Schadenfreude - <AUTHOR> http://www.antipope.org/charlie/blog-static/2014/02/schadenfreude-1.html <comment><USER4> Rather than enjoying some shadenfreude (directed at MtGox and its users, not Bitcoin itself), I'm bewildered by the users and upset that their stupidity has allowed this predictable fiasco to happen.

Leaving the entirety of your BTC savings on an exchange provided and managed wallet is utterly insane at the best of times but to have done so with MtGox was just asking for it.

There are countless examples stretching back years that reveal MtGox was nothing more than a badly run website put together by a bunch of amateurs who took an early bet on Bitcoin and got lucky.

It's been obvious to anyone who performed even the most basic of research that MtGox would one day blow up spectacularly and there have been vastly better options available for a _long_ time now: [http://www.bitstamp.net](http://www.bitstamp.net), [http://www.kraken.com](http://www.kraken.com) and [http://www.coinbase.com](http://www.coinbase.com)

It's sad people have lost money but MtGox users largely have only themselves to blame. The writing's been on the wall since almost forever, better alternatives have been available for a long time now and, regardless of the exchange, they should never, ever have left significant chunks of their BTC net worth on a wallet not under their exclusive control. If you leave all your money on an exchange controlled wallet, you'll eventually end up like the poor chumps who bought penny stocks from the Wolf of Wall street: robbed.

I just hope the entire BTC ecosystem doesn't come crashing down in the fallout.

<comment><USER5> The problem is, we're not all equally engaged in the issue. Nor can we be - <USER2> can't simultaneously be an expert on every single thing that touches on my life. For better or for worse, we all cut corners - we all _need_ to cut corners on the caveat emptor thing; there's only so much time in the day - <USER3> some of us will be more successful at it than others.

So I'm not interested in blaming the victims here. What happened to them was perhaps predictable and certainly tragic, but like with the recent housing crisis it's important to distinguish between people who we _wish_ had known better, and people who actually did have a moral or professional responsibility to know better. If anything, I'm way more interested in blaming the relevant regulatory agencies for not being quicker to do their jobs by ensuring that Mt. Gox was behaving responsibly. Perhaps this whole crisis could have been averted if, 3 or 4 years ago when BTC first got big, someone had thought to knock on their doors and said, "Hey, I'd like to meet your accounting team."

<comment><USER6> > The problem is, we're not all equally engaged in the issue. Nor can we be - > I can't simultaneously be an expert on every single thing that touches on my > life.

That's understandable if someone just bought a couple bitcoins on a lark when they were under $100. But there are people who have lost a significant fraction of their net worth - those are the ones who really should have taken the time to know better.

<comment><USER7> I'd say anyone who bought a house at the peak of the housing market also lost a significant fraction of their net worth. Should we say those are the ones who really should have taken the time to know better? Consider _just how many_ people lost a significant fraction of their wealth and now have underwater mortgages. Do you see where I'm going here? Caveat emptor really does only go so far. That's why at the end of the day, there's supposed to be regulation, to ensure a safe place as possible for people to conduct their economic activity, realizing that risk is still unavoidable. There's acceptable risk, and then there's, oh-no-those-bankers-were-pulling-some-nasty-tricks-and-the- public-suffers risks.

<comment><USER8> While the expectation of accountability holds for banking and mortgages (and in that case was more or less ignored and hardly punished for it), does it hold for MtGox and Bitcoin, where the foundation is built on the lack of regulation?

<comment><USER7> If we want to look at it that way, perhaps we can ask what the Bitcoin Foundation was doing to make sure their members were more capable then? The fact is that if you want Bitcoin to go mainstream, someone somewhere has to be able to say that a service provider is reliable because normal laypeople can't be expected to make that judgment call wisely.

</comment></comment></comment></comment></comment></comment><comment><USER9> Stross's disdain for bitcoin is existentially disappointing to me. The man wrote the first book I read where distributed autonomous corporations transacted on their own behalf. The idea of python based corporations and legal denial of service attacks blew my mind.

Bitcoin is in some ways, the realization of that dream. But Stross is so dismissive of it--no points for trying.

His disdain seems to be on the basis that Bitcoin is deflationary, but I don't think that's an issue for 2 reasons. Primarily, deflationary assets can exist side by side with inflationary ones with no problem. The existence of gold does not cause everyone to abandon fiat. I would argue the deflationary aspect is an elegant game theoretical solution to the bootstrapping problem and gaining adoption in a double-sided market.

Secondarily, if you think of Bitcoin as a money transmission protocol, a lossy protocol would be a lousy protocol.

If the argument is about intrinsic value, a Bitcoin is a token that allows you to transact on the Bitcoin network and that is where it derives its value from.

<comment><USER10> > Stross's disdain for bitcoin is existentially disappointing to me. The man > wrote the first book I read where distributed autonomous corporations > transacted on their own behalf. The idea of python based corporations and > legal denial of service attacks blew my mind.

I wouldn't read "Accelerando" as some kind of utopia, considering the eventual outcome.

> His disdain seems to be on the basis that Bitcoin is deflationary

I think cstross' problem with Bitcoin stems from exactly the same things that libertarians find so great about it: it's not taxed and nobody is in command (no monetary policy).

The fact that a major actor turned out to be incompetent highlights another area in which bitcoin is deficient: it lacks regulation (though I'll agree that the real-life banking world could use much tougher regulation and enforcement of existing rules).

<comment><USER11> Look at how hard it is to get a tiny twist on an old idea like AirBnB or Uber legal in society. These are great things that the existing institutions that benefit from government enforced monopolies try and use the law to smother.

I view the lack of regulation as a feature, not a bug.

Bitcoin is an arena for innovation and new ideas for micro transactions and programmable contracts and probably lots of decentralized things nobody has thought of yet. Were it left to the existing financial regulators and institution, the pace of innovation would be glacial and they would prevent most new ideas from coming into fruition. Why would they want innovation? They have an effective monopoly and use regulations to prevent competition. And these companies know that if they take major risks and nearly kill themselves, that they'll almost certainly be bailed out by a magic bag of free money.

It's refreshing to see a financial system with no bailouts for companies that crash and burn.

<comment><USER12> I don't think anyone's fretting over Mt Gox crashing and burning here. It's all the individual BTC holders that it took with it. Yeah, they probably should have known better than to use a wallet service on a cobbled-together site like that, but you sound like you're suggesting that's sufficient reason for them to be out their money.

I emphatically disagree. A site, upon offering a wallet-type service has (or would have, in the presence of regulation) a fiduciary duty to its users to protect their holdings. ISTM that in the Wild West of Bitcoin, the situation is, instead, "Sucks to be you."

Maybe you're comfortable living in that world. I don't think that's remotely grounds on which to suggest that everyone else should be comfortable with the same level of risk.

<comment><USER11> > Yeah, they probably should have known better than to use a wallet service on > a cobbled-together site like that, but you sound like you're suggesting > that's sufficient reason for them to be out their money.

This was an expected outcome given what information was public about Mt. Gox, but I'm not suggesting that the users deserve to be out of their money.

The only thing I like about what happened is that nobody is going to bail out Mt. Gox's owners. And this incident should hopefully make people more cautious about where they store their money.

> Maybe you're comfortable living in that world. I don't think that's remotely > grounds on which to suggest that everyone else should be comfortable with > the same level of risk.

I'm also not suggesting that everybody else should be comfortable with any particular level of risk. The great thing about Bitcoin is that it's voluntary. Nobody is forcing another human to use it - you only do so if you feel it's the best avenue for you.

</comment></comment></comment></comment></comment><comment><USER13> For me the schadenfreude isn't about cryotocurrency versus fiat currency. To me the whole Mt. Gox mess is a reminder that there are enough bad actors in society to screw things up, and combine that with ineptitude and you have a recipe for this sort of event. Sure its just one event, but its also a small community, and the event is quite huge proportionally. And its not going to get better. Indeed, as the stakes get higher, it will get worse. Its a corrolary to the idea that DRM will always be broken, no matter how technically sophisticated you make it.

There are a lot of idealists in the anarcholibertarian community who talk about "violence" as something that can be taken off the table. And what this shows is that violence is endemic. You can't take it off the table, you can just think of different ways to manage it.

I would really like to not see Bitcoin regulated or protected, except to the extent it is used to subvert meatspace laws. I just want to see what would happen if, e.g., it wasn't considered a crime to "steal" bitcoin. Ideally, it should also be legal to mug someone in real life for his bitcoin, so long as bitcoin is the only thing taken. Because cryptocurrency or not, holding a gun to someone and asking them to hand over the bitcoins they have under their mattress is always an option. Then we could see if the community came up with non-government based solutions to these problems.

</comment><comment><USER14> "A _real_ currency with a fiscal policy and the backing of a state that could raise loans would be able to ride out this insult. It'd be extraordinarily painful, but it wouldn't devastate the currency in perpetuity."

What if Bitcoin _does_ recover? Would that change your opinion?

"But Bitcoin doesn't have a fiscal policy: it wears a gimp suit and a ball gag, padlocked into permanent deflation and with the rate of issue of new "notes" governed by the law of algorithmic complexity."

Out of curiosity, what's your opinion on crypto-currencies that aren't deflationary, or that rely on proof-of-stake rather than proof-of-work?

<comment><AUTHOR> _Out of curiosity, what 's your opinion on crypto-currencies that aren't deflationary, or that rely on proof-of-stake rather than proof-of-work?_

Now, _that_ sounds like a good idea. But at that point, we're talking about a cryptocurrency equivalent of real grown-up money, which would sort of kill its appeal to a lot of the folks who rant on about the evils of fractional reserve banking and hoard gold because they think it has some sort of mystical inherent value -- the sort of folks who invest in what William Gibson termed "Dunning-Krueger-rands".

<comment><USER15> Proof of stake is wildly anti-egalitarian: very literally, the rich get richer.

<comment><USER16> Just as interest in the conventional economic system is wildly anti- egalitarian: very literally, the rich get richer.

<comment><USER15> Agreed but a difference is that to profit by interest, you generally have to invest, take risks, and put the money to work.

</comment></comment></comment></comment></comment><comment><USER17> > A real currency with a fiscal policy and the backing of a state that could > raise loans would be able to ride out this insult.

My bitcoins in my personal wallet seem to be "riding out" everything just fine. What am I missing?

<comment><USER18> The Harold Wilson argument: the numeraire of your wallet is indeed unchanged. The value of what you can buy with it has fluctuated dramatically.

<comment><USER17> > The value of what you can buy with it has fluctuated dramatically.

In 2013 I would have agreed. So far in 2014, the price fluctuations have been modest(though different people have different tolerances for risk, of course)

</comment></comment></comment><comment><USER19> I find all the Schadenfreude over MtGoX disgusting, especially here. Sure, it was likely to fail, even more likely than your regular startup. And no, I have like 0.0005BTC.

But it's just sad. There is no joy to be derived out any of that.

Why would you want a BTC exchange to fail? Or even the whole currency?

What's the popcorn for? You're gonna laugh at posts written by people who lost money? Isn't there an endless stream of youtube videos where someone is getting hurt because of their stupidity and with higher production values (HD!) than a bitcoin forum?

A lot of commentary looks to me like a completely pointless exercise in signalling that amounts to "I don't like those libertarians/nerds who are pushing bitcoin. Dorks."

</comment><comment><USER20> I don't understand what deflation has to do with this. Did the inflationary nature (or "real" monetary policy) of the USD somehow prevent Madoff/MF global/etc?

<comment><USER21> No, but Madoff went to jail, Corzine narrowly avoided it, and MF Global is out of business. Governments can't prevent crime, but they do punish it.

The distinction here isn't inflation vs deflation, but flexible policy set by current leaders according to circumstances vs rigid policy set by past leaders according to ideology.

<comment><USER20> I still don't understand - what does a leader-based monetary policy vs a rule- based monetary policy have to do with businesses going insolvent? If the US adopted some rule-based monetary policy (e.g. NGDP targeting or just plain old "don't print more money"), would Goldman suddenly collapse like Mt. Gox?

I can see why external regulators ensuring Mt. Gox's solvency (or various blockchain based surveillance mechanisms proposed by a number of people) might have helped this situation, but that has little to do with a central bank altering interest rates and purchasing assets to tweak the money supply.

I just don't understand the connection between monetary policy and fraud prevention/bad accounting/etc. Explain like I'm a 5 year old child.

</comment></comment></comment><comment><USER22> Authoritarian statists are disgusting.

I get along with most ideologies but blaming "bitcoin" when really it's just a rulebook in cpp that a bunch of people voluntarily decided to run is somewhat silly and misguided.

</comment><comment><USER23> > "But Bitcoin doesn't have a fiscal policy: it wears a gimp suit and a ball > gag, padlocked into permanent deflation and with the rate of issue of new > "notes" governed by the law of algorithmic complexity."

I like that about the gimp. I don't want him to have compassion with MtGox or those who've been told to stay away from MtGox for over a year.

</comment><comment><USER24> the money first property is its volume should be controlled, preferably by human beings. It should avoid arbitrary effect such as the money coining belongs to an elite without any legitimity. Right now, bitcoin is a kind of speculative ponzi like bubble based on hash of hash which has no other value than the belief of the gullible :)

</comment><comment><USER24> If charles stross talks about money, I would like the opinion of neal stephenson :) (REAMDE was right about that too, and his opinion is that money should always be indexed on resources, so that the economy is monetary bounded the same way we are resource bounded.)

</comment><comment><USER25> What does having a fiscal policy have to do with anything related to this issue?

</comment><comment><USER26> Doesn't Charlie understand that real people got hurt here? I find it incredibly insensitive to post something like that.

Yes people should not have kept their stuff on Gox. People have been warning from Gox since 2011 (where has Charlie been there? Nowhere, ahyes, hindsight 20/20 and all that?).

But it happened, and now there's lots of angry and hurt people. Maybe not add insult to injury mkay?

<comment><USER27> I think there are a few kinds of hurt here.

There are people who have paper losses. Losing something you never had _feels_ bad, but it's not an actual injury.

There are people who put real money into a completely unregulated financial instrument via a completely unregulated financial company named after a trading-card game. Hopefully they took the advice that's in the first chapter of any book on money management and didn't bet more than they could afford to lose. If so, then there's no hurt.

There are the people who had no clue and took a bath. They did get hurt, and I feel bad for them, but they are incidental to the drama.

Then there are a lot of people who have been hyping BitCoin to the skies. Where they got hurt is in their egos. There, I think adding insult to injury is _richly deserved_. They are the people who led the clueless into this, so fuck them.

<comment><USER26> Point stands that are people who, for whatever reason, had assets on Gox. And they got hurt real bad. Although people have been trying to warn everybody off Gox FOR THE LAST FUCKING 3 YEARS, they still got there.

And insulting people who just lost real money in whatever fashion. It's just not considerate. But, if Charlie had been there, the last 3 years, warning people off gox, well, I would emphasize. BUT HE HASN'T. Stross the dickwipe wasn't there, trying to wean people off Gox. He has only opened his piehole today, because it's the hip talk of today. It's shameful and illconsiderate. It's also showing an astounding lack of empathy as to be basically psychopathic.

Stross is a walking talking psychopathic incident waiting to happen.

<comment><USER28> How much did you lose? I'm sorry you got burnt, but in the end, maybe it helps to think of the BTC and money inside that wallet as never having existed in the first place. After all, it never was possible to withdraw all of it in Dollars, so it really wasn't the equivalent money.

He has been warning about BTC in general and there are many, mainly speculative, aspects of Bitcoin that are prone to people getting burnt.

To very many people, this is no surpise. At this point, these people are quite grumpy for having been laughed at by some members of the Bitcoin community.

<comment><USER26> I didn't lose any on Gox, I've been warning people off gox since 2011, and more often since late 2012. Everybody who didn't have his head stuck in the sand saw this one coming from a lightyear away.

But that doesn't mean you should insult the people who did get hurt by gox. They lost $55m in fiat and 770kbtc (around $0.5b). They're in a bad place right now, and they're gonna learn their lesson without pissing from on high.

</comment></comment></comment></comment></comment><comment><USER29> I want Bitcoin to fail, because to me it's a scam designed to enrich the few who got in early. I understand that this is an important problem, but this is just a very long con.

I also will enjoy it when the investors who funded duds like Lucas Duplan (Clinkle) lose their entire investment and some degree of reputation.

I'm a regular reader of Valleywag and whenever some poser gets humiliated, I'm glad to see it.

You know what this is _not_? It's not _schadenfreude_ and I wish people wouldn't use that word.

I don't want these people (HN libertarians, top VCs, Silicon Valley scenesters and idiots) to suffer. I just _don 't care_ if they suffer. And, so it is that most of the best things for society right now hurt the people at the top of that world.

<comment><USER30> Business A has an idea but needs people to invest in it to take off. Group B takes a risk and invests in Business A. Business A succeeds and Group B is now enriched.

Replace Business A with Bitcoin.

>I wish people wouldn't use that word.

Why? There is no English equivalent and it represents a concept that is a well known phenomenon which has been subjected to scientific studies.

<comment><USER31> > Why? There is no English equivalent and it represents a concept that is a > well known phenomenon which has been subjected to scientific studies.

Psychological studies of the kind you're referring to aren't scientific. To be valid science, a study must test a theory, an explanation, but the class of studies to which you refer only describe. Sort of like saying, "The night sky is filled with little points of light," and calling it astronomy.

<comment><USER30> >Psychological studies of the kind you're referring to aren't scientific. To be valid science, a study must test a theory, an explanation

What the hell are you talking about?

[http://deepblue.lib.umich.edu/handle/2027.42/69046](http://deepblue.lib.umich.edu/handle/2027.42/69046)

Abstract: To test the _hypothesis_ that Schadenfreude, pleasure at the suffering of others, will result when an envied person experiences a misfortune

[http://psp.sagepub.com/content/28/7/953.short](http://psp.sagepub.com/content/28/7/953.short)

This study tested the _hypothesis_ that schadenfreude (or pleasure in another's misfortune) would be more closely related to resentment and a wish to correct a perceived injustice than to envy, and that sympathy would involve different processes.

[http://psycnet.apa.org/psycinfo/2005-11932-007](http://psycnet.apa.org/psycinfo/2005-11932-007)

The present study tested the _hypothesis_ that Schadenfreude, pleasure at another's misfortune, results when a misfortune is perceived as deserved.

[http://scholar.google.com/scholar?hl=en&q=Schadenfreude](http://scholar.google.com/scholar?hl=en&q=Schadenfreude)

</comment></comment></comment></comment><comment><USER32> Many with a vested interest in bitcoin are desperately performing damage control, evident in every thread about this issue.

Mt. Gox was a, har de har har, Magic card trading site (and ebay is for pez dispensers), and everyone knew that it was fatally flawed and fundamentally incompetent...that it was often cited as the go-to if you wanted to get into BC was just a lot of people who don't know what they're talking about, and everyone burned deserved what they got.

That it was by far the largest such site, and its metrics were canonical for BC was just an oversight, cheered on by ignorant people. And the fundemantal, basic malleability flaw, that still existed in the _reference client_ , was "clearly" documented in some wiki page somewhere in 2011.

And if another exchange falls, the excuses will appear immediately, making it evidently clear that all was known to any in the know long before.

</comment><comment><USER33> > and implemented in PHP!

Stop reading after that. For the millionth time, the problem is not in the language but on the programmer. So if it was made, by the same person, in RoR or <insert hipster language that makes your panties wet> it wouldn't suck?

<comment><USER34> > For the millionth time, the problem is not in the language but on the > programmer

In all honesty it does seem like a bad language choice. A choice more likely to be made by a bad programmer than a good one. At least in my experience it's the sub-par programmers who choose to do stuff in PHP and tout it as being a fantastic language. YMMV.</comment></comment>


Rapleaf looking for an amazing software engineer - <AUTHOR> http://blog.rapleaf.com/jobs/ <comment><USER2> Is it really necessary to work 70-80 hour weeks? How long do they want to keep it up?

What is the rationale behind long work hours?

</comment><comment><USER3> Good luck passing their technical test, they are crazy, borderline ridiculous.

<comment><USER4> How so?

<comment><USER3> It was just harder than any other technical test I've ever had. They asked things that not even the smartest people I know would have been able to answer on the spot (over the phone).

<comment><USER4> in the sense of esoteric knowledge, or the sense of difficult-to-figure-out?

Because the latter, ok, but the former, seems pretty retarded. I can always google esoteric questions.

<comment><USER3> It required me to go look up the Poisson distribution in my stats book.

<comment><USER4> ooh. yeah that definitely comes under the esoteric category.

<comment><USER5> the job ad says they are looking for someone to develop fraud-detection algorithms. the poisson distribution is not esoteric in that context.

<comment><USER3> Would you have known it without having to look it up? I'm just saying that there is some reasonable limit to what you should be expected to know offhand.

For our startup we tend to look a lot more for general intelligence and ability to figure things out fast rather than rote memorization of formulas. I know somebody who is smart can look that up in a book and figure it out.

I think it is totally fair that they expect somebody to have a good comprehension of stats for what they are working on, maybe even to be a stats master, but I know people who have majored in math and are very smart that would still have to look some of that stuff up.

I'm just saying that the style of the technical questions they asked may filter out some great candidates.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> Tempted, but I have no desire to move to SF.</comment>


Shining a Flashlight on Digital Holography - <AUTHOR> https://blog.lookingglassfactory.com/process/shining-a-flashlight-on-digital-holography/ <comment><USER2> Nothing to do with digital holography. It's a digital lenticular.

<comment><USER3> There's not really any clean definition of "holography" anyway, and it's a pedantic (and long-since lost) battle to insist that anything that calls itself "holographic" be achieved with wave interference.

Besides, they have a lot more in common than you think. This is recreating a (single-parallax) light field - it's not really doing anything different from an imaging perspective than a single-parallax direct-write digital hologram - only the physics differs. The technique is fully generalizable to full- parallax. Saying that it can't be a "hologram" because it doesn't use lasers is a little like saying a Tesla isn't a "car" because it doesn't burn gasoline.

</comment></comment><comment><USER4> how does this display work? The website shows a large glass lens block in front of the display and claims 45 different angles. Is it somehow sending the light of 1/45 pixels in different directions?

</comment><comment><USER5> TL;DR: It's a Vive Tracker bolted to a dummy flashlight, which controls a virtual light source.

The flashlight's power button is also an input device, wired to some Digital Input pins on the Vive Tracker.</comment>


Apache Kafka and GDPR compliance - <AUTHOR> http://www.landoop.com/blog/2017/12/apache-kafka-gdpr-compliance/ <comment><USER2> I'm interested in the right to be forgotten section but I'm confused as too what this article is saying...

How exactly do you "forget" the data on the logs?

One interesting solution that kills two birds with one stone is if you encrypt the personally identifiable information then delete the private key if there is a request to be forgotten. Has the added benefit of also effectively destroying the data in backup copies too.

<comment><AUTHOR> > How exactly do you "forget" the data on the logs?

If we think around the options, you can have either:

i) eventual deletion (log retention policy) ii) compacted topics (and push null values) iii) expensive re-processing of the entire log iv) expensive segment re-write operation

with each option bringing in a new set of challenges

<comment><USER3> Encrypt with a user specific key when the data enters the log. You can effectively delete all the user specific data by throwing the key away. No tracking down files or reprocessing necessary.

<comment><USER4> Is that acceptable within GDPR requirements?

<comment><USER3> [https://en.wikipedia.org/wiki/Crypto- shredding](https://en.wikipedia.org/wiki/Crypto-shredding)

[https://law.stackexchange.com/questions/23375/gdpr- general-d...](https://law.stackexchange.com/questions/23375/gdpr-general-data- protection-regulation-crypto-shredding-or-regular-delete)

I believe it would be, but IANAL.

</comment></comment></comment></comment></comment><comment><USER5> This "right to be forgotten" requirement is quite staggering in scope. Do I need to dig out all of my offsite tape backups and re-transcribe them to edit out my user's data every time a user requests to be forgotten?

Sibling comments mention a cunning scheme with encryption, but that doesn't really help an enterprise with an existing non-GDPR-compliant backup archive.

<comment><USER6> My understanding is that the GDPR "right to be forgotten" does not cover backups. There may be some exceptions, but there are practical limits on its reach.

<comment><USER7> I believe your understanding is incorrect. GDPR certainly includes storage and processing, both of which backups probably trigger.

Anyway, think about the spirit of the law, and then think about how that interacts with backups. If someone asks to be deleted from your system, you do so, and then you restore a backup with their data, you have clearly violated the intent.

<comment><USER8> Keep a log of deleted users and re-delete upon restore.

The GDPR contains exceptions for data storage for which it is infeasible or outside reasonable effort to delete individual records or you have legal compliances to uphold.

<comment><USER9> Isn't the log of deleted users subject to the GDPR then?

<comment><USER10> You can make a log of deleted users without it containing personally identifiable information, by just storing the IDs.

</comment></comment></comment></comment></comment></comment><comment><USER11> We've been doing a lot of thinking about how to support GDPR at Snowplow (Kafka and Kinesis but plenty of other logs and stores) - for our first phase we're just going to support irreversible pseudonymization of tagged PII:

[https://github.com/snowplow/snowplow/issues/3472](https://github.com/snowplow/snowplow/issues/3472)

For later phases, yes user-specific encryption of PII or hashing-with-lookup table are the way to go...

<comment><USER12> I wish you wouldn't call it irreversible. Every large public claim of that sort has proven false. Consider the Netflix case, where the separate IMDB review dataset allowed reconstruction of pseudonymous movie watching records.

These approaches may help with compliance, but they're the opposite of real safety.

</comment></comment><comment><USER13> I'm wondering if anyone thought about a GDPR extension that would include machine learning extension, ie. being forgotten meant "unlearning" to the model from my data (or relearning it on dataset from which my data was removed).

<comment><USER10> I would consider that already covered under the GDPR. Most machine learning approaches today make little to no guarantees about differential privacy and allow for (partial) extraction of the training dataset, which would mean that the request for deletion was never fully fulfilled.

<comment><USER13> So do you mean that GDPR allows for a request for removal from model or of there is an exemption from data mining results?

<comment><USER10> I think that it allows for a request for removal from the model unless it can be proven that the PII cannot be retrieved from the model.

(This should not be considered legal advice by me.)

</comment></comment></comment></comment><comment><USER14> With GDPR do we need to get consent from users before we can set any cookies?

<comment><USER15> GPDR itself doesn't specify cookies use. "Cookie law" is defined in ePrivacy Directive (2002/58/EC) which to be replaced by ePrivacy Regulation which is an addendum to GPDR. Actually, it's going to be much saner approach than the joke the current "cookie law" is:

 _" Simpler rules on cookies: the cookie provision, which has resulted in an overload of consent requests for internet users, will be streamlined. The new rule will be more user-friendly as browser settings will provide for an easy way to accept or refuse tracking cookies and other identifiers. The proposal also clarifies that no consent is needed for non-privacy intrusive cookies improving internet experience (e.g. to remember shopping cart history) or cookies used by a website to count the number of visitors."_[0]

To answer your question _" do we need to get consent from users before we can set any cookies?"_

It depends: yes for tracking cookies, no for others. How to tell them apart is another question..

0\. [https://en.wikipedia.org/wiki/EPrivacy_Regulation_(European_...](https://en.wikipedia.org/wiki/EPrivacy_Regulation_\(European_Union\))

</comment></comment><comment><USER16> >The right to be forgotten, becomes one of the hardest challenges because of data immutability. Apache Kafka does not support deleting records, and although some eventual deletion is supported, it requires

This always seemed like an incredibly toxic decision to me. It's one that crops up in all sorts of systems, large and small. What, none of these people /ever/ foresaw the need to delete some data?

<comment><USER17> It's not that simple. For example in my business, we may give some money to help someone "once in its life" (the law says so). Therefore, if the persons asks to be deleted, then we might not apply the law anymore because it'll mean we won't remember the decision... I think GDPR is a good thing, but at some point, in my business, those who write the laws will have to be aware of it (and the legal teams is miles away from the IT stuff, sadly).

<comment><USER8> The GDPR offers exceptions to the right to erasure, this mostly includes legal compliance (banks) or in the interest of legal claims or when data cannot be easily deleted as individual record. It also does not affect any non-digital documents which aren't filed. This is all laid out very thoroughly in the legal documents relating to this.

<comment><USER17> I must recognize I didn't read the section about removal thoroughly. But I did read the articles about the "categories of data" which are the major pain point right now 'cos it forces you to, well, find appropriate categories of data. It's a very interesting thing to do but, in my organization, it leads to many loooong discussions :-)</comment></comment></comment></comment>


Towards Sequoia OpenPGP v1.0 - <AUTHOR> https://sequoia-pgp.org/blog/2020/04/26/202004-towards-sequoia-v1.0/ <comment><USER2> Having an alternative implementation to GnuPG is a pretty important. Although many would argue against the use of PGP encryption for many use cases such as email, there are other use cases where PGP's ideas have no replacement.

For a specific example take signing git commits. Even fossil scm delegates this task to pgp. Personally keybase is the only project that may provide some form of alternative, but they do so by supporting pgp.

I definitely agree that PGP was and is no longer the correct tool for every use case as it sort out to be, but I find there are still pockets where PGP has no alternative. I'd be interested what HN's thoughts are on PGP for this specific use case and if there could be an alternative.

<comment><USER3> First, that's a limitation of git.

Second, it's easy to fake PGP: [https://boats.gitlab.io/blog/post/signing- commits-without-gp...](https://boats.gitlab.io/blog/post/signing-commits- without-gpg/)

Third, we're adding support to SoloKeys to do this using a hardware token: [https://github.com/solokeys/solo/issues/395#issuecomment-612...](https://github.com/solokeys/solo/issues/395#issuecomment-612059329)

We're also collaborating with [https://keys.pub/](https://keys.pub/) to make "sign/verify" use cases easily usable with a GUI for everyone. So I'd say there's hope?

<comment><USER4> Your linked post is not about faking PGP, it is about replacing PGP with his own implementation which supports only a subset of the PGP standard, the subset necessary to properly sign git commits.

</comment></comment></comment><comment><USER5> I still use PGP to encrypt files with secrets in them that I am sending to a known source, and I know it's still the base encryption for a few well known file servers. A new player in the market is welcomed.

<comment><USER3> Keybase's "Crypto tools" tab can do this, with "known destination" determined via social proof.

[https://keys.pub](https://keys.pub) is a re-implementation of this use case without the messenger/cryptocurrency baggage that some dislike about Keybase.

</comment></comment><comment><USER6> Here's the command line documentation:

[https://docs.sequoia-pgp.org/sq/index.html](https://docs.sequoia- pgp.org/sq/index.html)

I have to admit that it looks more digestible than gpg's. It seems it's still missing a way to manage OpenPGP smartcards like Yubikeys. Also, I can't see a way to manage an arbitrary set of subkeys for a given primary key.

I'm really happy to see an alternative to GnuPG, though. This looks promising.

</comment><comment><USER7> As someone who has been trying to use this library but haven't had the time to finish build integration to cross compile for all of my target platforms, I really wish it weren't using nettle, particularly as it is _also_ using openssl :(. Does rust not have useful cryptography libraries yet? Or couldn't it _just_ openssl?

</comment><comment><USER8> Off topic af: what does the picture on their landing page symbolize? [https://sequoia-pgp.org/](https://sequoia-pgp.org/)

<comment><USER2> [https://wellcomecollection.org/works/s8yb9bt9](https://wellcomecollection.org/works/s8yb9bt9)

</comment></comment><comment><USER9> Note that this project is unrelated to Sequoia Capital.

<comment><USER10> note that Sequoia Capital is totally unrelated to the Indian silversmith and inventor of the Cherokee syllabary

</comment></comment><comment><USER11> What's the threat model?

I've looked into the code. It uses Nettle's Curve25519 which seems to be implemented constant-time (assuming ECC mul is using "ecc-mul-g" from which is protected against cache timing attacks because the other ecc-mul implementations are using raw table access.)

</comment><comment><USER12> IMO, encrypted e-mail is a dead end. Latacora has a good blog post about it that I highly recommend: [https://latacora.micro.blog/2020/02/19/stop-using- encrypted....](https://latacora.micro.blog/2020/02/19/stop-using- encrypted.html)

<comment><USER13> Hmm, I don't really see any really convincing points, or workable alternatives that your linked article provides.

Nevertheless I would like to read more about this claim:

> It [PGP] was designed in the 1990s, and in the 20 years since it became > popular, cryptography has advanced in ways that PGP has not kept up with. > So, for example, it recently turned out to be possible for eavesdroppers to > decrypt messages without a key, simply by tampering with encrypted messages. > Most technologists who work with PGP don't understand it at a low enough > level to see what's wrong with it.

(I admit I am one of these technologists)

<comment><USER14> My best guess is that they really meant EFAIL but didn't want to actually mention it because EFAIL had nothing to do with any weakness in the OpenPGP standard or the GnuPG implementation. Instead it was a HTML email horror story where someone figured out how to forward entire decrypted messages using image links.

So just more pointless anti-PGP innuendo...

<comment><USER15> That is not in fact a good description of EFail, which was indeed caused by a failure both of the PGP protocol and of GPG, its reference implementation.

<comment><USER14> >...a failure both of the PGP protocol ...

No. There were some changes in the actual protocol document that came out of EFAIL but no actual changes to the protocol other than a depreciation that was happening anyway.

>...and of GPG, ...

This also seems to be false. GPG didn't have to change anything as the result of EFAIL...

>...its reference implementation.

Also false. OpenPGP does not have a reference implementation.

<comment><USER15> There were no changes in TLS after Bleichenbacher '98; instead, implementations just incorporated increasingly hacky workarounds. The PGP post upthread details the problems with the MDC, and the compounding implementation flaw in GPG that released unauthenticated plaintext to callers.

That MDC-era PGP remains the global standard, and that GPG continues to release unauthenticated plaintext to callers, just calls out further the impossibly compromised position PGP-based cryptosystems are in. You can try to do things like Sequoia that modernize PGP, but nobody in the installed base will be compatible with you, and the most popular and important "driver" of the protocol (again, GPG) is disinterested in mitigating the flaws of legacy PGP.

You can choose not to call GPG the PGP reference implementation, and there's no formal declaration anywhere saying that, but, it obviously is.

<comment><USER14> It is odd you bring up MDC in the context of EFAIL as the EFAIL researchers were unable to come up with an exploit that MDC did not detect. Even if you feel that GPG should of anticipated EFAIL that means that OpenPGP as a protocol was secure against EFAIL.

It is entirely accurate to say that EFAIL in not applicable to OpenPGP. You might not like MDC but you have to admit that EFAIL is not an example of any sort of a weakness in MDC.

<comment><USER15> I feel like we're not reading the same paper. The EFail paper I'm reading has a prominent chart showing which implementations it was possible to break the MDC in, and a section detailing how the MDC can be straightforwardly stripped off messages.

I note that you didn't respond to the rest of my comment.

<comment><USER14> Yeah, the paper did not claim that the MDC was in any sense "stripped off messages". They instead claimed that the mail clients ignored the MDC error.

>I note that you didn't respond to the rest of my comment.

The TLS stuff? We are just quibbling here. You have an irrational hate of things called PGP. Nothing I can say is going to change that.

Added: You are the one that brought up the MDC stuff but that really is beside the point. The problem here is with the leakage that HTML emails allow. EFAIL would still have nothing to do with PGP even if MDC did not exist.

<comment><USER16> Search the Enigmail forums for people who couldn't open their emails after GnuPG made MDCs mandatory (as a reaction of Efail). Especially people with old PGP keys were receiving non-MDC (SE) ciphertexts since ever. Mozilla's bugzilla (and a bank I heart of) were using non-MDC encryption. Reading the OpenPGP RFC, this is perfectly fine behaviour.

The Efail paper also describes a way to downgrade MDC ciphertexts to SE ciphertexts. This was known since 2015, but not addressed in OpenPGP.

So OpenPGP according to RFC 4880 allows SE packets with no MDC, and the MDC can be stripped away in a standard conforming way (tho with some guessing of bytes). If that isn't a problem with the OpenPGP standard, I don't know what is.

Just weeks after Efail, they made SE packets (those with no MDC) deprecated in the current RFC 4880bis. They were careful to not mention Efail, because _it wasn 't OpenPGP's fault_. For some, it's never OpenPGP's fault.

<comment><USER14> Interesting. I was not aware of this particular issue. Is this it?

* [https://dev.gnupg.org/T3981](https://dev.gnupg.org/T3981)

As mentioned in the discussion:

>Actually this is not related to the mentioned CVE because the issue we are talking about has not been tested by them.

So it appears that the EFAIL people could of prevented MDC from thwarting their attack if they had used a really old cypher. So, OK I will concede that EFAIL at least inspired a change in GPG. My original statement that GPG required no changes as a result of EFAIL is still correct as stated though.

We are still quibbling here. I don't think that S/MIME was deficient in any way with respect to EFAIL either. So all this discussion about MDC is still pointless to me.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Simple viral marketing with Twitter - <AUTHOR>

At the recent Barcamp Leipzig I heard about a simple approach for marketing with Twitter. Instead of the classic "recommend this site to friends" email form, use a link to twitter with a prefilled status message. That way it is much easier for people to spam their friends about your web site, and they don't have to give you their friend's email addresses.<p>Self-Plugging Example: http://twitter.com/home?status=Just+read+Bjoern%27s+Blog+http%3A%2F%2Fblog.blinker.net+%23bjoernsblog (at least it won't be made into a real link). <comment><USER2> I don't think twiiter shoudl be used to encourage spamming :)</comment>


Ask HN: For small dev shops when or how do you tell employees what clients pay? - <AUTHOR> <comment><USER2> Why is this a question, i.e., why wouldn't you be sharing all the details with everyone as soon as you have it?</comment>


Show HN: Books2Rec – Machine Learning Meets Reading - <AUTHOR> https://books2rec.me <comment><AUTHOR> More about this project can be found here: [https://github.com/dorukkilitcioglu/books2rec](https://github.com/dorukkilitcioglu/books2rec)

</comment><comment><USER2> Very nice! I obviously need to invest a bit more effort into rating books I've read, though.

<comment><AUTHOR> Yes, sadly not many people keep track of their books on Goodreads and even less rate them. However we did add two methods to get recommendations by simply selecting one book you enjoyed. The first way uses all of the other user's ratings together with book features and the other simply finds all the most similar books to the one you selected (using description summary, tags, and genre)</comment></comment>


Three Years of Metal (2019) - <AUTHOR> https://zeux.io/2019/12/12/three-years-of-metal/ <comment><USER2> I use it for a fairly simple task and I often run in to compiler bugs. Const buffers over 64k get truncated on NVidia gpus, using half4 broke the optimizer on some iMac gpus, and sometimes I have to split up functions until the optimizer on some gpu I don't own stops doing crazy things. I am terrified of writing MSL because of this.

<comment><USER3> Yeah, to add to that, I've hit bugs in blending where certain blend modes just don't work and silently render transparent black. Also, the Metal debugger crashes most of the time and tells me "file a Radar". I'm likewise dealing with reported segfaults on hardware I don't own. And there are missing features: timer queries, for instance, aren't really supported and you have to hack them up in an unreliable way, useful extensions supported by the hardware like conservative rasterization are unavailable (Vulkan has this problem too), etc.

I suspect things are better on iOS, but Metal has not been a great experience on macOS for me. There's an argument to be made for proprietary APIs if they're _better_ than the alternatives, but not if they're _worse_...

</comment></comment><comment><USER4> After reading the title I was really looking forward to some musical discussions on HN... :)

</comment><comment><USER5> While Im not a graphics pipeline dev, Im curious given the foundational nature of these technologies like DirectX, openGL and Metal, besides platform lock in and bug/performance counting, do these technologies provide any lasting benefit outside of the inherent peculiarities of a given OS/graphics card combination?

At what point should this have been built into the OS vs creating a monopolistic os-driver-driven platform. Or as an improvement remove the OS from the picture entirely if possible.

Creating your own graphics pipeline based on OS and graphics card permitted integrations sounds alot like creating a proprietary bitcoin wallet for oneself.

<comment><USER6> >do these technologies provide any lasting benefit

While there are downsides to having these different targets, there are upsides as well. For instance on any given platform, be it Metal for IOS or DirectX for Windows, the "native" options has usually been the most bug free and best performing option. It helps when you can build something like DirectX and know that this will only run in windows. Making something cross platform like Vulkan is more effort and complexity.

The other benefit is you have different groups exploring this space. While things might have been simpler in some ways if there had only been OpenGL, OpenGL might not have been forced to evolve as much as it did. vulkan might not have happened as soon as it did, etc.

<comment><USER7> Making a graphics API cross-platform is definitely not where complexity comes from.

Apple wants to have vendor lock-in, but that is not news.

<comment><USER8> Obviously the statement is about building your application using a cross- platform library like Vulkan or OpenGL versus using a native library like Metal or DirectX. This has nothing to do with Microsoft or Apples vendor locks.</comment></comment></comment></comment>


Run Python Bytecode in Your Browser - <AUTHOR> https://github.com/pybee/batavia

<comment><USER2> As someone who was at the pycon au sprints watching this come together and hearing Russell talk about the potential uses that motivated him, I'm excited to see this continue. I'm hoping to find a little time to try and work on it in the coming week.

Pypy.js has demonstrated Python JavaScrip interoperability and DOM integration, so there's no reason this project can't have similar features. We can ship useful chunks of server side Python to the browser and stop duplicating our efforts.

</comment><comment><USER3> Another way to do this would be to use numba package to generate LLVM IR from Python bytecode (it supports a rich set of instructions including numpy stuff, has type inference, etc), and then run it in the browser via emscripten, with some adjustments to the IR if required.

Quick googling yields a related blog post: [http://cyrille.rossant.net/numpy- browser-llvm/](http://cyrille.rossant.net/numpy-browser-llvm/)

<comment><USER4> Numba is not a general-purpose Python compiler, and does not handle (or intend to handle) many basic Python statements (like class or function definition) at all: [http://numba.pydata.org/numba- doc/0.20.0/reference/pysupport...](http://numba.pydata.org/numba- doc/0.20.0/reference/pysupported.html)

And most general-purpose Python (e.g. dicts, most builtins, etc...) require running in "object mode" which is not standalone, it calls into the CPython API and thus requires an underlying CPython runtime.

So no, numba is not an other way to do that. shedskin[0] might be though.

[0] [https://github.com/shedskin/shedskin/](https://github.com/shedskin/shedskin/)

<comment><USER5> Actually many more general constructs like lists and class definitions are on the roadmap or in open PRs.

<comment><USER4> Point remains that Numba doesn't intend to be a complete general-purpose Python compiler.

</comment></comment></comment></comment><comment><USER6> The documentation is pretty minimal here, so I'm wondering if this has anything to do with WebAssembly[1].

If not, wouldn't it make more sense to target WebAssembly?

1\. [http://arstechnica.com/information-technology/2015/06/the- we...](http://arstechnica.com/information-technology/2015/06/the-web-is- getting-its-bytecode-webassembly/)

<comment><USER2> The goal is being able to pickle something like a Django template and then run it client side. It's based on past work that has shown its possible to build bytecode interpreters without much code. It's not as much about targets and cross compilation or anything like coffeescript. It's about trying to run existing Python bytecode with as little code as possible.

<comment><USER6> I'm not sure I was clear or understand what you're saying. It sounds like you mean this:

Python source -> Python bytecode -> Python bytecode interpreter -> JavaScript engine -> browser

And what I meant was this:

Python source -> WebAssembly bytecode -> browser

Does that make sense? It's not like there's a bunch of Python bytecode sitting around that we can't possibly re-compile. It makes a ton of sense to create a Python-to-WebAssembly compiler, but very little sense to spend time adding functionality to a browser that's specific to Python bytecode.

</comment></comment></comment><comment><USER7> We (PLASMA @ UMass, [http://plasma.cs.umass.edu](http://plasma.cs.umass.edu)) have a project with similar aims that is somewhat further along: Ninia ([https://github.com/plasma-umass/Ninia](https://github.com/plasma- umass/Ninia)). Ninia is a Python bytecode interpreter in TypeScript. It is also being integrated with Doppio, a runtime system for running "conventional" programs inside the browser ([https://github.com/plasma- umass/doppio](https://github.com/plasma-umass/doppio)), also from our group. DoppioJVM uses Doppio to run JVM bytecode in the browser ([http://www.doppiojvm.org/](http://www.doppiojvm.org/)). For technical details on both of these, see our PLDI 2014 paper: "Doppio: Breaking the Browser Language Barrier", by John Vilk ([https://jvilk.com/](https://jvilk.com/)) and Emery D. Berger ([http://emeryberger.com](http://emeryberger.com)): [https://dl.acm.org/citation.cfm?id=2594293](https://dl.acm.org/citation.cfm?id=2594293) (@ ACM), [http://people.cs.umass.edu/~emery/pubs/doppio.pdf](http://people.cs.umass.edu/~emery/pubs/doppio.pdf) (non-paywall), video presentation here: [https://vimeo.com/106106738](https://vimeo.com/106106738).

 _Abstract:_

Web browsers have become a de facto universal operating system, and JavaScript its instruction set. Unfortunately, running other languages in the browser is not generally possible. Translation to JavaScript is not enough because browsers are a hostile environment for other languages. Previous approaches are either non-portable or require extensive modifications for programs to work in a browser.

This paper presents Doppio, a JavaScript-based runtime system that makes it possible to run unaltered applications written in general-purpose languages directly inside the browser. Doppio provides a wide range of runtime services, including a file system that enables local and external (cloud-based) storage, an unmanaged heap, sockets, blocking I/O, and multiple threads. We demonstrate Doppio's usefulness with two case studies: we extend Emscripten with DOPPIO, letting it run an unmodified C++ application in the browser with full functionality, and present DoppioJVM, an interpreter that runs unmodified JVM programs directly in the browser. While substantially slower than a native JVM (between 24× and 42× slower on CPU-intensive benchmarks in Google Chrome), DoppioJVM makes it feasible to directly reuse existing, non compute-intensive code.

<comment><USER8> Looks like a version of the paper without the ACM paywall is at [https://web.cs.umass.edu/publication/docs/2013/UM- CS-2013-02...](https://web.cs.umass.edu/publication/docs/2013/UM- CS-2013-026.pdf).

<comment><USER7> That's actually a much older version that is hopelessly out of date. I'll add a non paywall link.

<comment><USER7> [http://people.cs.umass.edu/~emery/pubs/doppio.pdf](http://people.cs.umass.edu/~emery/pubs/doppio.pdf)</comment></comment></comment></comment>


Intel CEO Resigns - <AUTHOR> https://newsroom.intel.com/news-releases/intel-ceo-brian-krzanich-resigns-board-appoints-bob-swan-interim-ceo/ <comment><USER2> Dupe. Discussed earlier:

[https://news.ycombinator.com/item?id=17364899](https://news.ycombinator.com/item?id=17364899)

</comment><comment><USER3> A relationship? you don't think that Meltdown / Spectre didn't have something to do with it as well?

I would hope that Meltdown / Specture / the recent TLB Cache yeah Intel would be in a world of hurt over that.

2 Adults should be able to get it on without a problem

<comment><USER4> Company policy

<comment><USER3> Right it can also be seen as a power play to be dating your superior.

But I still hate to see a company policy stop 2 people from loving each other. The intelligent thing however would be for 1 person to quit the company and work in a different company.

<comment><USER5> The CEO dating someone is always sort of problematic, and relationships between people when someone reports directly to one of them should clearly be avoided, but forbidding relationships between employees in general seems unreasonable to me.

I guess a reasonable company would have the policy "it depends" and make sure that each case is judged on it's own merits, and that no one would just get fired - in some cases just maybe offered a different position.

I worked in one place where the wife of the CEO worked in a non-managerial role far from any top level management. Wasn't a problem, and she was the first to loose her job when they had to downsize. Totally unfair to her since she was a top performer, but that's the only way it could be handled I guess.

<comment><USER6> I've seen it happen a couple of times - one a receptionist, the other a PA, made meteoric rises to Head of HR or Head of Project Management under 6 months after starting dating the CEO. No-one no matter how talented gets promoted that quickly on merit alone... And no-one takes the CEO seriously after it comes out either</comment></comment></comment></comment></comment>


I'm writing a book – Designing Data-Intensive Applications - <AUTHOR> http://martin.kleppmann.com/2014/09/15/writing-a-book.html

<comment><USER2> Looks like something I'd be interested in reading. I would really appreciate a sample chapter as it helps me to determine if I'll benefit from the book.</comment>


Ask HN: We're developing an Android game. Should we start promoting it? - <AUTHOR>

I've teamed up with two developers and one artist and we are now developing an Android game together. The skill-level in our group is very high so I assume the game will be of high quality, also.
Through reading HN I've come to the realization that proper marketing is at least 50% of the effort if we want our game (or any other product for that matter) to be a success. So should we start now?
I thought about what we could do. We could start a blog where we write about the progress, but I am not sure if this would be that interesting for anyone. After all its just a couple of guys writing Java-code and the graphics are currently just blocks in 3 different colors.
Should we just relax and finish coding until we release the game and then worry about marketing? There's an interesting comment about that here: http://news.ycombinator.com/item?id=1527365
Or is it time to act now? If yes, how?
Also: Does it make sense to start looking for a game-publisher?
Thank you for any suggestions! <comment><USER2> Absolutely. You should be developing a marketing plan at the same time you're developing the app. Figure out the best way to generate some positive buzz, be it through blog updates, screenshots showing your progress, etc.

Don't go overboard, but start getting people excited! And while you won't be executing a good portion of your marketing plan until the game is released, you need to know what that plan is.

<comment><AUTHOR> Thats right, the least we can do is figure out, what to do once its out. A development-blog can't hurt either I guess. Perhaps for some people it's interesting "how games are made", perhaps targeting a more non-techie crowd.

</comment></comment><comment><USER3> From what I've seen from numerous succesful indie titles (Minecraft, Mount & Blade etc) developing a "community" along with the software is a key. So maybe you guys should also start a forum and welcome users/early adopters to share ideas and give you instant feedback about the game.

<comment><AUTHOR> Hm I have to think what kind of community it could be.. it's perhaps easier for sandbox type of games.

</comment></comment><comment><USER4> A word of advice from a gamer and a marketer...don't start building the hype machine until you have something to show and hook people with.

<comment><AUTHOR> You think there is a risk? If no-one cares, does it mean that they won't care for a first playable version?

I thought of posting intermediate builds to download and try out as well. Bad idea?

<comment><USER4> When it comes to building hype, I don't look at it as this huge risk considering the platform, but in terms of marketing efficiency and time spent building a following rather then building a great game the two appear to be codependent.

The better you are able to hook people in with your super game concept, the better your community is going to be in the beginning and those are the ones who are following it, offering suggestions/feedback, and telling their friends about it.

If you end up delivering poorly to that community you also lose out on a pool of people to help you hype up your next title.

This is all speculative theory though, you should really just direct your attention towards making a well polished and fun to play game first and foremost.</comment></comment></comment>


Cybercrime Supersite 'DarkMarket' Was FBI Sting, Documents Confirm - <AUTHOR> http://blog.wired.com/27bstroke6/2008/10/darkmarket-post.html <comment><USER2> From the article linked at the bottom of the article:

"DarkMarket is the only survivor among the handful of crime forums that emerged to fill the hole left by the Secret Service's "Operation Firewall" in October 2004. In that unprecedented law enforcement crackdown, the agency used an informant to target what was then the top crime site, Shadowcrew.com."

I think it's hilarious that the leading crime forums have been sting operations for the last several years. How long before criminals start assuming this is the case by default?

<comment><USER3> I'm sure they already do assume that, but an eastern european browsing off of his neighbors wifi and 7 proxies probably doesnt care that the fbi is running the forum as long as it works.

<comment><USER2> True, but some of them must be operating with faulty assumptions, since otherwise the government derives little utility from running the site.

<comment> tsetse-fly The value is in having nearly every cyber criminal on the planet gather at a central location. They're able to easily build a database of usernames, passwords, email addresses, and IPs. They can also monitor what type of goods are being sold and new schemes that pop up.

Everyone knows that law enforcement runs/monitors these forums, but they don't care. You need to be anonymous every step of the way.

</comment></comment></comment></comment><comment><USER4> When reading this I begin to remember an article I read on MSNBC some time ago about a sting operation in which several criminals (not violent ones, just ones wanted for robberies of various sorts) were identified and traced but were evading law enforcement. To solve this problem, police sent them priority mail, from the Police Department mind you, informing them that they had all won brand new 42" HDTVs, among other prizes, and that they needed to show up at a local mall at such and such date/time in order to claim their prize. Every single one of them showed up and were arrested upon walking in the door.

<comment><USER5> That's surprisingly a pretty common sting. I've heard it used to nab deadbeat dads by getting them to all come to a stadium to "collect the prize they won".

</comment></comment><comment><USER6> love the printed out LOLcat picture in the lower right-hand corner of the office picture - [http://blog.wired.com/photos/uncategorized/2008/10/13/ncfta_...](http://blog.wired.com/photos/uncategorized/2008/10/13/ncfta_inside_660x.jpg)

<comment><USER7> love how the head FBI agent was called 'Master Splynter'. Awesome.

</comment></comment><comment><USER8> I wonder if it's possible to solve this with something like a web of trust.

<comment><USER9> <http://en.wikipedia.org/wiki/Darknet_>(file_sharing)</comment></comment>


Microsoft Maims Skype's Full Screen Feature – For No Apparent Reason - <AUTHOR> https://answers.microsoft.com/en-us/skype/forum/skype_windesk-skype_callms-skype_audioms/new-skype-and-full-screen/72e78d3b-a709-4276-bfb6-cc45869ede08 <comment><USER2> Actual title: New Skype and Full Screen

It's a MS Q&A forum. The top two answers are hilariously illustrative:

> _Q: I cannot find the option while in a video call to go full screen mode. I > can maximize the window, but cannot go to full screen to remove the title > bar and taskbar. Is there a way to go to full screen_

\--

> _Serds_P (Microsoft Agent /Moderator) replied

Hi mapesmapes,

The full screen feature is not built on the new Skype for desktop. I can take this as a suggestion for future updates.

Let me know if you have further questions.

Did this solve your problem?

6 people were helped by this reply_

\--

> _RockTrolls replied_

 _Who is the brainless ninnie who eliminated the fullscreen option in the Skype migration? If I wanted a 3-inch by 5-inch video chat, I 'd use my smartphone for the call. I use Skype to actually have a decent view of who I'm talking with. Bring the fullscreen option back. Don't be an Apple programmer!

Did this solve your problem?

92 people were helped by this reply_

</comment><comment><USER3> Microsoft seems hell-bent on creating a UI for Skype that will kill the product. I have been using Skype ever since it first came out. The user interface in the early days was simple and inferable. Now it's a crap shoot of button pushing and following links to figure out how to do something simple like making a call. Skype on Linux has a strange bug where sound quality of the telephonic channel deteriorates over time whether it is used, or not.</comment>


Breaking Madden: The Super Bowl, in which the machine bleeds to death - <AUTHOR> http://www.sbnation.com/2014/1/30/5351052/breaking-madden-super-bowl-broncos-seahawks?resub <comment><USER2> Oh god I laughed hard on that one. FWIW, and I am not making this up, this is Don Knuth's[1] favorite way of playing video games. I had set up an experiment with an xbox, a copy of Halo (fighting aliens game) and a copy of Dead or Alive (fighting boobs game)[2], Don came by and wanted to see the games, he dismissed DoA pretty quickly but Halo2 we played for about an hour and a half. Don loved to have the character do things the developers probably had not thought they would try to do (like fall through a crack in the geometry and walkaround in "space" underneath the ship) He was really creative, we sat for a while with six aliens who wanted desparately to kill us but would not cross a door threshold which if we stepped through the door would close. It was very entertaining. Much like this Madden game. The color commentary though was really priceless.

[1] Yes the "Art of Programming" Don Knuth.

[2] It was a simple experiment at a conference, first half the console sat there, play either game, mid conference announced that we were tracking hours played on each game and compare second half ratio to first half ratio.

<comment><USER3> _Dead or Alive (fighting boobs game)_

Filed under 'things I wish I hadn't searched for.' WTF.

<comment><USER4> Finally! A video game for women.

</comment></comment></comment><comment><USER5> Wouldn't have expected this to show up on HN, but this entire 'season' is hilarious if you have even a cursory interest in sports video games -- there's a lot of (hilarious) frayed edges that get exposed when Jon pushes Madden to its limits.

<comment><USER6> I was laughing the entire read and through the videos, the guy writing this is talented.

</comment></comment><comment><USER7> This is my favorite thing about simulators: using them in unconventional ways.

It reminds me of being a kid and trying to build a city in SimCity without roads.

<comment><USER8> > It reminds me of being a kid and trying to build a city in SimCity without > roads.

I thought you were _supposed_ to replace all roads with rails? :)

<comment><USER9> Technically, you only need exactly one rail adjacent to a zone in the first game to make it grow, so the entire traffic model can be essentially ignored.

Example: [http://www.youtube.com/watch?v=UEzzLXOs- iU](http://www.youtube.com/watch?v=UEzzLXOs-iU)

</comment></comment></comment><comment><USER10> He wonders why the score shows up as 266 when it should be 262.

Well, 262 % 256 = 6. So if you have very old scoring code that expects the score to fit in an unsigned byte, it's going to think the score is 6.

So that explains the 6 in the ones column. The 6 in the tens column, well, that I can't explain.

<comment><USER11> I can't possibly believe something like a game's score would be recorded in an unsigned byte. The last time I saw an unsigned byte in use in a game was in the original Starcraft, which tracked number of kills per unit with a single byte, so if a unit killed more than 255 enemies, it stopped incrementing.

<comment><USER10> Don't miss this comment from a person who worked there:

[https://news.ycombinator.com/item?id=7159513](https://news.ycombinator.com/item?id=7159513)

</comment></comment></comment><comment><USER12> Jeez, firebug shows this site as being 64.7MB for me. And 'onload' occurred after 36 seconds.

<comment><USER13> 55MB was the (large) GIFs. Maybe HTML5 video would've been better. Disregarding that, 10MB is still pretty large, though.

<comment><USER14> That "maybe" is a definite "definitely". I would not be surprised it using video would make it 5.5MB.

<comment><USER15> Not to mention, they could be lazy loaded since they only play when you mouse over them...

</comment></comment></comment></comment><comment><USER16> > _I was pretty amused that a computer could attempt the most basic of tasks > -- addition -- and come up with two kinds of wrong._

It's a bit ironic that addition is kinda the quintessential thing computers get wrong. Admittedly, not much of an issue these days - but the comment was amusing :)

</comment><comment><USER17> I know how whiny this sounds, but please deinterlace before you upload to youtube. I get a headache just looking at this video.

<comment><USER18> I don't think people understand interlacing. The really saddest part is when news video is imported from a region with opposite interlacing and the fields are reversed when broadcast. It means the editors are either only previewing on non-interlaced or half-sized screens or they don't understand what they are seeing.

I once made a similar mistake. Someone submitted a video to my film festival and it was interlaced the wrong way. I swapped the fields and didn't do a full preview. Half way through the submitted video had swapped field order and I'd not noticed.

After the screening I explained the error and apologized. She hadn't even noticed. Some people just can't see.

Another example - a single field glitch. me : what's that glitch? person : what glitch? me (touching the screen next to the glicth) : here person : what glitch?

I just couldn't get them to see it.

<comment><USER19> I can't tell you how many times I've sat down at someone elses computer back in the CRT monitor days, and had to up their refresh rate to something tolerable (it was always defaulted at 60Hz). Almost no one noticed the flicker at 60. This used to not be so bad, until most interfaces switched to black text on a white background. Argh, my eyes bled.

</comment></comment></comment><comment><USER20> Interesting how the game score counter can't go over 255. Sounds like premature optimization at work.

<comment><USER21> Or it's from back in the day when Madden used an 8-bit processor, and the code for scoring has just never been updated to use something other than char.

<comment><USER22> Wasn't Madden 25 recently released? And score is still kept in eight-bit storage?

And the Innovative Title of the Year award goes to...

<comment><USER23> When I worked on Madden around 2007 or so, you could still find the original code for updating the score on a touchdown. It had Steve Chiang's[1] initials by it. It's not like the rules for that have changed much over the years, so there's little reason to touch the code.

[1] [http://company.zynga.com/about/leadership-team/zynga- leaders...](http://company.zynga.com/about/leadership-team/zynga-leadership- team)

<comment><USER22> No, I get that football doesn't change all that much, and therefore the games don't need to change all that much (so why it's become an _annual_ new release sort of situation is beyond me) so I could understand not redoing all of the game logic, but... eight-bit score storage?

<comment><USER24> Assuming a 15 minute quarter(though most Madden games have shorter quarters, especially if they're multiplayer), to get 255 points in a quarter, a team would need to score a touchdown + 2 point conversion every 30 seconds. For a full game, that's every 2 minutes.

Any given play generally takes 10-20 seconds, and you're going to be running, bare minimum, 2 plays per 8 points(1 for touchdown, 1 for 2 point conversion). So that's about 25 seconds per score.

If the teams are remotely well matched(i.e. aren't a Breaking Madden team), they'll take at least 2-3 minutes per possession, since you're most likely going to have 4 downs, which have a play clock of 40 seconds(most teams use around 30/play), so the "average" shortest possession is something like 2 minutes.

The point of all this? The Breaking Madden games are really an outlier that you'd have to specifically code for.

<comment><USER25> I think BlackDeath's point is just...

Who wouldn't just use "int" for all of this logic? It's so simple that you could do it on autopilot. You'd have to specifically _try_ to limit to 8-bits.

<comment><USER22> If 'char' in-place of 'int' is a legacy quirk, then I get it. I just find it odd that over the course of twenty-five years the required expense couldn't be made to update the data type. It just makes more sense.

<comment><USER26> If you find it odd you haven't worked on any large projects that have enormous backlogs of bugs and features to build which need to be prioritized. Bugs that will never actually manifest in normal usage should be far down the list of things to fix, particularly if they are in 25 year old code that is battle hardened and in the critical path.

<comment><USER22> So all that they could manage, over the course of twenty-five years, is to grow (or keep unchanged) the size of their bug list?

OK...

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> This had me crying I was laughing so hard. In an airport bar. People were staring.

</comment><comment><USER28> To those who suspect old code or premature optimization, if you read the comments all EA sports games apparent cap out at 255 points. It's an intentional throwback. When he did it in one quarter he triggered an Easter egg, a "false start".

<comment><USER29> I'm not sure I would call a false start an easter egg. It is a fairly standard penalty called all the time in real life games. The reason it was special enough to mention in the article is that he had specifically turned off penalties for the game.

<comment><USER30> Lol, moron...

</comment></comment></comment><comment><USER31> Damn that was too funny. I would love to see something similar with other games.

</comment><comment><USER32> I love these kinds of glitches, always makes me laugh until I cry.

Reminds me of the best one: [https://www.youtube.com/watch?v=4Zs4yxkRI6U](https://www.youtube.com/watch?v=4Zs4yxkRI6U)

</comment><comment><USER33> Tremendous. I love how the simulation threw its hands up at the end and gave up in such spectacular fashion.

Mathematical abomination, indeed.

</comment><comment><USER34> This website has an irritating bug. It's got a scrollbar next to the main scrollbar. Firefox 26.</comment>


Data Scientists Should Be Able to Deploy and Iterate Their Own Models - <AUTHOR> https://blog.algorithmia.com/data-scientists-should-be-able-to-deploy-and-iterate-their-own-models/ <comment><USER2> I fully agree, but the tooling is super immature. I think there's going to be incredible opportunity for engineers to build tools for doing ML in a very efficient and scientifically rigorous way.

For instance, Jupyter is the best thing we have to an IDE for science. It is an incredibly innovative project, but it is not what we need. We need a Photoshop, a Visual Studio, a Final Cut Pro for doing ML.

There are a lot of interesting projects out there solving some of these problems. My favorite ones are Prodigy (by Explosion AI), Pachyderm, Paperspace to name a few. But it'll be a decade I think until we get to a serious place with it as an industry.

I myself have found the process of understanding models after training is incredibly difficult. I'm talking analyzing misclassifications, visualizing embeddings, and looking at saliency maps. We just don't know enough about how models work, and when we do it's only after great effort that most small shops don't have the resources for. This was true when I was trying to get my last company off the ground and is still true now that I'm running ML at my current company. There is a pretty big opportunity especially given that most cloud ML companies seem to focus on just training and deployment. Thinking about trying to start this myself actually given how much of a pain point it is for me today.

<comment><USER3> For model versioning / keeping track of ML experiments, I can recommend Comet ML - [https://www.comet.ml/](https://www.comet.ml/) Takes just about 1 line of code to set it up (and of course you can customize it a lot after).

<comment><USER2> Comet looks great, thanks for the suggestion.</comment></comment></comment>


Amundsen – Lyft's data discovery and metadata engine - <AUTHOR> https://eng.lyft.com/amundsen-lyfts-data-discovery-metadata-engine-62d27254fbb9 <comment><USER3> This was probably in development before FoundationDB was open sourced, but this is exactly the type of system where FoundationDB shines. A developer from Apple did a talk at the FoundationDB Summit describing Apple's metadata store for machine learning that people interested in this from Lyft may like.

[https://youtu.be/16uU_Aaxp9Y](https://youtu.be/16uU_Aaxp9Y)

</comment><comment><USER4> Would someone mind explaining how ML models are used in the real world? In this case Lyft has users, trips, points of interest (destinations). What would they create a model for? How would it improve driver/rider experience?

I've gone through a few TensorFlow tutorials, but still can't grok what the appropriate use-case is.

Edit: I really appreciate the responses @tedsanders and @theossuary - <USER2> you so much! Not sure what the etiquette is other than upvoting you!

<comment><USER5> I received an offer from Lyft last year to do data science. Here are some potential use cases of machine learning for a taxi company:

-Predicting wait times

-Predicting the best route

-Predicting where to send drivers before requests come in

-Predicting demand so that you can surge price predictively

-Predicting what assets/requests to prefetch to the phone and when

-Predicting when drivers will churn and what tactics will reduce churn

-Predicting when passenger will churn and what tactics will reduce churn (e.g., special deal for 25% off next 10 rides)

-Predicting which passengers are more or less price sensitive and then price discriminating accordingly

-Predicting what it will cost various vehicles to reroute to pick up an additional Lyft Pool passenger on the way to their destination

-Predicting the driver's position some time ahead (e.g., you don't want to send a request for them to get off the freeway right as they are passing their exit)

-Predicting car location based on fusion of GPS, accelerometers, priors from past driving data (e.g., if GPS says you're 10 m right of the freeway traveling at 60 MPH, you're actually probably on the freeway)

-Predicting which Facebook users will be most likely to click ads

-Predicting who and when to send out email marketing

-Predicting all sorts of server load balancing type stuff on the back end (proactively scaling capacity for known busy times, etc.)

<comment><USER6> Predicting age, gender, and cost of the route and timings for en route, and doing shopping online for groceries and beverages in the cab, and pick them on their return to home.

</comment></comment></comment><comment><USER7> We did a presentation in Strata SF 2019 last week which detail could be found at [https://conferences.oreilly.com/strata/strata- ca/public/sche...](https://conferences.oreilly.com/strata/strata- ca/public/schedule/detail/72505). The slide could be found at [https://www.slideshare.net/taofung/strata-sf-amundsen- presen...](https://www.slideshare.net/taofung/strata-sf-amundsen-presentation) .

<comment><USER8> How do you deal with discoverability of map keys and struct fields? That's something we just added after such datatypes became more prominent in our DWH.

</comment></comment><comment><USER9> [https://github.com/lyft/amundsenfrontendlibrary](https://github.com/lyft/amundsenfrontendlibrary)

<comment><USER7> there are four repos (3 for microservices, 1 for data ingestion library): [https://github.com/lyft/amundsenfrontendlibrary](https://github.com/lyft/amundsenfrontendlibrary) [https://github.com/lyft/amundsensearchlibrary](https://github.com/lyft/amundsensearchlibrary) [https://github.com/lyft/amundsenmetadatalibrary](https://github.com/lyft/amundsenmetadatalibrary) [https://github.com/lyft/amundsendatabuilder](https://github.com/lyft/amundsendatabuilder)

<comment><USER10> Nothing quite highlights the fragmentation of Python more than 3 different Python versions being called out across 4 repos.

</comment></comment></comment><comment><USER11> congrats to the team! reminds me of Airbnb's data discovery tool: [https://medium.com/airbnb-engineering/scaling-knowledge- acce...](https://medium.com/airbnb-engineering/scaling-knowledge-access-and- retrieval-at-airbnb-665b6ba21e95)

</comment><comment><USER12> Metacat is worth checking out as well.</comment>


Show HN: Architect – Hardware Description and Emulation JavaScript Library - <AUTHOR> https://github.com/mbad0la/Architect <comment> TD-Linux For reference, the 4-input AND gate from the third example in Verilog:

      module ForInpAndGate(a,b,c,d,o);
        input wire a,b,c,d;
        output reg o;
        always @(*) begin
          o <= a & b & c & d;
        end;
      endmodule;

<comment><USER2> I'm not sure why the output is passed in at the start (I'm guessing it's like an out parameter in C#) and I don't understand what @(*) is, but that's surprisingly readable.

<comment><USER3> Verilog isn't a programming language. It is a hardware description language. It is used to describe the behavior of hardware. The output isn't "passed" out at the beginning. Rather, That line is indicates that there is an output and what it's name is. The @() indicates a sensitivity list. The block below is evaluated whenever the states of any signal in the sensitivity list are changed. The * is a wildcard character and signifies any signal in the block below. That feature was added in Verilog2001. Before that, you had to manually list any signal you wanted in the sensitivity list.

<comment><USER4> > Verilog isn't a programming language. It is a hardware description language. > It is used to describe the behavior of hardware.

In short, coding in verilog is like creating a schematic of the circuit.

<comment><USER5> You can write Verilog as schematic-like description, but there is a higher- level of modeling supported by synthesis tools that doesn't look quite so netlist like.

</comment></comment></comment></comment></comment><comment><USER6> This may be confirmation bias but I feel like since the Megaprocessor thread[1] I'm noticing an increase in hardware-simulation related posts. Can't think of them all off the top of my head, but see also:

* Nand2Tetris[2]

[1] [https://news.ycombinator.com/item?id=12317217](https://news.ycombinator.com/item?id=12317217)

[2] [https://news.ycombinator.com/item?id=5888705](https://news.ycombinator.com/item?id=5888705)

<comment><AUTHOR> Oh these were great!

I didn't know about them though. My project's inspiration is due to the fact that I love JS and had a computer system architecture course wherein I learnt VHDL.

I felt that the NodeJS Events API could probably help me simulate a `signal` driven system and thus, I started experimenting :)

<comment><USER7> Since nodejs is single threaded, you'll get the best results with synchronous logic. Even asynchronous systems are difficult to design in real life, so it's not a bad idea to use nodejs.

<comment><AUTHOR> Yeah, using events do offer an amazing async behaviour.

Thus,the I/O arguments of every hardware component are extensions to EventEmitter, resulting in quite an amazing simulation.

</comment></comment></comment></comment><comment><USER7> Looks like a cool project. And since it's based on javascript, it shouldn't be too difficult to add a graphical interface, so the system could be driven primarily by graphics instead of using text only. A graphical interface would vastly improve on productivity and open up hardware design to more than just hardware engineers. Heck, this might give FPGAs a boost in popularity.

<comment><AUTHOR> Couldn't agree more! Someone has already suggested me some cool libraries that I might be able to use. Visualisation is on the agenda definitely.</comment></comment>


Are Retailers Leaving Amazon Cloud? - <AUTHOR> https://www.lightreading.com/enterprise-cloud/infrastructure-and-platform/are-retailers-leaving-amazon-cloud/d/d-id/746490 <comment><USER2> > It's all vague at this point, and several vendors and at least one analyst > say they're seeing no such migration.

Seems the answer is a no.</comment>


Mark Zuckerberg's Year of Books: The Full List - <AUTHOR> http://www.telegraph.co.uk/technology/mark-zuckerberg/11379640/Mark-Zuckerbergs-Year-of-Books-the-full-list.html <comment><USER2> "Orwell's Revenge", by Peter Huber was a bit unexpected:

[http://amazon.decenturl.com/1984](http://amazon.decenturl.com/1984)

What it says about Mark Zuckerberg: Is he preparing for a dystopian world? Quite likely, yes.</comment>


Unable to download free book from Google play without credit card - <AUTHOR> http://i.imgur.com/NRBIAf3.jpg

<comment><USER2> This is expected behaviour -- you need a credit card linked to Play.

Not a bug.

<comment><AUTHOR> i can download free apps without credit card. Why not the same with books? And only around 9% of population in India have credit cards.

<comment><USER2> Then use a debit card?

<comment><AUTHOR> Indian debit cards are not accepted in Google play store.

<comment><USER3> What about gift cards?</comment></comment></comment></comment></comment>