collect that.

~~~
h2odragon
There's always
[https://catless.ncl.ac.uk/Risks/](https://catless.ncl.ac.uk/Risks/)

~~~
m3nu
Subscribed. Also found [https://securereading.com/category/news/latest-
hacks/](https://securereading.com/category/news/latest-hacks/)

------
robbiet480
Has anyone gotten that kind of call from the FBI and can shed light on how the
process works? Would be fascinating for a outsider and provide a guide on what
next steps look like for those poor souls that receive the call in the future.

~~~
4s2A1tD5
I've been on this call (both sides of it) probably a dozen times by now. Gov
agencies are decent at doing research so it's pretty unlikely that the FBI
just called their 1800 number or whatever.

Most small start ups don't get to the level where anyone that "big" is looking
at them but in the event that something does get flagged the agency will go
find their CEO/CTO/counsel on LinkedIn and either message them there or email
them. I've never seen an actual vulnerability disclosed in email, if it's a
potential legal issue (hello SEC and fintech) they may ask that your lawyer
responds to them in writing but more often it's just "this is Agent XYZ with
ABC. I have information about your company, please call me immediately."

For someone bigger (like Citrix) the company is _hopefully_ big enough to have
a team that is connected to the agencies in someway. Either the agency knows
someone who knows them, or they have a designated Security and Compliance team
that can handle these inquires.

The real problems come when you're in the middle of sizes - too big to have
eyes on every email but too small to have a real security team.

About 5 years I was working for a SaaS company and one of our clients
accidentally discovered a pretty serious hole in another company's product.
This client wasn't overly tech savy and was basically like "hey is this how
this is supposed to work?" when it very much was not... so we killed the API
connection and told the client we'd take care of it. It's about 7pm ET by the
time we figure out what's going on so we call and email the other company but
couldn't find anyone. In the end we got the home phone number of their CTO and
had our CTO call him at around 10pm. He thought it was a prank call but once
our CTO convinced him this was a problem he was able to get their on call eng
to patch it within hours.

Nowadays almost any company involved in security work either has a direct line
to FBI/DHS or has a vendor who does. ie if I'm some medium consumer platform I
probably don't get to talk to the FBI directly, but if I called up Crowdstrike
or any security consulting firm they could do that. In the event that my
medium consumer platform was infiltrated by Fancy Bear (and the government
decided to tell me, sometimes they don't) an FBI agent would email/call the
most likely point of contact for the fastest resolution without causing panic.
Lots of time the damage is already done, two vs four hours on a response won't
make a big difference in the long term so no need to email info@ or anything.

Over the past 6-8 years the corporation on public/private cyber investigations
has definitely changed as red tape has decreased in sharing of info has
increased - even more the last 4ish years since the DNC email hacks. I've had
a clients get a casual "just a heads up, you should check this out" from the
government without no paperwork and no follow up, something that would have
been virtually unheard of 8 years ago.

DHS gets a lot of shit in the media (lots of which is deserved) but they've
done a pretty good job just opening basic lines of communication and training
other agencies that spending 20 minutes looking at a random tip, and following
up if needed, is actually a pretty good use of time.

~~~
robbiet480
Thanks for going to the trouble of creating a new account just to reply,
appreciate it!

------
rmason
If you'd like a full perspective of the Citrix hack three security people from
Detroit discussed it on a recent episode of their show, How they got hacked:

[https://www.youtube.com/watch?v=fMgdrq0xMLk](https://www.youtube.com/watch?v=fMgdrq0xMLk)

~~~
IncRnd
Did you watch that? They mentioned that they don't know any more than is
publicly disclosed how the attack occurred and that they were speculating.
That was literally their first sentence about the attack.

------
axaxs
Having worked with Citrix, I'm shocked. Shocked that they detected it at
all...

~~~
da_chicken
I was going to say the same thing, but it sounds like it was the FBI that
noticed it:

 _> [T]he hackers had “intermittent access” to its internal network from
October 13, 2018 until March 8, 2019, two days after the FBI alerted the
company to the breach._

~~~
lawnchair_larry
This is extremely common. 6 months is not that long, even among competent
companies that have good security. You usually hear about it from the FBI. I
think the FBI forwards tips from agencies like the NSA, but they don’t tend to
give much information.

~~~
axaxs
It may be common, but I'll disagree it's common for companies with "good
security." Password spraying doesn't work with good 2FA, nor sane login
limits. I set off a flag anytime logging in from a new IP, for example.

~~~
dub
2FA and login limits alone aren't likely to stand in the way of state-
sponsored hackers.

Lots of companies still haven't upgraded to zero trust / BeyondCorp AuthN, and
lots of companies don't have reproducible signed build artifacts from CI/CD
with automatic policy enforcement regarding the properties that those build
artifacts must have before they can be deployed.

High-profile companies that think VPNs and networking rules are a security
solution have probably already been hacked and just don't know it yet.

------
empath75
If you have anything of value, I absolutely guarantee you that there are
hackers in your network right now.

One thing that frustrates me more than anything else is people assuming that
their corporate network is safe. Your firewall and your vpc or whatever is a
speed bump at best. You have to assume that you have an attacker on the desk
right next to you, because you will eventually.

~~~
viraptor
That's a really defeatist attitude. There are different levels of "value" and
different levels of protection. Not everything is internet facing. Not
everything is managed like a corp where turnover requires lots of access
changes. Not everything allows you persistence in the network. And not all
access is "access".

I really wish we moved past the "everybody's owned" idea. Your defence should
be proportional to the value you can lose. You can monitor for the rest. And
you can't guarantee the are hackers in my network. (Unless you're saying
you're guilty of breaking in? ;-) )

~~~
hibikir
I don’t think the grandparent says that everyone is owned, but that if your
data is interesting enough, your threat model must include employees that are
willingly exhilarating data, sometimes for nation states. That your first
barriers are therefore assumed to be breached to those attackers.

This of course does not apply if you are not holding on to anything
interesting, but it’s very easy to become interesting at a certain size, or if
you have interesting customers. Still, not everybody.

~~~
mandevil
Your threat exposure is not just your network. It's all of your customers and
all of your vendors as well.

Recall that the Target POS hack back in 2014 happened because someone hacked
the largest refrigeration contractor in western Pennsylvania, then bounced
from there onto the Target Partners Online portal with legitimate credentials,
and then from there in unspecified ways got onto the POS system. Obviously
going from TPO to POS is a failure of Target's network security, but their
network perimeter was much larger than just Target computers.

------
ngcc_hk
You need network sniffer and pattern recognition. Otherwise basically you hope
some of the unusual activities will affect ids/ips (or touch internet).
However if it is normal account you need some sort of intelligence to
recognise and alert.

Not many software can do this.

~~~
6wKZhFkquv
Throwaway, worked at Citrix. The unfortunate thing about this comment is that
they sell Citrix Cloud as having the intelligence to detect anomalies exactly
like this in your network.

~~~
zild3d
Ouch. This page [0] hurts a little bit to read now. Feel free to grab their
free ebook though! You'll learn how advanced analytics can help IT identify
user behaviors, determine risk profiles, and assess and address potential
threats

[0] [https://www.citrix.com/analytics/prevent-security-
breaches.h...](https://www.citrix.com/analytics/prevent-security-
breaches.html)

------
markholmes
This might not be the right place for this, but where should one get started
with security research?

~~~
rando444
I feel like an answer to this would depend largely on your age, background,
and what you are looking to learn.

------
qaq
average is 206 days

~~~
Godel_unicode
According to whom? That's significantly above what fireeye says (71 until
internally discovered):

[https://content.fireeye.com/m-trends](https://content.fireeye.com/m-trends)

~~~
qaq
According to Google search snippet I am totally ready to trust that FireEye
estimate is much more accurate

------
inapis
>Citrix said in a later update on April 4 that the attack was likely a result
of password spraying, which attackers use to breach accounts by brute-forcing
from a list of commonly used passwords that aren’t protected with two-factor
authentication.

Wow. This simply reinforces the fact that humans cannot, and should not, be
trusted with actively maintaining security of a system especially if there
could be significant economic consequences.

Would a password manager help in this? I don't know.

Probably a hardware token which controls all and any access to a system.

*Removed some ambiguous sentences.

~~~
Godel_unicode
I was with you up until the last paragraph, but no. That's not 2fa, that's
switching one factor for another.

People should use a password manager with an rng to generate and store
passwords. IT departments should run password spraying attacks themselves as
well as blacklisting known-compromised passwords. There's really good tooling
for this (likely the same tooling this adversary used!)

Separately from this, people should use hardware 2fa tokens whose weakest link
isn't the cell phone company support.

Edited for clarity.

~~~
u801e
> People should use a password manager with an rng to generate and store
> passwords.

[...]

> Separately from this, people should use hardware 2fa tokens whose weakest
> link isn't the cell phone company support.

What would be better is to support certificate based authentication in
combination with a username and password. Then you have 2FA without having to
share the private key. You can even get 3FA if the private key requires a
passphrase to decrypt it.

Using SMS or email based 2FA is not secure (or is only as secure as the email
or cell phone account as you already pointed out). Using TOTP requires sharing
a secret between the device and the server.

~~~
IncRnd
A passphrase doesn't make it 3FA, since that is an already used factor class,
what you know. 3FA is one from each category of what you know, what you have,
and what you are. Depending on the implementation, what you describe may only
be 1.5 factor auth.

~~~
u801e
I believe we can agree that just using a username/password for authentication
is 1FA (single factor authentication). If we add a one-time token sent via SMS
or email, or generated via TOTP, that's generally considered 2FA (with the
username/password considered what you know and the one time token being what
you have, I believe).

What I proposed was using a client-side TLS certificate in combination with
the username/password for authentication. If the private key corresponding to
that certificate requires a passphrase to decrypt, then it should be more than
2FA. What you know is the username/password, what you have is the private key.
Whether the passphrase for that private key is considered what you know vs
what you are is debatable (since, unlike the username/password or one-time
token, the secret isn't shared by transmitting it over the network).

~~~
IncRnd
Many security people will discount everything that someone says once they see
that person misapply marketing-phrases to describe security technology.

2FA does not become 3FA when adding a new passphrase to a system that already
had a knowledge based entry.

A password for a private key is _never_ considered what you are. You are
severely misusing security terms and will mislead people to believe that a
proposed solution has greater strength than it really possesses.

~~~
u801e
> [You] will mislead people to believe that a proposed solution has greater
> strength than it really possesses.

Then explain how authentication via a username and password validated server
side, a client-side TLS certificate validated during the negotiation of a TLS
connection between the client and server, and a passphrase validated locally
on the client's device is not a better solution compared to typical 2FA
implementations using email, SMS, or TOTP.

~~~
Godel_unicode
Key-logger on the box your soft cert is on. Soft cert is comprised
immediately, fully, and permanently. And you might never know. With email/sms,
at least it's possible for you to realize they're compromised, and with TOTP
the underlying keymat is likely not on the device so the attacker has to
repeatedly win the race.

More importantly, this is also a false dichotomy, as the correct answer here
is hardware protection of the private key, e.g. yubikey.

~~~
u801e
> Key-logger on the box your soft cert is on. Soft cert is comprised
> immediately, fully, and permanently.

That essentially means the entire machine is compromised and logging into any
service would allow the adversary to access them. That would compromise the
email and SMS routes. If they have root access to my phone (or whatever I use
to store the TOTP secret), that would allow them to generate the correct one
time token to log into any service that I use TOTP 2FA with.

> With email/sms, at least it's possible for you to realize they're
> compromised

That's assuming I check carefully and often enough. If someone brute-forces my
password over IMAP, then they could read my messages without me ever knowing.
But I could always check the process list on my computer to determine if a
keylogger is installed.

> and with TOTP the underlying keymat is likely not on the device so the
> attacker has to repeatedly win the race.

It depends on the application. If someone got access to my phone, they could
easily get the TOTP secret out of my GAuth app.

> the correct answer here is hardware protection of the private key, e.g.
> yubikey.

Except that it's not universally supported. It's not going to work with my
email client nor will it work with my IRC client.


Freedom, the US Government, and why Apple are still bad - zdw
http://mjg59.dreamwidth.org/39999.html
======
IBM
Huh. The fact that Apple are the only ones that can sign software that runs on
an iPhone may just allow them to defeat the DoJ in court.

[http://www.bloomberg.com/news/articles/2016-02-24/apple-
fbi-...](http://www.bloomberg.com/news/articles/2016-02-24/apple-fbi-fight-
asks-is-code-protected-as-free-speech)

Apple has indicated that they're going to continue to keep increasing the
security of their products in the future, which may make it impossible to
update firmware to the Secure Enclave (or at least require the user's
permission first), but that's actually a weak measure.

I'm not sure why tech people think that technical means to accomplish zero
knowledge is the holy grail, that will never trump having the law on your
side. Congress could pass legislation (like CALEA for tech companies) that
would require everyone to design their products to make them accessible to law
enforcement any time they want.

~~~
spiralpolitik
At this point you might as well kiss goodbye to the US tech industry as nobody
overseas will by anything that has a US government mandated backdoored.

~~~
IBM
I'm pretty sure if Congress passes legislation mandating it they can influence
plenty of non-American businesses by withholding their ability to do business
in the US.

~~~
throwaway2048
If they don't buy American products? I don't think so.

~~~
IBM
Do any of those businesses want to sell their products to Americans? Maybe
they can sell different SKUs with those capabilities but they'll have to do it
for every market they sell to because the US won't be the only government that
will want backdoors.

~~~
pjc50
Indeed. This already works the other way round: companies selling into China
have to comply with their "great firewall" requirements.

------
thothamon
I agree with all the ideas in the article, but at a bare minimum, Apple should
configure devices so that no firmware update can be installed unless the user
enters their PIN first. This would be an easy move that would make this whole
debate moot. The problem is that Apple only partially protected users from
Apple itself.

~~~
teacup50
There's a much bigger elephant in the room, though:

Updates to the OS and applications are encrypted, completely opaque, signed by
Apple instead of the original developer, can be granted additional
entitlements for arbitrary permissions, and cannot be audited by anyone but
Apple without a jailbreak.

When coupled with push updates, Apple already _has_ a targeted backdoor into
every iPhone anywhere connected the network.

This is a much more difficult problem to solve, as securing against that
threat model requires an diverse ecosystem of 3rd-party audit/review,
software, and tools.

I don't see any way of solving that issue while also maintaining their
stranglehold on the platform via DRM.

~~~
ikeboy
Don't users need to confirm OTA updates?

~~~
saurik
This person is talking about for applications, to which many users have
"automatic updates" turned on; this is one of the places where Android is
fundamentally by design more secure than iOS (though by implementation has
often been weaker :/ see the Master Key family of vulnerabilities).

~~~
ikeboy
Ah. Missed that point.

What's the highest permission an app can have? Wouldn't that be the limit of
the vulnerability here? Also, many permissions require manual granting, e.g.
contacts, camera.

Edit: also, that could be mitigated partly by requiring user approval of any
updates adding permissions.

~~~
saurik
The kinds of permissions that can be granted to an application by way of
entitlements is pretty brutal and go well beyond the permissions that people
tend to think of applications as being able to have: there are entitlements
for things like "can install other applications" and "can obliterate all data
stored on the device". I'm not certain if some of these are blocked to
applications of certain kinds, but I know that a lot of them are available if
Apple chooses to deploy them.

------
upofadown
I don't have anything against Apple retaining control of the firmware on an
Apple phone. It _is_ their closed system after all. It's just that Apple
should not imply that their phones are somehow secure. The FBI thing reminds
us that they are all effectively backdoored by Apple.

------
pjc50
On this topic I have a large unfinished essay:
[https://github.com/pjc50/pjc50.github.io/blob/master/pentagr...](https://github.com/pjc50/pjc50.github.io/blob/master/pentagram-
control.md)

------
bcook
... _is_ still bad? /grammarnazi

~~~
Redoubts
The British tend to use plurals with corporations.

~~~
bcook
Interesting... the plural says to me "all the individuals at Apple", vs the
singular referring to the company as a single, faceless entity.

I wonder if that was intended by the author.

~~~
okonomiyaki3000
Surely not. Just a weird British thing. Like how they write "math" as "maths"
and pronounce it "mafs"...

------
zekevermillion
Whose logo is on your i-thing? Render unto Apple the things that are Apple's,
and keep private what is truly private in the first place.

If you'll forgive the abuse of an old parable...


WWDC 2020: Rosetta 2 on Apple Silicon Macs and Virtualization - miles
https://www.macobserver.com/news/wwdc2020-rosetta-2-apple-silicon-macs-virtualization/
======
sgerenser
I still can’t figure out what the deal will be with Virtualization on Apple
Silicon. If they just mean that you can run the Arm version of a Linux distro
it’s not that useful (At least for devs like me who need to write native
software for Windows and Linux). But if it actually means you can continue to
run x86-64 versions of Windows and Linux at near native speeds, that sounds
great. Although I would wonder how that’s possible.


GuestToGuest Gets $35M - anjalik
https://skift.com/2017/03/10/guesttoguest-travel-startup-funding-this-week/
======
nerdponx
I didn't know Couchsurfing had raised any money. What had their monetization
plan been?


Scrutiny of 'Truthy', a university project that studies trends on Twitter (2014) - diyorgasms
http://thehill.com/policy/technology/221565-five-things-to-know-about-truthy
======
pnathan
> One study highlighted an attack on Sen. Chris Coons (D-Del.) when he was
> first running for his seat in 2010. It found that one social media campaign
> criticizing him for spending taxpayer money on dinners and fashion shows was
> largely the result of 10 Twitter bots.

This is an interesting finding. I think part of the broader question at hand
in our society is that the relationships and communications are becoming
world-readable, with significant consequences for shifting the flow of
discourse.

------
ChuckMcM
I expect a strong correlation with authoritative overreach :-) But more
seriously, the study of information flows to uncover information sharing
networks is not new, that the networks want to protect themselves from being
exposed is also not new. I don't agree with a lot of what Assange says but I
do agree with him that conspiracies hate light, and what is more making it
harder for them to communicate makes it harder for them to be effective.

------
elevenfist
This article talks about a research project studying the virality of
propaganda in social media. The article paints a political picture, the only
paper cited by the article (one of at least 30 published by the project)
discovered that a viral social media attack/campaign against a democratic
senator was the result of about 10 twitter bots. The article then cites the
republican congressman who launched the investigation into this study.

No mention of the FBI, and the NSF provided funding but the project has made
statements to the effect that the NSF is not involved, as listed in the
article.

This title is very misleading...

from the article: ' “Truth about Truthy.” In a series of bullet points, the
department said the project is not a "political watchdog, a government probe
of social media, an attempt to suppress free speech, a way to define
'misinformation,' a partisan political effort, [or] a database tracking hate
speech."

"There is a good dose of irony in a research project that studies the
diffusion of misinformation becoming the target of such a powerful
disinformation machine," the research department wrote. '

~~~
diyorgasms
Yeah I was reading a few articles about this and one mentioned that the FBI
was involved. Turns out it rant this article, and turns out not to have been a
reputable source. However it's too late for me to edit the title, and I can't
find a way to delete the post. Please feel free to flag our downvote.

------
golergka
Good.

I don't know how effective it'll be, but after witnessing first-hand how
successful government-sponsored social media manipulation have been in the
last decade, I'm really glad that western world finally reacts to it and at
least tries to do something about it.

------
__david__
Similarly to the irony mentioned in the article, many of the other comments
here clearly commented without reading the actual article, which has caused
misinformation to spread due to the misleading title.

------
diyorgasms
I apologize, I read the FBI part in another article and I can't seem to
corroborate the claim that the FBI is involved. As such I am editing the
title. Apologies for the sensationalism.

Edit: it would seem I can no longer edit the title.

------
hackuser
That's not the article's title and the article says nothing about the FBI. The
title should be changed.

"NSF funds Indiana University study of social media misinformation" would be
good. The actual title, "Five things to know about 'Truthy'", isn't helpful.

------
bobwaycott
This could use a (2014) in the title.

~~~
dang
So it could. We also changed the title to a representative phrase from the
first sentence.

------
Dowwie
They need to turn their sensors towards their own political parties and
campaign advertising

------
mtgx
And it's called Truthy, too? What - "Ministry of Truth" was trademarked?


Ask HN: Do you keep a journal, and why? - zabana
======
trykondev
I do! I started one in the summer of 2013. I originally started it as a way to
aggregate links & helpful information for my game development endeavors, but
it eventually evolved into more of a recounting of what I did or how I was
feeling on a particular day. I now have daily entries for the entire time
period since I started it, and I consider my journal to be one of my most
treasured possessions. Sometimes I'll get busy and not add entires for a few
days at a time, but I always go back and at least put a one-liner of why I was
too busy to write anything.

I've found it to be a slightly more structured & useful way to essentially
interact with my own brain -- it's a place for me to vent, a place to record
not-so-important but still fun-to-have memories, to keep notes & sort out
plans for the future.

It's a lot of fun to be able to scroll back and say "hey, what did we do for
my birthday three years ago?" :) It's also fun at times like new year's to
flip back through my journal and remind everyone what they listed for a
resolution last year.

------
grep_name
Funny, I just ordered a pocket notebook for the first time in years today. I'm
curious to see what contingent of people on HN still use a physical notebook.
I also use orgmode extensively to keep track of my intentions, media
preferences, notes, and stray ideas, but it doesn't really scratch the same
itch as a physical notebook.

The reason I had to order a physical notebook online is because I wanted a
pocket notebook with no lines, dots, or grids on the pages, which is
surprisingly hard to find. I'm attracted to the non-linear approach to
notebooking, and plan to fill this one with content in a random page-order as
things strike me. Sometimes I just have a cool thought or sentence, or just
want to slowly fill a page with something, and it can really help your
creativity solidify to have a trailing log of your weird random inspirations.
Sometimes I just transcribe lines from a song or book I like, or write down
something someone said. Some pages are just geometric shapes. Rarely, I'll
make a simple "today this happened and this is how I felt about it" page. By
the time you fill it up you have a really organic document that can help you
understand what makes you unique and what you like / care about in your daily
life, without the stress of writing a cohesive or linear work.

~~~
jolmg
I've also used org-mode and tried to make the switch to pocket notebooks[1].
My reason was that org-mode just wasn't as accessible to me. It's not as
practical to use when away from a keyboard as a physical notebook is. However,
writing as much in the physical notebook as I do in org-mode would fill it too
quickly. I also can't be as structured in the physical notebook as I can in
org-mode.

I guess I'm still figuring stuff out. Lately, I've been mostly using the
notebook for taking notes of measurements or prices at the store. Maybe in
reality my reason for trying a physical notebook is that I missed using a
writing utensil.

[1]
[https://www.amazon.com/gp/product/B00J535NN2](https://www.amazon.com/gp/product/B00J535NN2)

------
PragmaticPulp
Yes, but with constraints.

Journaling is an efficient way to elucidate your stray thoughts and feelings.
Writing forces you to distill everything into cohesive paragraphs, which in
turn forces you to put some structured thought around otherwise nebulous
mental energy.

However, journaling is only helpful so long as it's supportive. If you get
stuck in reinforcing thought loops or you find it just amplifies your
frustrations, it's time to change your approach to journaling or find another
outlet for your thoughts.

------
dhagz
I do. It's rather minimal, but I like it. I use a Rhodia Goalbook, which has
numbered pages and a nice month/day view in the front. I can jot down events
on specific days, or I can do more longform stuff on the regular pages. I'm
pretty loose with how I journal, and I don't require myself to do it every
day. I'm a fan of Merlin Mann's "The first page is profound" method to get
myself in the mindset of putting whatever I want in the journal.

------
slipwalker
after reading this thread sometime ago (
[https://news.ycombinator.com/item?id=20244848](https://news.ycombinator.com/item?id=20244848)
) i decided to start one. It's been an on and off endeavour, when i am most
busy, that's when i _should_ be taking those notes, and that's exactly when i
completely forget about it... :/


What Should We Call the Language of Mathematica? - mh_
http://blog.stephenwolfram.com/2013/02/what-should-we-call-the-language-of-mathematica/
======
quink
Without even reading it (and avoiding looking at the comments here), I predict
that he'll advocate 'Wolfram'.

Edit: Yep... <http://imgur.com/KRyN97S.png>

I love the ramp up, first it's just mentioning that the name of the company is
Wolfram... then going underground before coming out, in bold, with Wolfram
Language, then four paragraphs before concluding that "At this point, we
pretty much have to have 'wolfram'—or at least some hint of it—in the name."
and there goes the rest of the article.

Why not just call it Wolfram and be done with it. We know there's a big ego
involved and we can't possibly bear Stephen Wolfram strain himself so much as
to not name the language after himself. Anything else would be inhumane :)

And considering the good he's done with both the quality product Mathematica
and Wolfram Alpha, it's only justified.

~~~
patmcguire
Am I missing something or is that just a surreal picture?

~~~
rtra
I think it's marking the positions of the word 'Wolfram' on the document.

------
scarmig
Wolfram has written a lot of egotistical, boring things before. I have to give
it to him: this time he's outdone himself.

Why not just outsource the naming to a flunky and then take credit for it if
s/he comes up with a good one?

------
h2s
As far as I was aware everybody was already calling this language
"Mathematica".

~~~
onedognight
With projects like Mathics[1], that aim for Language compatibility with
Mathematica, on the horizon it makes sense to want to separate the language
from the implementation.

[1] <http://news.ycombinator.com/item?id=5196551>

~~~
wmf
Seeing this post hit HN just a few days after Mathics gave me a paranoid
feeling. Why now? Is Wolfram feeling the heat and looking for a new trademark
to deny his competitors?

~~~
ics
And Mathematica 9 just came out, so maybe it was _Mathics_ feeling the heat!
Despite the vacuum-like nature of our internal HN-eval-post loop, the rest of
the world isn't standing still. It's actually a little surprising that they're
only talking about this _now_ , given how long Mathematica has been around.

------
zem
good post, but it seemed like he dismissed "tungsten" far too lightly ("And in
the direction of whimsical, there are also words like Tungsten"). it seems
like the best choice to me - it has the "wolfram" association, as well as
fitting in with the general mineral theme while differentiating itself from
the gemstone cluster. also it's easy to pronounce and rolls off the tongue
fairly readily.

~~~
jerf
You beat me by one minute. Tungsten works for me.

<https://en.wikipedia.org/wiki/Tungsten> \- "Tungsten, also known as
wolfram... the free element is remarkable for its robustness, especially the
fact that it has the highest melting point of all the non-alloyed metals and
the second highest of all the elements after carbon. Also remarkable is its
high density of 19.3 times that of water, comparable to that of uranium and
gold, and much higher (about 1.7 times) than that of lead.... It is the
heaviest element known to be used by any living organism."

Not bad.

------
jpdoctor
Egotistica. (ld;o)

------
fusiongyro
I wouldn't have been surprised to learn it were already named Lingua
Mathematica, and I submit that as the best reason to give it that name (and
not some other).

~~~
fusiongyro
I thought the grammar might be wrong there, and it turns out, it is:

[http://english.stackexchange.com/questions/103916/it-were-
ve...](http://english.stackexchange.com/questions/103916/it-were-versus-were-
i-the-proper-subjunctive-for-this-statement)

The corrected versions are: "I wouldn't have been surprised if it were already
named Lingua Mathematica..." or "I wouldn't have been surprised to learn it
was already named Lingua Mathematica..."

------
ballstothewalls
I propose "Stephen"

I have found Mathematica to be super simple learn and use, so by calling it
"Stephen" it shows how friendly and approachable the language is while
maintaining the connection to the founder's ego.

~~~
hvs
I've never heard anyone refer to Stephen Wolfram as "friendly and
approachable," and naming the language based on that reason would be both
amusing and disturbing.

~~~
mauvehaus
I, for one, don't remember Mathematica being especially "friendly and
approachable" either. Maybe for basic stuff, but my introduction to it was a
grad-level computational neuroscience class, and it was the source of a great
deal of misery in my life for a semester.

Maybe for amusement value it /should/ be named Stephen.

~~~
ballstothewalls
This is a common complaint, but I don't understand it. Most of my peers that
didnt like it had no exposure to programming, though.

I have tried to teach myself Ruby and Python before but I have never gotten
really far. I am pretty competent in Mathematica though. The key is getting
used to their documentation center where they have lots of examples.

------
logn
How about "Leibniz" in honor of the mathematician who independently invented
calculus and, compared to Newton, used a superior notation (which he took
great pains to make nice)

Or, Zinbiel.

~~~
quink
I'd agree, but unfortunately "Leibniz" is not, nor does it rhyme with or even
allude to "Wolfram" and is therefore out of the running.

------
dnc
I think Aleph is nice name. There is already Wolfram Alpha, and Aleph, while
it is related to it, is IMO more appropriate for general purpose language.

It sounds to me mystical and abstract/mathematical at the same time as it
reminds me of Blaise Pascal's definition of Nature (or God) as "an infinite
sphere, whose center is everywhere and whose circumference is nowhere"
(because Jorge Luis Borghes has a story with the same name in which he cites
the Pascal's quote :)).

------
mturmon
Wolfram prefers "Wolfram." Telling.

------
georgemcbay
A New Kind of Language

------
zwegner
One of the names he dismissed is actually a pretty good word to use to
describe the blog post: Wolframble.

------
scott_s
Ego.

------
pg
M

~~~
huhtenberg
W

~~~
networked
There is already a programming language called W [1]. It's not related to the
language of Mathematica but you could say has a little bit of relevance to
scientific computing since it was created for the HP-95LX and the HP-200LX
DOS-powered programmable calculators.

I used to have a decent collection of subroutines for it.

[1] <http://www.vttoth.com/CMS/index.php/projects/49>

------
JD557
My December PLT Game's entry was actually called Wolf:
<https://github.com/JD557/Wolf>

Thank god he didn't chose that name, then I would be the one that would need
to think of a new language name.

Anyway, as stated in other comments, Tungsten seems like a nice choice.

------
okku
1\. Mathematica or 2\. Just pick a random cool name, how about: pipe | (they
use pipe in wolfram|alpha)

------
jimmytucson

        > In the years since, the name Mathematica has been widely imitated (think Modelica, for example).

...or Metallica, for example.

Seriously, isn't sticking 'a' (or 'ica') onto the end of a word some kind of
Latin thing?

Britannica!

~~~
StefanKarpinski
The Romans were just copying Stephen Wolfram.

~~~
davrosthedalek
They were pre-covering him. Like all the pre-covers of the songs from Glee....

------
reader5000
To me, "language" implies freely available to use. This is not a critique of
mathematica nor its pricing, but merely when I think of "computer language" I
think of python or c++ or java etc.

------
opminion
Ask Umberto Eco <http://books.google.co.uk/?id=2sDMxqbibS0C>

------
xntrk
FORMATH!

~~~
snogglethorpe
FORGREATJUSTICE!

I'll get me coat.

------
EvanMiller
Why not return the favor and call it "Jobs"?

------
revorad
"Steve" would have been better, as a nod to both men.

------
jonsen
Mathematicall

------
danbmil99
"Wolf"?

------
NonEUCitizen
Wolfie ?

------
calciphus
Mash

~~~
zwegner
Weird, that's the name of a language I worked on at a former job. It was
seriously awesome, it was like a functional version of Python mixed with
assembly, and was much clearer and also faster than C++. Shame that it will
probably never see the light of day (though I have plans for a similar
replacement).


How not to hire an engineer - eddieSullivan
http://www.chickenwingsw.com/scratches/programming/how-not-to-hire-an-engineer

======
briancray
I love the recent focus on hiring people, not job descriptions. I saw another
article written by David Cancel of Performable on the same subject. Technical
skills are important, mind you, but personalities can't be taught.


Slack is Down for Chrome due to CDN issue - tcarn
https://drive.google.com/file/d/0ByaKKJwF1jFsWjdCZ0FFR3lqVU0/view?usp=sharing
======
tcarn
Oddly issue only seems to be affecting Chrome - not Internet Explorer....
can't believe they use a different CDN on different browsers....

~~~
Piskvorrr
Unlikely. Perhaps a HTTPS cert issue that the other browsers can handle?

------
pm90
What? I see it on FF and Safari as well.


Why Instagram turned out to be so successful - shobhitic
http://www.pilanites.com/?p=58

======
shobhitbakliwal
It would not have been able to monetize itself anyway!

~~~
shobhitic
What about premium filters?

------
raghavrawat39
advertisements could have been done too

~~~
shobhitic
Not sure about it

------
shobhitic
It could have given premium filters


Why Skee-Ball Doesn't Change - prismatic
http://www.theatlantic.com/technology/archive/2016/11/why-skee-ball-doesnt-change/509117/?single_page=true
======
dottrap
But something did change, at least where I went.

When I was a kid, I remember the ball effortlessly glided off the launch ramp
into the air for the holes. Sometimes I would roll as hard as I could just to
see how high it would go (into the top net and ricochet down into the scoring
holes).

I recently went back and the launch ramp is like a speed bump now. The balls
no longer smoothly roll and launch into the air. Instead they smack hard into
the bump and lose most of their momentum and barely make it to the holes.

I can't for the life of me figure out how to actually get the ball in the
highest value holes any more. The harder I roll it, the harder is smacks into
the bump and it goes nowhere near the holes. Don't roll that hard, and it
barely makes it over the bump.

I really hate the change and I stopped playing. It is no fun anymore.

~~~
deelowe
I thought it was just me. I guess this is to make it difficult to rack up
points, making it more a game of chance than skill?

------
GnarfGnarf
I was a carny in 1968, handing out prize tickets to Skee-ball players. The
owners disallowed "banking" (bouncing the ball off a side) because it improved
player accuracy too much.

I could not believe how much people were willing to spend to win a prize of
lesser value.

~~~
freditup
I've played skee-ball quite frequently and done well using this banking method
(as taught to me by my grandfather!). But I'm not sure why it's better. Do you
know what makes it easier when banking as compared to rolling the ball
straight?

~~~
wernercd
I assume it's the same reason that basket-ball players bounce shots off the
back-board more often than they go for the swish...

[https://www.wired.com/2011/07/st_cheatsci_basketball/](https://www.wired.com/2011/07/st_cheatsci_basketball/)

[https://hiphopandhoops.wordpress.com/2011/04/14/bank-it-
stud...](https://hiphopandhoops.wordpress.com/2011/04/14/bank-it-study-
reveals-that-using-the-backboard-can-increase-free-throw-shooting-by-20/)

A quick look shows some interesting starting points that goes with my "gut"
about basketball and banking off the backboard.

I don't see any similar articles relating the two (banking Basketballs and
banking Skeet Balls), but I bet there's some sweet spot that you aim for and
get better with practice.

~~~
douche
Shooting basketballs off the glass is something of a lost art, at least
outside of point-blank layup range. Not too many people bother to invest the
effort to learn the geometry to bank shots from each particular spot on the
floor, compared to shooting for the rim, where your aim point and mechanics
are pretty much always the same.

It's rare enough nowadays that it was something of a signature move for
players like Tim Duncan.

------
ebbv
This article is wrong about skee ball being "pure" unlike other carnival games
that are skewed against the customer. It is just as easily and often
manipulated by proprietors just like any other carnival game. The collars
around the holes can be taller and/or narrower, the angle of the ramp can be
manipulated, the weight of the balls, the amount of points for each hole, the
return and price, etc.

It is fun to play once in a while, I'll usually do a few rounds every time I
go to Cedar Point. But it is subject to the same machinations as all the other
carnival games.

~~~
evanelias
I haven't seen evidence that manipulating skee-ball machines is a common
practice by owners, and I've played at a lot of places. Several of the
modifications you mention aren't easy to make. (At least, I can say that's
true when it comes to the official machines made by Skee-Ball Inc -- I usually
avoid the knock-offs so I don't have much experience with those.)

I was saddened to learn that the company was acquired by a rival earlier this
year and relocated production from the Philly suburbs (where it had been over
100 years) to Wisconsin. Strangely, no mention of any of this in the article.

------
xiaoma
It didn't used to have the 100 point holes on the sides. The 50 in the middle
was the highest.


SoureForge starts preventing misleading download button advertisements - chris_wot
https://sourceforge.net/blog/sourceforge-blockthis-initiative-update/

======
chris_wot
Makes me wonder why it took them this long - but brilliant though! Finally
SourceForge is going to fix their UI issues and downright misleading malware
links. This should go some way to restoring their reputation.


Show HN: A generator for random ASCIItabs - rocheio
http://www.asciitabs.com
======
rocheio
I made this site to help myself practice guitar / music theory and learn the
basics of music composition.

It's all written in Go and hosted on an AWS t2.micro instance right now. I
haven't implemented any caching yet so we'll see what happens if it gets any
traction...

Feedback / bugs / feature requests encouraged. Thanks!

~~~
SwellJoe
This is a cool tool...but, as a musician of more than three decades, I would
discourage new players from spending too much time on tablature.

I'd recommend you jump to traditional music notation for your learning
process, ASAP. You're learning new things, anyway, you might as well learn a
tool that is generally much more useful. There's a wealth of music and
exercises in standard notation available to practice with.

I'm not saying this to be preachy or holier-than-though, or to suggest you
can't be a good musician without knowing how to read music. But, standard
notation is technically superior to tabs, on nearly every dimension. It
provides more information in a smaller space, it is transferable to other
instruments and other musicians, it is much faster/easier to read once you are
proficient with it, and it provides visual cues about the things that you're
currently trying to learn that tablature does not (e.g. you can usually
readily discern keys and chords from traditional notation, while it is not at
all obvious from tabs until you've read quite a bit of it and mentally or
physically applied it to the guitar).

I wish I'd learned traditional notation sooner and with more gusto. I would
have been a better musician more quickly if I had.

~~~
rocheio
Thank you for this advice. You make a strong case for standard notation and
I'll keep that in mind as I try and advance as a musician. I've found the
'Masters in Tab' series to offer tabs / standard notation interlaced, so
perhaps that would be a good way to transition from one to the other
([https://www.amazon.com/Spanish-Guitar-Masters-TAB-
Intermedia...](https://www.amazon.com/Spanish-Guitar-Masters-TAB-
Intermediate/dp/0739000772)).

This also makes me think I should focus the website on where ASCIItab excels
over standard notation -- editability as opposed to being a precise blueprint
for how to play complex compositions. I think offering an in-browser editor
would still make this a good tool for novice composers to get a feel for
enhancing / creating music before they advance to standard notation.

------
gnode
Pretty cool, thanks for creating this.

A good addition would be audio output, or MIDI export.

From looking at the tabs, this seems mostly aimed at fingerstyle guitar
playing, rather than playing with a plectrum. Some parameters to the
generation could produce tabs for a wider range of styles.


Mysterious Statistical Law May Finally Have an Explanation - joosters
http://www.wired.com/2014/10/tracy-widom-mysterious-statistical-law/

======
e2e8
Same article submitted with its original url discussed here:
[https://news.ycombinator.com/item?id=8459264](https://news.ycombinator.com/item?id=8459264)

~~~
joosters
Thanks - I did a search before posting but it was based upon the wired
article's click-baity headline...


Evidence of 'risk-taking' brain - tortilla
http://news.bbc.co.uk/2/hi/health/7802751.stm
======
tokenadult
How does this study do by Peter Norvig's checklist?

<http://norvig.com/experiment-design.html>


Does anyone deserve to have a billion dollars? - smacktoward
https://www.nytimes.com/interactive/2019/us/politics/billionaires-democratic-candidates.html
======
milsorgen
No one deserves anything but it's not up to a 3rd party to judge the validity
of what one can generate when playing by the agreed upon rules of the system.
Fix the foundation rather then boarding up the broken windows upstairs.


Plsdr. Python-based software-defined radio (SDR) - auslander
https://arachnoid.com/PLSDR/
======
bobowzki
There are many ways to generate an SSB signal. In particular the Weaver method
is more common in SDR applications than the phase shift method he/she uses.
There're lots of literature online so I don't know why he couldn't find any.


License plate tracking for police set to go nationwide in the USA - novok
https://www.cnet.com/news/license-plate-tracking-for-police-set-to-go-nationwide/
======
Ancalagon
I guess I don't have a lot to say other than: this is pretty disheartening. We
are going further and further down the rabbit hole that is the surveillance
state.


Tumblr: Hashing Your Way to Handling 23,000 Blog Requests per Second - aespinoza
http://highscalability.com/blog/2014/8/4/tumblr-hashing-your-way-to-handling-23000-blog-requests-per.html

======
sargun
So, it looks like they're using BGP to "program" the adjacent router a la
"SDN." I'm curious as to two things:

* Byzantine fault-tolerance: How does this system handle failures when a specific node fails in a way that it fails to withdraw its routes. When a node's haproxy fails, how is BIRD informed of its failure? What if the failure is in some way that internal fault detectors don't see the failure.

* How is the ECMP hashing problem handled? ECMP hashing on most gear is just a plain hash, that means when a route is withdrawn, the rest of the systems see their traffic rebalance. How does this not result in all connections being severed?

~~~
nbm
I'm not sure about how Tumblr might do it, but one can use a combination of
ECMP and ipvs (with a consistent hash) to do the lower-layer L4 load
balancing. This means that even if one of the L4 load balancers go down and
the connections originally going to that L4 load balancer by the switch/router
get moved to another one, the consistent hash to the L7 load balancer handling
the request means the connections will not be reset (except in some
interesting and less-frequent cases).

This two-stage process also allows for good health checking from the much-
simpler Linux ipvs L4 load balancer servers to the more-complicated L7 load
balancer servers.

This was described in this Velocity 2013 talk -
[http://velocityconf.com/velocity2013/public/schedule/detail/...](http://velocityconf.com/velocity2013/public/schedule/detail/28410)

~~~
sargun
Yeah, this is how Facebook does it, and how we did it at Microsoft / Yammer.

------
cagenut
Hi Michael, you wrote a whole post about varnish cache management without
mentioning hit-rates! How effective was all this? How many of that 23K req/s
did origin have to handle?

~~~
mschenck
The cache effectiveness of this is actually quite good, but I'm deliberately
being ambiguous about the ratio.

The reason for my ambiguity is that our cache-hit ratio is actually a result
of our application. This architectural design afforded us the ability to
maintain our (very high) cache-hit ratio, even when we outgrew the total slab
size of a single varnish node.

That ability to maintain the same cache-hit ratio, the motivation for this
effort, is the result of not needing to evict cached content prior to TTL.

So, if you have a low cache-hit ratio due to eviction (and you don't just have
excessive TTLs), then your cache pool is probably too small. If so, then you
might want to give this design a shot - it's an analog to using ketama for
growing memcache beyond a single node.

------
CoffeeDregs
Random note on on scale-out, caching, etc: check out CloudFront's "whole site
delivery". You can set min TTLs to zero on CloudFront, configure your cache
headers correctly and get many of the benefits outlined in the article. See:

       http://www.allthingsdistributed.com/2012/05/cloudfront-dynamic-content-support.html

       http://blogs.gartner.com/lydia_leong/2012/05/14/amazon-cloudfront-gets-whole-site-delivery-and-acceleration/

WARNING: CloudFront will dutifully cache non-2xx responses, so you can get a
long-lived, but very fast, 500 response...

~~~
jgrahamc
Or you could not pay Amazon "per byte fees" and use CloudFlare and get the
same the type of functionality through out caching options and Page Rules.

------
bobjenk
If I was to use Varnish, would that make my need for Redis obsolete - should I
switch to a non-memory based key-value db and use Varnish on top of that?

My current stack: nginx/php-fpm/redis. Nginx and Redis serve me well, but php-
fpm makes my website rather slow with high volumes of traffic, so I believe
the solution for that would be Varnish(?).

~~~
codingjester
so @ tumblr, we're using varnish for a full page cache (we use it for parts of
the API as well for response caching), and invalidate when a blog updates (or
your page can just TTL out).

I definitely agree that I wouldn't use Redis (or memcache for that matter) for
storing entire pages and should be used for more of an object cache. Even
then, we use memcache for "simple" data structures and when we need more
complex data structures, will use Redis.

Redis is great if you need some kind of persistence as well (and it's fairly
tunable), where as memcache and varnish, are completely in memory (varnish 4.0
I believe is introducing persistence). So you kick the process, and that's all
she wrote for your cache until it gets warm again. (Which has its own
challenges).

Varnish also gives you a language called VCL to play around with to maximize
your caching strategies and optimize the way varnish should be storing things.
It's got an easy API to purge content, when you need to purge it and it should
support compression for your pages out of the box without too much tuning.

If you're having issues just speeding up static content, give varnish a whirl.
Spend some time with it, and you won't be disappointed.

I believe you can also look into using nginx as a caching alternative to cache
responses, but I don't have too much experience with that. I've heard it used
with some success though.

~~~
dallasmarlow
varnish has supported disk based caching for quite a long time, it's just that
all the instances at tumblr are configured to only use memory.

------
andremendes
>278 employees. That's a lot of people, I imagined they were way less.

~~~
billmalarky
Keep in mind that not all are engineers. They appear to do sales in house.

~~~
chojeen
Also, some Yahoo employees might have transferred over after the acquisition.

~~~
elliottcarlson
Not really - especially on the tech side.

------
maddalab
Apologies if this is not of interest.

If you found this interesting please checkout the jobs page [1] at Tumblr, we
are constantly looking for new folks. Specifically [2] for positions on the
teams that implemented everything described in the article.

[1] [https://www.tumblr.com/jobs](https://www.tumblr.com/jobs) [2]
[http://boards.greenhouse.io/tumblr/jobs/17886](http://boards.greenhouse.io/tumblr/jobs/17886)


Create and delete branches - nicolasd
https://github.com/blog/1377-create-and-delete-branches
======
artursapek
Suddenly I can clearly see what must be one of Github's long-term goals: to
make git usable end-to-end in the browser, and in a way where that is
preferable for certain situations.

We're going to continue spending more and more of our computer time in the
browser. It's the universal platform.

~~~
Swizec
Git in the browser is _exactly_ what we need to bring git outside programming
circles.

What I've wanted for a while is a site where I could fork somebody's muffin
recipe, fix stuff and so on ... I've even considered building a site like
that, but how many people who cook are also handy enough with a console to
make that viable? My guess is not many.

~~~
artursapek
Hahah, recipes are actually a very interesting application. A program is much
like a recipe, after all. I could see a collaborative site where you build up
a personal cookbook by forking and trying out other peoples' stuff and
contributing your own modifications, etc.

~~~
MartinCron
If you think recipes are like code, you should look at knitting patterns
sometime. It looks like assembly code to me.

~~~
derleth
I have a grandmother who can debug knitting patterns.

The patterns in the books are, apparently, sometimes wrong somehow. She debugs
them when she knits.

I can only imagine _every_ competent knitter can, if only because those books
must sell to a huge number of them.

------
h2s
My gut reaction to this was negative. As much as I like GitHub, I sympathise a
lot with Linus Torvalds' concerns about the way it encourages low-quality pull
requests [1].

However, thinking back through my own experiences with the kind of minor pull
requests I've occasionally made to projects in the past, I can see this being
quite useful. Have you ever actually cloned a big repo like the kernel's? Even
the Node.js repo takes a fair old while. If you're just trying to submit a
correction for a minor typo or omission in the project's README, then this
feature lowers the barrier from minutes to seconds. Hopefully that will be a
net positive for the community.

[1]
[https://github.com/torvalds/linux/pull/17#issuecomment-56599...](https://github.com/torvalds/linux/pull/17#issuecomment-5659933)

~~~
avar
Why do you sympathize with his concerns? As valid as they are for the kernel
they aren't for most of the projects hosted on GitHub. Most people are happy
to get a pull request at all, and when they get one it's usually some trivial
fix they can merge automatically.

------
elliottcarlson
Slight self promotion; here is a CLI tool I made to help clear up local and
remote branches easily - in case it is still useful to people:

<https://github.com/elliottcarlson/git-delete-branch>

------
jonahkagan
I can't believe it. I was looking for this functionality just yesterday and
now here it is.

------
greghinch
Delete a branch in the UI, thank you!

------
purephase
The create is nice, but the delete is absolutely essential. Thanks for
implementing this.

------
davvid
Don't forget to run `git fetch --prune` after someone deletes a remote branch.

------
a1g
You guys are awesome! Thank you so much :)


Yahoo shareholders approve sale to Verizon - artsandsci
https://techcrunch.com/2017/06/08/yahoo-shareholders-approve-sale-to-verizon/
======
techlekh
holy shit.... this was bound to happen

~~~
ganoushoreilly
Right! It's like, hey we have one buyer and one buyer only, should we approve
this or roll the dice?


Ask HN: What do we do with an iPad app built on a recently shutdown Google API? - thegrossman

My coworker and I have spent the last few months building an iPad app on top of the Google News API, which has just yesterday been slated to shutdown: http://code.google.com/apis/newssearch/
We were motivated to create the app based on a lack of quality "hard news" sources (for lack of a better term) on the iPad. There is no shortage of "social" news apps such as Flipboard and Pulse, and there exist a slew of quality RSS readers (Reeder is indispensable to me). But I also crave conventional, un-sexy, non-web2.0 journalism; a simple reporting of the news of the day.
I used to spend obscene chunks of my day parked on CNN.com, click the refresh button incessantly... before the quality of their reporting diminished. And while there are iPad apps for individual news outlets (the NY Times, CNN, etc all have their own apps), the great thing about Google News is the fact that they aggregate content from news outlets around the word, from the Times to Al Jazeera to my tiny local newspaper.
Google News doesn't have a spectacular web interface, especially when accessed on the iPad. We thought we could do better... and purely for our own use (at first), we built an app on top of their API. At this point it's 80% completed; here are some screenshots:
https://s3.amazonaws.com/jackadam_broadsheet/broadsheet.jpg
Now that the API is being shut down, we have an app with no data source. What do we do? On top of spending all that development time seemingly for naught, we love using our app, and don't want to go back to the old way!
So we're making an appeal to the HN community, in search of creative ideas on how to proceed.
We haven't been able to find any great news API alternatives. Yahoo News recently shut down their news API, and the Bing news search is missing a couple critical features. But maybe there are others?
[Also: I'd like to keep the conversation pragmatic and avoid the (perfectly valid) question of whether it's wise to build an app entirely reliant on some third party's good graces.]
======
maresca
_We haven't been able to find any great news API alternatives._

 _avoid the (perfectly valid) question of whether it's wise to build an app
entirely reliant on some third party's good graces._

In my opinion, it isn't wise to build an app entirely reliant on a 3rd party
API. Looking for a new API to migrate to says you haven't learned from the
mistake you made. I've made the same mistake with an attempt at a SMS to
Social Message tunnel on facebook/myspace back in the day. Then facebook made
it a native feature. It was an important lesson to learn.

If I were you guys, I'd stop looking for APIs and start building your own
backend. This way, you can pull in more than one source of data. Also remember
that there are other ways of getting data.

------
NonEUCitizen
Build your own backend so you can declare independence.

~~~
MatthewPhillips
I think building your own backend before you have funding when a simple API is
available is a pretty bad idea. You don't know if your site/app will ever hit
critical mass, why waste the time and money in building an elaborate backend
system when you can develop that down the road when/if you have something
worthwhile on your hands.


If seeing is believing... never point your smartphone's camera at a propeller - benz145
http://www.carrypad.com/2011/07/25/if-seeing-really-is-believing-never-point-your-smartphones-camera-at-an-airplane-propeller/

======
Ronkdar
This isn't a revelation for most people (or maybe I'm biased, a lot of my
friends are pilots), but the second video there is the best demonstration I've
seen so far of why this occurs.

------
ColinWright
From 15 months ago: <http://news.ycombinator.com/item?id=1301295>


Bitcoin’s Technical Flaw - nanzhong
https://medium.com/@nanzhong1/bitcoins-technical-flaw-3569fc0f7c2d
======
A2017U1
This reads like an ad for a closed source messenger only available in a few
countries. Have no idea how its related to bitcoin. Clicks perhaps?

I have plenty of criticisms for bitcoin and cryptocurrencies in general but
some of the claims here are amazingly absurd.

Note to author: I have used a bitcoin wallet with no troubles in China, it has
better uptime in the last decade than Amazon where you worked with
"distributed computing systems", can your messenger app do the same?

> just imagine that the Great Firewall blocks Bitcoin packets for a week,
> creating a Chinese fork and non-Chinese fork. Then it unblocks. All of a
> sudden, the non-Chinese fork would disappear. The Bitcoins that went into
> your wallet six days ago would vanish

The fact that the author doesn't understand how wrong this is despite
apparently studying Bitcoin as an AWS employee back in 2010 is scary.

~~~
nanzhong
I am the author. I'd love to understand your point. Can you give specifics?
Thanks.

~~~
A2017U1
You essentially point to a very large reorganisation and say all the tx's on
the global chain will disappear once the GFW opens up again. All orphaned
transactions go back in the mempool as unconfirmed and will be processed
later.

Simply blocking all global traffic already creates a huge monetary incentive
for miners to sidestep the rules and it's easily achieved with obfuscated
transports.

Such an action would be noticeable and considered hostile. Were they causing
network disruption you'd likely see a hardfork to memory hard algorithms or
clients blocking Chinese IP ranges.

There's certainly attacks they could try but I'm not convinced of the
effectiveness. Miners need the outside world to pay their bills as exchange
for RMB is impossible.

~~~
nanzhong
Yes, you can put the orphaned transactions back in the mempool to be processed
again. But what if the Bitcoins in those transactions are already spent on the
"winning" fork? Does it now mean that the wait for a transaction to be
considered "confirmed" needs to be longer the conventional six blocks and
potentially arbitrarily long?

China already banned non-state sanctioned VPNs in 2018. Anyone circumventing
the Great Firewall via "obfuscated transports" could get into legal trouble by
the Chinese authority. The Chinese government successfully suppressed all
dissidents and millions of protesters in 1989. Underestimate its force at your
own peril.

The whole point of the article is that a centralized entity (the Chinese
government) may be able to attack Bitcoin without controlling any mining
power. A hard fork in response to actions of a centralized entity could
shatter people's confidence in Bitcoin's promise of being decentralized.
Blocking Chinese IP ranges in a 100% reliable way is going to very difficult.
This defense is also rendered useless if someone does use a VPN to propagate
the Chinese fork (perhaps intentionally by a centralized entity).

------
brokenmachine
_> If the Great Firewall blocks Bitcoin packets, the Bitcoin network would be
partitioned and thus fork. Upon unblocking, the shorter Bitcoin chain would be
wiped out. Ignoring complicated attacks, just imagine that the Great Firewall
blocks Bitcoin packets for a week, creating a Chinese fork and non-Chinese
fork. Then it unblocks. All of a sudden, the non-Chinese fork would
disappear._

Is that true? Is it only based on how long the fork's chain are?

~~~
nanzhong
The Bitcoin protocol resolves conflicting forks by choosing the longer one
while dropping the shorter one.