FBI chief calls for national talk over encryption vs. safety - <AUTHOR> http://chicagotribune.com/news/nationworld/ct-fbi-chief-encryption-phones-20160805-story.html <comment><USER2> To sum up how I feel:

"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."

\</comment><comment></comment><comment></comment><comment></comment><comment>---

"The San Bernardino litigation was necessary, but in my view, it was also counterproductive," Comey said during his 20-minute speech. "It was necessary because we had to get into that phone. It was counterproductive because it made it very hard to have a complex conversation."

No.. you pushed for the conversation right after the terrorist shooting hoping the public would be scared enough to cave.

<comment><USER3> While I'm sympathetic to your point, that quote is always taken out of context: [http://www.npr.org/2015/03/02/390245038/ben-franklins- famous...](http://www.npr.org/2015/03/02/390245038/ben-franklins-famous- liberty-safety-quote-lost-its-context-in-21st-century)

> He was writing about a tax dispute between the Pennsylvania General Assembly > and the family of the Penns, the proprietary family of the Pennsylvania > colony who ruled it from afar. And the legislature was trying to tax the > Penn family lands to pay for frontier defense during the French and Indian > War. And the Penn family kept instructing the governor to veto. Franklin > felt that this was a great affront to the ability of the legislature to > govern. And so he actually meant purchase a little temporary safety very > literally. The Penn family was trying to give a lump sum of money in > exchange for the General Assembly's acknowledging that it did not have the > authority to tax it.

> It is a quotation that defends the authority of a legislature to govern in > the interests of collective security. It means, in context, not quite the > opposite of what it's almost always quoted as saying but much closer to the > opposite than to the thing that people think it means.

<comment><USER4> Thanks for the information and it's always good to have context.

I was going to say that the original meaning doesn't take anything away from the quote as currently used and the power of _that_ meaning. But Wittes already said that too, in the article you linked:

> _"... maybe it doesn't matter so much what Franklin was actually trying to > say because the quotation means so much to us in terms of the tension > between government power and individual liberties."_

I also disagree with Wittes that this means _" not quite the opposite... but closer to the opposite [than the usual usage today]."_

Franklin was arguing that the state ought to have the right to tax in order to defend the territory on the public's behalf. The Penns were trying to offer a one-time fee in exchange for not being taxed going forward.

Thus, Franklin's implication seems to be: do not trade temporary security in exchange for long-term liberty.

And so, I think the quote's modern usage and its originally intended meaning _are_ very much in alignment. Just as the Penns offered a short-term benefit to security in exchange for a longer-term loss to prospective liberty, the FBI here is offering a short-term benefit (of debatable potential) to security by disallowing encryption or having master keys/backdoors, in exchange for a longer-term loss to prospective liberty.

It seems to me Wittes (and the NPR reporting) just isn't thinking about it deeply enough. It's not as simple as "oh, Franklin was original discussing a security matter and arguing _for_ the state to provide security"... in fact, it is more nuanced and Franklin was saying that the state (and the public) should not accept, let alone advocate for, short-term security at the cost of long-term liberty and security.

<comment><USER5> Is maintaining smart phone encryption after the commission of a crime, when the Gov. otherwise has a lawful right to search and seize evidence used in the commission of a crime an _essential liberty_?

There is another famous quote from John Stuart Mill, "Your liberty to swing your fist ends where my nose begins."

For example, take the Constitutional Right to bear arms. Obviously we have limited individual liberty to bear arms for safety through both regulations and criminal statutes. I think that trade off can be pretty reasonable in some instances (say, no guns at the airport/on a plane) and since I don't mind sacrificing a little liberty for safety I don't think that trade off makes me undeserving of either liberty of safety, does it?

Please note, I am not trying to take a position other than public awareness and conversation about these things is always good; whereas, quotes about not deserving liberty or safety only serve censor an open conversation from a position of moral authority.

<comment><USER2> > Is maintaining smart phone encryption after the commission of a crime, when > the Gov. otherwise has a lawful right to search and seize evidence used in > the commission of a crime an essential liberty?

I would say NO. But, the issue is there's no way to _only_ allow a backdoor to be used when/after someone commits a crime. As tech people we understand this, and history proves it. Apple had a person testify at the hearing who expressed this really well. She also brought up other points I hadn't considered.

Also, the FBI is missing non-encrypted communications in most of these cases! I know encryption by default is going to be a problem for them in the future, but they are acting like it's the reason the recent attacks went undetected - when it actually had nothing to do with it.

<comment><USER5> >there's no way to only allow a backdoor to be used when/after someone commits a crime.

Outside of the encryption debate, this concept rings true of most evidence. In other words in the streets nothing really prohibits an officer from illegally searching/seizing evidence of a crime and a prosecutor bringing charges, but the 4th Amendment is our protection only after the fact where illegally obtained evidence is subject to being suppressed from use at trial. Example, police illegally raid a house without a warrant, break open a safe and seize cocaine...all evidence of crimes including the illegally seized cocaine could be suppressed.

Is there a way to determine when the backdoor was accessed? If so, then the defendant is actually more protected because there would be digital record of the illegal search/seizure vs the street example above where officers can lie about the factual events regarding illegal searches and seizures (i.e. testimony the defendant was outside the house in plain view holding the cocaine, so a warrant wasn't required). If not and it can't be determined when LEO accessed the backdoor it is still similar to any other illegally obtained evidence.

>but they are acting like it's the reason the recent attacks went undetected - when it actually had nothing to do with it.

I thought they tried to limit their position to need for the follow up investigation, but if they framed it to the public the way you describe, I agree that is disingenuous.

</comment></comment></comment></comment></comment></comment><comment><USER6> The FBI is living in the hole it dug for itself. Where was the "conversation" about warrantless wiretapping? I certainly don't remember it. What about the conversation about secret FISA courts?

Sorry our constitution is making your job harder. Feel free not to cash your paycheck next week if you think it's too hard for you.

<comment><USER7> I don't even understand why they care so much if they can't solve a case due to lack of access to electronic data. Just move on to the next case. Are they getting paid on commission based on how many cases are solved? If anyone asks why a specific case wasn't solved just point to the encryption and move on

<comment><USER8> I understand your point but imagine working in the FBI. How do you tell the victims of the crime that the people who harmed them is still out there because you can't get access to the last piece of evidence you need?

I'm not at all saying that encryption should be removed but I can definitely see how people who see the harm caused by crime every day could be a little upset about being unable to do anything about it.

<comment><USER9> Probably the same way the State Department tells the families of journalists detained by foreign governments that they are "working on it", but that it just not worth it, financially and politically, to unleash the full power of the Department of Defense to recover an individual.

</comment></comment></comment></comment><comment><USER10> It's not encryption vs. safety. It's functioning software systems vs safety and there is actually no conflict because functioning systems are _necessary_ for safety.

So really the FBI director should have phrased it as "lack of encryption vs. safety".

<comment><USER11> I'm on the "encryption is a right and essential to functioning software systems" train with you. But I don't want stick my head in the sand and pretend the other side doesn't have valid points.

If all network devices were trivially penetrated by government surveillance, a hypothetical terrorist plot with a WMD has chance A of being discovered. If network devices that are impenetrable to government surveillance are used, I'm not going to argue that the same plot doesn't have < A chance of being discovered (ceteris paribus).

I happen to believe that's a good and _just_ tradeoff to preserve the values of a democratic society, but I accept that others might think otherwise.

The US (and France, and the UK, and everyone else grappling with this that cares to pretend to be a democracy) should absolutely have a thorough, resolute discussion about our options.

<comment><USER12> If alcohol prohibition was reinstated it would probably save about 88,000[0] lives a year in the US. Between 1995 and 2014, 3503[1] US Citizens worldwide were killed by terrorism. If congress wants to save lives it could be done in a much less constitutionally suspect way. This is why I suspect that saving lives is not the true reasoning.

[0][http://www.cdc.gov/alcohol/fact-sheets/alcohol- use.htm](http://www.cdc.gov/alcohol/fact-sheets/alcohol-use.htm)

[1][https://www.start.umd.edu/pubs/START_AmericanTerrorismDeaths...](https://www.start.umd.edu/pubs/START_AmericanTerrorismDeaths_FactSheet_Oct2015.pdf)

<comment><USER13> Prohibition was repealed because it was an abject failure. It did not make the public safer last time, and I very much doubt this time around would be any different.

The claim that reinstating prohibition would prevent all alcohol-related deaths is simply not based in reality.

<comment><USER12> And the current anti-terror programs are a resounding success?

<comment><USER13> I neither said not implied anything about the anti-terror programs. I solely wanted to address your claims about reinstating prohibition, lest someone support it based on that flawed analysis.

</comment></comment></comment></comment></comment></comment><comment><USER14> Hint: the Constitution is intended to make your life as a cop difficult. If you have a problem with this, I'm sure the FSB are hiring.

</comment><comment><USER15> My rights aren't really up for a talk. Encrypted speech is still speech, that really should be the end of the talk.

<comment><USER16> That's a very bold assumption.

<comment><USER17> Until the constitutional right to communicate unintelligibly is declared invalid, encryption will remain constitutional.

[snarky comment about opposing political party placed here.]

</comment></comment></comment><comment><USER18> Encryption does not confront safety. It is only FBI that wants us to think this way. Encryption IS safety against people in power holding too much power.

I have the right to have private conversations with my family, friends and coworkers, specially if I work from home using teleworking tools. I will fight to defend this right if necessary.

If someone believes anything I do is illegal I have no problem when they have a warrant, but massive surveillance is criminal.

It is a crime they had not paid for yet, like Hillary Clinton or all the financial dome they are used to do everything against the law with no consequences.

<comment><USER19> > _Encryption does not confront safety. It is only FBI that wants us to think > this way. Encryption IS safety against people in power holding too much > power._

And also people NOT in power. From nosy spouses to "cyber-criminals", identity theft and so on...

<comment><USER18> Yeah, I include criminals in the power side too. In Italy Servia or Russia for example, the Mafia is part of the power structure.

In some places of Africa it is already very dangerous to communicate digitally because of digital surveillance tools developed by Israel,French or German companies.

<comment><USER20> The PRC's 'Great Firewall' is built on Cisco, Blue Coat, and other US companies' technologies as well [1].

1: [https://insidersurveillance.com/cisco-huawei-and- semptian-a-...](https://insidersurveillance.com/cisco-huawei-and-semptian-a- look-behind-the-great-firewall-of-china/)

</comment></comment></comment></comment><comment><USER21> The entire world today works efficiently because of encryption. The more encrypted things are, the easier and safer it is for us to communicate remotely. Encryption _IS_ safety. Take it away and we're back to having to communicate important information in person, or risk our own security and safety.

Also, no matter what the government does to prevent the general public from encrypting stuff, aren't big-time criminals going to encrypt their communications anyway? So we're not solving any problems by having this discussion, are we?

</comment><comment><USER22> Maybe the FBI should spend less time suing Apple and more time finding out where the wife of the Orlando shooter has disappeared to given she was proven to have assisted him with the crime and knew about it in advance.

The FBI might also do well to look into the mother of the San Bernardino shooters who lived with them in a house full of bombs and guns and yet somehow never had any idea what was going on.

These seem better leads than this constant obsession with searching everyone's phones.

<comment><USER23> How did the FBI come to know that the Orlando shooter's wife knew about it in advance?

<comment><USER22> Because she told them she did. Noor Mateen told the FBI she was with him when he bought ammunition and a holster and that she once drove him to the Pulse nightclub because he wanted to scope it out. She told federal agents she tried to talk her husband out of carrying out the attack against the nightclub.

</comment></comment></comment><comment><USER24> Encryption vs safety? This is carefully framed in a way that ignores the safety _provided by_ proper encryption. This isn't "encryption vs safety", but actual safety of secure communication and personal data vs possible safety of solving a few more criminal cases.

As koenigdavidmj already mentioned, one of the key principles of a free society is that liberty and justice is more important than law enforcement convenience. It is better to let the guilty go free than infringing the rights of the innocent. The police will simply have to be more creative and find alternative ways to do their work.

Of course, the FBI and congress already knows this, as Susan Landau already explained this in her testimony before the House Judiciary Committee.

[https://www.youtube.com/watch?v=g1GgnbN9oNw#t=12944](https://www.youtube.com/watch?v=g1GgnbN9oNw#t=12944)

</comment><comment><USER25> Why no guff when SSL was introduced? Perhaps back then there were tons of vulnerabilities, backdoors or untrustworthy CAs, but can it still be the case now? The FBI would have us believe that some kinds of encryption are acceptable? If that's the case then they must already have a way to circumvent it.

<comment><USER11> Because SSL is intricately tied to the CA infrastructure and thus able to be meddled with when the government decides it has national security concerns?

<comment><USER26> For now, and only if the CA feels like taking an existential risk. Browsers requiring Certificate Transparency should make it impossible to subvert the CA system _secretly_ , and subverting it _openly_ kills a CA.

<comment><USER11> Subverting SSL/TLS kills a CA _when noticed and reported_. Hypothetically, if you're identifying targets through other means and diverting their connections at the backbone level before monkeying with them then you're not running that big of a risk, statistically speaking.

Especially not when the CA's alternative is Serious Legal Consequences of ignoring a NSL.

<comment><USER26> Browsers can enforce Certificate Transparency for certificates from a given CA; once they reach the point of enforcing it for all CAs, browsers will no longer trust a certificate issued surreptitiously and not logged in the CT logs.

And even before that point, any site using certificate and CA pinning can protect against the use of the "wrong" CA to issue a certificate for their site.

> Especially not when the CA's alternative is Serious Legal Consequences of > ignoring a NSL.

I'd _love_ to see the court case brought by a CA that refuses to kill their entire business. But in any case, eventually, a certificate issued secretly by a CA won't be trusted by any browser, NSL or no NSL.

</comment></comment></comment></comment></comment><comment><USER27> Pretty sure not hiring pothead hackers is a bigger problem for the FBI than the encryption they keep whining about.

</comment><comment><USER28> Such debates are always a funny move.

It's like saying "let's have a national talk over encryption versus ethernal peace and harmony". Arguing for encryption in such a frame is determined to be a failure.

<comment><USER29> To me this feels more like the head of the KKK suggesting that we should have a national conversion about the proper place of blacks in society.

</comment></comment><comment><USER30> At least he's asking for a talk instead of outright decreeing privacy the enemy of security

<comment><USER31> He's banking on the fact that most people don't care about privacy and are more easily swayed towards giving it up for vague promises of safety when scared by threats of terrorism.

</comment></comment><comment><USER32> The FBI is the face of the larger government trying to control the people, which is hard to do when their communication is encrypted. They're playing off the fears of the sheeple and don't deserve our attention.

</comment><comment><USER33> "There is danger from all men. The only maxim of a free government ought to be to trust no man living with power to endanger the public liberty." \- John Adams, 1772

</comment><comment><USER34> How about we have an honest conversation about how the government is eroding the Bill of Rights?

</comment><comment><USER35> Fuck James Comey and fuck the FBI. I will continue to choose freedom over safety.</comment>


Sun adds support for Amazon Web services, targets start-ups - <AUTHOR> http://venturebeat.com/2008/05/04/sun-offers-support-for-amazon-web-services-aims-at-start-ups/

<comment><USER2> To sum, Sun launched: OpenSolaris, an open source OS [1]; a free AMI for OpenSolaris; MySQL Enterprise for EC2 [2]; an OpenSocial app hosting service [3]; and a Facebook app hosting service [4].

[1] Includes ZFS and DTrace. <http://en.wikipedia.org/wiki/OpenSolaris>

[2] Tiered support service. Cost: $599-4999/yr

[3] On Joyent's (OpenSolaris) servers. 1st yr: free

[4] To be released soon

</comment><comment><USER3> It must be cold in hell today. It seems that Sun made a right decision.</comment>


Bitcoin-Central.net was hacked - <AUTHOR> https://bitcoin-central.net/

<comment><USER2> That was a pretty great read. With the crap-storm that has been hitting Bitcoin services lately as well as things like the Linode hack, it's great to see Bitcoin-Central being completely open and transparent with what happened and what their plans are for the future. Bravo.</comment>


Show HN: Online Step Sequencer - <AUTHOR> https://dunkadunka.com <comment><AUTHOR> Creator here. I love creating beats, but couldn't find a tool that exports sounds so I can use them in a DAW, so I created my own. Front-end is preact and the bundle size is about 500k, which I'm OK with. Chrome CPU is around 12% on my late 2013 MBpro with all the tracks playing. All samples by me, more on its way. MIDI out is next on the list I think. And maybe some kind of song mode / pattern chaining.

<comment><USER2> Nice app and nice samples, do you mind if I use them in my tracker?</comment></comment>


The evolution of chess: Game lengths and outcomes - <AUTHOR> http://www.randalolson.com/2014/05/24/a-data-driven-exploration-of-the-evolution-of-chess-match-lengths-and-outcomes/

<comment><USER2> This is all pretty standard knowledge in chess circles, but it's always nice to see someone taking an interest in analyzing chess stats. I was a bit thrown by the misuse of chess terminology, though.

In chess, a "match" is a series of games between two players. The correct term for an individual game is a "game".

"Plays per person" is known as simply "moves". If each player has made 37 moves, that's 74 half-moves, or 74 ply (in the context of lookahead in the game tree by a computer).

Most analysts, when studying performance, assign scores of 1 and 0 to White and Black when White wins, 0 and 1 when Black wins, and 1/2 point to each when there's a draw. It is unusual to not count draws when analyzing performance. Doing so would decrease White's apparent advantage. For example, I just checked all the 2013 games from Chessbase's Megabase and White scored 53.4% with draws counted as a half point for each side.

By the way, one of the reasons that draws have decreased in the last 30 years is probably the advent of faster time controls. I also suspect one reason that games have gotten longer is the death of adjournments.

<comment><AUTHOR> I revised the wording in the post to reflect your wording suggestions. Thanks! The visualizations are a pain to replace, but I'll get the terminology right on those in future posts.

To me, it doesn't make sense to assign a draw as 1/2 to Black and White. Technically, neither side won, so why not just throw that game out when looking at which side wins more often? That's what I do in this analysis, although I show the full breakdown in the final area plot.

<comment><USER3> Consider this hypothetical situation:

A game in which for evenly matched players, in a match of 1000 games, 9 are wins for white, 1 is a win for black, and 990 are draws. Would it really be reasonable there to say that W has a massive 90% advantage? I don't think so - in that situation white only has a tiny average advantage per game, so that winning such a match would mostly depend on real skill differences.

</comment></comment></comment><comment><USER4> Translation of terms: Play -> ply (or half-move) Match -> game

The data doesn't support the conclusion that chess is becoming more defensive. It could be that time controls or new rule changes have changed the play. For instance, one proposed rule change is to not allow draws before move 50, which would definitely impact the number of moves.

<comment><AUTHOR> >The data doesn't support the conclusion that chess is becoming more defensive.

That's a good point. I weakened the wording to make it clear that I'm speculating.

<comment><USER4> Relatedly, if you want to analyze PGNs, I put together some Python code that can analyze PGNs in combination with a chess engine. It can also draw chess positions, if you find interesting positions you want to programmatically draw:

[https://github.com/pickhardt/chessbox](https://github.com/pickhardt/chessbox)

I'm kind of hoping someone will do a thorough analysis of the types of moves chess grandmasters make during a game. For instance, here is a chart from a GM book that categorized moves into four categories: [http://imgur.com/BMOElXN](http://imgur.com/BMOElXN)

<comment><AUTHOR> Nice! I've been needing a tool like this for these chess analyses. Do you have docs showing how to use the scripts?

<comment><USER4> Not really, it was mostly made for my own use then thrown on Github in case someone wanted it. It works for most games, but isn't guaranteed to be able to parse all games. I added example code to the readme.

</comment></comment></comment></comment></comment><comment><USER5> > Note: In all of the following plots, the white line is the mean and the > shaded blue area is the 95% confidence interval [for the mean of moves-per- > game]

Is confidence interval the right statistical concept to use when characterizing this data set? It seems like it would be more meaningful to examine how various percentiles of "moves per game" change over time rather than plotting a confidence interval around the mean.

In particular, the mean moves-per-game that he displayed is (I assume) the actual mean of his data set. It's not an estimate of the mean of some larger population of games, if I'm understanding the article correctly. So what does it mean to display a confidence interval for a parameter that's known rather than been estimated?

It seems more interesting to treat the data set as the population and analyze how it changes over time. For example, I'd be interested to see a graph of 5th, 50th, and 95th percentile of match length. I notice that the confidence interval is shrinking around his mean -- is that really reflecting that percentiles are converging on the mean because of changes in play style? Or have I misunderstood and the data set is being treated as a random sample of some larger population of chess games? (In that case, since there are more games in his data set in later years, it is unsurprising for the confidence interval to shrink. Whereas if the percentiles of match length are converging on the mean, then I think that's pretty interesting.)

<comment><AUTHOR> >In particular, the mean moves-per-game that he displayed it is simply the actual mean of the data set. It's not an estimate of that mean, if I'm understanding the article correctly. So what does it mean to display a confidence interval for a parameter that's known rather than been estimated?

Technically, I don't have the "true" mean because this data set isn't a set of _all games ever_. As such, I'm treating the games I have as a sample of all games ever, and providing an estimate of how confident I am in the mean I'm reporting.

>I notice that the confidence interval is shrinking around his mean -- is that because there are more recorded games

Exactly! Law of large numbers.

<comment><USER6> I have to admit that I (also?) was expecting the shaded region to give something like the standard deviation about the mean, not the confidence in the mean.

</comment></comment></comment><comment><USER7> If moves from all these games are available I am wondering if ngram type analysis could be used to tease out the emergence of new opening strategies etc. Given enough games, someone could build a markov-chain "Kasparov simulator" or something as well... :-)

<comment><AUTHOR> I'm actually looking at specific moves right now! Hope to have something to report on by the end of the weekend.

</comment></comment><comment><USER8> One of my friends (kerno) and I went through a phase when we were living in London of playing a LOT of chess against each other. What became apparent was that he was excellently skilled at openings; my experience was much more honed finding a kill in the end game. While the statistics are now lost, it became obvious to me at some point that if I could extend the game length beyond 15-20 moves then I was almost guaranteed to win.

I will also put on the record that kerno once 'pantsed' me - creating a checkmate in about 8-10 moves wherein I failed to capture a single piece of his. It was an epic highlight among a series of long games (one went to 57 moves) where I was triumphant.

</comment><comment><USER9> Just a remark on terminology: isn't this 'game' length iso 'match' length, and 'move' iso 'play' ? As a match refers to a series of consecutive games between the same 2 players. (fe a world championship match).

</comment><comment><USER2> By the way, I would be interested to see a graph of the average rating of the players by year, as well as what the other graphs look like when controlled for rating. I wouldn't be surprised if the explosion of the data set in recent times is partially due to many more games between lesser players being recorded, and this could certainly have an impact on the stats.

<comment><AUTHOR> Here's a distribution of Elo scores in the data set: [http://www.randalolson.com/wp-content/uploads/chess-elo- scor...](http://www.randalolson.com/wp-content/uploads/chess-elo-score-dist- plot.png)

This data set is from chess tournaments, so it's predominantly games with skilled players.

<comment><USER2> What I was wondering specifically was how the average rating varies by year. My hypothesis was that it has gone down over time as it has become easier for games between less skilled players to get into databases.

<comment><AUTHOR> Here's a quickly made chart to show that: [http://i.imgur.com/lHbVzXM.png](http://i.imgur.com/lHbVzXM.png)

(I don't have enough games w/ Elos pre-1960 to show a reliable mean.)

<comment><USER2> Thanks. FIDE didn't implement ratings until 1970 anyway. (I'm not sure what the ratings you have for the 1960s actually are - perhaps USCF ratings.)

</comment></comment></comment></comment></comment><comment><USER10> I'm just a casual Chess Player. Can someone point me to the new rules of Chess mentioned multiple times in the comments?

</comment><comment><USER11> I wouldn't necessarily assume that games would be shorter because of better efficiency, but that the central optimization has been piece preservation and high level players have become very good at it. This creates the defensive play style that seen in the modern game.

</comment><comment><USER12> If you wanna interactively check out chess games recorded over the past few centuries check them out here:

[http://database.chessbase.com/js/apps/onlinedb/](http://database.chessbase.com/js/apps/onlinedb/)

</comment><comment><USER13> > With the advent of computers in the mid-1900s [...]

Slightly off-topic but... wow! I didn't see this coming. It feels like the advent of the computer age is officially part of History now.

</comment><comment><USER14> What accounts for the big decline in match length between 1950 and 1970?

<comment><USER15> I have a guess. In 1952 FIDE reworked the rule about draws by agreement removing a clause which prevented players from agreeing to a draw before move 30. This is something that isn't mentioned in the article and I think really should be touched upon if the author wants to claim that longer chess matches imply chess has become more defensive. A lot of games are draws by agreement (hopefully the article could also tell us how many of those there are) and so a longer average game could just mean that players are waiting longer to agree to a draw.

Edit: Citation [http://en.wikipedia.org/wiki/Draw_by_agreement](http://en.wikipedia.org/wiki/Draw_by_agreement)

<comment><USER16> This is a good point and find, but is incomplete, it needs the context too.

The missing factor is that FIDE took control of the World Championship title in 1946, and implemented a regular cycle of Zonal tournaments, Interzonal tournaments, candidates tournaments to determine a challenger to the existing Word Champion starting in 1949/1950\. (The candidates tournament was changed to candidates matches after 1963 - see Bobby Fischer's complaint "The Russians have fixed World Chess": [http://sportsillustrated.cnn.com/vault/article/magazine/MAG1...](http://sportsillustrated.cnn.com/vault/article/magazine/MAG1074080/) )

Before the war, major chess tournaments were sponsored by wealthy chess patrons. FIDE represented amateur chess players, I think their crowning achievement was their nomination of the Max Euwe (who described himself as an amateur, he was a full-time teacher) as Alekhine's challenger in 1935 (and consequently beat Alekhine and became the 6th World Champion). FIDE had no hold over top-level chess. (Edit: FIDE also suggested Bogolyubov as Alekhine's challenger, twice. In all cases FIDE could not force Alekhine to accept, but Alekhine did accept to these challenges - possibly for financial necessity)

FIDE's World Championship cycles from 1949 onwards greatly increased the number of chess tournaments titled players could participate in, globally. Particularly the Zonal and Interzonal tournaments, brought together thousands of chess players regularly in - at the start - 3 year cycles.

So immediately, the number of tournaments involving titled players that adhered to FIDE rules jumped up substantially, and since the World Chess Championship cycle became the main top-tier events, other chess events naturally standardised on FIDE rules, and gave rise to hundreds of FIDE-rules tournaments.

So yes, the removing of the short-draw avoidance rule, in the context of a massive and new qualification cycle for the World Championship title gave rise to the side effect of shorter games.

Before the war, in patron sponsored top-level chess tournaments, each tournament had it's own set of playing rules. They were generally the same, a modification here and there based on previous tournament experiences of sponsors and influential players. There wasn't a consistent set of rules (until FIDE in 1946). For instance, in the Nottingham 1936 tournament book by Alekhine, he writes that they dropped the no-short-draw rules because it was becoming more evident players were circumventing that rule anyway, so it wasn't stopping non-competitive games from happening.

And the World Championship matches were predominantly decided by the current title holder, and mostly about whether it was financially worthwhile to the title holder to risk his title on a match with a sponsored challenger.

In turn, I wonder whether the tailing off of that in 1970 was the introduction of the Elo rating system and the Fischer-effect leading to the professionalisation, financial viability and the commercialisation of chess?

Maybe a rating system infused more competitiveness into tournaments, more professional application from the players.

Also, the tailing off of game length happened right when Fischer returned to the qualification cycle, where his spectacular series of results culminated in winning the World Championship in 1972 against Spassky in Reykjavik, starting the fracturing of the Russian hegemony of World chess.

Fischer also pushed for chess professionalism from a commercial/financial point of view. More money started to flow into chess because of Fischer and his financial demands / quality expectations. Perhaps that started the conversion of chess from a state-run Russian-owned speciality to a commercial/sponsored prestigious tournaments (e.g. Montreal 1979, San Antonio 1972, Milan 1975). And in conjunction with a rating system, compelled players to be more motivated towards playing for the full point, to improve their international standings, to improve the quality of tournament invitations, leading to more financial stability.

Somewhere between the Russian dominance of the World Chess Championship, up to Spassky losing to Fischer in 1972, and the multi-million dollar Kasparov- Kasparov matches from 1985 onwards, elite chess became a financially enriching career path for more and more players. 1970 may have predicated that, and the gradual rise of the length of games a side-effect of money being pumped into chess and initially the Fischer-effect.

</comment></comment></comment><comment><USER17> New players to chess are introduced to classical and Romantic games from the 1800s, and while I'm nowhere near very good, it seems harmful to show off these games as quality when they are often based on large inaccuracies. That being said, when I follow current top 10 player matches the players are so focused on playing the right move to maintain or develop an advantage that there is less sense of excitement or sharpness than games I've seen in games from 40-50 years ago. Perhaps that's why the famous players from then will be immortalized more deeply than prodigies like Caruana. Still, the advent of computers really changed the game, perhaps for worse.

<comment><USER18> I wouldn't advise beginners to study today's elite's game, because the opening preparation is incredibly deep and what you see is only the pit of the iceberg, meaning that it's impossible to really understand what's going on without deeply studying the opening theory, which is not what you'd want a beginner to do.

</comment></comment><comment><USER19> Do anyone know about a similar analysis of go? There are records of games dating hundreds of years too.

<comment><AUTHOR> I just found this research paper on Go: [http://biorxiv.org/content/early/2014/05/19/005223](http://biorxiv.org/content/early/2014/05/19/005223)</comment></comment>


Ask HN: Are tech companies making any effort to diversify their supply chains? - <AUTHOR> For example, after 3 years of trade conflict and now C19, is Apple making any attempt to diversify?  If not, is that rational? <comment><USER2> No</comment>


Ask not what you can do for your hobbies, but what your hobbies can do for you - <AUTHOR> http://blog.ralxz.com/post/37287361561/ask-not-what-you-can-do-for-your-hobbies-but-what-your

<comment><USER2> That's exactly how I see all prospective and current hobbies--if I'm doing it entirely for fun, it doesn't seem like it's worth my time. With so much to pick from, I'm always looking for something that on top of being exciting has lots of synergy with other stuff I'm currently doing, or builds up skills for me to realize long term visions. Great post concept.</comment>


US Senator wants FTC to regulate privacy on Facebook, other social networks - <AUTHOR> http://www.boingboing.net/2010/04/26/us-senator-wants-ftc.html

<comment><USER2> Probably Germans are complaining again?</comment>


Facebook pages are worthless for your startup. Go where the early adopters are. - <AUTHOR> http://thestartupfoundry.com/2011/02/16/facebook-pages-are-worthless-for-your-startup-go-where-the-early-adopters-are/

<comment><USER2> Be careful here, you are talking in absolutes.

If you are b2c you should definitely take a close look at facebook as a part of your marketing strategy. No, not for your friends / family but so you can pay for targeted facebooks ads to show to your potential customers to get them to like your page.

My startup now has over 35,000 'likes' on our facebook page, all in our target demo / market. This is huge. We now have a captive audience we can market to. I would put this just as high as building an email list and consistently marketing to that list.

YES it drives revenue, and more importantly awareness.

<comment><USER3> I'm impressed. Can you share how, or what kind of response those likes give you? Do you post updates regularly and see visible results?

<comment><USER2> We post when we have relevant content, which typically is a mix of new products / sales (we are eCommerce) as well as 'interesting' on topic content (funny videos, blog posts, etc from across the web). We also run contents like 'caption this picture' which are very popular

We see a good amount of likes and comments back and forth amongst the customer base, and as mentioned before it drives traffic to our website as well and keeps our 'brand' top of mind.

</comment></comment></comment><comment><USER4> I've worked a lot with PR, marketing and user acquisition methods for different startups the last couple of years and I can't agree with this article. My experience is the opposite, work with Facebook as much as you can, even if most of the "Likes" comes from friends.

There's two (combined) reasons for that:

1\. It's really hard to acquire users. With or without budget, the most important part of a startups success is the ability to find and get onboard new users/customers. Facebook might only be one method of getting people sign up for your service but hey, it's one of the most effective ones. If 200 people click "Like" on the same day, of course it will go viral if it's a cool startup. Friends or not, it 's people and most of them have great networks of other people around them. People with many friends are more likely to succeed not only with your Facebook Page but with the business itself. Guess why? People know people, even if they're not themselves in the right target group. Get many people like you, and they'll like what you're doing (and their friends to, _hint_ ).

It's no rocket science, really. Facebook is very effective for marketing. Use it. Tips: start the page as fast as you can. Growing the amount of fans takes time, with many invited friends or not. If you get pre-launch press, use it for something. To have 200 FB fans when you launch for real are very valuable.

2\. Retention. Facebook is great as a reminder to people. If you have many FB fans, you have many people to remind about your startups existence. Facebook is useful for getting long-time value of a initial interest/hype/launch. Actually more effective than newsletter subscriptions for some of the projects I'm involved in.

</comment><comment><USER5> Just a general comment about the site: I love your logo and headline styling, but why is the body text so unreadable? I know I can just ctrl+ it, but it seems that if you're building a better TechCrunch content-wise, why not shoot for better readability [reference intended] of the actual content? The emphasis looks like links and the graphic takes up a lot of room for an element that doesn't add anything.

<comment><AUTHOR> Thanks for the feedback mayank. I'll get this fixed.

<comment><USER6> agreed. something like 12pt/1.65 for .post-content works much better.

</comment></comment></comment><comment><USER7> My Facebook page allows me to broadcast content to my fans. That's valuable.

I've found that it's not all that effective when I'm promoting content that my readers get through my e-mails, RSS, or website, but it's actually really great when I'm promoting a sponsor (I'm in the employment space). I can usually send some extra clicks to my sponsor, and that makes the campaign look better.

</comment><comment><USER8> Most startups need to focus where their market is. If you're in B2B or focused on selling something to startups, you need to be on Twitter.

If you're more of a general consumer product, you should be on facebook, but not on a fan page, you should be trying to get users to "Share" your content.

Fan Pages can be a good way to communicate with existing customers or blog visitors, but it's not really an acquisition mechanism.

<comment><USER9> B2B startups need to be on Twitter?

Based on my experience with B2B, you don't even need a _website_.

<comment><USER10> Rüdiger, yor nick sounds like you're from Germany. Care to chat? If yes, email me pls (see profile).

</comment></comment></comment><comment><USER11> Your points about your Facebook network of friends not being your target market is many times true, and something I had not thought about. Good insight Paul.

<comment><AUTHOR> Actually this post was written by Robbie Abed, one of our new writers.

</comment></comment><comment><USER12> You should not just focus on twitter, but leverage community sites like HN. Also, social media is just one ends to a mean. There is always the good old fashion hustle in the streets to get that initial traction.

<comment><AUTHOR> Absolutely. Twitter helps to cultivate relationships, but meeting people in real life is where it's at. Twitter is a great tool to make that happen.

</comment></comment><comment><USER13> Great article - makes sense for many businesses, but not all. Getting your friends on Facebook could be very valuable if your friends ARE your target customers.

</comment><comment><USER14> I am with the author. I deactivated my FB account back in December. I don't trust friend's opinions and don't trust facebook to securely store personal data of mine or prospective users. Before adding the pretty bells and whistles, make sure your site attacts users and works correctly before wasting valuable design time.

</comment><comment><USER15> What about early adopters who "like" your site, come to your fanpage, and get their friends to check it out?</comment>


Loop: Pool on an Ellipse - <AUTHOR> http://www.loop-the-game.com/ <comment><USER2> Some other discussions at [https://hn.algolia.com/?query=elliptical%20pool%20points%3E2...](https://hn.algolia.com/?query=elliptical%20pool%20points%3E2&sort=byDate&dateRange=all&type=story&storyText=false&prefix=false&page=0).

</comment><comment><USER3> It's rather buried on the site, but there is an online version of the game at [http://www.loop-the-game.com/scoop/2015/7/21/play-floop- that...](http://www.loop-the-game.com/scoop/2015/7/21/play-floop-thats-finger- loop) if you want to test out your intuitive theories about the geometry of this.

</comment><comment><USER4> I'm not a big pool fan (nor am I skilled) but this seems to avoid the one part I actually like about pool... the runs.

It's fun to have a turn take a few shots and be able to work to setup your next shot in a series. This is a lot of quick back and forth.

All that being said... it's really cool they built it and probably fun to try.

</comment><comment><USER5> As kids, my brother and I always talked about opening a pool hall of novelty tables - varying shapes, terrains, multi-level, obstacles, etc. Bit like mini- golf. Would be so expensive to do though.

<comment><USER6> There was a game for the original Nintendo called "Lunar Pool" which was a pool simulation, with tons of different table shapes. It wasn't the best simulation, but I loved the variety of tables, and have always been a bit disappointed that it doesn't happen in real life.

</comment></comment><comment><USER7> I'd like to see them scale this out and get it in more places.</comment>


All new CUBRID 9.2.0 with new SQL support, performance improvements, and more - <AUTHOR> http://www.cubrid.org/blog/cubrid-life/all-new-cubrid-9-2-0-with-aix-support-performance-improvements-and-more/

<comment><USER2> 5 months ago.

But they don't have any updates/community/english ?

Forums are spammed.

Twitter stream not english.

Qa site nearly dead.

Chat ~dead.

Jira looks alive.</comment>


Self-hosted Git Server - <AUTHOR> https://www.petekeen.net/self-hosted-git-server

<comment><USER2> I spent years out in the woods with my own projects page that nobody could find and very few cared about, happily cutting trees down with nary a witness. I wanted control over backups, presentation, availability. I was terrified of relying on services that could disappear. I found self promotion distasteful, and I was happy to do the work just for its own sake, for the enjoyment of that process.

But then I wrote something people actually used. And they wanted it on Bitbucket, and then on Github, so they could contribute to it and track its progress.

Now that I've come in from my Zen training out in the wilderness, I feel that the old me who wanted "control" over all of my creations was immature and selfish, abstaining from participation in a community and helping no one but myself. I think that the social aspect of hosted coding sites, both for collaboration and exposure, is much more valuable than the control you get from running the whole show yourself.

<comment><USER3> Honestly, I'm not super concerned about GitHub disappearing in a puff of octocat ink one day. I know they're around for the long haul and I think they've done great things for open source.

No, I'm more concerned about branding. If someone comes to my site and I direct them somewhere else, I lose them. If they stay on my site and browse around, my site's look and feel is indelibly linked with my code, my projects, and ultimately me as a professional software developer.

<comment><USER4> Is branding the biggest reason for hosting your own git server?

<comment><USER3> For me personally, I guess the biggest reason is being able to control the user's experience, as well as my own. Plus I think it's neat, and it was a fun project to do on a Sunday afternoon :)

<comment><USER5> You seem to completely misunderstand. People using, forking or contributing to your projects do not want their user experience to be controlled by you. They want their own familiar user experience.

Of course it's a fun project, but it's really meta. Wouldn't it be more fun to work on one of your actual projects ?

</comment></comment></comment></comment></comment><comment><USER6> I checked out this guy's site. I understand he is reinventing the wheel. I respect that and do not mean anything negative about that. A lot of us are here to understand the wheel and build for ourselves. There is good value for that.

What I do not understand, with all due respect, is the value of Github, and to a lesser extent Bitbucket, is in the features outside of the VCS core and how most people realize there is nothing Git-like to replace the actual project management tools where people find Github value. That is, bug tracking/issue tracking is the killer feature.

To self-host this is problematic. This is not to say there are not good solutions. Traditionally that is Bugzilla, Trac, Redmine, and more recently a la ArchLinux and Music Player Daemon (MPD) I have seen Mantis BT. It looks interesting. The problem is, as others point out, maintenance, and adding the centralized to the decentralized, thus the point of Git, Mercurial, and others. I noticed this guy hosts his own repos (I tried links to bugsplat.rb) and it did not load, but I assume there is not bug tracking, despite the name.

Even this year, I decided to look into the state of DVCS integrated bug tracking. Very few tools exist, or many have problems. BE, bugseverywhere, kind of exists and has seen contributions as of last year. Ticgit was forked to ticgit-ng, but ironically that is a Github project and its bugs are in the Github issue tracker. There was a very cool Perl project, which seems abandoned, called SimpleDefects (SD), which also wanted to do distributed bug tracking. It was going to sync with Github and other issue tracker systems with decentralizaton, so you could git pull for bugs as well. This one has not seen updates for years, as I can tell, but might be the coolest of them.

Unfortunately, keeping you whole project decentralized is difficult. I have begun to look into fossil again, despite what people here say, because it might be ugly, but no VCS has its own bug tracker or wiki integration, all written in C. It is the SCM and bug tracker for Sqlite, Tcl, and even for all of NetBSD packages. The last really surprised me. I think for the little guy, that is ideal. Monotone might be worth revisiting (I had multiple problems 3 or 4 months ago because it was embedding Lua and they had not come up to the 5.1-5.2 API changes and builds failed; everyone is hard to find), even with the only data about it is there page and links to snarky Linus Torvalds jokes about the horror of OO data structures and modern C++ programming for a SCM.

In short, you should know to host your own Git repos (they are designed, with the native package tools in Git or others) to host simply on a website. It is best for even the lowest footprint web servers, shared hosting or not.

What git does not have, is the beautiful features that keep people on Github all day. I really wish distributed bug tracking advanced, but no one is interested. This topic only comes up when Github is down (or maybe in this case but Github is having publicity problems today). If people made a good tool like SD, that has its own bug tracking that syncs well with Github or (insert hosted SCM here), that would be fantastic. I could be more relaxed, principally, by relying on such tools.

Back to read the Fossil manual.

<comment><USER7> I don't consider Github's issue tracker to be particularly good.

Sure its convenient if you just have a small project and don't want to host an issue tracker yourself and don't care about the usability of the issue tracker.

The "killer feature" of the issue tracker is that you don't need to create yet another login just to report a bug. Chances are you've reported an issue on github before, or if not you just have to create a user once, that you can use to report bugs on _any_ github project.

I consider Github's issue tracker to be a _significant_ step backward/in the wrong direction from Bugzilla for several reasons:

      * defaults to markdown instead of plain text [1]

      * no easy way to attach binary files[2]

      * no easy way to attach files[3]

At least from a project developer's perspective I find bugzilla much easier to use (once you get used to it), and has more features.

There are some minor improvements in Github's issue tracker, but none that would want to make me switch.

[1] Whenever I paste some error message / shell output I need to escape it in <pre> or <code> blocks, otherwise it messes up the formatting. I initially created a lot of broken bugreports, that I had to edit once I've seen how bad it looked, of course then I found out you can _preview_ the bug before submitting. IMHO text should be the default for bugreports, not markdown!

[2] they come in handy depending on the project. If the project deals with binary files, it is expected that bugreports may have to contain them as well

[3] Besides creating a gist and pointing to the gist you pretty much have to self-host any file you want to "attach" to a Github issue, unless I'm missing something.

<comment><USER8> This is an interesting comment, my work flow is almost completely different. I wonder if it's a difference based on what language we both spend the majority of our time in (for me Javascript, python, ruby).

* For markdown I prefer the synatx highlighting and scrollbars that show up on github to the giant blobs plain text gives you.

* I rarely want to attach binary files while I often find myself embedding inline images to illustrate a point

* I use cat test | gist -c -f test.txt -d "Output from failure" (it puts the gist link in my clipboard).

<comment><USER7> Majority of my bugreports are related to C/C++ and to some extent OCaml, and mostly command-line programs. Hence a text-based entry for the bugreport is more convenient.

</comment></comment></comment></comment><comment><USER9> The fantastic thing about distributed version control systems like GIT is that you never actually _have_ to depend on a single repository.

Use Github, Bitbucket, and your own "server" all at once. None have to be read-only. Push and pull from multiple sources.

Decide that Github is no longer the place for you? No problem! People contributing to your projects should already know where to push to reach everywhere it needs to go and they only need to stop pushing to github.

No reason to rely on a "central" repo.

<comment><USER10> Worth noting though, a lot of the value of GitHub in particular, and to a lesser extent many other services, are extra features like issue trackers, wikis and so on that act to lock you in.

<comment><USER9> I can certainly see services like wiki and issue tracker hosting being big value-adds with GitHub. Thankfully GitHub does allow you to export your data. (And to be honest, I feel it would be a mistake to use these services if you _couldn 't_ export your data.)

The wiki system on GitHub is based out of it's own git repo ([https://github.com/[user]/[repo].wiki.git](https://github.com/\[user\]/\[repo\].wiki.git)). If you could be bothered to pull/push when changes are made, I'd imagine this content could then be made distributed.

While not distributed/decentralized... GitHub does lets you export your existing issues. The resulting archive can then be imported into services like bitbucket, pivotal, and etc with a little work.

There _are_ solutions for distributed/decentralized issue tracking, but I haven't seen any great way for users to interact with them. (SD and Bugs Everywhere, other users have posted links in their replies.)

</comment></comment></comment><comment><USER11> Here's another example, using Ansible and a few simple roles from Ansible Galaxy: [https://github.com/geerlingguy/ansible-vagrant- examples/tree...](https://github.com/geerlingguy/ansible-vagrant- examples/tree/master/gitlab)

Give Vagrant + Ansible about 15 minutes, and you'll have a nice little local GitLab server running. Modify the Ansible playbook slightly, to point it at a VM on Digital Ocean or elsewhere, and you'll have a nice little hosted copy of something like GitHub.

I run an instance of GitLab on a Digital Ocean droplet, and back it up to a cheap RamNode VPS; all my GitHub repos are pulled daily to repos on the GitLab server (for backup purposes—I use the GitHub repos primarily), and I also use this GitLab server as a central repo to which I push changes for my sites/services, and pull from on production servers.

There are many good reasons to put certain repositories on GitHub, and there are some good reasons to host some repositories yourself (or to just have one local working copy, with a backup).

<comment><USER12> I've been playing with this same setup for the last two weeks at work. I've got our full dev server config in ansible and stored in a repo that has a post receive hook that self-runs the playbook, and an instance of git lab running in a container and routed via nginx.

Gitolite is pretty robust, but after setting it up I kept on thinking of features I would like or need and I realized I was just rewriting git lab :) there are some docker images that make setting it up cake, and a full installer available for centos and Ubuntu.

Also I think I've used some of your roles off galaxy :) thanks for writing them haha

</comment></comment><comment><USER13> I also use my private repositories (simply setup using gitolite), but I simply also push to GitHub for the added discoverability.

I tend not to like GitHub however. The wiki/issue tracker actually require you to be online, which is the best thing about git: being able to work without network connection.

I'd like to find some project that syncs github issues with sd ([http://syncwith.us/sd/](http://syncwith.us/sd/)) or bugseverywhere ([http://www.bugseverywhere.org/](http://www.bugseverywhere.org/)), so that I could actually work on the issues without being online (the bigger pain point are attachments which need to be downloaded).

Another thing which I consider inferior to patches by mail are pull requests. Honestly, it's very rare that I can accept a patch without some reformatting or minor corrections. I also never ask people to do such minor reformatting just to be able to click 'accept'. Again, pull requests cannot be worked-on or accepted offline. Similarly, my patches sent to other projects are similarly handled by other authors.

<comment><USER14> Fwiw, pull requests are merely branches im the repository (named pr-* if i'm not mistaken)

</comment></comment><comment><USER15> An elegant solution for you, no doubt.

However, I couldn't part with the excellent tools that GitHub has developed (and will continue to develop) over the years.

<comment><USER16> I still use GitHub quite a lot, but I've started using a private installation of GitLab[1] for private projects and I quite love it. So far, I've only been using it for myself, so I'll admit I haven't really touched the collaborative features, but it does seem to have a lot of the nice features from GitHub.

[https://www.gitlab.com/](https://www.gitlab.com/)

<comment><USER3> Yeah, GitLab is great. I wanted a quick solution without many dependencies that would also act as a portfolio, so I went with a custom thing. GitLab is definitely something to consider.

<comment><USER17> I use GitLab at work, but for home, the amazing GitBucket does the trick and took a total of 30 seconds to install [https://github.com/takezoe/gitbucket](https://github.com/takezoe/gitbucket)

<comment><USER18> If you want to setup GitLab quickly please check out the packages [https://www.gitlab.com/downloads/](https://www.gitlab.com/downloads/) (I'm a co-founder of GitLab.com)

</comment></comment></comment></comment></comment><comment><USER19> It looks there are two main reasons to have a private Git server: to archive your own code, and to have control over how visitors and collaborators view your shared code.

If you want a place to store or archive personal projects (because you don't want to pay for private Git hosting?) features like wikis and issues become rather irrelevant, and if you want to move that data to or from GitHub, that takes some effort to be explicitly exported instead of just adding a new remote.

If you're trying to keep your own code, running your own Git server is simple if you have SSH (or not even SSH if you want to create a local "server"). The Git website has a simple tutorial for this: [http://git-scm.com/book/en/Git- on-the-Server-Setting-Up-the-...](http://git-scm.com/book/en/Git-on-the- Server-Setting-Up-the-Server)

I've also simplified this workflow into a tiny command, "mygit": [https://github.com/interestinglythere/mygit](https://github.com/interestinglythere/mygit)

As for running a GitHub clone, unless you have some really edge-case needs or you really don't want to pay for private collaborative repos, your time is probably better spent maintaining your actual code. In addition, having your code on a social site will make it more receptive to contributors. If you don't want contributors, why do you need a /Git/ server? (If it's because that's how you like to manage your code, see my first point.)

</comment><comment><USER20> Also check [https://github.com/takezoe/gitbucket](https://github.com/takezoe/gitbucket) Installation is as easy as downloading it and running:

java -jar gitbucket.war

<comment><USER21> Disingenuous. What happens when you need to restart your server because of some extreme necessary security patch?

How do you manage backups?

Since it's running on java, you probably don't want to expose this server to the internet unless you actively want to maintain updates to JDK versions. So now you're on the hook for that.

Self-hosting is never "simple".

<comment><USER22> "Since it's running on java, you probably don't want to expose this server to the internet"

Is latest versions from tomcat/jetty/etc. really known for having major security holes? More so than apache/nginx/etc.

Maybe you are confusing the recent Java applets security issue with Java in general. Java has got to be one of the most well funded and developed technology out there, due to peoples reliance to it in enterprise.

People also don't normally run their Java web server as root which adds a bit more security. If there is something about Java security that makes you so worried, I would love to hear about it. As it will probably be news to me.

<comment><USER21> Some of the exploits that target applets also affect running servers. Tomcat or Jetty or WebLogic from two years ago are likely compromisable pretty easily.

Any web server has the same issue, and most people are more than fine if they update somewhat regularly. Whether node or rails or whathaveyou, you need to keep updating.

My code on github from two years ago is as secure now as it was then, because someone else has taken on the onus of playing security-update wack-a-mole for me. That's all I meant; I didn't mean to imply java was less secure by default than any other thing listening for connections on the internet.

<comment><USER22> "Some of the exploits that target applets also affect running servers."

This would make sense. It's the same reason why php makes apache or ngnix insecure. They are front facing and have access to the OS filesystem and such.

"I didn't mean to imply java was less secure by default"

Okay gotcha. I work with Java quite a bit and was confused by your statement as I thought I missed some major security news.

</comment></comment></comment></comment></comment><comment><USER23> Well. I have to be honest. I used to do just that. And it is not fun to worry about backups and server breaking down. Outsourcing this part to Github will probably save a lot of developer/IT headache if you are a small company.

</comment><comment><USER24> What about all the problems that are inherent to hosting _anything_ ? It's not hard to set up a server that will respond to a request and deliver data.

It's hard to make it do that when the power goes out, when you anger somebody and they decide to ddos you, or when your code/service/whatever becomes insanely popular and whatever mac mini you run it on is overheating. It's hard to keep up with all the security patches required to keep your box from getting pwned. It's hard to negotiate the fine print with all the TOS's you've signed with your internet provider.

<comment><USER3> I'm sorry, I should have clarified. My private repos are running on a VM in the living room, but the public-facing website and repos are all on a Digital Ocean VPS.

</comment></comment><comment><USER25> I have registered in January 27 2009 to github, but I have been running my own git repository on a dedicated server for quite some time. I have never really been active at github or any other third party repository service. The reason I want to self manage my hosting is that I can get cheaper private repositories.

</comment><comment><USER26> For private repositories, I've discovered a software called SCM Server. It lets you add different users, with passwords, and create SVN/Hg/Git repositories with each their own access list.

</comment><comment><USER3> Sorry about the occasional 502s. I added a smattering of caching to the project pages so it should be better now.

<comment><USER21> This is my point exactly. Self hosting is maintenance. In the time you got 502s, my github pages stayed up. It is grossly inefficient to host your own source control.

Libraries and third party services exist for a reason.

<comment><USER3> Life is built of tradeoffs and compromises. For you, github pages makes total sense. For me, not so much. Saying that my little VPS is "grossly inefficient" compared to your GitHub repositories is like comparing apples to... I dunno, like a rock? or a monkey? Something else entirely, that's for sure.

<comment><USER27> It only proves you did not build your solution with scalability in mind. Once you get more traffic and the hosting bill goes up, i'm pretty sure you'll reconsider self hosting for the sake of self hosting.

<comment><USER3> The page in the original post has received 16,000 pageviews in the last 12 hours. Admittedly the project pages were not performing very well initially but after I added caching they haven't even blinked, and the dual core VPS (which runs a dozen other services besides this) is ticking along at a load average of 0.63.

Tell me again how I didn't design for scalability. I'd also love to hear your definition of "more traffic".

</comment></comment></comment></comment></comment><comment><USER28> heh, what at the odds: two libs that give you object-oriented access to git repos both coincidentally named the exact same thing:

python: github.com/rsgalloway/grit ruby: github.com/mojombo/grit</comment>


Big Oil Faded. Will Big Tech? (Today All of Exxon Is Worth Less Than Jeff Bezos) - <AUTHOR> https://www.nytimes.com/2020/08/27/technology/big-oil-faded-will-big-tech.html <comment><USER2> In general Amazon, with the exception of AWS, isn't really a tech company. It's a retailer/logistics company which made a critical bet in automating it's operations.

Even it's Kindle operations is just value-added for their retail branch.

In that sense Amazon is not a tech company like Microsoft or Google or Facebook. Amazon's business, with the exception of AWS, consists of selling goods and services through an online catalogue. You see a product, click click and it's delivered to your door step it a couple of days. Controlling the entire logistics network that delivers products from the factory to the door step of any regular Joe is a line of business that doesn't depend on tech excellence.</comment>


Let's Build a Simple Interpreter. Part 6 - <AUTHOR> http://ruslanspivak.com/lsbasi-part6/ <comment><USER2> The shunting yard or precedence climbing algorithms are better approaches to expression parsing. They make it trivial to add operators and change precedence levels without the convolutions of a recursive grammar. They also clear the way for user defined operators since the machinery is controlled with a table that can change dynamically.

<comment><USER3> I think shunting yard is a bit more complex since it requires a separate stack, but precedence climbing is definitely better than pure recursive- descent and follows quite straightforwardly if you try to refactor an RD parser by noticing that most of the functions are very similar, of this form:

        while(token in tokens[level])
            consume token
            result = result operator[level] func[level+1]()

Then you realise that you don't need to climb up each level of precedence with a function call, and instead can go right to the level of the token and consume everything "above" that level... so it's really more like "precedence jumping". This also means the call stack doesn't get deeper in proportion to the number of levels, unlike with a pure RD parser. There could be 10 or 1000 levels in the table and the running time will still be the same - linear in the number of tokens in the input. This is especially good for languages with many precedence levels like C, or more complex applications with dynamically defined operators as you mention. A more detailed explanation of this derivation is here:

[https://www.engr.mun.ca/~theo/Misc/exp_parsing.htm#climbing](https://www.engr.mun.ca/~theo/Misc/exp_parsing.htm#climbing)

</comment></comment><comment><USER4> A less verbose, in loc and exposition, example can be found here:

[http://www.jroller.com/languages/entry/python_writing_a_comp...](http://www.jroller.com/languages/entry/python_writing_a_compiler_and)</comment>


This is how you hustle - <AUTHOR> http://www.jacksimpson.co/this-is-how-you-hustle/ <comment><USER2> Not a huge fan of this to be honest. From my perspective as a user, I don't want businesses I have no involvement with contacting me out of the blue. It's not quite spam, but I would treat it largely the same.

I'm also unsure that it's a good long term strategy for the business. It may generate some customers, but building a customer base on people who have A) shown themselves to be relatively fickle in choosing a host and B) have a tendency to use public channels to raise issues strikes me as a unstable base.

<comment><USER3> > _I don 't want businesses I have no involvement with contacting me out of > the blue. It's not quite spam..._

Unsolicited email from parties you have no involvement with is spam by definition.

And note to spammers and marketers on HN, I know I'm abusing my spam filters, but if I see emails from parties I don't recognize because " _I subscribed for updates to one of their partners_ " (or some other bullshit explanation like that), I instantly flag them as spam, even if they have an unsubscribe button, because I can't unsubscribe from something I never subscribed to and I refuse to validate my email address like that.

<comment><USER4> The easiest way of killing spam is to hit the spam-button in Thunderbird. Spam is always spam and I have more fun things to do than find some unsubscribe button. That will only mark my email as active and give a better price when selling it further.

<comment><USER5> It's even more fun doing it in GMail, because if enough other people do it then spam is more likely to be widely dealt with in the manner it deserves.

</comment></comment></comment></comment><comment><USER6> In my opinion, this is not hustling but ambulance chasing.

Every tech company is going to have bad operational issue days. Going at your competitors customers regularly when your competitors have bad days will net you more negative reactions than positive, in my opinion.

<comment><USER7> It's also literally spam - unsolicited advertisement.

<comment><USER8> Is it unsolicited when you post your issue on a public medium for all the world to see? I consider any such public announcement a direct request for the target's response and an indirect request for the public's response.

<comment><USER9> On that medium, yes. By email, no. Every tweet I post is not an invitation to the world to send me promotional emails.

</comment></comment></comment></comment><comment><USER10> They've approached someone out of the blue, and offered no incentives or value over their competitor other than some arbitrary statements about how they 'just know' their service will be somehow better.

This avenue of "cold calling" is a bit new and interesting, but the way this webhost has done it just reeks of desperation. This isn't hustle, this is begging.

<comment><USER11> I would also be a little wary about it, but they're reaching out to a potential customer, with a targeted message at the exact moment they know the potential customer is frustrated with their current provider and possibly more open to change than normal.

That's awareness, hustle, and smart targeting in my opinion. Now, I'm not going to change hosting providers over a single outage, but the time to reach out is when I'm down...

<comment><AUTHOR> That's exactly my thinking. If I actually made money off my site or it was happening too often I would have been really ripe to poach.

</comment></comment></comment><comment><USER12> Lots of people pointing out this was likely automated and provided no proof of customer benefit, etc, all of which may be true in this instance. I do have a similar story that impressed me, however. Three years ago I was in the market for my first 3D printer and was looking for a specific model, but the manufacturer had a long delay for shipping. I tweeted asking if anyone knew where I could get one fast. A competitor quickly replied telling me they could ship me their printer within 48 hours. But that wasn't the end of it, they then proposed that they would print anything I wanted and take photos of it for me to show the quality, which I took them up on. Emailed them a file, and pretty quickly got emailed back photos of the print in progress, and then another email showing the final print close up so I could see how well it came out. Pulled out my credit card then and there.

</comment><comment><USER13> This is how you turn e-mail to crap - not how you hustle.

If they had tweeted to him back or DM him (i.e. used the same medium as him) then I understand. Sending unsolicited e-mail that capitalizes on a competitors stumble just makes you look petty IMO. Also, people should want to consume your service because they LIKE what you do more than your competitors not because you are pouncing on another's misery to flog your own thing.

Please do not encourage this kind of behavior by writing blog posts about hustle.

<comment><AUTHOR> > capitalizes on a competitors stumble

If I was actually making money off my site, I would probably be livid enough to dump my current provider - this is by no means the first time this has happened (although of course I bring this on myself by choosing an extremely cheap hosting provider and completely accept the risks I take).

Yes, it is sad when people stuff up, however if I was earning a living off that hosting, then I wouldn't see something wrong in a competitor specifically offering to fix something that is hurting my income.

</comment></comment><comment><USER14> I feel the OP likely may have been duped by an automated message that was setup to send during status issues or Tweets to a company's customer support representatives. I've sent some Tweets to customer support before (threatening to leave) that were "loved" by a competitor within seconds.

<comment><USER15> I hope the OP does realize that. Perhaps it's just the thought to put out a bot that scans twitter and sends such automated emails? The bot may take active effort to script, so there is at least some "hustling" going on.

<comment><AUTHOR> It wasn't, I emailed him back right away and we ended up exchanging multiple emails in a very brief period of time. Either that or chat bots are smarter than most humans these days.

<comment><USER16> Or the initial email was sent by a bot, but the follow-up was human?

<comment><AUTHOR> I'm really used to getting those bot emails by now, the personal greeting (left out of my post for brevity), speed of getting back to me, and conversation I had with the fellow after made it fairly clear it wasn't a mass spammed message.

</comment></comment></comment></comment></comment><comment><USER17> I disagree. I think trying to take advantage of your competitors outage situation is bad form, mainly because you will mostly likely suffer an outage as well. From a marketing point of view, it may be good for a while, but can be used against you in the future. This is the first thing my first manager taught me 20+ years ago in software, and I still tend to agree with him.

<comment><AUTHOR> I completely agree - if you swoop in and promise better uptime etc then you're making a deal with people that they won't experience this problem. You now need to be sure you can deliver.

</comment></comment><comment><USER18> Nice. Some email recipients will be creeped out or annoyed by this tactic, but their negative response is far outweighed by the positive response from someone like OP. Too bad for the company that he didn't name them in the post — that would have been a real coup. Think of the backlinks!

<comment><USER19> I thought he did mention them - PeoplesHost? Or is that a fictitious name?

<comment><USER20> I think the comment was a sly way of insinuating that the original blog post may or may not be 100% authentic.

<comment><USER21> I also wondered whether the blog post might be native advertising.

<comment><AUTHOR> Can you tell me how I can get people to pay me to write articles on my personal blog? So far I've mainly written about my interests in machine learning and science, but as a graduate researcher an extra source of income would be great /s

<comment><USER21> I should have clarified that I looked around your blog and based on the other in-depth content there, I figured it was a genuine post. It was just that my first impression was that this might be native advertising -- which says more about how the rest of the internet is nowaways as opposed to anything about your writing style or blog content.

<comment><AUTHOR> Oh I see, that's probably fair enough - I did toy with the idea of leaving a message at the end clarifying that I had received no money for writing it, but ended up leaving it out.

I didn't edit the names out when they were mentioned in the email but I did try to avoid gratuitous references to them in my main content.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> You actually read cold sales emails, and believe promises by sales people like "customer service" or "solving your problem?"

That well was poisoned by "hustlers" (in the derogatory meaning) a long time ago. Unless I have experienced it myself or a trusted acquaintance recommends it, it goes into the bin for me. No exceptions.

<comment><AUTHOR> "cold sales emails" There's a difference between cold sales emails that are completely impersonal and emailed out to thousands of people an an email that is personally addressed to me and my current situation.

"believe promises" No, you're reading in to what I believe. I stated that it made them _look_ good since they were responding to me more quickly than the company I was paying which had stuffed up.

</comment></comment><comment><USER22> There was an article within the last few weeks here where, in the comments section, this tactic was discussed. Lead generation by watching for Twitter complaints about your competitors. Wish I could find the article.

</comment><comment><USER23> Great article! While the company's methods is arguably on the edge of playing dirty, I think the line hasn't been crossed; all of us are just trying to do our best in this world, and those with the best hustle win. I think this company's method is a good example of someone thinking outside the box to get new customers, and I respect that.

From the customers point of view, their methods is probably really useful too- if I was paying for something, I'd want to make sure that I'm getting the best product my money can buy. I don't necessarily care WHO it is I'm paying, as long as the end product I get is the best value. So honestly it would be a "spam" email I'd be glad to receive!

Thanks for sharing!

</comment><comment><USER24> Interesting that the user that submitted this article is a spammer buying votes. Have comment karma farmers found their way to HN?

<comment><AUTHOR> Thank-you for the insightful contribution.

</comment></comment><comment><USER25> Maybe we need to scale up the specific approach (thought experiment).

Let's say that 10% (a small minority) of companies offering hosting adopt the same strategy, and that 20% (again a rather small minority) of them manage to get your email address (assuming that the other 80% missed your tweet or did not monitor specifically the twitter account or were lazy or are incompetent, it doesn't matter).

If there are 1,000 such companies, in no time after you post a tweet on your current hosting company you will find in your e-mail box 20 (unsolicited) messages, if there are 10,000 such companies that will be 200.

Would you react in the same manner?

</comment><comment><USER5> I don't see how this does anything other than encourage spamming. I make a point of marking this sort of email directly as spam, and I would certainly hope others do too - it needs to be discouraged.

<comment><AUTHOR> I don't know, I see a difference between an email personalised to myself and my current situation seeking my business vs mass spam.

</comment></comment><comment><USER26> Hello Everyone,

Instead of responding to comments individually I wanted to make one comment (and one comment only) to the responses to this article.

This is ONE of many strategies PeoplesHost employs to acquire customers. To address some questions or concerns others have mentioned in the comments made earlier:

\- The blog post is authentic. Jack is someone we reached out to earlier today. He responded by complimenting the hustle and giving him inspiration to write that blog post.

\- This is a manual human process and not automated or in bulk. Monitoring social media is a very tedious and timely process that we do on a daily basis.

\- Yes, there are many who disagree with this approach as well as many who don't. We receive an equal share of people who respond in a positive light as well as those who call us ambulance chasers.

\- Yes, no (hosting) company is perfect. Every hosting company will experience some sort of outage, disk failure, etc. at some point in time. It's inevitable and we understand that. When an event like this occurs, the web hosts should communicate and be honest with their customers base, which often times isn't the case. Customers are given the run around, canned responses, and shown a facade on social media that support is actually responsive when in fact all other support channels (live chat, phone, and tickets) the customer is left hanging where the public eye doesn't see.

Many of the vocal people we reach out to on social media are people who aren't receiving the support they deserve as a customer. These customers are taking to social media channels because they're receiving no updates or responses to their requests; it's their last resort to motivate their current provider to help them. For example, tickets going left unresponded to for many days. That's unacceptable and customers deserve better service. Many times, these customers are on their last string and ready for a move.

We understand that many of these targeted people run their businesses online and it's their livelihood. This is our livelihood too and we truly show our customers that we value them and their business..we wouldn't exist or be in business if it weren't for our customers. We've built a solid foundation of customers and built the company off the premise of exceptional and personal support.

\- Some will see it as spam and others won't. We target these customers online who are 1) publically pleading/crying for help 2) have their domains listed on their profile and 3) have no private registration on their domain. This allows us to find their information in the public WHOIS database (again, it's a manual and timely process) and reach out via email, twitter, or directly on their website's contact form.

\- We are not desperate and have a very healthy customer base. Our reviews speak for themselves.

\- Many of you may or may not know how competitive the hosting landscape is or how the industry works. Larger conglomerates (I won't name names) spend upwards to $200+ to acquire shared hosting customers via paid search, affiliates, and reviews.

Generally speaking, most consumers don't understand that the "review" sites they trust and rely on are getting paid $200+ for any referral sent to the hosts listed on their top 10 charts. These charts are solely based on who (which hosting company) is willing to pay the most for a referral and/or which host converts the best earning that review site or affiliate the most commission. We simply thought of a new way to target customers in a way that doesn't break the bank.

With that said, it is very enlightening to see other's thoughts on the subject in a public forum.

<comment><USER5> "We're spammers, but we work really hard at it!"

<comment><USER27> I wouldn't call this spam. Specifically because it is prompted and truly individualized. Moreover, they use only intentionally public info (twitter and whois).

They also aren't pushing hard, this is essentially the softest sales-pitch that is actually a pitch.

<comment><USER5> I would call it Unsolicited Commercial Email, because that's precisely what it is.

I suppose you could philosophically contort a meaning by which "it's not _really_ spam if you squint", but if I get that garbage in my GMail I hammer that "report as spam" button so fast, and encourage everyone else to do likewise.

<comment><USER28> It is not completely Unsolicited because the client has asked for help on twitter.

<comment><USER5> If I tweet something and someone tries to email me to sell me something about it, that's completely spam and I will continue to mark it as such and advocate that others mark it as such. How the hell is that not spam?

</comment></comment></comment></comment></comment></comment><comment><USER29> So ambulance chasing gets you customers!

</comment><comment><USER30> There's no better time to spam me than in a crisis!

<comment><AUTHOR> Well, they sent me a personalised message, deliberately at a point when I was frustrated with my current hosting provider. I don't make money off my site, but if I did I'm pretty sure I might have been livid enough to take them up on their offer. When you

</comment></comment><comment><USER31> All this post shows is that some people are easily impressed. Nothing original or praise worthy to see here.

<comment><AUTHOR> I thought it a rather novel strategy and an interesting experience.

</comment></comment><comment><USER32> > I sent them a Tweet to ask them to please resolve the issue. Before they > even responded to me, I suddenly had this email in my inbox

How did the Company that was trolling their Competitors' twitter account have access to this guy's email address?

<comment><AUTHOR> I'm guessing that they looked up the domain, saw the email associated with it and then emailed me directly.

<comment><USER32> > saw the email associated with it

How?

<comment><USER33> whois listings</comment></comment></comment></comment>


Story about Russian propaganda immediately flagged and removed - <AUTHOR> The "news" on this site recently had a story about Russian propaganda and what could be done about it. It was immediately littered with what seemed to be "propaganda" comments about how the article couldn't possibly be valid. Then it was removed from HN.
What gives?
Original item and link:
https://news.ycombinator.com/item?id=13413878
https://www.rand.org/content/dam/rand/pubs/perspectives/PE100/PE198/RAND_PE198.pdf <comment><USER2> I'm not trying to explain, because I don't know. But the story was posted before:

[https://news.ycombinator.com/item?id=13040737](https://news.ycombinator.com/item?id=13040737) (22 points, 52 days ago)

And first mentioned in the relevant thread 141 days ago:

[https://news.ycombinator.com/item?id=12377286](https://news.ycombinator.com/item?id=12377286)

<comment><AUTHOR> Reasonable... it's just funny because the article from today had the first three comments that were clearly from trolls. But thanks for the info.

</comment></comment><comment><USER3> It's marginally on-topic IMO, and people are probably just getting burned out on this whole topic. I didn't see it or flag it, but had I seen it, I would have been tempted to flag it. _shrug_ It happens, there's probably not a big conspiracy or anything.

Unless there is...

<comment><USER4> Isn't people getting burned out by contradictory information exactly the theory? /conspiracy

</comment></comment><comment><USER5> I could be wrong, but it looks like a valid and interesting article. While it is a duplicate post, enough time has passed since the original submission. It may have been reflexively flagged due to concerns that it consisted of politically partisan clickbait.</comment>


IAM Roles for EKS Pods - <AUTHOR> https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/ <comment> tedk-42 big news - i'm gonna repost this...</comment>


In Defense of the Blurry Black Hole Photo - <AUTHOR> https://newrepublic.com/article/153545/defense-blurry-black-hole-photo <comment><USER2> they have not taken a picture of a black hole because that is not possible..

they have at best constructed an image of some effects of a black hole.</comment>


Google Offers beta launching in New York City and the Bay Area - <AUTHOR> http://googleblog.blogspot.com/2011/07/google-offers-beta-launching-in-new.html

<comment><USER2> Does Google have a "always play catch-up" mantra in addition to "don't be evil"?

\- Hotmail (Gmail)

\- Mapquest (G Maps)

\- Firefox/IE (G Chrome)

\- iOS (Android)

\- Apple TV (G TV)

\- Twitter (G Buzz)

\- Facebook (G +)

\- Groupon (G Offers)

etc.

<comment><USER3> Well, considering that they started out taking an existing concept and making it better...

\- Google (AltaVista/Lycos/etc)

</comment></comment><comment><USER4> I gotta say, I'm already burned out on the Groupon-type sites. I'm not sure why they think I need to get waxed two times a week—I haven't seen a relevant offer in months, after buying a few in the first couple months. The only one that I still check interestedly is the Living Social travel deals, because with those, if you get a hit once a year, it was worth it.

<comment><USER5> If you like Living Social travel deals, SniqueAway and Jetsetter are great too. (I'm not affiliated with either one.)

</comment></comment><comment><USER6> Funny. Just about a week after I opted out of all of my offer emails. The signal to noise was getting out of hand.

</comment><comment><USER7> Heh, after a failed deal with Groupon this came about, apparently.

It'll probably fly better, too, since it'll integrate with the rest of the google services, and help google use us as a product...

Now only for it to start in a city I live in.</comment>