Bees can link symbols to numbers, study finds - <AUTHOR> https://phys.org/news/2019-06-bees-link.html <comment><USER2> >> Researchers have trained honeybees to match a character to a specific quantity, revealing they are able to learn that a symbol represents a numerical amount.

I don't know if this is very convincing. From what I see in the images shown in the article, the "specific quantities" are represented by different arrangements of various symbols- squares, stars etc.

The article doesn't say whether these arrangements were randomised in each image.

For instance - the number "3" could be _always_ associated with the same arrangement of any symbol. Say, a triangle formed by three identical symbol. In that case it would be impossible to know whether the bees learned to count the shapes or just identify their arrangment. Learning to identify a triangle doesn't say anything about the ability to identify quantities.

The fact that neither of the two groups trained on the two different tasks (character-to-quantity and quantity-to-character) could generalise their learning to the opposite task also doesn't bode well. It is exactly what you would expect to see if the setup for each task had some other, uncontrolled for, variable that the bees "overfitted" to, rather than learning what is theorised they did learn.

<comment><USER3> _> The article doesn't say whether these arrangements were randomised in each image._

It is a popular science retelling a story. In the original scientific article we can read

 _We used sets of stimuli with controlled surface area (set 1) and equal element size area (set 2) with achromatic properties (black elements on white background; electronic supplementary material, figure S1). The choice of stimuli for each trial was pseudo-randomized with regards to set (1 or 2), shape and arrangement of elements. Thus, bees were trained on both set 1 and set 2._

 _In Group 1, this test consisted of showing a sign as the sample and then a randomized set of abstract objects not previously seen by bees (set 3: random set with chromatic properties)._

Your proposed possible mistake is a way too stupid for a modern experimental psychology.

 _> For instance - the number "3" could be _always_ associated with the same arrangement of any symbol. Say, a triangle formed by three identical symbol._

It is more interesting, I believe. I had not read the original article thoroughly enough to find out could this be as you describe. There is a figures with some stimuli, but I'm not sure that it contains all the stimuli (to be sure it needs more reading, not just skimming).

Maybe this issue needs more testing, but in any case it is impossible to catch all the mistakes like that. For example, our ability to see a figure formed by a changing symbols, it is a property of our visual processing. Bees could have some properties which we do not have, and it could be that their properties could allow them to see some shapes formed by symbols, where we could see just randomly placed symbols.

 _> The fact that neither of the two groups trained on the two different tasks (character-to-quantity and quantity-to-character) could generalise their learning to the opposite task also doesn't bode well. It is exactly what you would expect to see if the setup for each task had some other, uncontrolled for, variable that the bees "overfitted" to, rather than learning what is theorised they did learn._

Yes, it is the most interesting part, because it goes perpendicular to a common sense, and thus gives a direction to a subsequent research. It always work like this: an experiment (a good one does) reveals something about nature, but poses new questions. Then researchers all over the world start to spend their grants on a sequels for the first research. At some point the number of articles becomes overwhelming, and several especially proficient scientists read all of them, studying methodology, combining data from different research into one big data set, making statistics, and finally they'd write a meta-research with a few hundreds of references to experimental articles, trying to make sense of data.

Media just cherry-picking articles with a clickbait titles, and makes them even more clickbaity. The most interesting articles for a newcomer would be a meta-research articles, which do no sparky experiments itself, but analyze all the data they could reach.

<comment><USER4> > _Your proposed possible mistake is a way too stupid for a modern > experimental psychology._

Bees have psychology now?

<comment><USER3> Not exactly. Non-human psychology is called ethology[1]. There are some differences (you cannot ask animal to fill a questionnaire or ask how it feels), but when it comes to an experimental psychology it is almost the same.

[1] [https://en.wikipedia.org/wiki/Ethology](https://en.wikipedia.org/wiki/Ethology)

</comment></comment></comment></comment><comment><USER5> Seems like one set of researchers has had two breakthrough studies of bee intelligence. Has anyone reproduced this? I feel like for something this incredible, we should perhaps wait until another team can reproduce the results before getting too excited.

</comment><comment><USER6> Reminds me of Neil deGrasse Tyson's comments on the "intelligence gap".

If bees can do this, how smart are we really? Compared to generally intelligent AI or extraterrestrials, the difference between our intelligence and a bees might not be much.

[https://youtu.be/Tt0uV5d8tss](https://youtu.be/Tt0uV5d8tss)

<comment><USER7> I always think what the perspectives of a being that could live for millions of years and had the computing power and memory and sensors of all of Earths machines would be. I don't think we could even comprehend the thoughts of this being.

<comment><USER8> I suspect that being would get insufferably bored.

<comment><USER9> It would probably think up a way to strap boosters onto itself and cruise the galaxy. Beats hanging around here.

<comment><USER10> How do I attach rockets to my brain?

<comment><USER11> What are you asking, exactly?

If you mean "you never said I had hands, gotcha", then yes you need to get hands first.

If you're talking about the physical task, I don't understand how that could be a problem. If you can move your body into a rocket, do that. If you can't, put a big dome over top, down to bedrock, and attach the rockets to the bedrock.

<comment><USER10> I should have been more precise, because even I don't understand what I meant anymore, & now can't even delete it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> How do we know the bees don't simply use a learned lookup-table rather than doing arithmetic?

During evaluation, did they present the bees with problems that they didn't see before?

<comment><USER13> How do we know that humans do not? My mental process for simple arithmetic does seem to involve multiple something that feels like lookup tables.

<comment><USER14> Yes, the difference is that you can synthesize numbers which are not (yet) in the look up table. It would be super amazing if one could show that bees are capable of doing that.

<comment><USER15> > Yes, the difference is that you can synthesize numbers which are not (yet) > in the look up table. It would be super amazing if one could show that bees > are capable of doing that.

Or rather, we can synthesize lookup tables from preexisting lookup tables.

<comment><USER16> Sure, but that extrapolation is called arithmetic.

</comment></comment></comment></comment></comment><comment><USER17> Non-paywalled papers:

• Symbolic representation of numerosity by honeybees (Apis mellifera): matching characters to small quantities [https://royalsocietypublishing.org/doi/10.1098/rspb.2019.023...](https://royalsocietypublishing.org/doi/10.1098/rspb.2019.0238)

• Numerical cognition in honeybees enables addition and subtraction [https://advances.sciencemag.org/content/5/2/eaav0961](https://advances.sciencemag.org/content/5/2/eaav0961)

</comment><comment><USER18> bees can link symbols to symbols?

<comment><USER19> No. Small quantities are represented with previously unseen symbols in randomized positions.

This is what numbers _are_ (cardinals, or equivalence classes of sets under bijection, if you wish).

So bees can _count_.

</comment></comment><comment><USER20> Don't most animals have the ability to learn associations? E.g. when the leash jingles the dog knows it is time to go for a walk. Not sure this is the same as humans doing arithmetic. Scientists seem quite anxious to make the jump from associations to human level abstract thought, for some reason.

Not saying it is impossible, but these kinds of studies seem very handwavy and not very careful with terminology.

<comment><USER21> I think the "abstract" part here was the concept of "three-ness" or "two-ness" \- that the bees could see something that represents 3 and correctly choose the path with three shapes, regardless of what the shapes were.

<comment><USER20> Based on the picture of the experiment setup in the article, it's hard to infer the bee understands 'three-ness'.

Based on this reasoning, does the bee already understand 'flowerness' since it knows to get nectar from many different kinds of flowers?

Do dogs understand 'dogness' because they know to sniff the butt of any dog that crosses their path?

Pretty sure I can create a simple AI that can distinguish three of something under many different kinds and orientations within suitable constraints, and have that capability associated with another easily distinguishable visual code. Yet, I would never say I've made my computer understand 'threeness', as the computer has no abstract reasoning capabilities whatsoever.

In general, how do we know when something understands '____ness' in the way we understand '____ness'? Per my previous examples, either the article's meaning is trivial, or unsubstantiated.

<comment><USER19> How about you just look at the paper?[0]

The positions of symbols were randomized, and they used symbols previously unseen by bees.

The concept of three-ness (as a cardinal number) is just that: being able to identify sets of objects which can be put into 1-to-1 correspondence with the following set of asterisks: * * * .

The bees, according to the experiment, can do that.

Is this _our_ understanding of three-ness? Maybe not; there's also the notion of ordinals (as in 3 is what follows 2, 2 is what follows 1, and 1 is where you start). We have at least two different notions for numbers. But the notion tested in the paper is good enough to do most mathematics with (cardinals and ordinals are kind of the same until you reach infinity).

[0][https://royalsocietypublishing.org/doi/pdf/10.1098/rspb.2019...](https://royalsocietypublishing.org/doi/pdf/10.1098/rspb.2019.0238)

<comment><USER20> I won't deny it is a very interesting study and seems to be well put together.

However, the paper is trying to present the bee study as evidence that human cognition is on a spectrum with animals, instead of a unique thing not found in the rest of the animal kingdom as part of a larger project to identify whether/how human cognition could have evolved from animal cognition:

"Nevertheless, there is no evidence that any species apart from Homo sapiens have ever spontaneously developed symbolic representations of numerosity, which opens the question of which animals are capable of learning symbolic number representations, which are capable of generating such representations, and whether this implies a fundamental difference in the mental processing of Homo sapiens compared with other animals."

So, for the bee study to evidence an answer to their question, we need to know whether this symbol-to-numerosity association the bees learn is the same sort of thing as symbolic number representation that humans use. The study is certainly a good step in that direction, but it seems to me there is a more fundamental question that is not being asked. Are the bees really perceiving 'twoness' and 'threeness' in the cardinality sense you mention, or is there some analog property, such as shape surface area, general shade of picture (i.e. two will seem lighter than three), triangular configuration (three) vs dots (two), etc. that the bees are responding to instead of exact cardinality?

To take a contrary perspective, why couldn't the bee symbol to number association be the same sort of thing as the AI I mentioned in my previous comment? The AI can recognize 2 and 3 symbols effectively, but it cannot extrapolate beyond that, nor could we take the AI and build an arithmetic module out of it through some kind of incremental training. The 2/3 recognizer is a hardcoded piece of functionality in the AI that will never expand beyond its core functionality. Perhaps 2/3 recognition is part of the hardcoded bee behavior that is necessary for it to set landmarks and navigate. This is much different than human arithmetic capability, where we can learn about 2s and 3s through physical examples, and then realize there is such a thing as 'number' and eventually realize there are an infinite number of 'numbers'.

So, for these two main reasons, despite its well constructed sophistication, I don't see the study as very compelling evidence that the human cognitive ability is not unique and merely part of a continuum wherein the dial can be turned up from animal cognition to human cognition.

</comment></comment></comment></comment></comment><comment><USER22> I expect one of these days I'll see an article titled "Bees proven to be Turing-Complete"

<comment><USER23> This really reminds me of the intelligent AI bees in Permutation City by Greg Egan

</comment></comment><comment><USER24> you don't need many neurons to do MNIST.

</comment><comment><USER25> These creatures never cease to amaze me.</comment>


5 Quick Tips for International Founders Relocating to Silicon Valley - <AUTHOR> http://blog.foundersnetwork.com/2013/01/5-quick-tips-for-international-founders-relocating-to-silicon-valley/

<comment><USER2> Thanks for posting, as a foreigner who hit the valley 'green' about 3 years ago all 5 points resonated. Its far too easy to underestimate the pragmatic concerns of dealing with a new culture and its social rituals, and how much time that actually takes away from building your product, enjoying new experiences, with partner or otherwise, and finding the comfortable balance. Simple things like credit lines (they don't exist for foreigners!), drivers licenses, insurance... the real basic things, can be massive pain points that locals will simply not understand.

The fact is, unless you're already hustling American-style, foreigners without established networks and a story ready to tell about their projects are going to sit on the sidelines (in the trough of sorrow) for a very long time. This could be a function of the transient nature of those who call SF their home, and its inherent social liquidity not facilitating deeper social connection... but I do know once you're "in", it's amazing, and doors will open.

Its hard, but glad to have stuck with it.</comment>


Call to Action Buttons - Examples and Best Practices - <AUTHOR> http://www.smashingmagazine.com/2009/10/13/call-to-action-buttons-examples-and-best-practices/

<comment><USER2> As usual the trick is to get inspired and not slavishly follow any particular implementation. Due to each site having differences in design and purpose, the only way is to do continuous a/b testing.

[http://visualwebsiteoptimizer.com/split-testing- blog/tag/cal...](http://visualwebsiteoptimizer.com/split-testing- blog/tag/call-to-action/)

[http://www.campaignmonitor.com/blog/post/3073/a-b-testing- th...](http://www.campaignmonitor.com/blog/post/3073/a-b-testing-the- difference-one-line-can-make/)

[http://thinkvitamin.com/web-apps/how-to-increase-sign-ups- by...](http://thinkvitamin.com/web-apps/how-to-increase-sign-ups- by-200-percent/)

</comment><comment><USER3> I'm amazed at the amount of "this is crap because I already knew it" comments in the articles comment section. Sure one sees this a lot on the web but it seems to me that it's becoming more and more common.

As a hobbyist in the field I find articles like these very interesting. However I find it hard to find larger collections, or even better books on such subjects. So much of what I come across is bloated with crap. Very seldom can I find collection focusing only on the why and how. Any tips?

<comment><USER4> Well I agree. The classic is still valid : [http://www.amazon.com/Think- Common-Sense-Approach-Usability/...](http://www.amazon.com/Think-Common-Sense- Approach-Usability/dp/0789723107)

Everything from there has been sort of copies. I find it more interesting to dig into the human brain and related books. Ie. cognitive psychology and how our brain perceives things. The difference between cultures etc. That's where you really learn the WHY and HOW.

</comment></comment><comment><USER5> See also: A Quick Web Design Case Study - Apple Macbook Air Call to Action

[http://voltagecreative.com/articles/web-design-case-study- ap...](http://voltagecreative.com/articles/web-design-case-study-apple- macbook-air-call-to-action/)

</comment><comment><USER6> Anyone doing A/B testing of buttons have a color recommendation?

<comment><USER7> Running multiple tests on buttons right now - and I've read/been given advice that a) orange is good and b) you want the color of your button to be different than the general colors on your sight to draw attention to it.

I think language matters equally as much - especially if you have primary and secondary text in the button - but these are all hunches, hence the testing. Found a ~80% uplift with 99% confidence just by flipping the primary and secondary text of a button on our homepage (not our primary landing pages) last week. Testing color variations on the improved text now.

source: [http://www.formstack.com/the-anatomy-of-a-perfect-landing- pa...](http://www.formstack.com/the-anatomy-of-a-perfect-landing-page) (note I don't agree with all of this but there is a good color breakdown). also had some real world advice given to me from a convo with a 500 startups founder a few months back related to orange.</comment></comment>


Welsh man throws away hard drive containing £4M Bitcoin - <AUTHOR> http://www.bbc.co.uk/news/technology-25138627

<comment><USER2> Same story, different source, significant discussion:

[https://news.ycombinator.com/item?id=6809065](https://news.ycombinator.com/item?id=6809065)

Yet more sources, no discussion:

[https://news.ycombinator.com/item?id=6814293](https://news.ycombinator.com/item?id=6814293)

[https://news.ycombinator.com/item?id=6815087](https://news.ycombinator.com/item?id=6815087)

I expect we'll see this story picked up and reported over and over again. It's about BitCoin, and everyone loves a good bit of _schadenfreude._

</comment><comment> daniel-cussen Dark Bitcoin. I wonder if, in the scenario where it becomes an important world currency, you'll have people looking for dark Bitcoin, and dumpster diving for it the way people currently dive for silver and gold in sunken ships.</comment>


ACLU: Amazon shouldn't sell face-recognition tech to police - <AUTHOR> https://apnews.com/5bd7883d7a1f4cf78ed52faf6641cbd0/ACLU:-Amazon-shouldn%27t-sell-face-recognition-tech-to-police <comment><USER2> This reads as a fairly myopic solution.

"People should be free to walk down the street without being watched by the government,"

So why not cut to the heart of the matter: don't allow governments to do mass surveillance. Simply stopping Amazon from selling the tech does nothing; there's clearly a market for it, so other companies will fill the void. Alternately, facial recognition software is fairly easy to come across, the police could simply implement it themselves.</comment>


Dungeons and Developers - <AUTHOR> http://www.dungeonsanddevelopers.com <comment><USER2> It's very cool, but some complaints:

\- I shouldn't have to know advanced database management to do AJAX or user authentication. Seems like a dependency bug.

\- The tree emphasizes jQuery effects to an odd degree (three levels) and it doesn't depend on JS mastery. Seems obscure and out of place.

\- There's too much specificity in a lot of the descriptions and links. I'd focus less on tools and more on skills. For example, instead of "You can use frameworks like Ember.js,...", say "you can build a complete, highly interactive SPA". Instead of "You can use mod_rewrite", say "You are comfortable deploying, configuring, and maintaining high-traffic sites in a complex environment." The User Testing and Prototypes skills are much better in this regard.

\- I'm not sure I love the Web Development Mastery skill, because I'm not sure what it captures besides "I checked off all the other boxes".

Edit: removed use of "just" that makes it sound more critical than I meant it.

<comment><AUTHOR> > "The tree emphasizes jQuery effects to an odd degree (three levels) and it > doesn't depend on JS mastery."

Do you find that use of jQuery requires a mastery of JavaScript? There was a time when I could use jQuery(especially jQuery plugins) but didn't have a clue about how to do very basic things with JavaScript.

<comment><USER3> There should be a Javascript tree to this too.

Unless you mean web designers, not web developers?

<comment><USER4> Where's the Canvas\HTML5 game made achievement?

For that matter, where's the rest of the server administration tree? It could branch, with helpdesk administration into enterprise desktop support, with network administration into BGP routing, and with corporate server administration into enterprise server administration.

</comment></comment></comment></comment><comment><USER5> Content aside, I love the idea of visualizing various skills and their relationships in this World of Warcraft - like style! Nicely done.

Khan Academy could be taking notes and inspiration to replace their current Knowledge Map:

[https://www.khanacademy.org/exercisedashboard](https://www.khanacademy.org/exercisedashboard)

Perhaps this would be a little over the top with gamification, but it could be cute to have a character sheet for every student with their level, experience points, skills and talent specs listed out in tabs. It's fun to look at Online Education as being essentially an MMORPG.

<comment><USER6> >t's fun to look at Online Education as being essentially an MMORPG.

Hell yeah!

>have a character sheet for every student with their level, experience points, skills and talent specs listed out in tabs

Isn't that one of the goals of Khan Academy? Because I remember them saying that they were against grades and that every student deserved a specialized reprot of their skills abilities projects etc

<comment><USER7> MOOC → MMORPG, not a big difference, but a huge impact. Education should be more fun, less hostile/prison.

</comment></comment></comment><comment><USER8> Not a skill tree, but this reminds me of the challenge map from [http://hacker.org](http://hacker.org).

EDIT: To add, the intent of the challenge map is that many of the challenges build directly or indirectly on past challenges. Basic crypto challenges (by basic, I mean simple substitution ciphers) to simple XOR ciphers with increasing levels of difficulty (intended, sometimes there are shortcuts the designer didn't perceive). Programming challenges using their own esoteric languages or solving problems with potential exponential algorithms (until you figure out the shortcuts) and the like.

<comment><USER9> Definitely recommend this site, it was a big influence in my early programming days, I found it way more interesting than Project Euler.

<comment><USER8> Agreed. I didn't get too far in Project Euler myself before finding other programming problems to solve. Logging in I only solved 4, apparently. Which doesn't seem right, maybe I accidentally created a second account, I've done that a few times.

The main issue was, though I have a math degree, there was no way it would appeal to most of my friends when we'd turn these sorts of things into a (mostly) friendly competition. Hacker.org hit just the right buttons to keep a few of them interested long enough to even plough through the problems they didn't enjoy just to make progress.

</comment></comment></comment><comment><USER10> Things seem aimed a bit more at designers than developers. If it was to be more developer-centric it would definitely need some references to things like GoF patterns, dependency injection, code reuse, testing/testability, loose coupling, etc. Someone could have a perfect score on this and potentially be terrible, even at web development specifically. If someone had a perfect score on the programmers competency matrix, however, they would be a sure thing.

[http://sijinjoseph.com/programmer-competency- matrix/](http://sijinjoseph.com/programmer-competency-matrix/)

The best sort of skill tree is one where it is hard enough that you cannot make it down every path in the time that it takes to play the game (in this case a career). Someone needs to create a new competency matrix with a broader scope.

</comment><comment><USER11> Dungeons and _web_ developers.

<comment><USER12> Sometimes I wonder if I still count as a developer because I don't do web tech.

<comment><USER13> Yes. Oh god yes. Don't let the HN world get you down, there's more out there than HTML and Javascript.

<comment><USER14> return(false);

</comment></comment></comment></comment><comment><USER15> What if a company implemented this in their workplace?

They would have different classes for general positions in the company, and you could get a skill by passing a rigorous test. Each skill point would get you a raise. You get promotions or change roles based on your class specialization and level.

I know, I know, it'd be a disaster. But maybe there could be lower stakes at hand to encourage employees to learn new skills, like cashing in XP for little perks.

<comment><USER16> I don't agree that'd be a disaster, I personally like the idea or at least something similar.

Essentially it's about basing promotions & pay based off meritocracy. There could be concerns about the Peter Principle [0] but at a high level, it appeals to me to work in an environment where people can "prove" they have the skills, instead of talking the talk or simply being the oldest employee.

[0] [https://en.wikipedia.org/wiki/Peter_Principle](https://en.wikipedia.org/wiki/Peter_Principle)

<comment><USER17> The fact that you can point to some credential that asserts that you learned something doesn't speak to your ability to actually use it effectively[1], much less achieve business objectives by using it.

Also, the people who you believe have been promoted by virtue of being the "oldest employee" may actually possess skills that you are unaware of -- perhaps even skills you are unaware are useful and important. Speaking as someone who has been around the block but prefers to work as an individual contributor rather than a manager, I have observed any number of important skills that are prevalent among effective managers that most technical folks start out unaware of. Risk assessment skills -- which are often based in having enough experience with both successful and failed projects -- are a good example. Another is the willingness to take responsibility for what often seem like nonsensical decisions that have to be made due to business or practical constraints. The latter is something that virtually no one _likes_ to do, but often needs to be done in real life.[2] I could go on indefinitely, but I hope a couple of examples will suffice for now.

[1] [http://31.media.tumblr.com/tumblr_lh0blbt3bs1qz8yeno1_400.jp...](http://31.media.tumblr.com/tumblr_lh0blbt3bs1qz8yeno1_400.jpg)

[2] I was too slow to pick up on this lesson in real life until I saw the way Tom Hanks told Gary Sinise he was being dropped from the mission in the movie _Apollo 13_. In the time since, this has been a useful observation about how managers can be more effective when they don't try to do whatever will make you like them the most (which is typically a negative trait in a manager).

</comment></comment></comment><comment><USER18> jQuery Effects is a pre-req for the ultimate (Web Development Mastery) but jQuery Effects does not arrow into the ultimate. Instead, Web Design Mastery, which is a pre-req for jQuery Effects, does. This appears to be a bug. You could resolve it by moving WDM up a level and moving jQuery Effects into its current position.

</comment><comment><USER19> Very cute and nice but the categories are too broad in name and narrow in focus "Server administration" = Apache setup etc.

</comment><comment><USER20> Nice idea - though it's a pity that it's so web dev centered.

</comment><comment><USER21> Very interesting concept, but it is very limited currently. I'd like to see some other 'classes'.

A class for Ops/DevOps, and for Technical Management for instance

</comment><comment><USER22> If this is the skill tree, is doing a startup a raid?

<comment><USER23> Nah, the better analogy is forming a guild. The raid is every time there's a fire you have to put out because a key customer is unhappy or you aren't making enough money and need to pivot or your landlord kicks you out or you go for VC funding.

...I can't believe I bothered to write this.

</comment></comment><comment><USER24> Myself: [http://www.dungeonsanddevelopers.com/#_a2b2cde3hijklm2nopqxy...](http://www.dungeonsanddevelopers.com/#_a2b2cde3hijklm2nopqxy2_15_Nick)

This is actually an interesting way to display credentials. You could potentially put this up as supplementary on your LinkedIn profile or something along those lines.

<comment><USER25> I find it intriguing how close yours was to what I came up with quick for myself ([http://www.dungeonsanddevelopers.com/#_a2b2c2de3hi2jklmnopqx...](http://www.dungeonsanddevelopers.com/#_a2b2c2de3hi2jklmnopqxy_17_Dak)).

I wonder what percentage of web developers on HN fall into the same broad category.

</comment></comment><comment><USER26> Aww. I guess not knowing stored procedures prevents me from obtaining Web Development mastery. Fair enough, I suppose.

<comment><USER27> Yeah, there should be a step before that involves joins, using composite primary keys and foreign key constraints, views ... just some things that I would say are a step above "I wrote a model file and my ORM issued the appropriate DDLs"

</comment></comment><comment><USER28> I love this! I think there's some real mileage in something like this realised a little better. For example:

\- Let users upload their own portraits

\- Sort out the skill dependencies to be more logical. Why do the 3 levels of jQuery effects not depend on JS mastery for example?

\- Less emphasis on specific tools and more on types of skill, as pointed out by some other commenters

\- Let us pick classes, perhaps with two components to the class, e.g. "Frontend ranger", "Devops Paladin", "Database barbarian", "Data Scientist High Elf" etc.

\- Sort out the ugly looking pushState url to something cleaner that people would be proud to link to

</comment><comment><USER29> Really nice !

But Server Side programming should have more levels...

<comment><USER30> Agreed, on both points. Fun and awesome design. Since I have so few skills on the left side of this talent sheet, I really appreciate how polished it looks.

I was a little sad that our framework benchmarks [1] and/or a "server-side performance" talent category were missing. :)

[1] [http://www.techempower.com/benchmarks/](http://www.techempower.com/benchmarks/)

</comment></comment><comment><USER31> This is fun! Great work.

One small suggestion: consider using replaceState instead of pushState, pressing the back button just removes one skill point when it should probably leave the site (or at least remove all skill points).

</comment><comment><USER32> This is fun as a "what don't I know" test. I think we all know of some professional software developers who wouldn't pass the advanced database talent. I might be one!

</comment><comment><USER33> Any MMORPG player would tell you that a build tree decreases flexibilty and annihilates creativity as only 2 or 3 major "build trees" end up being viable.

</comment><comment><USER34> Stylish, Sizzlin, Crafty, Nimble, Beefcake, XXL Knapsack, Mindweaver, Mindreader, Artistic, Conjurer, Stewardship, Spectral Guide.... From Dungeons and Developers

</comment><comment><USER35> Spaces in your names should be encoded/decoded as %20.

</comment><comment><USER36> This is pretty cool but shows up how unrealistic talent trees are in real life. Will be a pretty good idea for a customised CV in game industry, though... :-P

</comment><comment><USER37> I really enjoy this, but I think it might not have enough levels. I'm level 28 according to the tree, but I certainly don't feel like a 28.

</comment><comment><USER38> Should be able to "Save and Share" my profile

Really nice work

<comment><USER39> All the changed are in the URL, you can just copy and share it.

<comment><USER40> But what if I gain a new skill? The URL won't update if I have posted it somewhere.

<comment><USER38> Exactly

</comment></comment></comment></comment><comment><USER41> It would be pretty awesome if they created a fully editable/customizable version of this talent tree. I would totally pay for it.

</comment><comment><USER42> Too much awesomeness in one page. Now, needs to make a real game out of it. The web developer shaman and their enemy, the mighty IE6.

</comment><comment><USER43> You should add security in there somewhere!

</comment><comment><USER44> Back button is broken in Firefox 23.0

<comment><USER45> Yeah, same with chrome. looks like every skill you clicked on created an entry in the browser's history. Not sure why they did the UX like that; it's very annoying.

</comment></comment><comment><USER7> This is awesome, but makes no sense without:

         * Business Skills
         * Social Skills
         * Mastery of a Start-up
         * Entrepreneur Skills
         * Organizational Skills ($ and PM)
         * Marketing Skills (most importantly)

Unfortunately I know that I mastered all of these topics on site already more or less, but not the mentioned ones.

</comment><comment><USER46> I enjoy the subtleties. Leveling deployment adds dexterity and fortitude :)</comment>


Oracle Splats 300 Vulns in MySQL, Database, Fusion, etc. - <AUTHOR> https://www.theregister.co.uk/2019/04/16/oracle_bug_fixes/ <comment><USER2> so they are releasing security fixes with a new licensing agreement, wow glad I don't use any oracle stuff</comment>


Revisiting the spectacular failure that was the Bill Gates deposition - <AUTHOR> https://arstechnica.com/tech-policy/2020/09/revisiting-the-spectacular-failure-that-was-the-bill-gates-deposition/ <comment><USER2> What I have never understood about this is how everybody responsible didn't spend a single night in jail, for Contempt of Court if not for perjury.</comment>


Slack uses 2065 different libraries/NPM modules in their desktop app - <AUTHOR> https://slack.com/libs/desktop <comment><USER2> That's not so much a list of packages "in" the Slack app as it is a list of packages needed "to build" it. There are testing, linting, preprocessoring, and build tools, none of which will end up in the final application (and many of which will actually result in the final app being less code rather than more).</comment>


Qwiki - First impressions? - <AUTHOR>

Just got my Qwiki account, and played around with it for 30 mins.
First impressions: - Does not create qwikis on the fly. Has a whole load of stuff created with it which it serves to viewers. Thats the logical thing to do of course.
- Essentially, just reads out the first 3-4 paragraphs from the wikipedia page. Again logical as there's a very little chance that what you'd want to know about on Qwiki (on instinct) does not have a wikipedia page already. On instinct, all I tried looking for was personalities, companies and algorithms, and I got good quality clean output for all. Its when I wanted to stress test it was when I tried a query like "How to avoid cancer". Of course thats not a Qwiki-like topic.
Overall a great product. Makes me think - its very common sense: pick up the wikipedia page, annotate it with images and videos wherever there is a relevant context, store everything in the backend, and serve when requested.
I think its going to be huge. What do you think. <comment><USER2> Its a nice-to-have and in a very competitive market (information retrieval). it goes up against the following competitors.

a. reading Wikipedia b. searching on Google c. asking questions on social networks / forums

Its flashy and attractive but doesn't make the task more efficient and or grant obvious benefits. Might have a market in Education or Product showcase vertical but as a web consumer play? not going to be huge IMHO.

<comment><AUTHOR> Education can be huge. It IS huge.

<comment><USER2> I agree but they are pitching it to the consumer web not educational institutions.

<comment><AUTHOR> We're still some way off from seeing who they are pitching it to. Its more a question of having your ears to the ground and trying to understand who this can be sold to. I think that applies for any business. I am sure they'll pitch it to whoever it makes the most sense to pitch to.

</comment></comment></comment></comment><comment><USER3> As strictly an end user the computer voice annoys the crap out of me and makes me hate it. The concept is great but due to this one vice, I will never use it. It seriously makes me feel insane.

<comment><AUTHOR> Would agree to that, but would still use it.

</comment></comment><comment><USER4> It was nice for a beta launch. But they have long way to go before they can be of any practical use.

But it's great for kids... or is it? :P

But a really nice start. Interesting things are coming up in Content Industry. Nice!

</comment><comment><USER5> I can sight-read Wikipedia faster than the voice can read to me, so that's not adding anything.

The slideshow often seems like a random mish-mash of related images and graphs, with animating flourishes that distract rather than adding information.

I thought clicking them might branch off or accelerate the voice in that topical direction; instead in most cases it's just a zoomed modal lightbox that stops the voice and offers other outlinks. Some of the infographics are wrong where Wikipedia is right; for example its report of the area of the city of Palo Alto is off by a factor of 100. If the same information were just inline, I could read/scan them faster. As it is, rewinding is harder than the same info provided in a scrolling view.

I suppose if Wikipedia has 'too many words', or if you were otherwise of limited literacy, Qwiki might be valuable. I was underwhelmed, but then again I prefer the wordiness of the NYTimes or WSJ to cable TV news, most days.

 _Perhaps_ having it be a dashboard for other info sources -- as in the founder's 'alarm clock'/wake-routine scenario at TCDisrupt -- could provide some other value... but perhaps not more than other tech that can read a block of text stitched together from many sources.

<comment><AUTHOR> I looked at Metallica and Dylan, and looking at the Qwiki was a very enjoyable experience - way more juicier than reading. It could have gone even further if it played some tracks in the background :)</comment></comment>


Tunnel - a game in javascript and css using jquery. - <AUTHOR> http://www.christianmontoya.com/2007/05/10/tunnel-a-javascript-css-jquery-powered-game/

<comment><AUTHOR> This is pretty well done, although it's not really too much more than a "proof of concept".

I'd really like to see a lot more movement in this direction from online game developers, and it seems like we're just starting to hit the point where this is really feasible, so I guess we probably will.

No flash, no java applets. No more dealing with crappy or just unstable implementations of plugins on different platforms and browsers(just dealing with differing implementations of javascript and css on different browsers, which is also a bit of a pain, but it's getting better a lot faster.)

Edit: I just noticed this is from a year ago, and there has been quite a bit of game development using javascript. Good.</comment>


Nigel Warburton on Introductions to Philosophy - <AUTHOR> http://fivebooks.com/interview/nigel-warburton-on-introductions-to-philosophy/ <comment><USER2> Nigel Warburthon's _Philosophy Bites_ podcasts collectively form a great survey of philosophy.

[http://www.philosophybites.com/](http://www.philosophybites.com/)

</comment><comment><USER3> "Philosophy is the discipline whose adherents kick up a load of dust and then complain they can't see", Murray Gell-Mann</comment>


Parse (YC S11) adds User Accounts to Android.  - <AUTHOR> https://www.parse.com/docs/android_guide#users

<comment><USER2> Just to be clear, these are User Accounts for apps built for Android using Parse, akin to iOS's single sign-in using Twitter?

I was anticipating someone had built multiple user logins for Android devices, which would've also been fascinating.

<comment><USER3> It's per-app user accounts that people can integrate with just a few lines of code.

</comment></comment><comment><USER4> It would be cool if there were custom support for linking accounts, such as with facebook. That code is never fun to write, but common.

<comment><USER3> Coming up!

</comment></comment><comment> eric-hu Somewhat off topic:

This page has a beautiful javascript effect if you scroll. The index follows the page smoothly and highlights the displayed section. Does anyone know if this is a public library/function?

<comment><USER5> You should look into jquery waypoints --> <http://imakewebthings.github.com/jquery-waypoints/>

I use it on my blog to change how social buttons behave once you scroll past a certain point.

<comment> eric-hu That is so amazingly sexy. Thank you :D

These sticky elements seem to scroll with the page (or stick?) much more smoothly than I've seen on other pages. Are there crappy versions out there or could I just be experiencing a newer browser optimization?

<comment><USER5> It's a simple trick. Instead of using JavaScript to stick them on the page, you change their positioning to fixed when they hit the window's edge. Then the browser takes care of the rest.

</comment></comment></comment></comment><comment><USER6> I wish the title would've meant the solution to the Android tablet multiuser problem¹ as well.

¹: <http://code.google.com/p/android/issues/detail?id=15030>

</comment><comment><USER3> Hey we were just about to blog about this but you beat us to it! We also have some other good stuff we're set to announce this week so keep an eye out.

<comment><USER7> Who is we? :)

<comment><USER8> "We" is Team Parse ;-) Right now we have four people, HN usernames csmajorfive, jamesjyu, tikhon, and lacker (me). If you ever have any questions or feedback on Parse, feel free to contact us at firstname.lastname@example.com directly.

<comment><USER9> just one , it sucks when API returns null for not found instead of some form of NullObject IMNSHO it would be nicer and semantically more pleasing to eye to have if ( user.isLogged() ) { } else { }

</comment></comment></comment></comment><comment><USER10> what's the business model here?

<comment><USER3> It's a platform as a service. Most hobbyist and small apps will be free. Those needing more resources will pay us for usage - similar to Heroku, AWS, etc.

</comment></comment><comment><USER11> I sure hope this ties into Android's existing account management APIs. The one that already provides push notification support, automatic controllable data synchronization, etc.

Wow, not even 10 seconds and it's been shot at. What am I missing here?

<comment><USER12> Not only should it tie into the existing account management API's, but I can't figure out why they're offering their own push notification API when Android _has one built in_!!

<comment><USER8> We've heard from a lot of people who weren't happy with C2DM. We think our push API is easier to set up and use. It's also compatible with pre-2.2 Android and with Android devices that don't have an attached Google account. You can also can send push notifications to both iOS and Android with one API call. That said, if C2DM works for you there's nothing wrong with using it directly.

<comment><USER12> As a user, I'd certainly prefer for apps that I download to use the built in system functionality (like C2DM). One of the advantages of C2DM is a standard listener that used by all apps, rather than have multiple listeners (each potentially causing battery life impact). If the C2DM API is hard to use, it makes a _hell_ of a lot more sense to write a helper wrapper around it, rather than add another listener.

<comment><USER11> No idea why you're getting downvoted. No application that uses their own push technology is as nice to my battery as C2DM is. Facebook and Twitter can't even get push notifications right, though Google refuses to put Google Voice through the push/sync that Gmail/Calendar/Contacts have. It makes no sense to me. It's there, it's easy to use, it's really battery friendly...</comment></comment></comment></comment></comment>


Ruby Ncurses Forms and Widgets Library - <AUTHOR> http://rbcurse.rubyforge.org/

<comment><USER2> I think you should continue working on it. If nothing else it builds your personal code library up. I'm not sure how many apps in general use ncurses anymore, but I don't think it's going anywhere.

I'm actually developing a console-based ruby app right now. What would have been useful for me however is something to easily work with a REPL (including commands, subcommands, etc.) without a) having to drop into a full IRB session b) any assumptions that I want to parse an ARGV-like line with --long-switches and whatnot. I don't.

cmdparse is the closest, but still isn't good enough.

Thanks for doing the work on your project. Open-source authors don't get thanked often enough if their project isn't used by millions.

<comment><AUTHOR> Thanks for your reply. I would really appreciate if you could elaborate a bit more on the REPL part. Are you talking of a command line with which to query your own app within the app, as to the state of objects. Is this within the app, or like talking to it on a port and passing commands on a shell.

I had been actually thinking on the lines of how emacs can expose its commands -- although i am not an emacs user. I'd need to study that.

I am very familiar with various command line parsing libraries, including cmdparse. I did not get your requirement in this context. Thanks for answering.

<comment><USER2> I'm writing a monitor for an emulator I'm working on, so your first example is what I am doing.

I was wanting for something that lets me add commands, with aliasing, and arguments (maybe with optional regex validation) - e.g. breakpoint add $BEEF, etc. Writing a DSL is one solution and will probably end up being the way I go once I take a second iteration at this. Right now I'm just using regex parsing, but I only have a few commands I need to worry about now.

cmdparse is frustratingly close but makes a few assumptions that you want to parse ARGV or something that looks like it.

<comment><AUTHOR> Did you come across a project named Boson (I think), it allows aliasing of commands, and various other options. Check this: [http://tagaholic.me/2009/10/14/boson-command-your-ruby- unive...](http://tagaholic.me/2009/10/14/boson-command-your-ruby- universe.html)

<comment><USER2> Interesting, but it looks to require irb, heavily pollutes the global namespace with commands, and assumes I want to use --options-with-dashes. This is another 'close, but not quite' example.

The current implementation is that I have a hardware instance (like a CPU) that I want to monitor. To do that, I create a new monitor object, and tell it to monitor the hardware instance, and the monitor will mix itself in from there. It's not good if extra methods show up in the global namespace just for command parsing within a single module of the app. The monitor is just a part of this application, and a part that will not be used often by most users.

Everything I see feels like it's inches from what I really need. So close yet so far :)

<comment><AUTHOR> Another option that comes to mind is Thor by yehuda katz (took me ten minutes to recall the name!): <http://yehudakatz.com/2008/05/12/by-thors-hammer/>

otoh, there are some simple ones you could possible customize: i once studied and modified Choice (by Chris Wainstrath).

I'd really like to know if you find something that helps you, or what you did eventually.

<comment><USER2> I looked at both already. Both assume ARGV-like command strings with --long- switches with no way to get around that without significant rewriting/additional feature work.

Of everything, cmdparse is closest to what I want (by a significant margin,) but it's GPL (not LGPL :( ) so I'm not even sure I can use it in a non-GPL app. If cmdparse were under less-restrictive licensing I would have just hacked it up and released it already. I had already started doing so until I saw the license.

Right now, just writing a DSL is likely going to be my solution. I can bind an irb session to the monitor to keep scope from running away I think. Writing my own command parsing library just isn't interesting enough to me and I don't think I would ever finish it. This itch isn't _quite_ that strong, at least not now.

What I really should do and am going to do later is look into irc clients written in ruby to see how they are doing it. They would probably run into this same problem.

<comment><USER2> Looking into said IRC clients, they all look to use regexps like I'm also doing. buh.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> Strangely enough the title got changed.

Is there a future to a project like this today? Are people developing apps for character based terminals ? Any point in continuing to develop this ?</comment>


Micro-Services: Clojure vs. Scala - <AUTHOR> http://glennengstrand.info/software/architecture/oss/scala

<comment><USER2> sorry, but i cannot agree that someone may decide to go with clojure or scala based on the fact that one has type inference while the other not. Specially when you already have approaches to have type inference on clojure [http://typedclojure.org/](http://typedclojure.org/). Both languages have so much different concepts and ideologies on how to solve problems. To me it is much more about the mindset that each requires you to apply while solving a problem.

</comment><comment><AUTHOR> What do you mean by the term "mindset?" To me, that term usually implies a kind of groupthink.

<comment><USER2> I mean in terms of the philosophy behind it. A programming language is a tool for thinking. And each language, fits better with some specific way of thinking about a problem. So you are mastering a programming language when you can adapt the way you think about the problem to fit the best characteristics of that language. And i feel the discussion about using Scala or Clojure should be more about that, and not so much about the amount of code needed to write a program on each one, or the fact that one has Type Inference in its nature, while in the other it is optional. Just my 2 cents ;)

<comment><AUTHOR> I agree with your intentions; however, when comparing two languages, you need some quantifiable basis for comparison. "Better fit" is very ambiguous and hard to measure whereas code size is very specific and repeatable. I believe I used something like this.

wc `find ~/git/clojure-news-feed/server/feed/src -type f -name ' _.clj ' -print | xargs`

wc `find ~/git/clojure-news-feed/server/feed/test -type f -name '_.clj' -print | xargs`

wc `find ~/git/clojure-news-feed/server/feed2/src -type f -name '*.scala' -print | xargs`

I used code size because you hear about that alot but I agree that it is a very imperfect basis. Less code doesn't necessarily mean fewer bugs. When I coded these two services, I wasn't thinking of code size at all.</comment></comment></comment>


A look at Apple's 2009 Proxy Statement; No golden parachutes for execs - <AUTHOR> http://blog.dustincurtis.com/apple-posts-2009-proxy-stateme

<comment><USER2> even if other companies follow it will only be temporary... i mean given current financial climate the mentality is "lucky to have a job"... once the financial climate improves, we will see old habits creeping back again... all about supply and demand (of jobs)...</comment>


U.S. judge blocks Twitter's bid to reveal government surveillance requests - <AUTHOR> https://www.reuters.com/article/us-usa-twitter-lawsuit/u-s-judge-blocks-twitters-bid-to-reveal-government-surveillance-requests-idUSKBN2200CS <comment><USER2> Can we just ponder for a moment that we are being asked to believe that anything Twitter does or does not do could pose an existential threat to the United States?

"National security" is a sham now and has been a sham every other time it has ever been used as a blanket override for human rights. Human rights to free expression are more important than any nation.

This is just government spies trying to cover their ass whilst they continue breaking the law. They've conveniently mixed it in with "but terrorism!" to ensure that they get to continue breaking the law.

<comment><USER3> What's more disturbing and I simply can't get my head around is that Americans feel that they can trust big corporations more than their own government.

I don't trust US corporations at all and I thought that there was some kind of corporate conspiracy to discredit the US government to allow corporations to gain more power...

Now I'm thinking that the situation in the US is even worse than that; not only are corporations trying to discredit the government, but the government is working hard to discredit itself as well.

<comment><USER2> There aren't many/any instances of single corporations causing >10M deaths, or oppressing millions of people.

There are lots of recorded occasions of single governments doing this.

Governments are seen as having authorities that corporations do not, and thus are to be viewed much more skeptically as a general policy. Companies can't raid your house with machine guns, or toss you in jail for publishing an integer on your website.

It's not that corporations are trusted more; it's that the maximum possible damage by corporate evil is much, much, much, much less than the maximum possible damage by government evil. IBM participated in the holocaust, but they didn't directly _cause_ it. That needed governmental authority. It's prudent to maintain several orders of magnitude higher suspicion and/or skepticism of government activities; corporations are basically sandboxed (e.g. no armies, for the most part) in this model.

<comment><USER4> "There aren't many/any instances of single corporations causing >10M deaths, or oppressing millions of people."

If we look at historical instances of single entities causing 10M+ deaths and oppressing millions of people, _since corporations were invented_ , I think we will find that a corporation is driving the death and oppression more often than you might think. Jardine Matheson, Dole Pineapple, Dutch East India Trading, myriad tobacco corporations, British Petroleum, Shell Oil, for just a few famous examples are each definitely responsible for oppressing millions of people at least, and some of them are responsible for 10M+ deaths. Sure, governments generally claim a monopoly on violence, and in these cases it was a government that actually did the wet work, but they were doing the bidding of specific corporations.

<comment><USER5> > Sure, governments generally claim a monopoly on violence, and in these cases > it was a government that actually did the wet work, but they were doing the > bidding of specific corporations.

What about this inspires any form of faith towards governments? You've got an entity that controls/is the army and it is weak-willed enough that some company with money and a good story persuaded it to 'do the wet work' and kill or suppress millions of people.

What in this story makes you think that _only_ corporations will direct that sort of power in a way you don't like? Are people with bad intentions only found on the boards of large corporations such as Dole Pineapple?

And even if they were why are you then defending the idea that the entity holding the knife, as it were, is the more credible and trustworthy of the two? Surely the government has some accountability for its actions?

<comment><USER4> "What in this story makes you think that only corporations will direct that sort of power in a way you don't like?"

I'm not sure how that comes from what I wrote? I was responding to the claim that corporations aren't responsible for deaths or oppression.

No, it's not "corporation" vs "government". I don't have easy answers to how to prevent this kind of behavior, and I don't trust easy answers, like "minimal government" or "strong government". Global trade and capitalism seems to be working for the most part, with some unsettling caveats.

</comment></comment></comment></comment></comment></comment><comment><USER6> We learn from Snowden leaks that Twitter was the only major platform that refused to participate voluntarily with PRISM surveillance. Twitter only complied with legitimate FISA requests they were not able to refuse.

Microsoft,Yahoo, Google, AOL, Skype and Apple all did more than legally required.

<comment><USER7> Everyone else you mentioned runs a non trivial business that interacts with the government significantly. I know trump get's a lot of action on twitter but the next guy won't be using it for the main means of comms.

It's great that twitter took a stand, but if that company failed everyone would easily replace it. Twitter is toy.

<comment><USER8> What does that have to do with anything?

<comment><USER7> It's understandable because of Corporate law in the US that a public business wouldn't stand too firm against government overreach because it may impact future business, apple can do it because apple isn't a desktop provider to the government and doesn't have a market in danger in that space.

<comment><USER6> Apple was/is commercial partner in PRISM.

</comment></comment></comment></comment></comment><comment><USER9> Does anyone know why judges are so deferential to the US security apparatus? It seems in general like they have a clear bias toward "taking the security system at its word", even when common sense would dictate otherwise in any particular case. It's sincerely puzzling to me why national security entities seem to get treated so differently and I wonder if there's some legal precedent or consideration I'm not aware of.

Like in this case, I fail to understand how releasing the _number_ of requests would have any security bearing.

<comment><USER10> No judge wants to be responsible for a future terrorist attack or degrading intelligence capabilities against other foreign adversaries, regardless of whether the threats are real, perceived, and/or imagined. In this case, releasing the numbers might shine light into their capacity for investigations. In other words, sometimes security/capability gains more from perception than reality.

<comment><USER9> That was my explanation for awhile, but at some point the logic of the security arguments started to seem patently flawed. Also, judges seem to be ok with all sorts of judgments against domestic (state and federal) entities. It's almost as if when national security is mentioned, everything is thrown out the window. It's like a magic codeword or something and I don't understand the legal basis for it.

You make a good point re: investigatory capacity, but it seems even that is fuzzy and could maybe be handled through other means (aggregating time periods or using some kind of required delay).

<comment><USER10> I think the issue is we're trying to explain something irrational (a fear that something might happen) with logic. Judges make similar judgements in protective/restraining order cases. They would rather err on the side of caution, because as someone else mentioned, the downside to allowing the invocation of national security has a perceived minimal downside (minor inconvenience), vs. the downside of a terrorist attack taking place is much more catastrophic. Anyways, don't think anyone is wrong here, just some theories.

</comment></comment></comment></comment><comment><USER11> I can accept many reasons for not revealing at the time, jeopardising a criminal investigation and that could cover national security investigations. So I can see how the judge has angled this.

What I can not understand or appreciate is that such requests can not be made public after said investigations are closed. Alas that approach is now also curtailed and would have to be raised as a separate avenue now. Which with this judgement, will now make that a little more harder to pursue. Been nice if the Judge had allowed that avenue of release, but that was not catered for in the scope of how this case was put forward.

Maybe if Twitter had approached with - what is a fair and reasonable amount of time until we can make such requests public? Or along those lines, then that avenue of release would of been within the judgment remit. Though I'm no lawyer, and may well that this approach they have taken is the best as it allows two bites of the cherry and an angle to appeal.

One just hopes the matter is not as clear cut and settled as it stands.

<comment><USER6> Twitter requested permission to reveal exact number of requests.

Companies are allowed to reveal gagged legal process in ranges of 1000, starting at 0, for six-month periods. Combined FISC and NSL requests can be revealed in ranges of 250.

</comment></comment><comment><USER12> Six years for summary judgment?!? Even if Twitter had won, it and the American public still would have lost through this endless delay. Something needs to be done about the glacial pace of federal litigation. Justice delayed is justice denied.

</comment><comment><USER13> I wish there is a Twitter employee like Edward Snowden or Bradley Manning to leak those surveillance requests. Leaking documents seems to be the only way forward in the U.S.

<comment><USER14> Chelsea Manning, not Bradley

<comment><USER15> Wasn't it Bradley at the time of the leaks?

<comment><USER16> How is that relevant? Don't dead name people and in general don't be a dick.

<comment><USER15> The variable labeled 'Bradley' wasn't relabeled to 'Chelsea' until well after the leak. Changing a name doesn't propagate backwards in time.

Although you're certainly free to conform to whatever meaningless social convention you like. I assume it provides you a sense of belonging, moral righteousness, etc.. But, given the conformity you seem to demand, you might want to consider who here is most deserving of the "dick" moniker.

<comment><USER14> > Changing a name doesn't propagate backwards in time.

> you're certainly free to conform to whatever meaningless social convention > you like.

You don't see the irony here?

I'm not going to waste any time replying further but I'd simply point out that human empathy and care for others costs nothing here.

<comment><USER15> There is no irony. They are free to be as illogical as they like. I can't impose reason upon them as they clearly reject it.

Empathy is entirely extraneous to the discussion. If someone responds emotionally to an otherwise dispassionate discourse, that is their own concern.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> It's April now so that means this:

[https://www.rsync.net/resources/notices/canary.txt](https://www.rsync.net/resources/notices/canary.txt)

... is now 14 years old. This was the first warrant canary[1] and, I am sad to say, one of the few remaining ones.

[1] [https://en.wikipedia.org/wiki/Warrant_canary#Usage](https://en.wikipedia.org/wiki/Warrant_canary#Usage)

</comment><comment><USER18> Could Twitter set up a warrant canary for every user? Append "/canary" to URLs and make it 404 if the data has been compromised.

<comment><USER19> But couldn't they force Twitter to keep updating the canary as part of the gag order?

<comment><USER20> Yes, you are not allowed to take any action to circumvent the gag order. Changing the status of the canary included.

[From memory from some ancient HN thread]

<comment><USER21> The workaround is to make the canary automatically lapse frequently unless renewed. Precedent in the past regarding library books provides that you can't be compelled to _do_ something by a gag order that qualifies as speech, and updating a canary daily with a statement like "As of {current_date} we know of no warrants that have been issued for {private_content}" probably qualifies. Have a static page, update the date value daily so long as it's true, stop updating it when it becomes false. Based on the library book precedent I think this would hold up.

</comment></comment></comment></comment><comment><USER22> I'm not clear on whether the judge ruled in the abstract, or if they know the details of who was being surveilled and why. I just about trust a judge to act as a third party check on power but only if they get total transparency in lieu of the public being able to see.

</comment><comment><USER23> Seems like they definitely have every right to reveal these; I don't see how there is a constitutional basis for this unless they can demonstrate that Twitter would be enabling some imminent vital threat.

</comment><comment><USER24> Judge blocks Apple's bid to reveal government surveillance using Covid-19 tracing program

</comment><comment><USER25> I hope they appeal.

</comment><comment><USER26> Didn't Reddit have some sort of a "red herring" that was raised if they had to comply with some FISA request?

</comment><comment><USER27> "Never do anything against conscience even if the state demands it" \--Einstein

</comment><comment><USER28> Just do it anyway, pull the curtain back Jack!

</comment><comment><USER29> Isn't everything on twitter public in the first place? It's the least of any worries.

Just a reminder all kinds of "government" for any reason is reading all of your email any time they want without a warrant and it's perfectly legal. Just has to be 180 days old but I suspect that doesn't make a difference.

The law allowing it is 30 years old and why the Clintons had their own private email server in their basement in the first place. Congress was going to close the loophole but Jeff Sessions and Trump stopped it.

<comment><USER30> Yeah, I heard that to about emails, after so many days they consider it abandoned property. But seems some different courts debate over that...

Written back in the old days when everyone used POP for mail... Emails would download to your computer and be deleted from the server. Plus webmail back then had limited storage anyways, like 20MB while now you can get at least a gig or more depending on the provider. So the server was more just like a temporary holding space for your email, before it got downloaded to your computer where you'd store it longer term and be responsible to back it up, etc yourself.

Now with webmail and IMAP (where your same email account can be on both your phone and laptop). Super outdated now since we access email differently now with multiple modern devices, I doubt many people use POP email now.

</comment></comment><comment><USER31> A few thoughts:

1) There is no such thing as privacy anymore, at least with respect to anything electronic. I know this because I wanted to be the head of a large online community (I worked on a program which I hoped would become the next Facebook), and I studied everything I could about security/privacy that I could for many years.

2) It would be better, far better, if, when users signed up on Twitter (or any other online service for that matter) if there was a big screen which comes up, with big letters, and says "Everything you say could potentially be taken out of context, could potentially be used against you in Court, and/or could potentially be spun on the News Media or by other people in such a way so as to destroy your reputation, livelihood, and potentially your life." This would be honest, ethical, up-front. "Forewarned is forearmed", as they say...

3) When Jack Dorsey filed his articles of incorporation, for his company (which Venture Capitalists require, and for good reason, if they didn't, they wouldn't be able to sue if/when the founder skips town on them!), but when he did this, he made a legally binding CONTRACT with the Government. Oh sure, it may have been a State government, but let's remember the Supremacy Clause in the Constitution (the Constitution is also a CONTRACT, incidentally...). But once you do this, even though you might not be liable financially on a personal level for your company, you have basically set yourself up to be REGULATED, REGULATED, REGULATED, by the Government and its in-no-shortage-of- supply Lawyers... (Regulated is another fun word for "they're going to tell you what to do" <g>).

(Now, I'm not saying that's a bad thing... historically that regulation created some major wins for society, case in point, the meat packing industry, many many years ago, when proper sanitary conditions were not followed, and there are many other examples of this).

But the thing is, this Judge is making his decision based on that CONTRACT (the contract is the tip of the iceberg, by the way, it basically makes the company accept ALL of the thousands of miles of statutory U.S. code, it's sort a lead-in to that).

So, based on what I know about U.S. Law -- the Judge is probably, probably not wrong, but remember, he's making his decision based on

a) The CONTRACT, aka "Articles Of Incorporation".

b) The miles and miles of State, Federal, Statutory Code and Agency Code (since federal agencies are quasi-law creating entities) that the said CONTRACT (a), forces the company to accept...

In other words:

c) Lawyers, not technologists, are running the show... <g>

And you wondered how "The Swamp" works... <g>

Hey, I think I remember some song lyrics (Depeche Mode, actually!):

"The handshake seals the _contract_

from the _contract_

There's no turning back

[...]

The holiday was fun packed

The _contract_ still intact..."

-Depeche Mode, Grabbing Hands

<comment><USER32> > There is no such thing as privacy anymore, at least with respect to anything > electronic.

There never was! I was there for Scott McNealy telling us, "You HAVE no privacy. Get over it." As the CEO of Sun, he knew exactly what the federal government was doing with all those computers they were buying: running Larry's database, and archiving absolutely any-and-everything they could. All Snowden did is show us how well the tools running on top of that infrastructure work, 25 years on.

</comment></comment><comment><USER33> Obligatory: And this is a branch of the same government that HN users want to "regulate tech". Why would anyone want to give government more power?

<comment><USER34> Because normally a government does smart thing for its people. It hasn't done that in some time in the US.

<comment> Mary-Jane Since when? Governments have a history of greed, corruption, and trampling on the rights of it's people for it's own gain. Ref: any history book on any country, ever

<comment><USER35> The problem is all large organizations strive for power. One can be more easily changed than the other, at least in democratic republics. Corporations are more like autocracies, their leadership can't be changed. One can say that corporations derive power from customers, but this is not necessarily so. As they grow larger, they can necessarily control user habits through psychological means. The government can too but it has a lesser incentive, as power is more distributed, again in a democratic republic. Money however is a much better fitness function than power, as it can be quantified, so it is unsurprising that corporations gain power.

<comment><USER36> The only difference is that someone proposed an ideal when talking about government, but not for companies. Why not use the ideal free market here as well?

<comment><USER35> Free markets are sustained by governments free of bribery and corruption. Otherwise you get monopolies and oligopolies as in the Gilded Age and arguably now.

<comment><USER33> Where is the government that has a history free of bribery and corruption?

<comment><USER35> None, of course, that is true of any organization of incentive-driven autonomous agents, such as humans. However, governments are not explicitly designed to make money, whereas corporations are literally explicitly designed to make as much money as possible. Money equals power to some extent, so corporations cannot be as useful as governments if you're optimizing for the wellbeing of citizenry.

<comment><USER33> Governments are far from optimized for the well being of _all_ it's citizens. It's optimized for the majority. Just like the "War on Drugs" turned into "treating it like a disease" when drugs started hitting "rural" America.

France passed a law to make the Burkini illegal - targeting Muslims. This isn't just the US.

<comment><USER35> Of course, you can't please everyone. The distinction is, at least governments try to. Corporations do not, by design, as they are only incentivized to collect money and funnel it to the top X% of the company, not even the company as a whole which includes workers.

<comment><USER8> Corporations work by providing a product or service that customers believe to be worth more than the dollars and cents they're paying for it. It's inherently consensual. The only way a corporation begins to generate revenue is literally by attempting to please as many customers as possible.

<comment><USER35> Yes, but the problem is not when the corporation is small, but when it is large. With increased power, it can reach the levels of a nation-state in affecting people, and it is unchangeable as there is no mechanism, unlike voting, to change its behavior. You may say that the customer is always right and so will choose a different product, but this can only be done with a free market, which does not exist currently, and can only exist with strong governments free of monetary influence, as I said before. Sure, pockets of free market, competitive behavior exist, but for large corporations, they are near oligopolies, and people can't switch to another provider. See healthcare, colleges, ISPs, and so on.

Either way, one should be wary of large organizations, regardless of their type such as governmental or corporate.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER37> Twitter requires phone numbers.

I wonder if the millions of US Americans whose stimulus checks got "lost" are somehow correlated to people that have criticized Trump on twitter.

<comment><USER38> That's some next level paranoia.

</comment></comment><comment><USER39> >Twitter has argued it free speech rights are violated

That's rich coming from a company famous for censorship.

</comment><comment><USER40> Maybe if we stopped voting with single issues in mind we could see that we have been funding terrorists with every new congressional budget bill for a long ass time, and the real way to stop terrorism is to defund our government sponsored terrorists who we know commit crimes every day, instead of worrying about terrorists we don't know about yet but need to find because our local terrorists tell us we need to. Just saying.</comment>


The first seven new generic top level domains are available Feb. 2 - <AUTHOR> http://robb.weblaws.org/2014/02/01/here-they-come-seven-new-generic-top-level-domains-available-feb-2/

<comment><USER2> .io is old news: get a .plumbing for your IaaS startup.

<comment><AUTHOR> Lol. That's not a bad idea at all.</comment></comment>


Ask HN: What're your favorite nutritious, cheap, and tasty recipes? - <AUTHOR> For those of you who like to optimize for several or all of...
1) Cheap
2) Easy/quick to make
3) Nutritious
4) Delicious
...what are your favorite recipes? <comment><USER2> Caesar salad with chicken or hard-boiled eggs:

\- rinse lettuce \- tear lettuce \- add commercial Caesar dressing of choice \- toss lettuce with dressing \- add a handful of croutons, a spoonful of Parmesan, and a few slices of grilled chicken or chunks of egg. Voila.

Per meal, the croutons turn out to be the most expensive ingredient, oddly enough (if you go with eggs rather than chicken). A good head of romaine costs under $5 and will make 2-3 salads. The chicken/eggs you can either buy pre- cooked, or prepare a few meals' worth in advance over the weekend - and use for other recipes. 5 minutes prep, tops.</comment>


Pgsql: Support Grouping Sets, Cube, and Rollup - <AUTHOR> http://email@example.com

<comment><USER2> I was just looking at the wiki page [https://wiki.postgresql.org/wiki/Grouping_Sets](https://wiki.postgresql.org/wiki/Grouping_Sets) yesterday hoping that one day it would be in.

I now see that postgresql is the one true database. Everyone should abandon all other databases that don't have special features (ex: sqlite embedded).

<comment><USER3> > Everyone should abandon all other databases that don't have special features > (ex: sqlite embedded).

SQLite embedded _does_ have special features. It's embedded.

<comment><USER4> I believe GP used that as an example of what _not_ to abandon

<comment><USER3> Is "ex" short for "example" or "except"?

<comment><USER2> I use it for both. In that case it was 'example'.

</comment></comment></comment></comment></comment><comment><USER5> Wish they'd give some example sql statements to fully appreciate it.

<comment><USER6> It's on the developer version docs: [http://www.postgresql.org/docs/devel/static/queries-table- ex...](http://www.postgresql.org/docs/devel/static/queries-table- expressions.html#QUERIES-GROUPING-SETS)

<comment><USER3> Also here: [https://wiki.postgresql.org/wiki/Grouping_Sets](https://wiki.postgresql.org/wiki/Grouping_Sets)

</comment></comment></comment><comment><USER7> PGSQL just keeps getting better! Even gives Oracle a run for its money in a lot of areas.

<comment><USER8> I am a huge fan and advocate of PG but just for some perspective: CUBE and ROLLUP were present in SQL Server in the '90s.

<comment><USER9> I agree with you about PostgreSQL being late at adding these features, but SQL Server added CUBE and ROLLUP in 2008. They had GROUPING SETS longer, I think since 2000.

<comment><USER8> Here's an article on them from '99\. Version 6.5 was released in '96.

[http://sqlmag.com/database-development/sql-server-65-cube- ro...](http://sqlmag.com/database-development/sql-server-65-cube-rollup)

</comment></comment></comment></comment><comment><USER10> So does this mean I could use pg instead is SSAS for cube analysis?

<comment><USER11> SSAS and other cube (MOLAP) tools create persistent cubes as materialized views. Databases that do ROLAP processing create "cubes on the fly" which persist for the duration of the query.

If PG adopts a materialized view that supports controlled automatic maintenance, then you'd have something similar to what the MOLAP tools do.

Note that MOLAP is a trap of sorts (no pun intended).

<comment><USER10> What makes MOLAP a trap? I'm only generally acquainted with cube analysis.</comment></comment></comment>


The US or Europe? Where do you get a better deal working at a startup? - <AUTHOR> https://hackernoon.com/leave-silicon-valley-why-did-you-even-move-to-silicon-valley-4f11d7fd04f2 <comment><USER2> > A great position in France as a software engineer would be advertised > €54,000 per year ($67,660), whereas the same job would probably get you > around $105,000 a year in Silicon Valley.

So a "great position" in France is equivalent to an internship in Silicon Valley?

</comment><comment><USER3> California is the most expensive US area and when compared you still were better off financially.

If the author compared lived in Austin, Texas for example, you would receive WAY more disposable income.</comment>


Comparison of SSL Labs TLS Scores with Different Go Versions - <AUTHOR> https://aoeus.com/gotls/ <comment><USER2> I'd observe that this is testing the _default_ TLS configuration when you ask net/http to "Just TLS that connection for me, will you?" with no further details. I imagine almost any version could get to A- if you configured it (PFS seems like it may have been a feature that had to be added), and per selectnull's point about Strict Transport Security, you probably should not output that header by default so an A+ with a default configuration would arguably actually be a bad thing.

I certainly do not mean this is an unfair question to ask; quite the contrary! (It has been said "defaults matter", but I'm really coming around to the idea that even _that_ understates the truth. Options _almost_ don't matter. They do. But just barely.) More people should ask this of more code. I just want to make sure non-Go programmers understand what is being said here, that this is the _default_ , not the _top capability_ of the built-in Go TLS stack of those versions.

<comment><USER3> An HSTS default would probably be a good thing, but HSTS is hard to undo, because it's cached in browsers. We'd all be better off if net/http served HSTS by default, but individual users of the library might not be.

<comment><USER2> Half in my spare time, half at work I'm working on a Go web framework that tries to turn the web "default deny", and to do so with good API design that makes the default safe (so, it's a lot harder than just "write a middleware that slaps some headers on top"). I'm willing to be a bit of a jerk about cookies (if you _want_ the client to be able to read it, say so, etc.), I'm willing to make you _say_ "Look, just turn off CSP" if that's how you're going to roll... but even as much of a jerk as I'm being, I'm shying away from defaulting HSTS to on. I'm currently thinking of making it simply not defaulted; take a stand one way or the other, but just _defaulting_ it to on is a bit scary.

<comment><USER3> If I was building a framework, I'd probably force users to select an option, rather than providing a silent default either way.

The right option name for this is probably "Protect against HTTPS-stripping".

<comment><USER2> Thank you for your confirmation, I will do that then.

Not sure when or frankly even if it will go public, but I hope it will. Still have a lot of work to do on it before it's worth anything.

Edit: Also, thank you for the name suggestion. One of the other things I've noticed is that a lot of web security is... well... let's say, named in a way that does not always make it clear exactly what it means. I'm trying to make this stuff more clear in the naming too.

</comment></comment></comment></comment></comment><comment><USER4> For those who might not be aware, the highest SSL Labs grade is not A, but A+.

To score A+ you must score A and additionally set HSTS headers with long duration (I use 2 years, haven't tried with less). For example, with Nginx you use something like:

        add_header Strict-Transport-Security "max-age=63113904;";

<comment><USER5> If you use Hiawatha you get A+ with out of the box settings.

Just plugging it because it constantly outperforms my expectations and PolarSSL (now mbed owned by Arm), has avoided many of the recent openssl issues making my life less worrisome, but the dev doesn't really advertise or push it and relies on word of mouth more than anything.

It's worth checking out.

[https://www.hiawatha-webserver.org](https://www.hiawatha-webserver.org)

<comment><USER3> Zero is the number of TLS experts I know that would unreservedly recommend PolarSSL over Go's crypto/tls. I know several who wouldn't even recommend it over OpenSSL, but it's worth remembering that not only does Go's TLS not use OpenSSL, but it's curated by one of the world's experts in TLS security.

Go has one of the best TLS stacks in the world, and I expect the distinction to become starker in the future; in a few years, barring something unexpected from something like BoringSSL, it may end up being unquestioned best TLS stack.

<comment><USER6> > _Go has one of the best TLS stacks in the world,_

Go suffers a bit from weak random numbers though (crypto/rand Read() output), says dieharder at least: [http://nopaste.narf.at/show/31060/](http://nopaste.narf.at/show/31060/)

I'm not sure how severe that is...

<comment><USER3> Horseshit. Go's crypto reads from urandom, just like Nacl.

</comment></comment></comment></comment></comment><comment><USER7> It's amazing how much this line of code actually makes happen;

      http.ListenAndServeTLS(":443", "cert.pem", "key.pem", nil))

A full HTTP and TLS stack ready to start dispatching requests to your callbacks. I know there are other languages that can do the same, but I still think it's impressive. I've written just a few thousand lines of Go and while I'm pretty sure I'm not really "doing it right" I was able to port some decent complexity C# and very easily had all cores processing data at a higher overall rate with the Go code. High level libraries like this, and managed memory makes it almost feel like a scripting language, but with all the advantages of a compiler.

Operational question... If you're terminating client-side TLS like this, then does that mean either it's a single server or you have L4 (or lower) load balancing in front of it? I assume it's more common to have haproxy or nginx or something like that in front terminating TLS, with the API servers sitting behind.

</comment><comment><USER8> In addition to SSL Labs, I also find this useful for things that are not exposed to the internet. (firewalled)

[1] [https://github.com/drwetter/testssl.sh](https://github.com/drwetter/testssl.sh)

It only depends on OpenSSL and bash. I find it very useful for reviewing our systems before they go live.

<comment><USER9> Thanks, you read my mind! :)

</comment></comment><comment><USER10> Hmm what is HSTS preloading.

I have to catchup on the latest TLS stuff every few months.

So what is the default preferred cipher suite string for Go 1.6 ? I worked out my own a couple years ago and it still gets an A rating on SSL Labs

<comment><USER11> [https://tip.golang.org/src/crypto/tls/cipher_suites.go#L75](https://tip.golang.org/src/crypto/tls/cipher_suites.go#L75)

</comment></comment><comment><USER12> I wonder what the results would be for 1.5.2 (the version which had the bug in key generation). Has anyone check this? If not, I'll do it when I have time later today.

<comment><USER13> It will be exactly the same as 1.5.3 normally since no feature are added in those releases. The key generation problem had no visible impact on the tls negociation, it simply resolved a flaw in the key generation process.

</comment></comment><comment><USER12> Heh. Looks like the cipher suite options are outdated for this site (so it probably wouldn't pass an SSLabs test).

</comment><comment><USER14> The HTTPS connection of the website (aoeus.com) uses SHA-1.

<comment><USER14> Link to result [https://www.ssllabs.com/ssltest/analyze.html?d=aoeus.com](https://www.ssllabs.com/ssltest/analyze.html?d=aoeus.com)</comment></comment>