The Google Analytics Setup I Use on Every Site I Build - <AUTHOR> https://philipwalton.com/articles/the-google-analytics-setup-i-use-on-every-site-i-build/ <comment><USER2> It's pretty annoying that I have to create spam filters for Google Analytics to be useful. Every site I've installed GA on has required me to filter out spam. I don't understand why something isn't done about it at an engineering level. If site owners can set up filters against spammers, is it really that hard for Google to do it? Especially since they can see it across their accounts. Seems like it's the same type of issue that plagues email, yet Google seems to have that under control.

<comment><USER3> You can get around this with some fairly simple hacks. Write some JavaScript that evals a part of your page or something crazy like loading part of itself from Rot13 text file. Have this js generate an ID you can identify as 'real' or 'fake'. Filter your analytics by this ID. If you want to be extra funny make real and fake IDs look indistinguishable to human eyes.

99.9% of spammers are too lazy to spend any time figuring this out for a single site, and their tools won't even tell them spam isn't working. I've gotten away with adding a simple static ID to everything and except for really large juicy targets spammers don't even watse time on this.

All of my sites get zero spam with this filter

<comment><USER4> Can you elaborate on that? How do you make the real and fake ids?

<comment><USER3> The spammer bots are so dumb that using anything besides default "pageview" events seems to work

</comment></comment></comment></comment><comment><USER5> Echoing what others are saying, I much prefer Google Tag Manager. Many clients use a CMS which make injecting dynamic variables into a page a bit of a pain if it's not done via rules at runtime.

The Next Web has open-sourced its Google Tag Manager setup ([https://github.com/thenextweb/gtm](https://github.com/thenextweb/gtm)), which has things like Scroll Tracking, Engagement Tracking (riveted.js), Outbound Link Tracking and lots of other things that are not in the default GA setup. They have recently added support for AMP.

In my experience it allows clients to get up and running with a useful GA setup in a couple of hours and means that you as a developer don't get bothered to make trivial changes.

<comment><USER6>
      Scroll Tracking, Engagement Tracking (riveted.js), Outbound Link Tracking and lots of other things that are not in the default GA setup.

I understand why a site owner would want those things, but as a user it is terrifying! This is why I run an ad blocker.

<comment><USER7> Tracking & analytics are great, but respect for user privacy should be greater. The current state of analytics is too intrusive to user privacy. Hence we decided to get rid of all analytics from our website ([https://ipapi.co](https://ipapi.co)). </Shameless plug>

</comment></comment></comment><comment><USER8> With the surge in Ad Blocking recently, part of me wonders how accurate the Google Analytics JavaScript tracker is today, and how accurate it will be in 5 years. I wonder if we'll see a trend back to server-side analytics soon.

<comment><USER9> The percentage of visitors with an ad blocker depends on your site's audience. Outside of computer geeks and gamers, almost no one uses ad blockers. I wouldn't buy into the hype that the whole world is installing ad blockers.

<comment><USER10> This is correct. The vast vast majority of people are not using adblock.

<comment><USER11> Sometime ago I read an interesting interview[1] with the Economist deputy editor, Tom Standange, saying things like:

> The other thing about ads is that 41 percent of millennials are using ad > block. My daughter has ad block and she goes around infecting every machine > she gets to. She puts it on everything.

> But the other thing is that she lives in incognito mode. She's a total > nightmare for advertisers, because she's not leaving any cookies and she's > not seeing any ads.

Digital privacy is an undeniable rising trend. Just stating _the vast majority of people are not using adblock_ is, at minimum, shortsighted.

[1]: [http://www.niemanlab.org/2015/04/the-economists-tom- standage...](http://www.niemanlab.org/2015/04/the-economists-tom-standage-on- digital-strategy-and-the-limits-of-a-model-based-on-advertising/)

<comment><USER12> > But the other thing is that she lives in incognito mode. She's a total > nightmare for advertisers, because she's not leaving any cookies and she's > not seeing any ads.

Seems like she has the right idea to be honest.

</comment></comment></comment></comment></comment><comment><USER13> Please don't contribute to Google's tracking dominance over the web. How insane is it that one company runs their javascript on 90% of the web?

<comment><USER14> What are the best alternatives?

<comment><USER13> piwik or just grep your nginx logs.

<comment><USER15> Grep? Is that something I need a sysadmin for? /s

</comment></comment></comment></comment><comment><USER16> Remember that it's mandatory to disclose to visitors that your site uses Google Analytics in their T&C's [https://www.google.com/analytics/terms/us.html](https://www.google.com/analytics/terms/us.html) (section 7, 'Privacy'). I don't see a privacy policy on this Google employee's page but perhaps they have a special exemption?

Anyhow, for many websites you'll get more accurate traffic data with GoAccess parsing your logs and showing you page views and basic demographic data. Use it alongside Google Analytics if you must, to see the exact difference between what Google tells you your page views were versus what your server tells you.

<comment><USER17> > for many websites you'll get more accurate traffic data with GoAccess > parsing your logs and showing you page views and basic demographic data

Yes but remember that bot traffic may be more of an issue when analysing server side logs (a lot of bots still don't execute JavaScript).

It's hard to know how effective the bot filtering features in GoAccess are compared with those of Google Analytics.

<comment><USER18> > a lot of bots still don't execute JavaScript

I operate a service that measures this (see another comment on this discussion), and all I'll say is you'll be very surprised how many bots actually execute JS, especially stealth bots. You have to be careful either way.

<comment><USER17> > all I'll say is you'll be very surprised how many bots actually execute JS

Interesting. Do you have any numbers you can share?

<comment><USER18> I don't have access to the raw log files from the customers, so can't give you a percentage. All I'll say confidently is that my service processes a lot of bot traffic that needs to be filtered out before reporting.

BTW, are you the same Peter Hartree on this Segment thread? [https://community.segment.com/t/1889n1/how-common-is- client-...](https://community.segment.com/t/1889n1/how-common-is-client-side- tracker-blocking-how-can-i-find-the-percentage-of-visitors-that-block-google- analytics-on-my-website) It would appear we've crossed paths before on this topic. Please do email me if you want to talk properly. That Segment thread has my email.

</comment></comment></comment></comment></comment><comment><USER19> Not many people know about this feature of GA, but add the following to anonymize your users IP addresses before sending the information to Google.

> ga('set', 'anonymizeIp', true);

<comment><USER20> > anonymize your users IP addresses before sending the information to Google

That's a nice placebo that does almost nothing. Even if the packet body doesn't contain the IP address, it's still available in the IP header's Source Address field.

However, even if we assume Google - in a reversal of their general focus on gathering as much data as possible - _doesn 't_ recover the address from the IP header, their own documentation[1] for analytics collection URLs with the &aip=1 parameter (which should be present when 'anonymizeIp' is true) says:

        "... the last octet of the user IP address
         is set to zero ..."

Zeroing the least interesting 8 bits of the address doesn't make it anonymous. They still get to record the ASN, and they are recording at _least_ 8 bit of fingerprintable data from other sources. I should be _trivial_ to recover mostly-unique users, and calling this "anonymization" is at best naive and for Google, an obvious lie.

Their documentation even betrays their intentions:

        "This feature is designed to help site owners comply
         with their own privacy policies or, in some countries,
         recommendations from local data protection authorities,
         which may prevent the storage of full
         IP address information."

Actually making the data anonymous isn't the goal. They just want a rubber- stamp feature that lets them comply with the letter of the law.

[1] [https://support.google.com/analytics/answer/2763052?hl=en](https://support.google.com/analytics/answer/2763052?hl=en)

</comment></comment><comment><USER21> It looks like navigator.sendBeacon is not very well supported across browsers. [1]

Is this really a good idea?

1: [https://developer.mozilla.org/en- US/docs/Web/API/Navigator/s...](https://developer.mozilla.org/en- US/docs/Web/API/Navigator/sendBeacon)

<comment><USER22> analytics.js falls back to the older methods in unsupporting browsers.

</comment></comment><comment><USER23> Alternative title: The Spyware I Use on Every Site I Build

</comment><comment><USER24> Tag Manager is definitely preferable in my experience if you want to empower non technical people such as marketing to make their own changes on the fly without having to bother developers.

<comment><USER25> Yup, GTM is great until the folks in marketing add a script to the site without first testing in preprod that causes the UI for the app to not render.

</comment></comment><comment><USER26> Don't feed Google with your visitors' data, respect their privacy, use open source Piwik instead.

</comment><comment><USER27> What's the deal with stats delayed over 24 hours? Man, I hate that.

</comment><comment><USER28> Beyond this info, I'd add my own suggestions from having spent a good portion of my career digging around in GA...

\- If you have multiple domains, sub domains, etc. make sure to spend plenty of time reviewing the cross-domain setup documentation and test it thoroughly.

\- If you have high volume, frequently do deep segmentations, use lots of custom dimensions, etc., make sure you have a clear understanding of how sampling in GA works, how to tell if you are being sampled, and find ways to avoid it by pulling reports in different ways. Otherwise you can end up in a situation where you are making decisions off of .3% of your traffic and while Google's sampling algorithm thinks it is fine, comparison against other data sources often shows it is not.

\- Make sure any reporting you do across things like GA vs. AdWords is done with a clear understanding of how they each report on paid search. GA reports on it by default on a last non-direct click basis. AdWords just counts everything AdWords touches. This means that AdWords can give you a good sense of where you are gaining traction, whereas GA can help you understand how it works in conjunction with other touch points, and perhaps how you might change the way you weight things and measure success.

\- GTM is powerful and free, but with great power comes great responsibility. Also, it can be a real PITA sometimes.

\- Annotations are a highly underutilized tool in GA and can save you a lot of headaches. I just wish there was a way to bulk import/export them via spreadsheet or API.

\- You can't currently create goal funnels from event-based conversions (please Google add this!), but the workaround for the time being is to push virtual page views at the same as the event fires, and then create funnels off of those.

\- User stitching sounds awesome, but is actually much more limited than you'd think from reading overview. You need a separate view (which means your main GA view you use can't segment for the stitched sessions for comparison--just the new view which only contains the stitched users). And there's a 90 day rolling data retention window, so you need some sort of export process if you care about that data. Unfortunately, this is pretty important data if you have lots of cross-device tracking issues.

\- Depending on your volume, you can reach the hit limits of the free tier pretty quickly if you start tracking a ton of events (since they all count as hits). Here's a good overview [1] of what these limits are, how they work, and what they mean for you. When I got the scary notification, Google was exceptionally unhelpful in working with me to resolve the problem, despite considerable ad spend. After reducing them to what we thought would be fine, they were unable to assure me that our data would not be nuked, and basically couldn't give me any real info beyond "this is the policy." Super frustrating.

\- If you have good logging of events that tracks both server and client-side, it is healthy to compare for variances monthly or quarterly. You'd expect client-side tracking to break more often than server-side, but it is important to see how much that can alter your numbers.

[1] [https://www.e-nor.com/blog/general/hit-count-in-google- analy...](https://www.e-nor.com/blog/general/hit-count-in-google-analytics)

</comment><comment><USER29> Filtering out GA sessions with the language of "C" (versus actual languages like en-us, fr, etc.) goes a long way in filtering out GA spam.

This language code is 99% of the time associated with bots. I had one site where 20% of all the sessions in a given month was such fake traffic!

<comment><USER28> Isn't that a relatively easy thing for a spammer to change? Also, I'm seeing some valid traffic coming in with that language (conversions and everything).

<comment><USER30> Most won't bother

<comment><USER28> Sure, but even still, if I'm seeing valid traffic with this, then on its own it isn't sufficient to use as a filter.</comment></comment></comment></comment>


Does saying "Fuck You AWS" constitute offensive content? - <AUTHOR> http://thoughts.josephdeon.me/2020/07/02/fuck-you-aws.html <comment><USER2> I made fourteen requests over sixteen days to delete my amazon.com account.

I followed up and re-submitted almost every day. Each time I was told to wait 24-48 hrs and someone would contact me to complete the process, and I would follow up 24 hours later to repeat the process over again when nobody contacted me.

When I finally gave up, Something like a week of 1+ hour/day chats, I deleted all of the information I had control over (address, CC's, etc) to "anonymize" it at the very least. I then had a very juvenile idea to change my preferred first name to "FUCK" and lastname to "AMAZON" and made one last request.

Customer support deleted my account within the hour, no multi-step process, no "customer support specialist will contact you in 24-48hrs", just an immediate deletion. Finally!!!

I've also learned a good lesson — delete any new online account after you create it, before conducting business. if it isn't easy to do, then don't use the service. Otherwise, create another. Most sites are just a button, or a chat request, but Amazon was very ridiculous, (equal to airbnb, which required me to send a photograph of myself and my DL, and then replied to say I have to wait another 90 days and do it again?!)

<comment><USER3> I think what we've learned is that if you start a new support ticket about the same thing, the old one gets ignored.

</comment></comment><comment><USER4> All content is "objectionable" depending on the audience. We just have to trust our new Amazon overlords.

I like AWS and the general concept of cloud computing, but I'm extremely concerned about how difficult it appears to be to transition from one solution to another. As someone working on an AWS app, I'm worried about the possible day where my employer announces that we're moving everything to Azure or some other platform.

The lack of compatibility between cloud computing platforms makes it difficult to switch when issues like this come up. I suspect in most cases, it's just more economical to stick with the current provider and hope you aren't impacted in the future. Because of that, I doubt providers like Amazon see much immediate impact from things like this.

<comment><USER5> These are the reasons that I refuse to build any of my projects on some cloud provider's special snowflake solutions.

<comment><USER6> You mean this? [https://aws.amazon.com/solutionspace/financial- services/solu...](https://aws.amazon.com/solutionspace/financial- services/solutions/snowflake-data-warehouse/)

<comment><USER5> Haha, no I didn't mean that service in particular. I was using 'special snowflake solution' as a derogatory term for the branded and managed services that cloud providers sell.

<comment><USER6> Sorry, I should have made it clear I was joking :)

<comment><USER5> I figured but you never know. Sarcasm doesn't translate well over the internet.

</comment></comment></comment></comment></comment></comment><comment><USER7> "If this post gets removed then I know I have not fully achieved my ownership goal and it might be time to just host on a pi."

If the post does not get removed you do NOT know that you have fully achieved ownership. The simple fact that that clause exists means you do not have full ownership.

Hosting on a pi might not make much difference as most ISP's have similar clauses in their EUP's.

The only way to come close to "full ownership" I can think of would be by either owning the entire stack to the reader or maybe some encrypted p2p system. Does anyone have any practical suggestions?

<comment><USER8> Leaving aside whether the clause itself is objectionable, since when does "full ownership" mean you can do whatever you want? Am I allowed to drive my car on public roads without a license?

<comment><USER9> No, but you can drive unlicensed vehicles -- even vehicles that could _never_ be licensed -- on private land.

<comment><USER10> Sure, but the equivalent would be to host your content on a Raspberry Pi that is not connected to the internet. What would be the point ?

<comment><USER9> True. But you could host on a Pi via Tor, as an onion site.

<comment><USER10> I don't understand the premise. Why would one expect to be able to interact with the world without any consequences ? That makes little sense, philosophically, at least to me.

Even hosting via Tor can have consequences, if the government has enough incentive.

However, practically speaking, I think the OP would probably be fine posting on AWS, as others have remarked.

<comment><USER9> > Why would one expect to be able to interact with the world without any > consequences ?

Because you're not free if you can't do that.

> Even hosting via Tor can have consequences, if the government has enough > incentive.

Then you can chain Tor with other anonymity networks. Such as nested VPN chains, Orchid, or LokiNet.

Based on what I've seen, people have generally been pwned because they screwed up, and not through fundamental compromises.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> These are rules specifically written for selective enforcement on case by case basis.

<comment><USER12> Thats it, move on

</comment></comment><comment><USER13> Doesn't matter:

"The examples described in this Policy are not exhaustive. _We may modify this Policy at any time_ by posting a revised version on the AWS Site. By using the Services or accessing the AWS Site, you agree to the latest version of this Policy."

Everyone uses AWS at the complete discretion of Amazon.

<comment><USER14> > Everyone uses AWS at the complete discretion of Amazon

Isn't this totally obvious?

What might be more interesting to note, and what the author is testing for, is if/when these cloud providers change the rules of their discretion often or abruptly. But of course we're all at the mercy of these private companies when we run on their hardware.

<comment><USER15> Which is an argument for "common carrier" type regulation. Railroads once had a similar monopoly position. They could refuse to carry items from one shipper to favor another. In the US they have an obligation to provide "reasonable service for a reasonable rate upon a reasonable request from a shipper".[1] There's long history around this, and it may be time to apply it to some Internet services.

[1] [https://www.ams.usda.gov/sites/default/files/media/Railroads...](https://www.ams.usda.gov/sites/default/files/media/RailroadsCommonCarrierObligation.pdf)

</comment></comment></comment><comment><USER16> Well; speaking candidly: I once called one of our internal datacenters "trash" (for not meeting specifications, having no local support, overloaded switches and inconsistent hardware platforms) and I got a written warning for it.

So, yes. I would say it constitutes offensive content.

<comment><USER17> Isn't this totally unrelated? In your case it was your employer reprimanding you for your performance on the job. In OP's case it's him acting in his own capacity.

<comment><USER16> You're right of course, but we're treating developers (and developer spaces) as being professional settings.

Gone are the "underground hacker" days, as Antirez put it, so I think it applies.

</comment></comment></comment><comment><USER18> I ultimately got booted off twitter for a tweet that said:

"Dear @AmazonUK AI, please kill yourself now".

This clearly wasn't aimed at a human but their Artificial Intelligence.

Attached to the tweet (to provide the tweet with some context) was a screenshot of it recommending a whole bunch of those Hello and Chat type B-list celeb trash gossip mags. Items I swear I have never browsed for on Amazon, let alone a newspaper.

I was reported, possibly by @AmazonUK, or detected by Twitter's own idiot AI for "promoting or encouraging suicide or self-harm". FFS.

Despite my attempts to appeal I gave up. It counted towards my three strikes (one was a Frankie Boyle kinda joke about why no-one had had a pop at trump with a gun, buggered if I can remember the other, I think I may have used the "c" word).

Turns out I need to tailor things I say, that wouldn't be considered offensive in a Scottish pub, to Twitter's puritanical view of the world. But it's their shitshow and @jack can go fuck himself.

Edit: just to be clear, I've never encouraged anyone to kill themselves or "die in a fire". The Trump tweet was clearly a bad joke and in no way could be construed as encouraging anyone to try and assassinate the US President, nor anyone else. The "c" word was not aimed at anyone in particular other than the Scottish Conservative and Unionist party, who're pretty much considered fair game in Scotland.

<comment><USER19> So you told a support representative from Amazon (you should realize there are humans behind these accounts) to kill themselves, suggested someone should kill the US president, and "possibly used the 'c' word", and you're wondering why a US-based company might be offended by that?

That's basically a list of the three most offensive things you could possibly say in America. Of _course_ you were banned for it.

<comment><USER18> Unsure if _/ s_ or a smiley needs to be appended to your comment ;) I hereby invoke Poe's Law.

<comment><USER19> No. No Poe's Law, no /s, no smiley. Maybe things are different in Scotland but in the US if you tell someone to kill themselves and say the US president should be killed, that's about as serious an offense as I can imagine. It doesn't even matter how you feel about the US president, you could be the most anti-Trump person in the world but you still shouldn't expect to say someone should kill the US president and expect that you'll have zero repercussions for it.

<comment><USER18> Then I think you should read my post again. It's pretty clear none of what I said was to be taken _literally_. If that's the case then you're suggesting that the average US citizen's ability to perform reading comprehension is even worse than I thought and I simply do not cannot believe that.

<comment><USER19> It doesn't matter how you _intended_ for it to be taken. If you jokingly told someone to kill themselves and they did actually kill themselves, would you hide behind "they should have known I was joking"?

I read your post three times before I first commented to make sure I wasn't misunderstanding. What you claim to have said is horribly offensive and I can't believe you're trying to shrug it off as no big deal. Maybe it's a cultural difference, but hopefully what you're learning is that it may be okay to tell a human being to kill themselves in Scotland but that is not considered acceptable in the US.

<comment><USER18> > If you jokingly told someone to kill themselves

I jokingly told an inanimate piece of software to kill itself, AI's are not people, they're machines running lines of code. But I see no point continuing to justify my "cultural" differences in the use of speech other than to say that I've known enough US folks to know that your reaction is something of an outlier. If this is truly how you feel, then I'd be curious to know how the US managed to survive having George Carlin or Bill Hicks on their tellies.

<comment><USER19> The difference is they are comedians who were commissioned to tell jokes to an audience that is expecting to hear jokes. Meanwhile you told an Amazon employee to kill themselves because you didn't like the output of the technology their company offers.

Again... there are humans behind these Twitter accounts.

<comment><USER20> @teh_klev explicitly addressed his comment to an AI. Perhaps you're not familiar with it, but this is a common acronym for [https://en.wikipedia.org/wiki/Artificial_intelligence](https://en.wikipedia.org/wiki/Artificial_intelligence). Your comments are all saying the same thing and all deliberately or not missing the point that he was explicit in that he wasn't addressing a human. Any human that creates an account called "Amazon AI" can expect to receive content suitable for an AI.

<comment><USER19> They didn't create an account called "Amazon AI", they created an account called "@AmazonUK" which is what was referenced in the original comment. @AmazonUK has a human behind the account, not an AI.

<comment><USER21> And the tweet was directed at "@AmazonUK AI". It was clearly a response to something on the website, not anything the human did.

Would "@AmazonUK's AI" be clearer and satisfy you?

<comment><USER19> I would prefer humans not tell other humans to kill them selves because believe it or not some people actually do and some people really miss those people.

<comment><USER21> I agree, while noticing that such an event did not happen here.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> Disclaimer: I'm not a lawyer.

My understanding is that when interpreting the law and legal documents like a ToS or EULA things within a list are interpreted to be related to one another. So objectionable" doesn't literally mean anything anyone finds objectionable ever in perpetuity throughout the universe, it means "this list is not comprehensive, other things like the things in this list count". If you added 'saying fuck AWS' to the rest of that list would it make sense in context? The answer is pretty clearly 'no', so that would not be covered. And before someone says "well some people probably thing swearing is as bad as the other things in that list", the law also frequently defines things like this in terms of what a "reasonable" person would think. There is wiggle room, but for things where it's easy to get general consensus, not a lot. Again, not a lawyer, grain of salt, all that.

</comment><comment><USER23> There's certainly no shortage of "fucks" already on S3, so I'm guessing AWS doesn't give any about them.

[https://buckets.grayhatwarfare.com/results/fuck/](https://buckets.grayhatwarfare.com/results/fuck/)

</comment><comment><USER24> I vote for pi hosting :)

</comment><comment><USER25> I was wondering if they'd try something like that for [https://www.lastweekinaws.com--it's](https://www.lastweekinaws.com--it's) critical of them, and they've had a few angles over the years to go after it (trademark, suspending the domain, etc).

Years into the experiment I can safely say that their tolerance for criticism extends far beyond what I'm willing to test out, as I am not a human dumpster goblin.

</comment><comment><USER26> Are there any hosting providers that claim the opposite? Who has a ToS that specifically allows the items in AWS prohibits?

</comment><comment><USER6> This reminds me of Douglas Crockford's classic story about the JSLint license containing a "The software shall be used for Good, not Evil" clause: [https://www.youtube.com/watch?v=-hCimLnIsDA](https://www.youtube.com/watch?v=-hCimLnIsDA)

</comment><comment><USER27> The author should AB test two pages on different accounts: one insulting AWS and the other Bezos.

</comment><comment><USER28> Half of the spam I'm receiving comes from Amazom web services.

> I am Mark Ben John Bill. from FBI unit,i have been instructed by the FBI > Director Christopher A. Wray, to inform you that out of our thorough > investigation lately , we found out that one of the abandoned valid Packages > such as ATM Cards And Consignment Boxes by diplomatic agents who complained > that the beneficiaries failed to pay for the anti terrorist clearance > certificate to guide and show that the fund is no way related to fraud or > drug money,with the information we have here , we found out that one of the > funds belongs to you and it worth the sum of $10.5 million US Dollars.

So, IMO, Fuck you AWS, I'm rich now!

<comment><USER26> Why do you say this comes from AWS?

<comment><USER18> Likely spam originating from AWS IP addresses.

<comment><USER26> AWS IP addresses are blacklisted by most email providers...

<comment><USER18> I'm not sure that's true, I've successfully dispatched SMTP mail from their platform without it getting blocked or tagged as spam.

<comment><USER28> To be fair, the ratio of spam received from EC2 has dropped in the last month, something has definitely changed (or I'm not a target since then).

I'll let you know.

</comment></comment></comment></comment></comment></comment><comment><USER29> I think the author is taking the legalese too seriously and reading too far into the phrase "otherwise objectionable."

This is just a standard abuse TOS. Yes, "otherwise objectionable" casts a wide net, but I think in the legal understanding of the sentence it's supposed to refer to "similarly egregious things that a judge would agree were in this same relative severity of abusive content."

A judge wouldn't simply allow "otherwise objectionable" to mean "literally anything."

I would also point out that if you host abusive/illegal content on your own PC your ISP can shut you down just the same.

<comment><USER30> I think the legalese should be taken seriously!

For instance, we can draw a comparison to recent controversy with social media platforms. Do you think that social media platforms should be able to remove any content on their platform, regardless of legality? I believe that they can! Otherwise objectionable is hopefully that catch all.

I view the OP as a bit of a misguided test. The blog post, in all likelihood, will remain up. The control the authour speaks of will still remain in the cloud provider's hands.

<comment><USER8> If you're going to take "legalese" seriously, what you need to take seriously is what it _means_ , which is often slightly different from what it appears to say to a non-lawyer.

</comment></comment></comment><comment><USER31> Of course it does, it mentions Amazon, and that's quite offensive.

</comment><comment><USER32> Wear that on a t-shirt at AWS Reinvent and see what happens.

</comment><comment><USER33> Amazon is pretty lenient. You have to screw up really badly to lose your AWS account . I have noticed this it be the case for almost all cloud-based hosting services except of of course dropbox.

</comment><comment><USER34> Unless and until we start regulating cloud providers and social media companies as utilities then these issues will continue to present themselves.

</comment><comment><USER35> Is there a reason to say "Fuck You AWS" other than to cause offense? It's certainly devoid of any meaningful criticism.

<comment><USER9> Well, he'd want to say that _after_ they had nuked his page ;)

</comment></comment><comment><USER36> No, this will not be removed. Just like "we might kick you for any reason or without reason" is not a clause you can test-violate.

This specifically sounds like the clause you'd use to kick sites like The Daily Stormer out that are just universally despised and put a large amount of political pressure on whoever enables them, no matter if they're just a "neutral transit provider" or not.</comment>


Ask HN: How to apply to YC late seed funding (1M+) - <AUTHOR> YC makes lot of investments in later seed funding other than the typical 120K investment; such as investment in  https://www.crunchbase.com/organization/castle-2#/<p>my question is how to reach/apply-to YC for such funding other than someone who knows a YC partner or firstname.lastname@example.com <comment><USER2> I thought that was limited to YC companies?

</comment><comment><AUTHOR> that's what I thought, the startup castle, does not look like a YC company.</comment>


Facebook Platform was down - <AUTHOR> A check of
https://developers.facebook.com/status/dashboard/ returns an error and I'm unable to login with facebook to some of my mobile apps.
EDIT: Commenters are reporting that this appears to only impact users that are hitting the US data center[1], and that it may only impact users through specific ISPs
1.https://news.ycombinator.com/item?id=18434457
EDIT: Appears to be back up <comment><USER2> This should be an interesting postmortem, if they have one. I think Netflix never released a postmortem of their latest downtime.

<comment><USER3> Unrelated to OP, but did Google ever release a postmortem for the YouTube outage a few weeks back? Was interested to hear the cause of that one.

</comment></comment><comment><USER4> [https://www.youtube.com/watch?v=Rf2tz7_-2NI&feature=youtu.be...](https://www.youtube.com/watch?v=Rf2tz7_-2NI&feature=youtu.be&t=4)

</comment><comment><USER5> Back up for me.

Facebook makes ~$105k in revenue per minute [1]. Since the outage was seemingly only US-based, and it lasted ~30 minutes, this outage probably cost them just over a million bucks.

Pretty staggering to think about.

[1]: [https://ycharts.com/companies/FB/revenues](https://ycharts.com/companies/FB/revenues)

<comment><USER6> > this outage probably cost them just over a million bucks

I have always wondered whether it is accurate to think about it like this. It sure is interesting to know how much companies make in revenue per minute, but it doesn't necessarily 100% translate to lost revenue in an outage.

For example, if I wanted to purchase something on Amazon, but the retail site went down I would not visit another site to purchase it. I would just wait until the site came back up. In that sense, the revenue isn't lost just delayed.

<comment><USER7> That works with e-commerce, but not necessarily with advertising. If you were going to browse Facebook during lunch in the office (and be shown ads), but Facebook is down, then you won't necessarily just "browse Facebook later in the day instead." You weren't on Facebook to _catch up_ ; you were on Facebook because you had nothing better to do.

<comment><USER8> This is definitely true, I expect that users will spend a bit less time on Facebook today.

However, Facebook doesn't have a 100% fill rate of high value ads, so during the rest of the day they'll be showing somewhat more expensive ads to users, earning a higher average revenue. That will make up for some of the loss, despite lower usage.

</comment></comment></comment></comment><comment><USER9> Moving fast and breaking things!

</comment><comment><USER10> Interestingly I VPN'd into a node in Dublin and it is still working there.

Iowa (direct) and SF (VPN) were both erroring out sitewide. Anecdotally it seemed to start in Analytics and spread to Facebook.com and finally to the platform over the course of ~15 minutes. But not sure if that's representative.

</comment><comment><USER11> Using a completely oversimplified estimation method and 2017 revenue numbers, they're losing about $1300 every second their website is down.

<comment><USER12> Not Facebook.com, the platform that Facebook apps are built on I think.

<comment><USER13> It's down for a lot. Seems to primarily be NE US: [https://downdetector.com/status/facebook/map/](https://downdetector.com/status/facebook/map/)

</comment></comment></comment><comment><USER14> So much for the pivot to "move fast with stable infrastructure."

<comment><USER15> They've been down for, what, 20 minutes in the past year?

<comment><USER8> Most of their outages appear to be regional, and only part of their site. This one also appears to have been regional. So it's hard for us outsiders to know the statistics.

These kinds of outages are pretty typical for "move fast and break things" development -- instead of spending huge effort making sure that no outage ever happens, spend effort testing and limiting outages to a small part of production. The intended benefit is much faster development.

</comment></comment></comment><comment><USER16> broken image from static.facebook.com for the logo, too.

</comment><comment><USER17> Looks like they had a little blip [1]

[1] - [https://downdetector.com/](https://downdetector.com/)

</comment><comment><USER18> Yep but only through the Verizon connection. Phone works, Tor connection to FB works, so it's probably localized.

<comment><USER19> I can confirm what you say about Tor. I get the login screen when hitting FB via Tor, but not otherwise.

</comment></comment><comment><USER20> same. downdetector reporting 1200 plus reports of facebook down [https://downdetector.com/status/facebook](https://downdetector.com/status/facebook)

</comment><comment><USER21> From EU:

      Facebook Platform is Healthy
      Since October 23 at 4:10 PM

<comment><USER5> Different data center, looks like the outage is US-based.

</comment></comment><comment><USER13> Strange, I just logged into the website fine from Portland, OR via Comcast

</comment><comment><USER22> Down on latin america too

</comment><comment><USER23> Ideally it would never come back up.

</comment><comment><USER24> Regular login down too.

</comment><comment><USER25> It's working now.

</comment><comment><USER26> Is down here

</comment><comment><USER27> same as well as facebook.com

</comment><comment><USER28> works in EU

<comment><USER29> But does it?

</comment></comment><comment><USER30> same

</comment><comment><USER31> me too.</comment>


Ask HN: What podcasts do you listen to? - <AUTHOR>

<comment><AUTHOR> The Vergecast ([http://www.theverge.com/label/the- vergecast](http://www.theverge.com/label/the-vergecast))

This American Life ([http://www.thisamericanlife.org/](http://www.thisamericanlife.org/))

The Critical Path ([http://5by5.tv/criticalpath](http://5by5.tv/criticalpath))

Startups for the Rest of Us ([http://www.startupsfortherestofus.com/](http://www.startupsfortherestofus.com/))

</comment><comment><USER2> Destination burningman (good for long programming mixes)

Above and beyond(good for long programming mixes)

Charlie Rose

60 minutes

Fast lane daily

Startup for the rest of us

</comment><comment><USER3> NPR - Wait Wait Don't Tell Me

NPR - Car Talk

HBR Ideacast

Soocer Morning

Zencast</comment>


Bill would force patent trolls to pay defendants' legal bills - <AUTHOR> http://arstechnica.com/tech-policy/2012/08/bill-would-force-patent-trolls-to-pay-defendants-legal-bills/ <comment><USER2> This is a largely pointless gesture.

Patent trolls by definition have no assets (technically they're NPE or non- practicing entities). This means that if they lose big, they'll simply declare bankruptcy and move on.

The real problem-- _still_ \--is software patents shouldn't exist _at all_.

If a single device (eg a smartphone) potentially infringes on thousands of patents then you've gone well beyond the intent or usefulness of the patent system.

If this were going to do anything at all, any entity that files a patent violation suit should be required to establish a bond (set by the court) to cover defendants' reasonable fees before the suit can even go to discovery.

The maths of patent trolling is simple:

\- filing suits, issuing C&Ds, etc = $X million

\- potential payoff for settlement or successful litigation = $YYY million

\- probability of winning = Z%

If Y x Z > X then it's worthwhile suing. Filing a bond with the court then change sthis to Y x Z > X + B.

<comment><USER3> The company may be able to collect ownership of the patent from the shell company as payment to cover the legal fees.

This means that a troll would lose the set of patents every time they lost a case. Unless they were willing to outbid the winning party to recover the patents from the shell, in which case the winning party would recover their legal fees.

So it's not pointless. It does increase risk for trolls. Although I do agree that much larger reform would be better. And requiring the posting of a bond is a fantastic idea.

<comment><USER4> Not necessarily. Some of the companies are structured such that they don't own the patent, just certain rights to it. Basically they sue on behalf of someone else which both reduces the risk and also allows the patent owner to claim that they're not the one behind the suit.

I'd imagine that those rights would just be tied up so they weren't transferable (so if the company did go under they would no longer be an asset) and that this structure would become the norm.

What you'd need to do is have the suing company stump up the money in advance into some sort of escrow account (or some other mechanism for proving they can pay).

<comment><USER5> Shouldn't this loophole be closed? Something like: only allow the exclusive owner of a patent to sue potential infringers. That isn't enough to make shell companies a losing proposition, though, because they still contain the risk of losing a suit. I prefer the bond idea, it is a simple and more direct route to making NPEs liable for their actions.

<comment><USER4> Something along those lines might be an improvement but then you have the issue of a parent company in the US not being able to assign those rights to a European based subsidiary to defend them there.

I think it's probably dealing with the wrong problem which is the need for more fundamental reform of IP law.

</comment></comment></comment></comment></comment><comment><USER6> Personally, if software patents can't be done away with or at least reduced in its length, then I would like to see a couple of things happen:

1\. When sued, a defendant has the right to request a review of the patents, which would automatically stay all proceedings until the review is finished. Only upheld patents could then be litigated and if all patents were overturned, then the plaintiff would have to pay all court costs.

2\. Patents holders who sue but do not actually manufacture anything should be awarded reduced damages.

<comment><USER7> Both of these things happen already (well, sort of) under existing law:

1\. A defendant can request reexamination of the patent by the USPTO. There are pros and cons to doing so. [1]

[EDIT: If a defendant requests reexamination at an early-enough stage in the lawsuit, the judge is likely to grant a request to stay the lawsuit until the reexamination proceedings are finished. If the defendant waits too long, though, the judge might think the defendant is gaming the system to try to delay the trial, in which case the judge likely will deny a request for a stay.]

2\. A patent holder that actually makes and sells something can recover the profits it would have earned if _it_ had made the infringing sales. To do so it has prove some things it doesn't have to prove to recover a reasonable royalty. A troll can't do this because it didn't have the capacity to meet an existing demand at the time of the infringing sales. [2]

[1] <http://en.wikipedia.org/wiki/Reexamination>

[2] [http://www.finnegan.com/resources/articles/articlesdetail.as...](http://www.finnegan.com/resources/articles/articlesdetail.aspx?news=c29ba550-8c55-4b4f-a9a5-b2c72b1749c4)

<comment><USER8> A reexam request requires new prior art. You can't use what USPTO evaluated improperly (rms argued public prior art databases are a bad idea for this reason) and you're out of luck if it was something so obvious that nobody bothered writing it down. It also costs thousands of dollars _per patent_ with no refund for winning.

</comment></comment></comment><comment><USER9> Wouldn't it be simpler to require that any company suing over patents must also be an _active practitioner_ in the field(s) that the patents involve?

That would kill the asset-free trolls instantly because without an engineering staff and a product they can't very well be _building_ anything that uses their "property", can they?

<comment><USER10> I don't think we have to bring down the whole patent system just to stop software patents. Let's just stop issuing software patents and just deal with existing software patents however we can? One possibility.

<comment><USER11> If it is property, tax it like property, at 1% of value per year. All of a sudden, every trivial patent will be assigned 0 value by its owner, and then convincing a court the violation is worth $100M is hard.

Also puts old and new patents on equal footing.

<comment><USER12> > If it is property, tax it like property, at 1% of value per year.

Where is property taxed like that?

<comment><USER11> Real estate, essentially everywhere in the western world. The range I have observed in multiple countries is 0.5%-1.5%, and it isn't always called "property tax" (e.g., in the UK it breaks between "council tax", and various other taxes, none of which is specifically named "property tax"; in the neighborhoods of CA I'm familiar with, it's 1.2% in the last few years)

Car licenses in many places are also essentially a property tax of 1% of the car value, or so.

</comment></comment></comment></comment></comment><comment><USER13> This seems like a step in the right direction. In the UK, as far as I'm aware, this is standard procedure in ANY legal case. The loser has to pay the legal fees of the winner. This can be a double-edged sword however. A big legal firm with lots of resources will mount legal fees that they alone can crush any small company.

This is one aspect that I see missing from this. The mere _threat_ to sue over a patent can force a small company to settle or to even close-shop completely. Sure, if the small company wins, they'll get their legal fees back, but when would that be?? a good few months of time, energy, lack of sleep, and huge legal bills until the end of the process, and that's only IF they win.

</comment><comment><USER14> The reason that the American government hasn't implemented this broadly in legal disputes, as is practice in other countries, is that it makes it dangerous to pursue legal action for any entity. If I am a lone engineer who has just invented the perfect fuel source and GE rips it off, I have no recourse, because they can hire $50 million worth of lawyers and if she can't beat them in court, she's stuck with an impossible bill. These laws unfairly stifle the little businesses who are "supposed" to have a fair footing in the unbiased court of laws.

<comment><USER15> Why can't you make the max payout based on a percentage of the total money spent on the case by the loser.

That way if company A spends $10 million on the case and loses, the winner can recoup say $8 million.

But if Person A spends $50k on a case and loses, the winner can only recoup $40k.

<comment><USER12> Sounds like you might run into problems similar to US campaign financing law.

</comment></comment></comment><comment><USER16> I know most people here favor abolishing software patents.

My take is that they shouldn't be abolished. But they should be restricted. Say, 3 years. Maybe 5.

Software has short development cycles and version iterations. Three years gives a company a year to bring a product to market, and 2 years of patent protection after that.

This isn't perfect I'm sure and there are probably more optimal time frames than 3 years. But I like the idea that if I come up with a truly novel invention in code, I'll be granted a patent and a couple years at market before the clones emerge.

<comment><USER17> Why exactly do you think this would solve the problem? In a world where most (all?) patents being used for trolling are trivial and/or ignores prior art already. Why won't trolls just repatent something with different wording after it expires? This is already common in pharmaceuticals where some drugs have been under monopoly for way over the normal 20 years but under "different" patents. This is only not too common in software, yet, because the industry is young.

So wouldn't reducing length just worsen the problem by shifting even more power into the hand of incumbents who can afford to refill "different" patents more often than startups? Trolls would just use newer crap patents anyway.

<comment><USER16> So the answer is to deal with trolls not eliminate patents. Having a shorter patent grant is about addressing issues like Amazon 1-click. Amazon is not a patent troll, but having a 20 year patent on 1-click is absurd.

There are a lot of patent trolls outside software. Being against software patents and being against patent trolls are different issues with different solutions. I reject that dispensing with patents altogether is the best choice.

</comment></comment></comment><comment><USER18> Whilst the motives are good it realy should be a simpler bill:

`If you take somebody to court and you lose the case then you pick up the cost of the defence and courts time.`

That is what is needed, something simple and fair that covers this and other area's instead of one law for a specific area which will then need another law for another area and in essence complicate things by having many laws covering one simple thing.

Keep It Simple Stupid is a such a great old software term, that applies to so many things, including this.

<comment><USER19> TBH the entire court system would be better if money were a non-issue. The best way I can think of to solve that is to require both sides to be funded equally. i.e. if Side A wants better lawyers that cost more, then they should enough money towards a legal pool which is split equally between Side A and Side B. We will never have a just legal system until you eliminate this financial asymmetry.

<comment><USER15> That's actually a pretty good idea. I'm sure there are some implementation problems I haven't thought of yet, and ways for companies to get around it, but on the face of it a really good idea.

</comment></comment></comment><comment><USER20> Has anyone ever read this? [http://www.amazon.co.uk/Math-You-Cant-Use- Copyright/dp/08157...](http://www.amazon.co.uk/Math-You-Cant-Use- Copyright/dp/0815749422)

</comment><comment><USER21> How would this actually work? Unless a bond has to be posted the troll would just make sure the trolling entity (almost always a separate company shielding liability from true owner) has zero assets to pay the legal bills. Or did I misunderstand something?

<comment><USER22> Wouldn't the troll entity have at least control of the patents it's suing for?

<comment><USER21> Sure but if they lost the case doesn't that suggest those patents are worthless? If they can't be enforced they aren't effective patents.

<comment><USER15> At least it would keep them from using them to extort money from other victims.

A patent troll could lose without the patent being invalidated. It could be that the patent is enforceable, but not in this particular case (a case where a jury finds the defendant wasn't actually infringing).

We've seen patent trolls go after victims with nebulous claims that might not win in court even though the patent wasn't likely to be invalidated.

This may prevent those situations because if they lose and they have to hand over the patent, it deprives them of future extortion money.

It may at the least limit the scope of companies they go after to actual likely infringers.

</comment></comment></comment></comment><comment><USER23> I like it. If it works then it should cut down on these stupid spectacles. If it does not work then it only would further the cry of "See? We need total reform!"

</comment><comment><USER24> I like this alot:

In other words: just because we're defining "software patent" doesn't necessarily mean software patents are necessarily legal.

It's basically a temporary fix.

</comment><comment><USER25> This post was second after the one to Mark Zuckerberg when I clicked it, and for a second I thought it meant Bill _Gates_ was doing it. I boggled for a second at the idea of Mr Microsoft being sane about patents, but of course it was my error. Pity.

</comment><comment><USER26> Maybe I'm crazy but it seems there is a relatively simple solution to all this: make patents non-transferable.

<comment><USER27> If company A buys company B and company B owns a patent, the patent wasn't transferred, just company ownership.

So, making patents not transferable only adds a step or two depending on how complex the law is.

<comment><USER26> What I said was extremely simple, there are a million ways it could turn into law. A simplistic solution in my mind would be a rule that if your example were to happen, the patent is transferable in the case that the purchasing company intended to act on that patent (insert legal shenanigans to define what that means here).

The general intention is that a company can not own a patent which it does not have a vested interest in acting on, how that is defined could be an entire thread of its own.

<comment><USER28> And now your "relatively simple solution" has turned into a massive legal quagmire.

</comment></comment></comment></comment><comment><USER29> This is the way things should always have been. If you're going to falsely claim patent infringement only for it to be discovered you're not the patent holder or are merely using scare tactics to get money out of people you should be held liable for all costs associated with the legal threat.

</comment><comment><USER30> Why restrict this to just patent trolls?</comment>


I Wake Up at 5 Am Every Day - <AUTHOR> https://thegeekbin.com/why-i-wake-up-at-5-am-every-day/ <comment><USER2> My cat makes sure I'm up by 4:45am each day... No idea why.

</comment><comment><USER3> I wake up at 7 am and still manage to make ends meet</comment>


Billion-Dollar T Shirt - <AUTHOR> http://sethgodin.typepad.com/seths_blog/2007/12/the-billion-dol.html

<comment><USER2> What a fatuous observation. Yes, if only Godin had thought to build an auction site, like OnSale did, he'd be a billionaire. Or a search engine, like Infoseek and Teoma. Or an ordering system, like Cybercash.

</comment><comment><USER3> Can I get a billion dollar for my business advice?

1\. See what is coming 2\. Adapt to it 3\. ??? 4\. Profit

</comment><comment><USER4> That's a pretty cool T-shirt.

<comment><USER5> i would pay a billion and $1 for that shirt</comment></comment>


Vulkano – Safe Rust Wrapper Around the Vulkan API - <AUTHOR> http://vulkano.rs/ <comment><USER2> For the layman, could you explain why is this different to the already existing wrappers krust [1] and ash[2]?

1: [https://github.com/fyl2xp1/krust](https://github.com/fyl2xp1/krust) 2: [https://github.com/MaikKlein/ash](https://github.com/MaikKlein/ash)</comment>


California woman who drove with Google Glass beats traffic ticket - <AUTHOR> http://www.reuters.com/article/2014/01/17/us-usa-googleglass-trial-dismissal-idUSBREA0F1XR20140117 <comment><USER2> > Odle said he had not been planning to cite Abadie for wearing Google Glass, > but that he did so because of her reaction to his questions. "She got a > little argumentative about whether or not it was legal for her to wear > them," he said.

At first this sounded pretty vindictive, as though I could hear the officer ending the argument with "fine, we'll let the judge decide!" But after a little thought that sounds like a rather reasonable reaction.

Clearly there was some confusion about the legality and technically it did qualify as a "monitor", so some sort of legal precedent would be necessary to adequately end that argument, and the only way to get it into the courts was to issue a citation.

<comment><USER3> I think you're giving the officer a very generous amount of "benefit of the doubt".

He didn't say "I wasn't sure about the legality, so I referred it to a judge", rather saying he cited her because she got argumentative.

ie., "Don't challenge me if you disagree, otherwise I'll treat you as though you've broken the law."

That's pretty crappy behaviour on the officer's behalf IMHO.

<comment><USER4> I will side with the cop here. Knowing a few who are in this line of work I am more than amazed at what they put up with. Put it to you this way, your not being pulled over because they don't like you, your not being pulled over because they are having a bad day, your being pulled over because you flagged yourself; speeding, running a stop sign, tail light out, etc.

There is no reason to get argumentative with someone doing their job, let alone a traffic cop. All that while they are working on your incident they have to watch out for traffic, your actions, and ensuring you don't get so excited your a threat to yourself or them.

More than likely, being familiar with "our type"; techies, she came off as a pretentious twit and treated him with contempt for being an ignorant cop.

<comment><USER5> I've been pulled over for a "crack in the windshield" which wasn't visible from where the police officer's patrol car was sitting. I know because I went back and checked from his vantage point.

I get that you're trying to provide some nuance here, but let's not pretend that all police officers are honest and decent individuals just doing everything by the book. It goes both ways.

<comment><USER6> Wait, so was your windshield cracked or not? The way you said it seems it was; in which case I don't see what was wrong?

<comment><USER5> It was, maybe 3 inches lengthwise, about 2 inches off the edge along the bottom with a black background. My real contention was that I was pulled over for being poor (in my hoopty '90 626 at the time) and he saw the crack when he approached. He also didn't mention the crack until he had spent the previous 25 minutes threatening and cajoling me to tell him if I had been drinking or drugging and driving.

I wouldn't have minded this if I were pulled over for speeding and he noticed and added it to the ticket but to get pulled over for being poor, harassed and then written a ticket for the windshield crack...

Maybe that's an acceptable way for the police to pull anyone they feel like over, but there should be some sort of suspicion required. I know this is the everyday experience of a lot of people but I don't think it's acceptable for it to happen to them either.

<comment><USER7> Citing for something found isn't bad practice per se, nor is pulling over searching for statistically likely infractions. But too many officers use this argument as an excuse for bad behavior.

I've been abused in a similar manner, versus given a warning and relevant "counselling" (how to not get pulled over) from an officer with a more mentoring style.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Some research needs to be done on how distracting Glass is to drivers. I'm particularly interested in comparing the distraction caused by using Glass to navigate compared to the typical built-in navigation systems that ship with most cars today.

I suspect that Glass would beat out the Garmins and Tomtoms.

<comment><USER9> Giving our office's Glass to people to test, they're so distracted that they'll walk into things. Sometimes these things are pillars clearly visible at eye level.

I personally hate the idea of drivers wearing these things. My undergraduate was in psychology, neurophysiology, and hence I've been formally trained in attention and perception - I've got a better idea than layfolk on how these are compromised, though I'm not a professional in the field. In my opinion, the Glass is a significant attentional split - which is bad for driving. One example: say voice control is working fine (it doesn't always). You still have to take your eyes off the road, target a small reticle, make sure the glass is responding correctly. Even after that, there's still issues like just having a phone call in the car, which regardless of the device is a driving- performance-reducing attentional split.

Glass really, really impresses me as a technological feat; as a product I think it's a solution looking for a problem; and as a social phenomenon, I think it's quite dangerous when mixed with common activities like driving.

<comment><USER10> i expect driving to become automated sooner or later tho. I think human driving is the major cause of accidents, and automating it is really the best way to save lives, create better traffic conditions for smoother transportation, and also relieve the time required for the driver, so that other activities can be engaged.

Think about the avg hourly commute to work - how useful would it be if that time could be used for something else!

<comment><USER11> Like consuming media laced with advertising!

</comment></comment></comment></comment><comment><USER12> > Blair also dismissed a speeding ticket against Abadie, because an expert did > not appear to testify to the calibration on the officer's speedometer. Blair > said there was a lack of evidence to establish Abadie's driving speed.

This still happens? I thought it was pretty standard for officers to calibrate and maintain written records (at least, it's standard in new york)

<comment><USER13> Similar situation happened to me 2 years ago and I was dismissed in part because of the lack of evidence to back the calibration of a radar gun.

Link: [http://skatter.com/2011/02/how-my-smart-phone-got-me-out- of-...](http://skatter.com/2011/02/how-my-smart-phone-got-me-out-of-a- speeding-ticket-in-traffic-court/)

</comment></comment><comment><USER14>
      Highway Patrol Officer Keith Odle testified that he estimated Abadie
      had been driving her Toyota Prius at 85 miles per hour (137 km/h)
      in a 65 mph (105 km/h) zone when he pulled her over.

Case dismissed. Oh and Officer you're being suspended without pay for falsifying evidence, everyone knows a Prius can't go that fast.

<comment><USER15> "Woz gets $700 speeding ticket for doing 104 MPH in Toyota Prius" ([http://macdailynews.com/2007/08/21/woz_gets_700_speeding_tic...](http://macdailynews.com/2007/08/21/woz_gets_700_speeding_ticket_for_doing_104_mph_in_toyota_prius/))

<comment><USER16> That's no stock firmware.

</comment></comment></comment><comment><USER17> How is the Glass' HUD any different than the ones that get projected on windshields?[1]

[1][https://www.youtube.com/watch?v=TCTrsQaiD-0](https://www.youtube.com/watch?v=TCTrsQaiD-0)

<comment><USER18> Glass will play, amongst other things, video. It doesn't have the built in protections that video-playing car stereos have for not showing video while the vehicle is in motion.

</comment></comment><comment><USER19> In the future, people will pay a few cents to upload a hash of their video into the Bitcoin blockchain to prove the video was taken before a given date.

<comment><USER20> Seriously. That is an interesting application of bitcoin. Does that work with Bitcoin, or would it be neccessary to construct another "Coin" specifically for that purpose?

I'm highly sceptical of Bitcoin as currency, since there are so many conflicts between the technical properties of Bitcoin and the economics of currencies, but de-centralized verification of events and dates? _That_ sounds interesting.

<comment><USER19> It's actual possible today: [http://www.proofofexistence.com/](http://www.proofofexistence.com/). It should work with other forks of Bitcoin as well.

</comment></comment></comment><comment><USER21> > "As a hands-free device it is safer than a cell phone."

According to studies[0] hands-free devices aren't as safe as you'd think. I can't argue whether they are _safer_ , but at least "safer" isn't just enough in itself to justify it.

Also, from personal experience I have to agree with the study. The fact that my one hand is either up against my ear holding a device, or if the device is lying somewhere; the former doesn't require much extra of my attention than the latter. It is the talking and thinking of different things itself that takes away my attention from the road. Not saying one can't talk and drive (it's quite easy), but since the line is already drawn, it has to be uphold.

I haven't personally tried Google Glass', but could imagine it interferes with your vision a bit. It might be necessary for this to be subject for investigation as to the legality in the future.

[0] [http://unews.utah.edu/news_releases/hands-free-talking- texti...](http://unews.utah.edu/news_releases/hands-free-talking-texting-are- unsafe/)

</comment><comment><USER22> > Developers are already crafting apps [..]

Sounds grand if you phrase it like that.

</comment><comment><USER23> If this works, why isn't this same argument used for challenging tickets for using a phone while driving? All the same logic still applies.

<comment><USER24> Because if you are holding a phone to your ear you are by definition using it. Glasses could be just hanging out on your head though. Perhaps if you drove around with your phone strapped to your head with a sweat band you could make the same argument.

<comment><USER23> No, I could be holding it to my ear despite it being turned off, as stupid as that sounds. The point is, in the case of the phone, the officer never has _proof_ that the phone was on.

And if driving with Glass while it's on is illegal, shouldn't those dash mounts for phones be illegal too??

<comment><USER25>
      > in the case of the phone, the officer never has proof that the phone was on.

The phone company does.

<comment><USER26> No, the phone company has evidence that it communicated with tower within some period of time. The phone could still be powered up in a disconnected state, or communicating with the same tower before the driver got into the car, or.. (insert 20 other possible mitigating circumstances)

It's not that simple. Which is one of the reasons it's a good thing this was dismissed.

<comment><USER9> The expense of pulling phone records will outweigh the traffic ticket anyway, and neither party would be particularly interested in going that way.

</comment></comment></comment></comment></comment></comment><comment><USER27> You can't use a monitor while driving? The law says it's legal to use a mapping display while driving in California:

[http://www.dmv.ca.gov/pubs/vctop/d12/vc27602.htm](http://www.dmv.ca.gov/pubs/vctop/d12/vc27602.htm)

</comment><comment><USER28> Does Google Glass have some visible indicator whether it's on, similar to webcams? If not I think this should be added as soon as possible, in fact I believe it should be the law for any video camera switched on in public places.

<comment><USER9> You can see that there's an image on the glass if you're facing the user, but you have to be fairly close.

</comment></comment><comment><USER29> She didn't beat a ticket; the state had no evidence to present to the court that proved she'd done any thing wrong; a neat side step by the judge.

</comment><comment><USER30> So, must used Google Glass with Google Driverless Car.

</comment><comment><USER31> Wow!</comment>


Random Wikipedia page - <AUTHOR> http://en.wikipedia.org/wiki/Special:Randompage

<comment><USER2> I lack to see a reason as to why you posted this.</comment>


Phasing Out SHA-1 on the Public Web - <AUTHOR> https://blog.mozilla.org/security/2016/10/18/phasing-out-sha-1-on-the-public-web/ <comment><USER2> Chrome [1], Edge, and IE [2] are also in various stages along between the continuum of not marking SHA-1 secure, warning about SHA-1, or blocking it altogether.

[1] [https://security.googleblog.com/2015/12/an-update-on- sha-1-c...](https://security.googleblog.com/2015/12/an-update-on- sha-1-certificates-in.html)

[2] [https://blogs.windows.com/msedgedev/2016/04/29/sha1-deprecat...](https://blogs.windows.com/msedgedev/2016/04/29/sha1-deprecation- roadmap/)

EDIT: My frustration is that it's a bit difficult to grok who's warning against what when, and who's blocking what when, and who's giving unskippable errors to what when but I'll try to collect and distill this down because right now I have to look it up every time on blog posts that haven't been updated in years (-cough- Google)

<comment><USER3> The short version is, if you care about modern browsers, you should be using SHA-256 already. If you care about ancient clients, you should be using SHA-1 still. If you care about both, you need to serve both[1], but your SHA-1 cert most likely expires at the end of this year anyway, unless you've gone through the effort for extraordinary issuance.

[1] you'll most likely need to write code for this, I don't think it's widely supported. If you send SHA-1 to TLS1.0 and SSLv3, that's probably easier than triggering off the signature algorithms extension.

<comment><USER4> > If you care about ancient clients, you should be using SHA-1 still

I want to point out here that the oldest OS the newest Firefox supports is Windows XP SP2 [0], released 8 years ago, and a free upgrade from the original XP release 14 years ago. Unless you need support for last millennium's hardware you have no excuse for not supporting SHA-256.

[0] [https://en.wikipedia.org/wiki/Firefox#System_requirements](https://en.wikipedia.org/wiki/Firefox#System_requirements)

<comment><USER3> Note that I contrasted modern browsers and ancient clients. Client libraries in shipped devices tend to be several years behind state of the art when they were shipped, and live in the field without updates. As an example Symbian didn't ship SHA-256 support in their 9.3 release from 2006, but Firefox shipped support in their 1.0 release from 2004.

Whenever TLS 1.0 starts getting pulled from servers, it's going to be similarly painful. Nokia S40/Asha (last device released in 2014), only supports TLS 1.0, even though TLS 1.2 was 6 years old at that point. Nobody meaningfully supports TLS 1.1, but not TLS 1.2, so let's not hold lack of TLS 1.1 support against them.

(Not to pick on Nokia, they just happen to be an easily identifiable client platform that I'm familiar with)

</comment></comment></comment></comment><comment><USER5> The funny thing is that data deduplication storage systems work on sha-1 hashes to identify identical data blocks (two blocks are considered equal if the hash is equal - most systems don't care to check for collisions); they kept telling that the likelyhood of collisions is so astronomically small [1] ; i wonder if this statement is still considered to be true.

[1] [https://pibytes.wordpress.com/2013/02/09/deduplication- inter...](https://pibytes.wordpress.com/2013/02/09/deduplication-internals- hash-based-part-2/)

<comment><USER6> I think many systems use two hashing methods to verify this claim (e.g. SHA-1 and MD5.) Are there any known collisions that affect both algorithms?

<comment><USER7> You are talking about making a combined hash function from MD5 and SHA-1. Keep in mind that it is not trivial. For instance, if you just output both SHA-1 and MD5, you are actually only as strong as the weakest hash function (trivially for preimage, but also true for collisions, see [1]).

If you are interested in hash function combiners, have a look at _Robust Multi-Property Combiners for Hash Functions_ [2], a recent paper on the topic. It aims at getting several properties at the same time (preimage resistance, collision resistance). For simpler schemes with a single property, just explore the bibliography at the end of the paper.

[1] [https://cryptopals.com/sets/7/challenges/52](https://cryptopals.com/sets/7/challenges/52)

[2] [https://eprint.iacr.org/2016/723](https://eprint.iacr.org/2016/723)

<comment><USER8> What you are saying is completely irrelevant, because we are talking about checksumming data, not hashing passwords.

</comment></comment></comment></comment><comment><USER9> Disabling SHA1 for only a subset of Firefox 51 users after release sounds like it'll cause a lot of confusion. "Is my computer hacked?" "It works for me!" etc etc

<comment><USER10> Another good reason to not do the nonstop upgrades that FF keeps coming up with. I'm hanging in the upper 40's until this shakes out.

I understand SHA1 is an issue, but I'm also confused by some things. Happy to have web pages be encrypted to keep my personal information from being captured. Not really sure why we are encrypting video streams from Youtube. Is a cat video something that we need to make more secure?

And I agree with the comment that the problems are now coming back to the plethora of CA's that have popped up in the last few years.

<comment><USER11> _> Is a cat video something that we need to make more secure?_

This is about solidarity by increasing the background noise. If only those people who really need it would use encrytion, they were easy to detect and to suppress.

So, please show solidarity with the weak people in our and other societies by encrypting as much non-sensitive stuff as possible.

<comment><USER10> Thanks for the thought out reply, that makes the most sense.

</comment></comment></comment></comment><comment><USER12> Summary:

> per recommendations by NIST, issuance of SHA-1 certificates halted for the > web last January.

> In early 2017, Firefox will show an overridable "Untrusted Connection" error > whenever a SHA-1 certificate is encountered.

<comment><USER13> > overridable "Untrusted Connection" error

Allowing users to click past security warnings is a really bad idea. How is a user supposed to know the difference between untrusted because of SHA-1 deprecation and untrusted because of a MITM?

<comment><USER14> As far as I know almost all browser security warnings are overridable. The only one that comes to mind that does not have a click-through option is when a HSTS-enabled site fails a validation check.

<comment><USER13> This one in particular feels very strange, since there's actually nothing bad actively happening with the connection, it's more of a policy decision.

<comment><USER15> My understanding is that you can't _know_ that nothing bad is actively happening with the connection since SHA-1 is no longer a strong hash, so it's basically (hand-wave) no different from an HTTP connection.

<comment><USER16> So why don't they present any warning on HTTP connections?

It's not "basically no different" from an HTTP connection, it's _strictly better_ than an HTTP connection, but not as good as a cert made with a more modern hash. (For that matter the same argument applies to self-signed certificates: you're still keeping a third party from snooping on the phishing attempt the MITM is giving you, which is itself a Good Thing.)

<comment><USER17> All major browsers are moving towards this. Starting with the tiny icons changing colors they are beginning to make HTTP as insecure. Yes, it's very slow but at least they have started moving.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> Should SHA-1 be phased out of git, too? I understand that it's more of an issue for certs, but it's still a bit of an issue for anything that uses SHA-1. I'm just asking, not advocating, because the answer will depend on both benefits and costs, and I don't know enough about either in the case of git.

<comment><USER17> I don't think git's use was really intended for security. That being said it would be interesting to upgrade it and achieve security.

<comment><USER19> Regardless of whether or not it was intended for security, it is used for security now, via signed git commits and git tags. Lots of projects rely on them, and there aren't good alternatives yet; using third-party services like GitHub without signed git commits is very foolish.

Fortunately it's only becoming possible for attackers to create _pairs_ of messages that have the same SHA1 hash; an attacker still can't create a collision between a message of their choosing and an arbitrary SHA1 hash, and that type of attack is probably a long way off. But that's not much safety margin!

<comment><USER20> A scheme to generate (and sign) a SHA512 hash that more directly incorporates the full state of the repo was invented, and is used by some projects incl. nodejs

[https://github.com/cgwalters/git-evtag](https://github.com/cgwalters/git- evtag)

[https://github.com/nodejs/node/issues/7579](https://github.com/nodejs/node/issues/7579)

I personally think it's overkill

<comment><USER19> Oh, interesting! I do something not unlike that with my OpenTimestamps git commit signing: [https://petertodd.org/2016/opentimestamps-git- integration](https://petertodd.org/2016/opentimestamps-git-integration)

I don't describe it in that post unfortunately, as I still consider the git tree "rehashing" support to be alpha-level, but I'll look into git-evtag.

</comment></comment></comment></comment></comment><comment><USER21> Red Hat uses SHA1 certificates for their CDN [0] (that provides packages for RHEL7 and, I assume, other products).

It is a "private PKI" but their (current) intermediate and root certificates do not expire for a long, long time. Hopefully they'll move to a SHA256 root in the near future.

[0]: [https://cdn.redhat.com/](https://cdn.redhat.com/)

<comment><USER22> The hash algorithm of a root certificate does not matter, because you explicitly trust the root certificate, and it is only signed by itself.

Their intermediates and end-entity certificates should be updated, but still, the attacks PKIs are concerned about on SHA1 (a preimage attack) can only happen during issuance.

However, if a second preimage attack on SHA1 were viable, all of the above would be invalid, and SHA1 would be permanently weakened for all digital signature uses.

</comment></comment><comment><USER23> Honest question: why does a SSL certificate need SHA-2? In other words, where does hashing factor into the asymmetric crypto process? So from my cursory understanding of SSL, it uses RSA to exchange a symmetric key which is then used for the remainder of the session.

I'm interested in crypto systems but still getting my feet wet, so a simplified answer would be really appreciated! Also, pointers to any articles or papers would be great.

<comment><USER24> It's the hash of the certificate that is signed by a CA. Create a certificate with the same hash and you can transplant the signature. [http://web.archive.org/web/20071226014140/http://www.cits.ru...](http://web.archive.org/web/20071226014140/http://www.cits.rub.de/MD5Collisions/) demonstrates this with the MD5 hashes of two different PDF files, a letter of recommendation and a security clearance.

It's common to sign hashes instead of the data, reasons are explained here: [http://crypto.stackexchange.com/questions/12768/why-hash- the...](http://crypto.stackexchange.com/questions/12768/why-hash-the-message- before-signing-it-with-rsa)

<comment><USER23> So basically it's used to verify a MAC?

What I'm imagining: CA takes the hash of the certificate, encrypts that with its private key, and appends it to the cert. Client's browser then takes hash of locally stored certificate, and uses the CA's public key to check that the MAC attached to the incoming cert is valid.

I'm guessing SSL uses RSA-PSS[1] or something similar. Guess I'll have to do some reading when I find the time.

[1]: [http://www.onefs.com/emc-plus/rsa-labs/historical/raising- st...](http://www.onefs.com/emc-plus/rsa-labs/historical/raising-standard-rsa- signatures-rsa-pss.htm)

<comment><USER22> Certificates have a "tbsCertificate" component which holds almost everything (issuer, expiry, distinguished name, etc) except for the signature. The CA takes HashAlgo(tbsCertificate) and signs it with its issuing key.

The relying party can then take HashAlgo(tbsCertificate) and see if the CA signed that value.

Make sure you do not confuse encryption with signing. The hash is not private, so you do not need to hide its contents. I'm not sure if you can call it a MAC, because there is no key involved. It provides integrity guarantees, but the hash itself does not provide any authenticity guarantees; only the signed hash does.

<comment><USER23> Awesome. Thanks for the clear explanation!

</comment></comment></comment></comment></comment><comment><USER16> Doesn't matter when you have CAs known to have backdated certificates to avoid the SHA-1 deadline and all they get is a temporary suspension with none of their issued certs being revoked. The weak point of PKI is not the crypto, it's the CAs, of which there are too many and for whom there is little to no accountability.

<comment><USER25> It wasn't just a suspension - they got kicked out and may only _reapply_ after a year. Only if they pass strict scrutiny will they ever be re-admitted.

<comment><USER26> Not to mention not being able to do business effectively for a year is basically a death sentence.

"We sell certificates, but they won't work in Firefox, and maybe Chrome or IE if Google and Microsoft follow suit". Doesn't exactly sound like a vendor I'd purchase anything from.

</comment></comment></comment><comment><USER27> Do I understand correctly, when Mozilla says:

 _In early 2017, Firefox will show an overridable "Untrusted Connection" error whenever a SHA-1 certificate is encountered that chains up to a root certificate included in Mozilla's CA Certificate Program. SHA-1 certificates that chain up to a manually-imported root certificate, as specified by the user, will continue to be supported by default; this will continue allowing certain enterprise root use cases, though we strongly encourage everyone to migrate away from SHA-1 as quickly as possible._

This means that self-signed certificates, approved as an exception in browser, will continue to work because they are do not chain up to a root certificate included in Mozilla's CA Certificate Program? I.e. if user has confirmed an exception for self-signed certificate, it is not impacted by this change in Mozilla?

<comment><USER17> The signature on a self signed certificate doesn't matter as the certificate itself is trusted.

However if you add your own CA then yes, I believe it will continue to work for the near future. (You should be moving away anyways though ;) )

</comment></comment><comment><USER21> If you want to test out this behavior before it rolls out, you can set security.pki.sha1_enforcement_level (per Gervase Markham).

A value of 1 means "entirely forbidden", a value of 3 means "forbidden for public roots".

I can't speak for the behavior when using any other value.

</comment><comment><USER28> What about BitTorrent? It also heavily uses SHA1 - basically for everything from computing infohash to data integrity checks.

<comment><USER29> Well, a nation state attacker might be able to produce a fake block filled with garbage for a file and have your client accept it.

Unless BitTorrent relies on digital signatures somewhere, that's probably the worst of it.

<comment><USER28> Or worse, use it to infect the victim if it's executable/exploitable.

</comment></comment></comment><comment><USER21> They say that this won't affect any SHA1 certificates signed by a root that has imported and trusted, but there's a lot of devices that ship with their own self-signed certificates installed. I hope all the vendors have away from SHA1 or there might be a lot of "broken" devices.

<comment><USER17> Remember that if you are trusting the cert itself this is irrelevant because you aren't verifying the chain (which is the part using the SHA1 hash). I presume this is what most embedded devices do. But yes, if you imported a SHA1 root you should probably consider distrusting it.

</comment></comment><comment><USER30> what about retiring TLS 1.2 then?

[banking industry gasps]

<comment><USER3> Did you mean TLS 1.0? Retiring 1.2 seems a bit premature, since 1.3 isn't finalized.

<comment><USER30> no I was talking TLS 1.2

[https://www.ietf.org/mail- archive/web/tls/current/msg21278.h...](https://www.ietf.org/mail- archive/web/tls/current/msg21278.html)

</comment></comment></comment><comment><USER31> What about git? It also heavily uses SHA1

<comment><USER32> See this sibling thread about the same topic: [https://news.ycombinator.com/item?id=12738567](https://news.ycombinator.com/item?id=12738567)</comment></comment>


Why a period in a text message makes you sound angry - <AUTHOR> https://qz.com/1169792/theres-a-reason-using-a-period-in-a-text-message-makes-you-sound-angry/ <comment><USER2> My keyboard auto correct automatically adds periods at the end of sentences. My keyboard makes me seem angry all the time I guess.</comment>


Apple picks death not compliance for open source iPhone game - <AUTHOR> http://www.theregister.co.uk/2010/05/27/gnu_go_fsf_apple_itunes/ <comment><USER2> In the comments, I see criticism of Apple, defense of Apple, criticism of FSF (which was downvoted below zero), open source discussions etc.

Strangely, I don't see any criticism of the app developer. The app developer signed an agreement with Apple and agreed to its terms. They then went on to pick up source code with the GPL2 license.

It seems reasonable to assume that the developer signed two licenses with the full knowledge that they would have to violate one of these licenses.

<comment><USER3> Maybe he was just ignorant about the situation, recently here on HN, a community is well above the average of the Tech related communities in web, I have seen ignorance about copyright ownership and related subjects, so I prefer to believe that the developer was just ignorant, the Appstore model does nothing to educate this type of independent developer without any legal expertise and this type of situation can arise in the future as well.

</comment></comment><comment><USER4> I agree with Apple on this. If a license says that "You must do this, this, and that" in regards to something, and you can't do "this, this, and that" because it could kill your business model, then it makes perfect sense to preserve your business model - one that is working very well - by sacrificing the restrictive piece.

<comment><USER5> That'd be fine, were it not for that Apple's choice effectively cuts off open source software for their users as well. No one is saying that Apple should be forced to take undue legal risks, but by making themselves the single gateway to the iPOS platform, Apple implicitly assumes a lot of responsibility and, yes, legal risks. If Apple doesn't want the legal risks attending to GPL violations, then they shouldn't be the gatekeeper, period.

<comment><USER6> No. You're assigning blame to an inappropriate party here. Apple was more than happy to make the software available, free of charge, to anyone with an iPhoneOS device. If anyone is to blame, it's the FSF for forcing compliance to the letter of the law rather than it's spirit.

I men _come on!_ If you have an iPhoneOS device, you can just download the software. If you don't, the source code is freely available. How did the FSF's actions protect consumers, or even developers? As far as I can see, it didn't.

<comment><USER7> I see slightly differently. It would be nice to be able to have FOSS apps on the iPhone, but I don't think anybody of the parties are acting particularly unreasonably here.

I think the FSF is forcing compliance with the spirit of the law. As I understand it, the point of having source code freely available is so that _anyone_ can make modifications, use them, and further distribute them. Not everyone will make modifications, but if everyone cannot, then no-one will.

In the case of the Go app, if you or I obtained the source code, and made modifications for the go pieces to have some marble effect for example, then we could not distribute those changes.

As a side note, I think it is pretty reasonable to require Apple to distribute the source code. It is more likely that the creators of the Go go out of business than Apple, taking their FTP site, or other source code distribution mechanism with them. In which case the burden of distributing source code would fall to Apple. If Apple are not willing to set up a mechanism to distribute source code for apps now, then they would not be willing in the case that an app producer goes out of business. While I wish it were possible to run FOSS on the iPhone, I think t's a sensible business decision for Apple not to undertake this contingent responsibility.

What may happen in the future is that competition from Google commoditizes the App store, and forces Apple to open out the iPhone platform, for example by allowing other people/companies to host their own Apps. In which case a GPL App store may become a possibility.

<comment><USER8> "In the case of the Go app, if you or I obtained the source code, and made modifications for the go pieces to have some marble effect for example, then we could not distribute those changes."

What ever gave you that idea? Nothing stops you from putting your modified source up somewhere for download, so that people who want to use it can download it, compile it, and install it on their own phones.

</comment></comment></comment></comment></comment><comment><USER9> The title is misleading. By removing the offending app from the App store, Apple is now in compliance - it is not violating the GPL.

</comment><comment><USER10> Would have been very surprised if they changed their terms as a result of this.

</comment><comment><USER11> GNU Go is probably not the only app on the app store that makes use of GPL code. In particular, Doom Classic is also based on a GPL fork of Doom called PrBoom.

</comment><comment><USER8> Ugh. The article calls Go a chess-like game, showing that the author knows nothing of Chess or Go.

<comment><USER12> Compared to, say, Grand Theft Auto 4? Even three words dedicated to the difference in this setting would be three words too many. In the grand space of games, Go is a Chess-like game, Chess is a Go-like game, and both are related to Othello/Reversi and "Chinese" checkers rather more than soccer.

<comment><USER8> Why compare Go to anything in the article? If there must be some explanation for people who have no idea what Go is, simply calling it a strategy game would be sufficient, and would at least be accurate.

Chess and Go are not related. They have in common a rectangular board and are played by two players taking turns. That's about it. Saying they are like each other in the grand scheme of things would be like saying that poker and bridge are like each other, because they are both played with cards.</comment></comment></comment>


Apple, Google, and the map wars - <AUTHOR> http://counternotions.com/2010/05/25/mapwars/

<comment><USER2> This is one of those areas, like the OS kernel or browsers, where the losers need to gang up on the current winners by collaborating on an open platform, like Linux, Webkit, or in the case of maps, OpenStreetMap.

Mapping the world, like building an OS or web renderers is just too much for each company to do themselves and the value deliverd is multiplied by wide uptake. They need to figure out a way to add value on top of that open platform, and a way for 3rd parties to add value to that open platform too.

Building your own silo just slows you down. Is Apple really getting the benefit of building on OS X rather than Linux? I've heard it said before, but not recently, so the benefits seem minimal when upstarts like Palm are turning up with exciting looking phone and tablet OSes seemingly out of nowhere.

Will Apple spearhead this open map thing in the same way they kicked off Webkit and led with HTML5? I doubt it somehow, doesn't seem to be in their DNA despite most of the interesting stuff they do having this characteristic recently.

</comment><comment><USER3> I've always wondered how/why Google provide maps to any iPhone app... normally such commercial usage will cost you $10,000 (per app/website). I assume there is a commercial agreement and Apple has paid major $$$ on behalf of their developers. If Google decided to withdraw that agreement, it would leave a large whole in many iPhone apps.</comment>


ROCA-style: Simple recommendations for decent Web application frontends - <AUTHOR> http://roca-style.org/ <comment><AUTHOR> ROCA strikes me as a very close description to an ideal Rails-based application. In fact, when Stefan was describing the pattern, I said "duh, that's a Rails app" or something like that. But what he's trying to do here is useful, introducing a description that is technology-agnostic.

The main deviation from ROCA in my own apps is that unless utterly simple to accomplish, I don't try to accommodate non-JS browsers. Not as a matter of principle but rather of convenience. It is nice to aspire to 100% functionality in non-JS contexts, even with degraded user experience. I just don't know that it's practical in most cases.

<comment><USER2> Out of interest, if you're not trying to accomodate non-JS browsers, what does your SEO solution look like?

<comment><AUTHOR> I'm talking about internal pages that don't need to be spidered.

</comment></comment></comment><comment><USER3> Fits my current ideals here: [http://blogs.atlassian.com/2012/01/modern- principles-in-web-...](http://blogs.atlassian.com/2012/01/modern-principles- in-web-development/)

</comment><comment><USER4> Finally a manifesto of REST principles :)

<comment><AUTHOR> Some more details are here: <http://www.innoq.com/blog/st/2012/03/announcing- roca/>

"a set of rules to apply if the goal is to come up with a Web app that is actually on the Web as opposed to be tunnelled through the Web. We tried to come up with a catchy name, and finally arrived at "ROCA", a conveniently pronouncable acronym for "Resource-oriented client architecture".

So rather than a manifesto, they're trying to devise a nomenclature, along the lines of how Ajax gave a name to non-page refresh server communication with the browser.

</comment></comment><comment><USER5> Nah, no way am I going to allow wget or curl to do application work.

<comment><USER6> Why not?</comment></comment>


How to know all of your unfollowers on Twitter - <AUTHOR> http://shad.cc/how-to-know-all-of-your-unfollowers-on-twitte

<comment><USER2> No good can come from knowing who unfollowed you.</comment>


Websites using Facebook 'Like' button liable for data, Europe court decides - <AUTHOR> https://www.cnet.com/news/websites-using-facebook-like-button-liable-for-data-europes-top-court-decides/ <comment><USER2> These EU regulations, particularly GDPR, are out of this world unrealistic and clearly drafted by old school bureaucrats.

For example, one of the requirements is that a person should be able to reach out to a company and get all of the personal data the company holds about them (plus be able to amend or delete their personal data).

HOWEVER, the bar for identifiable data is so high (anything that can identify an individual, within the context), that you can easily call up and get information on anyone else, and abuse these rights.

The same laws that are supposed to protect people, are actually exposing them. An enraged spouse can easily gather data on their partner's whereabouts by calling up with their partner's MAC address.

Also, the burden on companies to deal with this is so unreasonable. I understand giving people rights as to how data is used, but to have on-demand access to everything one keeps about you? Really? If you want to know what others (including organisations) know about you, keep a track record for yourself.

Can you imagine if someone walked up to you and asked you to immediately forget everything about them?

I am not trivialising the matter. Organisations are like people. When you interact with them, you give them information. But to place the onus on organisations to keep track and allow you to manage all of your past interactions is highly unreasonable.

The economic effects of court cases that relate to these regulations, as they start to unfold over the coming years, will not be positive in the slightest, I believe.

<comment><USER3> On the contrary, the requirements force companies to get clarity on what information they collect on users and what they do with it. It's a good thing because the current state of affairs clearly shows that market forces failed to motivate companies here and they routinely damage their users' rights. Willingly or unwillingly.

</comment></comment><comment><USER4> Well, it is true...

</comment><comment><USER5> All of these ridiculous regulations will only make it impossible for someone without deep pockets to start an online business.

<comment><USER3> Either don't collect and store users data or do it responsibly.</comment></comment>