What If We Put Warnings on IoT Devices? - <AUTHOR> https://www.troyhunt.com/what-would-it-look-like-if-we-put-warnings-on-iot-devices-like-we-do-cigarette-packets/ <comment><USER3> In California, there is a law that basically everywhere (e.g. all apartment complexes) must have a sign that specifies that the compounds used on site can cause cancer or birth defects or whatever. But because the signs are pervasive, they are basically useless.

This feels kind of like that.

<comment><USER4> The problem I've always found with the California warnings is that they're so damn generic. There's nothing forcing companies to tell you what compound is harmful, where it is, or what it's used for..

A fishing sinker made from lead is pretty obvious when you see that warning. There's only one ingredient, lead, and it's obvious why it's harmful. But when you buy a complex product that says "this product contains chemicals known by the State of California to cause cancer or birth defects", the first thing I want to know is what the chemical is, the second is where it is in the product, and the third is why it's there. Nothing in the warnings makes manufacturers tell you any useful information.

<comment><USER3> Even if they did, would it matter? It would be some chemical term, like the one you see in an ingedient list, that is meaningless to most people.

And these are places, not products...with gardens. Even if they use organic pesticides, they probably still have to put up the warning.

<comment><USER5> > that is meaningless to most people.

Therefore no people should be allowed to know?

For what it's worth, I'm not in favour of California's labelling requirements either. But just because something is meaningless to the majority of the population doesn't mean it's meaningless to the entire population. And it is specifically the population that is interested in knowing it that finds it _least_ meaningless!

<comment><USER3> I didn't say allowed or not. Sure, you should know that there are 15 ug of theomacrotasium among a hundred other things in your environment, but then what? Information overload means our decisions can get worse, not better, when presented with more of it.

What would be more meaningful: certifications that act as abstractions for complex problems. Organic kind of acts like this already, and of course there are multiple federal certs for electronics. Having a functioning regulatory system as well as a working civil law system also help.

<comment><USER4> How about a warning that says "The battery in this cell phone contains an amount of theomacrotasium known to cause cancer if ingested."

That's a completely actionable warning. Don't eat the contents of the battery of your cell phone.

Or how about "This carpet contains formeldahyde, which is known to cause birth defects in pregnant women. Limit exposure to this carpet for a few days after installation."

That's a good warning. That tells me what I need to know, what the risks are, and how to mitigate it.

<comment><USER3> Hey, if it's just one thing, great! Now, how do you do that for a hundred things? Again, warnings work great for very small numbers of N.

We have to find a middle ground between "has chemicals that may cause cancer" and "a hundred specific chemicals in X quantities that may cause cancer." Abstraction is very necessary as a pragmatic solution, even if full disclosure makes sense as an ideal.

Heck, most places are just doing CYA, they have no idea what specific lists of chemicals their contractors use. For the IoT case, no one has any idea how their devices can be exploited, and merely admit the possibility of exploitation. But that is another issue.

<comment><USER6> Well, information on how to migitate the cancer risk is already a step forward.

If it is only harmful if ingested you know not to give it to your toddler. If it gives off toxic fumes while burning, well, stay away if you made a fire mistake. etc. The warning itself is pretty useless as it is.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I'm of the opinion that products which require a separate service to perform their advertised functions (i.e. a "cloud" service-- be it "free" with the product or subscription-based) should be clearly labeled as such. I know that I don't actually own anything that I can't self-host (or pay whoever I want to host it), but it's clear that most people don't. Public education on this front seems valuable to me (but, then, I'm one of those crazy people who believes in standards-based protocols and commodity hosting service).

<comment><USER8> Yes. There's this doorbell (400-1500 USD) that connects via internet to a central host, and then notifies you on your smartphone. Seems sort of a neat idea, but a house lasts several decades - is that startup and its server going to be around that long?

[http://www.doorbird.com](http://www.doorbird.com)

<comment><USER9> It also notifies that central host every time someone visits your home, and provides them with video and audio of that person. That doesn't seem like a "neat idea" at all.

"By visiting my front door, you agree to Doorbird's privacy policy"

<comment><USER10> Couldn't the same be said about all the other shitty cloud-connected surveillance cameras? Not saying that justifies it, just that this is a bigger problem then just those awful internet of doorbells

<comment><USER11> Of course it can be. It's all shitty engineering - making roundtrip through cloud with data that should only ever touch your personal devices.

</comment></comment></comment></comment></comment><comment><USER12> Simple rule: I buy it, I own it and it should not need an external service to operate. If it does then I'm not buying it.

None of those grafted on services for me, I really have yet to see anything that was so compelling that I would give up and consent to essentially renting a device and having an account with some service to make it useful.

That way you also don't need to warn anybody about the lousy security, I'm 100% convinced that those companies that are exploited are merely the tip of the iceberg, that for each of these there are a vast multiple that were exploited but never found out and that the remainder _also_ isn't as secure as they should be.

Running a secure service with devices in the field is hard, harder than I give most companies credit for and those companies that could pull it off (Amazon, Apple, Google, Microsoft and a couple of others) are usually the ones that I would trust even less with my data because of their ability to add it to the pile they already have.

<comment><USER13> > Simple rule: I buy it, I own it and it should not need an external service > to operate. If it does then I'm not buying it.

That's a good rule, but good luck opting out once most manufacturers no longer give you an option.

<comment><USER14> > That's a good rule, but good luck opting out once most manufacturers no > longer give you an option.

The irony is that this is Hacker News and so many people building those things hang out here. If we want to make a difference, we have to start making a difference.

<comment><USER11> Well, I strongly hope those many people involved in these things can feel the peer pressure here, and subsequently push for changes at their workplaces.

</comment></comment></comment></comment><comment><USER15> A little ironic: I tried to share this article on the #offbeat Slack channel at my work, but the automatic preview image Slack generated for it (from the top cover image of the article, which you can't really see most of, unless you view the image separately) is a (pretty NSFW) fake front-of-the-box for a "We- Vibe" IoT vibrator: "We can see how kinky you are". Not what I was planning to share with my coworkers. I'd recommend the author to change the cover image, or at least feature the whole image prominently front-and-center if that's really what they want to do, so people don't accidentally share it inappropriately like I did.

Good article though, and I definitely agree that these issues with IoT devices should be made more prominent.

<comment><USER16> I sort of wish Slack had a way to disable the preview image feature; I've run into this several times where a reasonable, work-safe article was processed into a picture not-so-suitable for Slack.

It mostly seems to be cases like this one, where the first image is concealed or contextualized in the article but treated like a normal header image by Slack. I think one that got me worst was a piece responding to someone else's content. Slack simply pulled the quoted text and picture at the top - <USER2> looked like sharing the original article, instead of a response to it.

<comment><USER17> An X shows up next to the preview/unfold when hovering, and allows you to delete the preview, at least in the full desktop app.

</comment></comment></comment><comment><USER18> It would be interesting to have a word for devices that is sort of like 'organic' for food.

It would indicate that the device is self-contained and has no connectivity.

<comment><USER19> > It would be interesting to have a word for devices that is sort of like > 'organic' for food.

> It would indicate that the device is self-contained and has no connectivity.

"Well-designed"?

<comment><USER20> >"Well-designed"?

Very good one.

A good candidate would have been "smart", but unfortunately it is already taken to mean the opposite.

<comment><USER21> I use "dumb". Sure, it sounds negative, but when used in context it's easy to understand for anyone that knows about "smart devices".

</comment></comment></comment></comment><comment><USER22> Z-wave and encrypted ZigBee controlled products work pretty well for in-home automation. Communication is encrypted between devices.

The problem can be the Z-wave/ZigBee controller which may very well require Internet and Cloud access to "phone home."

I avoid using IoT devices that I can't re-program or if nothing is available except some proprietary/cloud driven device I isolate them into their own little network space, so they can't attack the rest of the network or "phone home" unless I let them. Sometimes, that isn't possible and that's when 30 day return privileges come in real handy.

The ability to trace the packets coming off of most IoT devices is fascinating and sometimes scary. A lot of devices are like the recent OnePlus smartphones that record and send most everything to their "true master" the manufacturer of the device. At least, with a Oneplus you can fix that, by reflashing the phone.... which is not true of most IoT devices being sold today.

Have you noticed that BestBuy seems to only sell IoT devices that will "phone home?"

<comment><USER23> You gotta have a link for what you said about the OnePlus.

<comment><USER24> There was a post on /r/Android about it [1], but it seems like you can toggle this off by disabling device analytics in the settings.

[1]: [https://www.reddit.com/r/Android/comments/75ev0z/oxygenos_is...](https://www.reddit.com/r/Android/comments/75ev0z/oxygenos_is_collecting_a_lot_of_personal_info/?utm_content=comments&utm_medium=browse&utm_source=reddit&utm_name=Android)

</comment></comment></comment><comment><USER25> I read about proposal to prominently put expiration dates IoT devices, to show how long it will be servered with security updates. That could be interesting and also raise awareness.

<comment><USER26> Not really. Don't forget that for the longest time home routers shipped broadcasting the default SSID with no password. Now they come preconfigured with a locked-down SSID and password (though the management interface is still usually behind admin/admin or an equivalent). Security isn't on most people's minds -- it has to be built into the product from the get-go to get the largest reach.

</comment></comment><comment><USER26> It wouldn't change a thing, at least not in any meaningful fashion. People want the latest whiz-bang thing and these devices are marketed to those who have the barest understanding of technology.

</comment><comment><USER27> Interesting idea. I wonder how this would look like on commercial software packages :-) Yeah I'm an oldschooler that remembers buying software and games in actual physical boxes!!!

<comment><USER28> I sometimes buy hard copies of games simply because I dreamed of having a PlayStation or a gaming PC as a kid, but my parents couldn't afford either, so I never got the chance of collecting anything related to PC games. Unfortunately, most of them only come with a small piece of paper inside with a steam activation code written on it. I remember when games contained entire manuals in the box.

</comment></comment><comment><USER29> If there is such a warning, it should be along the lines of:

"This device is inherently insecure and could be remotely operated by persons unknown anywhere in the world."

<comment><USER11> Also: "This device collects data to be processed by the vendor and possibly resold to third parties."

Also maybe they should be honest and just write: "This device will stop working at any time the company behind it gets bought and/or decides to abandon the product line."

</comment></comment><comment><USER30> WARNINGS:

WARNING: This product warps space and time in its vicinity.

WARNING: This product attracts every other piece of matter in the universe, including the products of other manufacturers, with a force proportional to the product of the masses and inversely proportional to the distance between them.

CAUTION: The mass of this product contains the energy equivalent of 85 million tons of TNT per net ounce of weight.

HANDLE WITH EXTREME CARE: This product contains minute electrically charged particles moving at velocities in excess of five hundred million miles per hour.

CONSUMER NOTICE: Because of the "uncertainty principle," it is impossible for the consumer to find out at the same time both precisely where this product is and how fast it is moving.

ADVISORY: There is an extremely small but nonzero chance that, through a process known as "tunneling," this product may spontaneously disappear from its present location and reappear at any random place in the universe, including your neighbor's domicile. The manufacturer will not be responsible for any damages or inconveniences that may result.

READ THIS BEFORE OPENING PACKAGE: According to certain suggested versions of the Grand Unified Theory, the primary particles constituting this product may decay to nothingness within the next four hundred million years.

THIS IS A 100% MATTER PRODUCT: In the unlikely event that this merchandise should contact antimatter in any form, a catastrophic explosion will result.

PUBLIC NOTICE AS REQUIRED BY LAW: Any use of this product, in any manner whatsoever, will increase the amount of disorder in the universe. Although no liability is implied herein, the consumer is warned that this process will ultimately lead to the heat death of the universe.

NOTE: The most fundamental particles in this product are held together by a "gluing" force about which little is currently known and whose adhesive power can therefore not be permanently guaranteed.

ATTENTION: Despite any other listing of product contents found hereon, the consumer is advised that, in actuality, this product consists of 99.9999999999% empty space.

NEW GRAND UNIFIED THEORY DISCLAIMER: The manufacturer may technically be entitled to claim that this product is ten-dimensional. However, the consumer is reminded that this confers no legal rights above and beyond those applicable to three-dimensional objects, since the seven new dimensions are "rolled up" into such a small "area" that they cannot be detected.

PLEASE NOTE: Some quantum physics theories suggest that when the consumer is not directly observing this product, it may cease to exist or will exist only in a vague and undetermined state.

COMPONENT EQUIVALENCY NOTICE: The subatomic particles (electrons, protons, etc.) comprising this product are exactly the same in every measurable respect as those used in the products of other manufacturers, and no claim to the contrary may legitimately be expressed or implied.

HEALTH WARNING: Care should be taken when lifting this product, since its mass, and thus its weight, is dependent on its velocity relative to the user.

IMPORTANT NOTICE TO PURCHASERS: The entire physical universe, including this product, may one day collapse back into an infinitesimally small space. Should another universe subsequently re-emerge, the existence of this product in that universe cannot be guaranteed.

<comment><USER31> Just a sidenote, this is not original content and no source is mentioned. From a quick ddg search, this seems likely to be the original (1991):

[https://stuff.mit.edu/people/dpolicar/writing/netsam/warning...](https://stuff.mit.edu/people/dpolicar/writing/netsam/warning_labels.html)

</comment></comment><comment><USER32> I get the humor value, but isn't this just elitism from the software folks? Should we add similar warnings to websites of startup companies? Or during the installation of pretty much every single OS?

I saw some folks recommending punitive damages against IoT companies that ship this insecure junk. Well how about prosecuting software devs who introduce security vulnerabilities?

</comment><comment><USER33> Urm, you know, people got used to IoS. Telling other people how to make their choices is telling other people what to do. It's not always nice, and frankly, never actually works.

<comment><USER34> > It's not always nice, and frankly, never actually works.

It works and is profitable. Just ask any advertiser. And it is nice. It increases corporate profits. What could be nicer than that? /s

</comment></comment><comment><USER35> Sure, but Microsoft starts first with same label on Windows 10.

</comment><comment><USER36> If we follow Troy's line of reasoning, then we would need to add these warnings to phones, tv's, websites, credit cards -- just about anything that contains data about you.

I guess the main point the author is trying to make is that data can get compromised, and some people might not be aware of that.

Nothing new or groundbreaking.

<comment><USER19> > If we follow Troy's line of reasoning, then we would need to add these > warnings to phones, tv's, websites, credit cards -- just about anything that > contains data about you.

I honestly don't see a problem with _requiring_ this and enforcing it with the corporate death penalty. Need I mention Equifax?

</comment></comment><comment><USER37> We need UL listing for security on IoT devices.

</comment><comment><USER38> Ugh, hey Troy, thanks for making the post NSFW with that featured vibrator image...was it really necessary to make the point of the article?

<comment><USER28> I shared it on #general and nobody complained.

</comment></comment><comment><USER30> NOTE: This packet is sold by wait, not by volume. Packed as full as practicable by modern automatic equipment, it was delayed the full net wait indicated. If it does not appear full when opened, it is because contents have been compressed during shipping and handling.

[http://www.directionsforme.org/item/315569](http://www.directionsforme.org/item/315569)

<comment><USER8> weight...

> This package is sold by weight, not by volume. Packed as full as practicable > by modern automatic equipment, it contains full net weight indicated. If it > does not appear full when opened, it is because contents have settled during > shipping and handling.

Not entirely unreasonable note, but nothing to do with IoT</comment></comment>


Why China's Pollution Could Be Behind Our Cold, Snowy Winters - <AUTHOR> http://www.npr.org/blogs/goatsandsoda/2015/03/08/391056439/why-chinas-pollution-could-be-behind-our-cold-snowy-winters

<comment><USER2> More accurate might be, why the shit we are buying that is made in China could be behind our changing climate :)</comment>


Reshaping Cities: The Maglev Multi Elevator That Goes Up, Down and Left to Right - <AUTHOR> https://www.youtube.com/watch?v=pnxYW4IRBbw <comment><AUTHOR> I'd just like to point out that there is nothing "maglev" about this elevator at all. Wired's content team is pretty good but their subeditors are horrible!</comment>


Thoughts on Silverlight, Expression and Games - <AUTHOR> http://www.lostgarden.com/2007/05/silverlight-and-expression-thoughts.html

<comment><USER2> A lot can change in 5 years...

Silverlight as a platform doesn't look so rosy anymore and the "old school" downloaded app seems to have recaptured the lead thanks to the App Store and Google Play.

</comment><comment><USER3> It's interesting to read it 5 years later and observe how keynote presentation hype translates to long-term product evolution.</comment>


Getting the closest string match - <AUTHOR> http://stackoverflow.com/questions/5859561/getting-the-closest-string-match#answer-5859823

<comment><USER2> If you're using Python, difflib[1] is excellent tool for this:

        >>> get_close_matches('appel', ['ape', 'apple', 'peach', 'puppy'])
        ['apple', 'ape']
        >>> import keyword
        >>> get_close_matches('wheel', keyword.kwlist)
        ['while']
        >>> get_close_matches('apple', keyword.kwlist)
        []
        >>> get_close_matches('accept', keyword.kwlist)
        ['except']

Won't help you learn the algorithms, but if you need to get stuff done quickly, its an easy to use solution. I use it on the 404 page of a website to suggest what pages the user may have wanted (logging had shown that a lot of 404 and error pages were due to mistyped urls).

[1] <http://docs.python.org/library/difflib.html>

<comment><USER3> I tried it with the OP's sample input, and it favored Choice B - which seems entirely reasonable, since the last five words of the string are an exact match.

<comment><USER2> I agree, I think choice B is in fact the closest since the only word from the original string which is completely different is BROWN. FOX and COW have the O in common and the rest of the words match completely, while Choice C has two words which do not match at all.

At least as far as levenshtein distance goes, choice B is indeed the correct one, even if its not whats closest logically.

</comment></comment></comment><comment><USER4> I've had to do this a few times when building simple input normalization features. The trouble with scoring based on Levenshtein distance in that case is that it improperly penalizes phrases that are significantly different in length but similar in content.

For example, let's say I was searching a database of countries for "North Korea". In my list I have:

South Africa (LD: 6) Congo (LD: 9) Republic of Korea (LD: 11) ... Democratic People's Republic of Korea (LD: 28)

The actual answer (DPRK) will be pushed far to the bottom based on a naive ranking that uses LD.

The hack that's worked best for me? Rank based on the number of common two- character substrings between the source and target. It's simple, easy to build an index for, and has surprisingly great results. Its ideal use case is if you don't need to return a single absolute best result and can, say, present the three best to a human being and let them pick the match.

For the above search I'd get the following results using the two-character method:

Republic of Korea: 4 DPRK: 4 South Africa: 1 Congo: 0

<comment><USER5> What kind of thought process and/or experimentation led you to that algorithm?

<comment><USER6> The original code links to:

[http://stackoverflow.com/questions/653157/a-better- similarit...](http://stackoverflow.com/questions/653157/a-better-similarity- ranking-algorithm-for-variable-length-strings)

where there is more discussion, and links out to different string similarity metrics

</comment></comment></comment><comment><USER7> Fantastically thorough research, the kind of stuff I love to read. However I can't help but feel the much less impressive other answer "Use Levenshtein distance, here is the link." (paraphrased) is the better answer.

The long-winded answer goes in to a huge amount of details on really interesting pattern matching problems... but not really the specific problem mentioned by the question asker.

I'm glad for a world with Stack Overflow and other similar resources, because I find the long answer fascinating but if I were asking the question I'd much prefer also having access to the shorter, succinct, and also-correct answer beneath it.

<comment><USER8> He did far more than use Levenshtein distance. He is matching phrases not individual words.

He created different metrics based on Levenshtein distance, combined them using a weighted formula, and used an optimization algorithm to choose weights. And he provides great visualizations on how it worked.

I've tried several approaches to fuzzy string matching, and I'm impressed with his results and approach. I've bookmarked it for future reference.

</comment></comment><comment><USER9> _"I spent a day researching"_ \- when software engineers are given reasonable amounts of time, great results can occur.

<comment><USER10> At my last job, I was always boggled by the architecture team, who would lock themselves in a meeting for 8 hours and completely design some complex system with just their notepads and a whiteboard. I used to think they must be über geniuses who already know everything needed to come up with the optimal design and algorithms without needing to do any research. In hindsight, with a few more years under my belt, I now realize that what I mistook for knowledge and skill was mostly just hubris on the part of most of the team members (which also manifested itself in strong objections to any outside suggestion that there may be a better way to do things).

Challenging yourself to come up with better ways to do things is a great way to keep you learning, keep your work interesting, and improve the quality of your projects.

<comment><USER11> At my old job, the other architects and I would spend days researching on our own, then lock ourselves up for days in a glassed meeting room with nothing but a notepad and a whiteboard and lots of coffee as we debated all the various methods we'd discovered, pointed out the flaws in each others' approaches, picking one person's research of choice and seeing how far we could push it and when/where/how it would fail in an attempt to reach the best solution.... then do more research, get some developers working on prototypes, and repeat the whole thing all over again in two weeks' time.

All I'm saying is, it's not necessarily hubris. Too often you find half-baked or half-researched ideas that work in theory but not in the real world or the opposite (being things that work great but in practice could only ever be used in that particular application). You need to look into what transpired before and after those 8 hours meetings before coming to that conclusion (not saying you haven't).

<comment><USER12> Why wouldn't the architects work on prototypes?

In my experience, class distinction between "architects" and "developers" is a red flag. Actually, the term "architect" is itself a red flag. Come to think of it, even the term "developer" is kind of a red flag.

A lot of red flags :)

<comment><USER11> Oh they did. I was a developer/architect, did more developing than any of the developers and more architecting than any of the architects.

However, not all the "architects" (mind you, none of us actually used that term/title) were developers. We had the head of the QA in charge of testing and real world deployments on the team, as well as the lead interface designer. Their feedback helped to find a solution that would be both feasible and user friendly.

That's why I said the developers would work on the prototypes.

<comment><USER12> _mind you, none of us actually used that term/title_

What terms/titles did you actually use?

By the way, I didn't intend my "red flag" comment to imply that your particular setup didn't work well. There are lots of good variations. The sociology of software projects is fascinating.

<comment><USER11> Team Leaders. Even if a team was more smaller teams :)

C/C++ Team Lead, Web (C#/ASP) Team Lead, QA Team Lead, Design Team Lead, and The Boss (startup CEO).

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> This article talks about using levenstein distance to compare the similarity of two words/sentences another great algorithm for fuzzy string matching is <http://en.wikipedia.org/wiki/Metaphone> it basically compacts a word into its phonetic components and allows you to implement a google type did you mean.

<comment><USER14> Your answer would be much more comprehensible if you used punctuation.

</comment></comment><comment><USER15> Levenshtein distance is actually built into PHP : <http://php.net/manual/en/function.levenshtein.php>

</comment><comment><USER16> Postgresql has both Levenshtein and metaphone functions as part of the fuzzymatch extension. It's nice to have this when trying to match addresses.

</comment><comment><USER17> Someone should mention Norvig's spelling corrector.

<http://norvig.com/spell-correct.html>

Might as well be me! :-)

</comment><comment><USER18> I hope whoever posted that answer doesn't get shitcanned for posting sensitive information/their company's intellectual property/whatever to a public forum.

</comment><comment><USER19> I think this algorithm was covered by the final exam of CS101 of Udacity. Any udacitians come to confirm this?

</comment><comment><USER20> Answers like this are what make stackoverflow such an awesome resource

</comment><comment><USER21> the Levenhstein distance is at the heart of most opensource geocoders.

</comment><comment><USER22> Sounds like a task for Shingling man!

<comment><AUTHOR> What does this mean? I googled but still have no idea what you're talking about. Care to enlighten me?

<comment><USER22> [http://www.google.co.uk/search?q=shingling&ie=UTF-8&...](http://www.google.co.uk/search?q=shingling&ie=UTF-8&oe=UTF-8&hl=en&client=safari)

includes useful/relevant results like:

[http://nlp.stanford.edu/IR-book/html/htmledition/near- duplic...](http://nlp.stanford.edu/IR-book/html/htmledition/near-duplicates- and-shingling-1.html)

and from Wikipedia for a useful introduction:

<http://en.wikipedia.org/w/index.php?title=W-shingling></comment></comment></comment>


2012 Person of the Year: Barack Obama, the President - <AUTHOR> http://poy.time.com/2012/12/19/person-of-the-year-barack-obama/ <comment><AUTHOR> This was bound to happen.</comment>


Eventbrite Claims the Right to Film Your Events – And Keep the Copyright - <AUTHOR> https://www.eventbrite.com/support/articles/en_US/Troubleshooting/eventbrite-merchant-agreement?lg=en_US#8 <comment><USER2> So if I have an expensive multi-day conference and hire a well-known band for a conference at the end of the first day, they get to come in, record, and sell that as a live concert recording of that band and _I 'm_ on the hook for making sure they have all the rights to do so.

 _" You are responsible for obtaining, at your own cost, all third party permissions, clearances, and licenses necessary to secure Eventbrite the permissions and rights described above, and you represent that you have done so."_

Edit: major discussion thread [https://twitter.com/branaby/status/987206339268169728](https://twitter.com/branaby/status/987206339268169728)

</comment><comment><USER3> This is pretty standard for a contract with a company hired to record events with photography / videography. High school yearbook photos involve similar agreements. That is how photographers make money and limit liability. Just don't try to photograph the license plates at Don Corleone's daughter's wedding, OK?

<comment><USER4> But EventBrite were not "hired to record events with photography / videography". They were just involved to sell tickets. This is a vast over reach and should be removed.</comment></comment>


Spotify becomes a "total music management platform" - <AUTHOR> http://www.spotify.com/uk/blog/archives/2010/04/27/the-next-generation/

<comment><USER2> _"So how do you get the new version? We've started rolling out the update to users today, however, it will take us a number of days to get it to everyone."_

You get the updated version if you (re)download Spotify from the website.

<comment><USER3> Really? I tried, and I still got 0.3.23 (Windows).

<comment><USER2> You're right, doesn't work for everyone. Does seem to work to transfer the binary from someone else though.

Edit: Cnet reportedly has the new version: [http://download.cnet.com/Spotify/3000-2141_4-10912348.html?t...](http://download.cnet.com/Spotify/3000-2141_4-10912348.html?tag=mncol)</comment></comment></comment>


In Ben Bernanke's Memoir, a Candid Look at Lehman Brothers' Collapse - <AUTHOR> http://www.nytimes.com/2015/10/06/business/dealbook/in-ben-bernankes-memoir-a-candid-look-at-lehman-brothers-collapse.html?_r=0 <comment><USER2> Perhaps it is explained further in the book but what brings up questions more than anything is what prompted them to save AIG 2 days after Lehman's bankruptcy. A cynical person looks at the circumstances and says that AIG owed Goldman Sachs a ton of money on credit default swaps and since Hank Paulson, the Treasury secretary, was the former CEO of Goldman he was sympathetic to that situation.

The stated reason is often that AIG was so huge that it had to be saved to avoid disaster. Yet, this article seems to argue that the exact reason Lehman wasn't saved 2 days earlier was because it was just too large for the government to handle and that it didn't have the authority to do so until a month later when TARP was passed.

You have to wonder how candid memoirs by former officials are vs attempts to influence the historical record. Wikipedia says that Bernanke now advises Citadel which benefited to the tune of $200 million from the bailout of AIG.

<comment><USER3> Perhaps there's a more benign explanation for the AIG bailout. It was quicker and more efficient to give the money to AIG and let them pay their failing counterparties (all those crooked investment banks holding the credit default swaps) than it was to negotiate a bailout for each counterparty separately.

The paperwork for a first round startup financing is so complex and expensive a lot of investors can't afford a deal below a few megabucks. Can you imagine the paperwork to bail out an investment bank, multiplied by dozens and dozens, that had to get done in a few days.

Once the govt and the fed had decided to intervene, they needed to get it done. This got it done.

I'm afraid this is a case where justice for a few hundred bad actors took a back seat to righteousness for the whole economy.

<comment><USER4> Still no good reason for counterparties not even taking a minor haircut on CDS.

<comment><USER5> It encourages moral hazard.

<comment><USER4> Can you explain? If I know that I will recover less than expected if a counterparty defaults, I'm going to diversify my counterparties. That reduces moral hazard.

<comment><USER5> I'm agreeing. Not taking haircuts encourages moral hazard.

</comment></comment></comment></comment></comment></comment><comment><USER6> Going a little bit off on a tangent here but this article reminded me of how the gold price against the dollar has historically been set:

>Every morning at nine o'clock, [acting treasury secretary] Morgenthau; Jesse Jones, the head of the RFC; and George Warren would meet with the president over his breakfast of soft-boiled eggs, to determine the price of gold for that day. They began at $31.36 an ounce. The next morning this increased to $31.54, then $31.76 and $31.82. No one had a clue how they went about setting the price, although everyone presumed that some subtle analyses of the world bullion and foreign exchange markets went into the calculations. In fact, the choice of price was completely random. All they were trying to do was to push the price a little higher than the day before. The exercise brought out the juvenile in Roosevelt. One day he picked an increase of 21 cents, and when asked why, replied that it was a lucky number, three times seven.

Source: "Lords of Finance"

</comment><comment><USER7> When I was visiting Hiroshima in 2010, I stopped at a 'Japanese pizza' shop. It was nothing like actual pizza, but the staff and other customers in there were incredibly friendly, and we ended up trying to explain to each other where we from and what our hobbies were, among other things.

One of them was a man who sat down at the table next to me. We talked for a bit, and he explained that he worked at the Bank of Tokyo. I think he was trying to practice his English. He asked me 'What is the most famous bank in Canada?'

After thinking about the most famous Canadian bank for a bit, I told him it was probably Toronto Dominion (TD). Or maybe the Royal Bank of Canada (RBC). Then I thought for a moment and said 'Though, the bank most famous in Canada is probably Lehman Brothers.'

He had such a look of sadness on his face when I said that.

<comment><USER8> In Japan, the popular noun for the economic crisis is "Lehman-shock". A lot of weight is attached to Lehman - appropriately so, but it has the effect of sticking around in Japanese memory.

</comment></comment><comment><USER9> The Lehman brothers bankruptcy was a huge cluster fuck! I don't think most people realize just how close it came to stopping the entire worlds economy.

The problem with Lehman was that it was a large prime broker for many hegde and pension funds. That essentially means its a bank that holds the holding(cash, stock and bonds) of these funds.

When it went bankrupt in the US, what was expected was that each of the funds would pull out their holdings and move them to healthier prime brokers.

This would have the double bonus of removing one unhealthy company(Lehman) and at the same time propping up other healthier companies by having them handle the assest of the funds pulling their holdings out of Lehman( sort of like letting a bank fail and having deposits put into other banks.

Unfortunately the British financial regulators, who built London on a program of pretty much anything goes style regulation, woke up that day and decided that for the first time ever they needed to actually regulate and they declared Lehman's assets frozen, meaning that otherwise healthy funds (including pension, mutual, and hedge) now had no access to their own assets.

So now hedge funds can't trade, pension funds can't pay people and mutual funds can't allow redemption's and the other banks can't take in these assets to prop themselves up. The equity markets started to seize up as funds had no assets to trade.

The capital markets nearly seized up. Repo desks are the portion of banks that lend money to each other to ensure everyone has the money they need to operate, suddenly couldn't get money and weren't allowed to lend out money for fear of lending to a company who might go bankrupt.

Almost all large companies these days operator on this over night borrowing, using this to smooth out cash flows, similar to using a line of credit.

General Electric had 2 days of cash before they couldn't continue operations. We came really, really close to having the entire world stop working!

Andrew Ross Sorkin has a great book called Too Big to Fail that goes into this. House of Cards is also a great book on the 2008 crash.

The other big firm to go under in 2008 was Bear Sterns. If you like finance read "When Genius Failed" its the history of the rise and fall of Long Term Capital Management. In the book they detail how everyone except for Bear Sterns pitches in to bail out the fund. In 2008 Bear Sterns was the one who needed the bail out and the same people who pleaded with Bear to help with the LTCM bailout just turned their bask of Bear and let them go bankrupt and then get bought for $172 a share at the end of 2006 to being bought for $2 a share in 2008.

<comment><USER10> _General Electric had 2 days of cash before they couldn 't continue operations. We came really, really close to having the entire world stop working!_

People are debating this in other responses to you, but you're absolutely right. E.g.:[1]

       The Fed then purchased commercial paper issued
       by GE 12 times for a total of $16 billion.
       It bought paper from Harley-Davidson 33 times,
       for a total of $2.3 billion. It picked up debt
       issued by Verizon twice, totaling $1.5 billion.
       ...
       Verizon spokesman Robert A. Varettoni said
       that it was "an extraordinary time," adding
       that there was no credit available otherwise
       at the time.

Forget the debate of whether GE is an industrial or a financial, etc. Verizon was the 2nd largest telco in the USA, and if they needed money from the Fed then yes WE CAME REALLY REALLY CLOSE to having (much of the) world stop working.

If people are still not convinced, and they think that it was all financials, consider that McDonalds also needed money from the Fed.[2]

[1] [http://www.washingtonpost.com/wp- dyn/content/article/2010/12...](http://www.washingtonpost.com/wp- dyn/content/article/2010/12/01/AR2010120106870.html) [2] [http://www.asphaltandrubber.com/news/harley-davidson- federal...](http://www.asphaltandrubber.com/news/harley-davidson-federal- reserve-cpff-loan/)

<comment><USER11> I think the actual scenario was that there was no credit available at rates they were hoping to pay.

The fact that these situations happened 12 and 33 times suggests that management had some structural disability in facing reality rather than needing a short-term boost until they could go shopping for what they needed.

Just like shortages of profession X in geography Y, if you're not willing to pay the price...

<comment><USER12> "I think the actual scenario was that there was no credit available at rates they were hoping to pay."

Not on the traditional market from banks (i.e. commercial paper and repo) -- banks weren't lending money at any rate at the time as they really couldn't. Keep in mind that bank loans are basically "money printing", something that can't be done when your reserve ratio is already illiquid, as it was for most in mid-late 2008.

Individuals and holding companies like Buffet/Berkshire with actual reserves OTOH were giving high interest rate loans out (i.e. to Goldman), but those were bespoke negotiations.

</comment></comment></comment></comment><comment><USER13> If you remove the Goldman Sachs alumni connections, and look at it from the perspective that the Fed and Treasury really did not want to perform any bail outs or rescues unless absolutely necessary, then the whole thing (sort of) makes sense. The tentacles of AIG reached far and wide, to such things as insurance on commercial jet liners and if AIG had gone under, those planes would have contractually been not allowed to fly.

Yet it's incredibly difficult to believe the Fed and Treasury were completely against any bailouts, considering that 6 months before, a rescue package was offered to Bear Stearns, and the eventual purchase of Bear by JP Mogran was effectively guaranteed via the NY Fed's backing.

I want to believe it was for reasons other than influence by GS and their alumni, but that is a hard sell.

</comment><comment><USER14> Here is the Treasury's Assistant Secretary for Economic Policy on why the Fed bailed out plenty of other institutions, but did not bail out Lehman:

 _The reluctance of the Federal Reserve to lend to Lehman contrasts with its actions regarding Bear Stearns and A.I.G. The difference is that in the other two cases, the Fed saw itself as lending against reasonable collateral.

In the case of the Fed's loans that facilitated the acquisition of Bear Stearns by JPMorgan Chase, $29 billion of Fed money was at risk against a collection of Bear Stearns assets thought to be worth $30 billion. JPMorgan would absorb the first $1 billion if the value of those assets declined, providing a cushion ahead of the Fed (that is, ahead of taxpayers). Those assets were good in the end, with the Fed fully repaid with interest.

In the case of A.I.G., the Fed's loans were collateralized by the entire assets of the firm, based on the observation that A.I.G. had potentially huge losses at its unit that sold credit default swaps but the rest of the firm was a successful insurer. The latter parts — the rest of the company — provided the collateral for the Fed's initial loans, and eventually TARP funds were substituted for the Fed resources to provide the company with a better capital base rather than Fed loans. To be sure, it was hard to know in September 2008 that the value of the company would offset the potential losses in A.I.G.'s financial products division, but this turned out to be the case, with both the Treasury and the Fed turning considerable profits on their investments in A.I.G.

Such a successful outcome was simply less imaginable with Lehman than with either Bear Stearns or A.I.G. To all eyes, the problem at Lehman was one of solvency while the issue in the other two cases was liquidity. The Fed's actions on Bear and A.I.G. were thus appropriate in its role as a lender of last resort and the same with its caution at Lehman. Indeed, after Lehman had filed for bankruptcy, the Fed did extend loans to allow the firm's broker-deal subsidiary to function, but in bankruptcy these loans could be fully collateralized by assets within the brokerage subsidiary and not encumbered by obligations in other parts of the larger firm._ [1]

Basically, Bernanke knew that Lehman owned a bunch of worthless paper whereas firms like AIG, GM, Fannie Mae + Freddie Mac, Goldman, etc. owned actual valuable assets that they could use as collateral against taxpayer loans, and operated in profitable segments outside of risky IB and junk-debt securitization. He was tight-lipped about saving Lehman Bro's because he wanted the private sector to step up and do it themselves, and also so that they wouldn't know whether or not to expect handouts from the Fed down the road.

Although I disagree with Bernanke's decision to adhere to Keynesian economics during the economic crisis, valuing short-term stability over properly setting precedents for long-term prosperity and growth, I have to respect the man for his intelligence and thoughtfulness. Looking forward to reading his account of the crisis and why he made the decisions that created the economic environment as it currently stands.

[1] [http://economix.blogs.nytimes.com/2013/09/13/why-lehman- wasn...](http://economix.blogs.nytimes.com/2013/09/13/why-lehman-wasnt- rescued/)

<comment><USER15> FED does not put money at risk since unlike every other institution they create $ out of thin air

<comment><USER14> I'm tired of seeing this argument. What they are putting at risk is the faith of investors who trade in USD and the belief that the US economy is robust and healthy.

Creating $ out of thin air also creates inflation within the financial system, benefitting debtor institutions and hurting creditors. It also sets a precedent that the Fed will simply push the magic money button whenever something goes wrong, which affects market behavior.

The Fed pays a price every time it takes any action - you just have to think harder about what that price is.

<comment><USER15> If FED takes a position on their balance sheet that get's wiped out (very theoretical since cost of carry for FED is 0) This does very little to erode investor confidence compared to having full blown meltdown. In any case FED eventually increased it's balance sheet to almost 20% of GDP around 2012 so it might have being cheeper to bail out lehman brothers

</comment></comment></comment></comment><comment><USER16> I heard they wanted to see what would happen if they did NOT bail out a major institution, as part of the mix of reasons.

</comment><comment><USER17> Want the real story?

Inside Job - Charles Ferguson

</comment><comment><USER18> Lehman didn't fall, it was pushed, by Goldman Sachs. A veritable scapegoat, the meat of which was then eaten by the remaining players. Take a look at Henry Paulsons activities surrounding them for more insight. Financial terrorists, the bankers are.

<comment><USER19> When you're that overleveraged, a slight breeze is enough of a push to send you over the cliff.

Nobody set out to snipe Lehman, it fell due to its own incompetence.

<comment><USER18> So explain the difference between it and the other banks that were in the same state, but the others got rescued...?

<comment><USER20> The other banks _weren 't_ in the same state as Lehman.

</comment></comment></comment></comment><comment><USER21> Pure and complete lying. The government could have rescued Lehman Brother's. It would have created very bad problems with TBTF, but they could have rescued them. He's just trying to make it seem as if all the things they did were right by pretending he was wrong in this one narrow instance.

I'm not saying that what they did was wrong. But the guy here is just making up this pretend honesty to solidify all the choices he made afterwards.

Anyone who swallows this self serving nonsense is naive.

<comment><USER14> > It would have created very bad problems with TBTF

That's one of the reasons that both Paulson and Bernanke cite for not bailing out Lehman.

Technically the government can bail out whoever they want for whatever amount they want. Bernanke isn't dumb - he knows this. He is saying that the bailout was impossible from a cost-benefit perspective. Setting a TBTF precedent so early on and putting the garbage debt-profile of Lehman's underlying assets on the government's balance sheet were too risky to justify bailing the bank out.

I'm also willing to reserve judgement until I read the full book rather than a few quotes picked out by the NYT.</comment></comment>


Probability Theory — A Primer - <AUTHOR> http://jeremykun.com/2013/01/04/probability-theory-a-primer/

<comment><USER2> If this kind of stuff interests you, you should check out the lecture videos from Harvard's Stat 110: <http://stat110.net>. Prof. Blitzstein is hilariously nerdy but still has a very clear presentation style (he had kind of a cult following back when I took the course [1]). If video isn't your thing, the article here is basically the first few chapters of the textbook [2].

[1] <http://www.youtube.com/watch?v=iAwS7vzvLnY> <http://www.youtube.com/watch?v=TQvVLhWOiis>

[2] [http://www.amazon.com/First-Course-Probability-7th- Edition/d...](http://www.amazon.com/First-Course-Probability-7th- Edition/dp/0131856626)

</comment><comment> loup-vaillant For a moment I thought I would read something like Jaynes book, only simpler. Much examples and definitions, but not many ties to real world problems. It sounds quite arbitrary, in fact.

I think that a good primer needs to talk of probabilities as degrees of belief from the start. Then sketch the basic premises (Probabilities are encoded in real numbers, they abide common sense, and are consistent). Then go on to the [0, 1] interval and state the product and sum rules. We can gloss over Cox theorem, though we probably should stress that the sum and product rules are not axioms, but theorems based on the basic premises above.

And _then_ , one can talk about probability distributions, random variable and "probability space", in terms of the above.

From then, one would understand why a toss of a die yields a uniform distribution: not because the dice itself is "fair", but because we just have no idea whatsoever which side will come up, and don't have any reason to favour any hypothesis over the others. This distribution is not a property of the die, but a measure of our own ignorance.

</comment><comment><USER3> I just spent some time going though this blog - very interesting stuff, ranging from probability to code to topology to poker puzzles. Nice link.

</comment><comment><USER4> If you guys like probability and real world examples, you may wish to follow my research (and educational process) here: <http://www.shift8creative.com/posts/social%20media>

I'll be updating it with more geeky math and how it relates to social media in the future.

I'm not a statistician or mathematician, so I really appreciate this article and the links in the comments. Thanks!

</comment><comment><USER5> Does anyone know of a similar resource but with real world examples and perhaps R snippets? Would be great if I could practice two things at the same time.

<comment><USER6> R's not going to teach you about pre-measures, Carathéodory's theorem, or Radon-Nikodym. Break out the whiteboards!

(Then bust out R again when you want to play with stochastic processes and Brownian motion.)

</comment></comment><comment><USER7> Quality stuff right here.</comment>


The Mgmt configuration management language - <AUTHOR> https://purpleidea.com/blog/2018/02/05/mgmt-configuration-language/ <comment><USER2> I hope that the DSL evaluator can statically determine the oldest historical value that the code will use and avoid keeping unused historical values around?

FRP has a more general purpose way to do that kind of thing; a behavior can accumulate occurrances of an event, using a function provided by the user that takes the previous accumulation and adds a new value to it. This makes it easy to implement things like a rolling average, or to access historical values without keeping unnecessary ones around.

For example, here's a rolling buffer of size n in haskell's reactive-banana:

        rollingbuffer n event = accumB [] (fmap update event)
          where
            update v l
                | length l < n || null l = v : l
                | otherwise = v : init l

Of course, this needs a language that functions can be implemented in, not a special-purpose DSL.

</comment><comment><USER3> Language is a human invention allowing humans to express ideas. But language often masks the complexity of systems. If I told you "put the jar on the counter", there is a lot embedded in that language, but also a lot is missing, and it's up to the human to make decisions based on its life experience to figure out how to interpret that command in each circumstance. If you've had any experience at all in a configuration management DSL, you know that after a while, they all just suck to use.

And it's mostly the same problem for programming. With programming we're using language to express a complex set of interactions, but we still often fail to catch important distinctions, and most of our code does not learn from its past experience. Language can express complex ideas, but only if you have a brain that can re-interpret the language continuously and act differently in each case. That is the _hope_ of language-based configuration management, but rarely do you see a CM tool that is fed regular data solely so it can change how it makes decisions.

I think modeling languages like TOSCA are a much better design for expressing how to manage a complex system. By modeling the components and interactions, it's much easier to observe and test for various conditions in simulation. You can get incredibly detailed in modeling, and as such it's much easier to manage all the complex interactions, rather than hoping you are good enough at language to be able to express your ideas in a way that will be interpreted the right way by an otherwise rigid computer program.

</comment><comment><USER4> Mgmt looks awesome. It's just a shame it arrives so late, when stuff like containers and orchestration systems (read: Docker and Kubernetes) is taking over lots of responsibilities traditionally left to configuration management.

Not to say configuration management and traditional servers are going away within the next years, but it will probably hinder the popularity and growth of new tools like these. Sadly.

</comment><comment><USER5> I worked with James a bit at Red Hat. He's a smart dude and I look forward to following his progress with this post-RedHat life.

</comment><comment><USER6> So it is like React but for server management, and using it's own functional reactive language [1].

That's super cool! I definetly will keep an eye on it.

I would have preferred a more standard language, but I guess it's difficult given the problem space. Actually looks easier to understand than force feeding yaml into ansible.

[1] [https://en.m.wikipedia.org/wiki/Functional_reactive_programm...](https://en.m.wikipedia.org/wiki/Functional_reactive_programming)

</comment><comment><USER7> I eventually want to create a something similar to mgmt but with separation of concerns, the language would simply get compiled into an idempotent shell script that would use POSIX CLI tooling. The issue with doing this is I don't know many languages or compiler frameworks that compile down to shell (if any).

<comment><USER8> I had a sort of similar idea a long time ago. I even came across a few that do something similar to what you are describing.

<comment><USER7> Thinking about it more it could be simplified to just be an execline script and separate binaries for 'package', etc.

</comment></comment></comment><comment><USER9> So this is rediscovering Puppet's language. OK, and what's new in here?

<comment><AUTHOR> The language is inspired by Puppet, but reactive and statically typed. The configuration can depend not just on current, but on historical observations about the system, and is applied continually. I think the QEMU example in the article illustrates it well.

Edit: Puppet has what it calls "data types", but they are not checked statically.

      $ cat test.pp
      function f(Boolean $arg) >> String {
        5
      }

      if false {
        f("not a Boolean")
      }
      $ puppet apply test.pp
      Notice: Compiled catalog for foo in environment production in 0.03 seconds
      Notice: Applied catalog in 0.02 seconds</comment></comment>


Failing indiegogo, great product no interest. - <AUTHOR>

I thought I nailed the product, I thought I nailed the perks. Something simple and honest a colouring book for the holidays with kids pictures. No idea whats going wrong?<p>http://www.indiegogo.com/AChristmasColour?a=773583 <comment><USER2> There are many colouring apps, this is what is wrong, too many. And while the app is really nice and well done it does not add something special to deserve the founding. If you want to engage the users there are many better ways.

<comment><AUTHOR> Uhmm yes, I can imagine better ways to engage my audience. But I would disagree about there being too many colouring apps. User choice is very important. And not to be too egocentric, its does have a USP. No other app mixes paint in a real simulated way at the speed the A Christmas Colour can.

</comment></comment><comment><USER3> First, I liked the app (I have a 10 years old daughter, a little too old for this).

But I don't understand why do you need the funding? Can't you sell the app for $0.99 directly? What is the difference with Paint Sapiend: [https://itunes.apple.com/us/app/paint- sapien/id430608121?mt=...](https://itunes.apple.com/us/app/paint- sapien/id430608121?mt=8) ?

Why the name is AchristmasColour? Why in the video you are painting a dog instead of Santa?

Perhaps you can sell a app for kids with a basic set of ¿10? images (and maybe 1 additional image each month). And sell some additional packs of holydays images. For example, patio11 sells a BingoCardCreator software and he creates an especial site for each holiday with custom wordlist for that special holidays and he makes ~$3000 monthly. Perhaps a variation of this business model could work for this app.

<comment><AUTHOR> Excellent! Thanks for the feedback, much appreciated. Yeah I'm really not looking for the funding but more user content. I want to get toddlers drawings in there as some sort of xmas gift. I do agree the dog (actually a bear in a bear suit) could be a lot more Christmass'y. So I'll fix that and put some kids art in there too to illustrate the point. Yes, I am working on a fully featured app, though I do take a stance against inapp purchases for kids app's, its a good idea to add addon pack's.</comment></comment>


ASCII Art Signatures In The Wild - <AUTHOR> http://geon.github.com/Programming/2012/04/25/ascii-art-signatures-in-the-wild/

<comment><USER2> I really like the ascii art you found. reading through those it makes me wonder how many were hand done and how many people rendered.

I remembered that VLC has an ASCII video output.

[1] <http://wiki.videolan.org/Video_output>

<comment><AUTHOR> I filtered out over 75% of all signatures manually, since they were just generated text. I kept only the few that had something interesting going on.</comment></comment>


Strange seismic waves were picked up circling the globe on November 11 - <AUTHOR> https://www.news.com.au/technology/environment/strange-seismic-waves-were-picked-up-circling-the-globe-on-november-11-now-seismologists-are-trying-to-figure-out-why/news-story/7332f57a824432fd559bed6f2d8b7b1e <comment><USER2> Undersea landslide?</comment>


Iconinator for Sketch - <AUTHOR> Hey, everyone! Agis here, the developer behind Iconinator. I'm pumped to finally get this plugin out into the designer (and engineer) community. Iconinator is a Sketch plugin that provides a means to generate sets of App Artwork icons for the iOS Platform. Iconinator provides you with a tool (App Icon generator) that can be continually altered to your liking, in order to maximize on the workflow of your design work, getting an idea for the direction you're headed.
When it comes to using Sketch for App Icon design, Sketch itself provides you with the basics of what is needed, like a variety of artboard sizes for different icon sizes. But nothing within or outside of Sketch existed until now, that provided you with a means of generating app icon artwork in general and make your workflow much more efficient with a great UX.
The plugin itself is a WIP, as this is 1.0, but we'd love your feedback, questions and more to ensure we adapt and add based on your needs. Given that, feel free to send all of that our way. Looking forward to hearing your thoughts! <comment><AUTHOR> Here you can find Iconinator on Product Hunt [https://www.producthunt.com/posts/iconinator-for- sketch](https://www.producthunt.com/posts/iconinator-for-sketch)</comment>


Professors Regard Online Instruction as Less Effective Than Classroom Learning - <AUTHOR> http://chronicle.com/temp/email2.php?id=YtzQy6hv9pvrCkjqQsn6rsxB8pKftcqh

<comment><USER2> Imagine that? Who loses when online instruction wins? Professors. This has been a problem for innovation in education for decades. Established interests have a seat at the table, but not kids. Did anybody ask students about their experience? The beauty of online learning is that it is a supplement to core instruction that can be paced to meet the needs of students. As a replacement to AP english it probably is not as effective but when schools cut out German, what's a kid to do? Clay Christensen notes this in his new book, Disrupting Class - I'd encourage anyone thinking about innovation in education (especially as it relates to online learning) to read this important book.

</comment><comment><USER3> I'm not sure why it would have to take longer to prepare for an online class vs. a regular class. I had been taking online graduate CS courses through DePaul University and those were set up as regular classes with an online component being recorded. All the technology was there to view slide presentations, capture writing on a physical whiteboard, and recording of the lecture which made not only distance learning possible but reviewing the material possible for the regular students. All assignments were submitted online as well. The only time it seemed extra onerous to the professor was one time when the professor forgot to set the equipment to record and he had to redo the lecture for the distance learning students.

</comment><comment><USER4> Less effective at what? Job protection? My own survey suggests it is almost equally as effective

[http://nielsolson.us/STLHE020409/Olson_TimeValueOfStudyHabit...](http://nielsolson.us/STLHE020409/Olson_TimeValueOfStudyHabits_STLHE.pdf)

more context here: [http://nielsolson.us/Haversian/2009/02/some_current_thoughts...](http://nielsolson.us/Haversian/2009/02/some_current_thoughts_on_teach.php)

</comment><comment><USER5> There's not a shred of real data about learning outcomes in that article, only subjective opinions from decidedly biased sources. Also, there's no hint of a cost-benefit analysis. Online instruction may not be as good, but it should be much cheaper and save time, which could still make it worth it.

Universities are bloated bureaucracies full of people who can't be fired (for the most part), most of whom don't really want to teach.</comment>


Breaking the Cycle of Malware - <AUTHOR> http://blog.cloudflare.com/breaking-the-cycle-of-malware

<comment><USER2> Now I have to ask: how is the unsophisticated user (at whom these messages are apparently targeted) supposed to distinguish such alerts from actual malware itself that masquerades as anti-viral/anti-malware software? If anything it will establish a design that malware authors will be highly motivated to copy.</comment>


Google announces Helpouts - <AUTHOR> http://venturebeat.com/2013/11/04/google-helpouts/

<comment><AUTHOR> Is there any rhyme/reason to the title change? I'm interested in the discussion specifically related to how Helpouts will impact telemedicine, and healthIT culture, particularly as Google moves to federal licensure.

This is a huge game changer for the health innovation community.

And for those who don't think so, Google, Amazon and the like have been quietly rolling out new BAA to fall in step with fresh HIPAA omnibus requirements.

Edit: [http://www.emrandhipaa.com/emr-and- hipaa/2013/06/19/amazon-a...](http://www.emrandhipaa.com/emr-and- hipaa/2013/06/19/amazon-aws-will-sign-hipaa-business-associate-agreement/)

</comment><comment><USER2> What does HIPAA compliance in that setup mean? That any physician can discuss your disease with someone else? I am not a deep expert in HIPAA but I can hardly believe that this would be compliant, even if the name of the patient isn't disclosed.

I would be pretty upset if my physician discusses my diseases using Google.

<comment><USER3> (once upon a time I worked at a company that did health claim processing, so I had the standard course of HIPAA training, though this was about ten years ago)

I think you may be overestimating what the HIPAA privacy rule does. First of all, there are some automatic exceptions to the privacy rule, which allow information to be disclosed without requiring the patient's authorization.

One is an exception for law enforcement; we would occasionally get LEOs contacting us, and we had people to forward that to, who would make sure that they came with valid warrants/court orders/etc. to get the information.

The other is the broad "TPO" exception: that's Treatment, Payment and Operations. Which means your doctor can share information with other medical personnel, for example, and disclose details to your insurance company, and so on.

Finally, anyone else can get access so long as the patient has provided a written authorization to allow it. And generally anyone who's smart is going to get that authorization up-front.

HIPAA also defines the scope of "Protected Health Information", which is essentially individually-identifiable information relating to a person's past/present/future health, health care they have received/are receiving/will receive, and related payment information.

Now, I don't know offhand what exactly Google intends this service to do, or what steps they've taken to achieve compliance, but I don't see it as being particularly difficult to achieve.

 _I would be pretty upset if my physician discusses my diseases using Google._

Your physician likely already uses the internet, the telephone system and regular old snail mail to transmit/discuss information about patients, including you. Do you trust any of those more than you trust Google?

</comment></comment><comment><USER4> A fax machine can be HIPAA compliant, with your personal info just sitting in the output tray for anyone to take.

(and that is how many doctors transfer your info around)

HIPAA doesn't mean anything in reality, it is just a false sense of security.

<comment><USER5> I think regardless of the actual security HIPAA brings, it's a very good thing so that interesting services like remote psychotherapy can be performed without doctors risking themselves from a regulatory perspective.

<comment><USER4> None of that messy actually interacting with a human being in person eh?

<comment><USER5> Well, more like none of that messy traveling, possibly across the country (or countries) if, say, you're on a trip and want to have a session with a therapist you've had for years.

For what it's worth, I imagine that there are some people that have particular social aversions that might benefit from a remote session.</comment></comment></comment></comment>


Concatenative Programming: An Overlooked Paradigm in Functional Programmng [pdf] - <AUTHOR> http://mitarbeiter.hs-heilbronn.de/~herzberg/Publications/ICSOFT.2009.pdf <comment><USER2> One of the most powerful traits of concatenative programming languages is that implicit parameter passing through the stack makes it possible to factor any code fragment into a new word that can act as a textual replacement. Anywhere you repeat a sequence of operations, you can factor it out. Most languages that use explicitly passed parameters make this more difficult as you have to start worrying about scoping and the "shipping and handling" of passing in arguments and unpacking results into a local scope.

I've linked this many times before, but I'm reminded of "Thinking Forth"[1], an excellent discussion of application architecture. It specifically deals with the Forth programming language, but carries lessons that are applicable to almost any language. I think the reason it works so well is because you can easily demonstrate factoring with a very short piece of Forth. In a language like C or Java you would need comparatively more involved examples to demonstrate the same principles.

[1] <http://thinking-forth.sourceforge.net/>

</comment><comment><USER3> I love Factor, but this paper was frustrating to read. They use variables in their rewrite rules even though the whole point of the paper was that you don't need variables. So we never get to see a quotation function written in point-free style. The definitions are never used to actually prove or conjecture anything. Definition 3.4 is particularly content-free. Section 4 contained a 'cool' analogy with nothing to do with this programming style (4.1), 'research in progress' with no prototype (4.2), 'belief' (4.3), reference to 'an as yet unpublished paper' (4.3), and related work that should have been given its own section (4.4).

Perhaps it's not satisfied to be a position paper and the authors find themselves trying to show off novel research. I wish they'd resisted the temptation.

</comment><comment><USER4> My suggestion is that concatenative programming languages are nearly direct representations of Combinatory Logic in the same way that Lisp (in its purest sense) is a direct representation of the Lambda Calculus:

[http://github.com/raganwald/homoiconic/blob/master/2008-11-1...](http://github.com/raganwald/homoiconic/blob/master/2008-11-16/joy.md#readme)

</comment><comment><USER5> In the early 2000s I wrote 'Basil'. It started as a macro language on steroids soon turned into a concatenative), functional web language that I used to build a number of large commercial sites. It turned out to be amazingly expressive while surprisingly efficient (or, at least, efficient enough).

It was a cross between lisp and C (and a touch of REXX). Everything was a string, strings were manipulated and stuck back together and everything returned a value (or the empty string {}) even a 'for' and an 'if'.

A very simple example is this piece of code (that I hastily dug up) that would make a stripy table.

      for(x in args)
      {

        for(y in x)
        {
          if(stripey)
          {
            stripey=t
             y
          }
          else
          {
            stripey=f
             y
          }
        }

      }

Which on first view probably looks unremarkable until you see the invisible concats in all the white space and that the curly brackets all denote strings, even after the fors and ifs.

for instance:

      x = for(y in {1 2 3 4 5 6 7 8 9 10}){y}
      x

would return:

      12345678910

Just thinking about it has made me dig out the old code and take a look at it again. It had super-simple built in MySQL integration, an MVC-alike system of actions, objects & 'envelopes'. It automatically cleaned all CGI in and CGI out. It even had it's own NoSQL style database!

String concatenation was ideal for web programming (and a lot of other Unix tasks).

I'd love to return to it as it had a number of innovative features that I've yet to see in any other language (as well as a number I've seen appear since).

<comment><USER5> I've just spotted an error in my hastily edited code above... I'll leave it as an exercise for the reader :)

<comment><USER6> you got stripey=t and stripey=f swapped?

<comment><USER5> indeed!

(I've also got $dddddd instead of #dddddd. Still valid, assuming there was a variable called dddddd).

Because it was a web language html entities, colors and tags were all valid code (and just returned strings).

</comment></comment></comment></comment><comment><USER7> Interesting. Reminds me of the Cat programming language, which has term rewriting as well: <http://www.cat-language.com/>

<comment><AUTHOR> There are a bunch more, too:

      5th
      Enchilada
      Factor
      Forth
      Joy
      Onyx
      PostScript
      Raven
      Staapl

See the left sidebar on this page:

<http://concatenative.org/wiki/view/Concatenative%20language>

</comment></comment><comment><USER8> One powerful concatenative language is Factor: <http://factorcode.org/>.

The implementation rocks, although the creator is now also sucked by the Google Vortex.

</comment><comment><USER9> The APLs (APL, J, K, and Q) have a very strong concatenative element to them, as well.

</comment><comment><USER10> Please ignore this, it's the key to my big idea that will change the world.</comment>


Free SSL Certificate for Open Source Projects - <AUTHOR> https://www.globalsign.com/ssl/ssl-open-source/? <comment><USER2> This is a good initiative. Open source security projects could really make use of this. As a small example, the Gpg4win [1] project does not support HTTPS. Now whether this is due to a lack of funds or motivation is unclear, but a free SSL certificate might sound enticing and may motivate people to install them on their servers.

[1]. [http://www.gpg4win.org/](http://www.gpg4win.org/)

<comment><USER3> Why should this project support 'https'?

There are no user registrations taking place or sensitive informations. It's just binaries.

<comment><USER4> So no one can do a MITM attack and change the binaries as you download them.

<comment><USER3> Hm I trust the package integrity check[1], more than the SSL[2].

[1] [http://www.gpg4win.org/package- integrity.html](http://www.gpg4win.org/package-integrity.html)

[2] [http://www.thoughtcrime.org/blog/authenticity-is-broken- in-s...](http://www.thoughtcrime.org/blog/authenticity-is-broken-in-ssl-but- your-app-ha/)

<comment><USER5> So no one can do a MITM attack and change the SHA1 checksum, OpenPGP Key ID, file lengths and code signing certificate fingerprints as you download package-integrity.html?

<comment><USER6> You can do a MITM attack with certificates also. In fact NSA can do it by compromising any CA in the chain.

A distributed system that verifies identity would be much better. For example, namecoin based identities and checksums committed to the blockchain.

In fact, any self-signed public key system with a MAC distributed to many sources would be good enough. It doesn't have to have proof of work. The only requirement is that there are enough root CAs that you can't compromise them all.

This should be taken care of by browsers themselves!

I wrote this 3 years ago and since then nothing has been done: [https://news.ycombinator.com/item?id=2024164](https://news.ycombinator.com/item?id=2024164)

<comment><USER7> Agreed, CAs are an easily-exploitable smokescreen. Distribution is the way to go here. Seems like you could post your public key in the data section of a namecoin domain entry, no?

I think there is movement on this type of system, but it's slow because people don't realize just how insecure HTTPS is when CAs and the US government are involved.

<comment><USER6> Is there any work on a project like this that you know of?

<comment><USER7> I heard of a project a while back, but haven't seen it since and I forget the name. My understanding is that it's slow going. I think the best bet is, as mentioned, piggyback onto the blockchain somehow. Namecoin is probably the closest to getting this right.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> GlobalSign helped out Haskell.org and gave us a nice wildcard certificate quickly and easily. We really appreciated it.

</comment><comment><USER9> My company has been a globalsign partner for a little over 2 years. They are a great company and I am really happy to see them supporting the OSI. Nice to have partners that have the same vision when it comes to supporting the FOSS community.

</comment><comment><USER10> This is a cool initiative, but honestly, I would far prefer if open source projects started to implement DANE.

<comment><USER11> DANE is a good idea, but almost useless in practice since it lacks browser support (addons doesn't really count since nearly noone would install them)

Any ideas how we could ask Mozilla, Google, Apple and Microsoft to include DANE (and/or, maybe, TACK and/or Convergence) support into their browsers?

</comment></comment><comment><USER12> i build software accounting ... and the term open source.Are it freely downloadable or close company but open source to customer ? Previously i use ssl for testing speed the google spdy.. but performance not much different. __sorry not git hub account for downloadable accounting software but if wanted to real code and product and sell combine,access will be given.

</comment><comment><USER13> But aren't these like $1.99 through NameCheap?

</comment><comment><USER14> Startssl give them for free anyway

</comment><comment><USER15> Free SSL certificate for pretty much anyone: [https://startssl.com/](https://startssl.com/)

Why do people pay for SSL certificates

<comment><USER16> I do not recommend StartSSL.

Their $25 fee for revocation during the Heartbleed situation left many of their users who could not pay their fee vulnerable to attack. During these extenuating circumstances you would expect them to offer the revocation for a discounted price or even free, but they did not. I did not have any certificates registered with them and am very glad I didn't.

I imagine that there are a huge amount of StartSSL users who cannot pay the $25 per certificate and have no choice but to leave their server vulnerable. This was pure short-sighted greed on the part of StartSSL.

I'd strongly recommend [https://www.namecheap.com/security/ssl- certificates/comodo.a...](https://www.namecheap.com/security/ssl- certificates/comodo.aspx) It's a great price and their support has been excellent in my experience. If you have an open source project then the GlobalSign free certificate is hard to beat.

<comment><USER17> The $25 fee is a bad move but if you don't revoke your old (compromised) certificate, new connections would still be secure if you switched certificate, correct?

<comment><USER18> No they wouldn't, because the MITM attacker would simply use the old one. And the user wouldn't know. That's why the old one needs to be revoked.

</comment></comment></comment></comment><comment><USER19> Free SSL certificates are completely undermining Internet security. The whole point of certs is that you have a certificate authority that verifies the identity of the person you are issuing the cert to. By giving it away for free and doing zero of the backend work, all you're doing is creating a false sense of security and poisoning the ability to trust https.

<comment><USER20> As it stands, the majority of CA's do not verify any of this information, besides a very cursory email verification.

Exceptions would obviously include higher priced (OV/EV) certificates, which are no different cryptographically. Even the CA mentioned (GlobalSign) states this fairly clearly on their website.[1]

[1] [https://www.globalsign.com/ssl-information-center/types- of-s...](https://www.globalsign.com/ssl-information-center/types-of-ssl- certificate.html)</comment></comment>


Google court ordered to remove a bunch of websites (essays/termpapers) - <AUTHOR> http://www.chillingeffects.org/uncat/notice.cgi?NoticeID=22474

<comment><USER2> Is this illegal now? I tend to use the free editions of these sites (e.g. coursework.info) to help improve my essay writing (I don't actually hand them in). They're a great source of revision.

<comment><USER3> That's crazy. There is no way this is actually illegal, except that some of the individual term papers uploaded probably don't have the permission of their original authors.</comment></comment>


How to be original - <AUTHOR> https://m.signalvnoise.com/how-to-be-original-8877c5feeeb1 <comment><USER2> Cool, but the whole time I wanted to know what a skater's solution was to respiratory masks. I was let down. Even by the linked article.

<comment><AUTHOR> Me too. Me too. I scoured around for those, but couldn't find them. I'll try and reach out to the original authors of that research to see if I can drum some up.

</comment></comment><comment><USER3> It quotes interesting research and doesn't leave even a cursory link to it, expecting you to take them on their word.

<comment><AUTHOR> The very first sentence mentioning the research links to an article they wrote for further info.

[https://cl.ly/1Z2s1F2C0414/Image%202017-06-15%20at%203.02.04...](https://cl.ly/1Z2s1F2C0414/Image%202017-06-15%20at%203.02.04%20PM.png)

Here was the link: [https://hbr.org/2014/11/sometimes-the-best-ideas-come- from-o...](https://hbr.org/2014/11/sometimes-the-best-ideas-come-from-outside- your-industry)</comment></comment>