Crypto's $600B Crash Hits a New Low - <AUTHOR> https://www.bloomberg.com/news/articles/2018-08-08/bitcoin-tumbles-to-3-week-low-as-sec-postpones-etf-decision <comment><USER2> I used to ride on the crypto hype train. Made quite a bit of money from btc. However, it is too risky of an investment. Most people that push crypto sound like pyramid scheme people.

At a party dude was telling everyone to invest in btc because it is the future, and it was $14k at the time. I explained that it is very risky and volatile and dude would just ignore whatever I was saying, even though I mined many cryptos, bought btc for 1 penny and had a better understanding of tech than him. 3-4 months later crypto was back to $6k and he never mentions it again with me around lol.

The point is many crypto businesses screwed people over (MtGox). Many people lost fortunes from private wallets due to malware, forgetting pw.

If I pay with a credit card I have level of protection. When I put my money in a bank the money is insured. Crypto is simply too risky as a way of storing money and trading.

<comment><USER3> A serious % of btc is near pure cult. So much time and energy wasted for the prospect of quicksilver it's insane.

<comment><USER4> The value of any particular coin is pure marketing. Anyone can start a coin. There is literally an infinite supply. The only thing giving them vale us popularity, and marketing is what drives popularity.

Token price speculation (aka "crypto investing") is much more about marketing than it is about technology. This is why you see cult-like marketing attempts.

<comment><USER5> This note is legal tender for all debts public and private.

Is not pure marketing.

<comment><USER4> Fiat currency gets value from the fact that it is legally required ('by fiat') to use. There is no such requirement for tokens.

</comment></comment></comment></comment></comment><comment><USER6> Practical use of these things is always just around the corner. At the moment it seems to be too slow and expensive to use for transactions (as currency) and too volatile to use as a value store. Right now it's a fun gamble, and for transactions where using normal currency woule have a higher cost (i.e. you are buying something illegal).

</comment><comment><USER7> What a wild ride. I bought Ethereum almost two years ago at 12 dollars a token on Coinbase and it's changed the financial trajectory of my family. I still have high hopes for cryptocurrencies, but I think this pullback is necessary to clear out the speculators and let the developers work on the core infrastructure of a lot of these tokens.

<comment><USER8> Did you turn it into real money or are you still speculating (now with the future of your family at stake)?

<comment><USER7> I turned it into " _real_ "(fiat) money. I expect to be sitting on the sidelines for another 2ish years. We bought a Model X and took the remainder and invested it into a pretty strong (IMO) YC startup.

 _#ThisIsNotInvestingAdvice_

<comment><USER9> Investing in a single company (even YC) is just about as risky as investing in crypto.

Disclaimer: I own a portion of about 100 YC companies. And some crypto.

<comment><USER7> It depends on what stage, but yeah it's risky.

<comment><USER10> Investing that large of a percentage of one's portfolio in any single company is extremely risky; even if it is a large, publicly traded giant like Microsoft or Amazon. In order for the investment to be successful, not only does the company have to do well, but their sector has to do well, their country's economy has to do well, and stocks as an asset class have to do well.

If you don't have hedges to insure against those risks, you are still essentially gambling with your principal. Even a Series A/B Ycombinator company probably has a double-digit percentage failure rate.

<comment><USER7> Well the company is not A/B and it's not a large percentage of my portfolio. All I said is that it's the remainder of the money from cashing out of crypto, you're making a bunch of assumptions beyond that.

Also I agree with everything you said.

<comment><USER10> Sorry - when you said it altered your financial trajectory I assumed that to mean it represented a majority of your net assets. I'm in the process of diversifying a very concentrated portfolio (a year ago >95% of my net worth was in Uber stock) and may have projected my own concerns onto your situation.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> I'm one of the core developers for Nano[1] (formerly called RaiBlocks). It's one of only a handful of cryptocurrencies with an actual working product available _today_ that does everything it claims to do: Instant transactions with zero fees on a green network that could be powered by a single wind turbine.

Despite what _I_ see as it's massive potential for things like micro- transactions, global remittance, arbitrage across exchanges, a development platform for payments and functioning as an actual currency (i.e. a medium of exchange, what you send is exactly what the other person gets) -- the market does _not_ reflect this reality at all right now. There are several projects that are objectively scams with higher market caps than Nano.

To me this reflects that the market is completely irrational right now. I knew as early as January that there was going to be a reckoning, but until some of these coins and tokens that are going nowhere are shaken out projects will just have to stand on their own merits and prove that they're valuable.

[1]: [https://nano.org/en](https://nano.org/en)

<comment><USER12> It's not working because it's impossible to use Nano as currency when it has so much volatility. Imagine sending your friends $10 and they only receive $9.

<comment><USER13> That's actually not true. Even if the volatility were that extreme, you could easily mitigate it.

At this point you are just saying anything that comes to mind and is negative without putting in thought.

<comment><USER12> It is _actually_ true. Please post how one can easily mitigate extreme volatility. I'm all ears.

[https://coinmarketcap.com/currencies/nano/](https://coinmarketcap.com/currencies/nano/)

<comment><USER11> My reply: [https://news.ycombinator.com/item?id=17722685](https://news.ycombinator.com/item?id=17722685)

</comment></comment></comment></comment></comment><comment><USER14> I've always had the opinion that Bitcoin's price was supported in part, by the Chinese using it to get around China's capital controls.

So possibly this crash, in addition to the SEC refusal to let a Bitcoin ETF trade, is also affected by the recent tariffs and the Yuan devaluation...?

</comment><comment><USER15> It looks like there were people waiting for a good quit spot, other than that crypto market doesn't seem to be hard hit since 8 months straight and still stays valuable.

</comment><comment><USER16> Take the resources being spent to get Bitcoin onto Wall Street, spend them to get Facebook Moms onto Bitcoin and suddenly the value rises. Salvageable currency, without that utility it suffers.

</comment><comment><USER17> I believe in Bitcoin only.

The people that have been around for almost a decade have treated Bitcoin as a hedge against Fiat currency inflation. Similar to how people treat gold. I am one of these people that believe in the 21,000,000 solutions as something that is nuclear chemistry proof and rare.

Outside of that is a joke.

dApps unused, copypasting bitcoin (or various alt coins), then promoting it as a world changing idea. Various centralized currencies which defeat the entire purpose.

I imagine things like Tether will be the future allowing money to be moved cheaply. As I develop my own coin, I choose to tie it to a very popular investment rather than produce yet another silly 'rare' number.

CryptoCURRENCY needs to move things that are hard to move, cheaply. Crypto that stores and manages data seems like a foolish application due to the enormous expense, unreliable txn times, and unneeded verification.

<comment><USER18> Why would you use bitcoin as a hedge against inflation instead of some real asset that has persistent value? Land, gold, etc?

<comment><USER17> Land is good, but can be seized by a government. I know an Iraqi family that went from riches to rags due to this.

Gold is good, but as a chemical engineer, nuclear chemistry is a real threat.

I love ETFs, but I think the market is artificially inflated by the current trump bull run.

Bitcoin is used worldwide and can be kept on a cellphone or piece of paper.

<comment><USER19> > _Gold is good, but as a chemical engineer, nuclear chemistry is a real > threat._

I never thought I'd run into someone who believes in crypto _and_ practical alchemy at the same time.

</comment></comment></comment></comment><comment><USER20> Spoken differently to see the glass half full: Ethereum Classic jumped to new hights, the highest of the last 4 month, while Bitcoin returned to the 6.something it was at the last month before passing 7k due to ETF rumors

Business as usual, some people make money (those who bought ETC 2 or 3 weeks ago at the dip, and are selling now in BTC or in USD), some people lose money (those who speculated on the ETF success). These are cold hard facts - not the half full, or half empty glass.

The article title however is just dramatization, maybe for clickbait, or maybe intended to please an audience of people mostly hostile to crypto? It is bloomberg that hits a new low.</comment>


Facebook has been paying people to install a "Research" VPN - <AUTHOR> https://techcrunch.com/2019/01/29/facebook-project-atlas/ <comment><USER2> Some of the highlights from Will Strafach, who did the actual app research for TechCrunch:

#1 "they didn't even bother to change the function names, the selector names, or even the "ONV" class prefix. it's literally all just Onavo code with a different UI."

#2 "the Root Certificate they have users install so that they can access any TLS-encrypted traffic they'd like."

My editorializing - I have been suspicious of Facebook getting the "submarine" treatment (1) but the insane scuminess of #1 above, which essentially is a big fuck you to Apple, pretty well supports the recent view that FB will essentially break any rule that serves to further their own ends.

via [https://twitter.com/chronic/status/1090394419902197761](https://twitter.com/chronic/status/1090394419902197761)

(1) [http://www.paulgraham.com/submarine.html](http://www.paulgraham.com/submarine.html)

<comment><USER3> Side note: This wouldn't get around cert-pinning? Even if a new trusted CA is installed on the system, an app implementing cert pinning still wouldn't trust this new CA. Seems that could be a wise move for Facebook's rivals that want to limit snooping.

Edit: on 2nd thought even if Facebook can't decrypt a particular app's traffic, just knowing how many requests it makes, how large they are, and how often, could still provide some useful insights into an app's usage.

<comment><USER4> If the app is hard coded it shouldn't trust another cert. Note though that browsers, like Chrome, ignore cert pinning if the cert chains up to a locally trusted CA. So the answer is more "It Depends".

> Chrome does not perform pin validation when the certificate chain chains up > to a private trust anchor. A key result of this policy is that private trust > anchors can be used to proxy (or MITM) connections, even to pinned sites. > "Data loss prevention" appliances, firewalls, content filters, and malware > can use this feature to defeat the protections of key pinning.

[http://www.chromium.org/Home/chromium-security/security- faq#...](http://www.chromium.org/Home/chromium-security/security-faq#TOC-How- does-key-pinning-interact-with-local-proxies-and-filters-)

EDIT: Spaced on the fact this is a phone app. While Chrome on Windows ignores certificate pins, I'm unsure if this also applies to Android / iOS root stores as well.

<comment><USER5> So what DOES pinning protect against? Certs generated by state actors with access to CA's?

<comment><USER6> That, and (more commonly) CAs mis-issuing certificates to malicious actors due to bugs or weak internal controls.

</comment></comment></comment></comment></comment><comment><USER7> How is this not in violation of most wiretapping laws? Facebook is not the common carrier in these cases. Both parties of conversations with teens are not consenting to the wiretapping, which is not allowed in many US states. I'm not sure teenage consent is considered "consent" and the parents aren't a party to the conversations Facebook is wiretapping. Facebook is both paying people and recording the electronic communications... So how the hell is this legal under current laws?

<comment><USER8> im sure a disclaimer is in the eula (boo).. but if it were deemed illegal, i suspect fb would just pay the fines, or more likely, be given time to come into compliance with the law..

<comment><USER9> A 13-year-old can't make a contract in law, certainly not in the UK. Was the app installed outside the US?

<comment><USER10> A 19 year old can. If he access private discussion with his 13 year old brother, indirectly the study will gather data of the kid. RGPD don't care if you gathered data directly or inderictly, you are liable.

</comment></comment></comment></comment><comment><USER11> The fact that this exists makes me uncomfortable, but I'm having trouble pinpointing a reason why it's bad. People are opting into the data collection. Perhaps they don't know the full extent of what Facebook is tracking, but sideloading apps on iOS is not a one-tap process—anyone who used this had a sense of what they were doing.

And, $20 per month is pretty substantial compensation.

The way that Facebook is bypassing Apple's rules feels shady, but I've always felt those rules were user-hostile to begin with. I firmly believe that users should have control over their own devices, and that means letting users give information to companies if they so choose—especially if they're being financially compensated.

<comment><USER12> Recently, there was an HN thread of a Chinese man who sold his kidney for an iPhone at 17 years of age and 8 years later was bedridden for life because his remaining kidney failed.[1]

You could say the people who bought his kidney for an iPhone did nothing wrong. The kid had control over his own body and they made a deal the kid thought was good.

I think, though, that he wasn't properly educated of the risks that doing such a trade would leave him with, and that the people who offered him the deal very well knew them, but targeted him for being a naive child who wouldn't take them seriously.

I think this is the same case. People just don't understand or don't take the risks of this seriously enough, and companies like Facebook take advantage of that.

[1] [https://news.ycombinator.com/item?id=18925780](https://news.ycombinator.com/item?id=18925780)

<comment><USER11> You're implying (perhaps unintentionally) that selling an organ is equivalent to selling information on what websites you visit. There's a reason selling organs is illegal, at least in the US.

I don't think personal information is so valuable that we need to outlaw its sale.

<comment><USER13> Organ selling isn't illegal because organs are valuable.

<comment><USER14> Impingement on quality of life by the seller of an organ can be, and is translated to a value statement. However, the paradoxical nature of human beings which relies largely on emotional responses dictates that while we can have people starving in the streets, because it would make society squeamish, they can't be allowed to sell their organs, for the sake of their own human dignity and quality of life, never mind that society stripped them of both anyway.

<comment><USER15> This isn't paradoxical at all, when both options are horrific there is little benefit to cover up one with the other and claim a solution.

Furthermore a short term windfall from selling organs will not provide the skills or assets required to prevent long term starvation and homelessness; so now the horror has been compounded: homeless, starving, and prone to debilitating illness.

<comment><USER14> The paradoxical nature is that being homeless and starving is horrifying but something humans have become accustomed to, and yet the idea of selling organs is embedded culturally as being shocking, even if the end result of being starving and homeless is relatively equivalent to being desperate enough to sell organs, so it's not allowed.

Also, how you mention as fact that money from selling organs won't prevent long term starvation and homelessness is surprising; you don't know that's the case one way or another but you're trying to pass off an opinion as fact. I can't argue either that it would help with a clear and definite metric, but the correlation of living conditions and money is clear. How real-life application of such legalization or organ selling, with quality of surgery and post-surgery care, legal predatory practices, and other factors are dealt with are potential problems, but those are issues that exist in all commercial domains.

I also never argued organ selling as a solution to a problem; as others mentioned, it is a potential band-aid to a problem that lies in wealth inequalities, but which I find interesting as a societal flashpoint that show how knee-jerk emotional responses can cause logical paradoxes.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> I recently came across a similar market research effort in Switzerland [1] after I noticed the VPN symbol in the status bar on a relative's iPhone when showing them something. I asked about why they (not very tech-savy otherwise) were using a VPN and was told they were participating in a market research project in exchange for some shopping gift cards. As is the case with FB, the research company installs a VPN and their own root certificate.

Of course the implications are outlined in the fine print / data protection agreement when signing up, but I doubt most of the participants are aware of just how far the data collection they enable with this goes...

[1] [https://swissmediapanel.ch/](https://swissmediapanel.ch/) (Link in German)

<comment><USER17> Seems to me like the law needs to be clearer about how to inform users in cases like these. Surely, it's deceptive to tell someone they're getting paid for installing a "market reasearch" app which actually records all online activity. Charging companies, who knowingly deceive users like this, with fraud sounds reasonable to me.

<comment><USER16> I agree that the law should probably be changed, but for slightly different reasons.

They are clearly informed that the app will track information regarding their online activities, device usage behavior and applications they use.

I think the main issue is that users without a tech background are just not aware of the full implications of allowing a third party to collect this kind of data, even decrypting their HTTPS traffic and tracking everything they do online.

The statement by Strafach in the original article sums it up quite nicely:

"The fairly technical sounding 'install our Root Certificate' step is appalling," Strafach tells us. "This hands Facebook continuous access to the most sensitive data about you, and most users are going to be unable to reasonably consent to this regardless of any agreement they sign, because there is no good way to articulate just how much power is handed to Facebook when you do this."

<comment><USER18> You can't be _clearly informed_ and _not aware_ at the same time.

Which makes this _fraud_ , right?

In the same way automotive manufacturers are held accountable even if their was no intention to cause harm, the software industry needs to be held accountable.

We need to have professional organisations, and government regulators, working to ensure some kind of general industry best practice, where software developers can initially start getting tapped on the shoulder, then given a series of rapidly increasing penalties until the industry gets the point that it can't keep making out it's the wild wild west.

And this is why I don't believe software development is a proper serious profession. The proper professions, here in Australia at least, are granted the authority to witness statutory declarations. I can go to a qualified vet, doctor, engineer, chiropractor(!), police officer, school teacher, postal worker, the list goes on[1], because these _professions_ have a _chain of trust_.

And yet we trust(?) software developers and their employees with our most sensitive data!

1\. [https://www.ag.gov.au/Publications/Statutory- declarations/Pa...](https://www.ag.gov.au/Publications/Statutory- declarations/Pages/List-of-authorised-witnesses.aspx)

</comment></comment></comment></comment><comment><USER19> In an odd twist, this is precisely what some tech critics have been pushing for—for consumers to be monetarily compensated for the data they're giving up to tech giants:

[https://news.ycombinator.com/item?id=17595564](https://news.ycombinator.com/item?id=17595564)

<comment><USER20> One issue with this is brought up in the article:

> "The fairly technical sounding 'install our Root Certificate' step is > appalling," Strafach tells us. "This hands Facebook continuous access to the > most sensitive data about you, and most users are going to be unable to > reasonably consent to this regardless of any agreement they sign, because > there is no good way to articulate just how much power is handed to Facebook > when you do this."

<comment><USER21> right, but considering most web traffic is encrypted nowadays, it's pretty much mandatory to do MITM to analyze traffic.

<comment><USER22> Perhaps that should be taken as a hint rather than a challenge.

</comment></comment></comment></comment><comment><USER23> Being opt-in and getting compensated are the two things I've seen people want from usage of their data. No one should have an issue with this since it does both.

<comment><USER24> I harbor serious doubts that most of the 'volunteers' here know exactly what it is they're providing -- the sign-up sheet probably didn't say "we will know very specifically your porn-watching habits" e.g.

<comment><USER25> 13 to 17 year olds aren't supposed to be able to access porn legally, so can Facebook plausibly deny that this is something they are monitoring?

<comment><USER26> FB is not supposed to make deals with minors without adult supervision…

</comment></comment></comment></comment><comment><USER27> The group of people using this "App" by this can be broken up into 2 main groups:

1\. Those who understand what they are signing away and need $20/mo more than they need privacy

2\. Those who don't understand or don't understand fully what they are signing away and see it as free money

Preying on either group is disgusting and wrong. I'm really interested to see what Apple does here, they have taken a hard line on privacy and I don't doubt they will kill this app but if FB wants to play wack-a-mole they WILL win (see iOS sideloading scene), for me the big question is will Apple take down the FB apps?

We've seen Netflix, Uber, FB, Amazon, and more skirt the rules of the App Store in the past, they've barely gotten a slack on the wrist (in public at least). At what point does Apple take a real stand and say no? Cause so far $$$$$ has ALWAYS stopped them, I really do believe they care about privacy, I don't know know if the shareholders do.

Edit: Typo

<comment><USER28> Wait a sec, 2 is wrong but 1 sounds positive to me. For some people this money could be incredibly important.

<comment><USER27> Are we, as a society, ok with people being desperate enough to need $20 more than privacy?

Or maybe privacy isn't something we should care about or at least value as much as we do as a society. Maybe I'm wrong. I _think_ I see the dangers down the road but maybe it's just a mirage and privacy will die and it won't be used against use by people in power or with money.

<comment><USER29> This is probably something you should ask the person who's desperate enough to need that $20, than to decide for them from your point of reference.

<comment><USER27> I'm not attacking them for taking it, I harbor no ill will toward either group #1 or #2 of my original comment. I'm asking if we are ok with this being necessary in the first place. I'm not ok with it.

<comment><USER30> I have the app installed on my phone. I have it installed because I want the $20 amazon. I don't know if I really "need" the $20 amazon but it is 100% passive once it is installed. You literally need to do nothing. Every month they send you $20. I would not uninstall it even given the privacy concerns.

If you guys are so concerned about it then create something that puts cash in my pocket. I'll gladly run whatever app you want on my phone if you pay me.

<comment><USER31> Now you actually do make me have ill will toward #2. Enjoy your $20. A free lunch/month, right?

Edit: and now they shut it down. You can thank us privacy advocates later.

</comment></comment></comment></comment></comment></comment></comment><comment><USER32> > Facebook first got into the data-sniffing business when it acquired Onavo > [..] to learn that WhatsApp was sending more than twice as many messages per > day as Facebook Messenger [...] and to spot WhatsApp's meteoric rise and > justify paying $19 billion to buy the chat startup

This makes a lot more sense now. At that time the tech sphere was surprised at the price tag which is expected as people outside Fb perhaps didn't have these metrics.

<comment><USER33> I know that it's not really insider trading, but the concept really does sound similar..

<comment><USER34> It is actually crazy that this is not discussed more often.

How they heck is this fair?

<comment><USER33> I know, right? Spy on your competition without anyone's consent and then simply make them an offer they can't refuse...

</comment></comment></comment></comment><comment><USER35> I don't see why Apple couldn't take down _all_ Facebook apps until they comply. It seems like Apple has the real power here.

<comment><USER27> Oh they could, I mean Apple could just keep killing their accounts they create but is FB ballsy enough to keep opening them? It would be FB calling Apple's bluff. Users would riot though. Apple has to decide between supporting privacy or supporting their users' choice. Apple has made the decision to take away users' choice in the past in the name of safety/protection, I could see them doing it again.

I can bet this is the LAST thing they want to see in the headlines. It forces them to address it, maybe they have a plan ready to go for this eventuality, a whole PR push and I kind of hope they do. If they don't they either look weak on privacy or have to roll out some half-baked plan/proposal/nebulous idea on how to protect users privacy better in iOS 13 or something like that.

Right now Apple is doing a whole hell of a lot of taking out of both sides of it's mouth and I understand it's a hard line to walk, I'm not saying I could do it better. FB's practices in general are probably an affront to Apple in general but skirting Apple's limitations to piss all over privacy and essentially turn an iPhone into an Android-level of data collection, I can imagine Apple is PISSED. I just really hope they had something planned for this day.

<comment><USER36> > Oh they could, I mean Apple could just keep killing their accounts they > create but is FB ballsy enough to keep opening them?

Enterprise developer accounts (the ones that can issue apps signed such that they can be sideloaded on any device) aren't something just anyone can go online and sign up for-- they require manual approval with proof of a business's identity before they're created.

So, unless Facebook starts opening well-disguised shell companies or something along those lines to circumvent any restrictions Apple might put on them, this will be over as soon as Apple revokes Facebook's enterprise distribution account. (Or, more likely, threatens Facebook into dropping the VPN app, because FB probably doesn't want to lose the ability to distribute legitimate internal-use apps to their employees.)

<comment><USER27> > Enterprise developer accounts (the ones that can issue apps signed such that > they can be sideloaded on any device) aren't something just anyone can go > online and sign up for-- they require manual approval with proof of a > business's identity before they're created.

It's my understanding that faking these business identities is the entire business model of iOS sideloaded services (see the subreddit for examples [0]) so I don't think it's that difficult to do. That said, I'd be shocked if Apple let them go that far as to keep spinning out fake businesses but then again if FB thinks it can get away with it what's stopping them?

[0] [https://www.reddit.com/r/sideloaded/](https://www.reddit.com/r/sideloaded/)

<comment><USER37> That would be getting into serious fraud, arguably criminal under CFAA. Normally Apple isn't interested in prosecuting these people as its just sideloading, which is some minor copyright violations and a security risk in their view, but if Facebook did it after having been banned themselves, having a written statement from Apple that these apps were violating, and then they go and pay a third party or deliberately make a shell company to defraud Apple? That could provoke a total business embargo between the companies which would suffocate FB.

</comment></comment></comment></comment></comment><comment><USER38> What I want to know is:

Why is Josh Constine still covering Facebook at TechCrunch? Is there no accountability for journalists who totally failed us?

For context, he's the guy who was supposed to be covering Facebook over the last 10 years, but instead of hard hitting journalism, we got nothing more than press releases and pro-FB articles.

See for yourself:

[https://www.google.com/search?q=Josh+constine+facebook+site:...](https://www.google.com/search?q=Josh+constine+facebook+site:techcrunch.com)

<comment><USER39> I think a lot has to do with media outlets like TechCrunch having an "oh shit" moment wherein they realize Facebook is taking their profit machine from them (advertising). He even admits as much in the Twitter comments where he posted this.

If people at this point doubt that traditional media is waging war against Facebook as a means of survival and masquerading as a bastion of privacy as a means to an ends they are willfully delusional. These organizations show much more intrusive ads to me than Facebook. Also they treat Twitter with kid gloves because Twitter is useful for them to gain a following and disseminate their posts. Twitter has also shown me much more politically motivated ads recently than Facebook has.

<comment><USER40> Why aren't you using an ad blocker?

<comment><USER41> What are your suggestions for blocking ads inside of the Twitter app?

<comment><USER42> There are browsers for Android that have ad-blockers (e.g. Firefox for Android). You can use Twitter's mobile website in one of these browsers.

</comment></comment></comment></comment></comment><comment><USER30> I have this app installed on my phone and I have chosen to have it installed by choice. I am getting paid $20 amazon per month to have it installed.

Why do I do this? Because I enjoy making side hustle money with my phones. This research app in particular is very useful to me because it is 100% passive. If you are concerned with privacy you can always just use a crap side phone to run the app.

<comment><USER43> > 100% passive.

Can you explain what you mean by this? I wouldn't like it because I would consider it to be watching me, and I don't think that's passive.

<comment><USER44> I'm pretty sure he just means he doesn't have to set aside any time to directly interact with the app himself

</comment></comment></comment><comment><USER45> I'm not a law expert, but IMO FB should seriously lawyer up. I can say that this kind of misconduct would almost certainly end up in court in Germany. A 13 years old consent with a cryptic data protection policy is not legally binding and luring kids in need of protection with money to give up fundamental rights can be viewed as an act of non-physical abuse.

<comment><USER30> I have this app installed on my phone. When you sign up you purposefully have to get consent from an adult to sign up as a minor.

<comment><USER9> I'm not sure that works in law. A 13-year-old could click "consent" and not make a contract with FB.

<comment><USER45> I agree. That can also be called "common law" in Germany. Contracts with people who are not entitled to sign contracts on their behalf are not considered legally binding.

In that sense, it shall be treated as if there hasn't been a contract at all. The process is purposefully designed to get a signed contract as fast as possible. The technology to make proper ID (Age) verification is available, but my understanding is, that it is not used by facebook and its partners.

<comment><USER37> COPPA doesn't require foolproof age verification IIRC, otherwise the regular Facebook app and nearly every app on the planet that just asks for a birth data with no verification would be illegal.

<comment><USER45> That is 100% true. It's a regulatory issue that politics could address. Having no proper age verification is not illegal.

I mixed two points here. Contracts that contradict the law and my wish for better regulations.

</comment></comment></comment></comment></comment></comment><comment><USER25> Apple should just pull their Enterprise certificate so the app stops working.

<comment><USER46> Apple should pull their entire developer program account! This is insane abuse of either Enterprise signing or developer signing - it could be either depending on the setup process.

</comment></comment><comment><USER47> The actual article title is "Facebook pays teens to install VPN that spies on them".

<comment><USER48> And that's a sensationalist title, since it's not spying, it's consensual informed monitoring.

<comment><USER49> "it's not an explosion, it's a rapid oxidation event"

<comment><USER50> Rapid unscheduled disassembly

</comment></comment></comment></comment><comment><USER51> Whilst not technically correct (Facebook is not getting "root access" to the device), paying teens to install a VPN that spies on them is just gross!

</comment><comment><USER52> This all seems like a rerun of Uber - bad news on bad news compounding on bad news. Something is very rotten at Facebook and has been for a long time now.

<comment><USER53> Ya, and Uber had a change of leadership, lets hope something like that happens at facebook too.

<comment><USER54> I guess the difference is that Zuck has over 60% voting control of Facebook so he can't be forced out.

<comment><USER40> Facebook's record is the best argument for banning dual share classes: if you want to keep control of your company, you shouldn't be able to do that at the same time as selling most of it off. If you are running a public company, you should be accountable to your shareholders.

<comment><USER55> I disagree, those shareholders know what they're getting into when they buy the stock. I do agree with just about 95% of criticism directed at Facebook, so this isn't me defending them specifically. I just don't see why dual share classes should be forbidden as long as people are properly informed when purchasing non voting ones.

If I offered you 10% of my bakery's profits but told you explicitly that you'd have no voice in how I run it, it could be a good deal for both of us and we'd both know what we're getting into.

<comment><USER40> It's not about whether it's a "good deal" for the investors: it is that as a society allowing unaccountable business dudes to run roughshod over society isn't working out so well.

<comment><USER54> If you eliminate dual share classes then those dudes will remain unaccountable by never going public.

</comment></comment></comment></comment></comment></comment></comment><comment><USER56> Those enterprise code signing certificates and provisioning profiles probably won't have much life left if Apple is awake at the wheel.

Seems like a risky game to play, likely staking their appstore developer account at the same time. High stakes.

<comment><USER57> I really hope not. Enterprise distribution has been hugely useful as an internal tool at just about every company I have worked for.

They seem to have broken the cardinal rule though. Namely the somewhat ambiguous "Don't use your Enterprise account to bypass the App Store."

<comment><USER40> If they ruin this for the rest of us, I will never forgive Facebook. I hope Apple comes down on them like a bag of bricks instead of f'king up my beta testing.

<comment><USER58> Hard to forgive Facebook for undermining democracy, mass behavioural manipulation, privacy violation, monopolistic practices, and a gazillion other things.

But I agree, add this to the "unforgivable" pile.

</comment></comment></comment></comment><comment><USER59> Maybe I am getting old but I am really becoming more and more skeptical of anything that's coming out of Silicon Valley. Everything Google, Facebook and other ad-supported companies produce seems to be designed to do something behind the backs of users. If the trends continue these companies will soon have world-wide full surveillance of almost everything which then will be perfect infrastructure for dictatorships. And with the growth expectations these companies will have to do more and more sleazy stuff to keep growing.

<comment><USER60> You are not getting old. In the past SV solved the "hard" problems for the military. Now it's solving perceived first world problems

<comment><USER58> The problem is simple and relatively recent: advertising business models lead to unethical behaviour. That's all. The worst companies are those most dependent on advertising.

</comment></comment></comment><comment><USER61> This is hardly different from all those ad supported platforms we use every day. For privacy invasion, you get compensation. Usually you get to use a service free of charge, in this case (because the invasion is worse) you get financial compensation.

If you mind this, you should be honest with yourself and compare it to all the other deals you're striking with many services.

<comment><USER62> Let's put it this way, imagine if everything that you ever said in various businesses was recorded and publicly available. That's analogous to the "many services" you're referring to.

Now imagine if people were being offered the chance to get some gift cards in exchange for strapping a microphone to their face 24/7, regardless of location. That's analogous to what's happening here.

Anything you do, visit, etc, can be collected. Your bank app traffic, your location data that any app requests, the contents of your data voice calls over non-FB apps, etc.

<comment><USER61> I understand the implications.

But I don't see a fundamental difference between strapping a microphone over someone's mouth 24/7, and only strapping the mic on (or, more practically, turning it on) when the user uses certain applications. In both cases you're compensated and in the former we feel violated, and in the latter it's all fair game and business.

</comment></comment></comment><comment><USER63> Reminds me of those old "dial up" Internet access offers that offered to pay you to surf the web. Being a broke college kid, my friends and I quickly learned we could game the system by installing software that moved our mouse and clicked randomly. Made for a pleasant and sometimes shocking surprise when waking up in the morning and checking to see where your PC navigated to the previous night.

<comment><USER64> Yes, AllAdvantage was the biggest: [https://en.wikipedia.org/wiki/AllAdvantage](https://en.wikipedia.org/wiki/AllAdvantage)

I only got paid $31 for a month. Even as a kid, it wasn't worth the effort required due to their constant updates.

The real hidden gems were NetZero and K-Mart's BlueLight. Both were completely free dial-up internet providers, paid for by a banner ad program that was easy to hide with window killers.

Netzero went on to acquire BlueLight and many other free internet providers, and eventually turned into a paid internet service: [https://www.mybluelight.com/](https://www.mybluelight.com/)

<comment><USER63> >I only got paid $31 for a month. Even as a kid, it wasn't worth the effort

My exp exactly.

>The real hidden gems were NetZero and K-Mart's BlueLight.

Yes and Yes! Used both, both were a giant pain but fun to mess around with. Now that I'm thinking about it, I'm not sure why I bothered as our family had dialup (I was probably just bored)

</comment></comment></comment><comment><USER65> At what point does Apple pull Facebook's developer licenses? as people have mentioned, this appears to be a violation of the enterprise account program.

<comment><USER25> It's important to note that Facebook has at least two "licenses" here: one is used to push their apps to the App Store, and another to sign enterprise apps (like this one). Pulling one should not affect the other.

<comment><USER66> But to the point - this should at least result in a revocation of the Enterprise account.

</comment></comment></comment><comment><USER67> Well, this is the final straw for me. Facebook has been so repugnant lately that it's time to delete my account. Does anyone here recommend an alternative? Right now I'm considering Mastodon and MeWe.

EDIT: I ultimately went with MeWe because it's more user-friendly to non-tech people i.e. most of my relatives.

<comment><USER68> > Well, this is the final straw for me. Facebook has been so repugnant lately > that it's time to delete my account.

Don't delete your account. Just delete all your posts and change your profile pic to something that tells everyone you've ditched Facebook. It'll continually remind everyone you've left and make Facebook seem more like a dying community to those who are still on it.

Then finally delete your account once it's as dead as MySpace.

</comment></comment><comment><USER69> Would joining FB as a Privacy Czar or whatever be a job one should rightly wish on a highly competent privacy person, or is it a new form of torture in Hades alongside Sisyphus and others?

<comment><USER70> Perhaps a bit like Baghdad Bob's job as Saddam Hussein's Information Minister: [https://en.wikipedia.org/wiki/Muhammad_Saeed_al- Sahhaf](https://en.wikipedia.org/wiki/Muhammad_Saeed_al-Sahhaf)

</comment></comment><comment><USER71> What is the problem here? They are literally paying users to get their data. Seems like a fair tradeoff right?

<comment><USER72> The problem is some things should not be for sale at all, otherwise we end up in some kind of undignified nightmare of a society.

Human beings, body parts, privacy, those kind of things.

<comment><USER73> And who will make this decision for me? You?

<comment><USER74> You, of course. No one is arguing that you should be forced to sell your privacy.

<comment><USER75> Except it's a very one-sided deal when "you" doesn't fully understand (or even begin to understand) what's being given up.

Find me five people off the street who can explain the implications of tapping yes to install that root cert.

</comment></comment></comment></comment></comment><comment><USER76> How are they able to pay or contract with users under the age of 18? Or do they get parental consent. Not sure how that works. Referring to the 20/month, I assume under 18.

<comment><USER77> The article goes into that, they compensate the parent with the $20/month.

</comment></comment><comment><USER78> I... I... I just can't even...

What is Facebook thinking?? Shouldn't a company which is already getting bad PR for its handling of private data be extra careful about how much personal data it gathers and what it does with it?

<comment><USER79> The funny part is you always have those people that show up and say that we are "too hard" on Facebook, and that the NYTimes is just pushing too much and that it's just bad PR, not really bad actions. And yet, after all this bad PR, Facebook keeps being a shitty company.

<comment><USER33> Sort-of.

I mean Facebook does deserve the negative PR it's receiving, don't get me wrong. I finally deleted my account, too, since it's become too much. It does seem to me like it's very much in their interest of the media to keep attacking Facebook now that it's socially acceptable (Cambridge Analytica stuff and all), since Facebook's one of the companies that greatly influenced and interfered with their possibility to generate an income.

</comment></comment></comment><comment><USER80> Why are there always so many people willing to defend the oppressor?

This story is full of people making apologias for facebook's shady behaviour.

I just don't get the urge in some people to defend the rich and powerful.

They don't need you to defend them, they are probably 100000x richer than all of us discussing this here put together.

This is an honest question because I can't understand the motivation behind it. If you are one of those people defending facebook, why are you doing it?

<comment><USER34> >This is an honest question because I can't understand the motivation behind it.

How informed should the user be? What qualifies as an informed user?

This is getting into some dangerous territory because it because implies so some sort of contract literacy.

<comment><USER80> > This is getting into some dangerous territory because it because implies so > some sort of contract literacy.

We already have laws forbidding certain types of deceptive contracts.

The average user can't be expected to understand the consequences of installing facebooks 'trusted' root certificate.

</comment></comment></comment><comment><USER81> I recently had something similar on Google Fi. One day my phone had a pop-up offering to connect me to their beta VPN automatically for security.

Of course, while connected to the VPN you can't connect to anything on the LAN, and I'm not sure how regular users would be able to disable the thing.

And, of course, the problem of Google sniffing everything you do.

<comment><USER82> I have Google Fi and I'm not sure this is the same thing. The Google VPN doesn't install a root CA (AFAIK) and merely acts like a normal VPN. It _does_ terminate at Google's servers so they can peek at your traffic, but not any more so than a traditional ISP.

The "secure" VPN dialog only comes up for certain WiFi connections that Google has some knowledge about. For example, when I'm in Chick-fil-A I get the "Secure this connection?" dialog, but I never get it at home or work. I've never had a need to disable it to reach local resources, but I'm guessing you could turn off WiFi and turn it back on to rejoin the network and not accept the VPN connection. I've never had the need to do that so I don't know if it would work or not. :/

<comment><USER81> No, this was different from the automatic per-known-wifi connection securing that it normally does. It was an actual VPN, that I had to manually remove because I could no longer access anything on my LAN.

</comment></comment></comment><comment><USER83> Who is surprised? This is Facebook's DNA.

</comment><comment><USER84> It's no surprise that over and over again, Facebook has shown us that it will stop doing some of the bad things it does only when it's caught red handed. Until then, the employees who work there won't have any ethical qualms and the company won't care much about the impact either. Every time some news like this comes out, the PR department probably shrugs its shoulders and says "What are the users gonna do now? Quit our platform? Where will they even go to?" and just laughs out loud.

If a person were to adopt this behavior, we would call them a criminal. Facebook, on similar lines, is a criminal enterprise that hasn't been punished appropriately so far!

</comment><comment><USER85> > Facebook sidesteps the App Store and rewards teenagers and adults to > download the Research app and give it root access

But how? I didn't knew this is possible to do on iPhones except really old models. If it is I'd love to know how.

<comment><USER25> The article is misleading; the app does not have root access, it has access to web traffic via a trusted root certificate. The app is distributed outside the App Store through the enterprise developer program.

<comment><USER57> It's worth noting that one of the main rules of these Enterprise accounts is that they are not to be used to bypass the App Store.

For example, we use them to distribute frictionless test builds internally.

<comment><USER25> Yes, I know what the enterprise program is for; this is a clear violation of those rules. But Facebook is not getting root access to your device, as the title of this post and the article claims.

<comment><USER57> Yeah I can tell you have experience with iOS code signing.

I just wanted it to be clear to others that this is NOT the intended purpose of the Enterprise program.

<comment><USER86> I'm looking forward to Apple revoking Facebook's access to it.

<comment><USER37> It appears to be their main In-House Enterprise cert, so it may well cause some major chaos as all internal apps go dead.

</comment></comment></comment></comment></comment></comment></comment><comment><USER87> Apple should remove all facebook apps from the app store till facebook employees decide evil isn't worth it.

</comment><comment><USER88> For anyone reading this now good news - [https://news.ycombinator.com/item?id=19033451](https://news.ycombinator.com/item?id=19033451)

</comment><comment><USER89> "Root access" and "root certificate" are entirely unrelated, but this article seems to conflate the two terms.

<comment><USER90> "Root access" isn't in the original article title.

Edit: HN title has changed to remove this part completely.

<comment><USER89> It was in the original article title when I posted this; I believe they edited it.

</comment></comment></comment><comment><USER91> Tangentially related, but his leads to an issue I try to stress this to my students all the damn time, but they just don't care. Like, they all try to download any free VPN that'll connect so they can play Fortnite during school, without ever looking to see what they give away. Hell, I'm not convinced they wouldn't _consent_ even if it was told, as long as they get their fix while at school. There's a huge problem nobody wants to try to fix.

<comment><USER40> The arms race between school administrators and people who wanted to connect to things they shouldn't has been going on for decades and is one of the major sources of sys admins. The problem here is that installing a VPN is far too easy and doesn't teach children where /etc/host is located.

<comment><USER37> At my school, they have default "teacher" for external events that use school facilities, usernames and passwords based on each school code that bypass all filters, but somehow no one has found it leading to insane workarounds. Sadly, people used to use web.archive.org as a workaround (like dude, just go home and look stuff up?) so they blocked it, which breaks a lot of research and sources on Wikipedia.

</comment></comment></comment><comment><USER92> I wonder if a party at the _remote_ end of the traffic that Facebook is monitoring could have valid grounds for damages against Facebook.

</comment><comment><USER93> As an app developer, is there anything that can be done to prevent Facebook from spying on your traffic?

<comment><USER94> Certificate pinning. And perhaps warning your users about potential baddies if someone tries to change it.

Elsewhere in the article it mentions people were paid to screenshot their Amazon order history. Why would they do that if they could read all app traffic? My guess, Amazon is smart enough to use certificate pinning and/or not trust root certs

</comment></comment><comment><USER95> I wonder if Apple considers options to take the Facebook Apps out of the App Store.

</comment><comment><USER96> I don't know how I feel about this. On the one hand Facebook is working around Apple's terms and conditions, and enticing underage kids to compromise their phones. On the other hand, there's no law broken here, Apple's terms and conditions are not generally fair to users, and the kids know all of their data is being tracked for money ( and presumably are happy with it). Plus, freedom to use the personal device you bought as you see fit is preferred to Apple deciding what you can and cannot have on your phone. So, how should I feel about this?

<comment><USER97> > Slavery in 1800s

> glitchc: there's no law broken here. So, how should I feel about this?

<comment><USER98> You're comparing owning a person to people voluntarily downloading apps ?

<comment><USER97> What I'm implying is the original commenter's reasoning is faulty.

But you can interpret it whatever you wish.

<comment><USER96> Actually it's your reasoning that's faulty. All crimes are not equal. That's why society deems it appropriate to outfit different crimes with different punishments.

Let's not forget that until mid-20th century, adultery was illegal in most states...

</comment></comment></comment></comment></comment><comment><USER99> Facebook. Preying on kids again.

</comment><comment><USER37> Damn, I tried DM'ing some security researchers about this a week ago, looks like I should have just sent it here. I've got some added details from my research into it.

1) Regarding distribution channels, I have only once had the program advertised, via an Instagram ad. I have my real age on Insta (I know, I know...) so targeting younger users may have played a role. I first saw the ad in June 2018, and decided to click through to see how bad it was from a security standpoint. IIRC I never installed it, but I got an email to my throwaway account a few weeks ago asking to reinstall, so I decided to give it a run-through for research. They refer to is as "Research Application," and avoid mentioning FB, their email the first time was firstname.lastname@example.com and it is now sent through a mailer with no mention of FB in email address. The contractor was Applause/uTest, they offered $10/month via PayPal (which <18 technically aren't allowed to have). Since uninstalling, they sent an email saying it hadn't heard from the app in 24-hours and you must participate 23/days month to be paid.

2) The install link is at [https://m.facebook.com/facebook- study/f8854f1fb9f4f57bf0d861...](https://m.facebook.com/facebook- study/f8854f1fb9f4f57bf0d861c03528ce4c/<unique_code>), and the IP used by the VPN is vpn-sjc1.v.facebook-program.com / 22.214.171.124. On iOS, the "Connect on Demand" feature is used to render the normal VPN off switch useless, one must uninstall the app or turn off COD on the VPN info page. Outgoing traffic goes through a regular FB IP (I wonder if any IP-based authentication on their systems might be weakened by doing this?).

3) I definitely agree with TechCrunch that this is an Apple ToS issue, however, they are wrong to say that FB "avoided TestFlight." TestFlight is for closed _betas_ only, and this app is not a beta of anything, so it is patently ineligible. Interestingly, if Apple revokes their cert in response (as they due to shell company certs used for sideloading marketplaces), it would result in an immediate shutdown of all Facebook's legit internal apps, because Apple only (afaik) issues one cert to each DUNS number. Notably, the cert says "Facebook, Inc. (In-House)" not just "Facebook Research, Inc." so it looks like the main cert. I've sent a complaint to Apple Privacy about this, will report back if they reply.

3b) Apple's Enterprise Dev Program ToS[1] excludes from allowed internal apps those that are, "used, distributed, or otherwise made available to other companies, contractors (except for contractors who are developing the Internal Use Application for You on a custom basis and therefore need to use or have access to such Application), distributors, vendors, resellers, end-users or members of the general public." It does allow the use of written, binding agreements to enable contractors to use the app, but it seems doubtful that this would extend to those ostensibly participating in social research for a nominal compensation.

4) Most users need to be clearly told that installing a "trusted root" cert is the keys to the kingdom. Providing a normal VPN honestly wouldn't be that bad, as TLS protects everything but the domain name. So they could see "morpheuskafka made 200 requests to reddit.com in an hour," but not the content, much less my login and password. Most people who know what a VPN is are familiar with the idea of their network traffic being rerouted and monitored at the ISP level, but they could easily think they were installing the VPNs server certificate or a client certificate to access it. It's staggering to think that . Also remember that Facebook owns the certs for its own platforms, so they could (ethically) monitor your use of their own services w/out this. Remember "don't even give the IT people your password?" Fill out any login in form and FB has your password (and can use the same IP to sign in without raising suspicion). Job or college app? SSN, tax info, etc. Only e2e is safe. Notable, Caddy's MITM detector cannot detect this "research app."

I hope they do revoke the signing cert, and will enjoy seeing all their internal apps stop working in the chaos. And I hope that Google and other large companies send password change warning to anyone who has logged in from these IPs.

[1] [https://download.developer.apple.com/Documentation/License_A...](https://download.developer.apple.com/Documentation/License_Agreements__Apple_Developer_Enterprise_Program/Apple_Developer_Enterprise_Program_License_Agreement_20181019.pdf) [can sign in with any Apple ID to view]

Sorry for the long post, but this is truly outrageous.

</comment><comment><USER100> I'm sure this was approved by product counsel (most features go through legal reviews at large companies like Facebook) and was justified (even using the Enterprise certificate) by arguing that the teens are actually contractors working for Facebook who're being paid and are have consented (along with their parents, if necessary).

</comment><comment><USER101> Your phone doesn't just contain private data about you, it contains private data about people you know. Selling them out like this is a scumbag thing to do, not to mention it's probably a TOS violation of every service you interact with. FB basically solicited people unwittingly commit crimes on their behalf.

</comment><comment><USER102> when is "too far"? I'm certainly thinking that we are there, but when does most of the world get to that point?

</comment><comment><USER103> I'm curious what devs working at Facebook feel about the shitstorm surrounding Facebook the last couple of years. Do you still work there and is the money the only incentive for doing so? Would you jump the ship if you got the chance? Or are you ok with everything that Facebook does?

</comment><comment><USER104> I don't get it, does FB need more negative press? Regardless of the true intentions, this looks bad.

</comment><comment><USER105> A simple UI change like making the root certificate trusting UI look like you're about to do something extremely dangerous would likely stop a lot more users from giving their data away like this. But instead, Apple shows you a benign-looking "warning."

</comment><comment><USER106> Any other company would have all their certificates revoked and certificates revoked

</comment><comment><USER107> I'm really curious, how the average Facebook engineer feels about this data mining and when is the point when they think they should stop building tools to allow Facebook to do this.

</comment><comment><USER108> It sounds like an Internet equivalent of a Nielsen box?

</comment><comment><USER109> What could be more ironic than your VPN spying on you? The very thing you use to avoid the watchful eye of elder siblings.

<comment><USER110> I think it is safe to assume that any free VPN is spying on you.

<comment><USER111> Except the one you set up yourself... or rather, you can spy on yourself with that one, so your point still stands. ;-)

<comment><USER110> The one you setup your self isn't free...right? But yeah, I tamper with DNS requests on my home network, so fair point lol.

</comment></comment></comment></comment><comment><USER112> Holy shit. This is beyond the pale.

</comment><comment><USER113> The most scary thing is that someone is willing to pay $20 /month for this data.

</comment><comment><USER114> Isn't this....kind of what the entire tech community has been PUSHING Facebook to do? Paying you for your data instead of acquiring it through shady means...?

I'm sorry but...it's not as if they're using this data to do evil things. They're trying to target advertisements. Whooptie doo. So evil.

</comment><comment><USER37> Didn't want to edit my already too long comment, but it's worth noting that on a closer read of the Apple Enterprise Terms, they state that they have the ability to notify users at 5.3: "[Facebook] understand and agree that Apple may notify end-users of Covered Products that are signed with Apple Certificates when Apple believes such action is necessary to protect the privacy, safety or security of end-users, or is otherwise prudent or necessary as determined in Apple's reasonable judgment." __We need to call on them to do so immediately and fully remove the profile, apps, and certs issued by this and any other programs of FB. __

I don 't recall the app having any mechanism to filter EU/EEA nationals, so the GDPR shitshow is about to explode in Facebook's face as well.

</comment><comment><USER115> How is this any different than how TV ratings are gathered?

<comment><USER116> There's only one activity you do when watching TV and that is... watch TV. Even on SmartTV sets, the amount of data the screens can gather is limited in scope and quantity.

There are all sorts of things you do with your smartphone and this VPN tracks all of them.

<comment><USER115> People also agree to lower insurance premiums in exchange for having a GPS tracker installed on their car.

I guess my point is that the concept of being directly paid to give up elements of privacy is a well established concept.

I also think it's extremely patronising to the poor to assume that they don't understand what trade off they are making.

<comment><USER49> >People also agree to lower insurance premiums in exchange for having a GPS tracker installed on their car.

and that should make you uncomfortable too! how on earth can you justify this with an equally insane analogue?

<comment><USER117> Just because it makes you uncomfortable doesn't mean it makes everyone uncomfortable.

I agree with the previous user that it isn't that different than what Nielsen does to collect TV ratings.

Maybe Facebook's execution here wasn't the best, i.e., I agree that a better device would have some limitations as to what kind of data it could access.

</comment></comment></comment></comment></comment><comment><USER118> Facebook certainly has established itself as a rouge data mining company.

</comment><comment><USER119> Any European people affected? How does this play with the GDPR? Are the user's over 16? Anyone tried to file a GDPR data request?

</comment><comment><USER120> The HN title/article is slightly misleading with its use of "root access"; the iOS Enterprise Root certs give increased data access outside of an app (e.g. decrypted SSL traffic, like what this app was doing), but not "root access" in the Unix sense.

You can play with them using mitmproxy to generate a Cert and intercept SSL traffic.

<comment><USER121> It is "root" in the sense of "root certificate"[0] which allows, potentially, the ability to MITM essentially any TLS connection transparently to the user.

[0] [https://en.wikipedia.org/wiki/Root_certificate](https://en.wikipedia.org/wiki/Root_certificate)

<comment><USER122> "root access" has a different meaning than "root certificate"

<comment><USER121> Yes, I'm aware of that, which is why I "translated" for the article.

</comment></comment></comment></comment><comment><USER123> Why has this been hidden from the front page?

</comment><comment><USER124> Are we out of the Facebook crisis yet? Do they not realize this is really not helping their case?

</comment><comment><USER125> > Children, specifically.

I fail to see how this is supposed to make it in any way worse.

<comment><USER126> Children don't have fully developed minds, can't appreciate the consequences of their actions (especially in the long term) and are easy to manipulate with bribes ($20/mo).

This isn't a bunch of adults deciding to sell their privacy. It's children who have no hope of understanding what they're doing.

<comment><USER18> To be fair, you could replace the word _children_ with the word _adult_ in your first paragraph and it would all still hold.

Adults might have fully developed brains from a biology perspective, and I recognise this is what you meant, but I believe there is a strong argument to be made that many adults, myself included, are heavily lacking in the _development of mind_ department. Mark Zuckerberg surely is, either that or he's _actually Satan_.

I definitely have an undeveloped appreciation of the consequences of my actions, and I'm easily manipulated. I'm rapidly approaching 40 laps around the sun!

My greater point here is that I don't find your argument for why it's worse _because children_ particularly compelling. Or, perhaps, _insufficient_. So I'll replace with my own:

Society at large has a long history of, and a cultural and biological evolutionary adaptation, to _protect children_ more strongly than adults, because we are born vulnerable and take a long time to reach sexual reproductive age. We've only made it this far because we're not descended from parents who let their kids stumble in to sabretooth tiger territory. (As an aside, I appreciate that the greatest threat to children's health and development is their immediate family. But here we are).

The worrying thing is, now the sabretooth tiger is a guy who's surname translates from the mother tongue, German, to English as _candy mountain_ , Google translate actually says "pile of sugar", and comes with a family friendly large blue thumbs up symbol. So the threat is _difficult to discern_.

I'd actually be more worried if I didn't have a seizure like laughing fit every time I think about the whole scenario. It's a coping mechanism I guess.

I mean, is this really happening? I wish Bill Hicks was still alive! Aaah, he lives on through those who carry the flame!</comment></comment></comment>


Apple Defends Killing OpenGL, OpenCL as Developers Threaten Revolt - <AUTHOR> https://www.extremetech.com/computing/270902-apple-defends-killing-opengl-opencl-as-developers-threaten-revolt <comment><USER2> Did not see any mention of the revolt in the article. just a description of what has already been said about what the deprecation is. Clickbait title.

</comment><comment><USER3> I'm ok letting the old die, actually, but Vulkan needs to happen else Apple's native platform is going to be left holding a bag of shit & reliant almost fully on WebGPU for anyone that doesn't want to spent millions just on their apple port.

</comment><comment><USER4> I'm curious if we'll see OpenGL/OpenCL implemented on Metal in the same way MoltenVK implements Vulkan on Metal. Imagine a sort of Wine-like comparability layer providing these older APIs.</comment>


E2 Visa: I Am an American in Every Way, Except on Paper - <AUTHOR> https://memphisip.com/2018/01/25/e2-visa-i-am-an-american-in-every-way-except-on-paper/ <comment><USER2> Similar story for many other H4 visa children who came here as dependents of H1B parents. They are here as children, lived here, studied here - after they turn 21 they are being phased out of the immigration system.

Why does coming here illegally is a _required_ qualification for dreamer bill, while children who followed all the rules, stayed decades in immigration queues are excluded?</comment>


Silicon Valley startup gala spurs feeding frenzy (YC Demo Day) - <AUTHOR> http://www.reuters.com/article/2012/03/28/net-us-startup-incubator-idUSBRE82R12920120328

<comment><USER2> "Y Combinator's 'Demo Days' have grown into fixtures on the Silicon Valley calendar, a geek version of the Kentucky Derby, where tech investors come to see and be seen -- and to place bets on the perceived studs of the startup scene."

All that's missing are the funny hats and mint juleps.</comment>


Google Commits to Racial Equity - <AUTHOR> https://www.blog.google/inside-google/company-announcements/commitments-racial-equity/ <comment><USER2> 'Racial Equity' is a nice way of saying that they'll perpetuate racial discrimination.

The way forward is for race to take the back seat and then disappear from the radar, not to ensure it remains the focus of attention and cause for discrimination.</comment>


Show HN: OpenGL in super slow motion – visualising Z-buffering - <AUTHOR> http://orbides.org/apps/superslow.html <comment><USER2> If you're interested in what modern game engines do to display a frame, I highly recommend following studies:

GTA V: [http://www.adriancourreges.com/blog/2015/11/02/gta-v- graphic...](http://www.adriancourreges.com/blog/2015/11/02/gta-v-graphics- study/)

Supreme Commander: [http://www.adriancourreges.com/blog/2015/06/23/supreme- comma...](http://www.adriancourreges.com/blog/2015/06/23/supreme-commander- graphics-study/)

Deus Ex: [http://www.adriancourreges.com/blog/2015/03/10/deus-ex- human...](http://www.adriancourreges.com/blog/2015/03/10/deus-ex-human- revolution-graphics-study/)

HN Discussion about GTA V: [https://news.ycombinator.com/item?id=10492876](https://news.ycombinator.com/item?id=10492876)

</comment><comment><USER3> The link is a demonstration of Z-buffering. I don't know that I'd call that "the core algorithm of 3D", but it is pretty important for most real-time rendering.

The description doesn't give a lot of detail about the algorithm or its issues. The main problems to be aware of with Z-buffering are Z-fighting and the lack of support for transparency, neither of which are demonstrated. Here are a couple of links that go into a bit more detail:

[https://en.wikipedia.org/wiki/Z-fighting](https://en.wikipedia.org/wiki/Z-fighting)

[https://www.sjbaker.org/steve/omniv/alpha_sorting.html](https://www.sjbaker.org/steve/omniv/alpha_sorting.html)

<comment><USER4> If you slow it to the minimum, you can see how it fills the triangles pixel per pixel. That, along with depth testing and the iteration over triangles, could possibly be called the "core algorithm"?

<comment><USER5> My vote would go to perspective projection

<comment><USER6> Agreed, but I'd have to first put in a vote for not claiming one part is the mostest.

I like this post, among other things, it's a nice demonstration of the crazy amount of work your graphics card is doing to display a frame of your game. And it took some work and was put together with love.

But _if_ you're going to call one single thing "the core algorithm of 3d", then yeah I'd have to second this one, perspective projection might be it - perspective is what makes 3d look 3d, you can do it without solid surfaces, and the math for perspective was developed long before computers with z-buffers existed.

I will totally grant that depth testing is the core algorithm of z-buffering, and iterating over triangles is the core algorithm of rendering triangle meshes. ;)

<comment><USER7> > the math for perspective was developed long before computers with z-buffers > existed

I would say long before computers existed. Perspective projection was the key algorithm of renaissance art!

<comment><USER6> You're absolutely right, I'd hoped that was my implication. ;)

Funny story though, speaking of renaissance art- I was doing research for my Master's thesis on computer graphics, and got direct access to several books from the 1700s that outlined the geometry of perspective projection as well as the geometry of shadows. (My thesis was about rendering shadows.) They were hand-written tomes, with very ornate covers and bindings and hand-drawn diagrams. The books weren't allowed to leave, but they had a special reading room for them, with archive-safe lead weights to hold the pages down so I wouldn't spread my damaging finger oils everywhere. I was taking some digital photos, and at one point I forgot about the lead weights and turned the page. It tore a little bit, and I was completely mortified!

Sorry, history!

<comment><USER8> Are you by any chance comfortable with sharing your thesis here (if you still have it around)? It sounds interesting. I would have asked via email if I had known where to send it!

<comment><USER6> Sure! I'm not sure the complete thesis with the renaissance geometry images is online anywhere, but it's mostly an expanded version of this paper: [http://www.graphics.cornell.edu/pubs/1999/HDG99.html](http://www.graphics.cornell.edu/pubs/1999/HDG99.html)

This is old now, and modern techniques have mostly surpassed it, but the basic idea was to combine single-sample ray casting for finding occluders probabilistically with an image-plane flood-fill using analytic methods to render the shadows. It's a way to only pay for accurate shadow calculations where shadows actually exist, and skip the shadow calculations in all the un- occluded areas.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Back when I was doing OpenGL in the 80s, "super slow motion" was included in every library as a free feature :-)

<comment><USER10> Are you sure it wasn't just "GL" ([https://en.m.wikipedia.org/wiki/IRIS_GL](https://en.m.wikipedia.org/wiki/IRIS_GL))? OpenGL started in 1992

<comment><USER9> Yeah, probably right- Thanks for the correction.

</comment></comment></comment><comment><USER11> This is amazing, thanks for sharing! Haven't really programmed much in 3D so this is a great resource to understand the concept behind a render engine.

</comment><comment><USER12> Very good work. I enjoyed it and while viewing I just reminded myself the following: By watching it at full speed, I am causing the CPU on my machine to do so much computational work in so short a time just so that I can enjoy the animation.

I wonder, how much computational power (measured in CPU/GPU cycles) is used all over the world for animations/games.

Computers have greatly changed our lives and our perspectives too.

<comment><USER13> Don't worry, they don't mind.

<comment><USER14> Yeah I hear they even use the GPU to render window managers too, nowadays. Imagine that! :)

</comment></comment></comment><comment><USER15> If you're watching this on a phone, keep in mind that this is NOT how a mobile GPU would render this. Instead it would render the whole thing in screen tiles, completing a tile before going on to the next.

<comment><USER16> Is that a typical implementation feature because of how VRAM is shared or something, or is this exposed somehow to the OpenGL ES developer?

<comment><USER17> Tiled renderers or "chunkers" are common on mobile because the memory bandwidth is much less (1/10th to 1/5th) than desktop GPUs. The color/depth buffers are stored in on-chip memory which is much faster.

This isn't exposed to the programmer directly (Vulkan's multi pass API is related) but it has performance characteristics that we engine programmers need to be aware of.

</comment></comment></comment><comment><USER18> This is excellent! How much more can we learn by slowing down time and watching a process unfold? I think many in this thread are overly focusing on what is being presented, rather than the technique used to present it. The technique is what is being demonstrated.

The nice thing, is that this timescope comes with its own visualizer. Other processes have no such luck, it would be interesting to use machine learning to create abstract structured visualizations from the evolution of a process so that one needn't hand code them.

<comment><AUTHOR> Another thing i contemplated was doing the GUI (That is, the OS window manager) in the same fashion.

The rectangle algorithm of redraw-updating windows and widgets is quite a curious beast.

However, it didn't feel right and reminded too much of broken graphics card drivers...

</comment></comment><comment><USER19> "GPU, a video card, is a special purpose processor that does millions of such calculations at once."

It's not exactly millions at once...

</comment><comment><USER20> This would be better if you could turn off the Z-buffer, to see the rendering error that occurs without it.

</comment><comment><USER21> fun, but what am I learning from this that I don't already know, namely that 3d scenes in OpenGL/Vulkan/D3d are made up of triangles? Haven't I seen this already 1000 times when I select a "wireframe" option on every 3d scene that's ever been around for the past 30 years? Every casual gamer who's ever run unigine heaven knows this.

Am I being instructed here about the matrix math that creates the perspective illusion on a 2d plane? Not really. All I'm seeing is a bunch of triangles creating a scene. This is not going to instruct a beginner about the principles of the z-buffer in any way that I can see. That requires linear algebra. Unfortunately. No shortcut.

<comment><USER22> On the right side, you see new pixels being painted only if they are lighter than the pixels they are painted over. It shows that this is happening for every triangle, regardless of what order the triangles are iterated over.

This is a visualization. If you already know how it works, so what? Now you have a visualization of it that isn't confined to your brain.</comment></comment>


Ask HN: Can I trust Google products as a freelancer? - <AUTHOR> As a freelancer I'm not sure I trust Google products anymore. That is trust that what I invest my efforts in today will still be supported in five years time by Google. Therefore, I have checked out all my Google docs and setup my own Nextcloud. I will also be more reluctant to get too heavily invested in their APIs.<p>Do others feel the same? <comment><USER2> What you describe is the "vendor lock-in". If you only store some files on gDrive you do not have a lock-in. But If you built a product on top of their api then you have to invest something if you want to move to a different vendor. That's why I usually try to stay on simple vServer with some open source software or at least some bought software.

</comment><comment><USER3> What makes you think Google Docs, or any of the other most popular Google Cloud APIs, would not be supported in the next five years?</comment>


Don't prototype. Pretotype - <AUTHOR> http://www.pretotyping.org/

<comment><AUTHOR> Ask HN community: Is pretotyping just another word for "paper prototyping" or "lean startup"? I found this site and want to know what people have to say about it.</comment>


Google listen.js - <AUTHOR> https://gist.github.com/1030082

<comment><USER2> I don't see the point in 14k lines of obscure javascript code with no comment and no description whatsoever. Can you explain?

<comment><AUTHOR> it's just looks awesome :)</comment></comment>


Docker 1.5: IPv6 support, read-only containers, stats, and more - <AUTHOR> http://blog.docker.com/2015/02/docker-1-5-ipv6-support-read-only-containers-stats-named-dockerfiles-and-more/ <comment><USER2> > _Open Image Spec ... As we continue to grow the contributor community to the > Docker project, we wanted to encourage more work in the area around how > Docker constructs images and their layers. As a start, we have documented > how Docker currently builds and formats images and their configuration. Our > hope is that these details allow contributors to better understand this > critical facet of Docker as well as help contribute to future efforts to > improve the image format. The v1 image specification can be found > here:[https://github.com/docker/docker/blob/master/image/spec/v1.m...](https://github.com/docker/docker/blob/master/image/spec/v1.md) > _

This is a great start, and I hope this doesn't sound negative, but this likely wouldn't be here if CoreOS hadn't shaken things up the way they did with ACI/Rocket.

<comment><USER3> Great post by Fred Wilson on Perez's technological surge cycle [http://avc.com/2015/02/the-carlota-perez- framework/](http://avc.com/2015/02/the-carlota-perez-framework/)

She predicts every major technology has a breaking point and turning point.

I can't see why the same isn't true for docker. Rapid adoption leads to growing pains, which leads to introspection, which leads to fixing of issues to create better product.

If you've been around the block, it's hard to see Rocket as competition. There is a lot of sunk cost already in Docker (Amazon, Google, Joyent, lots of startups), if it's not obvious to CoreOS already.. Docker will be the predominant way we package our applications for the next 5-10 years

<comment><USER4> > Docker will be the predominant way we package our applications for the next > 5-10 years

That same effect will also drive a revolution in cloud infrastructure. I call the effect the problem cloud because it's a pain in the ass sometimes, just like a teenager.

</comment></comment></comment><comment><USER5> Docker Issue #1988 is still an issue.

While it is still an issue, and still neglected (or more likely arbitrarily ignored for profit) Docker will be a red flag for any real corporate uses.

<comment><USER6> I agree it's still an issue. Enterprise sysadmins should be allowed to block access to external registries, including Docker Hub. There is nothing contentious about it, and it has nothing to do with profit. If you send a properly implemented patch for it, the maintainers will merge it.

<comment><USER7> That's great news. What do you consider a "properly implemented patch"? I would think the most bulletproof & simplest patch would simply allow the default index (index.docker.io) to be reconfigured to something else in docker.conf. Would you support a patch that did that?

Edit: And perhaps [https://registry-1.docker.io/v2/](https://registry-1.docker.io/v2/) as well?

<comment><USER6> I think the best way is to allow a "whitelist mode" where only an explicitly specified list of URLs are allowed to be reached. Everything else would be blocked by default. This should give ops the peace of mind they need.

Note that this is an ACL change, and not a namespace change. That is important because we want image names to have the same meaning everywhere, regardless of site-specific configuration. So for example, "docker pull ubuntu" should always mean "install ubuntu from the official docker library". This is crucial to the developer experience and to respect the principle of separation of concern between dev and ops. However, if ops chooses to block access to the standard library then "docker pull ubuntu" will fail with "access blocked by your administrator", which is totally acceptable. What we don't want is the operation silently substituting a site-specific image, without the knowledge of the end user, thereby breaking their build in a thousand invisible ways.

I hope this helps. Does this mean I should look forward to a patch from you? :)

<comment><USER8> > However, if ops chooses to block access to the standard library then "docker > pull ubuntu" will fail with "access blocked by your administrator", which is > totally acceptable.

Actually, it isn't, at least in production, because it forces us to rebuild a lot of images that references the standard library, when a more reasonable approach would be to mirror them.

The index/registry/image identity problem is by far the weakest part of Docker, and what appears most attractive with Rocket, in my opinion. There are pretty much zero cases where I, in my ops role, can allow production deployments to have access to the official Docker repository, because it opens the door to pulling in all kinds of stuff that has not been vetted (e.g. referencing the "latest" images, and having that change between dev signing something off and deployment), and it creates all kinds of obnoxious failure scenarios.

At the same time, I don't want devs to have the hassle of having to repackage all the images to point them to our internal registries, when we could easily mirror the images that have been tested.

So if there's no easy way to point the default somewhere else, what we'll resort to instead is increasingly adding firewall rules to block the official registry, coupled with DNS tweaks to make *.docker.io point where we want it, or patching the code.

Or switch to Rocket once it gets more mature, if Docker continues to make custom image management more troublesome than necessary.

<comment><USER6> I totally agree that mirroring of official images should be easier, and right now it's an obstacle to easier production deployment. This is why it's important to have cryptographically signed, self-describing images. Then it becomes irrelevant _where_ you download them from, and anyone could host a public or private mirror. I am 100% in favor of it and we are upgrading the registry system to allow it. Happy to chat more on #docker-dev.

</comment></comment></comment></comment></comment></comment><comment><USER9> >Specify the Dockerfile to use in build

oh man it's finally here. I'm excited.

<comment><USER10> Finally! I can finally use one Dockerfile for Fig development, but another for staging and pushing it to Octohost, and then a final one for kicking up to AWS/CoreOS for deployment!

They all use the same code, they just have subtly different configurations and trade-offs. This is going to make that so much easier!

</comment></comment><comment><USER11> Oh yeah, being able to specify dockerfiles is golden. We actually use Makefiles to copy docker files from different directories for building, then copying them back. What a hassle it has been.

<comment><USER12> Couldn't you use symlinks that you create/unlink at build time?

<comment><USER13> Docker explicitly forbids usage of symlinks.

But there was a workaround: tar the entire directory and then build your container from the archive, like `tar cfh * | docker build -`.

Hopefully that wouldn't be needed now.

</comment></comment></comment><comment><USER14> I've been doing research into Docker, because the ideas of making a dashboard to easily manage entire apps quickly and easily is very compelling for building and managing rapid prototypes. With the addition of a stats API and parametric Docker builds, this appears to be a realistic use case.

I still haven't found a good answer to whether you can embed Docker images within a parent administrative Docker image, though, in order to achieve ultimate portability. Who Contains the Containers?

<comment><USER15> Not entirely sure what you're asking, but you should probably look into "schedulers" and other tools built on top of such ecosystems. Here are a few to get you started:

Docker ecosystem: swarm and/or compose

Mesos ecosystem: Chronos, Aurora, Marathon

CoreOS ecosystem: fleet

Hashicorp: Terraform

Amazon Container Service: works with the above, will likely build their own simple one in the near future

This is less about embedding images and about managing/"scheduling" them

Edit: Zikes mentioned Kubernetes, as well.

<comment><USER16> There's also Lattice: [https://github.com/pivotal-cf- experimental/lattice](https://github.com/pivotal-cf-experimental/lattice)

Which is extracted the next generation runtime of Cloud Foundry, known as Diego.

</comment></comment></comment><comment><USER17> Named Dockerfiles support is a nice addition. I usually split up my projects with one (or more) container running the app, and a separate container running Grunt to compile all the front-end libraries. It was a minor annoyance to separate these into different directories simply because a Dockerfile could only be named... Dockerfile.

</comment><comment><USER3> Read only flags? Streaming stats? Docker's API gets more and more powerful everyday! Very excited about this release

</comment><comment><USER18> You can rename containers now! `docker rename OLD_NAME NEW_NAME`

Uou can have a container named `service_prod`, deploy a new version as `service_staging`, then shuffle them with renames if the staging version is effective.

</comment><comment><USER19> IPv6 is really a 1.0 feature.

I know how to build and i know it does go test; but it makes me a little :( that there's no public CI listed in github.com/docker/docker.

<comment><USER20> They link to their jenkins with the little "build passing" badge near the bottom:

[https://github.com/docker/docker#contributing-to- docker](https://github.com/docker/docker#contributing-to-docker)

[https://jenkins.dockerproject.com/job/Docker%20Master/](https://jenkins.dockerproject.com/job/Docker%20Master/)

They used to use drone.io, but they recently removed it:

[https://github.com/docker/docker/pull/10519](https://github.com/docker/docker/pull/10519)

I like the creative branch naming.. "jfrazelle:burn-in-a-fire-drone" :)

</comment></comment><comment><USER21> Does anyone know the status of User namespace support? I would think this is a blocker for any paas to use docker.

<comment><USER6> User namespaces recently got merged into libcontainer (which is used as the default backend for sandboxing in Docker). There is 1 technical question left to resolve to enable it by default: how to abstract away the concept of UID mapping, and how does it impact sharing of volumes between containers? There is an ongoing technical discussion, I am optimistic that we will find a solid solution soon but don't want to make any promises we can't keep.

<comment><USER22> In addition to user namespaces, and the obvious sVirt / SELinux bits Dan W from Redhat has been contributing, what features / enhancements are necessary for docker to be considered mostly secure?

For reference I run all of my apps as different containers with different users on my own server. I then have iptables rules to block any outbound internet connections for containers that shouldn't. It was hilarious to see when someone hacked my wordpress install running in a container and managed to write out a perl daemon using a rexec bug in wp. But when it tried to contact its C&C server, iptables dropped it and ossec notified me. In a perfect world, I'd do something similar, but root inside the container would map to != uid 0 on the host. I'm just curious if there is anything else you consider necessary to deem docker more "secure" than it currently is.

</comment></comment></comment><comment><USER23> Wish they'd enable IPv6 by default

<comment><USER24> Yes, I dont see why they shouldnt get link local addresses. It is also slightly odd that if there are existing router advertisements they dont get used, rather you have to do manual config.

<comment><USER25> It does have linked local addresses by default. It's the more complicated setup of actually routing IPv6 addresses outside our current host that's not enabled by default.

[https://docs.docker.com/articles/networking/#ipv6](https://docs.docker.com/articles/networking/#ipv6) has more of the details (and the discussion at [https://github.com/docker/docker/pull/8947#discussion_r22534...](https://github.com/docker/docker/pull/8947#discussion_r22534269) is also useful)

Basically, we can't use existing router advertisements (as I understand it) because you also have to tell your current IPv6 router that the entire prefix you use for Docker needs to go to this one host as opposed to just the one IPv6 address that host would auto-assign itself via RA.

Since there's manual outside-Docker setup involved, we can't really automate this bit. If there's a nice clean way to do so, we're definitely open to a PR (I'd love to have something simpler myself)! :)

<comment><USER24> That is not very clear from the docs then which say "By default, the Docker server configures the container network for IPv4 only. You can enable IPv4/IPv6 dualstack support by running the Docker daemon with the --ipv6 flag" \- that doesnt sound like link local addresses by default...

Will have to take a look, I guess there are lots of potential setups. If you have a /64 per host it should be ok anyway, if you have a /64 for the network it might not be.

<comment><USER26> Link local addresses are not meant for application level use in IPv6 so bringing them up would only be confusing.

LL addresses are used for stuff like router advertisement, neighbour discovery (IPv6 equivalent of ARP) etc. You can't use link-local addresses without extra gyrations in socket API (scope id) so they cannot be usefully passed to normal apps.

</comment></comment></comment></comment></comment><comment><USER27> In other news, the issues list [0] just keeps growing by the day, apparently with few or no devs committed to ensuring show-stopping kernel interoperability bugs [1] get resolved in a timely manner.

I want to love you docker, but the experience of using your products is often sooo painful!

[0] [https://github.com/docker/docker/issues](https://github.com/docker/docker/issues)

[1] [https://github.com/docker/docker/issues/4036](https://github.com/docker/docker/issues/4036)

Karma-wise I'm sure there will be hell to pay for my impolite outburst.. Sorry for the offense! Just calling it like I see it.

<comment><USER6> You are right that devicemapper (basically lvm snapshots for storage, used as an alternative to aufs/btrfs on many distros including Red Hat) has been a source of headaches for us. It is relatively obscure (we knew we were in trouble when googling libdevmapper error messages returned our own source code as the first result) and frankly not pleasant to work with.

But, the good news is that we have made progress recently. In fact the 1.5 release includes several improvements to devicemapper. And as of last week, Red Hat has volunteered a dedicated engineer to escalate devicemapper problems. So, fingers crossed things will be even better in the next release :)

Another alternative is to switch storage drivers: aufs and btrfs are popular options.

<comment><USER27> Thanks for following up Solomon! I'm glad you are at least aware of what is going on with this.

</comment></comment></comment><comment><USER28> I was a little disappointed to see 1.5 released without a fix for the "tty bug" in `docker exec`, and without mention of the same known bug/limitation in the documentation:

[https://github.com/docker/docker/issues/8755](https://github.com/docker/docker/issues/8755)

Hopefully it will get fixed soon. Other than that, I'm excited to kick the tires of v1.5 -- thanks Docker team!

</comment><comment><USER29> > Open Image Spec

I'm wondering if this will eventually merge with the ACI that Rocket implements.

<comment><USER30> That seems unlikely, based off the bad blood developing between CoreOS and Docker. See the links below:

[https://github.com/docker/docker/issues/9538](https://github.com/docker/docker/issues/9538)

[https://github.com/docker/docker/issues/10643](https://github.com/docker/docker/issues/10643)

<comment><USER31> Wow, those are some pretty hostile words coming from Shykes.

> Coming up with a new "standard", then criticizing the established open- > source project for failing to implement it, is a common tactic

> One last fact, which you might find funny: one of these alternative > implementations of Docker's image distribution system is developed by > CoreOS, the very same vendor which is propping up this so-called standard

> Do you know how many complaints I received, since Docker was created, that I > didn't "comply" with this or that self-proclaimed standard? Dozens

> But [CoreOS] never did, because as competing commercial vendors their > interest is to weaken and fragment the Docker standard, not contribute to > it.

~~

> based off the bad blood developing between CoreOS and Docker

You know, I think this is really 1-way... I have not see anything along these levels of hostility coming from the CoreOS camp.

<comment><USER32> Looks like spam accounts / repeated behaviour which reported these bugs. Even though Shykes isnt the best pr guy in the world.

<comment><USER31> I'd hardly call 2 issue tickets "spam accounts"... and the first one definitely isn't -- there's years of activity.

<comment><USER32> I really do not use docker nor coreos, but I wonder what the huge demand is for standardizing this. At least it looks a little suspicious for me while browsing through those 3 tickets.

<comment><USER31> > but I wonder what the huge demand is for standardizing this.

Containerization on Linux is really poised to be the "next big thing", enabling all sort of new workflows, deployments, etc. In order for it to really take off, people need a universal standard image format which is portable to other implementations. There _must_ be multiple competing implementations. It _must_ avoid vendor "lock-in".

Back when virtualization was getting off the ground, there was no standardized format. Every vendor had their own format, and all were completely incompatible with one another. This made migrations incredibly painful, sometimes impossible.

It created a "vendor lock-in" _even when it came to the open source hypervisors_ \-- ie. once you decided on a product, you were stuck.

The OVF (Open Virtualization Format) came along after years of this... not without it's imperfections -- but it was a real life saver in a great many ways. Vendors and open-source projects alike started to support the format, allowing users to export their VM's and import them into a different hypervisor with relative ease -- no weird hacky work-arounds, no re-imaging your vm, no nonsense.

<comment>~

For this kind of industry-changing technology, it's more important to have an open standard than an open implementation.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER33> It's really annoying how long it's taking to add fuse support to containers. If I want to act on remote filesystems I have to use something like rsync.

<comment><USER34> It seems pretty close to working. One of the few (or only) issues remaining is this one: [https://github.com/docker/docker/issues/10184](https://github.com/docker/docker/issues/10184)

Basically, docker had to add device support, which it now has, but fuse is explicitly forbidden in libcontainer ([https://github.com/docker/libcontainer/blob/164cd807a16e63ed...](https://github.com/docker/libcontainer/blob/164cd807a16e63ed539cddda55ce3bbc32e1791e/devices/defaults.go#L146))

A patch to libcontainer or possibly Docker itself should resolve this (volunteers always welcome!)</comment></comment>