A Law Professor Explains Why You Should Never Talk to Police - <AUTHOR> http://www.vice.com/read/law-professor-police-interrogation-law-constitution-survival <comment><USER2> > _He didn 't say a word. And there's no doubt that he was exercising his > Fifth Amendment privilege, but he didn't [formally] assert his Fifth > Amendment privilege. So the five Republican [appointees] on the Supreme > Court said, Because you didn't tell the police that you were using your > Fifth Amendment privilege, your exercise of the privilege, or your decision > to remain silent can be used against you as evidence of guilt._

Wow, just wow. Even when you choose to say nothing, that can be used against you as guilt. It really seems like the American way is guilty until proven innocent, and there will be no let up and everyone is in jail!

<comment><USER3> > Because you didn't tell the police that you were using your Fifth Amendment > privilege, your exercise of the privilege,

That ruling needs challenging. It runs contrary to the Miranda rights. The police explicitly state that you have the right to remain silent. They don't say that you need to invoke the right.

<comment><USER4> Miranda is only implicated when you're taken into custody, which didn't happen here. It doesn't protect you from incriminating yourself in a voluntary conversation with the police, which is what happened here.

The _purpose_ of _Miranda_ , and the Fifth Amendment generally, is not to keep guilty defendants from incriminating themselves. It is to keep the State from using its coercive power to extract unreliable confessions from the accused. When an accused incriminates himself without the coercive power of the state being invoked, excluding the evidence does not serve the purpose of the Fifth Amendment. The Supreme Court has given a pretty broad reading to when the coercive power of the state is invoked, but has drawn the line just short of "any interaction with the police."

</comment></comment></comment><comment><USER5> This may be good advice but it indicates that something is very, very wrong with this society if you can't talk to cops.

<comment><USER6> Might it be as simple as the economy? I mean the police needs unchecked power to keep the bottom of the 99% in line.

<comment><USER7> I don't think there's any indication that the bottom 99% commit fewer crimes or require less policing.

</comment></comment></comment><comment><USER8> How far do you take this? If I see someone in a car throw some trash at a bicyclist, and then swerve and knock the cyclist off the road...should I not give a description of the car and driver to the police?

Or suppose a child disappears on the way home from school. Police ask people along the child's normal route if they saw her that day (they are trying to narrow down where she may have been abducted). I was out mowing the lawn that afternoon and did see her walk by, and know the time to within 5 minutes. Should I not tell the police?

In prior discussions of this video on other forums, people have told me that based on it they would in fact not say anything in the above examples. If people won't tell the police these kind of things, it is going to be a lot easier to persuade people to support pervasive public surveillance.

<comment><USER9> How the hell are you supposed to behave?

Police officers have the informal authority to make your life miserable (detaining for 24hrs without cause, selective enforcement, the ability to lie both to you and the court and be taken at their word, etc). No lawyer is going to advise talking to the police, but there's clearly an element of selection bias in that. In cases that don't wind up requiring a lawyer, cooperation with the person who has this power over you is almost certainly to your benefit. The real question is how to draw the line, and all the lawyerly "never say a word to the police ever unless you're invoking the 5th" really doesn't help.

<comment><USER10> Most people just talk to the police. The overwhelming majority of interactions with police are benign.

Consider avoiding police interactions if you are black/latino and not a resident of the neighborhood where the interaction occurs; if the police are knocking on your door or doing something else that deliberately involves them confronting you; if you carry or have casual access to firearms or contraband; if you have any criminal record.

Statistically, most people don't fall into these buckets and thus don't land in the fact patterns that generate the majority of abusive interactions.

I know it's hard to believe on Internet message boards, but in majority- minority neighborhoods in the US, the primary complaint residents have with the police is that _they aren 't doing enough_.

(I do not also mean to say that residents of black neighborhoods aren't also concerned that the police will casually murder them in tense/hostile confrontations, because that is a real concern as well).

</comment></comment></comment><comment><USER11> As someone who used to put on the uniform i can tell you this is really good advice. Be smart, it can save you.

<comment><USER12> The surprising thing is, it can save you even if you're innocent.

<comment><USER13> ISTM silence is even better for the innocent than it is for the guilty. An innocent suspect has no idea what sorts of statements will be interpreted as incriminating.

</comment></comment></comment><comment><USER14> One flaw with this advice is that it's difficult, impolite, awkward and unrealistic to stay perfectly silent.

How about "my lawyer would be happy to answer all your questions"? Does that work?

<comment><USER15> That is _exactly_ what the police want to exploit when they're questioning you - social norms and politeness.

When you're having a conversation, we're conditioned to find long pauses awkward and uncomfortable. That's why when you start not saying anything during a conversation, the other person will jump in and start filling the dead air.

It's useful during negotiations, because the person will start jumping in with concessions, trying to make things less awkward, when you let silences stretch out when it's "your turn to talk".

Just remember, the police are not your friends. They want something out of you. Don't give them a single inch.

"I want a lawyer" or "I want my lawyer" and then shutting up has nothing difficult, impolite, awkward, or unrealistic about it.

If you're worried about politeness when the cops are trying to pin a crime on you, I really don't know what to say except think about how impolite it would be for them to arrest you.

</comment></comment><comment><USER16> What's even more impressive about this old presentation is the second half: [https://youtu.be/d-7o9xYp7eE?t=26m52s](https://youtu.be/d-7o9xYp7eE?t=26m52s)

This is where a cop comes up after the 'slick lawyer' (who is giving fantastic advice the whole time) and completely agrees with him.

</comment><comment><USER17> TLDR: The lawyer in the viral YouTube video on not talking to the police has written a book on it. Also, due to a Supreme Court ruling, saying that you invoke the 5th amendment can be seen as admitting guilt.

<comment><USER18> IANAL, but my understanding of the supreme court decision is that if you stop answering questions, that can be presented to a jury as evidence that you may be guilty. A stupid example:

Q: Did you kill Alice?

A: No.

Q: Did you kill Bob?

A: No.

Q: Did you kill Carol?

A: _silence_

They can then make the argument in court that since you stopped answering questions at the 3rd one that you are trying to hide something. This is why the advice is to just straight up refuse to answer any questions without a lawyer. "I want a lawyer" is not refusing to answer the question, just delaying it, so may not be covered by the current precedent.

<comment><USER19> I am a lawyer, and a former prosecutor and former defense attorney (I do civil law now). And invocation of your right to counsel is supposed to terminate all questioning. Very clear that it cannot be presented as evidence if the matter goes to trial.

<comment><USER18> My understanding is that in Salinas v. Texas the issue was that the defendant did not explicitly invoke this right, but was quiet; though apparently, at least one of the Justices was of the opinion that the 5th amendment rights do not apply when the person being questioned is not being detained.

</comment></comment></comment></comment><comment><USER20> What does one do if stopped in traffic? Just say, 'I want a lawyer?' Seems like that would get you arrested (or worse).

<comment><USER21> I'm waiting for this scene to really happen in the US:

(A police officer walks into a doughnut shop.)

\- Good day Sir, how much these doughnuts cost?

\- I want a lawyer.

<comment><USER22> Is it sad that I can visualize a scene where that's the right thing to do? Such as when the prices are clearly marked, and the person behind the counter is on parole (but hasn't violated it).

Yeah, it is sad.

</comment></comment></comment><comment><USER23> I would love to know how legally and practically this all works in Canada. I feel like it may be very similar, but different enough to matter.

<comment><USER24> The same, by not saying anything to police who question you on the street it can be 'obstruction' if you don't ask for a lawyer first before being silent, unless you are arrested and your right to be silent is given to you. Also in Canada police don't have to stop talking to you if you've requested a lawyer they can still keep you in interrogation trying to get you to talk for as long as they want, which usually means all weekend until you see a judge on Monday morning. [http://www.edelsonlaw.ca/news/show/40/8/0000/0](http://www.edelsonlaw.ca/news/show/40/8/0000/0)

Any informants they place in your cell with you, regardless of you asking for a lawyer may continue to interrogate you as well. Your prison phone calls can also be recorded and used against you, again regardless if you've asked and not seen a lawyer so if you phone your job and make up an excuse why you won't be there on Monday morning, that excuse can be used against you in court. A well known trick is for the police to place you with an informant who offers you a cellphone, because typically you have to call 3-4 people when arrested (family/gf, job, a lawyer) instead of just the one phone call they have to give you (which they don't have to provide until days after you are arrested). This contraband phone will be recorded hoping you say something incriminating, or just hoping you lie so they can prove later you are a "known liar" since most people don't want to tell their employer they've just been arrested and will lie about it.

<comment><USER25> That's even worse than in the US. I'm shocked.

<comment><USER4> The procedural protections of the criminal justice system are weaker in many developed countries outside the US. E.g. Italy where you can keep trying someone for murder until you get the result you want. What makes the overall system worse in the US is how militarized the police are, how over the top aggressive prosecutors are, and how long sentences are.

<comment><USER26> Italy is bananas. A few years ago I accidentally drove a rental car through a ZTL in Rome. Some months later I received a letter in the mail at my home in the U.S. asking me to pay the fine (even though I had already paid it to Avis). What was astonishing was that the ticket said you were allowed to contest it, but if you contested it and the authorities decided against you, the fine would significantly increase.

</comment></comment></comment></comment></comment><comment><USER27> Some cops are more patient and compliant with the law than others. It does not matter how well you know the law, if you have someone that has a strong preference towards violence (e.g: asking for identification, then shooting you dead when you reach for your wallet = suspecting you are armed).

</comment><comment><USER28> Predictably, the SCOTUS case discussed in the article, Salinas v. Texas, split down conservative/progressive lines, with Kennedy casting the deciding vote to abrogate our 5th amendment privileges. Three members of the Supreme Court are over the age of 70—Kennedy is 80. Vote accordingly next month.

<comment><USER29> However, Scalia's dissent in Maryland vs. King was a truly conservative-based dissent. You also have Kyllo vs. United States where 'liberals' Kennedy and O'Conner dissented and 'conservatives' Scalia and Thomas joined Ginsburg and Breyer in the majority that established using FLIR without a warrant was a violation of the 4th Amendment.

In US vs. Jones, Scalia again wrote the majority opinion enstablisbing that a GPS tracker on a car is a violation of the 4th.

We also have Riley vs. California, Hamdi vs. Rumsfeld (where Scalia'd dissent was joined by John Paul Stevens.)

My point is that we need justices that follow the Constitution and not justices that follow a party. I don't particularly trust Clinton to pick constitutionalist justices while Trump is a wildcard (he isn't even remotely conservative, so it's likely his picks would likely be more centrist to please his own centrist views without alienating the Republican voters.)

I don't like Trump or Clinton, but I think Trump picks will likely be more moderate than anyone Clinton might select.

However my opinion doesn't matter, what I'm trying to say is that a vote for Hillary doesn't mean a vote for judges that will rule correctly. It doesn't mean a vote against those judges either. But 'vote accordingly' is meaningless because there is no 'accordingly.' For example, look at Kagan's opinion in Ransom v. FIA Card Services.. She sided with the credit card company over a consumer in a bankruptcy case while Scalia was the only dissent in the 8-1 decision.

Vote accordingly.. ok how? Meaning, there is no such thing. "Liberal" justices aren't always "liberal" in ways that you might like and "conservative" doesn't always mean what you think. The court is far more nuanced. A balanced court is far safer than one ideologically disposed to one extreme or another. It would be very dangerous to have an entire court of John Paul Stevenses just as it would be dangerous to have a court filled with Clarence Thomases.

<comment><USER30> You seem to imply that the court ruled incorrectly in the Ransom v. case. I skimmed through it ([https://en.m.wikipedia.org/wiki/Ransom_v._FIA_Card_Services,...](https://en.m.wikipedia.org/wiki/Ransom_v._FIA_Card_Services,_N.A.)) and while I most certainly am not a legal scholar, it seems fairly straightforward? No, it doesn't cost $28k to own a car you already own outright for five years (operating expenses are claimed separately and not controversial here) and you don't get to protect that money in a bankruptcy.

What am I not seeing? (To be fair, and to underscore the degree to which I am not a legal scholar, I don't understand the substance of Scalia's dissent.)

<comment><USER31> I think it is not SCOTUS' job to clean up the congress created mess and Scalia was cranky because of that.

I think that Scalia strongly believed in laws are set in stone. So if there is some abmiguity or stupid language it is the Congress' fault and it is not up to SCOTUS to create laws on the fly by guestimating the congress intent.

</comment></comment></comment></comment><comment><USER32> Some of what this guy is saying is moot because of the reprehensible tradition of plea bargaining in the United States. As far as I know (IANAL), most criminal accusations don't go to trial because the prosecutors throw _everything_ they have at the defendant.

If you're accused of a crime, it's often crazy to try to defend yourself: if you try to do so and lose, it'll ruin your life. Better just to plead out and take a deal.

If the prosecutors can force you to gamble for your life and livelihood, it doesn't matter what evidence they have against you. The only way around the problem is to remain compliant and never get accused of anything.

<comment><USER33> > _The only way around the problem is to remain compliant and never get > accused of anything._

The issue with that is that it is becoming increasingly difficult to live a normal American life without breaking a few laws every now and then, and not even realizing it. The book's author touched on this during the interview, but basically more and more "everyday" actions are becoming criminalized over time.

Technically, committing a crime implies criminal intent, but that notion has been absent from our justice system for a very long time. Look at how many laws are on the books about "negligent" crimes, those committed not out of intent but out of ignorance or forgetfulness. Traffic laws are easy to pick on for this metric, since in most states the driving tests barely scratch the surface of the body of traffic law. In some states you can be jailed over any moving violation at the officer's discretion, and that combined with the general attitude of "don't fight the ticket, just pay it" means you've just become part of the system, and this stacks the deck against you making it easier to gain a conviction if you're accused of a more serious crime later in life.

<comment><USER34> > The issue with that is that it is becoming increasingly difficult to live a > normal American life without breaking a few laws every now and then, and not > even realizing it.

Well that has been the case for a while now, the Three Felonies A Day book [https://smile.amazon.com/Three-Felonies-Day-Target- Innocent/...](https://smile.amazon.com/Three-Felonies-Day-Target- Innocent/dp/1594035229) is from 2009. Although of course the bombastic claim in the title is disputed [http://skeptics.stackexchange.com/questions/22530/does- the-a...](http://skeptics.stackexchange.com/questions/22530/does-the-average- american-unwittingly-commit-three-felonies-a-day) it essentially claims the exact same as you.

<comment><USER33> > * it essentially claims the exact same as you.*

First, I never said "three felonies a day".

Second, I have an inside view -- I work for a law enforcement agency in a civilian position and have worked in this field for a total of fifteen years -- and what I've seen bears out what I actually said. Not necessarily three _felonies_ a day, but as I said, most Americans unknowingly break a few laws every now and then just living a normal daily life. The problem is that the number of infractions has been steadily increasing over the past century, and soon the Dystopian concept of "everything you do is illegal" will begin to ring true.

<comment><USER34> Right, as I said, the bombastic claim of the title is hardly true but if you deduct that from the book it does claim the same as you: ordinary people with ordinary lives will break some federal regulations now and then. Peace :)

<comment><USER33> Gotcha, I thought you were saying that I was claiming the wording of the title, not the actual content of the book.</comment></comment></comment></comment></comment></comment>


Does Java Make You Less Productive Than Dynamic Languages? - <AUTHOR> http://java.dzone.com/articles/does-java-make-you-less

<comment><USER2> "List comprehension: great in Python, easily added to Java, once it has closures" - yep, that kind of article..

</comment><comment><USER3> I can't think of any good way to say this without sounding like an arrogant bastard (but hey, I'm a programmer so that's assumed :-) ...). The author states:

        I used to prefer Python to Java. But then
        along came Eclipse with its refactoring and
        code browsing and afterwards, I could not
        go back to simpler editors.

I'd rather choose a language that lets me write code that won't need refactoring, rather than choosing a language and editor based on the assumption that I'm going to botch things and need help getting out of the ditch I'm going to dig myself into.

<comment><USER4> For those of us that dont always write perfect code on the first try. Or have to clean up after others, refactoring tools such as extract method and intelligent rename are invaluable.

</comment></comment><comment><USER5> Adding X languages features to Y language won't make Y language better....

To be more specific, Java has annoyances(this is my own damn opinion) that are carved deeply into the language, you won't get rid of them by adding more features, it would just make the language more bloated.

Adding closures to the language won't fix anything.

</comment><comment><USER4> The article states that having an IDE with strong refactoring support is impossible for dynamic languages such as JavaScript.

Is this true? in that case why?

</comment><comment><USER6> Ah, I do love scala.</comment>


Bechtolsheim: AWS, open source rewrite rules for startups - <AUTHOR> http://gigaom.com/2011/11/10/arista-roadmap-2011/

<comment><USER2> It's interesting that Netflix mentions the cost of infrustructure.

At the moment, owning dedicated servers and coloing them yourself is orders of magnitude cheaper then a cloud provider. It's only "cheaper" if your cost of money is stupidly high, ie. you're a startup, or other factors dominate your TCO, ie. you're a startup.

What is interesting is that supply side there is no reason for this to be so. Furthermore there are reasons to expect that the equilibrium price for cloud to be below the cost of dedicated hardware/colocation.

<comment><USER3> This is spot on. At some point I expect these costs to flip. I've done the TCO computation a couple of ways and for OCP/Web2 type deployments its still cheaper to do your own deployment once you need more than 500 instances.

Of course not to take away from Andy's point, if you're deploying the equivalent of Slashdot (which ran on like a dozen servers) then you're silly to spend a couple employee slots on keeping that running in a co-hosted scenario. And these days, given the power of a machine, a LOT of things can be done on a relatively small handful of machines.

<comment><USER2> The point will probably be a few years off, at least for retail prices. Cloudsmithing is still a new art, and there are very few people outside of Amazon who can produce a functional cloud.

</comment></comment></comment><comment><USER4> Hint: The title makes much more sense when you realise that they mean 'rewrite the rules' as a verb, not 'rewrite rules' as in mod_rewrite.

<comment><USER5> wuz confused for way too long, also.

</comment></comment><comment><USER6> > The combination of low-cost data center infrastructure and rapidly evolving, > free or nearly free open-source development tools means that tech startups > can get going cheap, and if things don't work out, move on to other things, > Bechtolsheim said today at the GigaOM RoadMap Conference.

How is this news? Anyone in the startup space already knows about AWS and open-source.

Thanks, Andy Bechtolsheim, for confirming what many of us have already known for a long time.</comment>


Talking Funny – Seinfeld, Gervais, Chris Rock, and Louis CK dissect comedy - <AUTHOR> https://www.youtube.com/watch?v=OKY6BGcx37k <comment><USER2> Wha?! Louis CK took time out of his day to pause from masterbating to talk comedy? (Why he still has a career is beyond me. He's in the median of funny comics imo)</comment>


Microsoft.com is not a website - <AUTHOR> http://jgthms.com/microsoft-com-not-a-website.html

<comment><USER2> "And providing a 'Feedback' button may be a hint of what _not_ to do.":

As a programmer it is not obvious to me why you shouldn't add a 'Feedback' button. So, dear UX designers, what is the reason for that?

<comment><AUTHOR> I'm sorry it wasn't clear. I actually added that sentence at the end without going further into that thought.

What a feedback button actually tells the user is: "We're not sure about our design, we haven't thought it through, so please help us improve it."

It is usually Ok for small websites, or startup websites, whose primary talent is not web design, to ask for advice. But you'd think Microsoft, of all software companies, could handle a single-page on the web without having to ask advice from random users.

Furthermore, I believe such a button hinders further development. It's like saying: "Ok, we've launched the new website, but we're not entirely convinced by the new direction. So, let's just wait for some feedback before actually going further."

I've never believed in design by consensus. Web design is not just 'graphics pleasing for the eye'. It's work, just like any other. And what you need, is experts, or at least, people who know what they're talking about. And Trent Walton is one of them.

I've always had issues with clients over trivial concerns, such as colors, fonts, button and logo sizes, etc. If someone hires me to do their web design, they've got to accept that I know what I'm doing. 'I've thought it out. Trust me.'

And a feedback button is giving credit to random people who probably don't know what they're talking about.

<comment><USER3> While I agree with your sentiment--that design by consensus and indecisive design are bad--I'm not convinced that including a feedback button is a bad thing.

If it's well-placed and unobtrusive (doesn't flash "what do you think of our redesign?!") a feedback button serves the purpose of providing a bit more information about user pain-points. Keeping in mind that most users have too much inertia to hit a feedback button, when it is used you get reports of major frustrations. That could be a bug in a corner-case or browser you didn't test, or an accessibility issue.

So, I'd argue that quietly keeping a feedback button around is a good thing, and as developers it would be our responsibility to handle the feedback responsibly (filtering noise, distractions and unfixables).</comment></comment></comment>


Foundation for Apps - <AUTHOR> http://foundation.zurb.com/apps/

<comment><USER2> Very interesting project and direction for Foundation. Now uses angular directives instead of jQuery "PlugIns" has YAML defined routes and animation through ui-router, flexbox based grid. If you have been using Foundation for a while and are interested or using Angular you should definitely take a look at this project.</comment>


77% of 433,000 Sites Use Vulnerable JavaScript Libraries - <AUTHOR> https://snyk.io/blog/77-percent-of-sites-still-vulnerable/ <comment><USER2> These types of findings are such bullshit. They use "vulnerable" javascript libraries.

I implore any reader to go out and find a vulnerability of non-P5 severity on 10% of these websites through these "vulnerable libraries".</comment>


Page Speed Service - <AUTHOR> http://googlecode.blogspot.com/2011/07/page-speed-service-web-performance.html <comment><USER2> The settings docs page [1] shows what this service does:

      Combine CSS
      Combine JavaScript
      Image Optimize
      Image Resize
      JavaScript Optimize
      Move CSS to head
      Proxy CSS
      Proxy Images
      Proxy JavaScript

You can see demos of the Page Speed Service doing each of these things at [2].

The dashboard docs page [3] shows that there's _some_ analytics but not a great deal.

[1] <https://code.google.com/speed/pss/docs/settings.html>

[2] <http://www.pssdemos.com/>

[3] <https://code.google.com/speed/pss/docs/dashboard.html>

</comment><comment><USER3> Seems like strong competition to Cloudflare (<https://www.cloudflare.com/>). Always thought that was their greatest risk, someone with a huge, worldwide, already paid for CDN stepping in an offering the same service.

They still have the statistics and security features going for them, though...

<comment><USER4> Cloudflare does a LOT more than this. In fact, the area where they cross-over is the area that interests me the least - I am quite capable of making a website balls-to-the-wall fast without either of their products, but Cloudflare leverage their size to accomplish things I literally could not accomplish without them. I initially wrote Cloudflare off because of this, they don't do a great job of telling you about the coolest things they do.

<comment><USER5> Yeah i agree there seems to be some overlap with CloudFlare. I wanted to sign up a client of mine who is running a Wordpress site to CloudFlare, but wasnt able to do so because it required moving their complete zone file over to CloudFlare which they werent able to do for multiple reasons. CloudFlare dont seem to provide a solution where you can just point an A record to their servers (currently).

I wonder if this Google PageSpeed service can provide a similar service to CF, without needing to move the Zone file across completely. Mind you CloudFlare's basic service is free.

<comment><USER6> Cloudflare does have the ability to let you define CNAMES for your site and manage those in your own DNS outside of Cloudflare. I believe it is in limited beta right now but we are testing it and it works great.

Contact them for more details.

<comment><USER5> Im a little hazy on my DNS knowledge. I understand upto zone file, dns and A records. Haven't quite understood how i would achieve this with a CNAME? _ i've tried to understand many times what CNAME's are but never got my head around it.

Would you mind elaborating a little? I did contact them about a month ago, and explained the problem and they just told me it wasnt possible at this moment in time(?)

<comment><USER7> A CNAME points a name to another name. In the case of Cloudflare, Google, or others, they need to know what CNAME you are using (say, www.example.com CNAME some.proxyservice.com) so they can map the request to your content.

</comment></comment></comment></comment></comment></comment><comment><USER8> It's pretty iteresting in what direction google is pushing.

Since all the requests are handled by google (you have to change the dns servers to point to google), this will give them complete website profiles, on what surfers visit and how they can rank websites better. They could even adapt their crawling on that No need to crawl websites which a human has never visited before.

I would also consider that they might evaluate the logs from their open dns servers to rank websites and decide what's important and what not.

It's like having a cookie in adsense or analytics, just nobody noticing it.

</comment><comment><USER9> I think I just don't get it... The optimized version is actually slower than the normal one... [http://www.webpagetest.org/result/110728_KN_1bd8e23bea97037c...](http://www.webpagetest.org/result/110728_KN_1bd8e23bea97037ce5976777b9732c6a/)

I must be missing something obvious...

<comment><USER10> The same with our website. ([http://www.webpagetest.org/result/110728_2Y_cf94015a7345bbed...](http://www.webpagetest.org/result/110728_2Y_cf94015a7345bbedcee24323d6054a58/)) 8% faster than Google's version. Yay!

To be fair we have done a lot of optimizations on the site, but still feels like I may be missing something obvious.

<comment><USER11> Getting similar results. I don't really get it, the optimized version takes a few seconds before anything other than my background is displayed. By the time the rest of the 'optimized' site is being rendered, my original site's already loaded.

(This is from watching the video in my test results)

<comment><USER12> I don't think we're the target audience.

I suspect the biggest gains will be sites based on proprietary products which may be in quite a state.

</comment></comment></comment></comment><comment><USER13> > Page Speed Service fetches content from your servers, rewrites your pages by > applying web performance best practices, and serves them to end users via > Google's servers across the globe

I don't get it. Given that most websites have some dynamic content, that static assets can be updated, edited or otherwise altered at any time, Google must be fetching content on a request-by-request basis, i/e acting as a proxy. How can this be faster? You've got the existing latency of fetching your content, PLUS the extra latency of Google zipping and concatenating assets and forwarding the result on to the client.

Doesn't make any sense.

<comment><USER14> Didn't make sense to me either. Now I realized it optimizes static content: css, javascrips and images on the firs run, then it serves optimized version until you update them. There is some latency to fetching dynamic content and that's the reason optimized sites are slower on this test.

</comment></comment><comment><USER4> If anyone on HN thinks their site might be sub-optimal on the front-end, contact me on email@example.com and I'll take a look, and let you know what you can do to speed things up :)

<comment><USER4> If anyone could give me feedback on why the above is being downvoted, I'd appreciate it. Ta!

Edit: I'd actually like feedback please... it went down to 0, then up to 1, then down to 0 again.. and then back up to 2 after I posted this reply. I wasn't asking for upvotes, I want to know what it is that is making some people downvote this. Is it not in keeping with the etiquette here, is there some unspoken rule I'm violating?

<comment><USER15> It could be interpreted as spam. People often think that "I want to help you" is "I want you to pay me" in disguise :)

</comment></comment></comment><comment><USER16> People should realize that by using this service, all sensitive data posted to your website will be readable by google.

</comment><comment><USER17> Can end-users somehow opt-out of the pages they are viewing passing through Google?

It should be technically possible but I doubt they will offer that.

<comment><USER18> Why would you want to?

<comment><USER19> Some users are uncomfortable with the idea that even if they avoid Google entirely by not using their search, OS, email, or maps, that Google can still have a profile of them and which sites they visit.

If you don't like the company and want to avoid them, you will now have to choose to not visit websites served through their DNS. That's much more difficult than just using a different email provider.

<comment><USER20> If one wants to avoid Google, they also need to make sure anyone they e-mail isn't using GAFYD. How many anti-Google folks do that?

</comment></comment></comment></comment><comment><USER21> Tried their test. It was slower on my site...

[http://blog.craigrcannon.com/post/8170801499/my-site- tested-...](http://blog.craigrcannon.com/post/8170801499/my-site-tested- slower-with-google-page-service)

</comment><comment><USER22> Absolutely great. What do people await? It is a free service helps to improve ya site. I run the g-pagespeedtest + webpagetest and received a list with errors in my project <http://www.webdesign-angebote.com> Especially pics and js made problems.

And the suggestions are okay, really helpful {background-color: expression(this.runtimeStyle.backgoundColor = 'none'} and "Compress Images", but thats been my fault. I adepted it immediatly and hope for improved user- and rankingresults.

</comment><comment><USER23> I really don't see the point of passing it through them. Instead I'd rather they just tell me how to optimize it so I can apply the improvements myself.

<comment><USER24> They offer that as well. <http://pagespeed.googlelabs.com/>

<comment><USER25> Pagespeed is on the soon to be closed Google Labs ([http://googleblog.blogspot.com/2011/07/more-wood-behind- fewe...](http://googleblog.blogspot.com/2011/07/more-wood-behind-fewer- arrows.html)).

<comment><USER26> They have already announced that Page Speed will not be closed and will be moved off labs.

</comment></comment></comment></comment><comment><USER27> Good stuff but I'm not sure if if optimizing a website consisting of static pages this way really makes sense. If the website was done by an idiot then yes, but most of the users probably won't even notice any change in speed if the website was developed correctly earlier.

Also I probably wouldn't trust some other company enough to proxy my stuff to my users for the price of a slight optimization.

</comment><comment><USER28> Anyone notice all the testing locations are AWS Regions?

I was assuming webpagetest was a Google property and figured they would use their own data centers.

<comment> brown9-2 That doesn't prove much though, does it? "Northern Virginia" is a pretty broad region.

<comment><USER29> Weird that their default test browser is IE8 too. Hello Chrome ?

<comment><USER30> A dead link by Canopy below says:

"WebPagetest is not run by Google."

and points to their about page. Apparently, he's right.

</comment></comment></comment></comment><comment><USER31> I tried it on www.google.com !! Their optimized version is slower than their normal version :) Check it out for yourself [http://www.webpagetest.org/result/110728_TR_d83c788b1387dab0...](http://www.webpagetest.org/result/110728_TR_d83c788b1387dab0a6f7319190f74d75/)

</comment><comment><USER32> +1 useful. On a related note, does anyone know of something similar that can diagnose and optimize a browser's connection to the internet (the other side of end-to-end performance)?

</comment><comment><USER14> Does this work with dynamic web pages, like Facebook or news.ycombinator.com?

<comment><USER33> I haven't checked, but I assume it works fine if you've got all your Cache and Vary headers set properly.

</comment></comment><comment><USER34> just out of curiosity i checked some of my web based application :

\- orginal : load time 5 seconds *

\- optimized : infinity....

I think they have to optimize their optimizer...

* : all js & css & image files about 900kb and the connection is 1Mbit adsl.

</comment><comment><USER35> Just another example of Google trying to improve the world.

I would personally be a bit worried about the level of control this would mean giving up. But I just like to tinker. I know plenty of people for whom this is perfect.

<comment><USER36> Seems hard to believe their motivation for seeing a ton of consumer web traffic on third party sites is to improve the world. I mean, obviously google analytics isn't some altruistic attempt to help people track their web usage better.

</comment></comment><comment><USER37> Deprecated in 5, 4, 3, ...</comment>


My Python Code for the Netflix Prize - <AUTHOR> https://github.com/alexbw/Netflix-Prize I competed alone in the Netflix Prize in college under the team name "Hi!". I've never seen anybody release their code, and I'm getting back into machine learning now, and realized that some folks might want to take a gander at a competitive machine learning codeset.
It's implemented mostly in Python, with Cython for the real speed-sensitive parts (everything in file "svd.pyx" did the heavy lifting, and got me up the leaderboard).
I hope that some folks will find this useful. <comment><USER3> Here's mine if anyone is interested. I wrote it in D and haven't looked at it in years. I'm sure it's not usable as-is, but it might be fun anyway.

<https://github.com/nogwater/NetflixPrizeD>

The algorithm is based on Simon Funk's blog post here: <http://sifter.org/~simon/journal/20061211.html>

For me, the best part was squeezing the data and indexes into memory. :)

</comment><comment><AUTHOR> @tuananh I've got the dataset stored away, but I don't know if I'm legally allowed to post it. Would love if someone could produce proof one way or the other.

@viraj_shah I spent about 6 months working on the project before I had to stop to concentrate on my schoolwork (I was a senior in collge at the time). I think it would have been impossible to do this for myself without Cython. If it were to happen today, I would probably be writing in PyCuda, or with Numba, and it would be much, much, MUCH more succinct.

<comment><USER4> @alexbw Thanks for the info, great work!

</comment></comment><comment><USER5> You indent by 8 characters.... I wanted to read your code but this will make my eyes bleed.

From pep 8: "Use 4 spaces per indentation level."

<comment><USER6> Close but no cigar. He's indenting with tabs.

</comment></comment><comment><USER7> I wrote a 195-page monograph on the Netflix Prize, for people interested in that sort of stuff: <http://arek-paterek.com/book>

<comment><USER8> Comic Sans?

<comment><USER7> right on :)

the beauty of self-publishing

</comment></comment></comment><comment><USER9> Very nice. It might be helpful to (briefly) describe the actual techniques you tried in the readme file? At least that's the first thing I looked for...

</comment><comment><USER4> This was incredibly kind of you to post up. It is great to see it public domain as many can learn from it. The Cython code looks scary though - <USER2> lines! May I ask how long you spent on this?

</comment><comment><USER10> Nitpick: binary blobs like .pyc and .so don't belong in a code repository. Instead you would put a makefile or setup.py to compile the .pyx files.

</comment><comment><USER11> I also worked on this at uni and had lots of fun -- those lessons certainly look familiar! We were trying to mine Wikipedia for more information on the movies. The code's here:

[http://code.google.com/p/wikipedia- netflix/wiki/WikipediaNet...](http://code.google.com/p/wikipedia- netflix/wiki/WikipediaNetflix)

It includes Wikipedia parsing stuff and a fairly fast C++ implementation of the very cool BellKor kNN algorithm.

<comment><USER12> Love each of the individual BellKor approaches ([http://www2.research.att.com/~volinsky/netflix/ProgressPrize...](http://www2.research.att.com/~volinsky/netflix/ProgressPrize2007BellKorSolution.pdf)) for finding recommendations in the space of movies or users-- an MDS embedding, a PCA whitening, an NMF factorization by alternating least squares. Each of those hunches seems like the true art in these problems. The blending 100 of them together is far less interesting to me, though.

Yet that seems to be the sort of jockeying and tweaking these problems (seen now in Kaggle contests) seem to require. Is there an art or science then to the subsequent blending? Does one develop a better intuition for the problem at that point, or am I entirely missing the point of most ensemble methods (predictiveness over parsimonious understanding)?

<comment><USER13> > Is there an art or science then to the subsequent blending?

You could regard this as an application of the "Smoothed expectation theorem", Saying E[X] = E[E[X|Y]]. That is, if you are trying to compute the expectation of something, you can make it depend on anything else, and compute the inner expectation with respect to that. Might seem trivial or useless, but it is wildly applicable and often significantly simplifies computations.

One of the practical implications is that if you're not sure about something (underlying model, specific parameters), just apply some prior distribution and compute the expectation over that -- it is essentially guaranteed* to provide a better result than trying to pick the correct setup.

Although I'm not sure what the interpretation here would be.

* - so long as the entropy of your prior is not more wrong than the entropy of your hyper-parameters. This _is_ often the case.

<comment><USER12> Yeah, the tower property! That made my day. Thanks for cleanly giving motivation and mathematical beauty to something that irked me up until now. Which is probably the problem of having your aesthetics drive you in the first place.

</comment></comment></comment></comment><comment><USER14> Thanks for posting this. Your code combines two successful approachs : a latent factor model (SVD) and a neighborhood model :)

Here's my implementation of a recommender algorithm in C if someone is interested : <https://github.com/GHamrouni/Recommender>

</comment><comment><USER15> Mine is at <https://github.com/hbcdev/Netflix> in C++, got to the top 500. It runs just inside my 8GB PC :)

</comment><comment><USER16> I had a look though this and was confused by this line:

ratings[ratings<1.0] = 1.0

in

[https://github.com/alexbw/Netflix- Prize/blob/master/src/pred...](https://github.com/alexbw/Netflix- Prize/blob/master/src/predict.py)

Is it specific to NumPy? Or perhaps a Python trick I haven't seen before?

<comment><USER17> Specific to NumPy. Boolean indexing.

[http://www.scipy.org/Cookbook/Indexing#head-86055279f6592d36...](http://www.scipy.org/Cookbook/Indexing#head-86055279f6592d36b8956f3400e3716c6491ae95)

<comment><USER18> Yep. The indexing and slicing are quite powerful. For those familiar with MATLAB, this is a fantastic resource: <http://www.scipy.org/NumPy_for_Matlab_Users>

</comment></comment></comment><comment><USER19> great for ref. however i can't found the dataset anywhere on the internet :(

<comment><USER20> Netflix had to pull the dataset after a researchers at U Texas were able to de-anonymize the dataset, shown in their paper Robust De-anonymization of Large Sparse Datasets.[<http://www.cs.utexas.edu/~shmat/shmat_oak08netflix.pdf>]

</comment></comment><comment><USER21> Good readme file. Liked the lessons learned.

</comment><comment><USER22> Does anyone have any thoughts on the lack of conformity to PEP8? His code works and it's valid python but I feel that it's difficult to read.</comment>


Lenovo, Google websites hijacked by a DNS attacks - <AUTHOR> http://www.pcworld.com/article/2889392/like-google-in-vietnam-lenovo-tripped-up-by-a-dns-attack.html

<comment><USER2> Amazing that this can happen to companies this large. Although I guess that if North Korea can have it's entire IP block stolen by Pirate Bay then this isn't that hard to believe.</comment>


OpenChird – An Open Source Platform for IoT with Support for LoRaWAN - <AUTHOR> https://openchirp.io/ <comment><USER2> Sounds similar to "The Things Network"[0]

[0] [https://www.thethingsnetwork.org](https://www.thethingsnetwork.org)

<comment><USER3> Came here to ask how OpenChirp differs from TTN?

</comment></comment><comment><USER4> I absolutely love the concept of Lora / Ip over LoRa. Very cool project indeed.

</comment><comment><USER5> s/chird/chirp/ ?

</comment><comment><USER6> Meanwhile on CatM1 and Narrowband....

</comment><comment><USER7> Read openChild and got spooked</comment>


Ask HN: How to retain IP as a software contractor - <AUTHOR> I am sure a lot of folks ran into this scenario before, but searching for an answer online seemed hard due to all the noise, so hoping to see if anyone has personal experience on this
Q1. If you were a software contractor working for a company on contract (say, to write a web site in html/js/css), by default, the IP is owned by the contractor/author unless there's a written agreement to transfer ownership. Is this correct?
Q2. If you were the said contractor, and you wanted to retain ownership of your work after the contract is over, does that mean all you have to do is not sign any written transfer agreements? Would it be worth it to have some kind of extra written agreement to make it clear you as the contractor still retain IP after the contract ends?
Q3. From the company's point of view, it would be preferable to own the IP of the contractor. Under what circumstances, in the usual case, do they let the software contractor retain the IP? Seems like a lot to give up, given all the time/money the company already spent to set up the contract job, look for contractors etc. Does this usually lead to a significant reduction in, say, price of the contract? What would usually convince companies to give up IP to contractors, or not care about IP after the contract ends?
Q4. If you were the said contractor, after the contract, can you retain 100% ownership of the IP, and then provide a "for eternity" licence to the company, such that both you and the company can use the code at the end of the contract, but the company would own any modifications it makes after the contract, and you would own modifications you make. Essentially have the ownership be divided when the code gets "forked" when the contract terminates. Is this possible? Is there a canonical term for this type of arrangement?
Thanks <comment><USER2> First things first, IANAL. Assuming you are talking about building a website for a client as a contractor, and the IP you refer to is the code behind the website:

Q1: Most development contracts I have seen usually lay out that the code is owned by the developer until final payment, or some other final agreed upon milestone is reached, at which time the ownership transfers to the customer.

Q2: While not signing a "transfer agreement" sounds simple in theory, you are going to be hard pressed to convince a customer to not take ownership of a website or other application you were hired to develop for them. Why would I hire you to build a website for me and then not want ownership of said code? This is exactly why this question is asked by potential investors and exists on directly on applications for programs like YC, "Was any of your code written by someone who is not one of your founders? If so, how can you safely use it? (Open source is ok of course.)"

Q3: Why as the contractor would you want to retain the IP? Are you looking to resell to other companies? One option would be to build it for them under contract and then come up with a lease or maintenance contract upon completion of development. This may allow you to retain the IP while continuing to bill them.

I think to answer your questions though it really depends on what you are developing for the customer. If you are building a website for a company or building a specific application than I can't see a reason the company would want you to own the IP when you are done development. They hired you to develop it for them to own.

Based on your questions it sounds like a company asked you to develop something and you think it is a good idea and want to keep it for yourself so you can resell it to other clients. If this is the case, it sounds like a shady way to approach it. You may be better suited to build the software and have the customer as your first client. But tell them that is your intention from the get go. Another option would be to attempt to work out an arrangement with them where you build it and they sell it, splitting revenues.

<comment><AUTHOR> Thanks for the advice.

Yes all these questions are aimed at finding a way to clarify intentions/expectations for both sides from the get go, before the contract starts.

<comment><USER2> No problem.

I would say that if the application is being used internally by the customer (i.e. an accounting program or intranet site) you are going to have an easier time. If the application is a product/service they are selling to their customer, is a source of revenue, or is the marketing tool (i.e. their website) you are going to fight an uphill battle to convince them to let you keep the IP.

Regardless, I would be clear from the get go and if you are looking to retain ownership I would make sure it is spelled out clearly who owns what. You may even consider a nuclear type option where they have a buyout right down the road if you do retain ownership. Either way, I would consult an attorney before signing anything.

</comment></comment></comment><comment><USER3> Specify in an agreement that: \- it is _not work for hire_

\- you own IP

\- client gets non-exclusive license to use IP without rights to sub-license, sell or transfer the license.

I was pretty successful to actually ask client if he wants to own IP or not. No - ok!

Yes - ok - for the double price of engagement.

Everyone is happy.

<comment><AUTHOR> that's very helpful gesman. Thank you

</comment></comment><comment><USER4> The contracts I have seen pretty much all say 'work for hire' and assign the IP to the client who is paying. Actually sometimes they try to go further and say they own everything you do while contracted with them.

Most of my jobs have essentially been startups where I was the tech co- founder, except not recognized as such, rather hired as a cheap code monkey. Those gigs are just much easier to get. Sucky and mostly a waste of time, but pays for food and rent.

Anyway I don't think anyone will share ownership of IP unless they are clueless or looking for a co-founder.

</comment><comment><USER5> You cannot lose your copyright other than by your signed agreement. But look out for the term "work for hire". That specifies the company owns your work.

If you are a regular employee then the company owns your work. In the US the determination of whether you are a consultant or employee is determined by the "twenty factors", also known as the "twntry questions".</comment>


This AI generates fake news about anything you want - <AUTHOR> https://www.fastcompany.com/90390287/this-ai-generates-fake-news-about-anything-you-want-try-it <comment><AUTHOR> I wonder if creating content using machine learning is one of the reasons Google has tweaked their algorithm to take into consideration content user engagement (such as time on page). Basically using real human intelligence to avoid ranking fake AI generated content.</comment>


Show HN: Free search engine for everybody - <AUTHOR> http://bubblehunt.com/ <comment><AUTHOR> Create your own search system - add in 1 click any resources in your profile, like bookmarks or other and get search trough this data.

<comment><AUTHOR> You can upload unlimited resources, make bubbles private or public, with indexing, crawlers and other cool stuff ;)</comment></comment>


Adopting Microservices at Netflix: Lessons for Architectural Design - <AUTHOR> http://nginx.com/blog/microservices-at-netflix-architectural-best-practices/

<comment><USER2> > One kind of coupling that people tend to overlook as they transition to a > microservices architecture is database coupling, where all services talk to > the same database and updating a service means changing the schema. You need > to split the database up and denormalize it.

That sounds pretty heavy duty; the kind of thing you might do once your company is already big. I wouldn't want to start out that way though, it sounds like a recipe for a mess.</comment>


FortiGuard XOR Encryption in Multiple Fortinet Products - <AUTHOR> https://seclists.org/bugtraq/2019/Nov/38 <comment><USER2> This speaks about Fortinet: _" 2018-06 - 2019-11: Multiple conference calls, discussing technical details, agreeing on disclosure time"_

Translation: half a year to communicate:

\- you send it unecrypted

\- yes we do.

<comment><USER3> Given that the advisory advises you _update_ rather than stop using them, _hopefully_ a year and a half to actually implement some sort of actual encryption. And hopefully the reporters were paid for "discussing technical details", like, how to actually use an encryption library.

<comment><USER4> Well, posting over HTTPS (with the worst certificates removed) instead of HTTP, perhaps with certificate pinning, isn't that hard and goes a long way.

<comment><USER5> This "XOR encryption" is vulnerable to an eavesdropper with almost no technical capability.

Even just HTTPS with no checks whatsoever (think 1990s Perl scripts or Python Requests with all the checking explicitly switched off) is protected against eavesdroppers, so that would require an active attacker (or a large quantum computer) to defeat, far more sophisticated than this trivial nonsense.

<comment><USER4> Yeah exactly, that's my point - going from "oh shit" to "I feel fairly comfortable" in this case shouldn't take 1.5 years.

</comment></comment></comment></comment></comment><comment><USER6> Previously... [https://duhkattack.com/](https://duhkattack.com/)

Though the main harm of VPNs IMO is that they lead to "the secure company- internal network" style thinking.

<comment><USER7> I've thought for a long time that this is a broader problem with the whole firewalls-and-NAT network security paradigm. It leads to a "soft underbelly problem" and a complacency that leads to insecure internal systems.

From what I've seen: God help most organizations if someone gets to the internal LAN!

The rule should be: If your thing can't run securely on the unfiltered Internet, it's broken. Any firewalling and such should be a defense-in-depth afterthought.

Of course this is kind of perfect world thinking. The reality is that quite a lot of software is either broken or insecure by design (e.g. databases that assume a secure LAN and don't even authenticate nodes) and so in practice we're quite far from this being practical for all but the most carefully managed deployments. Developers are also notoriously lazy about security while developing. I'm as guilty of this as the next dev sometimes.

<comment><USER6> I think the latter part of this is too pessimistic - network segmentation works as long as it's fine grained. Put that kind of apps on their own isolated vlan/vpc/equivalent and put an authenticating ssl proxy or something as the gateway.

</comment></comment></comment><comment><USER8> _the static XOR key has been removed from this advisory_

...because it's easy enough to determine from the plaintext and ciphertext?

<comment><USER9>
      >>> cb = bytes.fromhex('6968766f606e776c2d2d21262138475c5b5a475b545e475c6b6a776b646e776c6b6a772b646e776c6b6a776b646e776c6b6a776bbadf04036b6a776c616a846f')
      >>> pb = b'\x02\x02\x01\x04\x04\x00\x00\x00FGVMEV0000000000\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00...'
      >>> print(''.join(chr(c ^ k) for c, k in zip(cb, pb)))

     kjwkdnwlkjwkdnwlkjwkdnwlkjwkdnwlkjwkdnwlkjYEJ

EDIT: The repeating XOR key is pretty obvious. Just ignore the junk at the end from the `...` in the given plaintext.

<comment><USER10> Key looks more like they just bashed the home row with a few extensions of the longer fingers.

<comment><USER11> Apparently, running "uuidgen" is too difficult for them. Which, shouldn't be a surprise for someone who already decided to use XOR "encryption".

<comment><USER12> XOR encryption is unbreakable with an one-time pad that matches the message length (that's basically AES CTR). It's one of the most secure cryptography primitives we have.

The problem is deciding to use home-grown encryption.

<comment><USER13> This isn't a one-time pad. It's reused for every message.

<comment><USER14> It's reused every 8 bytes...

<comment><USER13> That too.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> I wonder how much they paid to gag the researchers for the 17 months it took them to fix this.

<comment><USER16> Am I reading this correctly that they couldn't be arsed to do DTLS/TLS and so they rolled their own lame crypto?

<comment><USER8> I suspect it was more that they never intended to use "true encryption" but just wanted to lightly obfuscate the data. Using strong crypto in a commercial product, especially one intended for international distribution, still brings up a bunch of legal issues that they may have been trying to sidestep:

[https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...](https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States#Current_status)

Having worked before (fortunately not for long) in an environment where trying to argue for "using the OS's crypto library is easy" would've been shot down with a strict "NO!" from management, I can definitely see how this situation occurred. That was a long time ago, but this may have been code left over from that era, and I'm not surprised if many more examples of such, along with people who are still in that mindset, still exist today.

I've seen similar things in all manner of other software (mostly DRM-related, so I won't say more...) --- it's not a hard wall, but a shield from casual observers and "keeping the honest people honest" type of idea.

<comment><USER17> > Using strong crypto in a commercial product, especially one intended for > international distribution, still brings up a bunch of legal issues that > they may have been trying to sidestep:

But apparently they sell VPN software. That's their product. The obscured by not encrypted output is the information from the inside of the VPN, and more.

They could not avoid solving legal issues anyway when selling VPN.

They completely deserve a "doghouse" tag on Schneier's blog:

"A decade ago, the Doghouse was a regular feature in both my email newsletter Crypto-Gram and my blog. In it, I would call out particularly egregious -- and amusing -- examples of cryptographic "snake oil."

I dropped it both because it stopped being fun and because almost everyone converged on standard cryptographic libraries, which meant standard non-snake- oil cryptography. But every so often, a new company comes along that is so ridiculous, so nonsensical, so bizarre, that there is nothing to do but call it out."

FortiGuard qualified IMHO. A big seller of VPN software to companies (2B revenue!) who is deliberately faking encryption.

</comment></comment></comment></comment><comment><USER18> How does this not result in FortiNet customers suing, to say nothing of shareholders and the FTC?

To intentionally design an insecure obfuscation for customer confidential traffic, and then keep it in place for a year and a half after someone discovers and reports it, is obviously negligent and causes real damage to the companies who bought this defective product.

<comment><USER19> That's why you pay your legal time extra money to write a good "Terms of Services".

<comment><USER18> Deceptive business practices can't be over-ruled by Terms of Service.

</comment></comment></comment><comment><USER14> The key doesn't even seem to be 'encrypted' itself, since it's found via strings:

Found the magic bytes here:

[https://www.hybrid- analysis.com/sample/4dc1a98813bfa60b0139b...](https://www.hybrid- analysis.com/sample/4dc1a98813bfa60b0139b54302cd2a8580bdd0cfea9b4adf1e6d27e1a0bbea33?environmentId=120)

(in the strings for 4dc1a98813bfa60b0139b54302cd2a8580bdd0cfea9b4adf1e6d27e1a0bbea33.bin , between 'Kindesmisbrauch' and 'Kunst und Kultur'

</comment><comment><USER20> They can patch the bug but they can never take back all the data that was leaked over that encrypted-not-encrypted channel.

</comment><comment><USER21> Does responsible disclosure really make sense for design flaws like this? Any motivated attacker would have already noticed it too you'd think.

<comment><USER22> "Responsible disclosure" is an Orwellian term coined to coerce researchers into aligning their actions with the incentives of vendors. The better term is "coordinated disclosure", and coordination sometimes does make sense, and other times does not.

<comment><USER3> "Responsible disclosure" is an _opinionated_ term, and there's nothing wrong with people using it if they think that what they're doing is actually responsible. In fact, one advantage of using it is that it should, in theory, make one thing about whether the coordination you're doing is responsible or not.

I was at first inclined to think that a year and a half was way too long to actually be considered "responsible". But if the outcome of that process was that FortiNet now has actual encryption in place (as one would hope since the advisory recommends people update their software, instead of recommending switching to a competing product), then I think there's an argument to be made that the effort put in will probably have been beneficial on the whole.

<comment><USER22> The term was literally coined by a group of vendors, and uses the word "responsible" so as to launder their commercial preferences into a universal norm. It worked so seamlessly that people casually use the brand without even thinking about where it came from or what it implies; it's like the word "kleenex" but with malign moral freight. It's the purest example of Orwellianism I can think of in our field; a direct weaponization of language itself.

On the other hand it's 5 in the morning and I've been awake for 4 minutes so it's possible that when I'm fully conscious I'll feel differently.

<comment><USER3> > It's the purest example of Orwellianism I can think of in our field; a > direct weaponization of language itself.

It doesn't seem to me any different than "pro-life" or "pro-choice"; or "Catholic" (which means "universal") or "Orthodox" (meaning "right- believing"), or "progressive".

I know people that won't use "Catholic", but instead will say "Roman" or "Papist" (since that organization is objectively based in Rome, and does follow the Pope); and people who won't use "pro-life", but always say "anti- abortion" or "anti-choice", or who won't use "pro-choice" but use "anti- abortion" instead. I understand where they're coming from and respect their preferences. I myself tend so put "progressive" in quotes, because I don't consider all causes "progressives" pursue to be making progress.

But such people normally don't go around injecting themselves into other conversations and complaining about the terms people do use. Rather, they simply engage in the conversation and use their preferred term.

I use the word "responsible disclosure" because I think we should be responsible about both how we disclose things and how I keep things secret. Both disclosing immediately, and sitting on an issue for years, are irresponsible in my view. Ideally issues would be reported, fixed, pre- disclosed, and disclosed within a few weeks. Having things _fixed_ in that time frame is not always possible, particularly when you're dealing with a company that is so utterly clueless as the one described here. Given that, whether it's more responsible to zero-day everyone or to sit on it for a year isn't very obvious, and reasonable people can come to different conclusions.

<comment><USER22> It turns out I still feel the same way as I did when I woke up at 5AM. I mean, I went back to sleep. But I've been up for a little while now, and I'm pretty sure I'm right, and "responsible disclosure" is way more Orwellian than "pro- life"; there's at least a colorable argument that "pro-life" is descriptive of a policy position, whereas there's nothing "responsible" at all about independent researchers disclosing information to the public only on a vendor's schedule and terms.

<comment><USER3> > there's nothing "responsible" at all about independent researchers > disclosing information to the public only on a vendor's schedule and terms.

Right, so the reason we disagree is that we have different understandings of what "responsible disclosure" means. From Wikipedia:

> In computer security or elsewhere, responsible disclosure is a vulnerability > disclosure model in which a vulnerability or an issue is disclosed only > after a period of time that allows for the vulnerability or issue to be > patched or mended. This period distinguishes the model from full disclosure. > [1]

And full disclosure:

> Full disclosure is the practice of publishing analysis of software > vulnerabilities as early as possible, making the data accessible to everyone > without restriction.

Nowhere does it say that this is done "on a vendor's schedule and terms". On the contrary, unless there is some other agreement in place, the discoverer _can_ publish any time they like; and so in reality control of the schedule is _always_ at the discoverer's terms.

This is recognized in the XenProject's Security Response Process [2]:

> When a discoverer reports a problem to us and requests longer delays than we > would consider ideal, we will honour such a request if reasonable. If a > discoverer wants an accelerated disclosure compared to what we would prefer, > we naturally do not have the power to insist that a discoverer waits for us > to be ready and will honour the date specified by the discoverer.

Google Project Zero typically report a vulnerability and say, "We're telling everyone about this in 90 days, hope you're ready."

 _That_ is my expectation of "Responsible disclosure". If SEC Consult waited 18 months, it's either because 1) they had a contract with Fortinet of some sort, or 2) they were convinced that waiting 18 months would cause less harm to people than zero-daying everyone.

[1] [https://en.wikipedia.org/wiki/Responsible_disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure)

[2] [https://xenproject.org/developers/security- policy/](https://xenproject.org/developers/security-policy/)

<comment><USER22> As I said at the top of the thread: it often makes sense to coordinate with vendors, and natural preferences often do align. But it sometimes doesn't, and, at times, it even makes sense to disclose without any coordination. Un- coordinated disclosure isn't intrinsically irresponsible, and so the term "responsible disclosure" is misleading. This isn't just my idea, and the term itself has become disfavored among vulnerability researchers.

<comment><USER3> > Un-coordinated disclosure isn't intrinsically irresponsible,

I agree with this.

> and so the term "responsible disclosure" is misleading.

I think this is a key point. As I said, I think "responsible" implies being responsible on _both_ sides: _neither_ simply publishing without sufficient time for a vendor to make a fix, _nor_ waiting indefinitely while the vendor waffles around or tries to pretend the vulnerability doesn't exist. "Responsible disclosure" focuses (or ought to focus) on minimizing harm to users, whereas "coordinated disclosure" focuses on cooperating with the vendor. As such, "Responsible disclosure" in fact carries within itself the threat of going public if the vendor is dragging their feet, where "coordinated disclosure" doesn't.

I continue to think that we should use the term "responsible disclosure", and insist that it mean _actually behaving responsibly to users_.

[Minor edits]

<comment><USER22> I understand what you're trying to say. You're saying that conceptually there is such a thing as being "responsible" or "irresponsible" about disclosure, and I think that's true!

The problem is that ( _charitably_ ) the term of art (or _uncharitably_ , brand) "responsible disclosure" is attached to some very specific norms, including "not releasing vulnerabilities without a patch" and "giving vendors a commercially reasonable amount of time to create a patch" and "working closely with vendors to coordinate that time window" and "redacting or carefully reducing POC code", which are not themselves universal or even generally "responsible".

They're _commercially_ responsible, to be sure! But it should not be an obligation of unpaid third party researchers to expend any effort whatsoever to be responsive to a vendor's commercial concerns. It's a nice thing to do, and some people are just preternaturally nice to vendors, and that's usually fine, but there's nothing deontologically "responsible" about that.

<comment><USER3> > You're saying that conceptually there is such a thing as being "responsible" > or "irresponsible" about disclosure, and I think that's true!

I'm saying more than that.

We both seem to agree that there is an ongoing war about disclosure; and that large vendors (through a mix of good, neutral, and bad intentions) are warring to make disclosure more convenient and less painful for themselves, to the detriment of their users (and ultimately themselves as well); and that the use of words is one arena in which that warfare exhibits itself.

But we've come to opposite conclusions about the best way to fight the war in this specific arena.

You've observed that companies are trying to define "responsible" to mean "commercially responsible". But rather than recognizing _this attempt at redefinition_ as an attack, and insisting on using the word "responsible" to actually mean responsible towards users, you seem to think that _the use of the word itself_ is an attack; and want to instead try to insist on using a different term, "coordinated disclosure".

I think that's a bad strategy. You're advocating that we surrender the word "responsible" entirely to large vendors. Large vendors are not going to stop using the word "responsible"; if right-minded security researchers simply abandon the word, then the broader public are going to be entirely at the mercy of vendors to decide what's "responsible". Furthermore, as I've argued, using "coordinated" shifts all focus to the vendor, removing any focus from the user at all.

In the war over disclosure, your strategy seems to me to hand a massive win to big vendors.

I think a much better strategy is to counter-attack. The word "responsible" is too valuable a term to just give up. We must continue to insist that "responsible" means "responsible to users"; and we must continue to insist that there are times when pressuring and even embarrassing large companies _is the most responsible thing to do_.

<comment><USER22> There's nothing I can say to this that I haven't already said. "responsible disclosure" is a term of art. It means something you don't mean. You can redefine it for yourself, but people reading you will take its actual meaning, not yours.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> The patches are not available yet.

The 6.0 download hasn't been updated. It's still 6.0.6. [https://www.forticlient.com/downloads](https://www.forticlient.com/downloads)

</comment><comment><USER24> Tangential, but are Fortinet products annoying as well as dangerous? What should I tell a boss who is considering their devices in front of their ISP line?

<comment><USER25> Show him this -

       1) Fortinet tries to explain weird SSH 'backdoor' discovered in firewalls - https://www.theregister.co.uk/2016/01/12/fortinet_bakdoor/

       2) Fortinet Finds More SSH Backdoors - https://www.bankinfosecurity.com/fortinet-finds-more-ssh-backdoors-a-8826

       3) Fortinet backdoored fortios or hackers did for monitoring since last 5 years - https://www.securitynewspaper.com/2019/08/29/fortinet-backdoored-fortios-or-hackers-did-for-monitoring-since-last-5-years/

<comment><USER26> Please don't use blockquotes as they're unreadable on mobile.

> 1) Fortinet tries to explain weird SSH 'backdoor' discovered in firewalls - > [https://www.theregister.co.uk/2016/01/12/fortinet_bakdoor/](https://www.theregister.co.uk/2016/01/12/fortinet_bakdoor/)

> 2) Fortinet Finds More SSH Backdoors - > [https://www.bankinfosecurity.com/fortinet-finds-more-ssh- > bac...](https://www.bankinfosecurity.com/fortinet-finds-more-ssh- > backdoors-a-8826)

> 3) Fortinet backdoored fortios or hackers did for monitoring since last 5 > years - [https://www.securitynewspaper.com/2019/08/29/fortinet- > backdo...](https://www.securitynewspaper.com/2019/08/29/fortinet-backdoored- > fortios-or-hackers-did-for-monitoring-since-last-5-years/)

</comment></comment></comment><comment><USER27> This is the company that shuffled a hard-coded password instead of fixing it. The developers got around the strings AP_image|grep "hardcoded password" "check" the managers were doing on the AP code by just moving it to the controller code instead.

They still have a hard-coded root password on their WLC controllers.

</comment><comment><USER28> If there were ever a reason to become cynical about grandiose marketing claims, this is it.

<comment><USER29> Well, no one else is using that particular static key, so it is a "unique security fabric."

I do love the low key burn of putting that vendor description up front.

</comment></comment><comment><USER30> Up to a couple of years ago, Checkpoint had been shipping a 10 year old version of openssh. I always wondered if anyone figured that one out :D

<comment><USER31> You could have posted that when you found out instead of wondering whether you're the only one seeing it?

</comment></comment><comment><USER32> I hate fortinet stuff. My number one reason being the binary blob vpn client for linux, that you can't even download without an account. (so not in repos, have fun deploying to many machines) Also the annoying but more benign fact that everything has "Forti" in front of it.

<comment><USER33> There's openfortivpn[1] in Debian Buster, which is an open source[2] VPN client, and doesn't start with 'forti'.

[1]: [https://packages.debian.org/buster/openfortivpn](https://packages.debian.org/buster/openfortivpn)

[2]: [https://github.com/adrienverge/openfortivpn](https://github.com/adrienverge/openfortivpn)

</comment></comment><comment><USER34> Is anyone that works with Fortinet surprised?

</comment><comment><USER35> Wow that's a pretty big blunder.

</comment><comment><USER36> A long time ago, I thought such things don't really happen but the more experience I have less surprised I am.

</comment><comment><USER37> I think XOR encryption is the future and gratefully devour every YC article!

</comment><comment><USER38> fortiXOR crypto suite

</comment><comment><USER39> A _year_!</comment>


Make Your Site Run 10 Times Faster - <AUTHOR> http://highscalability.com/make-your-site-run-10-times-faster

<comment><USER2> "Rookie database administrators are taught in school to always keep their databases normalized. ... The 'database ninja' way to handle this scenario, is to duplicate these two pieces of frequently accessed data..."

Completely wrong. Normalization is a foundational principle of relational database design. Review the ACID properties and any of the textbooks a "rookie" DBA read in school and you'll find that optimizing performance for a web site is NOT a consideration in database design.

The original article does not even describe denormalization, which has a real meaning and real applications for data warehousing and OLAP -- non- transactional databases used for reporting and data mining. It describes caching, and an expensive and error-prone way to maintain the cache in real time. When rookies do this out of ignorance the database is called un- normalized; doing it intentionally is almost always a bad idea that will come back to bite.

The notion that normalized data slows query performance has been debunked so many times that there's a whole literature on just that subject. It's a shame that so many database "ninjas" cut their teeth on MySQL, and think that the tricks required to get a low-end RDBMS to keep up with a web server when it's ruanning an interpreted language and SQL written by amateurs will apply to relational databases in general. If a serious DBA trained in Oracle, Sybase, DB/2, or SQL Server were to follow your advice they would be sent back to school.

I tried to post this comment on the original author's site but his forum software thinks my browser has Javascript disabled. I guess another way to make your site 10x faster is to eliminate important functionality.

</comment><comment><USER3> The real speed problem is using general purpose web server like apache. What you need to do is write your own custom webserver for each site in assembler. That way most, if not all, the site can be served directly from server in ram without have to resort to disk reads.

<comment><USER4> "... in assembler." Or Forth!

</comment></comment><comment><USER5> not too impressed with this article..

When was client side javascript a server side performance bottleneck? On the contrary farm out as much work as possible on the client instead of doing it at the server, like sorting tables and stuff. Things like javascript tabs are also worth lot in terms of performance, serve one page that contains the content of 10 pages = less requests to the server.

eAccelerator = old skool, why not APC which is the php opcode cache favoured by Rasmus Lerdorf?

Why no advice on using a cache in apache or in front of apache to serve static stuff directly from memory?

<comment><USER6> I agree with you, I noticed the _No more than two queries per page._

Even better tip - just make a static page and your site will be so much faster...

</comment></comment><comment><USER7> Trash.

</comment><comment><USER8> The secret to high-scalability: Make a no complexity site which does near no more than a static page, denormalize your DB because even at 2 queries max per request MySQL dries up because it can't do hash-joins, but damnit if you are going to switch to a _real_ DB and implement caching on top of that blah blah blah.

This was almost, but not quite, entirely different from trash advice.</comment>


Show HN: Easy Way to Run a Contest For Your Startup - <AUTHOR> https://gleam.io/app/competitions

<comment><USER2> Greg from Rafflecopter here - our name is mentioned in your terms of service for some reason [http://cl.ly/image/0A2L0W0L3G2t](http://cl.ly/image/0A2L0W0L3G2t) glhf

</comment><comment><USER3> This is a saturated field, as others said. But there's room for a competitor here. I would focus on the main social networks integration: Facebook, Twitter, and maybe maybe Pinterest. Everything else, including Mailchimp is overengineering.

Also I left a comment just now on your site. I wonder if it's possible to get all the Twitter oauth tokens when people enter through Twitter?

<comment><USER4> It is definitely a saturated space. However, only a few competitors are agnostic to platforms (Splurgy, RaffleCopter, gleam.io, and a few others). Other competitors such as OfferPop, Woobox, Shortstack, and etc... are all Facebook centric which means you cannot embed your contests/giveaways on your website; This means you won't be able to funnel your existing website traffic into your social properties.

Also, MailChimp is not over engineering at all. It's a very key feature. These integrations are important for marketing teams. After people socially engage into these contests/giveaways, their emails are captured and then can be ported into MailChimp where you can run e-mail campaigns.

</comment></comment><comment><USER5> Nice product and website! Haven't seen Dropbox used as a CDN before ;)

Being able too look at the backend of a demo competition would be great. This makes or brakes the tool for me. Additionally, I missed more information about the social network integration. Competitions and give-aways are big on Facebookm so how does it look and work there?

<comment><AUTHOR> I hear you on the backend demo :) Our frontend is all AngularJS, however the backend isn't. We plan to have a visual drag/drop builder once we do that.

We have most networks integrated from an entry perspective, including Instagram, Facebook, Twitter, Pinterest (No API currently), SoundCloud & YouTube. We've got Tumblr coming then adding based on demand.

Our Facebook tab solution is 90% completed, we're just testing it currently. Install to Facebook will be in the free plan, on Pro you'll be able to customise the tab/gate images :)

</comment></comment><comment><USER6> Nice service, but it's already a saturated market with service providers like splurgy.com and rafflecopter.com

<comment><AUTHOR> Indeed, this isn't our only product :) But certainly we believe there's room in this space to do things better.

</comment></comment><comment><USER7> How is this any different when compared to rafflecopter.com?

<comment><AUTHOR> Few differences (we also have a lot of respect for RF, those guys have a great product):

\- Verified actions, we verify via API's that users actually complete an entry. You can just bypass this on RF (something I'm sure they're working on).

\- API, you can create completely custom entry types on Gleam. Put our API code on your shopping cart, or email signup form & activate an entry. Useful for things like "Add 5 products to your wishlist for an entry, or leave a review for an entry".

\- More social network coverage (Instagram, YouTube/Soundcloud)

\- More ways to install than just embedding on the page</comment></comment>


Apps can measure distance to nearby WiFi access points to determine position - <AUTHOR> https://www.androidpolice.com/2018/03/07/android-p-feature-spotlight-apps-can-measure-distance-nearby-wifi-access-points-determine-position/ <comment><USER2> ...on Android P</comment>


Measuring the speed of light using marshmallows in a microwave - <AUTHOR> http://efnx.com/measuring-the-speed-of-light-using-marshmallows-in-a-microwave/

<comment><USER2> I once saw this demonstrated live on a kids' TV show. The guy was basically a crazy scientist with very little idea what kids could actually understand.

His trick must not have been vetted before he went on, so as he started putting screws in the microwave and trying to explain things, the poor hosts were getting more and more flustered and concerned. It was hilarious.

</comment><comment><USER3> ADDED IN EDIT: My apologies to efnx - when I saw that the the submitted link referenced another site, I thought it was just referencing it. The comments below show that the referenced site was actually doing something different.

I'll leave this here as a reference, but I was wrong.

 _mea culpa_

</comment><comment>==

Here's the actual link:

[http://gaurabc.com/visualizing_microwaves_in_a_microwave_ove...](http://gaurabc.com/visualizing_microwaves_in_a_microwave_oven)

From the guidelines at <http://ycombinator.com/newsguidelines.html>:

      In Submissions
      ...
      Please submit the original source. If a blog post
      reports on something they found on another site,
      submit the latter.

<comment><USER4> One uses neon bulbs embedded in a clear sheet, the other uses marshmallows. This link provides a substantially easier-to-replicate version, and is therefore valuable.

<comment><USER3> You're right, I've added an apology.

</comment></comment></comment><comment><USER5> You can do this with a plate of chocolate chips too, if no marshmallows are handy.</comment>