Fexl Version a3 now released - fexl
http://fexl.com/code

======
fexl
The code page now includes some simple instructions for doing a quick download
and test.

I also made a very nice but simple enhancement to the grammar. Now when you
want to do a recursive definition, you must use "==" instead of the normal
"=". That might sound like a pain, but bear with me, it's really great. In
short, the "==" syntax announces to the parser that you _intend_ to apply the
fixpoint operator (Y combinator) to the definition, explicitly making it
recursive.

For example, here is the function which sums the numbers in a list:

      \sum == (\list list 0.0 \head\tail double_add head; sum tail)

Of course, if you don't like saying double_add everywhere, you can easily
abbreviate as follows:

      \add=double_add
      \sum == (\list list 0.0 \head\tail add head; sum tail)

Now here's the great thing about requiring "==" for recursive definitions. It
enables us to do ordinary "procedural" looking code, like in this snippet from
test_procedural in test/try.fxl:

      \show=(\name\value print name; print " = "; print value; nl;)

      \x=3.0
      \y=4.0

      \x=(add x x)
      \y=(mul y x)

      show "x" x; show "y" y;

      \x=(div x; mul y 4.0)
      show "x" x; show "y" y;

      \z=(mul x; mul y; add 1.0 y)
      show "x" x; show "y" y; show "z" z;

      \z=(div z 5.0)
      show "z" z;

In other words, you can do incremental calculations which look like
destructive assignment, but really aren't.

In the old version "a2", a definition like this would have yielded infinite
recursion:

      \x=(add x x)

Now it actually means something useful.


Say Cheese: a snapshot of the massive DDoS attacks coming from IoT cameras - jgrahamc
https://blog.cloudflare.com/say-cheese-a-snapshot-of-the-massive-ddos-attacks-coming-from-iot-cameras/
======
riskable
I've been warning about this kind of thing for _years_ and years. Both
professionally and in my personal life. On forums and anywhere people will
listen...

 _IoT is a security disaster_

I hate to suggest things like this but we may need _legal_ remedies to solve
the problem before it becomes an Internet Zombie Armageddon (IZA). It's _that_
bad.

There's going to be _tens of billions_ of IoT devices installed at businesses
and homes in just a few short years. If they're not receiving regular, timely
security updates the Internet as we know it may just plain collapse from the
sheer weight of all the zombies.

I propose a mandatory "nutrition label" of sorts for IoT device packaging.
Something like this:

        * Updates itself regularly
        * Conforms to NIST security standards
        * Public penetration test results: https://ptr.iot.nist.gov/A2L7P9D23345
        * Shares data with 3rd party: No
        * Administration by vendor: No
        * Requires Internet connection to administer: No
        * Requires 3rd party service to function: No
        * Notifies of intrusion: Yes
        * Logs all access: Yes
        * Encrypts all network traffic: Yes

Something like a publicly-posted penetration test would be incredibly
valuable. Especially if it was performed after each update of the device and
at regular intervals. Even if it was an automated test (which in theory could
be 'gamed') it would still be better than what we have now which is _nothing_!

~~~
pdkl95
As Dan Geer warned[1], embedded devices must not be both _unfixable_ and
_immortal_. Either they have some sort of remove management interface and
receive regular security updates, or they _must_ have a limited lifespan.

Creating embedded systems that won't be updated and live indefinitely is
knowingly creating a hazard and nuisance to society.

[1]
[http://geer.tinho.net/geer.blackhat.6viii14.txt](http://geer.tinho.net/geer.blackhat.6viii14.txt)

~~~
pavel_lishin
> _or they must have a limited lifespan_

This seems like it would give free range to sell shitty devices that are
obsolete the moment they come out of packaging - or worse, that brick
themselves on a timer for supposed security purposes (think HP ink
cartridges.)

~~~
pdkl95
I agree, but the unfixable+immortal combination isn't really an acceptable
situation.

The solution for most devices is to simply keep them off the internet. Being a
host on the internet requires some level of care and maintenance so you don't
become a hazard to others. I doubt most light-bulbs or thermostats are worth
the ongoing expenses of maintaining security updates into the indefinite
future. In theory, traditional goods that last more than a few years should be
more successful on the market than self-destructing devices with dubious
internet features.

------
Animats
Interesting. This set of attacks is coming from real IP addresses. (SYN floods
and single-packet UDP-based attacks use a totally bogus source IP address.)
The device can be talked to and potentially located. Somebody needs to be
finding some of those devices and analyzing them. How are they controlled?
IRC? Some set of known domains or IP addresses? A self-healing mesh network?
All of those have been used, and most modern botnets have a quite
sophisticated control network. This provides both robustness and conceals the
actual controller. In modern botnets, everything is encrypted, so it's hard to
take over the botnet.[1]

Attacks from real IP addresses are potentially blockable upstream. That's only
a temporary fix. The device, if behind a NAT, can request a new IP address and
evade the block. It may do so periodically, just to confuse the issue. At
least you can block a hostile IP at a firewall, so it can't use server
resources. That's what Cloudflare is doing.

On the legal front, it's worth suing makers of vulnerable devices for
negligence. Their EULA will not protect them, because the victim isn't their
customer and isn't a party to the EULA. A few court orders to recall a product
might get the attention of the IoT industry.

[1]
[https://www.damballa.com/downloads/r_pubs/WP_Botnet_Communic...](https://www.damballa.com/downloads/r_pubs/WP_Botnet_Communications_Primer.pdf)

~~~
exhilaration
_On the legal front, it 's worth suing makers of vulnerable devices for
negligence._

Where does one sue the no-name Chinese manufacturers of these devices? I have
a feeling a lawsuit won't get very far in Shenzhen Municipal Court. There's
absolutely no consequences to them building these devices and you cannot
expect a solution from them.

~~~
Animats
Nolo Press: _" In between the manufacturer and the retailer, there may be any
number of wholesalers, suppliers, distributors, or other "middlemen." Each and
all are part of the chain of distribution of the defective product, are
therefore potentially liable, and should be named as defendants in your
defective product lawsuit."_

Cloudflare can start by suing a retailer. That's likely to result in the
retailer pulling all merchandise from the offending vendor, even before the
lawsuit gets very far. (Otherwise, they move to a higher tier of negligence
and damages for knowingly allowing the problem to persist.) That will start to
get the attention of manufacturers.

See this article.[1]

[1] [http://www.techrepublic.com/article/lock-it-down-ddos-
attack...](http://www.techrepublic.com/article/lock-it-down-ddos-attacks-may-
land-you-in-court/)

~~~
pixl97
Lots of this crap gets shipped straight from China by a distributor on Amazon.
Try to sue them and I'm sure they'll just disappear and come back with a
different name

~~~
mynameislegion
Sue Amazon?

------
falcolas
Strangely enough, I think the solution is in devices like OnHub, Google WiFi,
or other third party managed routers (yes, another IOT device).

Why? When attacks like this are first detected, they can be shut down at the
source. Known bad devices can be preemptively locked down behind a firewall.
Traffic to specific IP addresses, or packets which spoof headers to cause
amplification attacks could all be detected and dropped before they even reach
the ISP.

Yes, there will be problems and bad diagnoses, no, I don't want one of these
managing my home network; but it would be perfect for my mother, for my non-
technical friends, and for the average Joe with a subverted IP camera.

~~~
hathawsh
I like this idea a lot. Perhaps every IoT device should publish a profile of
its expected behavior to the router. For example, a wifi-enabled thermostat
might tell the router that it only intends to connect to a particular range of
servers, by DNS name. The router could then set up an automatic firewall rule
that stays in sync with DNS changes. The user should be able to disable that
firewall rule (to overcome technical issues), but most users will never have a
reason to do so.

We could bootstrap this idea by having the router fingerprint IoT devices and
apply matching firewall policies from a database. If only we could install
"apps" on routers, like we do on Android and iOS devices, someone could get
started with this idea right now.

~~~
anchpop
The only issue is that after that point, the device can never connect anywhere
else.

~~~
ceejayoz
So allow the device vendor a way to push a configuration change?

~~~
jrockway
Then the attacker would push that configuration change before DDoSing someone.

~~~
hathawsh
Well, I would hope that any IoT device that accepts remote configuration or
software updates also checks digital signatures before applying changes. If it
doesn't, then I would want the automatic firewall on the router to block all
updates.

------
danielcid
That's a problem that will only get worse. To give an example, last year,
Incapsula recorded ~9,000 IoT cameras attacking them. A few months ago, Sucuri
recorded ~25,000.

CloudFlare is seeing close to 50k. And that's the attackers just using a small
portion of their real power for http floods.

Our report from a few months ago breaking down the types of cameras and
networking doing the attack - very similar to what CloudFlare saw:

[https://blog.sucuri.net/2016/06/large-cctv-botnet-
leveraged-...](https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged-
ddos-attacks.html)

*I work at Sucuri.

------
Mister_Snuggles
I've got a bunch of cheap Wifi cameras and I don't worry about this kind of
thing at all.

All of the cameras live on a separate Wifi network that is unable to connect
to the internet. I use Zoneminder to handle all of the recording, motion
detection, etc. For remote access, I've got a VPN server running. Fortunately,
the cameras I use are perfectly happy to work without being able to talk to
the manufacturer's servers (though they do try!).

In a nutshell, I get almost all of the "benefits" of the cloud service (the
only missing thing is off-site storage, but a fix for that is in the works)
with almost none of the drawbacks.

Of course, this is NOT easy for the average consumer to set up. They expect to
be able to plug the camera in and have things Just Work, which is why we've
got cameras that can open ports on routers/firewalls, register themselves with
cloud services, etc, with minimal effort.

As for IoT in general, my future plans are to use this separate WiFi network
for all IoT-like devices that don't really need to connect to the internet.
The Philips Hue is a good example - it has a bunch of cloud-enabled
functionality, but I don't actually need any of it.

~~~
joblessjunkie
It sounds like you actually worry about his kind of thing a great deal,
considering the amount of effort you put in.

~~~
Mister_Snuggles
Believe it or not, it was a whole bunch of little things that added up to this
state.

When I started with the cameras I was just using the motion detection and
email features that were built into the firmware. I never bothered setting up
the cloud stuff because I didn't need it. Slowly I transitioned to having the
cameras dump images onto a local NAS via FTP. Eventually I started using the
cameras for more than watching the cats, so I needed something with better
motion detection and recording capabilities. I started with 'motion', then
used a fork of 'motion' that seemed to work better, then finally ended up with
ZoneMinder.

On the VPN side, I decided many years ago that I wanted remote access to my
"stuff" \- file shares, etc. This started out with the PPTP VPN built into my
router, which is terrible but sort of worked. The next step was writing a
script that would run SSH and set up a couple dozen tunnels, which is
differently terrible but sort of worked. Eventually I got tired of maintaining
that and ended up with an IPSec VPN using racoon -- split DNS and split
tunneling are truly amazing.

The extra Wifi network actually started as a misguided attempt to prevent
other stuff (Netflix, mainly) from interfering with the cameras. I figured
that putting them on a separate Wifi network would isolate them and give them
dedicated bandwidth. My first attempt involved using a Raspberry Pi as an AP.
It worked, but not very well at all. The second attempt used the Virtual AP
functionality on my router -- it wasn't until I set this up that I understood
that Virtual APs don't quite work this way. Around this time I started to see
articles about cloud-enabled cameras doing bad things and decided that this
setup was worth keeping.

The camera and VPN stuff both went on over the last 5-10 years or so, with the
Wifi changes being something I did within the last year.

You're right that there was a lot of effort, but as you can see it wasn't
really driven by privacy/security until the end. Most of these things were
driven by trying to find better ways to scratch various itches.

The next planned change is to re-address my network so that it doesn't use the
192.168.1.0/24 range that every consumer router seems to use by default. This
way I will be able to use VPN when I'm visiting friends without having to
tether to my cell phone. Like everything else, it's just scratching an itch.

------
jwmullally
A general solution to IoT security would be for all IoT devices to only
communicate to your personally owned home gateway, which would run open-source
drivers for each device to provide the networking/external communication
functionality. The IoT device could even be assigned its own isolated network
link to the router (i.e. sandboxed).

That approach seems like the only logical conclusion for the device owners. I
_hope_ this is how the field will eventually evolve.

While its against the commercial interests of "Internet data" companies (who
might subsidize devices), in the long term regular consumer appliance
manufacturers will implement it _if_ theres enough market pull for it.

~~~
mtgx
That is kind of what Nest's Thread protocol allows IoT devices to do. But
strangely enough, Google is going the opposite direction with its devices,
including coming up with such stupid ideas of controlling your (OnHub) Wi-Fi
router _over the Internet_ through an app.

~~~
jwmullally
Thread is just an IPv6 wireless mesh routing protocol right [1][2]?. On its
own it doesn't solve 2 key security problems:

* Any device can send arbitrary data to somewhere on the internet

* Internally, any devices can send arbitrary data to any other device

\-----------------------

Another less-critical but important usability limitation is the short sighted
nature of how device logic + APIs will evolve long-term for Device-to-Device
communication.

Device-to-Device implies the application protocols are running on the devices
themselves, which can't be bugfixed or upgraded by the user and in the
majority of cases will likely never be updated by the manufacturer after
release.

In [2] they give examples of devices like fridges and thermostats talking to
each other. There's 3 long-term ways I see of handling device-to-device
application APIs:

* Option 1: Raw device-to-device (Short term): How the hell will those APIs be agreed upon and evolve across multiple years and device products? Bluetooth now barely handles relatively simple interop use cases (files, contacts, audio...). Will Thermostat X support Fridge Protocol 8? How will the user handle more advanced use cases?

* Option 2: Vendor managed (Currently the most likely): The devices will talk to the vendor servers which will talk to other vendor servers which will talk to your other devices. Terrible for the user for so many reasons but great for the vendor: its the simplest to implement, keeps protocols secret and locks user into giving that specific vendor endpoint all that juicy data.

* Option 3: User managed (IMHO Preferable): Computer drivers are a much better model for this. Drivers sit over devices to transform the weird device API (fixed target) into a consistent interop API (community driven moving target) that does what people want. This still supports device-to-device: device A -> API call on gateway driver A -> gw driver interop API -> API call gateway driver B -> device B. This is what Option 2 (vendor managed) will actually have to do under the hood anyway. This could be implemented in a simple way e.g. with per-device(type) containers exposing a TCP/UDP port to the device.

I predict Option 3 to become mainstream when the year of the Linux desktop
lands :D

\-----------------

[1]
[https://www.threadgroup.org/portals/0/documents/resources/Th...](https://www.threadgroup.org/portals/0/documents/resources/Thread_Technical_Overview.pdf)

[2] [https://www.infoq.com/articles/thread-protocol-for-home-
auto...](https://www.infoq.com/articles/thread-protocol-for-home-automation)

(Thread is a poorly chosen name for a new computer protocol:P)

------
pbnjay
I have a few cheap chinese ip cameras and I noticed that they have telnet open
(I subsequently rooted them to fix this) and of course have them behind my
home firewall.

However this and other IoT devices got me thinking that maybe it's time to
start an underground device hacking organization solely committed to not only
rooting and reverse engineering these devices but also releasing new firmware
for all of them with open source internals. I'm sure this would have to be
"underground" due to all the legal restrictions around the embedded device
drivers.

Who wants to do this? I wouldn't know where to start besides a .onion site...

~~~
rasz_pl
>not only rooting and reverse engineering these devices but also releasing new
firmware for all of them with open source internals

I had the same idea, except in my version automated scan finds exploitable IOT
devices and updates them with new firmware straight from /dev/null. Problem
SOLVED.

~~~
emp_zealoth
Actually it would be a nice thing to do. Wonder how long would it take
manufacturers of all this crap fix their shit after massive warranty claim
flood came in

------
bhouston
Does Cloudflare still host (edit: proxy) the companies that do DDoS attacks
thus serving to justify the use of Cloudflare services?

~~~
jgrahamc
We don't do hosting.

~~~
bhouston
Quoting Brian Krebs:

> These two services, like most booters, are hidden behind CloudFlare, a
> content distribution service that lets sites obscure their true Internet
> address. In case anyone cares, Lizardstresser’s real Internet address
> currently is 217.71.50.57, at a hosting facility in Bosnia.

[https://krebsonsecurity.com/2014/12/lizard-kids-a-long-
trail...](https://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-
fail/)

~~~
aurbano
So they don't do hosting... What you've quoted just explains how they act as a
layer in front of the actual server

~~~
bhouston
Host/proxy - a non-relevant detail. I misspoke.

Either way, Cloudflare appears to both help booters and then also sells
services to protect you from booters.

~~~
jgrahamc
Cloudflare's CEO spoke about this here: [https://www.youtube.com/watch?v=SWFX-
zEYwN0](https://www.youtube.com/watch?v=SWFX-zEYwN0)

~~~
e40
An almost hour long talk. TL;DR?

~~~
majke
(I work at CF)

I usually agree that spending 1h on a talk may be much. But I found this one
to be really good. Matthew is both entertaining, and revealing some things
that weren't public before.

I'd say the 1h is worth it.

~~~
cryptarch
I think the point of a TL;DR is to allow those short in time to still take
some points away, or to give an overview and entice to consume the entire
thing.

I'd say "Cloudflare recommends Cloudflare" is pretty uninformative while a
TL;DR isn't.

~~~
astrodust
Sometimes there isn't a TL;DR. Like explaining cancer or quantum physics in 30
seconds misses most of the important details.

~~~
cryptarch
Sure, but GP seemed to focus on "I know best how to spend your time", whether
intended or not. Irksome.

------
merb
> Connection: close

well if they would have keep-alive it would be probably even more disastrous.
especially if the botnet would have some intelligence that it would try to
detect the keep alive timeout and send requests exactly in this time frame.

\--

also a lot of these devices are probably built with linux. and here is
something that is probably bad with linux, the lifespan of most linux iot
devices are probably outspanning the official lifecycle of any
distribution/kernel. this may lead to problems that the vendor will just
abadonned it or doesn't care anymore, if he even provided a way to upgrade. on
windows this is probably as bad as well since most vendors will probably not
pay additional fee's after the next windows iot gets out of live.

it's probably time to abadon most os's for these devices and create a new open
source project for these kind of devices, hardended from scratch. this would
at least help with the unmaintained part of the os parts, which would make the
situation at least 1% better. well it won't fix the laziness of certain
vendors.. but it would be a beginning.

------
dx034
The OVH write-up [0] is very interesting combined with this, as they had to
withstand an even bigger attack. Unfortunately, they don't publish as many
statistics. But apparently their attack came mostly from Spain, so different
AS than Cloudflare.

Their plans to upgrade the Ddos mitigation sound very interesting, will be
interesting to see how long it takes until they need the 5Tbps:

>will be replaced by a new technology developed in-house and based on FGPA
(programmable integrated circuits) and codes that have been in development for
the past 18 months. This will allow us to offer up a VAC capable of
withstanding DDoS attacks with peaks up to 5 Tbps without slowing down our
network.

[0] [https://www.ovh.com/us/news/articles/a2367.the-ddos-that-
did...](https://www.ovh.com/us/news/articles/a2367.the-ddos-that-didnt-break-
the-camels-vac)

------
codedokode
Internet is decentralized so there is no authority that could stop DDoS
attack. We need a protocol that would allow a host to require peer or upstream
network to block/allow traffic from specific IPs or subnets. And of course the
denied traffic should not be paid for.

------
supergeek133
Seriously? I get the cameras scenario keeps coming up, but most of these (if
not all) are CCTV systems with a DVR with open remote management that either:

\- Is turned on by default (bad)

\- Is turned on without enabling even the slightest of security by the end
user (stupid but still bad)

\- If a or b aren't true, it has some sort of exploit that the company will
never fix (if they are still in business)

The "rest" of IoT in many cases doesn't have this problem at this scale.
You're either talking about proximal networks with no outside internet
(z-wave, 15.4, etc) or something with secure communication with the home
service (PKI for example).

I'm more and more frustrated with IoT fearmongering, if you want to talk about
CCTV fearmongering? OK. But these aren't Nest cams, or Arlo cams. They're off
the shelf DVR CCTV systems.

------
throw2016
At the moment a ddos is like an open weapon that can be deployed by nearly
anybody to further any agenda; governments, extortionists, and anyone with an
axe to grind.

But putting the burden on all devices that connect to the network is
idealistic. Sure it may work for the 99 billion devices, but what about the 1
billion devices that may not be properly secured. This wack a mole strategy
rarely works.

There must be a way for edge nodes to quickly detect a ddos and shut it down.

We should be extremely wary security hysteria often used by people with
agendas to gain control and lock things down. Only 'approved' devices can
connect to the network or everyone on the internet must surrender their
passport to the nearest authority and be surveiled 24/7 to prempt and prevent
criminal operations.

------
kingosticks
The first attacks were described as only lasting minutes. Is this the
perpetrators stopping? If so, why? In case people start to notice their
'smart' lightbulbs are glowing unusually bright? Otherwise what else stops the
attack?

~~~
tehmaco
Proof of ability to potential customer? Checking that their command and
control software works?

I doubt you'd notice a difference on the device unless you were doing
something network/CPU intensive on it, even then, it'd just seem slow.

~~~
kingosticks
Ah OK that makes sense, thanks. It's handy for companies like Cloudflare to
get a heads up on what's around the corner.

------
boulos
Nobody seemed to mention it, but the large payload query is designed to also
DoS the hell out of old/insecure PHP binaries that will blindly accept (and
keep appending) as many items as you want. (In this case the array $a).

Similar attacks probably work against other CGI parsing things that don't
expect to have hundreds of thousands of qps each with long querystrings.

------
MrMullen
The only way I see IoT security being taken serious is when someone makes a
bot that hunts down insecure IoT devices and permanently disables (bricks)
them. Only then will customers will force manufacturers to take the subject of
security seriously.

------
bogomipz
Does anyone if there's a commonality amongst these IoT security cameras that
is facilitating this? Is it just non-sensible defaults or is something more
like the embedded webserver/SoC?

~~~
c22
I think the biggest shared threat is the ability to punch holes in firewalls
with upnp. That and the fact that they're running ancient unpatched software
stacks.

~~~
bogomipz
Indeed, that gets back to not sane defaults though I suppose. The filet-of-
firewall was particularly troubling, Flash and DNS rebinding is all it takes
if UPnP is running on your router. This worth read if anyone is interested:

[http://www.kb.cert.org/vuls/id/361684](http://www.kb.cert.org/vuls/id/361684)

------
DenisM
How about this for a fix? Just thinking out loud here...

Let's make a protocol that allows a server to specify to its upstream ISP to
cut off all traffic from a particular IP address. The ISP can either soak up
the traffic, or go further up to its own upstream ISP and relay the request,
and so on until the source of the attack is reached. Now it's between an IoT
device owner and his residential ISP, it's up to them to sort it out.

To motivate all ISPs to play along let's make a law for each ISP to be
financially responsible for failure to honor such requests, enough for a
victim to pay for defense plus some %% in penalties.

Sort of an automated "Ceases and Desist" letter, and a failure to abide is an
automatic tort.

Hm?

~~~
zzzcpan
BGP flowspec works kind of like that. Also routers don't have unlimited
capacity to hold everyone's filtering rules, don't forget that.

~~~
DenisM
Your typical large-scale attack has a few thousand IPs at most, so it's
technically doable. All that's missing is the motivation for everyone to
abide. With enough incentive hardware makers might accommodate, too.

------
t3ra
Time probably time to name and shame brands. CP Plus is doing so much
marketing in India with TV slots.

They should probably invest that in doing some research and patching .

------
zzleeper
If things get too bad, can cloudfare pool with google, etc. and just block the
IPs of those affected? (until someone fills a captcha)

~~~
majke
There are researchers in many companies that are actively fighting the
botnets.

Some links:

\- [https://krebsonsecurity.com/2016/10/who-makes-the-iot-
things...](https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-
attack/)

\- [http://blog.malwaremustdie.org/](http://blog.malwaremustdie.org/)

\- [https://www.akamai.com/us/en/our-thinking/information-
securi...](https://www.akamai.com/us/en/our-thinking/information-
security/information-security-research.jsp)

------
farhanhubble
It's high time we start fixing criminal liability for companies building such
poor quality software and hardware.

------
polynomial
Seems somewhat ironic that an article about DDoD is published on CloudFlare's
blog.

~~~
jlgaddis
Ironic? To me, it seems quite fitting that a company who has "protecting you
from DDoS attacks" as one of their major selling points would publish an
article about (recent and relevant) DDoS attacks.

~~~
hueving
Ironic in the sense that they protect companies offering DDoS as a service.

------
gohwell
Their graphs mention Mrps and Krps, any idea what the R stands for?

~~~
kbuck
Requests (i.e. HTTP requests).


Maybe the Low-End iPhone Is Really a Mid-End iPhone - antr
http://allthingsd.com/20130503/maybe-the-low-end-iphone-is-really-a-mid-end-iphone/
======
ttdan
I think this would especially make sense considering the Lifetime value of
these iOS customers. Forcing (the majority) of users to pay for upfront for
the iPhone seems to drive a much better success rate on the iOS app store then
we see with Android where users are just getting the best free phone their
cell phone provide is giving them and may not have interest in apps. IMO,
forcing potential users to recognize the value of the device before purchasing
(charging more upfront), leads to better lifetime value as well as increased
margin upfront.


Mysterious Statistical Law May Finally Have an Explanation - joosters
http://www.wired.com/2014/10/tracy-widom-mysterious-statistical-law/

======
e2e8
Same article submitted with its original url discussed here:
[https://news.ycombinator.com/item?id=8459264](https://news.ycombinator.com/item?id=8459264)

~~~
joosters
Thanks - I did a search before posting but it was based upon the wired
article's click-baity headline...


Funny money: How counterfeiting led to a major overhaul of Canada’s money - CaptainZapp
http://www.theglobeandmail.com/report-on-business/economy/currencies/funny-money-how-counterfeiting-led-to-a-major-overhaul-of-canadas-money/article2258968/singlepage/#articlecontent

======
damnFineYarn
Interesting article.I wonder if most of them could have gotten away if they
weren't that greedy. Making 5 bucks to get some cigarettes would probably
never be uncovered.

Get a new book every few days. Use it to buy groceries. Don't print yourself a
yacht.


Red Hat, Amazon deliver Linux on demand - shayan
http://www.infoworld.com/article/07/11/07/Red-Hat-and-Amazon-deliver-Linux-on-demand_1.html

======
e1ven
I think this is an interesting product, which will help bring EC2 into more
businesses, but it seems to be added cost for little value for most startups.

Perhaps I'm missing the value-add that Red Hat is bringing to the equation-
They're increasing the price over the standard EC2 image.. They're adding a
$19/server flatfee, and then increasing the hourly cost by 10c - 16c/hr..

Granted, they're bringing their name and reputation to the party, and you can
use official RHEL packages, rather than CentOS, but it doesn't seem worth it
for almost any startups.

From: <http://www.redhat.com/solutions/cloud/faq/>

` For Technical questions: Red Hat provides support for end-customer questions
about the services. Technical issues be addressed by Red Hat associates
working in concert with Amazon support and engineering in the event of issues
with the EC2 infrastructure.

For Customer Service issues: All customer service issues (Billing, EC2 Account
Activation, etc.) should be forwarded directly to Amazon via application-
payments@amazon.com. `

It looks like it's basically RHEL branded EC2, and the extra cost is to
support the RH devs and tech support. That Laudable, but probably not enough
of a value-add to be worth it.

------
shayan
Awesome Move by Red Hat and Amazon (by Tim O'Reilly)
[http://radar.oreilly.com/archives/2007/11/redhat_amazon_ec2....](http://radar.oreilly.com/archives/2007/11/redhat_amazon_ec2.html)

------
shayan
My love for Amazon is constantly growing ... I think Amazon's services are
becoming more and more interesting and innovative


Facebook Patent Would Allow Lenders to Determine Credit - beauzero
http://consumerist.com/2015/08/05/facebook-patent-would-allow-lenders-to-determine-creditworthiness-by-looking-at-your-friends/

======
Amorymeltzer
Lenders and credit score companies already have enormous influence and access,
do we really need to open the door to our friends and family? I suppose this
is in line with previous reports of users getting different quotes based on
what browser they use — admittedly your friends are probably a better measure
of your credit — but it's yet another dive into your personal life by
creditors.

I think Facebook's going to find that if your social network can directly
impact your money, people are going to behave differently. I can think of at
least 50 friends I'd cut today under such a scheme. How does that help
Facebook if suddenly its users have fewer connections?


Facebook privacy, Chrome extension for 2-clicks "like" button - hayeah
https://github.com/hayeah/FaceOff

======
indygreg2
For Firefox users, may I recommend ShareMeNot
(<http://sharemenot.cs.washington.edu/>). It also nukes the tracking behavior
of Twitter, LinkedIn, StumbleUpon, Digg, and Google +1.

Or, if you are an Adblock Plus user and want to kill Facebook on non-Facebook
sites, add the following rule:

      ||facebook.*$domain=~facebook.com|~127.0.0.1

~~~
fsaintjacques
Block all social garbage with adblockplus.

[http://www.techairlines.com/2010/12/12/block-social-
buttons-...](http://www.techairlines.com/2010/12/12/block-social-buttons-
widgets/)

------
ErrantX
Better to have posted it _after_ you've actually written it...

~~~
hayeah
MVP. Sorry to disappoint :p

~~~
mtogo
MVP stands for Minimum Viable _Product_. There has to actually be something
for it to be a Product.

~~~
hayeah
Maybe I misused the term minimum "viable" product. But isn't it a standard
practice for lean startups to run something like a potemkin village to test if
there's interest?

I don't see why I shouldn't do the same with an open source project.

------
ck2
Does everyone realize google tops Facebook by millions for cross site
tracking? I mean ad scripts, stats scripts, +1 scripts, etc. etc. etc.

Good luck on blocking google, I cannot even turn off javascript for their
domain because now their search requires it to function.

~~~
antimarketing
Yes, that is a very important point, precisely because people do not want to
focus their attention upon it.

Google has gone from a company that does not do any "evil" to a company that
tries to make a progressive / positive impact and therefore they feel entitled
to collecting more information about their users than they ever thought they
would need at the beginning.

In that sense Google is like the government in the original Austrian
economics. From utility to expansive progressive force. But with what results
this time?

Edit: this reminds me off the "Faceback" app from the movie Good Guys.

------
ryanwhitney
Great Idea. Hoping for a Safari extension soon.

------
alxv
The Disconnect extension for Chrome is pretty good for that:

[https://chrome.google.com/webstore/detail/jeoacafpbcihiomhla...](https://chrome.google.com/webstore/detail/jeoacafpbcihiomhlakheieifhpjdfeo)

------
csulok
i love it when stuff backfires on evil/annoying companies. god i hope everyone
starts implementing the 2 click like buttons.

~~~
hayeah
You would violate terms of agreement. But if it's a Chrome extension, what can
they do?

~~~
Yaggo
Not a violation.

<http://news.ycombinator.com/item?id=2957957>

~~~
hayeah
ah. I stand corrected.


Johnston Sans: The Tube typeface that changed everything - Jaruzel
http://www.bbc.co.uk/news/magazine-35916807
======
jimothyhalpert7
> "Having the serifs on makes things more difficult to read, there's more for
> the eye to take on," says Steel.

[https://en.wikipedia.org/wiki/Serif#Readability_and_legibili...](https://en.wikipedia.org/wiki/Serif#Readability_and_legibility)

> Serifed fonts are widely used for body text because they are considered
> easier to read than sans-serif fonts in print. However, scientific study on
> this topic has been inconclusive.

~~~
red_admiral
I don't think that's a contradiction - I'd guess that sans serif is indeed
much easier to read specifically on _signs_.

When the UK designed its road/motorway signs they conducted all kinds of
usability studies and ended up designing the Transport typeface; just about
any country I've been to in Europe uses sans typefaces for roadsigns and
station/tube/airport signs.

The jury may well still be out for body text in books and other publications.
That's not the problem Johnston was asked to solve though.

~~~
theandrewbailey
The US (and most of North America, it seems) also use sans serif road signs.
[https://en.wikipedia.org/wiki/Highway_Gothic](https://en.wikipedia.org/wiki/Highway_Gothic)


It's Remarkably Easy to Lock a Pilot Out of the Cockpit - jabo
http://www.wired.com/2015/03/remarkably-easy-lock-pilot-cockpit/

======
anigbrowl
Amid all the talk of how the door locking system should or should not be
modified (eg always rotating another person into the cockpit or whatever), I'm
astonished that there's no discussion of having a backup radio system on the
plane. One of the saddest things about this whole incident is the idea of the
senior pilot futilely banging on the door with no way to get in, and no way to
even communicate his predicament to the ground.

Allowing ground takeover of a plane in distress would bring numerous problems
of its own and is probably not feasible to implement in the immediate future,
but adding an extra radio would be technologically trivial, the protocols
would be easy to implement, and it would allow witnesses to (apparent) crimes
of this sort to pass information that might save lives or at least give
investigators a head start instead of a 3 day delay.

~~~
soneil
I think it's not a priority simply because it makes no difference. I mean, if
you had some Disney-style ability to 'go back' and change one thing, it'd be
the 48-hour delay in forming an initial conclusion?

Personally, I think it'd be much more productive to address the culture that
leads to this - it is incredibly difficult for pilots to seek help for mental
health issues. It's "career suicide", and puts them in a position where
medical professionals are their enemy.

Worrying about the particular trivialities of this incident really doesn't get
us anywhere - remembering that any tool put in place to help the "good guy" is
also available for use by the "bad guy". Ensuring "good crew" can rush the
flight deck helps in the case that it's the "bad crew" flying - but also
allows for "bad crew" to rush the flight deck while "good crew" are flying.
You can't win this one.

~~~
Rockslide
> it is incredibly difficult for pilots to seek help for mental health issues.
> It's "career suicide", and puts them in a position where medical
> professionals are their enemy

Exactly. Except that not so much the medical professionals, but the employers
are the enemy. In the meantime, evidence was found in the pilot's appartment
which shows that he was in treatment for a mental illness and was certified
unfit for work on that day by his doctor. And his employer did not have a clue
about all that... (German reference e.g.
[http://www.spiegel.de/panorama/justiz/a-1025956.html](http://www.spiegel.de/panorama/justiz/a-1025956.html)
)


Rumor: Third-party widgets on Facebook? - gibsonf1
http://webware.com/8301-1_109-9709696-2.html?tag=cnetfd.mt
======
far33d
I doubt this. The main differentiator between facebook and myspace is that
facebook is clean and easy to use, vs. the maelstrom of crap that's tossed at
you in myspace.

If they do allow widgets, I'd imagine they'd go the opposite route as myspace:
instead of allowing all widgets and sites except the ones they block, facebook
will probably only allow sites that are approved.


Show HN: Heroku-style deployments for private clouds - wereHamster
http://scrz.io/

======
wereHamster
I very much like Heroku, but due to technical restrictions (no WebSockets) we
have to use our own dedicated servers. And I wanted to have deployment as easy
as Heroku where you just push to a repo and done. Scrz is not quite there yet,
though. It's more like: upload a slug to scrz and done. How you create the
slug is up to you.

It's Heroku-style in the sense that the developers don't need to know on which
servers the apps will be deployed to, and don't need to have ssh access to
those servers. There is also no need to have server addresses stored in the
project source code like it's usually done with capistrano.

We have our CI server configured so it automatically uploads the slug to scrz.
So for us it's really like Heroku, developers push to a git repo and the app
is automatically deployed.

------
tectonic
Is this an open source project?


7 essential AI YouTube channels to keep you updated on AI - lonedune
https://medium.com/p/d545ab401c4
======
lemmonii
While not exactly centered around AI i would also recommend CodeParade
[https://www.youtube.com/channel/UCrv269YwJzuZL3dH5PCgxUw/vid...](https://www.youtube.com/channel/UCrv269YwJzuZL3dH5PCgxUw/videos)


The San Francisco Rent Explosion: Part II - ryan_j_naughton
http://priceonomics.com/the-san-francisco-rent-explosion-part-ii/

======
twic
There is a special hell for people who present tabular data as images.

~~~
calbear81
I sometimes do this in emails because for some reason Gmail hates CUT AND
PASTE from an Excel table into an email and none of the work I did to format
padding, widths, etc. in cells are preserved.

------
djb_hackernews
I live in Boston and have visited SF a few times, definitely not connected to
the SF rental market like I am to Boston. What I am curious about is how new
and how large these 1 bedroom apartments are in SF. My hunch is your dollar
probably goes further in SF than it does in Boston.

A 1 bedroom/1 bathroom in the Back Bay (nicer, while not nicest part of the
city) will run about $2500/mo. But it'll be 100 years old, 400 sq ft,
outdated, no laundry etc.

I wonder how that compares to apartments in SOMA, which appear to be newer
buildings at least.

~~~
icedog
I have a friend paying $2200 for a 230 sqft micro-apartment in SOMA. It's like
having your bed in a tiny kitchen.

~~~
baddox
I'm paying $1800 for a ~250 sq. ft. microstudio in Soma. It's very much like
having my bed in a tiny kitchen, but it's by far the cheapest place within a
15 minute walk of work (FiDi) by myself with somewhat reasonable facilities.

------
nostromo
I'm surprised that the Tenderloin has resisted gentrification for so long. Why
is that neighborhood so impenetrable?

~~~
twic
According to their numbers, rent for a one-bedroom apartment in the Tenderloin
actually _fell_ 12% last year. What's going on there?

~~~
samstave
> __* What 's going on there? __*

ghetto

------
genwin
Do coders (like at Twitter) typically make over $200K/yr? Or do they just eat
ramen every day?

~~~
potatolicious
Some. Most do not. San Francisco's economy relies on young people not
realizing the importance of saving, and the consequent willingness to spend to
the bone.

In some cases the importance of saving is realized, but offset by the
certainty that they're going to cash out huge Any Day Now(tm).

~~~
sixQuarks
Also, I would think they are sharing 2-3 bedrooms with other co-workers.

------
monkey_slap
I'm currently interviewing for a position in SF that will likely be a dream
job, but as a midwesterner, the rent situation terrifies me. Salaries
certainly seem to be inflated because of this, which is fine, but could anyone
offer some insight or precautions about moving to SF at this time?

~~~
cesarbs
I have a friend who recently moved to SF. The tip someone gave him was
basically to not take anything less than $150K for a salary.

~~~
falsestprophet
Only 28 out of 638 startups on AngelList in San Francisco list software
engineering jobs at over $150k.

[https://angel.co/jobs?utm_source=home_gs#find/f!%7B%22locati...](https://angel.co/jobs?utm_source=home_gs#find/f!%7B%22locations%22%3A%5B%22San%20Francisco%22%5D%2C%22types%22%3A%5B%22full-
time%22%5D%2C%22roles%22%3A%5B%22Software%20Engineer%22%5D%2C%22salary%22%3A%7B%22min%22%3A150%2C%22max%22%3A200%7D%7D)

~~~
potatolicious
There's a growing gap between people who know how to negotiate and position
and people who do not. Despite heavy competition for talent it's still easy
for an experienced, capable engineer to make "only" $120K in SF.

If you really have the chops, and know how to stick to your guns and position
yourself in negotiations, companies _are_ willing to break the $150K barrier
(even the $200K barrier). They're simply hoping you're not smart enough to
know how.

This includes not advertising the fact that they're willing to go above that
barrier.

------
throwaway3333
One question I'm not seeing asked is, other than the wealth of interesting
jobs for those in tech, is SF even worth the price of admission as a city? My
experience here so far says "no fucking way".

~~~
genwin
Seems people tend to conflate the price of admission with desirability. There
are plenty of reasons why rents can rise much faster than inflation, other
than desirability increasing.

~~~
muzz
Yes, things like economic opportunity

~~~
genwin
Current biggest reason is likely that mortgage interest rates are being
minimized by gov't so that banks can unload the houses they're holding at
higher prices. When house prices rise, rents tend to as well.

------
cesarbs
This is crazy. I pay $2300 for a large-ish 2 bedroom loft in an expensive
place in the Seattle area (Downtown Bellevue). I hope prices here don't get to
what they are in SF.

~~~
genwin
If you plan to stay in Bellevue long term, buy as soon as possible. The
Seattle area's population is growing rapidly (mostly immigration it seems) and
the cranes aren't keeping up.

~~~
cylinder
I can definitely see the Chinese diaspora becoming obsessed with Seattle in
the same way they have with Vancouver, Sydney, Melbourne, etc ...

~~~
genwin
I stopped short of mentioning that. It's harder for them to get into Vancouver
now, with a change in immigration law there. I think the ones who would've
picked Vancouver now tend to settle on Seattle, willing to pay the same
$million in cash for a house.

------
Shivetya
one reason for sky high rents, with the rules so bent towards renters the
higher rents and deposits filter the majority of those people out.

Its akin to renting homes, rent below 1k and your more than likely to get a
bad renter.


The other kind of “flash” that we used to worry about - tbodt
http://rachelbythebay.com/w/2018/12/26/flash/
======
Dunedan
I was reading an article the other day and it took me a moment to realize that
it was talking about flash as in software and not about flash as in flash
storage. Based on the headline I thought Rachel would write about the same, so
I was quite surprised and amused to read that she was talking about an even
older meaning of flash.

------
sevensor
> I should mention that there have been many variants on this theme. You could
> jam those same fun escape sequences into a mail

This happened to me once as an undergraduate. I was in a lab full of dying
Suns (they were replaced the following semester). It was late at night, late
in the term and the hushed lab was packed with students wrapping up their
projects. I used Pine to open an e-mail from one of my friends at another
university, which turned out to be an animated Christmas tree, complete with
blinking lights and beeping out "We Wish You a Merry Christmas" on the
internal speaker. I killed the terminal window as fast as I could, which
wasn't very fast because the poor Sun was so busy rendering it. Everybody gave
me dirty looks.

~~~
subway
A long long time ago, at a gig I desperately despised, I accidentally ran `cat
MyResume.pdf`, causing a mix of garbage and readable ascii to print to my
xterm. Unfortunately somewhere in that binary garbage were the escape
sequences to turn on printerControlMode in the xterm.

Not long after, my boss shows up at my desk with a sheet of garbage with
snippets of my resume mixed in. Learned an important lesson about accidentally
spewing binary data into an xterm that day...

~~~
sevensor
Ouch!

------
pascoej
This is still possible at CMU. Guaranteed to annoy your friends doing their
homework.

mesg y is the default and write works. However when you try to run wall you
get "-bash: /usr/bin/wall: Permission denied."

------
gaius
I knew about talkd and other shenanigans but I have never heard it called
“getting flashed” before

~~~
rachelbythebay
This is probably the proof that I spent way too much time on IRC over the
years.

------
kacbskjbc
Sometimes I think this happens to me when I accidentally `cat` binary files!
It's particularly interesting that people used to add such strange features as
"automatic file transfer" to their terminals.

~~~
segfaultbuserr
and the solution to this problem is still

> _to suspend the program and hope they could blind-type out a "reset"._

I find myself doing it a few times in a month, sometimes because of
accidentally catting binary garbage, other time it was became a ncurses
program crashed without resetting the terminal back to the normal mode.

Next time I'll remember to call it "getting flashed".

Unfortuately, ESR hasn't curated the Jargon File since 2002, and this word was
not included. AFAIK, Bob Mottram maintains his own fork of Jargon File,
[https://code.freedombone.net/bashrc/TheJargonFile](https://code.freedombone.net/bashrc/TheJargonFile).
I should request him to add the definition into the file.

~~~
segfaultbuserr
_Update:
added[https://code.freedombone.net/bashrc/TheJargonFile/src/652aff...](https://code.freedombone.net/bashrc/TheJargonFile/src/652aff1386b37f5dd333d4d0e88e9090f97244c9/entries/flash.txt)
_

------
mr_toad
You can often find escape sequences embedded in requests in web server log
files, waiting for some unsuspecting user with a vulnerable terminal to read
them.

------
icedchai
Simpler times... I remember when running talkd, fingerd, etc. was the norm.
Not to mention unshadowed password files.

------
jaggederest
"Flash" is also a term of art in manufacturing, where it's the excess material
squeezed out along the mold lines where the molds join.


Entrepreneur Steps iPhone app (promo codes inside) - robsonw

Hey guys! Here are some more promo codes for you to evaluate my new iPhone app! It's a niche app with a todo list with pro tips, ready to help early stage entrepreneurs to start a small business.
EE4X6R4X3H67 366NYAAY3F9K TLE3XKNPXPRP WELPRL6AR7JR NPEXJRLWEYE7 Y7KYW9R6F6W7 XHN9X9YMFLTA HA4RHA7EFPFJ XA7WKYH3RLMM
Here the links: http://ooomf.com/entrepreneursteps
https://itunes.apple.com/app/entrepreneur-steps/id562140478?ls=1&mt=8
Thank you for your comments and valuable feedback! Feel free to contact me anytime through: hello@foggylabs.com
Bob
======
robsonw
Clickable link: [https://itunes.apple.com/app/entrepreneur-
steps/id562140478?...](https://itunes.apple.com/app/entrepreneur-
steps/id562140478?ls=1&mt=8)


Evidence of 'risk-taking' brain - tortilla
http://news.bbc.co.uk/2/hi/health/7802751.stm
======
tokenadult
How does this study do by Peter Norvig's checklist?

<http://norvig.com/experiment-design.html>


Photographer sues Getty Images for $1B for being billed for her own photo (2016) - vezycash
https://www.latimes.com/business/hiltzik/la-fi-hiltzik-getty-copyright-20160729-snap-story.html
======
dredmorbius
Unfortunately the case was thrown out of court:

 _The company said the suit was the result of several misunderstandings, and
that they would “defend ourselves vigorously.” Highsmith had no right to claim
misuse or infringement, said Getty, because she gave up that right when she
donated her images into the public domain._

 _In late October, the courts agreed with Getty, basically destroying
Highsmith’s case._

[https://petapixel.com/2016/11/22/1-billion-getty-images-
laws...](https://petapixel.com/2016/11/22/1-billion-getty-images-lawsuit-ends-
not-bang-whimper/)

~~~
kristofferR
There's nothing unfortunate about it. It would set a very bad precedent if
content in the public domain, freed from copyright law, would still be subject
to arbitrary usage limits.

If you want to release something for free with conditions, use other licences
like Creative Commons instead.

~~~
diffeomorphism
> would still be subject to arbitrary usage limits.

Didn't the ruling achieve the exact opposite? Getty took public domain images
and _added_ arbitrary usage limits on them by (fraudulently) claiming to be
the sole copyright holder.

Taking the images and using them for whatever is fine, taking them and then
trying to forbid anybody else from taking them (the originals, not getty's
copies) is not and unrelated to the license.

~~~
oliwarner
Public domain is special. You free yourself of all ownership which means that
somebody else can pick it up and relicense their distribution of it, including
_saying_ you cannot do things with it. I emphasise "saying" because that's
pretty much all you can do unless they know they're the only entity
distributing it.

The problem here was trying to enforce on something that was obviously non-
exclusive. This mistake happens with all sorts of content available through
multiple channels. Getty should have marked it as such on ingestion.

~~~
cturner
Putting copyright matters aside, there is an issue of misrepresentation.

A case that would be interesting would be one where Getty had represented that
they were acting on behalf of an exclusive copyright holder, and where a third
party had acquiesced to those demands, only to subsequently learn that Getty
was not the rights holder.

This is about basic contract issues. Getty falsely represented themselves to
be X, with the use of aggressive language, leading to a contract being formed
based on invalid premises. If it is a pattern of practice, it starts to look
like a RICO matter.

~~~
oliwarner
I disagree on the fundamental point that this was misrepresentation. They had
every right to enforce a claim, they were just stupid to assume others
wouldn't have their own claims.

~~~
rndgermandude
You're breathing air. I own all the air. Pay me.

Now, if I claimed this seriously, most people would laugh me out of the room.
But some might not and actually pay up. Especially if I threatened to sue them
if they didn't pay up and the "I" was a big, well-known company.

What Getty does is not just muddy grey misrepresentation, it's outright
fraudulent.

\- They say it's copyright infringement in their letter. It is not.

\- They say you need a valid license to use the image. You do not.

\- They demand a license fee. Not a "you used our service to find and download
this public domain work" fee. A license fee.

\- There is no indication whatsoever Getty/Alamy had any role in how the
photograph got onto the website of Highsmith's foundation. Given it's her own
photograph, it's unlikely she used Getty at all. But they do not claim a fee
for using their services anyway, they claim a license fee based on copyright
law, which they cannot.

Highsmith gave up her copyright and cannot demand attribution or damages under
the copyright law, so I agree with the court there. What she instead should
have done is file a criminal complaint and a civil suit regarding the attempt
to defraud her.

~~~
oliwarner
I take an amazing photo and give it to you with all rights to redistribute and
sublicense it as you wish. You choose to redistribute it under a restrictive
license for cash. As far as you know you're the only person selling this
photo.

You see my photo being used in a national advert. The advertiser is not your
customer. Again, you think you're the only person with the right to
redistribute this photo, and infer that your rights to a licensing fee is
being infringed.

As I say, they were _stupid_ to treat this as if they had an exclusive
license, but they had every right to redistribute under their license and ask
for a license fee. Just as the recipient of that demand had the right to tell
them go away.

~~~
rndgermandude
>I take an amazing photo and give it to you with all rights to redistribute
and sublicense it as you wish.

This is not what happened. They never were granted the rights to sublicense
it. It is in the public domain. They can use it, redistribute it, or charge
you if you somehow use their services to do things with it, or even create
derivative works which they then own. But they cannot relicense it or claim
they own it, or represent the owner.

Now, the only thing I would let them bring forward as their argument is if
they themselves were defrauded by somebody claiming ownership of the
photograph. I see no indication that this is what had happened, tho.

~~~
foo101
> This is not what happened. They never were granted the rights to sublicense
> it.

This is not what happened. They were granted the rights to sublicense it.
Placing a piece of work in public domain automatically grants others to do
whatever they want with it including sublicensing it.

~~~
Marazan
They were not granted the exclusive right to sub licence it.

Happy now?

~~~
foo101
The image was put in public domain. No further exclusive rights are required
to sublicense it. You are allowed to pick work from public domain and
sublicense it if you want to.

~~~
bcrosby95
The whole example was about having exclusive rights so anyone that had the
image must be infringing. That presumption is gone once the image is in the
public domain.

The problem isn't that Getty is trying to license an image, the problem is
Getty is contacting people already using a public domain image and trying to
get them to pay them money to use it.

------
kstenerud
As a business model it makes perverse sense:

1\. Use bots to vacuum up as many images as you can online, and claim
ownership.

2\. Use bots to search for infringement and automatically send claim letters
against them.

3\. For any pushback, have a team of lawyers and clerks of various grades to
deal with situations as they escalate. Push or capitulate after sizing up the
opponent.

Most people either just want it over, or don't have the means to fight back
for any length of time. The money you make from such a scheme would far
outweigh the legal costs due to the scale of the automated income.

It would only become problematic if someone else started a rival company, at
which point they'd need to set up an oligopoly agreement to avoid destroying
one another with their bots.

~~~
dkdk8283
Most people are indeed afraid of the law.

Let’s not forget Getty is the reason we no longer have the “View image” button
on image search.

~~~
dredmorbius
Brand D does:
[https://duckduckgo.com/?q=view+image&t=h_&iax=images&ia=imag...](https://duckduckgo.com/?q=view+image&t=h_&iax=images&ia=images)

~~~
saagarjha
Unfortunately DuckDuckGo’s image search is worse than their regular one :(

------
peteretep
> As for the now-infamous collections letter, Getty painted it as an “honest”
> mistake that they addressed as soon as they were notified of the issue by
> Highsmith.

I'd like to see the working on that. How did the mistake happen? How will they
stop it happening again? Are they regularly emailing people threatening emails
about Library of Congress photos?

~~~
madaxe_again
It’s automated.

I ended up mediating a silly situation between Getty and a client about six
years ago.

The client is a manufacturer of consumer goods, mostly kitchenware. They own a
boatload of brands. In 2014 or so they did a mountain of photography to
reposition an existing professional cookware brand for consumers - lots of
lifestyle shots, as well as your usual product shots. They made the images
available in an online, access controlled library for their customers to use
in their marketing.

About six months after this branding pack is made available, we hear from the
client that their customers are getting large payment demands (tens of
thousands, in some cases) from Getty for the images that the client provided.

We approached getty on the client’s behalf, as they were just bewildered and
didn’t know where to even begin.

It took about two months to sort out - we had to repeatedly explain the
situation, while they argued that they owned the images, and had to go through
a lengthy process proving that the client owned the images. Burden of proof
was totally on us, and we were getting nowhere fast. While looking at some of
the supposedly infringing images, we noticed an incredibly faint watermark
embedded in one of them that specified the site that the image had been
rendered on - an unprotected image library on one of the client’s customer’s
sites.

From here, it transpired that Getty had hoovered up everything in that
library, assumed rights, and was selling it. Once we started pushing the tack
that they had broken several laws by accessing a computer system that was not
intended to be available for them to access, and had stolen images from there,
the whole thing, along with all of the images on Getty from that library,
vanished. They never even responded.

Our takeaway here was that Getty use bots to find large collections of unique
high-res images on sites that aren’t explicitly copyrighted, and just take
them, on the odds that they’ll get away with it.

We encouraged the client to sue them for damages, but they were so relieved
that the problem had gone away that they just wanted to move on.

I’d wager this isn’t a unique experience.

~~~
throw_m239339
> I’d wager this isn’t a unique experience.

If your story is true frankly, then it makes Getty Images a bunch of
criminals, period. This is fraud and racketeering, no more, no less.

It's even worse than the "Prenda Law" story where lawyers were making money
threatening people who downloaded porn torrents illegally and forced them to
settle or be sued, because Getty Images does not own the content at first
place, they stole it, literally.

~~~
jandrese
This justice department isn't going to take any action against businesses of
any sort, so Getty is pretty much in the clear on this. They might get in
trouble in the future, but the end result is unlikely to be more than just a
slap on the wrist (a few tens or hundreds of millions in fines) so there isn't
much downside for them.

It's not illegal if a corporation does it after all.

------
dana321
So, they took public domain, added a watermark and claimed copyright?

Its a case of using the wrong license if they didn't want this to happen. They
should have used Creative Commons.

------
dillonmckay
So, in the US, how does one put their IP into the public domain, without dying
and waiting many years?

I had thought this would be a license, not a waiver.

~~~
HeadsUpHigh
My understanding is that public domain means no license, no nothing. So anyone
can sell a copy of it( claiming copyright like in this case is a different
story). A licensed piece is not in the public domain. As the creator you can
dictate the terms of use, and you do so with a license which basically allows
everyone to use the piece( or for certain use-cases depending on the license).
Think of it as a hack: a licensed piece is still copyrighted, and will enter
the public domain when the copyright expires( or the sun blows up, whichever
comes first).

~~~
JJMcJ
Look at the Unlicense: [https://unlicense.org/](https://unlicense.org/)

It releases into the public domain, where possible, and has a paragraph that
comes as close as possible to the public domain in jurisdictions where that
release isn't possible.

I think the idea in the referenced case is that a release to the public domain
means that the author gives up all interest in the work.

Not to really defend Getty Images, which seems to be acting out of line.

------
ArtDev
I hope they make an example of Getty.

------
choonway
the only way for all of this to work out (for all parties involved) is if
there is another superpower nation with nuclear weapons with laws that
punishes these sort of behavior and all the tech talent flows there.

------
Urgo
Mods can we get a [2016] in the title?

------
dredmorbius
2016


APNewsBreak: Evidence of 'God particle' found - brackishlake
http://www.ajc.com/news/nation-world/apnewsbreak-evidence-of-god-1468757.html

======
dotcoma
Is this The Onion?


Python alternatives for PHP functions - weslly
http://www.php2python.com/
======
mambodog
I think in some cases, it would be better to explain why the PHP function was
a bad idea to begin with, rather than letting people bring it's mess over to
Python. For example, Python doesn't need dumb shit like nl2br() [1].

[1] <http://www.php2python.com/wiki/function.nl2br/>

~~~
jiggy2011
What's wrong with nl2br?

Seems to do what it says on the tin.

~~~
madjar
Except the problem most people actually want to solve is not "convert newlines
to
", it is "convert some text to html", and this function may lead to
think that it does that, when it only does a tiny fraction of that. And that's
how injections are born.

~~~
jiggy2011
If you're dealing with ascii plaintext the main significant difference is how
it deals with new lines vs HTML.

The function never purports to do anything other than convert newlines to BR
tags.

~~~
tolmasky
What is being suggested is that the plaintext may contain a random html tag
(Perhaps if supplied by a user, or perhaps because that tag is meant to be
displayed as plaintext as well. The reason doesn't rally matter, "tags" in any
situation are still valid plaintext). By passing text to something that
replaces new lines with br the implication is that it is now safe to drop into
HTML -- however now that tag from before can take effect (particularly bad if
its a script tag). Thus, this function doesn't make sense unless it is at
least also coupled with HTML escaping.

~~~
timdev2
> By passing text to something that replaces new lines with br the implication
> is that it is now safe to drop into HTML

I don't see how that's implied at all. After all, the function is named nl2br,
not html2text.

~~~
tolmasky
It's implied because basically the only context under which
's are used is
when appearing in HTML. If someone is taking text, converting the newlines to

's, then there's a 99.9% chance that the next step is that that text is
going to be placed in a larger HTML document. Unless of course I'm forgetting
some alternative use of
's.

I agree the function does exactly what it says it will do. And if this was a
private function used by something like text2html internally, then maybe it
might be a fine function. However, as a public function, the argument is that
it inspires bad programming practices, since again, it is almost certainly
being used as a primitive form of "sanitation" or "conversion" before
displaying plaintext in a larger HTML document.

I think if you could come up with an example of how this would be used NOT as
an immediate precursor to dropping into HTML I could be convinced otherwise
(and saying it is used after the other tags go through a sanitation process is
a poor response, since it means this function must always follow the other one
-- further proving its uselessness as a standalone function).

~~~
tarabukka
I have never, ever seen nl2br referred to as making anything secure or safe.
It just converts new lines to
s. That's what the manual says it does.
That's what tutorials say it does. That's what the function name very
obviously shows.

I think map() from Python should be removed. Its name implies to a new learner
that it will draw a map, but it actually does nothing to that effect at all!
No, it maps an array to a function. We must rename this dangerous function to
call_a_function_on_every_element_of_an_array - or, even better, remove it from
the language core ENTIRELY. If it was a private function used inside the
runtime, maybe that would be fine, but it's a public part of the API.

~~~
ufo
>I have never, ever seen nl2br referred to as making anything secure or safe.

There is also no mention in the manual that it is _unsafe_! One of the big
problems with PHP is how easy it is to write dangerous code and how the
standard manuals and tutorials often give little explanation to this.

~~~
Firehed
It should be better documented to not directly print user input in HTML
context, and there should be a very obvious best-practices[1] guide for
newbies explaining what to do (and what not to do). But nl2br could only be
dangerous is you misunderstand the function's name, description, sample code,
and everything else on the documentation.

[1] as if they would read it...

------
kijin
Thought for a second that somebody had invented a Python library with
functions that work identically with their PHP counterparts. Like php.js [1].

Turns out it's much more than that. Rather than handing out ready-made
functions to make Python behave like PHP, this site actually teaches you how
to write Python like a real Pythonista. For example, str[2:5] instead of
substr(str, 2, 3). Well done!

[1] <http://phpjs.org/>

~~~
naiquevin
> Rather than handing out ready-made functions to make Python behave like PHP,
> this site actually teaches you how to write Python like a real Pythonista.

Not in my opinion. Here is my personal experience of using this site when I
was just starting with Python. I had landed up there looking for a function
similar to PHP's `array_fill_keys`. And it showed me `dict.fromkeys(keys,
value)`[1] without a slightest of warning that unexpected things will happen
if its passed a mutable data structure such as an empty list as the value.

So IMO, for people coming from PHP background writing some of their first
Python code, it can be helpful at times but not an alternative to learning
Python from a book or some serious online resource. Moreover, the site itself
says that it won't teach you either PHP or Python.[2]

[1]: <http://www.php2python.com/wiki/function.array-fill-keys/> [2]:
<http://www.php2python.com/about/>

~~~
lloeki
Not to mention the idiomatic way might just be one of:

        # before generator expressions (generates intermediate list)
        result = dict([ (k, value) for k in keys ])

        # with generator expressions (lazy iteration)
        result = dict((k, value) for k in keys)

        # with dict comprehension (brand new, probably the fastest)
        result = { k: value for k in keys }

~~~
d0mine

        d = dict.fromkeys(keys, value)

is fine if value is immutable e.g., a string, number.

Your code doesn't solve the mutability problem (each value is the exact same
object. If you modify it for one key; the values are modified for all keys).

For a mutable type you need to create a new value for each key:

        d = {k: [] for k in keys}

~~~
naiquevin
This works fine too,

       dict((k, []) for k in keys)

Although I later realized what I really needed was defaultdict[1]

       d = defaultdict(list)

[1]:
[http://docs.python.org/2/library/collections.html#collection...](http://docs.python.org/2/library/collections.html#collections.defaultdict)

------
jeffisabelle
cool job right there, but just curious, why this is php >> python and not php
<< >> phython ? does that need a lot more work?

~~~
redegg
Because mostly everyone hates PHP. This site serves to show the Python way of
doing things if anyone's interested, or is moving away from PHP.

Edit: I am wrong, not everyone hates PHP.

~~~
dsl
As someone who doesn't know much in the way of Python, it seems odd to me that
many of the examples are blocks of code vs one line replacements for PHP
functions. Is Python just more verbose?

~~~
nikcub
I know both languages well. Python is much more succinct than PHP because of
array literals, list comprehensions, lambda's and better native data types
with ways to navigate them (all the functional methods are there). Only PHP
5.4 with a literal array syntax is beginning to approach some of the things
you can do in Python.

You think PHP is short because you have functions like xmlrpc_encode_request
and the equivalent in Python is 20 lines. What you don't see if that
xmlrpc_encode_request is pages and pages of C code and PHP macro's behind the
scenes. That function should be in a library, not in a programming language,
which is why PHP is more comparable to other web frameworks, not to other
programming languages.

~~~
Firehed
It IS a PHP library - just one written in C rather than in user-land PHP code.
Why is this a problem? The XML-RPC extension isn't even enabled by default.

------
agentultra
I actually found this quite useful today. A rare case where I needed to
translate the Wordpress post decoding function to get the rendered HTML form
from a post into Python. Soon pelican's importer will be better able to
preserve content from Wordpress blogs.

------
tomjakubowski
I was pleasantly surprised to see this wasn't a link to php.py, the somewhat
bizarre port of the PHP standard library to python:

[http://code.google.com/p/php-
py/source/browse/trunk/src/php/...](http://code.google.com/p/php-
py/source/browse/trunk/src/php/php.py)

~~~
gasull
There's also PyHP to use PHP templates with Python:
<https://github.com/bendemott/pyhp>

------
niggler
Just like with PHPJS (an effort to bring PHP standard library to JS) there are
missing implementations:

<http://www.php2python.com/wiki/function.mt-rand/>

------
RossM
I suffer from the 'does everything in PHP because it's comfortable' habit, and
this guide always helps when translating.

------
nodesocket
Very nice and useful.

------
eriksank
PHP may have its flaws, but Python does not seem to be the answer either. By
the way, have they already found a fail-safe way to visually represent the
difference between a space and a tab? Since space is a keyword and a tab too,
how does the programming with invisible differences in whitespace combinations
work? Does it already support all possible unicode whitespace? I guess I
should ask a high priest in Python whitespace calculus ... Why not simplify
the whole thing and use brainfuck characters instead?

~~~
andybak
No one who actually uses Python has any day to day problems with white space.

Actually had one myself yesterday. Took me seconds to fix and was notable only
because it was such a rare event.

~~~
smsm42
I do use python for work from time to time (not every day, but probably every
week) and I still occasionally have problems with whitespace. It's one of the
most annoying things with Python, especially if editing somebody else's code
or working in foreign environment (another machine, etc.) where tools aren't
configured in your standard way.

~~~
andybak
PEP8: "Use 4 spaces per indentation level."

If you're getting code from someone else in your company which doesn't, just
hit them round the head with PEP8 until they learn.

~~~
smsm42
It's easy to write a PEP, it's less easy to configure every editor in
existence to use exactly 4 spaces, especially when normal humans prefer
hitting tab once instead of hitting space 4 times.


Ask HN: Looking for NYC-based technical co-founder for green meta-retail site - octavia

Fully-functional, uniquely positioned green/social impact ecommerce site seeks a co-founder to help oversee site development, co-raise capital, and grow the organization with the existing founder. The existing founder is strong in finance and business development and has founded three Internet startups to date. The perfect co-founder will be strong in technology but also capable of confidently co-pitching the company to potential investors.
This is the perfect opportunity for someone interested in the environment, helping small businesses thrive, and doing something positive for the planet to walk in as a partner and have an immediate impact on the direction of a startup that, with a small round of investment, can be launched in a very short amount of time. The site is real and it's 95% of the way towards being launch-ready in a basic form with plans for continuous improvement. Launch fast, update often.
The company is a for-profit venture, although it's social impact is beneficial, thus it fits the profile of traditional and social capital market investors. It is funded by the founder and friends&family to date.  Co-founder salary will depend on successfully raising a round of capital. Existing founder realizes the importance of the role to be filled by this new co-founder and that will be reflected in the equity package presented to the right person.
If you have a strong business background, but not a technical one, and are looking for such an opportunity, feel free to contact us.  A third co-founder who significantly increases the company's potential is not out of the question.
The company is based in New York City and the code for the site was written by a reputable local contracting firm.
Contact egreen.site1@gmail.com
======
smoody
HNers,

I have personally known the founder of the above startup for a decade and can
vouch for her abilities as both a serial entrepreneur and as a genuinely good
person. This isn't her first time doing this, so she has a track record. And,
although the funding climate is a bit bumpy these days, there are some unique
opportunities specifically in NYC for startups, startups that help local (and
non-local) businesses, and for social impact startups in general.

There are plenty of 'looking for programmer to implement idea as described on
the back of a napkin' situations out there (and I'm not knocking them -- those
can be amazing), but this is different. And there is plenty of room for
innovation as the site evolves over time.

I guess my post raises at least two potential questions:

1) Why am I not stepping in as a co-founder? Answer: I'm busy with my own
startup. Additionally, she's a good friend of mine and I've learned again and
again that working with friends is, in the long term, often high risk with
more downside than upside.

2) Who can vouch for me? No one on this site perhaps, but even if there were,
it's turtles all the way down. :-)

       Scott


48 Hours Left: Crowdfunding Amphetamines Research & Metrics to Date - bmahmood
http://www.perlsteinlab.com/round-table/anatomy-of-a-crowdfund-the-homestretch

======
bmahmood
Ethan Perlstein, as Princeton research fellow is crowdfunding his research on
amphetamines. So far, he's raised raised $18,246 from 258 donors, and needs
$6,754 to complete the fundraising.

This is one of the first hard science crowdfunding campaigns I've seen, and I
believe if successful, can be a testament to the power of crowdfunding to
support scientific research in the future.

The researcher has promised to provide regular updates on his research in an
open-notebook fashion, and the preliminary metrics of the crowdfunding
campaign may represent the diligence with which he is already assessing his
efforts.

We can help support the cause here:
[http://www.rockethub.com/projects/11106-crowdsourcing-
discov...](http://www.rockethub.com/projects/11106-crowdsourcing-discovery)


‘Lede’ vs. ‘Lead’ (2011) - gruseom
http://howardowens.com/lede-vs-lead/
======
scandox
This is great news. One of the most frustrating things on Twitter is everybody
pretending to be a hardbitten journo throwing this term around like they were
on a deadline...or even had a job.

~~~
eli
Though to be fair, actual hardbitten journos use it too. It's the accepted and
most popular formulation of the word even if the myth around its origin is
bogus.

Earliest reference in my OED is 1951 with "lede" listed then as an alternate
spelling of "lead"

~~~
ghaff
Yeah. I know long-time journos who use it and it seems to have become pretty
widely accepted. But, having been at least somewhat involved in journalism for
a long time, I probably had never seen that spelling before 15 years ago or
so. I admit I tend to use it today. Here's a piece that William Safire wrote
in the Times a long way back:

[http://www.nytimes.com/1990/11/18/magazine/on-language-
hed-f...](http://www.nytimes.com/1990/11/18/magazine/on-language-hed-folo-my-
lede-unhed.html)

~~~
gojomo
This article also explains TFA's confusion about not finding examples of
'lede' earlier.

The variant spelling was an old practice, well-known to Safire & the other
"old hands of journalism" mentioned (such as Herb Caen), as inside-jargon –
but its initial practical value came from its distinction from the 'common
spellings' for similar concepts.

But Safire writes about it, in 1990, because just around then it's starting to
sneak out into wider usage. Safire concludes his reporting and wordplay-
around-the-word with:

 _But [lede] has earned its place as a variant spelling, soon to overtake the
original spelling for the beginning of a news article. That 's lexicographic
news, but I have learned never to put the story in the lede._

~~~
duggan
Since this is an article about language usage, can you explain to me what
"TFA" means to you?

I've seen in pop up increasingly on HN, and as far as I've always known it was
a contraction of RTFA (from RTFM) and thus not generally a civil way to refer
to an article.

~~~
ghaff
It's just an in-group way to refer to "the article" or "the article under
discussion." If it bothers you. well, I guess that's your prerogative.

~~~
duggan
No need for the snark, I was just curious as to whether the meaning had
shifted.

------
ender7
Note that journalism has a more overloaded space than most when it comes to
lead vs. lead, so I'm not surprised someone started using "lede" to mean
specifically the one that sounds like LEED. "Leading", a common typographic
term describing the space between lines, is pronounced the other way, like the
element (and is in fact named for it).

~~~
axaxs
But the article states lede was meant to represent the one pronounced 'led',
or did I misinterpret?

------
Doctor_Fegg
Former (UK) magazine editor. I’ve never seen “lede” on any publication I’ve
worked on. “Standfirst”, “intro”, sometimes “lead” (though that was more often
used to describe the positioning of a story on a page). But never “lede”.

It’s possible it was used in UK newspapers, but I doubt that: most newspaper
jargon found its way to magazines eventually (subbing markup was the same, for
example). I suspect it’s purely a modern US newspaper affectation.

~~~
binaryriviera
Exactly. As someone who's only lived in commonwealth countries and consumes a
lot of printed media, I've never come across this term before, it just looks
odd to me.

------
simias
It reminds me of a pet peeve of mine: the way most modern english speakers
pronounce "celtic" with a hard 'k' sound. I'm not a native english speaker so
I always assumed the 'c' would be soft here, because even though as we all
know english pronunciation can be a bit... random at times, pronouncing "ce"
as "ke" seems very out of place. When I first heard it pronounced that way it
surprised me.

After looking more into it, it seems that it's a relatively recent shift in
the language, quoting wikipedia:

> The ⟨c⟩ in the words Celt and Celtic was traditionally soft but since the
> late 19th century the hard pronunciation has also been recognized in
> conscious imitation of the classical Latin pronunciation of Celtae[...]

So it's just some late 19th century hipsters wanting to sound posh by randomly
borrowing a foreign pronunciation rule. There's also the fact that in Gaelic
the C is hard, but that's kind of adding insult to injury because "Celtic" is
not a Celt word.

It falls in the same category as people insisting that the plural of "virus"
is "virii" or that you have two "octopi" (both plurals being technically wrong
IIRC). Given that about 50% of english vocabulary comes from french I guess
these people should start using french grammar everywhere to be consistent.

Or should I say "Given that about 50% of vocabulaire anglais come from
français I imagine that these folks should to start grammaire french
everywhere for to be consistant"? Am I fancy enough yet?

~~~
klodolph
> So it's just some late 19th century hipsters…

That's a pretty caustic way of putting it. English pronunciation is known to
be a mess, and applying "inapplicable" phonetic or morphological rules to
words is just the way it works _everywhere._

Think about it this way: we have a limited budget for language complexity.
It's too much to learn and remember that certain words conjugate according to
certain rules of the word's original language, so instead we say "singular -us
becomes plural -i". And then people judge each other poorly for getting it
wrong.

> Given that about 50% of english vocabulary comes from french I guess these
> people should start using french grammar everywhere to be consistent.

Honestly I don't follow this argument. English already has irregular nouns,
learning a few new ones or switching around the plural forms is not unusual.

~~~
simias
I completely agree with your point but in this case it's not a simplification,
it's yet an other exception. I can understand exceptions or odd pronunciations
disappearing but that's the other way around.

Normally words in english which have "ce" in them are not pronounced "ke".
Similarly words whose singular ends with "~us" do not usually become "~i" in
the plural. You don't say "one bus, two bi", "one fetus, two feti". Cherry-
picking a few words that for some reason should follow latin grammar is more
motivated by sounding "smart" than linguistic necessity IMO.

~~~
klodolph
I can't help but feel that the "bus-bi" example is disingenuous. Surely you
don't think I'm that stupid?

Memorizing which words take Latin plurals and which ones don't is work that
not everyone has done. So we guess that "virus" is a second-declension Latin
noun, which is correct, but now we have to also remember that it's a mass noun
and therefore doesn't take a plural in Latin, but since it's not a mass noun
in English it has to take a plural anyway, and therefore we get "viruses".

And when people get this wrong you can judge them poorly and accuse them of
trying to sound smart.

------
JacobAldridge
I trained as a journalist in Australia in the late 90s/early 00s - although I
went down the radio/tv route rather than print so had only limited exposure
(and a few bylines in nothing of note) to the latter.

I never saw it spelled anything other than "lead" or spelled it myself any
other way. Seeing "lede" later in life made me question what else I may have
wilfilly missed - glad to learn I wasn't a complete moron through that part of
my life.

------
jccc
What in the world are you people talking about?

Hed, dek, lede, graf, etc. were all used in drafts when I was on the morning
daily newspaper in J School specifically because they'd get caught in spell
check.

Still used on occasion now by people in my very semi-journalism job because
absolutely everyone knows what they mean and where those spellings come from.

------
klint
I've never heard the "hot lead' explanation or heard the word pronounced as
"led." If I had to guess, I would guess that deliberate misspellings arose for
the reason I find them useful: they get flagged by spellcheckers, reducing the
risk that placeholder text will be published. I've wondered, though, whether
the funny spellings predated word processors. Lede, graf, hed, etc. would
standout to human copy editors and computer spellcheckers alike. A 1970s
origin for "lede," if correct, would suggest it emerged alongside word
processors.

~~~
carlmr
>I would guess that deliberate misspellings arose for the reason I find them
useful: they get flagged by spellcheckers, reducing the risk that placeholder
text will be published.

I was just thinking, they're using a stringly typed weak type system.

------
CPLX
In professional settings jargon is useful because it eliminates ambiguity.
That's what it's for.

The words lede, hed, dek, and graf (the latter three being curiously absent
from this article) have no other usage except in journalism, they mean exactly
one thing, and there is absolutely no chance that they are words that appear
in the actual story. They are spelled the way they are so you know what they
are when you see them.

When you're in a fast paced business of organizing words and getting them into
public hands on very short deadlines, those are _useful_ attributes.

Things like this generally get adopted because they are useful, not because of
some oddball nostalgia. Ockham's razor suggests that's what has happened here
as well.

~~~
interfixus
And Occam's too.

~~~
CPLX
[https://en.wikipedia.org/wiki/William_of_Ockham](https://en.wikipedia.org/wiki/William_of_Ockham)

------
smnscu
Can I just say that one of the many features of Mac OS that I love is force
click (or triple tap) a word to see its dictionary definition. Especially
useful for a non-native English and German (yes, you can configure multiple
dictionaries which is pretty cool) speaker.

Example: for lede you get the concise definition, even what "bury the lede"
means [https://i.imgur.com/2jcKHkh.png](https://i.imgur.com/2jcKHkh.png)

~~~
pkamb
Related: Lately I've been noticing just how bad/outclassed the Mac spelling
correction dictionary is.

Often I'll type a sentence and a word or two will get the red-underline.
Rather than figure out exactly which letters I transposed, I just right-click
and select the word I meant to type.

But half the time Mac OS can't figure it out. So I copy my misspelling, paste
into Google, and the "Did You Mean...?" feature gets it right every time.

------
jwilk
Language Log post about "lede" and friends:

[http://itre.cis.upenn.edu/~myl/languagelog/archives/004380.h...](http://itre.cis.upenn.edu/~myl/languagelog/archives/004380.html)

------
fao_
Interestingly enough Google Ngram shows high occurence of the word "lede"
(with varying capitalization) in the 1800s with two peaks around 1815 and
1860, and then heavily declining usage.

[https://books.google.com/ngrams/graph?content=lede&case_inse...](https://books.google.com/ngrams/graph?content=lede&case_insensitive=on&year_start=1800&year_end=2000&corpus=15&smoothing=2&share=&direct_url=t4%3B%2Clede%3B%2Cc0%3B%2Cs0%3B%3Blede%3B%2Cc0%3B%3BLede%3B%2Cc0%3B%3BLEDE%3B%2Cc0)

EDIT: Graphing lede,lead shows that 'lead' has always been in the lead with
respect to usage. However, expanding the corpus timeline shows almost
competing usage in 1564!

[https://books.google.com/ngrams/graph?content=lede%2Clead&ca...](https://books.google.com/ngrams/graph?content=lede%2Clead&case_insensitive=on&year_start=1200&year_end=2000&corpus=15&smoothing=2&share=&direct_url=t4%3B%2Clede%3B%2Cc0%3B%2Cs0%3B%3Blede%3B%2Cc0%3B%3BLede%3B%2Cc0%3B.t4%3B%2Clead%3B%2Cc0%3B%2Cs0%3B%3Blead%3B%2Cc0%3B%3BLead%3B%2Cc0)

~~~
mysterypie
Under the graph, google has links to open up excerpts of usage from various
time periods. Looking at a bunch of them, it seems that most of them come from
Lede being a proper name. I also saw a couple occurrences as a verb as in "it
ledes to water".

------
InclinedPlane
I always use this little mnemonic to keep things straight:

Lead rhymes with read, whereas lead rhymes with read.

------
SAI_Peregrinus
I prefer the spelling "lede" simply because it differentiates it from the
element "lead" with symbol "Pb". Heteronyms are irritating and sometimes
confusing. I'd be happy if the "lede" spelling expanded to cover the other
meanings with that pronunciation.

~~~
zik
That still doesn't help with "I put my dog on his lead", "Usain Bolt is in the
lead" or other cases where it's pronounced that way.

~~~
tacostakohashi
Isn't that a leash?

~~~
ClassyJacket
It's a different word for the same thing. I hear leash in American TV shows
but in Australia we call it a lead.

------
ramshorns
I had never heard of “–30–”. Apparently it marks the end of a story.

[https://en.m.wikipedia.org/wiki/%E2%80%9330%E2%80%93](https://en.m.wikipedia.org/wiki/%E2%80%9330%E2%80%93)

~~~
ghaff
It means end of story. i.e. it's what you typed (on the typewriter) to
indicate there weren't any more pages which isn't necessarily obvious with
strict inverted pyramid writing. No one seems too clear on the origins AFAIK
although a leading theory is that it came from a telegraph standard.

~~~
stan_rogers
It's three exes (XXX) written as Arabic numerals (though they were never Roman
numerals to begin with). "XXX" is an easily-identified marker; "30" is just
cargo cult stuff.

~~~
ghaff
That's one of a variety of explanations but no one seems sure of the actual
answer, e.g. [1] In any case, it was widely used for a long time.

[1]
[http://archive.saila.com/journalism/thirty/](http://archive.saila.com/journalism/thirty/)

------
unixhero
Interestingly lede means to lead in Norwegian.

I thought someone had some kind of semantic exploration going on about the
origins of the word lead from it's beautiful origins of Norse Viking wisdom.
But alas, I was mistaken.

------
peatmoss
As an undergraduate journalism major who never worked as a journalist, I also
remember learning that “headline” was often shortened to “head,” but was
spelled “hed.”

At least according to one of my J-school profs who had come from industry. So,
uh, take all that with a grain of salt, even though I believe it to probably
be true.

~~~
peatmoss
An an aside, the context we were given for “hed” and “lede” was that both were
whimsical in-jokes / jargon among old timers, and that if we wanted to appear
skookum, we should at least be aware of this tradition.

------
rhapsodic
Referring to a paragraph as a "graf" goes back at least to the early 90s, I
can attest.

Edit: Wow, I must have a stocker who downvotes everything I post. This was
downvoted within a minute of posting it. It's true, and relevant to the topic
of the post.

~~~
daveguy
1) commenting on downvotes often gets downvotes (not that it should) 2) It's
spelled stalker. A predator stalks its prey. A grocery store employee stocks
the shelves.

~~~
rhapsodic
_1) commenting on downvotes often gets downvotes (not that it should)_

Yeah, I'm aware of that. But I'm willing to burn a few karma points to call
this behavior out. It's really bizarre.

When I first discovered HN, I was really pleased that the tone of the
discussion threads was, unlike just about every other place on the net, really
civil. And it didn't even seem so much that it was the result of the
moderators or the downvoters policing the tone, although that no doubt helped
some. Instead, it simply seemed to be a byproduct of _who the people were_ who
posted here. They seemed to be cerebral people who could have spirited
disagreements with someone, but stick to arguments based on reason and logic,
without resorting to name-calling or personal attacks, as is common in so many
other places. I really dug it.

And I have to say, the tone here is still pretty civil. But there seems to be
a nasty passive-aggressive undercurrent that's developed in the last year or
two where stories get quickly flagged into oblivion, and even the most
innocuous comments, like mine above, get hammered with downvotes for no
apparent reason. I again acknowledge that the Edit I added is a reason that
some choose to downvote, but the original part, can someone offer a theory as
to why that would attract downvotes?

~~~
ghaff
If I had to guess, other than complete randomness, it would be that a few
downvoters didn't recognize the connection to the original topic; i.e. they
didn't recognize that graf was journo jargon like lede is.

------
zitterbewegung
I thought that lede had a different meatning from lead until now... I think it
should be Lead.

------
nonfamous
I think there's a fair case to make that lede is a genuine neologism, though.

------
jrobn
Off-topic...

But this reminded me of English’s:

Lead, led Read, read? (Why not red?)

------
chasing
All language is made up. If someone prefers to use "lede" and it's not causing
communication problems, then people should use it if they want.

~~~
rplst8
It is indeed made up but it's a lot easier to understand when it follows
established rules.

~~~
tialaramex
One of the things that's definitely true (and might be important, or maybe
just a coincidence) about English is that there isn't any agreed authority to
"establish" rules. Plenty of folks would like to set themselves up in that
role, but none have anything resembling a consensus. The situation is so bad
that the last time spelling reform (a trivial matter for such an authority)
was "successful" for English it split the language in two, and all subsequent
attempts have failed utterly.

So, the best we have is the descriptivist rule: whatever it is people actually
do, that's the rule. People actually write "lede" so, fine, it means what they
say it means. Humpty Dumpty was right... at scale.

And that means that when people _change_ what they do, the rule changes and
there's no authority to say otherwise.


Show HN: A stopwatch for the iPhone with the option to disable screen auto-lock - fam

I've always been annoyed at the fact that there's no way to disable screen auto-lock while using the built in stopwatch app so I finally got around to building my own.  Some of you may find this helpful so here you go!
There are some edge cases that I need to fix but for the most part it should be fine for basic needs.
http://thestopwatchapp.com
======
dutchbrit
Simple idea but I can imagine that this could be very handy for people that
use the stopwatch functionality a lot!