A cheating scandal in the world of professional bridge - <AUTHOR> http://www.newyorker.com/magazine/2016/03/07/the-cheating-problem-in-professional-bridge <comment><USER2> I enjoy bridge, but high level competitive bridge sounds like a nightmare.

"Expert poker players often take advantage of a skill they call table feel: an ability to read the facial expressions and other unconscious "tells" exhibited by their opponents. Bridge players rely on table feel, too, but in bridge not all tells can be exploited legally by all players. If one of my opponents hesitates during the bidding or the play, I'm allowed to draw conclusions from the hesitation—but if my partner hesitates I'm not. What's more, if I seem to have taken advantage of information that I wasn't authorized to know, my opponents can summon the tournament director and seek an adjusted result for the hand we just played. Principled players do their best to ignore their partner and play at a consistent tempo, in order to avoid exchanging unauthorized information—and, if they do end up noticing something they shouldn't have noticed, they go out of their way not to exploit it."

How can you possibly play like this, and expect others to play like this, in a genuinely competitive setting?

<comment><USER3> You can't. It's a game that is fundamentally flawed at the base level, just like blackjack.

The fact that both these games outlaw certain _thought processes_ , be that counting cards in your head or acting on your partner's hesitation, shows that they've been shoehorned into something they're not.

<comment><USER4> counting cards is legal in Atlantic City, but if they suspect you of it they'll shuffle every hand or not let you change the size of your bet.

<comment><USER5> I may be picking a nit, but counting cards is legal in all casinos in the US. You are not breaking a law by counting cards, but the the casino has the right to stop providing you its service if you are, or if they even think you are (right up there with "No shirt, no shoes, no service").

Perhaps you mean that casinos in Atlantic City actually will not kick you out if they suspect you're counting cards, or they're bound by some law to allow you to keep playing?

If counting cards were actually illegal, we'd be a lot further along on our way to Orwell's 1984. You can't outlaw thought (yet).

<comment><USER4> Yes, you are correct. What I meant is that the casinos are forbidden from asking you to stop playing or to leave the casino based on counting cards. It's really in the casino's best interest though, because there are more people who _think_ they can count cards than there are people who can do it effectively.

</comment></comment></comment></comment></comment><comment><USER6> This reminds me of a family card game we played when I was younger called Rook. It was very similar to bridge in that you played with a partner, bid for a contract/trump, and table talk was not allowed. We did allow non-verbal forms of communication and that became a large part of a winning strategy. We mixed up partners and the escalation became so great that we had a different form of communication for each of the different partners. Then a scheme would be figured out and we would have to rotate our codes to something else. It was like a family game of thermonuclear war by the time us kids moved out. Just like I think they should have a legal doping class in cycling where it is okay to take performance enhancing drugs, we should just make an open class of bridge where non-verbal communication is allowed and the schemes are not shared with the opposing pair. I'll bet we would observe some interesting behavior emerge between partners.

And I have to hand it to the New Yorker for this one. Longform journalism is hit or miss for me, but I really enjoyed reading about this game that I've never played before. I guess the author did a good enough job explaining the game that I figured out that it was similar to Spades, Hearts, Euchre, and Rook in some ways that I stuck with it until the end.

<comment><USER7> > I'll bet we would observe some interesting behavior emerge between partners.

Just have a different scheme for each hand, and describe your whole hand with hand signs. (Since you don't have more information than your whole hand, this is as bad as it'll get.)

</comment></comment><comment><USER8> I have never played bridge so my opinion is of a complete outsider's. You can also see me as the devil's advocate.

What if we just accepted "cheating" to be part of the game? Such that every team is allowed to devise their own way to communicate in subtle manners (barring the use of electronic devices). And so part of the game would be to figure out the opposing team's code. There is really no way to prevent communication when you have physical presence. If you really want to prevent communications, sit them in separate rooms and make them play through computer terminals.

Catcher signals are used in baseball, we don't call that cheating.

And to bring up another analogy. Remember how in the anime Naruto, the kids have to take a paper exam to advance? The questions in that paper were hopelessly difficult for the candidates, and it turned out that the real exam was for them to attempt cheating without being obvious.

And please don't get me wrong. I'm not saying that what Fisher and Schwartz did was ok. They were clearly violating the _existing_ rules. What I'm saying that trying to enforce a rule forbidding communications when you have physical presence is an exercise in futility. It's just that maybe we should consider changing the rules or how the game is played.

<comment><USER9> If you take that to a logical extreme (and humans _do_ take things to logical extremes... ) it becomes a game more about electronics intelligence (jamming, jam evasion, cryptography, steganography... ) which, don't get me wrong, would be amazingly amusing to watch if you even _could_ watch it, but would devalue the relative contributions of the card players and would put more emphasis on having money for equipment and the salaries of specialists.

You could fix that by making sure every team has the same budget and watching the financials closely to ensure nobody goes even one cent over, which should once again move the competition into the realm of being mind against mind instead of checkbook against checkbook. For added fun, make all purchases and hiring decisions (and make sure all team members are hired and salaried out of the total budget) public information, so each team can fret about what every other team just spent money on and why and how all those things can be used and which are decoys and which decoys are actually useful and we should buy that decoy and...

<comment><USER10> Something race leagues know all about.

</comment></comment></comment><comment><USER11> "No one would try to memorize all the percentages"

As someone who studied and memorized 20,000+ words to improve my tournament Scrabble play, this made me laugh. If knowing the numbers is truly advantageous, there's likely to be a subset of competitors willing to work to get that edge.

Maybe bridge is different, but the games I've been serious about (Scrabble and poker) both rewarded a significant amount of focused study and memorization.

<comment><USER12> My mom was competitive at the regional level, not national nor world, and she carried around a ~10 page typewritten document with all the bidding and lead conventions she had with her current partner, and study it while I was at various after-school activities.

Because in duplicate bridge you are scored not on your absolute result, but on your result relative to people who played the same hands as you, the tinyest edge is magnified.

The basic card-splitting rules are known even to the most rank beginners in duplicate, and there are definitely players who know the percentages as well as any poker player. In a way it's actually easier, as you know where half the cards are as soon as the first lead is made.

</comment></comment><comment><USER13> I'm a huge bridge fan - it's a very logical game, and the rules are simple but the implications many. It also has two parts: the bidding, in which you signal to your partner what you have as well as determine both trump and which partnership will play (The game incentives bidding as high as you can, but not bidding higher than you can achieve; and the play, which is an exercise in odds and using the information gleaned during the bidding - it is often practical to pull off bids that sound highly dubious.

Duplicate bridge, as described in this article, is one of the most satisfying ways to play - you aren't relying on the luck of the draw, you are scored how you do on this deal vs others that play WITH THE EXACT SAME DEAL. (generally you preserve your hand as you play, and pass your hands to the next group to play). So even on a terrible hand, if you can do better than others, you score points.

The problem in dealing with cheating is that any efforts to block communication or signaling first require you to have no social chatter. Boring - play Go or Chess then. (and second, they require you to signal to the other partnership if you're using non-standard signals, which gets messy but isn't boring)

For people interested in learning bridge, just recognize that the need for exactly 4 to play is one problem, and without the duplicate part (which then requires at least 8 players) luck plays a bigger part. Despite greatly enjoying the game it's been years since I played. The local bridge club at the time was hard to enter because I was a young 30-something and everyone else was a retiree.

<comment><USER14> I was dragged to a bridge class by my girlfriend several years ago, and it was fascinating. The thing that struck me most was that you could lose the game during the play, but you could only win the game during the bidding.

Unfortunately, because I'm an antisocial rat bastard, I never kept up with playing or tried to join the club.

<comment><USER13> One of the unfortunate side effects of learning bridge is the tendency to sneer at games like Spades as being "bridge-lite"

<comment><USER7> Try Mü. It's a German style trick taking game, somewhat comparable to Bridge, but can be enjoyed at a more casual level, too.

<comment><USER15> I am a huge fan of Tichu, which is also a more casual Bridge-like game.

<comment><USER7> Tichu is fun, too. I managed to convert some Singaporeans from Big-Two to Tichu.

</comment></comment></comment></comment></comment></comment><comment><USER5> I really have never understood the cheater's mentality, at least when it comes to these silly, artificial games we play.

Yes, at the highest level of professional sports, etc. I see a clear financial motive to cheat (cue reference to the amorality of corporations), but some subset of people cheat all the way down that hierarchy in sports/cards/etc.

/slightly OT, but thematically in line, I think:

I'm a rather avid amateur billiards player (there's no money in pool in the US anymore, not that I can even compete with the pros - I'm better at making money with a keyboard) and I routinely see a (admittedly small, probably around 1%, but unchanging as players come and go) percentage of amateur players that clearly, actively want to cheat as long as they can get away with it.

The actual expected value for their cheating is terrible. I play in a couple of leagues where, if, by chance, you get first place, you'll get ~$1000, having paid ~$256 in table time (and 16 weeks of play) to get to that last match.

It's just a game! Isn't the whole point, and fun, and glory of winning a game actually winning by the restrictions placed on you by the rules? I can beat Tiger Woods by hitting him in the temple with an icepick, but why? The rules are what make the game challenging.

I guess I just don't get it, if I foul in a pool game I'll call myself on it, because if I didn't I wouldn't walk away from it thinking I won. I'd think I cheated and I would feel terrible about it.

Reiterating my opening sentence, I just do not understand people who cheat on games.

<comment><USER16> > _I just do not understand people who cheat on games._

I think they have a fundamentally different personality type: sportsman vs. gamesman. _Sportsmanship_ values honor and conduct; _gamesmanship_ values winning.

It seems that the highest levels of competition reward gamesmanship over sportsmanship, perhaps unsurprisingly. There is a culture of gamesmanship, and gamesmen have better outcomes. Competitions where this seems to be the case include:

        * auto racing
        * football (world)
        * football (american)
        * cycling
        * fighting (MMA, boxing)

And I'm sure plenty of others. These mottos are prevalent:

        * If you're not cheating, you're not trying
        * It's not cheating if you don't get caught

<comment><USER5> That's a fair point. In the game of pool gamesmanship has a long history, though in that context it's called hustling.

Of course, the game of pool has always had a history of gambling; the fact that we even call it pool is a reference to the betting pool. Still, even when I play a set for money I won't cheat because it makes me feel dirty. I guess I just can't reconcile the fact that when I win without cheating, I feel great as though I accomplished something (although obviously it's just a game). When I win by luck I don't get the same satisfaction as when I win by perfectly executing whatever plan I was trying to accomplish.

I guess I'll just never understand the hustler's mindset; I'll never be a conman.

As an aside, I think it's amusing that the term "hustle" means "do whatever it takes to get by", or just "give it all you've got" when it's meant, roughly, "undersell your actual skill level to fleece someone out of their money" for many decades in the pool world.

<comment><USER16> Regarding hustle, I see:

> late 17th century (originally in the sense 'shake, toss'): from Middle Dutch > hutselen

So I think it splits into the dice and gambling sense, where deception becomes a valuable skill. And also the "hustle and bustle" sense, as in a football coach yelling at his player to hustle.

</comment></comment></comment></comment><comment><USER17> So here's an idea for a game. Let's call it "inductive bridge".

1) Rules of play are as for standard contract bridge.

2) You may use whatever conventions you like. There is no obligation to tell anybody what they are.

3) Have fun figuring out the opposing partnership's conventions!

Yes, it'd be a whole different ball game. But would it be _worse_?

Discuss.

(Full disclosure: I played bridge competitively at university.)

(Update: seems k_sze was ahead of me.)

<comment><USER18> I think it would be a worse game. :)

I used to play an ok amount of bridge.

I enjoyed trying unusual systems, but playing against them were less fun. Sure you can play some advanced relay system, but even with open information about the system needing to figure out exactly how your relay system is built takes away the focus from the core of the game that is enjoyable: Finding the right bid, and then meeting it in play.

</comment></comment><comment><USER19> An interesting subject is what can be done to stop cheating? It seems that separators are insufficient.

Each player must be in a completely enclosed room, preferably a Faraday cage, lead box? Furthermore, all moves must be submitted digitally, with a time limit, and the actual move will only be displayed at the end of that limit.

Even then, we'll probably hear about a bug in the software used.

<comment><USER20> However, that will render an incredibly boring game

<comment><USER21> While I also prefer face-to-face playing, online playing (which is still fun) is actually not very different from the secure solution described by Cpoll

</comment></comment></comment><comment><USER22> Great example of explanatory writing that makes an article interesting even for a reader who's never played bridge.

</comment><comment><USER23> This is why bridge always seemed stupid to me: You're not allowed to communicate with your partner, but you _are_ allowed to communicate through card plays, but then you _aren 't_ allowed to have secret communication through card plays (you have to tell your opponants your communication system)...

It's artificial and ridiculous. Given how easy it is to secretly communicate you're basically trusting people not to cheat.

</comment><comment><USER24> if anything this is good for the game. games where there is possibility for cheating & scandals when getting caught are much more interesting. i always though bridge was dull, but i might be more interested now.

</comment><comment><USER25> This reminds me of the Fleming Bond novel _Moonraker_ , in which a whole chapter is devoted to the idiosyncrasies of the villain who is being challenged by Bond via bridge.

</comment><comment><USER26> do New Yorker authors get paid by the word or something? Tl;dr They cheated by adjusting a tray to different positions to convey different meanings.

<comment><USER27> I like the longer articles in the New Yorker. The charm of articles like that is becoming familiar with a milieu, not the notional theme of the article. Learning about a small but dedicated subculture by reading an interesting story is more interesting than just knowing the facts about a professional contract bridge cheating scandal.

This tl;dr thing makes sense in articles about technical subjects when all you really want to know is the answer. It makes no sense for things you read for pleasure.

<comment><USER28> I agree. What the actual cheating technique was is the least interesting part of the story.

<comment><USER5> I disagree - I think the variety of cheating techniques (not covered by GGP's tl;dr) was interesting, especially given the monikers. I found the Coughing Doctors and the Italian Foot Soldiers to be quite amusing

[Edit: fixed OBOB on the reference to a higher level post]

</comment></comment></comment></comment><comment><USER29> IT sounds like a very interesting game. Have never played it, but I do agree that they should look at how they could stop the cheating in this game.</comment>


Lenovo Readies New ThinkBook Family of Laptops - <AUTHOR> https://www.anandtech.com/show/14296/lenovo-readies-thinkbook-laptops <comment><USER2> lack of trackpoint disturbs me, looks like it should fit into the ideapad side of things rather than the Think side</comment>


Ads on HN? - <AUTHOR> This is the first time I'm seeing a submission without any features but 'hide'. What does this mean?<p>https://imgur.com/a/BRSne4y <comment><USER2> YC-funded startups can post job ads: _These appear on the front page, but are not stories: they have no vote arrows, points, or comments. They begin part- way down, then fall steadily, and only one should be on the front page at a time._ [https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)

<comment><AUTHOR> I missed this. Thanks.</comment></comment>


Ask HN: How is the avg in my HN profile calculated? - <AUTHOR> I currently have a karma of 1556 and an average of 2.55. I'm a HN'er for 509 days as on date. Clearly, the average is not straight forward. So, how is it calculated? <comment><USER2> I marked up the code pointed to by mrduncan with comments (a semicolon begins a comment in Arc).

      (def comment-score (user)
        (aif ;; (aif test true-part false-part) ;; if test is true, assign its value
                                                ;; to the variable it and evaluate
                                                ;; true-part. Otherwise, evaluate
                                                ;; false-part.
             ;; This could alternately be awhen, and leave out nil at the end
             ;; of this function
         (check (nthcdr 5 (comments user 50))
      	  [len> _ 10]) ;; if the user has at least 15 comments, assign
                           ;; the comments numbered 6-50 to the variable it
         (avg ;; get the average of the list returned from the next line
          (cdr ;; take every score but the first
      	 (sort > ;; order the scores, so the "first" score mentioned above is
                     ;; the highest-scoring one
      	       (map !score (rem !deleted it))))) ;; get the scores of each comment
                                                     ;; as a list
         nil))

So it takes your comments numbered 6-50, throws out the highest-scoring one, and averages them. This is assuming the code posted by mrduncan is still correct (I'm not digging through a fresh copy of the source right now).

</comment><comment><USER3>
      ; Ignore the most recent 5 comments since they may still be gaining votes.
      ; Also ignore the highest-scoring comment, since possibly a fluff outlier.

<http://github.com/nex3/arc/blob/master/news.arc#L2301>

It may be slightly different now, but probably not by much.

</comment><comment><USER4> I've heard it described as basically the aveage of recent comments, with the highest and lowest outliers thrown out. (I guess the formula's in the source if you really want to know).

</comment><comment><USER5> total karma / # comments = average?</comment>


The Internet's Back-to-the-Land Movement - <AUTHOR> https://www.are.na/blog/the-internet%27s-back-to-the-land-movement <comment><USER2> I fully expect that as the 'traditional' internet becomes increasingly monopolised, locked down and regionally fragmented, solutions similar to Othernet [0] will become more common. Personally I can't wait to be able to select between a multitude of networks all serving different content and services.

[0] - [https://othernet.is/](https://othernet.is/)

<comment><USER3> I hope so. Maybe it'll bring back some of that BBS/early-internet community feel to it, at least for a while.

</comment></comment><comment><USER4> > The analysis concluded that unless people took immediate action to > counteract growth, global resources would be exhausted by the first few > decades of the 21st century. In other words, civilization as of 1972 was > projected to reach a total collapse by what is increasingly becoming our > present day.

I've read it quite a while ago, but I certainly remember that the first few decades of 21st century, and 2015 in particular, was projected to be the "top" point in terms of overall life quality, and after that point, the humanity would slowly, but inevitably, turn backwards. "Total collapse" by this model wouldn't occur until the last quarter of 21st century, and "our present day" would be just the almost unnoticable beginning of stagnation.

<comment><USER5> The nature of evolution dictates that, even without a collapse in our ability to harvest energy and other resources from the environment, life is destined to get worse for the median human being. There are only so many resources to be consumed, but life reproduces exponentially.

<comment><USER4> > life reproduces exponentially

Life in general does. Humans, however, seem to be abandoning this trend.

<comment><USER5> It's temporary. Most humans are poorly adapted to modern life. But not all. The transition back to higher fertility is already underway, it's just hard to notice because the percentage of people who are well adapted to modernity is really small. But there are people who have 4+ kids, despite living in the developed world. Those are the humans of the future.

</comment></comment></comment></comment><comment><USER6> While I appreciate the lightening of the load of websites to something more manageable and reducing overprovisioning, it should be stated that data centers are more efficient, in that they spend fewer watts for the same number of gigahertz, compared to at-point computer rooms or even personal computers. Clouds reduce energy consumption, not increase it.

<comment><USER7> An increase in efficiency does not necessarily mean a reduction in total consumption. [https://en.wikipedia.org/wiki/Jevons_paradox](https://en.wikipedia.org/wiki/Jevons_paradox)

<comment><USER8> I've always struggled with the application of Jevon's paradox to decision making. Does it mean we _shouldn 't_ try to make our usage of scarce resources more efficient?

<comment><USER9> I think it just means you have to do more than simply make things efficient. You also have to have some way to minimize total costs.

</comment></comment></comment></comment><comment><USER10> > Fukuoka recognized that many of our celebrated technological advancements > would be unnecessary had humans not created an ecological crisis in the > first place.

Interesting. I'll have to give this some thought. I suspect there is some truth in this and some over-simplification as well.

</comment><comment><USER11> While I agree that many websites are needless bloat in a game of chasing ad revenue that drives people away or to block them back to the land is fundamentally a silly regression based on fantasies of a past that never was. Where do they think industrial labor came from? Farmers. Agriculture for reduced growth is counter effective.

Agricultural efficiencies were too high for that sort of thing centuries ago and density is actually the lower in environmental impact option. It seems an idea pushed more by memes and ideology than anything practical.

<comment><USER12> This is a really good point. After reading, this article seems mostly about the aesthetics of these movements and how they influence people and businesses and how they affect lifestyle choices. To quote the slogan of sfpc.io: It's "more poetry, less demo". It feels like something that could be tacked on to Fred Turner's The Democratic Surround. ([https://www.youtube.com/watch?v=KTKmcToqKRs](https://www.youtube.com/watch?v=KTKmcToqKRs))

<comment><USER13> There are really two separate but related things here. Communes didn't work, but many of the ideas from that movement are still useful. The people involved with or sympathetic to that movement exposed just how wasteful rampant consumerism is, for example. There are many, many practical ways to reduce consumption, most of which are still widely ignored, even by so-called progressives.

The second, related part of using the internet as a way to organize people was also co-opted by the very organizations that benefit from continued consumerism, and that had more of a debilitating effect on the internet that the "eternal September" tech types like to complain about. The tipping point was somewhere in the late 90s or early 00s. That has led to the current godawful web we have today, with probably over 98% of the packets being sent for purposes of surveillance or ad-serving.

So, maybe it seems futile to some, but for someone like me who has living memories of the time before computers were common and relatives who died with basic tools of life that were more than 50 years old, it's worth discussing at least.</comment></comment></comment>


Show HN: Kikked – check if any of your NPM repos is trademarked - parro-it https://github.com/parro-it/canibekiked <comment> parro-it I'm not a native speaker, I had no idea what "kike" means in english before reading this issue.

I intended the word only in the sense "to suffer the same fate as the azer/kik project".

I renamed the project, my apologies to anyone who could have been offended by my mistake.

<comment><AUTHOR> No harm done, node itself has 'gyp' which is a racial epithet for gypsies in most of Europe.

<comment><USER2> Even "gypsy" has negative connotations, hence their preference for "Roma", generally speaking.

</comment></comment></comment><comment><USER3> There's also [https://github.com/egoist/is-trademarked- cli](https://github.com/egoist/is-trademarked-cli) \- a CLI tool I came across the other day, to see if a name is trademarked.

<comment><USER4> That's actually the dependency that provides the trademark checking ability of OP's tool. And its first commit was two days ago, so it was probably also a response to the NPM kik-storm.

</comment></comment><comment><USER5> I have an NPM package named "barrel"[0], which apparently is also a trademark for some kind of sunglasses company. I would expect there to be some kind of fair-use-like rule for common nouns that are used in different industries or domains?

[0] [https://www.npmjs.com/package/barrel](https://www.npmjs.com/package/barrel)

<comment><USER6> At least in the US, the rule is essentially confusion: is a consumer likely to be confused? In both cases (yours and kik) the likelihood of real confusion is unlikely, although admittedly sunglasses are a couple steps more removed than a messaging app.

Good reading is the Apple V Apple series of court cases: [https://en.wikipedia.org/wiki/Apple_Corps_v_Apple_Computer](https://en.wikipedia.org/wiki/Apple_Corps_v_Apple_Computer)

<comment><USER7> True, but the brouhaha over kik was over npm's module name dispute policy.

So, it seems like the operative questions are 1) How likely is X to create an npm package? and 2) If a node.js developer types `npm install X`, are they more likely to expect X's package, or my package?

For the parent commenter, 1 is a definite no, and 2 is kinda wishy-washy.

<comment><USER8> I don't think anyone on earth installs a package with npm without specifically knowing what they are installing. This is in contrast to users going to foo.com expecting to find foo corps website.

Going to foo.com is a very serviceable strategy for getting foo corps website and if it's not you have invested 2 seconds and risked nothing.

Contrast that with npm unless you specifically know the package by name getting foo corps software by npm install foo is a total crap shoot that is only somewhat likely to succeed will cost you as much as a minute or more of your time and is installing software considered by most technical people to be risky.

Nobody is likely to confuse foo package with foo Corp unless the description of the package is unclear thus name and description should be considered together to decide if confusion exists.

<comment><USER9> But when you saw the headlines, "Internet broken due to Kik package dispute" it is reasonable to expect confusion with the trademarked company and software.

<comment><USER8> Trademarks exist to prevent confusion in trade not in people who read headlines and not articles.

It's more likely that most had heard of neither and now way more clear on who both parties are.

</comment></comment></comment></comment></comment></comment><comment><USER10> Don't think this really solves the problem... I think the real issue here is security of what happens when a deep dependency in NPM's graph get's removed... Right now it is possible for anyone to republish said dependency with any (perhaps evil) package. What needs to happen is either unpublish needs to be disabled, or when you remove a dependency that is heavily depended on, an empty placeholder has to be automatically added by NPM so no one can hijack the package name. The question becomes what constitutes a heavily depended on package. (100 dependents? 1000?)

</comment><comment><USER11> All: it took at most a single click to figure out that "canibekiked" included "kike" by obviously innocent accident. I understand the magic power of the bikeshed to hold internet forums in thrall, but holy magoly you guys outdo yourselves sometimes.

You all owe parro-it (<\-- notice the country code in the name? _big clue_ ) an apology. How about setting this right with some substantive feedback about the project?

Edit: We'll mark this and the other "is that a racist slur on the bikeshed" subthreads off-topic, so your forthcoming substantive feedbacks should all rank higher in the thread.

</comment><comment><USER12> Oy Gevalt, in all fairness the developer of this doesn't appear to be a Native English speaker.

<comment><USER13> I'm not the creator, but I am a native English speaker. I've never heard the word "kike" before, had no idea what it meant...

</comment></comment><comment><USER14> The author has decided that he will rename the package 'Kikked.'[1] The title should be updated to that.

1: [https://github.com/parro- it/canibekiked/issues/2#issuecommen...](https://github.com/parro- it/canibekiked/issues/2#issuecomment-201908619)

</comment><comment><USER15> 20 comments about the name here and none of you bothered to open an issue. For shame!

<comment><USER16> Someone just did: [https://github.com/parro- it/canibekiked/issues/2](https://github.com/parro-it/canibekiked/issues/2) :-)

<comment><USER17> And like an idiot, I waded in.

<comment><USER15> Yeah, I can't say I don't regret my involvement either.

<comment><USER17> Seems like it's worked out for the best.

<comment><USER15> Yeah, luckily.

</comment></comment></comment></comment></comment></comment><comment><USER18> Am I parsing it incorrectly in my head, or does this project have a blatantly antisemitic name?

<comment><USER19> You are reading correctly. The project name doesn't follow English inflection rules. Just as e.g. "tap" becomes "tapped", "kik" should become "kikked". "Kiked" is an inflection of "kike", just as "liked" is an inflection of "like" and "taped" is an inflection of "tape". This mistake is easy to make, since there aren't any English verbs spelled ending "ik"; words with this sound are instead spelled ending "ick".

<comment><USER20> The "Kiked" should probably be read as "Kik'ed" and in any regards, "Kikked" would be wrong. Kik is an entity and not a word in itself here. Try replacing it with "IBM'ed", "Microsoft'ed", "Facebook'ed" etc. The last one is the closest one, you wouldn't be saying "Facebookked".

As a side-note, I in no way think the author made any association with the word kike. Even though I know the word, I didn't jump to that conclusion at least, especially given the context.

<comment><USER21> The entity has nothing to do with it. Back when I worked for the comparison shopping NexTag, for example, people would certainly joke about being 'nextagged', not 'nextaged', which would've been read as something completely different.

None of IBM, Microsoft, or Facebook end in exactly one 'short' vowel plus one consonant, which is the rule, in English, that determines when the final consonant is doubled. _That 's_ why your examples don't work.

</comment></comment></comment></comment><comment><USER22> A fairly unfortunate naming choice.

It looks like the author is Italian, so I would hazard that they're not a native and that this is just an innocent mistake in transcribing what they think "kik'd" ought to sound like.

</comment><comment><USER23> Does the inflection rule still work the same way with proper names?

<comment><USER24> Yes. If Twitter had been named after a guy named Bob, then the past tense of the verb for posting on that service would be "Bobbed," not "Bobed."

<comment><USER23> Ok, thats fair. It seemed weird at first that there could also be someone named Bobb, but I guess that would be Bobbbed.

</comment></comment></comment><comment><USER25> Without wishing to otherwise get involved at all, I'd like to say that as an Australian native english speaker, I have never heard of the word "kike" or that it is apparently a slur against jews. Why would anyone else in the world know that?

I have nothing against jews, but it pisses me off that some local slang is elevated into a global "character sequence you can't use", so long as that slang originates in NYC. Imagine if every other city had that privilege; we wouldn't be able to name anything.

<comment><USER26> That rule usually only applies if the word doesn't have other valid uses. For example, 'cracker' is a racial slur for white people, but it also means an edible snack, so it's in the clear. To my knowledge, the word 'kike' does not have a non-offensive meaning, at least in the english speaking world.

<comment><USER27> Again, only in the United States. The word "kikel" is the yiddish word for "circle", and illiterate Jewish immigrants coming to the US didn't want to write an X by their name because they inferred they were being asked to draw a cross.

Once this was figured out as the problem, Jewish immigrants were instructed (in yiddish) to write a circle instead, thus they were referred to as "kikes" by immigration officials.

Since the origin of the term is specifically american, why should the rest of the world have to deal with it? You're not really addressing the original concern. Your theory of offensiveness as being "words with only one possible meaning" is fallacious, since again, that meaning is derived from the very specific mores of only one society. Very disappointing to see this kind of thoughtless "america is the center of the universe" opinion in HN.

<comment><USER28> The rest of the world doesn't have to deal with it if they don't want to. This is easily solved by registering the trademark with someone other than the US, establishing the brand and trademark and then coming to the US.

</comment></comment></comment></comment><comment><USER29> #unfortunatesubstring

</comment><comment><USER30> "Canibekik'd" please

<comment><USER31> It's funny, but this is, in a way, a parallel of what happened to the original "kik" project, in that there is a suggestion of name change because of the perception of some people.

<comment><USER17> Was the same argument made for kik, or was there a different name originally?</comment></comment></comment>


Ask HN: Is it illegal to require users to be under a certain age? - <AUTHOR>

Many sites require that users be over a certain age, for example Facebook requires users to be at least 13, most dating sites require users to be legal adults, as do most porn sites. It's obvious why that's all considered perfectly legal and reasonable.
Is it legal to require users to be under a certain age (eg 30)? Does anyone have personal experience with this, or know of any sites with such requirements? My concern is an age discrimination lawsuit. I've been building web businesses since the mid 1990s, but I honestly have never run across this issue before, and I suspect it's a murky area legally; as in, it's not technically illegal, but someone could definitely sue you for age discrimination and have a case, but that doesn't mean someone will ever bother to do so. <comment><USER2> Not a lawyer, but FWIW: if it's employment-related, tread very carefullyYou could specify that a potential employee must be 'in touch with what's new and hip' but it's risky to say that you won't hire anyone over 30 (as well as maybe unwise). If you're looking to hand out scholarships or somesuch, it's probably much less of an issue. If you want to make Logansrun.com* where everyone has to be under 30 to join up and waste time on your social network, you're probably safe, as old and middle-aged people are not a protected class that I'm aware of.

* Of course being able to reference Logan's Run dates me as over 40.

</comment><comment><USER3> Disney's Club Penguin is an example of a site with implicit maximum age restrictions.

Per the "How do I become a member?" FAQ [1]:

"It's very simple to become a Club Penguin member. Before you purchase a membership, you'll need to ask an adult for their permission.

"Once you have an adult's permission, visit our Membership page together to add a membership to your penguin account. "

[1] [http://www.clubpenguin.com/help/help- topics/membership/how-d...](http://www.clubpenguin.com/help/help- topics/membership/how-do-i-become-member)

</comment><comment><USER4> > As in, it's not technically illegal, but someone could definitely sue you > for age discrimination and have a case

Did you just say that age discrimination both is and is not illegal?

<comment><AUTHOR> That's sort of correct. There's nothing inherently illegal about discrimination: it just means to recognize a distinction between. Most types of discrimination are legal. Work places always discriminate when they pick the best candidate.

There are many instances in which age discrimination is not illegal (I listed three examples in the post). Facebook is a massive age discriminator for example, and it's entirely legal; ditto porn sites. American drinking laws age discriminate against 20 year olds (so every liquor store is an age discriminator).

Sometimes age discrimination is considered illegal, and sometimes it is not.

My question was whether it's illegal to require users to be under the age of 30. I plan to age discriminate against people of certain ages (under 18, over 30).

<comment><USER4> > My question was whether it's illegal to require users to be under the age of > 30.

I was referring to your statement that you believed that it was: 1\. Technically not illegal to do so, and 2\. That if you did so, someone would "be able to sue for age discrimination and have a good case".

You seemed to believe both sides on the illegality issue not just of age discrimination in a broad sense, but of the specific act.

<comment><AUTHOR> Obviously you can be sued for things that aren't technically illegal, and you can lose due to a sympathetic jury. I'm not _certain_ on the legality of this context, but I have generalized industry knowledge accumulated from the past 18 or so years (that is, at best I can make a decent guess). I was hoping someone with direct experience on this issue might respond.

In this case in which the legality doesn't appear to be well determined, there may very well not be a single law on the books when it comes to restricting usage of a site to people below a certain age. However, a jury might set an example then and there; and given the litigious times we live in, that's a real risk.

I think you run the lawsuit risk at all times these days, but if I know for certain this isn't illegal right now, then it boosts my confidence that in a lawsuit situation I at least have a fighting chance.

<comment><USER5> > Obviously you can be sued for things that aren't technically illegal, and > you can lose due to a sympathetic jury.

If you feel that the law is on your side, but the jury won't be then opt for a trial by judge. It's your right as the defendant.

<comment><USER4> Actually, both parties have the right to jury trial in civil cases in the US (at least, those in which either party has that right.)

The defense does not have the right to demand a bench trial if the plaintiff prefers to exercise their right to a jury trial.</comment></comment></comment></comment></comment></comment>


Show HN: Findka – Personalized recommendations for any type of content - <AUTHOR> https://findka.com <comment><AUTHOR> Hi, OP here. I started working on recommender systems in 2016 during my undergrad, specifically doing music recommendation. I spent about five months in 2019 trying to make a music startup based on that. However, during that time I realized that there would probably be more value in having a really good general-purpose recommender system. i.e. if you're looking for something specific, use Google, and if you're not looking for something specific, use Findka. That's the vision anyway.

Some good articles on this topic:

"Search, discovery and marketing"[1]

> Google is very good at giving you what you're looking for, but no good at > all at telling you what you want to find, let alone things you didn't know > you wanted.

"The Big Promise of Recommender Systems"[2] (2011)

> When we evaluate the current generation of recommender systems from the > point of view of the "recommendee," we find that most recommender systems > serve the goals of the business instead of their users' interests. Thus we > believe that the big promise of recommender systems has yet to be fulfilled. > We foresee a third wave of recommender systems that act directly on behalf > of their users across a range of domains instead of acting as a sales > assistant.

The algorithm currently is dead simple. Just collaborative filtering without explicitly taking into account content type. So it's naively cross-domain. Since the data set is still small, there's no need for matrix factorization. I recompute the whole matrix every hour and store it in memory. See [3] for the implementation (it only took 30 LOC). That's a little out-of-date but the general approach hasn't changed.

For the tech stack, I'm using a Clojure web framework + deployment solution that I made.[4] It's like a self-hosted version of Firebase (I'm running it on DigitalOcean). See [5].

[1] [https://www.ben-evans.com/benedictevans/2015/6/24/search- dis...](https://www.ben-evans.com/benedictevans/2015/6/24/search-discovery- and-marketing)

[2] [https://www.aaai.org/ojs/index.php/aimagazine/article/view/2...](https://www.aaai.org/ojs/index.php/aimagazine/article/view/2360)

[3] [https://findka.com/blog/rec-sys- in-30-lines/](https://findka.com/blog/rec-sys-in-30-lines/)

[4] [https://github.com/jacobobryant/biff](https://github.com/jacobobryant/biff)

[5] [https://findka.com/blog/migrating-to- biff/](https://findka.com/blog/migrating-to-biff/)</comment>


Why Is 'avast Web/Mail Shield Root' Listed as CA for Google.com? (2014) - <AUTHOR> http://security.stackexchange.com/questions/73476/why-is-avast-web-mail-shield-root-listed-as-ca-for-google-com

<comment><USER2> Do you have a Chrome extension called something along the lines "Avast Online Security"?

<comment><AUTHOR> My experience is that the Avast installation process will install its Trusted Root certificate if the "web scanning" option is enabled (which is the default) during installation. Even if Avast browser extensions are disallowed, and even if the web scanning feature is later turned off, the Trusted Root Certificate will still be there and will still be utilized.

As noted in the comments of the accepted answer on SE, this is not necessarily a security problem as long as the certificate is unique on each PC. But to me, in order for this whole Antivirus-MITM scheme to be secure, the AV vendor has to get a lot of things right. If the certificate generation during AV installation is flawed (say, with a weak RNG), then it could easily be exploited to perform MITM on anyone with the flawed certificate in their trusted root store.</comment></comment>


Predicting time series - <AUTHOR> http://mailman.srv.cs.cmu.edu/pipermail/connectionists/1989-October/011939.html <comment><USER2> People from other domains call this "extrapolation", and it's generally quite well known thing with plenty of algorithms. I'm not sure if there is much to gain from AI. Probably another example of AI research looking for a problem.</comment>


Show HN: Using CNAMEs as SNI Hostnames - <AUTHOR> #A shell script that "learns" and updates itself with new information.
#Usage: echo https://example.com/index.html|cname-sni > 1.html; firefox 1.html  [1]
#where example.com is a site hosted on AWS Cloudfront and the script is called "cname-sni".
#Purpose: send CNAME as SNI hostname, e.g., send dnere6g15e5vs.cloudfront.net instead of www.reuters.com
#Uses DNS-over-HTTPS from Cloudflare but can easily substitute other sources
#    echo 18.104.22.168 cloudflare-dns.com >> /etc/hosts
#1. The file 1.html will contain TLS headers, HTTP headers and possibly chunk sizes.  Removing those is left as an exercise for the reader.  I wrote some crude filters in flex to do it.  Adding "<base href=https://example.com />" to the top of 1.html will fix relative links when viewed in the browser.

    # requirements:  ed, grep, sed, openssl ;
    get(){ printf "GET $1 HTTP/1.1\r\nHost: $2\r\nConnection: close\r\n\r\n"|exec openssl s_client -ign_eof -no_ticket -connect $2:443 -verify 9 $3 $4 $5;}
    doh(){ u=cloudflare-dns.com;get "/dns-query?name=$1&type=A&ct=application/dns-json" $u |grep  -o "d[^\"]*.cloudfront.net";};
    read x q; unset q;case $x in https://*)x=${x#*https://};esac;host=${x%%/*};path=/${x#*/};
    case $host in "") # the ";;" lines are eight spaces from the left margin and there are eight spaces following grep and echo
        ;;www.reuters.com) y=dnere6g15e5vs.cloudfront.net
        ;;www.wsj.com) y=dlp0y1mxy0v3u.cloudfront.net
        ;;*) a=$(doh $x|sed 1q);
    echo $a|grep -q "^d[^\"]*.cloudfront.net$" ||exit;
    z=$a;if ! grep -q '        ;;$host) 'y=$z $0;then echo '        ;;'$host')' y=$z >> $0;
    printf "/doh .x\n-1\n\$m.\nwq\n"|ed $0 >/dev/null;fi;esac;get $path $x -tls1_2 -servername ${z-$y};exit
 <comment><AUTHOR>
       sed -i '/read x/s,$,test \$path != \$x||path=/\;,' cname-sni</comment>


Ask HN: Built a successful app business, now I desperately need a biz partner - <AUTHOR>

<comment><USER2> Is the app published? whats the name of the app?

</comment><comment><USER3> Built _

<comment><AUTHOR> that too. thanks</comment></comment>


A Heroku buildpack for Rust applications - <AUTHOR> https://github.com/emk/heroku-buildpack-rust

<comment><AUTHOR> For those unfamiliar with buildpacks, a buildpack is a collection of scripts which prepares your code for execution by the Heroku dyno manager. Heroku's Cedar stack has no native language or framework support; Ruby, Python, Java, Clojure, Node.js and Scala are all implemented as buildpacks.

[ref] [https://devcenter.heroku.com/articles/buildpacks](https://devcenter.heroku.com/articles/buildpacks)</comment>


Boston Red Sox Used Electronic Devices to Steal Signs Against Yankees - <AUTHOR> https://www.nytimes.com/2017/09/05/sports/baseball/boston-red-sox-stealing-signs-yankees.html <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=15178807](https://news.ycombinator.com/item?id=15178807).

</comment><comment><USER3> Is there something cultural in Boston that encourages this kind of misbehavior?

The Patriots are also notorious cheaters.

[https://en.wikipedia.org/wiki/2007_New_England_Patriots_vide...](https://en.wikipedia.org/wiki/2007_New_England_Patriots_videotaping_controversy)

[https://en.wikipedia.org/wiki/Deflategate](https://en.wikipedia.org/wiki/Deflategate)

<comment><USER4> From your linked Deflategate article:

> The judge asked to know what exact evidence links Brady to deflating > footballs, with NFL lawyer Daniel Nash responding that there was "no direct > evidence Mr. Brady clearly knew about this," including records of text > messages, and phone calls between the quarterback and one of the two > Patriots employees implicated. He also indicated there is no "smoking gun" > showing that Brady had direct knowledge that the balls were deflated.</comment></comment>


How did the repo get 5000 stars in a few days? - <AUTHOR> https://github.com/zenorocha/clipboard.js/issues/56 <comment><AUTHOR> maintainers response: [https://github.com/zenorocha/clipboard.js/issues/56#issuecom...](https://github.com/zenorocha/clipboard.js/issues/56#issuecomment-144936509)

<comment><USER2> This should have been the link in the first place.</comment></comment>


Show HN: Get a phone number in 50 countries & answer calls anywhere in the world - <AUTHOR> https://conumber.com <comment><USER2> I've been using didlogic.com for this for many years.

Their web UI makes it really easy to set up round-robin and to to turn destinations on/off. This is really useful for me as I can easily change the set of destination numbers with just a few taps, when I land somewhere.

</comment><comment><USER3> This is old hat. I had such a number for a while twelve years ago, for $5/month. It was possible to connect it to Skype, too.

</comment><comment><USER4> interesting idea, but why would i use this over Twilio? yea, i know i would need to do some tweaking to Twilio to get it to do the same as this, but it would actually work out cheaper on their end, i think...

<comment><AUTHOR> Twilio is great if you have someone to set it all up. If you are a small company or a freelancer, than twilio might not be the simplest solution. With conumber you don't need to setup anything. Choose a city and tell us where we should forward the incoming calls to. Takes 1 minute and you're ready.

</comment></comment><comment><USER5> guys there is a bug out there in your site pls fix it fast. [https://imgur.com/a/blQbUGe](https://imgur.com/a/blQbUGe)

<comment><AUTHOR> thanks! we will fix it asap.

</comment></comment><comment><USER6> How is it different from rest?

<comment><AUTHOR> There is absolutely no setup involved for our customers and the call quality for incoming calls is very good.</comment></comment>


Ask HN:Where can I find software I can resell outside the US? - <AUTHOR>

<comment><USER2> There are some people offering websites and other packages for resale on eBay, of all places. Flippa might be a good source for web-based stuff.

Otherwise, can you be more specific about what you're looking for?

<comment><AUTHOR> I feel like I am good at designing software, and been thinking on starting a software consulting group, but my area of expertise is SAP and I was wondering if there is other softwares I could sell based on commision.</comment></comment>


Ask HN: Open-source devs&users using closed source OSes, could you explain why? - <AUTHOR> Just got through Lunduke's "Linux sucks 2020" video [0] and even if it might be in jest, he brought up a good point that many people promoting linux, presenting linux stuff, working in opensource or contributing to it, use closed-source OSes. I'm not trying to bash anybody, it's just genuine curiosity as to why.<p>0: https://open.lbry.com/@Lunduke:e/LinuxSucks2020:b?t=3215 <comment> non-entity Because while I enjoy the philosophy behind open source and use, and even occasionally contribute to OSS projects, I'm not a zealot. Theres still plenty of software that only runs on proprietary systems I want to use (games are a bug one, but you'd be suprised how much dev software only runs windows). Hell even mant linux systems likely have something proprietary on it, even if it's just firmware for some wireless or graphics device.

<comment><AUTHOR> > I'm not a zealot

Why do you think running an open-source OS has something to do with zeal?

> you'd be suprised how much dev software only runs windows

Really depends on what you're developing, what for and in which language.

> Hell even mant linux systems likely have something proprietary on it, even > if it's just firmware for some wireless or graphics device.

I'm not entirely sure what point you're making here. Quite a bit of hardware does indeed only have closed-source drivers and there is simply no alternative, but why would that be a reason to use a closed-source OS? I'm not understanding the connection.

<comment> non-entity > Really depends on what you're developing, what for and in which language.

And? That doesnt change the fact that it's a valid reason from using closed- source operating systems, even if you're involved in other open source development and advocacy.

Ok it appears I made of mistake on extrapolating your criticism of the use of close-sourced operating systems to apply to closed sources software in generally, however from your profile you appear to be one such zealot as I mentioned.

> Closed or obfuscated? Virus!

So according to you any of the aforementioned proprietary firmware is somehow a "virus".

<comment><AUTHOR> > That doesnt change the fact that it's a valid reason from using closed- > source operating systems

True.

> So according to you any of the aforementioned proprietary firmware is > somehow a "virus".

It's a joke a colleague made and I found it funny. I do work in closed source myself.

</comment></comment></comment></comment><comment><USER2> "Open source" is primarily a coding phenomenon.

But an operating system is about more than just code. It is the central component of a computing ecosystem. And producing a viable, productive ecosystem requires much more than just open source code. It requires design, implementation, incentive and marketing.

If code was all that was needed, Linux distros should be dominate by now. Instead, after 30 years of effort by some of the best and brightest and billions of lines of code later and the result is --- a big yawn from the general computing public.

But, but, but Android. Well, Android isn't totally "open source" now is it? Key pieces of the ecosystem are not really "open" at all. And these key nuggets capture the incentive that propels the design, implementation and marketing forward.

Bottom line --- it takes more than an engine to produce a best selling car. And likewise, it takes more than charity, good intentions, free labor and open source to produce a truly viable and popular operating system.

<comment><AUTHOR> I mean... a response to the actual question would've been nice.

<comment><USER2> My answer should be obvious. They are using what they feel best addresses their _overall_ needs. And like the general computing public, their needs extend beyond the availability of source code.

</comment></comment></comment><comment><USER3> Windows vs Mac vs OS OSs is what you're talking about. If you're a gamer - Linux is no go. If you're a developer, macOS is more often used than _anything_ else. If you're not trying to benefit from any well made commercial software then OS OSs are terrible. CS software is almost never optimized for OS OSs.

Much of what's OS is not delightful to use unless you're in the terminal. It's much better now than 5 years ago. Simple things like watching videos and listening to music requires proper OS configuration because of codecs not being free as in freedom. There's more annoyances, so to sum it up, nothing available for Linux that has a GUI is enticing to me. Whereas many native Mac apps are simply amazing.

<comment><USER4> I find Linux much better and less annoying than Windows, although maybe that is because I use and prefer command-line stuff a lot rather than GUI, and don't watch videos much on my computer.

Well, I suppose is good that people who do not like Linux will be able to use Windows or Mac OS X instead, since some people will prefer that.

But some software is written for all three common operating systems, and some software is written for older computers or VMs which can then be executed in modern computers by emulation. (For example, there are many good free NES/Famicom games, such as We Are Hejickle, and Gruniozerca (a series of three games so far), and NES/Famicom emulation is available for many kind of computer systems.) Some companies will write software for Windows, but will also ensure working with Wine and advertise the compatibility with Wine, too. (And, of course, there are many web apps, too, these days.)

</comment></comment><comment><USER5> I do enthusiastically use Linux in the scenario where it is comparatively strongest, that is, on computers without screens.</comment>


Kicking off Stripe's private beta in India - <AUTHOR> https://stripe.com/blog/india-private-beta <comment> git-pull By the way, stripe has a cool new project, "stripe-mock": [https://github.com/stripe/stripe-mock](https://github.com/stripe/stripe-mock)

It lets you run a local stripe API on your machine. I've got high hopes in it. This could be the cure to building resilient stripe tests on local machines.

The maintainer @brandur seems to know his stuff in regards to rest apis.

<comment><USER2> Oh god, thanks so much for this. I've literally just been testing on prod and praying that it works.

<comment><USER3> You know you can generate a API test token and use one of test card numbers for all your testing purposes. There is a toggle in your main dashboard which will let you switch between sandbox/test mode and production for viewing charges etc.

<comment><USER4> This assumes you have internet connection always when developing/running tests, which is not always the case.

I always to rely on local tools/endpoints so when I'm offline, I can still continue working. Don't use Stripe as much as before but I definitely I wished I had this mock when implementing Stripe in applications I worked on.

</comment></comment></comment></comment><comment><USER5> I have really high hopes from this. There is currently no good way for a SaaS startup in India to get money from international customers. I think this is why many are forced to incorporate in the US/Singapore/etc. I am a single founder working on a SaaS project and receiving payments from outside India is one of the biggest challenges for me. I do not want to raise funds but may have to got that route just so that I can incorporate outside India and start receiving payments.

I have three requests for Stripe:

1) I hope that Stripe does not come out with a limited version for India, and that it is possible to charge international customers a variable amount every month, like you can do in the US.

2) I also hope that they come up with a prompt way of issuing FIRCs for every payment received. Without an FIRC there is no way to prove that the transaction was an export and therefore you have to pay GST on it, which is normally 18% for services. This reason alone is pushing me to incorporate in some other country. I stand to lose thousands of dollars this year because I can't get an FIRC for the payments I receive via Paypal/Wire transfer/Transferwise.

Paypal and Transferwise have procedures to get FIRCs, but when you approach their banks they either don't respond or come up with hundred reasons to not issue one. Citibank absolutely sucks at this. I really hope that Stripe just charges me whatever they want and couriers the FIRCs to my address automatically.

3) I hope that Stripe has a legal setup that is compatible with RBI regulations regarding the filling up of SOFTEX forms. There are some restrictions which in my understanding prohibit Indians from using international gateways like fastspring.

<comment><USER6> How does paddle.com handle this? They take over as merchant of record, and so technically they're selling your SaaS and paying you royalties via a reverse invoice. Any idea if they need to or give our FIRCs?

<comment><USER7> Are you suggesting that paddle.com gets around the RBI restrictions for companies based outside of India selling to Indians?

<comment><USER6> Not really - they're a London based company, and they follow whatever laws are applicable in the country of each customer (EU gets VAT, India gets GST, US gets nothing), etc.

If I work with them, the idea is that I've sold my product to them, so I'm exporting it to a company in London. I'll need to either pay or get exemptions for my taxes based on export rules. They re-sell it worldwide and handle whatever country specific rules are prevalent in each country, but that's not my problem any more.

</comment></comment></comment></comment><comment><USER8> Oh god yes, thank you! I've wanted this for so long. I'm building a SaaS and I seriously considered paying $500 for Stripe Atlas to incorporate in the US just for Stripe. (I don't expect my crowd to be from any particular country, so a global payments vendor is the best option.)

The state of payments here is sub-par; while providers are still coming up, the documentation is just not sufficient (at least not up to Stripe's standards), the APIs are a bit convoluted, and the whole thing feels shaky. Plus, Stripe is trusted by customers, so I bet at least a few of them would be more comfortable if they see the familiar Stripe payment form.

<comment><USER9> I agree with you. The timing couldn't be better and I've tried most of the other payment processors but I didn't find them usable at all. Waiting eagerly to get my invite and hope this isn't some crippled version due to RBI regulations.

</comment></comment><comment><USER10> >In just the past two years, the percentage of India's population connected to the internet has more than doubled to 500 million users

This is the statistic that will change the world more than a little bit. This is partly because the richest man in India has spent $25bn on telecom infrastructure and acquisition of new customers.

Here's a related article - [https://www.economist.com/news/business/21718495-jios-100m-n...](https://www.economist.com/news/business/21718495-jios-100m-new- customers-cost-cool-25bn-acquire-mukesh-ambani-has-made-business-worlds)

</comment><comment><USER11> This is going to be tough. The competition in payment ecosystem is pretty hot in India. You have Alibaba funded paytm with about 250 million users. They provide digital wallet services which can be used for buying anything from flights tickets to electronics online or paying for Uber. Apart from that they are also present offline, you can but grocery or even tea with that. Additionally they also have payments bank licence so you can have your bank account there itself. Then there is Jio money funded by India s richest man which also operates in telecom and has roughly 100 million users, they also have a payments bank licence. Finally there is Amazon pay, which is moving slowly but has recently tied up with lot of websites for movies or online food delivery. So the competition is likely to be fierce.

<comment><USER12> YC has funded 2 Indian startups in this space: Razorpay, and Cashfree, and now Stripe has also entered the space. Along with the startups some big banks are also in the fray. I started with HDFC payments for my company's payments but moved away from them; they expect you to work at their pace. That'd have killed us by now. I wrote about my payment experiences here: [https://blog.simplyguest.com/payments/simplyguest- payments.h...](https://blog.simplyguest.com/payments/simplyguest- payments.html)

<comment><USER13> Hi Subbu,

The canonical url for your page is set to [http://localhost:4000/payments/simplyguest- payments.html](http://localhost:4000/payments/simplyguest-payments.html) . That is not the best option for SEO :)

<comment><USER12> Thank you, Sharmi. I really appreciate you taking out time to look at the source and point out the issue. I have fixed the canonical url. I also noticed the feed url was wrong too. I have fixed that as well :)

</comment></comment></comment></comment><comment><USER14> What's the credit/debit card penetration like in India? I recall most transactions happening in cash when i visited a few years ago. Which also led to amazon and flipkart offering cash on delivery payment methods.

Did something change in relation to that? coz if not then stripe is gonna have a hard time finding customers

<comment><USER15> Others have pointed it out that it may but its also for Indian startups being able to easily accept payments internationally without setting up a US company.

</comment></comment><comment><USER16> As someone who doesn't know Stripe well, because it hasn't been available in India, is it just a payment gateway, allowing me to put a Buy button in my site or app to charge someone's credit card, debit card, net banking or Paytm?

<comment><USER17> Payment processor, so "buy button on site/app/etc"

</comment></comment><comment><USER18> It would be interesting to watch Stripe competing with the Razorpay which started as the Stripe of India. Both are funded by YC.

<comment><USER8> Wait, YC would fund a startup that's a competitor to one of its other startups? Huh, this is news for me (and it opens up the possibility of me applying to YC; previously I was apprehensive because YC had funded a direct competitor ~10 years ago).

<comment><USER19> RazorPay is India-focused and started a few years ago. Until they came around, there were few (zero?) payment gateways that fulfilled all the following criteria:

* Clean API

* Support India-focused payment options (netbanking is huge here. And Razorpay also supports digital-wallets)

* Easy to get started fast with less paperwork

For every other payment gateway, you had to go through a papertrail before you could even tryout the sandbox API.

I remember Razorpay (initially atleast) required only PAN and allowed individuals to start accepting payments. This IMHO is huge indie-friendly. And back then, for every payment gateway you had to be a registered company. Not sure if that relaxed rule translated to an uptick in growth.

</comment></comment></comment><comment><USER9> Is the Indian Stripe account same in functionality as the US account? Or is it restricted in some way due to the strict RBI rules in India?

<comment><USER20> Hopefully without restrictions! Fingers crossed!

If it's going to be restricted in some major way, then there won't be any difference between Stripe and say PayPal which makes it a non-starter.

RBI really needs to loosen up a bit, especially when it comes to over- regulation of the Software sector.

</comment></comment><comment><USER21> I'm still waiting for Stripe to launch in the UK's Crown Dependencies. I'm based in Jersey, and we have no (easy) marketplace payment solution.

Currently using Safecharge, which is quite good, however the setup process requires submitting 10+ documents with details on the company structure, UBOs and nature of business.

</comment><comment><USER22> Razorpay (funded by YC) is a competitor to Stripe in India. Has anyone tried using it? How was your experience?

<comment><USER23> A couple of months back I wanted to try Razorpay for receiving payments from my app users. Just like donate button in PayPal. But Razorpay was not supporting independent developers at that time.

While Stripe supports this feature beautifully, it wasn't supporting in India. Now I'm excited to hear this news.

</comment></comment><comment><USER24> Can you do subscriptions, how does it work with the compulsory 3D secure rules?

</comment><comment><USER7> Does this allow companies outside of India to accept payment from Indians without an international credit card?

<comment><USER25> Isn't that true already? My friends and I have been able to use local bank debit cards and they work as expected on international sites.

<comment><USER7> Well yes and no. The vast majority of Indian credit and debit cards don't work outside of India. You need to get special permission from your bank to be able to use an Indian CC outside of India [0].

0\. I have to say that I have not looked into this in detail in the last 12 months so if things have changed with the RBI I would be very happy to know.

</comment></comment></comment><comment><USER26> Will this accept RuPay?</comment>


HTTP/2 is not the future, it's the present - <AUTHOR> http://blog.eleven-labs.com/en/http2-future-present/ <comment><USER3> It's not Eleven-Lab's present, seeing as they don't support HTTPS, and HTTP2 doesn't work without it.

<comment><USER4> The standard [1] doesn't require the use of TLS/HTTPS. However, all of the major implementations only support HTTP/2 over TLS.

[1] RFC7540 - [https://tools.ietf.org/html/rfc7540](https://tools.ietf.org/html/rfc7540)

<comment><USER3> Correct, "all of the major implementations" :)

<comment><USER5> Which I'd quite bad. I don't understand why/who lobbied to implement it that way in Firefox. Can someone disclose the decision-making behind this? It would help devs a lot if HTTP/2 works without TLS too.

<comment><USER6> All the main browsers want to encourage HTTPS everywhere. They're taking a number of initiatives to encourage it, some are carrots, some are sticks.

Mostly it's ending up as the stick, eg "You can only get these major performance advantages over HTTPS". Soon there is an intent to specifically call out non-HTTPS content very prominently in the browser, even more so that HTTPS content was ever called out back when that was introduced.

<comment><USER5> Yes, exactly. But why? What's the agenda? Why now? It's not like Amazon.com was broken between 1996 and 2016. There is a push to HTTPS at all costs, even if things (ad networks, devs, software) is not ready and is there even a need for 100% TLS? That an open source browser is engaged in such initiative is not good. With HTTP you can be anonymous, and most website visits aren't mission critical things. With HTTPS your traffic is quite unique and the players with big money have the resources anyway, there TLS is no big thing as we learned in the last few years. So which Think-tank or what ever is behind this initiative?

<comment><USER7> Even if it's not a mission critical web request, isp's injecting content into your http pages is unacceptable.

Even if the government could brute force or fingerprint one of your TLS sessions, they can't do it for everyone for every site.

Just because Amazon wasn't broken doesn't mean we can't improve it.

Also your comment about a think tank coming up with this idea is an odd insult, given how broadly you can empirically see people support this.

<comment><USER8> Hmmm but i am pretty sure ISP and Ad Agents(Google etc..) will figure a way to inject content.

<comment><USER9> Well... They won't be able to. If they can figure out a way it means they have broken the underlying encryption, so that gets fixed.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I'd like to go further: HTTP/2 is the present not just for content serving, but could be for _APIs_.

Right now, everyone who's supported both mobile and web APIs (or cared about bandwidth constraint) can tell you how frustrating it is that well factored restful (or rest-ish) APIs are often the casualty of accepting the realities in mobile client support. You end up increasingly collapsing requests into one Special Bigger Request because One Special Bigger Request almost always has better performance on bandwidth-constrained clients than the same performance elsewhere.

And this is especially frustrating because often times the client can't tell us exactly what they need in the initial request. The best we often can do is stash an etags header in the request and try and get very fancy there. We end up with smarter endpoints which require tons more programmer maintenance, and move us away from the world of autogenerated and automatically audited endpoints.

HTTP/2 w/ Push offers us a way to split the difference. While individual endpoints can be served very quickly, we can have our APIs recognize (via etags, probabilistic inference, previous negotiation, etc) that more data is about to be requested and push it immediately.

This means we can keep our well-factored, simple API designs that we developed 10 years ago without sacrificing performance to the bandwidth-constrained. It means that we can further lean on the abstraction Service Worker gives us in web clients to just naively poll in client code and trust in clientside caching to make this efficient (with the fallback being the same network call we would have always made).

It's why I'm absolutely infuriated with so many languages for balking at supporting HTTP/2 as part of their stack (more often than not, on the grounds that SSL + ALPN seems tedious to implement).

<comment><USER11> I think that within a datacenter, a bunch of microservices make sense. When communicating with a customer, you want to craft just the data they need and minimize roundtrips.

GraphQL seems to be a great candidate for bridging this gap. I recommend using graphql to allow clients can use to make "One Special Bigger Request" which then gets split into multiple requests on the backend.

<comment><USER12> The thing about One Special Bigger Request is that it isn't cacheable. GraphQL is no exception: [https://philsturgeon.uk/api/2017/01/26/graphql-vs-rest- cachi...](https://philsturgeon.uk/api/2017/01/26/graphql-vs-rest-caching/)

If you want network-level caching, you want multiple atomic resource requests. HTTP2 enables this.

</comment></comment></comment><comment><USER13> This just made me add the 'http2' directive to my Nginx configs, and it seems that I'm getting a 15% decrease of loading time for my websites. Should have done this long ago...

<comment><USER14> Just to be sure, use a site like ssllabs.com to make sure you are actually using an ALPN. For example on Ubuntu 14, setting http2 does nothing, as it requires Openssl 1.0.2. If you are using Ubuntu 16, or a distro that provides the newer Openssl it should work correctly.

</comment></comment><comment><USER15> > Remember, in may 1996, the very first HTTP protocol version (HTTP/1.0) was > born.

Uh, what? HTTP predates 1996. The first version was HTTP/0.9, from 1991. 0.9 is still supported by a lot of web servers, too!

<comment><USER16> Personally, I've found it hard to find much information about pre-HTTP/1.0. To my understanding, "HTTP/0.9" is a retroactive version number. The original HTTP protocol was incredibly simple. An HTTP Request was simply "GET /", then the response was just the content immediately followed by a closed connection. There were no headers.

"HTTP/0.9" is used to describe the implementations of "HTTP/1.0" before it was -- for lack of a better word -- 'ratified'.

If you, or anyone, has more information or analysis of pre-HTTP/1.0 protocol implementations (client or server), I would be very interested in reading it.

Also, if there is a public, pre-HTTP/1.0 HTTP server available on the internet, I would very much like to check it out.

Thanks.

Edit: Alternatively, if it's possible to run an pre-HTTP/1.0 server (or client), that would be phenomenal. It only occurred to me after making the comment, however I highly doubt that it would be a simple process to get one running. I suspect that I wouldn't be able to spin a Docker container with some ancient version of Apache (I assume due to changes in the Linux environment, shared libraries, changes to gcc, etc.), but possibly, a VM running an equally-ancient version of Red Hat (pre-EL) would do the trick.

<comment><USER15> This is the only reference I've known: [https://www.w3.org/Protocols/HTTP/AsImplemented.html](https://www.w3.org/Protocols/HTTP/AsImplemented.html)

It's a little more sophisticated than GET /, as you can also specify a full URL.

> Also, if there is a public, pre-HTTP/1.0 HTTP server available on the > internet

Most HTTP/1.0+ web servers still support HTTP/0.9. I don't know of any 0.9-only servers though, but there's probably some.

</comment></comment></comment><comment><USER17> While I look forward to a faster desktop and mobile browsing experience with HTTP/2 I do worry about the complexity. I hope that the simpler protocols remain supported for a long time to enable implementations on low resource embedded systems.

The last thing we need is for all the closed-source, internet-connected, black boxes in our lives to poorly implement a complicated web standard protocol. There are so many places where we have already seen vulnerabilities with implementations of simple web severs and clients.

<comment><USER18> What looks particularly complex about HTTP/2?

The "simple" text based protocols are NOT simple to implement correctly. Go try out line-wrapping and play with using \r\n vs \r vs \n as line endings and tell me what the compatibility ends up like.

And this does create real-world security problems. Some VoIP companies allow you to make free calls by screwing with their SIP proxies because popular software handles line endings differently allowing you to make their edge software interpret packets differently than their core.

Even parsing is easier in a nice binary format (and much, much, faster, too).

<comment><USER19> It's not got much to do with the serialization protocol itself as such - <USER2> server software uses a library which handles it properly and then doesn't have to worry about it. It's more that web developers have to get bits of their stack (the dynamic and static serving aspects) to cooperate in ways they never had to before (in fact, the general wisdom was to separate them as much as possible as they have totally different requirements when it comes to performant serving).

This is not even to get into persistent connections & server push etc., which is quite a big subject for developers used to handling independent fire-and- forget requests.

I guess I'm saying the massively complexity comes in trying to _use_ these new features.

</comment></comment></comment><comment><USER20> For those interested in HTTP/2 Push, check out Eric Bidelman's Push Manifest format[1], which is a JSON format describing the dependencies to push for any request URL. You can generate the manifest by hand or with tools, and then there are servers that can read the manifest and push the right resources.[2]

In Polymer we're most of the way done with support for automatically generating push manifests from a dependency analysis of your project[3] and have push manifest support in our dev server and soon a small production server, so you can `polymer deploy` and get a push-enabled site.

[1]: [https://github.com/GoogleChrome/http2-push- manifest](https://github.com/GoogleChrome/http2-push-manifest)

[2]: [https://github.com/GoogleChrome/http2push- gae](https://github.com/GoogleChrome/http2push-gae)

[3]: [https://github.com/Polymer/polymer- build/pull/172](https://github.com/Polymer/polymer-build/pull/172)

<comment><USER21> This is really interesting thanks.

Doesn't this lead to the most highly used static assets being pushed for every subsequent request? Isn't that wasteful?

I use varnish cache extensively and am considering writing a probabilistic server push module. It could keep track of subsequent requests and push the next set of assets. This is more of a server module approach rather than client side.

Any thoughts on that?

</comment></comment><comment><USER22> Can someone recommend an up-to-date book/guide on HTTP(2)? I'm thinking this may do: [https://http2.github.io/](https://http2.github.io/), but I'm not sure if that's the best guide.

Much of the jargon in the comments is unknown to me. The article in the OP is a good start.

<comment><USER23> I've learned most things about HTTP/2 from talks given by Brad Fitzpatrick. Go's HTTP/2 support in standard library was largely implemented by him.

</comment></comment><comment><USER24> I'd like to see a web framework that implements well HTTP2.

AFAIK, the Assets Pipeline in Rails is not designed for HTTP2 and I think that there are no immediate plans to implement it.

<comment><USER25> > AFAIK, the Assets Pipeline in Rails is not designed for HTTP2...

Not true. You can define as many manifests as you want, and design your own heuristics around resources in rails. It doesn't need to be an HTTP feature.

You have to patch rails to fill up the link header with the assets however. If you do it, proper reverse proxies like h2o can serve assets using server push.

<comment><USER24> > You have to patch rails

That sounds like a bad idea in the long term... ;)

</comment></comment></comment><comment><USER26> Can somebody ask mr. Heroku why they don't support it...

<comment><USER24> You should probably not be serving a site directly from Heroku anyway. Put Cloudflare in front of your Heroku and you will get HTTP2

</comment></comment><comment><USER27> To be clear, Server Push as described in the article is not actually provided by nginx yet and thus by the server config in the article. I have no doubt that the awesome nginx folks will implement in due time though.

<comment><USER28> Its implementation is already present in nginx plus since 2015. [https://www.nginx.com/blog/http2-r7/](https://www.nginx.com/blog/http2-r7/) Not sure if they are going to provide server pushes in the community version soon.

<comment><USER29> From your link:

>The "Server Push" feature defined in the HTTP/2 RFC is not supported in this release. Future releases of NGINX Plus might include it.

<comment><USER30> Does not invalidate his main point: the developers have a conflict of interest into releasing features for the open source version that competes with the paid version.

<comment><USER29> My reply wasn't intended to. I was pointing out that even the Plus version doesn't have Server Push. I don't expect it will ever be present in the open source version, barring a fork.

</comment></comment></comment></comment></comment><comment><USER31> Worth watching: [https://www.youtube.com/watch?v=CkFEoZwWbGQ](https://www.youtube.com/watch?v=CkFEoZwWbGQ) (HTTP/2: What no one is telling you by Hooman Beheshti @ Fastly)

tldr; H2 can be slower than H1.1 under degraded network connections. e.g. mobile connections with high packet loss.

</comment><comment><USER32> As I've said previously [1][2][3], you shouldn't PUSH with `Link re="preload"` for performance gains. You will likely run into TCP HOL Blocking or browser request race conditions. Instead send PUSH_PROMISES in the whitespace while the client waits for the TTFB.

[1] [https://news.ycombinator.com/item?id=14082636](https://news.ycombinator.com/item?id=14082636) [2] [https://shouldipush.com](https://shouldipush.com) [3] [https://youtu.be/GjWD1pOkxUk?t=1534](https://youtu.be/GjWD1pOkxUk?t=1534)

</comment><comment><USER33> Is the common pattern to support http2 at the highest level?

If a request goes through CDN/edge network -> Load Balancer -> nginx -> Python app, should http2 be enabled on all components or is enabling just on the CDN enough? Any pros/cons?

With HTTPS, usually enabling on the CDN is good enough for most cases.

<comment><USER34> That will only get you the protocol. All of the server push stuff for example, needs to be supported by the actual web server.

<comment><USER35> That's not correct - while any HTTP/2 capable servers along the path _may_ implement server push, the most important one is the closest server to the user (i.e. the CDN). The only requirement is that the intermediate servers must not strip out the server push headers/tags, so that the edge server knows what to actually push.

It's quite possible to have your own server provide HTTP/1.1 and still take advantage of server push, and this is a usecase supported by Akamai[1], Cloudflare[2], and I suspect other CDNs (can't find details) - you may get better performance using HTTP/2 on that intermediate link, but that's less likely to be because of server push.

[1]: [https://blogs.akamai.com/2016/04/are-you-ready-for- http2-ser...](https://blogs.akamai.com/2016/04/are-you-ready-for-http2-server- push.html) [2]: [https://blog.cloudflare.com/announcing-support-for- http-2-se...](https://blog.cloudflare.com/announcing-support-for- http-2-server-push-2/)

<comment><USER34> Ah yes. For static content your correct. I've got my head in dynamic stuff at the moment. Of course you're right.

</comment></comment></comment></comment><comment><USER36> Anyone combining h2o and node in interesting ways they'd like to share/blog- about yet?

</comment><comment><USER37> It's here, but current server-side implementations are super weak. rel="preload" is a hack. Only the few languages that have a native HTTP 2 push api are really here.

</comment><comment><USER38> and it's not as good as it could've be. the statefulness makes it really really really really really akward.

<comment><USER39> HTTP2 has been created for big players. When you are a small team, benefits from it are not that interesting. Plus mandatory TLS is making boostraping a project unnecessary hard.

<comment><USER40> If you mean bootstrapping a webservice-project, I don't believe it's hard in any way. With offerings like Lets Encrypts, it's incredibly easy and takes no more than 20 minutes.

<comment><USER41> Bootstrapping using letsecrypt requires an internet connection and a public facing service. I can say that 14 year old me, who had books, a pc and no internet would have been screwed by this.

<comment><USER42> If you're just using it locally, you can use a self-signed cert. Caddy generates one automatically by just adding "self_signed" to your config[1]. Or you can copy-paste a single OpenSSL or PowerShell command to generate one.

[1]: [https://caddyserver.com/blog/caddy-0_9-released#easy-self- si...](https://caddyserver.com/blog/caddy-0_9-released#easy-self-signed- certificates)

<comment><USER39> But this implies you can then deploy your caddy server. Which means a private server with root rights. Do you realize most devs don't even know server admin ? If you know the command line, you are not most dev. You are far, far away from the reality of enterprise software.

Tomcat and apache are still massively deployed. If you moved to nginx years ago, remember than it's still a new toy for a huge number of people. So caddy...

<comment><USER43> Caddy doesn't require root. You can easily use systemd/upstart/custom scripts to run as an unprivileged user.</comment></comment></comment></comment></comment></comment></comment>


Why 'The Enterprise' might be hard for your startup to break into. - <AUTHOR> Because we expect a lot of hand-holding.
You deliver a product.  It works, but wait: there is a problem.  Back to the vendor: we need to know how config X.
Now, it is not that I'm not capable of reading up on how to, say, edit $APP_ENGINE to be secure.  I have a development environment, I can play around with this setting or that.  I _can_.
I don't have _time_ for that.
I've got my normal workload, I've got projects, I've got a stable of applications to configure, babysit, fret over.  If I had to spend my time re-discovering how to make each and every one of those applications work, that is all I would be doing.
No.  What I need from my vendor is a cook book approach: if you have Solaris, do this.  Redhat, do that.  Windows, the other thing.  I need guidance, so I can hand the book to a junior SA and say 'follow these directions'.
If you, the vendor, can't provide at least that level of hand-holding ... it's going to be a rocky relationship. <comment><USER2> "You deliver a product"

Thats 90% of battle won. Problem is most "startups" don't even get to that point. The reasons are not as simple as just "I dont have time". Enterprise contracts are usually for many years and vendors have a very strong hold on enterprise clients. I support a multi million dollar vendor system at my employer and I can tell you even though most of the client "users" hate it, no one can even think about getting rid of it.

<comment><USER3> Besides which, if you've delivered a product to an enterprise then implicitly or explicitly they're paying for the support, in advance, possibly with agreed rates for "additional work", in their license agreement.

And although you can usually afford to lose them, small businesses can be demanding too.

</comment></comment><comment><USER4> People don't realize that part of building a product is documenting how to use it and building a support system for it. Enterprise demands documentation and support for everything. But people tend to think that their app is _self- documenting_. Nope. Never w has been. Never will be. You need to include support and documentation as part of the product and develop it alongside. You also need to price it accordingly.

</comment><comment><USER5> First hand experience selling Review19 - <http://www.review19.com> \- to the enterprise: It is extremely hard.

Always nice to have the right contacts and have favors waiting to be cashed in.

<comment><AUTHOR> One thing that soured us on startups was actually dealing with a startup.

Or rather, not dealing with them: they folded two years after we acquired the application. Leaving us with a very important tool written in a language nobody at our company knew.

This closed the door on future opportunity. "Nice product, will they be around in two years? Remember XYZ ..."</comment></comment>


Show HN: Microtonal piano keyboards with d3 + Web Components - <AUTHOR> https://micahscopes.github.io/all-around-keyboard/ <comment><AUTHOR> Hey there hackernews... I've been working on some web components so I can start blogging about music theory and its connections to mathematics. So I've come quite a ways in creating this flexible piano keyboard tool.

I'd love some feedback!</comment>


Woz Survives round one of Dancing with the Stars - <AUTHOR> http://abc.go.com/primetime/dancingwiththestars/index?pn=index

<comment><USER2> Woz also survived the fall of the Berlin Wall, both terror attacks in Bali, and Erlang Day at Hacker News.

I have an election in my part of the world this weekend. My prediction: Woz will survive that too.

</comment><comment><USER3> I think the Woz updates are great. Every culture needs some heroes. When one of your heroes is in the spotlight, talk that stuff up!

<comment><USER4> Could not disagree more.

Woz is a hero for his hacking, not for his obsession with practical jokes. The least of all things he could be admired for includes, murder, punching babies, and dancing with the stars.

Being in the spotlight, for no reason or for a shitty reason, is not to be voted up.

But then again, that's must my opinion.

</comment></comment><comment><USER5> Hacker: an enthusiastic home computer hobbyist; News: Information about recent events or happenings, especially as reported by newspapers, periodicals, radio, or television.

<comment><AUTHOR> Hacker: Woz was the 'original' hacker. News: He's on TV doing something that no other 'hacker' has done and survived.

</comment></comment><comment><USER6> As much as I love his enthusiasm and balls for going on the show, he was pretty terrible. Still good to see 'one of our own' up there! Kudos.</comment>


Should You Be Allowed to Prevent Drones from Flying Over Your Property? - <AUTHOR> http://www.wsj.com/articles/should-you-be-allowed-to-prevent-drones-from-flying-over-your-property-1463968981 <comment><USER2> I don't see the issue as being one of 'drones'. It is more one of 'cameras' and surveillance. No one cares if a med-flight chopper goes over your house at 1,000 feet, but as soon as you slap a camera on something it becomes an invasive tool, generally against your will. The real driving issue behind people buying drones is the camera. Take the camera off (or restrict it) and you'll see a lot of these issues disappear.

When Gov't puts a camera on a plane, there is an uproar (maybe not as loud as it should be, IMO). I'm sure some have issue with Google Earth. People just want to be left the F*uck alone. so as far as I'm concerned, anything within range of a 12-gauge is fair game (though i also have a big enough yard that it wouldn't effect anyone else.)</comment>


Quantum Tokens for Digital Signatures - <AUTHOR> https://arxiv.org/abs/1609.09047 <comment><USER2> Best abstract ever. Sadly, the quantum money scheme it's based on is insecure [1]. (IIRC the concrete version was broken earlier using quantum state restoration [2] -- shameless plug!)

The concept is extremely cool, though, and I hope they find an alternate construction for it. I suspect it will be very hard to base it on the Farhi et al. money [3] because that scheme has no secrets at all, which means that the public key doesn't naturally map onto it. On the other hand, it just might be possible to shoehorn it in by using the list of valid serial numbers as the (rather long but very compressible) public key. In essence, you'd be proving both possession and consumption of a token that has a completely known state that happens to be very difficult to generate. I'll sleep on it.

As an exercise for the reader, prove that their notion of "everlasting security" is impossible if the attacker is allowed to know the public key. :)

[1] [http://www.scottaaronson.com/blog/?p=2903](http://www.scottaaronson.com/blog/?p=2903) [2] [https://arxiv.org/abs/0912.3823](https://arxiv.org/abs/0912.3823) [3] [https://arxiv.org/abs/1004.5127](https://arxiv.org/abs/1004.5127) [and yes, I'm part of "et al"]

<comment><USER3> Hi Andy! It's Or.

We report on this attack in Section 7.2, and propose how to fix it in Section 7.3. We prove security based on some strong form of Virtual Black Box (VBB) obfuscation, and conjecture that it is secure (and provide some supporting arguments) under the assumption of indisitnguishability obfuscation.

Regarding your second comment: we definitely tried to base it on the "money from knots" scheme, and more generally, assuming arbitrary public QM scheme. We failed. "In essence, you'd be proving both possession and consumption of a token that has a completely known state that happens to be very difficult to generate." The procedure should depend on the document's content. There seems nothing that can be done other than "measuring in the standard basis" which is not document dependent, and furthermore, unclear whether it reveals any "hard to generate" information (given a public key - an Alexander polynomial - it's probably easy to find a knot with that polynomial. This is not the case in Aaronson & Christiano's construction). I hope this comment makes sense. If you have some ideas, I'll be more than happy to hear them.

</comment></comment><comment><USER4> The conversion into a classical check bit sounds kind of trivial, since the bank has to do the verification of the check. Just add some EPR pairs to the token and use them for teleportation. The measurement results of the teleportation are the classical check.

 _Edit_ : Ah, you can verify the signature without the bank. Instead of teleporting you sign a message like "I give this token to Bob. Bank please generate a replacement token for him because signing this message destroyed mine.".

<comment><USER2> > The conversion into a classical check bit sounds kind of trivial, since the > bank has to do the verification of the check. Just add some EPR pairs to the > token and use them for teleportation. The measurement results of the > teleportation are the classical check.

Be very, very careful doing things like this. For example, if the bank knows a secret, uses it to verify your token, and returns the token back to you even if it was invalid, you get a nice oracle to use to attack the bank's secret. See, for example:

[https://arxiv.org/abs/1010.0256](https://arxiv.org/abs/1010.0256)

<comment><USER4> The protocol from the paper already includes a 'verify token' function. I don't see how teleporting the token, vs using a more typical quantum channel like a fiber optic line, would increase any of the risks.

...

...

Maybe there are situations where an attacker could substitute their own EPR pairs into your token? EPR pairs aren't separately verifiable, so you wouldn't realize. And if the attacker intercepted the classical channel you used to send the measurement results for the teleportation then you would accidentally be sending the token to the attacker instead of the bank. Even if the attacker just listened in, and you or the bank realized the attack was happening when the verify failed, the protocol doesn't require checking with the bank before accepting a token and so the attacker can still spend the token.

<comment><USER2> What I meant was: be careful when applying an operation involving secrets to untrusted input. It's very easy to leak your secrets.

This doesn't matter with this scheme because verification doesn't use any secrets. (Well, sort of. If you're taking advantage of "everlasting security", then the public key is secret.)</comment></comment></comment></comment>