FinTech is the worst - <AUTHOR> https://medium.com/listen-to-my-story/why-fintech-is-the-worst-de90e89a4f0c <comment><USER2> B2C/C2C fintech, perhaps. But it's not the only model, and TBH, selling financial services to consumers is difficult - the risks of getting a startup involved in your financials aren't trivially dismissed.

Selling tech, particularly SaaS, into finance is a different story. Most organizations are large and scelerotic, developers are heavily laden with security controls, and smart devs are uninterested in the more boring plumbing, where you're a cost centre and aren't getting a decent slice from the bonus pool.

Historically a lot of financial software has been consultancy-ware sold directly to management, or poorly implemented internal systems with long turnaround times. The industry is ripe for more cloud-oriented software with lower onboarding times and less gating by internal IT. The primary challenge is convincing people that their data is safe with you, and that the service can be continued even if you go away (so, source escrow).

(I work in this space - send me an email at firstname.lastname@example.com if you're interested in joining a growing startup in London. Stack includes C++/Java/Ruby/JS and more.)

<comment><USER3> > The primary challenge is convincing people that their data is safe with you, > and that the service can be continued even if you go away

Isn't it possible to sell self-hosted software like AeroFS does?

<comment><USER2> It's possible, but it's a different business model. For a complex multi-tier application, it wouldn't just be an executable; it would be a set of machines that all need to be on the same version, configured correctly with appropriate firewall rules etc. Who would manage it? Would it reach out and grab updates, or would the you reach in and upgrade it remotely? Would IT want to get involved? Are you responsible for training them? For fixing things when they mess it up? There's loads of pain in this direction. It's best avoided if the application is in any way complex, and particularly if it has a rapid upgrade cycle (we roll out upgrades every 2 to 4 weeks or so).

</comment></comment></comment><comment><USER4> I personally think FinTech is the the best.

The examples mentioned are focused on a specific sector of the market where there are players to compare against for similar products or products that at the end of the day, do the same thing.

A disruptive business has its own market that can't be compared against another before it such as Bloomberg. The examples offered are just variations of existing business models and are bad examples of the potential of FinTech businesses.

Even with the businesses mentioned it ought to be mentioned about the ROI. The operating costs of Merrill can't even remotely be compared to the upstarts.

There are a couple of really good examples such as TransferWise, CrowdCube, Bloomberg, Square, Stripe, Xero, MPESA and loads more that are at the top of their categories either immediately or in terms of growth.

Fintech businesses _do_ scale quickly, very quickly. Most of the examples I've given have done this already. MPESA transacts in multiples more than the entire banking system itself in Kenya.

</comment><comment><USER5> Here is a revealing fact. Trading in FX has been electronic since well before the age of the internet, with EBS being setup to compete with Reuters as early as 1990. Still, as soon as transactions are bigger than some small nominal amount (say, 5m USD notional), inevitably, they're transacted human to human, _to this day_. Sure, many transactions in total size are larger than that, done in smaller electronic chunks, but as soon as there is a real, single-flow risk, many humans simply like to deal with another human. Twenty five years later.

The facts is that, when you're risking large amounts of money, and I have been a portfolio manager and self-analysed why, despite being a techie, I was uncomfortable putting large risks through a machine, the fact is that you want re-assurance. You want a _person_ to guide you through the risks, or at the very least, you want to be able to reward a real person with your flow, buy their loyalty, so that in future they will help you with new, nascent risks, that you might not be aware of (the salesman-PM bond).

Fintech in too many cases assumes that transactions are simply a dry exchange. Where it fails every time is in acknowledging the rich set of emotions that accompany any transaction beyond a certain threshold size, and which only another human can understand/acknowledge/address.

I have not been surprised, because of the above, about how many fintech companies are failing.

<comment><USER6> Matt Levine at Bloomberg summed this up well: "It's not enough to get your machines to agree. You have to agree on what your machines should agree about."

You're exactly right. People forget money is a contract business for a reason. Even if it were feasible to remove government regulation, the enormous complexity of financial needs and marketplaces would require a huge amount of human oversight. When things go right, transactions are simple. The problem is they frequently go wrong, sometimes in unanticipated ways where liability gets fuzzy.

</comment></comment><comment><USER7> Lots of fintech entrepreneurs I have spoken seem to disregard threats to their model by their biggest competitor: banks. Banks are your biggest and smartest competitor. And they are not as bureaucratic as you may have been led to believe. They pay top dollars for engineering and marketing talent and they have a ton of money and patience. So unless you have a strategy to deal with banks, you are toast.

<comment><USER8> It's well-known that banks do not pay top dollar for engineering or IT talent. Further, for the less-than-top-dollar pay, you often work in horrible conditions. It's loud, relentlessly interactive even if your job function has nothing to do with intraday banking activities. Banks are notorious for using legacy technology, having arcane legal restrictions (e.g. you can't use an open source project without weeks worth of approvals and paperwork), virtually never pay down technical debt, have an unholy mixture of off-site consulting teams with too many cooks in the kitchen, and require you to work an unreasonable number of hours purely for the sake of appearing, visually, to do a lot of work.

I am not in the fin tech space, but if I was, banks would not be a serious worry. When large banks "mobilize" to compete with faster moving start-ups it is a hilarious failure, like when a cat is trying to take off a cat Halloween costume.

<comment><USER9> _It 's well-known that banks do not pay top dollar for engineering or IT talent._

Doesn't jibe with my observation -- my sense is that (upper-tier) banks do pay significantly higher than tech startups (leaving aside equity, of course), on average. And offer a lot more security, if you can stick it out. Again, on average -- for average-schmoe Java/C++/what-have-you devs.

You're definitely right about the horrible technology and working conditions, though. That's why the banks know that have to dangle above-average salaries for all kinds of humdrum role descriptions -- deep down inside, they know that to a large extent, they're paying people for being willing to hold their nose, day in, day out, year after year.

And of course for the willingness to pee in a cup, because someone told you to.

<comment><USER8> I guess it depends on what you mean by upper tier. Goldman Sachs pays well. JP Morgan, Bank of America, Wells Fargo, BNP, Citi, Morgan Stanley, TD Bank, Standard Chartered, etc... These places absolutely don't pay well even compared to medium quality established tech firms. Certainly they don't pay well compared to hedge funds, private equity, VC, and other types of boutiques. And if it is even remotely adjusted for quality of life, they begin to look horrible.

The larger banks like JPM etc go out of their way to suppress wages. They are sort of the IBM of finance. Lots of big, senseless, ill-conceived technology re-orgs all the time happening to create bonus fuel for someone up the food chain. These places certainly don't recruit the best, and often dupe decent developers into doing totally foolish things, like working in a proprietary language for years that heavily damages your ability to get other jobs, for salaries and bonuses that don't even afford that great of a lifestyle in the high-cost cities you're required to live in to work for them.

Bonuses at banks are also often paid in the form of bank stock and vests on a rolling basis. This stands in contrast to straight cash bonuses paid by many other types of firms, which have the benefit of not immediately being correlated directly to your regular income stream (e.g. if things go downhill and you're laid off, at a bank this often means that stock bonus has lost considerable value and you could be screwed out of a large portion due to vesting issues ... whereas a cash bonus could have been invested in some way that helped diversify and hedge against risks of losing your job).

Comparing with start-ups is not very useful since start-ups also seek to greatly suppress wages by marketing jobs as lifestyles instead of a fair trade of labor for wage.

</comment></comment></comment></comment><comment><USER10> "FinTech is not an acquisition space" might be the only universally true point here. At Bitsapphire.com we talk with tons of Fintech founders every month. Exit strategy is the Nr. 1 problem for almost all of them _except_ B2B SaaS Fintech companies.

B2B SaaS Fintech us a while other ballgame. SaaS in general is difficult to exit because you can easily increase your valuation with a few more users. If you get financial.institutions to use your SaaS product you have a long term goldmine. Obviously the sales cycle is horrendous though.

</comment><comment><USER11> While FinTech does face headwinds, it's not as bad as the author claims. Taking the points in turn:

1\. "FinTech businesses don't scale quickly." Online lending platforms can actually scale rather quickly. According to SoFi's CEO, "In 2012, SoFi funded about $90 million of loans. These days, it originates more than $1 billion a month". [1] While that is indeed still small relative to size of the market, that's more of a reflection of how huge the market is.

2\. "It's really easy to get fooled by early adopters." True in any space.

3\. "FinTech is not an acquisitive space." This is a good point.

4\. "The sale cycles are really long." If you're selling into an enterprise, then sales cycles are always long.

5\. "Customer acquisition is hard to hack." Compared to a social network, yes, but social networks are singularly conducive to viral growth. It is possible to achieve viral growth (e.g., PayPal).

[1] [http://www.sfgate.com/business/article/Online-lender-SoFi- st...](http://www.sfgate.com/business/article/Online-lender-SoFi-starts-hedge- fund-to-invest-in-6885222.php)

<comment><USER12> >If you're selling into an enterprise, then sales cycles are always long.

The point OP is trying to make is that in financials even selling to consumers has a really long sales cycle, since people are understandably leery about just handing over their finances to a random startup that didn't even exist a couple of years ago.

</comment></comment><comment><USER13> For each point there is a counter-point about why it's a good place to invest:

FinTech businesses don't scale quickly. => it takes a long time to build a business, but once you're there it's harder to get usurped by new upstarts.

It's really easy to get fooled by early adopters => this can be said about _any_ market, not just fintech.

FinTech is not an acquisitive space. => yeah, you build long-term equity value in the companies you think are going to be successful and big wins.

The sale cycles are really long. => this is endemic to the entire finance & banking space itself; not just fintech. That also means once you're in, you're in for a while.

Customer acquisition is hard to hack. => moat, and this can be said about any space.

</comment><comment><USER14> And the elephant in the room is regulations. You end up hiring a dozen people just to read the draft regulations coming every week, you need to set up processes, controls, compliance depts. And before you know it you became a bureaucratic bank.

<comment><USER15> In another life I built an entire product for the sole purpose of helping companies meet their regulatory requirements for marketing their products to other people who worked in finance. I had many a meeting with compliance officers. It was ludicrous.

</comment></comment><comment><USER16> Having done an e-banking startup in the mid-90's I agree generally with every point the author makes. The reason people continue to go after the space is that it's a very rich one.

</comment><comment><USER17> FFS. It's the worst because it parasitically drains the market while adding exactly zero economic value.

<comment><USER18> 'it' being Fintech? Which type of Fintech product do you think does what you state?

<comment><USER19> High frequency trading would be one for me.

<comment><USER20> If high frequency traders add zero value then why do counterparties enter into trades with them?

<comment><USER19> So can you explain the economic value that HFT creates, with some evidence rather than just rhetoric?

<comment><USER21> Isn't the fact that people trade against their quotes sufficient evidence? After all, if someone besides the HFT had a better quote (e.g. better price), people would trade against that instead of the HFT's quote.

<comment><USER22> No. Not unless they become high-frequency traders themselves. HFT will always win the trade since they can instantly offer a 1 cent lower price.

<comment><USER21> That sounds like the HFT is providing a better bid-ask spread.</comment></comment></comment></comment></comment></comment></comment></comment>


12 Billion-year-old signal from the end of the universe's 'dark age' - <AUTHOR> https://phys.org/news/2020-06-scientists-billion-year-old-universe-dark-age.html <comment><USER2> An old friend of mine is one of the authors on this. Their instruments generate _a lot_ of data. I don't know if this is the case for their array in Australia, but when he was working in South Africa they had to carry hard drives out of the country because there wasn't enough fiber capacity out of the continent.

<comment><USER3> I recently found out that that is referred to as the sneakernet, and is actually still a preferred way to transfer a lot of data. [https://en.wikipedia.org/wiki/Sneakernet](https://en.wikipedia.org/wiki/Sneakernet)

<comment><USER4> AWS has a little-known service for trucks transporting 100PB of data in shipping containers:

[https://aws.amazon.com/snowmobile/](https://aws.amazon.com/snowmobile/)

<comment><USER5> What do their prices look like for 100 pb?

<comment><USER6> It's probably not bad compared to the monthly recurring you're about to get hit with for sitting in all of those bits.

</comment></comment></comment></comment></comment><comment><USER7> A question pops in my head whenever I see news of signal detection from the early age of the universe.

As the universe expands we can see further in the past since light has been traveling a longer distance. However, since time has passed to reach the stage where this distance is significant there's a limit to how far we can see, and this limit is continually pushed further as the universe expands (and accelerates expansion).

Now, my question is, how is it possible that we can see so far in the past? Has the early expansion rate of the universe been much faster than what I assume that it's still possible to capture these signals, are we capturing signals spread and reflected over time, or is there some other explanation/wrong assumption?

<comment><USER8> The universe is bigger than the observable universe.

<comment><USER7> Is that verified? That would be a reasonable explanation

<comment><USER8> What do you mean verified? Do you think we're in the center of it?

<comment><USER7> We don't need to be in the center of the universe for that, just less than a certain distance from the edge.

<comment><USER8> Well if the furthest stuff we can see all happens to be the same distance away from us, that would mean the universe is larger than the observable, unless were in the center, which, as history shows, is a bad assumption to make.

</comment></comment></comment></comment></comment></comment><comment><USER9> Can someone ELI5 how sparse neutral hydrogen could physically emit signal so strong it could travel this far and be detected? Like, there were no stars, no nuclear reactions, no interactions with energy exchange(?)... Who lost all that energy?

<comment><USER10> The emission is the so-called 'forbidden' hyperfine transition of the spin state of Hydrogen's one electron. It's flips from spin up to spin down, and the energy difference is a photon at about 1420 MHz.

It's called forbidden because it's extremely unlikely to occur - so unlikely that I don't believe it's been observed in the lab. But in aggregate, with vast vast clouds of hydrogen it becomes likely enough and strong enough to detect.

We observe this emission from hydrogen in our own galaxy and through the local universe. And it's quite strong to easily detect.

In this experiment, they're looking for that same 1420 MHz signal, redshifted down to something like 180 MHz (where exactly it is isn't known for sure).

<comment><USER9> Thank you!

</comment></comment></comment><comment><USER11> > This radio telescope consists of 4,096 dipole antennas

Does anyone know the significance, if any, of there being 2^12 antennas?

<comment><USER12> Probably a 64x64 grid.

<comment><USER11> But why 64x64 then?

Is that just to match some characteristic (i.e . number of inputs) of the data aggregation/logging device (more likely), or is it something about the physics of the type of signal they are trying to detect (less likely)?

There are, after all, plenty of possible square grid combinations bit only some are powers of 2.

<comment><USER13> It must be for separating the visible area into smaller grids for analysis.

I also assume some level of error correction is needed and pair of antennas data need to be somehow correlated

</comment></comment></comment></comment><comment><USER14> Honest to god question: do you think there's a market for moving encrypted SDD drives in big european cities?

For stuff that could not and should not be transfered over network.

I had this idea for a bicycle messenger & hardware encryption startup, but i don't have any idea what the demand really is like.

<comment><USER15> I would have used that 3/4 times during the last year in a big EU city: we do consulting, and one of our customer is adamant their data cannot go on the public cloud. So they have their own data center, and some file sharing utility. Problem is, you need to go through their VPN, that is super slow, and their sharing utility closes connections after a while.

Result: transferring 30/40 GiB of data is painful, and we often go to their office to retrieve the data instead of using the Internet. In an ideal world, I wouldn't need a service like the one you suggest, but since a lot of our customers seems to be in the Stone Age, I would probably use it.

</comment></comment><comment><USER16> It's amazing that we think this is even possible to achieve — pick up a particular signal that's been floating around since the beginning of the universe and get interesting info from it... would be so cool if they manage it!

<comment><USER17> Floating around doesn't do it justice....it's been flying at the speed of light away from its origin for the past 12 billion years until it ran into a little sensor.

</comment></comment><comment><USER18> I wonder if the kangaroos hopping by create any interference that they need to correct for.

<comment><USER19> Not likely. I worked at a research station right down the road from a zoo and we didn't see any interference from any of the animals. Now, the security fence on the other hand? Static City we used to call it.</comment></comment>


Ruby on Rails' Speed - <AUTHOR>

Any outlook on Rails' speed in the future? There have been actual upgrades to its performance but are there any performance upgrades in the future to give a big boost of speed? <comment><USER2> If you are a traditional SQL kinda person adequate record from tender love seems to offer some performance increases. There seem to be lots of effort to make some of the larger key pieces of rails faster.

I would't expect rails on it's own to get dramatically faster. The way it is going to get way faster is to strip out a lot of why to use rails and get closer to what we get from a pure rack app. The flip side is we lose a lot less off the top line speed see in benchmarking.

Using things like Russian doll caching and turbo links can make apps seem faster.

With some patience jruby and the right server setup rails can get a pretty big performance boost. For long running processes like web servers jruby can be a pretty big win for the ruby ecosystem.

There is some very thorough benchmarking done by Brian Knapp comparing different ruby runtime/server/framework combinations you can see here [http://www.madebymarket.com/blog/dev/ruby-web-benchmark- repo...](http://www.madebymarket.com/blog/dev/ruby-web-benchmark-report.html)</comment>


U.S. health agency under cyberattack during coronavirus response - <AUTHOR> https://www.usatoday.com/story/tech/2020/03/16/us-health-agency-cyberattacked-during-coronavirus-crisis-report/5057453002/ <comment><USER2> That comes very close to being an act of war.</comment>


One of the Most Alarming Internet Proposals I've Seen - <AUTHOR> http://lauren.vortex.com/archive/001076.html <comment><USER2> Er, actually reading the specification, it's about proxying _http_ resources, not _https_ ones. This proposal is strictly better than the transparent proxying that's common on the internet today.

        To distinguish between an HTTP2 connection meant to transport "https"
        URIs resources and an HTTP2 connection meant to transport "http" URIs
        resource, the draft proposes to

           register a new value in the Application Layer Protocol negotiation
           (ALPN) Protocol IDs registry specific to signal the usage of HTTP2
           to transport "http" URIs resources: h2clr.

...

        4.3. Secure Forward Proxy and https URIs

        The Proxy intercepts the TLS ClientHello analyses the application
        layer protocol negotiation extension field and if it contains "h2"
        value it does not do anything and let the TLS handshake continue and
        the TLS session be established between the User-Agent and the Server
        (see Figure 8).

<comment><USER3> HTTP/2 changes the meaning of the [http://](http://) scheme. All connections will now be TLS-encrypted. (Edit: Maybe not. See hobohacker below.) [http://](http://) means that the endpoint has not been verified using the CA system and is using a self-signed certificate (and is thus trivially vulnerable to a MITM should certificate keys not be checked out-of-band).

The purpose is to provide confidentiality to the vast majority of traffic, even if the authentication part of the CIA triangle isn't achieved. This proposal's purpose is to undo that and expose all traffic using the [http://](http://) scheme to your ISP, exactly as it is today. (I would also note that this draft is proposed by AT&T, which is now rolling out new plans in Austin that charge an extra $30/month if you do NOT agree to them inspecting and data-mining all of your internet activity and selling it to advertisers.)

<comment><USER4> > This proposal's purpose is to ... expose all traffic using the > [http://](http://) scheme to your ISP, exactly as it is today.

Isn't that a semantic requirement of HTTP, though? Half of the "tech" in the HTTP/1.X spec is to allow for caching of resources and responses by proxies, allowing anyone between the client and server (e.g. your ISP) to act as a CDN.

HTTPS/1.X effectively throws that away by doing end-to-end encryption. It's a trade-off: we gain the surety that all the responses are coming directly from the peer, rather than anyone else... but the web becomes 90% less cacheable, because the only places things can end up cached are between the client and the HTTPS pipe (i.e. the browser cache), or between the HTTPS pipe and the server (i.e. "reverse proxies" like Nginx.)

The current workaround for this, when you _need_ caching for your Big Traffic on either ingress or egress, is to do what amounts to purposeful self-MITMing of your HTTPS session: to terminate HTTPS _on a caching proxy_ , that holds the certificate of your client/server, and acts as if it were you, while itself doing another HTTPS session for "the last mile" to connect to you. This is what companies do when they deploy their own CA-cert to their networks, so everyone's access can be proxied through their own system; and this is what services like Cloudflare do when they sit "in front of" your server while not being a part of your company's VPN at all.

Basically, HTTP2 codifies this workaround, and calls it HTTP.

<comment><USER5> I find it difficult to imagine a world where Applications agnostic caching for encrypted sessions is possible.

I fully expect a world where application developers have services at their disposal for positioning assets closer to the end user with VM instance level isolation and security guarantees.

Transport level security is not likely to be enough for high value/sensitivity data in the long run but adding a bunch of new trusted parties to the system is going to be huge enabler for end user surveillance.

<comment><USER4> Why application-agnostic? HTTP's own caching isn't application-agnostic; it relies on the server to specify Cache-Control headers.

I would imagine an ideal HTTP2 caching protocol to basically specify that some resources can come from anywhere, as long as the retrieved result conforms to an attached content hash—while also specifying a primary source to get the resource from, if you don't have a DHT handy. (Oddly enough, this is basically a suggestion that web browsers try to resolve magnet: URNs.)

</comment></comment></comment></comment></comment><comment><USER6> This article ignores the context behind the proposal. Many companies, schools, and prisons are MITMing all SSL traffic today for a variety of liability reasons. Today those users get no notice that their Web browsing is being observed and censored. Trusted proxies are intended to give those users some notice that they're being MITMed.

I agree that MITM proxies shouldn't be used on the public Internet and thus we shouldn't make it easier to do so, but what about the people who are already being MITMed? Is there another way to solve this problem or must we throw corporate Web users under the bus to save the public?

<comment><USER7> As Patrick McManus says in [http://lists.w3.org/Archives/Public/ietf-http- wg/2013OctDec/...](http://lists.w3.org/Archives/Public/ietf-http- wg/2013OctDec/0703.html):

If someone can install a root cert onto your computer then you are already owned - there is no end to the other things they can do too. Call it a virus, call it an enterprise, but call it a day - you're owned and there is no in- charter policy this working group can enact to change the security level of that user for good or for bad..

The good news is not everyone is already owned and SSL helps those people today.

</comment></comment><comment><USER7> The specification indeed is about proxying http resources, not https ones. So it's not initially as alarming as some other proposals discussing trusting proxies to intercept SSL connections. For more details, you can refer to [https://insouciant.org/tech/http-slash-2-considerations- and-...](https://insouciant.org/tech/http-slash-2-considerations-and- tradeoffs/#Proxies).

This specific proposal is interesting because it specifically is related to opportunistic encryption proposals, in particular, the one that allows sending [http://](http://) URIs over an unauthenticated TLS connection: [http://tools.ietf.org/html/draft-nottingham-httpbis-alt- svc-...](http://tools.ietf.org/html/draft-nottingham-httpbis-alt- svc-03#section-3.6). The problem here for proxies is, if you mix http and https (authenticated) traffic on the same TLS connection, the proxy cannot tell if it can safely MITM the connection. The proxy vendor would like to know if it can do so, probably for network management / caching / content modification reasons. Of course, the point of the opportunistic encryption proposal is to increase security (although its actual effective impact is controversial: [https://insouciant.org/tech/http-slash-2-considerations- and-...](https://insouciant.org/tech/http-slash-2-considerations-and- tradeoffs/#OpportunisticEncryption)). But if you believe in opportunistic encryption's security purposes, then it doesn't seem to really make sense to make the MITM'able traffic identifiable so proxies on the network path can successfully MITM them without detection.

</comment><comment> vezzy-fnord It actually appears that the RFC openly admits the potentials for abuse here:

"6\. Security Considerations

This document addresses proxies that act as intermediary for HTTP2 traffic and therefore the security and privacy implications of having those proxies in the path need to be considered. MITM [4], [I-D.nottingham-http-proxy-problem] and [I-D.vidya-httpbis-explicit-proxy-ps] discuss various security and privacy issues associated with the use of proxies. Users should be made aware that, different than end-to-end HTTPS, the achievable security level is now also dependent on the security features/capabilities of the proxy as to what cipher suites it supports, which root CA certificates it trusts, how it checks certificate revocation status, etc.

 _Users should also be made aware that the proxy has visibility to the actual content they exchange with Web servers, including personal and sensitive information._ "

<comment><USER8> To play devil's advocate, this could potentially be less harmful than the existing situation: where e.g. various corporate nets will require you to install root certs to accomplish the same MITM attack, in a less visible fashion (after installation), with some if not all of the same caveats - especially if given the ability to opt out.

(Bugs, insufficiently scary UI, and "discovery" are all massive concerns of course...)

<comment><USER9> Hm, no. _Various corporate networks_ doesn't classify as an ISP, the number of potentially abused users is not the same. A company can do whatever it wants to, an ISP offers a service and should respect the privacy of it's costumers, at least theoretically.

<comment><USER6> This proposal isn't intended for ISPs and should never be used on the public Internet.

<comment><USER9> Oh, my bad then. I miss-understood the proposal and it's implications. But since the protocol supports that, how can we be sure that ISPs won't use it?

<comment><USER8> Cynically, "we can't". Or "they already have better options".

Alternatively, outcry and blacklisting ISP proxies - just as we do with root cert abuse.

</comment></comment></comment></comment></comment></comment><comment><USER10> I've become increasingly more disgusted with IETF since I found out they have at least a few NSA agents working with them on protocols, and more importantly _refusing to kick them out_ \- even after all the Snowden revelations with NSA trying to subvert and undermine encryption protocols:

[http://mirrors.dotsrc.org/fosdem/2014/Janson/Sunday/NSA_oper...](http://mirrors.dotsrc.org/fosdem/2014/Janson/Sunday/NSA_operation_ORCHESTRA_Annual_Status_Report.webm)

Then I find out that they've been working with Cisco on another similar thing to this one for "legal intercepts", a.k.a "trusted backdoors", like we're seeing above.

[https://www.blackhat.com/presentations/bh- dc-10/Cross_Tom/Bl...](https://www.blackhat.com/presentations/bh- dc-10/Cross_Tom/BlackHat-DC-2010-Cross-Attacking-LawfulI-Intercept-wp.pdf)

With NIST being already corrupted by the NSA, and now W3C becoming corrupted by MPAA, too, I think we're seeing the decay and fall of the "standard bodies", because I don't believe the Internet will tolerate these moves. The Internet will ignore them, do its own thing, and make it popular. I think future standards will be built from the bottom-up, and if I'm not mistaken most of the Internet so far has been built that way anyway.

<comment><USER6> If you consider a standards body corrupt because they have a single member you disagree with, you might be failing at politics.

<comment><USER11> It's not like they are just some "ordinary" bad guys, like A&T, who just want to make some bucks. The NSA is one of the most dangerous enemys to free speech and the freedom of the Internet. There is a high chance that they are going to undermine all our efforts to make a free and secure internet.

</comment></comment></comment><comment><USER12> The best part: the "Privacy" section of the document is blank.

[http://tools.ietf.org/html/draft-loreto-httpbis-trusted- prox...](http://tools.ietf.org/html/draft-loreto-httpbis-trusted- proxy20-01#section-7)

</comment><comment><USER13> There are some kinda legitimate uses for this in certain environments -- enterprise DLP, various kinds of filtering, etc. Potentially even caching and stuff on the distant end of really weird network connections (when I go to Mars in ~30y, I'd like to have as much cached as possible, and converted to message-based vs. connection-oriented protocols).

We have good enough workarounds for this right now (putting wildcard CA certs on devices and proxying that way), but they're not awesome. So, if there were a way to keep this from being used for evil, it could make some existing non- evil activities easier.

But, on balance, the risk of evil might be too high.

<comment><USER14> There are _potentially_ legitimate (though still sketchy) reasons to MITM HTTPS traffic from a host configured to allow that (for instance, by trusting an organizational CA). There are no legitimate reasons to MITM HTTPS traffic without the host's knowledge.

</comment></comment><comment><USER15> There was another article on here a week or two ago effectively blasting the http/2.0 wg for doing stupid things. I think it was the "HTTP 308 incompetence expected" article.

Now this. I'm beginning to wonder if I want anything to do with HTTP/2.0.

<comment><USER7> Perhaps you should look at the Hacker News comments on that thread: [https://news.ycombinator.com/item?id=7249193](https://news.ycombinator.com/item?id=7249193). Notably, my comments: [https://news.ycombinator.com/item?id=7249560](https://news.ycombinator.com/item?id=7249560) and [https://news.ycombinator.com/item?id=7249869](https://news.ycombinator.com/item?id=7249869). Basically, the author is wrong.

</comment></comment><comment><USER16> Ok - here is a suggestion: The Right to root.

Just as a citizens letters, papers and home are inviolable, should our new papers our new homes be also inviolable - if I own a device, No-one should legally be allowed control over it?

<comment><USER17> >if I own a device, No-one should legally be allowed control over it?

Then tech companies might start leasing out their devices: you technically don't own it, so you're not allowed to do what you want to it.

Not that the Right to Root wouldn't be nice, but the change in attitude has to come first. And we need to somehow convince the likes of Apple that their DRM is bad for business.

<comment><USER18> Wasn't that written from a mac/ipad?

<comment><USER16> errrr... yes. My iphone actually. (How could you tell? Or was that a lucky piece of sarcasm)

If the signatories to the US constitution owned slaves, I can use an iPhone while still wanting the Right to Root.

</comment></comment></comment></comment><comment><USER19> Another stab at using 'Trusted proxies' huh? I thought we had learnt that lesson a while ago.. Can we move on please, internet?

<comment><USER20> The fact is "trusted proxies" are a real thing right now. Plenty of private networks require that you trust one or more private CA roots and all SSL are intercepted and filtered. It is sort of a pain to do. You have to use something like Microsoft System Center to push the root onto all managed computers.

This IETF proposal just formalizes it.

</comment></comment><comment><USER21> The amusing thing about this is that MITM can also be used to one's personal benefit -- I run a local filtering proxy that strips off most of the crap on the majority of sites, and I've had to do a bit of hex editing to be able to do that without the browser complaining.

Look at it another way: With browsers becoming more and more unconfigurable and nearing the point of being user-hostile, it is any wonder that the content providers would want their content, whether or not the user likes it, to be delivered unchanged and forced upon the user? All the Snowden stuff has made us feel that way, but what I'm saying is that the one who is doing the MITM isn't always malicious.

<comment><USER22> Yes! If you don't have a reasonably easy way to inspect and modify what is being sent over the encrypted connections your device makes, you are in very serious trouble. Your device will be [ab]used against you.

</comment></comment><comment><USER23> The most alarming thing about this article is the author's tone.

</comment><comment><USER24> I'm not an expert in internet security or crypto. Some of the comments below raise some interesting points both defending the intent (and implementation) of it and pointing out the flaws. However, as an unsophisticated person interested in my data security, this sounds absolutely awful. Hopefully more clarity on this emerges.

</comment><comment><USER9> This proposal is so stupid it's hard to believe someone actually made it. Really beats the purpose: Why use SSL? Who am I protecting my data from if the ISP is snooping??? The kid on the Internet Cafe who just found about SSLSnoop?

At this point the right proposal should be to just remove SSL altogether, no need to make circles over it.

</comment><comment><USER25> Is someone from the NSA behind this?

Sorry, let me rephrase that. _Who_ from the NSA is behind this?

<comment><USER26> Apparently the NSA is a intelligence agency. [1] So they are probably not that blunt.

[1] [https://en.wikipedia.org/wiki/Nsa](https://en.wikipedia.org/wiki/Nsa)

</comment></comment><comment><USER27> Crazy. If you want to use caching, just use HTTP for that content.

<comment><USER28> It's not that simple.

If you are going to use HTTPS, you need to use it for all content on that domain. Otherwise if you load for example a large javascript file over HTTP, the attacker can just poison that file and control your whole page.

Even if you loaded an image from the same domain, your credentials would sent sent as a cookie in plain text.

You could use a separate domain for content as explained here: [http://stackoverflow.com/a/5160657/804713](http://stackoverflow.com/a/5160657/804713)

<comment><USER29> The web is long overdue for a method to specify an exact resource, by content- hash, from one-of-whatever-sources.

Those sources can then be other less-secure protocols, even those unanticipated by the referrer, because the client got the necessary verifier via the secure-path.

<comment><USER30> I believe there's already a standard HTTP header for this: Content-MD5.

Browsers definitely don't cache across origins by this though.

If they did, would it be possible to create a malicious JavaScript file with the same MD5 as jQuery?

<comment><USER31> Yes it would be possible because MD5 has been broken: [https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities](https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities)

Any file can be modified to result in a hash collision with a specific MD5. This makes is unsuitable for its stated purpose as a cryptographic hash.

The solution would be to use a newer and stronger hash like Keccak.

A solution similar to what you are thinking of is already used by Bittorrent's Distributed Hash Table to identify files.

<comment><USER29> To be precise, while MD5 has been 'broken' in the sense of not meeting its design goals for a long time, and there are now a number of scenarios where attackers can create pairs of files with the same MD5, it is not yet practically possible to create a collision for any arbitrary file (such as jquery.js) on demand. That would be the total 'preimage vulnerability' as mentioned at:

[https://en.wikipedia.org/wiki/MD5#Preimage_vulnerability](https://en.wikipedia.org/wiki/MD5#Preimage_vulnerability)

MD5 should absolutely not be used for this content-identification purpose or any other new code... and wise designers haven't been using it for 10+ years. I'm just mentioning this to be precise about the current state of its proven weaknesses.

</comment></comment></comment></comment></comment></comment><comment><USER32> Carriers are fighting against being turned into dumb pipes.

Google is fighting to turn carriers into dumb pipes.

I can't take this Google consultant seriously in that context.

<comment><USER33> Carriers _are_ dumb pipes. Carriers are fighting to get rid of that. Internet _is_ dump pipes connected together. Carriers are fighting against that.

</comment></comment><comment><USER34> When I read the title I thought this was going to be from Upworthy.

</comment><comment><USER35> Maybe he who proposes this proposal is just meant to be funny.

</comment><comment><USER36> SSL is such crap. time to make a better internet.

<comment><USER37> With blackjack and hookers?

<comment><USER38> he's not wrong about SSL being poor.. rather, the CA system is what I consider to be poor.

there was the idea of notaries that never took off, but that would be ideal imho.

<comment><USER36> yes notaries + alternative DNS. problem is really the root (literally). its the same thing: somebody running a server and making decisions based on profit/power what goes into that server. I mean you choose whether you go to GoDaddy or Comodo, but that's about it. with .com you don't even have a choice but verisign. DNSsec add insult to injury, by making domain regs the CA's. and this 'proposal' is really the height of absurdity. AT&T shouldn't be writing the trust protocols.</comment></comment></comment></comment>


The Galaxy S5 does not have temperature or humidity sensors - <AUTHOR> http://opensignal.com/blog/2014/04/09/does-the-galaxy-s5-have-temperature-and-humidity-sensors/ <comment><USER2> It's most likely due to the water-proofing. The S4 rugged version has the same limitation.

<comment><USER3> I talked to an engineer from Sensirion (the makers of the temperature sensor on the S4) a couple of weeks ago. He told me that the waterproofing was the reason that they couldn't include their sensor in the S5.

<comment><USER4> Conflicting information, I just talked with someone from Sensirion who was quite central to the the SHTC1 project, he confirmed it was NOT the waterproofing that was the issue and pointed out there are Japanese devices with the same chip that are waterproof, even to IP68 (2m depth).

</comment></comment></comment><comment><USER5> Well that's disappointing. Adding gimmicky(imo) sensors and removing functional/useful sensors.

Obviously Samsung is thinking from a consumer prospective, but still very disappointing.

<comment><USER6> > and removing functional/useful sensors.

Are temperature and humidity really that useful? I know many Android phones have had them, but have they really be used? Do they really add much to the device?

<comment><USER7> I believe temperature sensors are required to get barometric data to altitude[1]. That's why all altimeter watches also have temperature though its usually useless while wearing since its reading the temp of your wrist instead of the air.

On a second note I produce an app ([http://www.ullrlabs.com](http://www.ullrlabs.com)) for avalanche danger evaluation and knowing your ambient air temperature is one factor which is helpful in that process. Though I haven't yet tried to read that value on android phones for the app.

[1]See pressure altimeter calibration equation: [http://en.wikipedia.org/wiki/Altimeter](http://en.wikipedia.org/wiki/Altimeter)

<comment><USER8> Your first note is irrelevant, since all modern phones have a (hot) CPU running while the phone is active. It's why phones don't rely on their temperature sensors for ambient readings in the first place even if they have them.

</comment></comment></comment></comment><comment><USER9> I love how developers of this app allow themselves to collect numerous data about their users' phones, so much they even track their hardware, model numbers and available APIs. But the worst thing is probably that this has became so common that people don't react negatively anymore towards that kind of privacy violation.

<comment><USER10> Why do I care that a mobile developer knows my device model and hardware specs? I'd prefer you to know for bug testing and performance metrics.

</comment></comment><comment><USER11> Makes sense, after all temp sensors don't really belong to phones. What't the point of knowing it's 35C and the humidity of your pocket? They 'd make sense in cars, once (if ever) they get connected.

<comment><USER12> Weather signal [0] has developed algorithms to correct the internal sensor measurements for things like this, particularly temperature. So it's not entirely useless.

[0] [http://weathersignal.com/](http://weathersignal.com/)

<comment><USER13> Allow me to be skeptical about the reliability of this algorithm. How can you ever know the temperature of the air outside by measuring the temperature of your pocket? Sure, there's a correlation, to some degree. But what if you wear different pants, or put the phone in your bag? I just don't see how that's possible (to a meaningful degree of precision). I would think data from weather stations would be a lot more reliable, and make the temperature sensor obsolete.

<comment><USER12> It presumably relies on having multiple phones recording the temperature, averaging out person-to-person variations in attire (thickness of pants, etc.). If those variations are correlated among people for a given day (everyone is wearing thicker pants), it's probably colder, and that would have to be included in the algorithm.

</comment></comment></comment></comment><comment><USER14> What other cool sensors do mobile phones have these days?

<comment><USER15> Many phones also have magnetic compasses, so you can get an accurate bearing without needing GPS signals. I would expect significant advances in inertial navigation systems in mobile devices in the coming years.

[https://en.wikipedia.org/wiki/Inertial_navigation_system](https://en.wikipedia.org/wiki/Inertial_navigation_system)

</comment></comment><comment><USER16> The best tl;dr ever!</comment>


Mandriva in danger of closing its doors - <AUTHOR> http://www.itworld.com/it-managementstrategy/238291/mandriva-danger-closing-its-doors

<comment><USER2> I'm more surprised that they lasted this long. I remember using it back when it was Mandrake. It was ok for it's time. At the time, when I was stuck on dialup, it was nice to be able to buy a desktop distro on CD, but I really don't see how they've had a viable business model in years.

</comment><comment><USER3> Yes, it surely isn't nice to see one of the older Linux distributors likely gone but honestly... I cannot think of a single unique or outstanding feature that mandrake could offer back in the day and by now, desktop-linux is firmly in the hands of ubuntu and redhat. The last significant or even non- significant news I have heard or read about mandriva or mandrake must have been years if not a whole decade ago. I am actually surprised to learn now that they are still around and I am from Europe.

My facetious side thinks its sole reason for existence was that it was from France and offered French language so French people were probably more likely to use or buy mandrake than Redhat or SuSE or slackware.</comment>


Apple's Aggressive Recruiting Destroys Motorcyle Startup - <AUTHOR> http://www.reuters.com/article/2015/10/19/apple-motorcycle-idUSL1N12F2JZ20151019 <comment><USER2> _accelerated after a long struggle to find funding and a sound business model._

Or maybe, you know, that was the problem?

Lack of funding, no business model... Gee, why couldn't they retain top talent???</comment>


Danah Boyd: confused by Facebook - <AUTHOR> http://www.zephoria.org/thoughts/archives/2007/09/06/confused_by_fac.html <comment><USER2> If you're gonna respect anyone's opinions on social networks Danah Boyd is she. I think she's highlighting some excellent points, the punchline of which is that Facebook's caught between two opposing sides: pleasing their users versus opening up themselves to more promising business ventures. Luckily, Facebook's got great street cred and pretty good public relations, so in general what might be unspeakable by another company seems alright when they do it. If they can start making money before the users figure out they're being profited off of in potentially unwanted ways, they'll be pretty good off.

</comment><comment><USER3> whoa, small world. baratunde uses my email-management software. this is probably a bad day to tell him we're gonna limit it to 5 emails a day and axe the 'export' function...

</comment><comment><USER4> Her name is danah boyd.</comment>


What the Indian head wobble really says - <AUTHOR> http://www.bbc.com/travel/story/20180722-cracking-indias-mystifying-nod-code <comment><USER2> I can't believe this was posted to the BBC website and didn't have a single GIF or video.

This was amusing: [https://www.youtube.com/watch?v=Uj56IPJOqWE](https://www.youtube.com/watch?v=Uj56IPJOqWE)

This was helpful too: [https://www.youtube.com/watch?v=0RaBxH_MKQI](https://www.youtube.com/watch?v=0RaBxH_MKQI)

</comment><comment><USER3> Besides the heterogeneous nature of being an "Indian", the wobble is just agreement.

The person who's wobbling their head is agreeing to what is being said. It's not a yes/no.

It's mostly a "Go ahead and say what you want, I'll do what I want to do after you're done".

I didn't grow up in India, so I can see it for what it is, but I am Indian, so the subtleties are visible to me.

And aptly, people who don't need to take any shit/be kind in that instance/appear submissive don't "wobble" their heads. Those people mostly reserve it for their elders (parents/elder relatives mostly).

Take all of this with a huge grain of salt.

<comment><USER4> > The person who's wobbling their head is agreeing to what is being said. It's > not a yes/no.

> It's mostly a "Go ahead and say what you want, I'll do what I want to do > after you're done".

So "sure"/"ack" ("it resolves")? That's roughly how I'd interpreted it from interacting with colleagues, an acknowledgement.

<comment><USER5> Yes, it's an agreement, or like "sure yeah".

<comment><USER6> As some from Yorkshire I like 'aye' it's an anachronistic affirmative yes, old people still use 'nay' as well.

Language is a wonderful thing.

</comment></comment></comment></comment><comment><USER7> Just FYI - India is not a homogenous society. It has 22 official languages, 29 states + 7 union territories, 9 officially recognized religions.

So, no, there is no "Indian head wobble". What the fine article describes is a distinct cultural thing amongst a very specific subset of India's population that western society has encountered so far.

<comment><USER8> It's common enough that you can call it Indian head wobble.

Not all Americans are fat, you can still talk about the American obesity problem even if a few of the states are fitter than the European average.

People talk about American accent, but a Texan, a Californian and a New Yorker (just to pick 3 of many examples) will sound very distinct.

People talk about beer tasting German, but it's very distinct between Bavaria and Cologne.

Not talking about the Indian head wobble is just unnecessary hair splitting. It's an interesting phenomenon which is spread widely enough in India and throughout the Indian diaspora that you can call it that.

<comment><USER9> > Not talking about the Indian head wobble is just unnecessary hair splitting. > It's an interesting phenomenon which is spread widely enough in India and > throughout the Indian diaspora that you can call it that.

I don't know if you're Indian or very familiar with India, but this really is not true.

I'm from Punjab and the first time I travelled to Karnataka the head wobble was something of a culture shock to me. The way people constantly shook their heads to signal being attentive towards another person who is speaking, the way I saw an auto driver do a slow 180-degree shake to signal "yes I'm familiar with the address" while I thought he was trying to say "I've never heard of that place in my life", we have nothing similar in Punjab or its neighbouring states.

Maybe it's common in the Indian diaspora, because there is a lot of cross- Indian-state intermixing outside India, but that is not the case within India itself.

<comment><USER10> I have seen it in Pakistani Punjab, from an employee of the PTDC office in Lahore

<comment><USER9> Unless you've also seen the South Indian headshake, you might not know exactly what I meant by the culture shock. No Punjabi would do a long, slow sweep of their head to say "yes".

</comment></comment></comment></comment></comment><comment><USER11> Greek here, never been to India, never hanged out with Indians. The head nod is very easy to interpret. It means 'I am willing to talk to you and even agree with you if you play nice, but at the same time I am looking at you, inspecting you and trying to understand where this is going'.

<comment><USER12> Given the fact that you lack any Indian cultural references, and given that your interpretation seems to differ from those suggested in the article, what makes you think that your interpretation is anything other than something in your own head?

<comment><USER11> My interpretation doesn't actual differ a lot from that in the article. I have watched enough videos, you can easily understand what is going on by interpreting the full body language of the participants, part of which the head nod is.

</comment></comment></comment><comment><USER13> My understanding is that it is an affirmation of understanding and only of understanding, á la Roger in radiophone.

It is not same as Wilco, Correct, or Negative, it is just and only just Roger.

</comment><comment><USER14> Do people writing about India in the west even know that there is an entire part of the country where people look more "East Asian" than "Indian"? Are writers generally aware of the North-Eastern parts of India at all?

</comment><comment><USER15> As the article and the comments say, it is a gesture rich in context. While there is some common meaning, that meaning can differ based on the situation, the people, the relationships. And if you spend enough time with your team, you'll get to know them and you will understand them, with this gesture or any other. Trying to write up a black and white interpretation of such things is no more effective than it would be if the article was reversed, trying to tell people in India what it means when Americans move their eyebrows.

Just get to know the people you work with -- it will all fall into place.

</comment><comment><USER16> I have never seen this in eastern and north-eastern India. I think its mostly done by people from west and south India.

</comment><comment><USER17> This is the second time I've seen this article or something similar recently. I don't think this is exclusive to Indian culture. A non-committal reaction, where you don't want to nod or shake your head "no" is common in other parts of the world. I do it and I'm neither Indian nor have I worked in India.

<comment><USER18> The 'Indian head wobble' is a very distinct thing, separate from, at least, anything I've ever seen in any western culture.

<comment><USER19> Not sure why this post is being downvoted but I agree with this. It's not entirely unique to India but its frequency/speed of wobble is distinct from others. Perhaps it has to do with their languages. Most of the languages have up and down tone that goes along with the wobble.

</comment></comment></comment><comment><USER20> It's similar to [https://en.wikipedia.org/wiki/British_humour](https://en.wikipedia.org/wiki/British_humour)

</comment><comment><USER21> The node code is very confusing when working with cross cultural teams

</comment><comment><USER22> Very bad article... Not a single GIF or video to demonstrate the movement? You prefer decribing the motion instead of showing it? Are you the BBC or some sort of amateur blog?</comment>


Jack Horkheimer, the "Star Hustler", passes away - <AUTHOR> http://www.skyandtelescope.com/news/home/101194934.html

<comment><USER2> I met him about 10 years ago at an astronomy conference. Very nice man, and a great speaker.

His talk was about the influence the appearance of comets had on politics in classical civilizations. It was an excellent presentation.

As a visual aid, he brought out Roman era coins, from his personal collection, which commemorated comets and various leaders, including Cleopatra if I remember correctly. As he finished talking about each one, he would hand it down into the audience to be passed around and viewed by everyone.

I remember thinking that that was pretty brave of him, considering the size of the audience and the low lighting conditions. But he got them all back.

He will be missed.

</comment><comment><USER3> [http://www.tropicfan.com/The%20Many%20Phases%20of%20Jack%20H...](http://www.tropicfan.com/The%20Many%20Phases%20of%20Jack%20Horkheimer%20by%20Michael%20Browning.htm)

</comment><comment><USER4> I looked forward to his little five minute vignettes into the night sky on PBS --called Star Gazer. He helped spur my interest in astronomy. He made a difference in my life as I'm sure he did in many other people's lives. (We'll miss you, Jack.)

</comment><comment><USER5> I'll miss him. He conveyed such incredible enthusiasm in his TV segments and brightened up so many of my evenings. He was an absolute, unabashed nerd, and I say that with the utmost of admiration and respect. RIP.</comment>


Ask HN: Do enough people click on ads to make targeted ads worth the cost? - <AUTHOR> I would wager that it costs a lot of money for Google/Facebook/Twitter to curate personal info and then sell it to ad providers.<p>Everyone I know uses an ad-blocking plugin, and those who don't would never click on an ad on purpose. So...are there that many people who WILLINGLY/ON PURPOSE click on ads? <comment><USER2> If I'm looking to buy something I go to google and click the ads first usually.

If I'm doing research I click on the organic links.

</comment><comment><USER2> a lot of website ads have moved to retargeting. you put a pixel or js code on your site and when they visit other sites they see your ads.

Also, you're probably not someone that shops to shop.</comment>


Silicon Valley Reels After Trump's Election - <AUTHOR> http://www.nytimes.com/2016/11/10/technology/trump-election-silicon-valley-reels.html <comment><USER2> Carlos Slim's personal blog continues to _generally_ disappoint (weasel wording since I've heard nothing but praise about their election night coverage, which could well be orders of magnitude better than most in both presentation and accuracy).

For example, lying is not a policy that will help anyone:

 _Last year, Sundar Pichai, Google's chief executive, published a broad rebuke of Mr. Trump's plan to ban Muslims from immigrating to the United States._

Trump's been quite explicit about this being a moratorium, until we can figure out a better way to do it. And the "broad rebuke" they linked to was too short in general and too biased in facts vs. feelings to take seriously. Could we at least have an acknowledgement of why anyone would take this proposal seriously? Since we're talking about California, I'll even include a hint: [https://en.wikipedia.org/wiki/2015_San_Bernardino_attack](https://en.wikipedia.org/wiki/2015_San_Bernardino_attack) (an even a sane immigration policy could have prevented, our current regime didn't even try, and we have many particulars about this couple if you doubt it).

 _Some made very big, idealistic proposals — this being, after all, the land of disruption. On Twitter, for instance, Mr. Pishevar said he would fund a campaign to get California to secede from the nation._

And this concept is about as old as the nation itself, couching it in terms of idealism and all the good connotations of "disruption" is ludicrous. Although I suppose killing off 6-7 figures of people, as happened the last time this was attempted for real, would qualify as "disruptive".

Let me also comment on the economic idiocy of such a proposal: if it wasn't for the fashion and taste preferences of California's ruling classes being enshrined in law and regulations, it could probably feed itself, and could certainly supply its own electrical power and it's big enough, like Texas, to run its own reliable gird.

But we all know the exact opposite has happened, and going further a simple change in law could also deprive it of the Alaskan oil which the last time I checked glutted its refineries (and crude oil is not all that fungible, plus it would be _much_ more economic to send Alaska's oil to Japan and thereabouts, they get most of their's from much further away, the law here is a remnant of the '70s insane energy policies).

Etc.; without entering a real war, which didn't, for example, happen quickly when Southern states started to succeed, the rest of the nation could bring California _very_ low with simple embargoes like the ones I've mentioned, and that not even getting into what could be done in "cyberspace". The _casus belli_ would be the inevitable, even required refusal of cash strapped California to shoulder it's share of the outstanding nation debt at the time of succession.

ADDED: See also this "evergreen" Tweet [https://twitter.com/RubinReport/status/796229381114859520](https://twitter.com/RubinReport/status/796229381114859520)

"Media which got everything wrong will now tell you all the things that will happen as a result of the thing they said wouldn't happen."</comment>


Robert Fano has died - <AUTHOR> http://www.nytimes.com/2016/07/27/technology/robert-fano-98-dies-engineer-who-helped-develop-interactive-computers.html <comment><USER2> More discussion here: [https://news.ycombinator.com/item?id=12102623](https://news.ycombinator.com/item?id=12102623)

</comment><comment><USER3> Why is this on front page? Story is 11 days old.</comment>


One-Third of All U.S. Coronavirus Deaths Are Nursing Home Residents or Workers - <AUTHOR> https://www.nytimes.com/interactive/2020/05/09/us/coronavirus-cases-nursing-homes-us.html <comment><USER2> Is there a further breakdown between residents and workers? I didn't see one in the article, but I would guess that resident deaths outnumber worker deaths. That seems like an important distinction.

<comment><USER3> Yeah, those seem like very different stories. That old people with health conditions are likely to die isn't exactly news. If younger people with high exposure frequency became much likelier to die if becoming sick, that could be very notable (but doesn't seem likely from just the information here).

</comment></comment><comment><USER4> That count is actually way low for California according to the LA times (which does its own count). They have it at 49% in California. They've reported the state's data has glaring omissions.</comment>


Ask HN: No-bullshit UK-based domain registrars - <AUTHOR> I am looking for a replacement domain registrar. I currently use Gandi, who are based in France. I am happy with Gandi's service, but I am looking for a UK registrar because of Brexit ramifications.
I live in the UK. The current Brexit transition period[1] means I deal with UK VAT for EU purchases, including domains. I pay VAT (sales tax) and can claim it back as a business expense. When the transition period is over, my accounting will be more straightforward if I purchase domains from a UK registrar.
I don't want the cheapest possible service, I don't want endless upselling, or any of that nonsense. I would like to buy domains from a wide variety of TLDs, be able to administer DNS etc from a sensible control panel, and have clear billing so I'm not spending time deciphering things.
Who should I look at? Who should I avoid?
Thank you in advance for advice and feedback.
[1] https://www.gov.uk/transition <comment><USER2> I have used Tsohost[1] for a long time. They used to be Daily.co.uk.

For me the big advantage is that you can buy a domain for 10 years.

The control panel is pretty generic but works OK. There is no API to control DNS that I am aware of.

[1] [https://www.tsohost.com/domain-names](https://www.tsohost.com/domain- names)

<comment><AUTHOR> I used to deploy Tsohost for client and reseller sites, they were acquired by GoDaddy and their service is sadly deteriorating.

</comment></comment><comment><USER3> Not had much of a problem with Fasthosts ([https://www.fasthosts.co.uk](https://www.fasthosts.co.uk)) in a couple of decades of using them.

<comment><AUTHOR> Thanks. I've had some experience with Fasthosts a long time ago, I will take a look.

</comment></comment><comment> jadzia-dev Why not just use Google Domains? You can just use an UK address and it will charge to the UK, right?

<comment><AUTHOR> I've had mixed results with Google services over the years. I'm a G Suite Partner, and that part of Google has seemingly no awareness of UK VAT at all, so I have to fudge my accounts when payments come in.

Granted that's earnings not expenses, but it does play on my mind.</comment></comment>


Android Studio Beta Released  - <AUTHOR> https://sites.google.com/a/android.com/tools/recent/androidstudiobetareleased

<comment><USER2> Trying it out now. It's got glass and wear APIs but I feel that they're moving too fast for me now. I'm only just making my first Android App. It's interesting coming from Ruby on Rails back to the Java ecosystem with its heavy heavy architectural tooling. Amazing stuff really. I feel this is Google's answer to Visual Studio. I'm happy that Google is the company Microsoft and Apple should have been in terms of embracing software openness fully but I fear that their corporate mission will finally cause them to succumb and then we'll be looking for the next Google. Until then there's Android which at least has Linux at its core.</comment>


Why I think app.net will succeed - <AUTHOR> http://workstuff.tumblr.com/post/29171511685/some-thoughts-about-app-net-and-social-networks

<comment><USER2> Nice article.</comment>


AlphaGo's next move - <AUTHOR> https://deepmind.com/blog/alphagos-next-move/ <comment><USER2> There was a time not too far back when people used to be considered a "genius" for their ability to memorize things well.

Nowadays nobody thinks of them as geniuses.

Also, people used to be considered geniuses for knowing a lot of things.

Nowadays information is just a Google search away, so knowing a lot doesn't really mean as much as it used to. What matters more nowadays is your ability to learn synthesize the things you know to come up with creative solutions to things.

Basically the "memory" part of human brains have become commoditized without us even realizing.

It's still very early but I do think there have been some subtle but significant step forward in the last couple of years. The most important being: machines are capable of doing certain things better in ways humans can't comprehend easily. I think this is a glimpse into the future where the "creativity" aspect of our brains will become commoditized, also without us realizing.

This doesn't mean machines will take over, just like machines didn't take over the world because they have better memory. But I think this will result in many humans taking advantage of this aspect to exert influence on rest of the humanity.

<comment><USER3> > Also, people used to be considered geniuses for knowing a lot of things.

This is still true, and in the eagerness to dismiss "memorization" as a thing of the past you overlook the obvious. For example, anything you care to know about, say, C++ programming or quantum field theory is available to you on the internet. But does that mean you can write a C++ program as if you had already learned it? What if you want to write a C++ program and you have to look up everything? You will do a very poor job if at all, and you will take a lot of time.

So yeah, until looking up stuff in the internet is as quick as effective as looking stuff up in your brain (the quick may happen but the effective I don't think so), then it still is a very worthy skill.

<comment><USER4> But you've just proven cocktailpeanuts point that its about the ability to use the knowledge, not simply recall it.

<comment><USER5> The ability to use knowledge does not come out of thin air. It is unlikely to find someone who knows how to program C++ extremely well, or solve problems in Quantum Field theory, but does not remember most of the language constructs or mathematical equations.

Continuous practice involves putting in the hours at practicing an art or a science, which by itself builds muscle memory about the language syntax/equations etc. It is unlikely that one can remember one but not the other.

<comment><USER6> "The best geologist is he who has seen the most rocks." – H. H. Read

<comment><USER7> Well, in that case:

"All science is either physics or stamp collecting" -Ernest Rutherford.

</comment></comment></comment></comment></comment></comment><comment><USER8> I remember vividly in 1997 when Deep Blue defeated Kasparov, and I was a competitive chess player. The mystique of the game was immediately lost for me, and I never found the passion for the game that I once had. My heart goes out to the sea of Go players now searching for meaning in the game. At the very least we can take this signal as a true indicator that our world is close to being completely upheaved by intelligent machines, in all areas of intellectual pursuit.

<comment><USER9> There are several activities right now that people keep doing despite machines being better suited: martial arts (and more in point, HEMA[1]), handicrafts, several Olympic sports. Why would anyone attempt to run a marathon under two hours, when any car can do it in 30 minutes?

I think the answer lies less in "I will be the absolute best", and more along the lines of "I will do it better than anyone before me". And sometimes, even "I will do my best" is an excellent reason for doing things.

I don't think Go players were in it due to a need for expertise that machines could not fulfill until now. And if people nowadays keep practicing with swords several centuries after the invention of firearms, Go players will do just fine.

[1] [https://en.wikipedia.org/wiki/Historical_European_martial_ar...](https://en.wikipedia.org/wiki/Historical_European_martial_arts)

<comment><USER10> It does feel like there's a difference–maybe Go and Chess are just so much closer to what defines humanity than any physical sports?

<comment><USER8> Yes and physical prowess was never dominated by humans anyway. We are surrounded by creatures which can fly and swim and sprint far better than any human ever could. But our minds is what separates us from the beasts. We've never been second place in the thought competition.

<comment><USER11> Aren't we actually better at endurance running than any other animal?

<comment><USER12> Seems sled dogs beat us on this one:

[https://youtube.com/watch?v=HDG4GSypcIE](https://youtube.com/watch?v=HDG4GSypcIE)

<comment><USER13> Yet again we have created something to outdo us.

<comment><USER14> DeepMind could do it better.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> One common comment from Go players at all levels up to 9-dan pros is that they don't understand many of the moves. The same will happen as more and more advanced AIs are used in the real world.

Yes, we do not completely understand the workings of current advanced neural networks either but the effects are still contained as they are not general enough to cause unintended impact outside their domains.

This could have started to change: a recent Google paper, AutoML, allows the machines to design themselves to suit each task. [1] A future advance could allow the machines to pick and learn to do new tasks that are helpful to accomplish a given high level mission. Therefore, chances of unintended consequences become much greater.

With human involvement only at the meta level, deep understanding of the generated implementations becomes more challenging and, in highly complex domains, perhaps impossible.

The major issue is, without a moral core that closely aligns with humanity's evolved morality, there _will_ be moves that advanced AIs come up with that we deem abhorrent, and sometimes unforeseeable, yet they perform them innocently and we only find out the consequences once it is too late.

[1] [https://research.googleblog.com/2017/05/using-machine- learni...](https://research.googleblog.com/2017/05/using-machine-learning-to- explore.html)

<comment><USER16> They don't fully understand the moves but on the other hand, the live commentary on the games suggests it's not completely mysterious. Good moves still tend to look good to them, in retrospect at least.

The games are apparently very interesting to study.

<comment><USER17> Against a human, the games look fairly straight forward.

From what they've released against itself, the games look like a different game. Especially at times, Game 2 in the current crop for example.

</comment></comment></comment><comment><USER18> Congratulations to Deepmind and Google for this tremendous achievement.

However, it is disappointing that the code and model will not be released publicly after Alphago finishes competitive play. It's one thing to say that an apple, once dropped, will fall to the ground, but another to describe its motion as 1/2at^2 + vt.

<comment><USER19> They did announce that they would release a teaching tool which will show AlphaGo's analysis of Go positions, as well as the paper explaining how to build your own.

Not only do you have the principle and the formula behind it, but also a little physics simulator tool! At this point, it is hard to complain.

<comment><USER20> > At this point, it is hard to complain.

Actually, it's very easy to complain. If they released the model, people could generate arbitrarily many self-play games instead of depending on DM to release 50, could create arbitrarily many tools using the model instead of depending on DM to create and maintain a single tool, and could verify the results of training a clone based on even sketchy descriptions of the methods instead of depending on DM releasing a detailed enough whitepaper and then guessing at whether a reimplementation is competitive or not. DM is only being 'generous' if you ignore how releasing the model is easier for them and superior for us in every way.

<comment><USER21> > _people could generate arbitrarily many self-play games_

I have doubts. Their TPU design may be a large factor into making matches at this level within the time limits. And at this point, some implementation details might hook into Google-specific libraries that require the ability to spawn processes in thousands of servers, which past blog posts[0] have hinted at.

[0]: [https://deepmind.com/blog/decoupled-neural-networks-using- sy...](https://deepmind.com/blog/decoupled-neural-networks-using-synthetic- gradients/)

<comment><USER20> There might be some hard to release infrastructure code for the MCTS part, certainly, but the model on its own should be a standard TF CNN model and highly competitive (and people can write their own MCTS wrapper, it's not that complex an algorithm). Nothing in the AG paper or statements since has hinted at using anything as exotic as synthetic gradients* and there is no reason to use synthetic gradients in AG. (In RL applications the NNs are generally small because there's so little supervision from the rewards so a large NN would overfit grossly; a NN so large as to require synthetic gradients to be split across GPUs would be simply catastrophicly bad. Plus, the input of a 19x19 board, a few planes of metadata, and other details encapsulating the state is small compared to many applications like image labeling, further reducing the benefits of size. Silver has said AG is now 40 layers but that's not much compared to the 1000-layer Resnet monsters and even those 40 layers are probably going to be thin layers, since it's the depth which provides more serial computation equivalence, not width, making for a model with relatively few parameters overall.)

* I find synthetic gradients super cool and I've been reading DM papers closely for hints of its use anywhere and have been disappointed how the idea doesn't appear to be going anywhere. The only followup so far has been [https://arxiv.org/abs/1703.00522](https://arxiv.org/abs/1703.00522) which is more of a dissection and further explanation of the original paper than an extension or application.

</comment></comment></comment></comment></comment><comment><USER22> The 10 AlphaGo vs. AlphaGo games are a nice gift!

I have always liked playing through great games, both Chess (using the book The Golden Dozen) and Go (modern games and the ancient Shogun Castle games).

I have some history with computer Go. In the late 1970s I wrote a Go playing program in UCSD Pascal that I sold for the Apple II, and also for a lot more money I sold the source code to a few people who wanted to experiment with it. DeepMind's AlphaGo is a great intellectual and technological triumph and I agree that it is an example of future AIs teaching us and working with us.

A little off topic, but Peter Norvig gave a nice talk a few weeks ago at the NYC Lisp Users Group where he talked about the future of collaboration with AIs and also that the ability to work effectively with AIs, adding human insights, will be an important future job skill.

<comment><USER23> Do you know if there's video or audio of Peter's talk online? I just did a bit of a search but couldn't find it.

<comment><USER22> [https://vimeo.com/215418110](https://vimeo.com/215418110)

Enjoy!

</comment></comment></comment><comment><USER24> It's scary how coverage of this match in China, which is extensive, actually manages to censor the association between Deepmind and Google.

<comment><USER23> The microphones used in the post match discussion featured the name "Google" quite prominently. I imagine that was a negotiated detail.

<comment><USER24> There's different post match discussions.

</comment></comment></comment><comment><USER25> So, a question bordering on the philosophical :

What can be done to prepare for the end of human supremacy, and quite likely human civilization? For instance, as a software developer it feels almost pointless to continue improving at my craft if AI systems will surpass me within 2-4 years (even if the pessimists are right about it taking 5-10 years, that's still an awfully small timeframe).

Likewise, it feels a little pointless to work on any endeavor - technical or otherwise - including but not limited to AI research itself. From a purely practical standpoint just getting up to speed on AI research will take a solid 5+ years, and from a moral vantage point I'm not sure that's even a defensible career given the obvious and hugely negative implications that field will have for human civilization.

Even in artistic endeavors, humans will soon be second fiddle to our own creations - so it's not like there's any "point" to starting down that path either.

Is it time to just engage in a hedonistic, nihilistic, fest of gluttony and "fun" while that's still possible? Honestly, news like this just makes me consider ending it all : it feels like none of us will have much of a future before long.

<comment><USER26> Is there really anyone credibly suggesting software developers will be surpassed by AI within a few years? Writing arbitrary software seems dramatically more complex than what "AI" like systems are capable of today.

Even 10 years seems impossibly soon.

<comment><USER27> People said the same thing about Go. That it was far too difficult and that a pro-level AI was 10+ years away.

What happened was new mathematical tools and new hardware were developed, and suddenly it was all too possible.

It's clear that with our _current_ tools, general AI is out of reach, and new tools must first be developed. But because nobody has any idea what those new tools _are_ , it could happen overnight or over 100 years.

<comment><USER28> It didn't come from _nowhere_ , the current streak of ML achievements rides on the back of deep learning, which is an elaborate pattern matching at its core. What makes Go "harder" than chess is that it's difficult to estimate how good or bad a particular position is, so we employed a "magical box" of deep learning and learned to estimate how good a particular move is. That's pretty good, but let's not forget

\- it took a ton of very hard work

\- it's not transferrable to other domains per se ("elaborate pattern matching" can be, but it's not even an AI)

\- this has nothing to do with qualia, consciousness or the theory of mind.

Programming is not about elaborate search or pattern matching at the end. It's about formalizing a domain, stripping it from some subset of real-world complexity, and inventing a solution to a problem in that domain. A rift between beating someone in Go and deducing a fact that doubles wouldn't do well in financial calculations is _immense_.

This sort of over-extrapolation of current trends is surprisingly prevalent in the tech crowd to be honest. It's like folks in mid-20th century who saw both airline and car industry exploding and made a "logical" guess about flying cars being the obvious next step. Guess what, physics doesn't work that way and flying cars are a dumb idea. The current AI craze seems very, very similar to me.

</comment></comment></comment></comment><comment><USER29> > We plan to publish one final academic paper later this year that will detail > the extensive set of improvements we made to the algorithms' efficiency and > potential to be generalised across a broader set of problems.

I'm fascinated to see what the next step for this AI is. Anyone care to speculate what a system like this could most readily be applied to?

</comment><comment><USER30> I find it interesting that AlphaGo improves its play by playing against itself. I wonder what the limits of this are.

<comment><USER31> In RL you have two modes, "explore" and "exploit". In explore mode it doesn't always select the best known move, instead it selects a promising move for which it has less experience. This is how the surprising new strategies are discovered, in self play there's no shame in losing.

</comment></comment><comment><USER32> The problem is an AI that is good at Go is not at all transferable to any other game. However, a human prodigy can apply their genius to many domains.

<comment><USER33> > However, a human prodigy can apply their genius to many domains

I'm not sure how true this is. It's pretty rare to find someone who is a genius in more than one domain. Einstein was famously offered the presidency of Israel. Sure, he could probably do well in other sciences, but he was smart enough to know he could not apply his genius to unrelated domains.

<comment><USER32> Of course there is domain knowledge that needs to be learned, along with non intelligence related characteristics, such as personality. But general intelligence appears to be widely applicable.

</comment></comment></comment><comment><USER34> I'd like to see public competitions between two AI giants like Google and IBM. Now that would be an interesting ongoing race for AI superiority.

</comment><comment><USER35> My browser just shows me a blank page.

</comment><comment><USER36> If your AI is so great you should do some deep learning thing to explain the AlphaGo moves.

</comment><comment><USER37> The gift Google makes to the community (some games AlphaGo,played ) is nothing. The super tricky thing with neural networks is that you can't reverse engineer them. Once the information is coded into the parameters, you can't base anything useful on them. So it's a super good intellectual property protection... Therefore one more nail in the coffin of knowledge sharing as we know it...

<comment><USER38> Most importanly, it is almost inevitable they must run on a fam of computers basically mean it becomes a service. Can we ever create a robot who can self- learn but with the super brain power locally without having to call a service for an answer?

<comment><USER37> This raises a question for me : is there currently some public infrastructure that can rival with AlphaGo ?

<comment><USER38> Public means API? AlphaGo is very specialized in solving Go game. Google, Amazon and IBM have services for various services like image recongition and speech recongition. Startups like Clarifi also exists in that space.

The closest to a generalized AI service would probably be Watson from IBM (but I don't have experiment with it sadly so I am not sure about the usage experience).

<comment><USER39> > The closest to a generalized AI service would probably be Watson from IBM

Ha ha ha!

<comment><USER38> That's not very nice.

<comment><USER39> Sorry, I honestly thought you were joking.

'Watson' as it is sold today is a mishmash of random, separate services. You can get the same from Google, MS or multiple other places.

'Watson' the jeopardy winning thing was an ensemble of search and rule-based NLP techniques.

Neither are much like general AI.

</comment></comment></comment></comment></comment></comment></comment><comment><USER40> "We have always believed in the potential for AI to help society discover new knowledge and benefit from it" Get real. You do this for your own intellectual gain. Google does it for financial gain.

Meanwhile, Antarctica may crumble. How about putting effort into solving THAT problem, with all your technology & knowhow Google?

<comment><USER41> [https://www.logicallyfallacious.com/tools/lp/Bo/LogicalFalla...](https://www.logicallyfallacious.com/tools/lp/Bo/LogicalFallacies/155/Relative- Privation)</comment></comment>


Tell HN: My day job is just as intensive as a startup - <AUTHOR>

I'm an analyst programmer working for Accenture in the UK.
Working for Accenture is like founding a startup. You go to bed thinking about your project, you wake up thinking about your project and you spend 12 hours a day working on your project, the other 12 hours you spend filling in paper work.
Only difference? There is no chance of a massive pay off.
That is all. <comment><USER2> So... why work for Accenture then?

<comment><USER3> the lack of chance of massive payoff is probably balanced by a stable income.

I got a feeling that if you are the kind of person that worries about any job, you'll worry about all jobs.

(For certain values of "worry".)

<comment><USER4> There are lots of places where you can make a stable income without flushing your health, your psyque and your social life down the toilet. Hell, if you don't care about that and are already working 80+ hrs per week, you could probably make more money by working 2 regular jobs! Or you could have your cheese and eat it too, by working one 9-5'er + moonlighting...

I guess you feel all excited about your current job, and it must be an amazing professional experience... but you will grow older some day. Just be aware of that fact and be ready to jump boats before you burn out the fire inside you.</comment></comment></comment>


Systematic Discrimination of Indian Immigrants in US - <AUTHOR> http://7monthsvs70years.siia.us <comment><AUTHOR> I have researched this issue many times, and I think this information by SIIA.US explains very well, the issue of systematic discrimination of immigrants from India in the US.</comment>