NHS open-sources contract tracing iOS and Android apps - <AUTHOR> https://github.com/NHSX <comment><USER2> Some quite interesting stuff around how they might be getting around the background iOS restrictions[1] can be found in the Android source.

Looking at the Apple documentation on background peripheral bluetooth, they state "All service UUIDs contained in the value of the CBAdvertisementDataServiceUUIDsKey advertisement key are placed in a special "overflow" area; they can be discovered only by an iOS device that is explicitly scanning for them"[2]

I wonder if they have managed to reverse engineer this overflow area so it is accessible via Android.

Someone did some looking into this and it seems at least feasible[3]

[1]: [https://github.com/nhsx/COVID-19-app-Android- BETA/blob/maste...](https://github.com/nhsx/COVID-19-app-Android- BETA/blob/master/app/src/main/java/uk/nhs/nhsx/sonar/android/app/ble/Scanner.kt#L58)

[2]: [https://developer.apple.com/library/archive/documentation/Ne...](https://developer.apple.com/library/archive/documentation/NetworkingInternetWeb/Conceptual/CoreBluetooth_concepts/CoreBluetoothBackgroundProcessingForIOSApps/PerformingTasksWhileYourAppIsInTheBackground.html)

[3]: [https://crownstone.rocks/2018/06/27/ios-advertisements-in- th...](https://crownstone.rocks/2018/06/27/ios-advertisements-in-the- background)

<comment><USER3> It's interesting to consider that Bluetooth cannot be used to estimate distance between two devices in any meaningful way in real-world environments.

A recent article [1] confirmed this in interviewing the inventors of Bluetooth.

The environmental factors were explored in a recent conference on contact tracing [2] with leading researchers.

So in a UK context, what is the plan in dealing with the huge number of false positives captured by this system, which in reality cannot estimate a 2 metre distance?

The Australian COVIDSafe app sends all contacts in Bluetooth distance, which obviously includes people in other rooms, and on entirely different levels of a building - because there's no directional information.

Separate to the issue of proximity is the issue that this system cannot really work unless it's mandatory, as others have outlined.

Does any purpoted health benefits have to be modelled, proved and measured against the issues of shifting Western society to one which requires mandatory install and carry of a mobile phone which records all nearby devices?

It gets us closer to a society where political actors will be tempted to provide a rationale which justifies permanent extreme surveillance of citizens.

The limited analysis of the particular client implementations appears to miss this wider geopolitical point, and responsible technologists might want to consider these more carefully.

In the Australian situation all we are currently told is that if the app registers you as a close contact then it is used for 'usual contact tracing' and that contact tracing involves determining whether you are a 'close contact' and have to self-isolate for 14 days - a huge cost in a re-opened society if it is an unnecessary false positive.

It's been quite strange to see leading technologists such as Mike Cannon Brookes of Atlassian and Troy Hunt of HaveIBeenPwned strongly urge Australians to download it as an 'unequivocally safe app' when the most important part - the server-side algorithm to 'guesstimate' proximity - has not been shared by the Australian Government [3].

How can a technologist give the thumbs up to a proximity app when there is no evidence of it reliably estimating proximity in the real-world scenarios it is meant to operate in?

[1] [https://theintercept.com/2020/05/05/coronavirus-bluetooth- co...](https://theintercept.com/2020/05/05/coronavirus-bluetooth-contact- tracing/)

[2] [https://www.youtube.com/watch?v=KgKbllhgESc&feature=youtu.be...](https://www.youtube.com/watch?v=KgKbllhgESc&feature=youtu.be&t=2988)

[3] [https://www.abc.net.au/news/science/2020-05-06/coronavirus-c...](https://www.abc.net.au/news/science/2020-05-06/coronavirus- contact-tracing-app-covid-safe-lockdown-lift/12217146)

<comment><USER4> Interestingly, and purely anecdotally (so not designed to replace the study itself), I've been experimenting with the RSSI being reported by the NHSx app through the debug menu. At least based on what I've seen so far on my devices (and noting the NHSx model considers device model ID to allow for antenna variations going forwards), there was a ~25 dBm change in signal strength (from -32 to around -57) between phones being sat together, and through a wall yet still close.

Clearly this is going to vary depending on building construction, but I suspect the most relevant factor will be determining whether a contact event takes place through a wall or not. The real question is whether or not this can be modelled into the app and it proves reproducible.

My understanding is there's no claimed intention to measure the 2m distance, and this is accepted as a known factor, at least for now. I suspect in an indoor setting the initial challenge will be preventing spurious triggers from indoor use (although arguably if people are that close they might live in an apartment block, and they could have been exposed through contact with door handles or lift buttons etc). But once people are outside more and returning to normality, all bets seem to be off - I imagine a lot of false positives.

My instinct would be that contact exposure duration will become more of a factor than the RSSI, or that a min/max/median/standard deviation might be captured in addition to a "raw" RSSI, to perhaps get a better idea. If the RSSI never goes "above" -60 (noting it's a negative number) then that's not likely to be a hugely close contact event.

<comment><USER5> I wonder if WiFi connection information could help. Being on different networks would suggest greater social distance.

<comment><USER4> During current "distance under all circumstances, stay at home", that is likely going to be true (modulo people using multi-AP setups that aren't meshed under one SSID, assuming you use SSID, or who use 2.4 and 5 GHz SSIDs).

Going forward though, I imagine that as restrictions loosen, the usefulness of WiFI connections would drop significantly, as people aren't always at home. It would also not really help in the workplace, assuming a large campus WiFi setup, since everyone would probably be joined to the same network anyway.

The challenge would be privacy - you'd have to send some kind of information (or unique derivative) of the BSSID/SSID, which would introduce some privacy impact too. At that point, assuming you got access to the hashed SSID/BSSIDs, someone like Google with a street view dataset of AP MAC addresses could "enrich" the anonymised dataset with "ordinary location".

</comment></comment></comment></comment></comment><comment><USER6> I'm delighted to see that they have a vulnerability disclosure program for the app too [1].

That's fairly rare for the public sector - the UK Gov and NCSC are really leading on this sort of stuff.

[1] [https://github.com/nhsx/COVID-19-app-iOS- BETA/blob/master/SE...](https://github.com/nhsx/COVID-19-app-iOS- BETA/blob/master/SECURITY.md)

<comment><USER7> Agreed. I think the decision to go it on their own and not use Google/Apple's API is completely bone-headed and won't work at all. But given that they made that decision, everything else they've done seems pretty good.

</comment></comment><comment><USER8> There's some good initial investigation into this at [https://reincubate.com/blog/staying-alive- covid-19-backgroun...](https://reincubate.com/blog/staying-alive- covid-19-background-tracing/), which I posted to [https://news.ycombinator.com/item?id=23108867](https://news.ycombinator.com/item?id=23108867) in case it warrants a separate discussion.

Sounds like their approach is fairly privacy conscious and clever in terms of taking advantage of how each platform works - whether it works well enough and whether people will use it despite "not using the Apple/Google way" I guess we will see

<comment><USER9> Tom do you know if anyone has told the developers of the useless Australian app about this?

<comment><USER8> I'd be amazed if they weren't aware of it. It does sound like they've found ways round some of the issues.

Whether it is worth the trade offs vs the Google/Apple system remains to be seen, but the fact that they've released the source already and people smarter than me seem impressed is a better situation than I expected it to be in. Also good to hear they may be open to switching to the Apple/Google way if needed.

Hopefully contact tracing apps prove to be helpful given the amount of hope being put in them!

<comment><USER9> Yes. There seems to be a huge amount of hope invested in these apps with little evidence they will make much difference.

<comment><USER10> Given the human and economic cost of this virus, "not much" difference in R could still make it worth it. It's supposed to be complement human tracing and social distancing, not control the virus spread on its own.

If it allows you to reopen some business sectors, say, half a week earlier, I can't imagine that wouldn't pay for the resources invested in the app.

There has been some modelling carried out that suggests use of the app would be worth it, but even with a level of uncertainty it seems like it's worth trying.

<comment><USER4> There's one other angle too here - a future version of the UK app will give people feedback on their level of distancing via a "social mixing score", which is basically the number of unique people they were recorded as being in contact with per day. This looks like it will give people an idea of "You were close to X people today, and really close to Y people".

"Close" will be locally determined, probably based on the RSSI model and duration of contact. This will give people feedback on how well they are distancing.

There's a lot of research which shows people struggle to know if they are doing well without feedback, and that people's perception of how well they can do it will influence if they try.

Couple this with a differential privacy daily voluntary "upload" (add a random, zero-mean number sampled from a normal distribution to their daily number) and people can find out if they're doing well, or if others are reducing contact more. NHS also gets an idea of average number of contacts and close contacts, and nobody actually needs to reveal their own number.

</comment></comment></comment></comment></comment></comment><comment><USER11> > Each two hours, we merge any changes from master into internal

Not hiding the fact the published source code isn't that built into the app then...

<comment><USER12> Yes indeed. I'm not buying it isn't patched in some way before it's pushed to any app stores. Especially with all the noise beforehand about how it operates and the involvement of GCHQ/NCSC in development.

Edit: some digging. NHSX is run by Matthew Gould. Former Israel diplomat and tied via UK-Israel technology hub to NICE (Neptune Intelligence Computer Engineering) Ltd which is a former Israeli army surveillance and data security company among other functions.

So basically a hotpot of reasons not to install this thing.

<comment><USER13> It's the same story as with Signal for iOS. How do we know the version downloaded from the App Store is the same code hosted on GitHub? I'd like to have the option to sideload it. Clearly that would involve some work on their backend, but I think that's fairer than the stuff described in this Signal GitHub issue [0] and Telegram's website [1] regarding the same thing.

EDIT: if I'm wrong please leave some details for myself and others to learn more. I've worked on iOS apps for several years, and as far as I know there's no way to verify if an app downloaded from the App Store was compiled from a particular code revision. Even the same code compiled on separate machines can produce different unique binary IDs. And on the scale of difficulty, I'd say that sideloading is less difficult than jailbreaking, if that method even really works for this problem.

[0]: [https://github.com/signalapp/Signal- iOS/issues/641](https://github.com/signalapp/Signal-iOS/issues/641)

[1]: [https://core.telegram.org/reproducible- builds#reproducible-b...](https://core.telegram.org/reproducible- builds#reproducible-builds-for-ios)

<comment><USER14> It's not possible to side-load iOS apps and still get push notifications. Also, Apple doesn't allow you to distribute applications outside of the app store (unless you violate the terms of your enterprise developer account).

<comment><USER15> While I'm not an expert on push notifications, shouldn't you be able to receive push notifications if you entitle your application for them and create the right certificate online?

<comment><USER13> This is my understanding. You would have to register your device in ADP and create an ad-hoc certificate for the app. If people are doing this on their own ADP accounts, then they're just testing their own builds, not receiving an enterprise deployment from some single developer.

</comment></comment></comment></comment></comment></comment><comment><USER16> From [1]:

// TODO: We need a real device to test Bluetooth scanning if isMultipleAdvertisementSupported == false

// TODO: We need analytics to identify number of devices that fall into this bucket

I don't know whether to laugh or cry reading those comments, the fact that this is a "to do" whilst the app is in "testing" and the fact they've decided the appropriate procedure is to reinvent the work Google and Apple have already done.

Google already published their code/APIs in [2]. I'm sure these considerations are taken care of by the framework the OS vendors have published themselves. It's absolute pure arrogance that anyone would even attempt to re-create the work that is being done at the OS level and not 'fall in line'. Germany back tracked, Australia back tracked, and the UK too, will back track and implement Google's APIs.

In a time where the message is "saving lives", those TODOs are not living up to that motto. This app is a complete waste of time, resources and money. Use the official APIs and be done with it, anything else is putting people in harms way because you think you "know best". The UK government claimed they reached 100k tests, fudged the numbers, and haven't hit that target since. But it's okay, they'll hit 200k by the end of this month too!

Pure 100% incompetence.

[1]: [https://github.com/nhsx/COVID-19-app-Android- BETA/blob/maste...](https://github.com/nhsx/COVID-19-app-Android- BETA/blob/master/app/src/main/java/uk/nhs/nhsx/sonar/android/app/DeviceDetection.kt)

[2]: [https://github.com/google/exposure-notifications- android](https://github.com/google/exposure-notifications-android)

<comment><USER17> This app is many things, but it does not reimplement the Google/Apple scheme, and works very differently. If you believe knowing contacts who tested positive is enough, the Google/Apple scheme is fine. If you need to know earlier and/risk assess based on exposure, only the NHSX approach works. It's not a clear cut Central v Not Central decision.

<comment><USER16> Yet, reading a recent report in [1]:

"The NHS contact-tracing app must not be rolled out across the UK until the government has increased privacy and data protections, an influential parliamentary committee has said".

The app requests location permission on Android, something that Google doesn't allow when using their implementation.

I suspect this app, in this form, is DOA and will be quickly replaced. Even if they do somehow roll it out widely, there are concerns in [2] about its effectiveness working in the background. This app is a complete disaster, and will be unviable for the mass tracing they will want to conduct. They've pushed and pushed for "why" a centralized approach is the "right" one, made blog posts, issued justifications.

Yet the app isn't likely to see mass adoption and isn't going to work due to restrictions within the OS. This app represents the disastrous approach the government took to this virus. Flip flopping around, shutting down way too late, no clear guidelines or approach, and a high death rate to solidify their failure. Then, they decide the official approach is "wrong" or "not good enough".

Heads should roll over this.

[1]: [https://www.theguardian.com/world/2020/may/07/uk- coronavirus...](https://www.theguardian.com/world/2020/may/07/uk-coronavirus- contract-tracing-app-could-fall-foul-of-privacy-law-government-told)

[2]: [https://github.com/nhsx/COVID-19-app-iOS- BETA/issues/2](https://github.com/nhsx/COVID-19-app-iOS-BETA/issues/2)

<comment><USER17> Location permission is a technical requirement for using Bluetooth in this way because of beacons.

Lots of people keep saying the app can't work due to restrictions. Maybe, I'm not sure that has really been shown yet. A lot of the criticism doesn't really withstand the light of day.

<comment><USER16> The problem is, there's no way to disassociate the two flaws with this:

1: people see "government app wants your location"

2: the government possibly using that location access at a later time

I don't want to accept location on a government app, and the UK has some history with facial recognition cameras and other privacy invasive laws. So there's no way for me to know this location is _only_ for them to use BT LE and they won't make an API call to getLocation and uploadLocationToServer. I assume once you grant location permission even for BT LE purposes it can be (ab)used in some other way.

They've made their own bed with their actions, public confidence might not trust an app like this with a permission like that.

<comment><USER18> It's probably exactly your concern about the ability for apps with network access to upload user data that led the Android team to introduce the locations permissions for BLE identifier scanning.

Without a location requirement, an app could claim to use only Wi-Fi and BLE permissions, yet it could combine beacon scanning and data access to de- anonymize user locations.

This permission requirement was introduced in Android 6.0 (see the release notes[1]) in October 2015, so it's been around for a while.

If you have some suggestions around how to improve the tracking of permission usage (static analysis? run-time requests (preferably avoiding times when users are under duress and likely to click 'OK' by default)?) then you may wish to file some requests with them and/or contribute to other projects that you feel are taking a better approach.

Your concerns around trust in app developers -- regardless of whether they are a government or any other entity -- are best handled by two means:

\- Open sourcing the code (which NHSX have done)

\- Enabling reproducible builds[2] so that users can confirm they have an authentic binary build of the source code

[1] - [https://developer.android.com/about/versions/marshmallow/and...](https://developer.android.com/about/versions/marshmallow/android-6.0-changes#behavior- hardware-id)

[2] - [https://reproducible-builds.org/](https://reproducible-builds.org/)

<comment><USER19> I may be misunderstanding this thread, but what the parent is saying is that the BLE permission in Android was _never_ meant for privacy focused contact tracing, and you are saying this is not a secret.

This is why Google and Apple developed the Exposure API, which is more private because it doesn't save as many metadata than the classical BLE permission, and at least Google does _not_ allow apps to declare both the Exposed API and the location permission at the same time.

This gives more guarantee to the users than just trusting the app developers.

In other words, any serious privacy-focused contact tracing apps should use the Google/Apple Exposure API, and not a custom made solution on tops of the older BLE permissions.

However, I still think digital contact tracing, even private, is a bad idea.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> I'm shocked to see all the Firebase and Google analytics in there. I'm quite surprised that a gov built app would include this. Disappointing from the UK (along with the fact that they really just should use the Apple/Google framework to begin with, which will in the end better integrate with the device and thus will perform better from a technical perspective).

<comment><USER21> I assume they want to know if people are actually using this app and I don't know if building an analytics platform is the best way for them to spend their time right now.

It does undermine any privacy claims they might make.

<comment><USER22> I agree around usage of Firebase here because no one really knows what data is being sucked up there but it looks like the intent of usage here is pretty clean;

If you look at the code Firebase is in there because the push notifications to notify of infection are sent via Firebase Cloud Messaging.

I also grabbed the Google plist out of the IPA from the app store and it has analytics turned off.

<comment><USER23> Then why is the Analytics SDK even there? It's not required for messaging

<comment><USER21> The directions for integrating SDKs are usually something along the lines of "Add Firebase to your Podfile", which often adds way more than you need.

Given that these devs were likely in a hurry, it wouldn't surprise me if they forgot to go back and clean this up after getting it working.

</comment></comment></comment></comment></comment><comment><USER8> One mildly interesting thing I noticed is that some of the files date back to 12th March (possibly earlier, I'm on my mobile so can't search properly) - back before the UK was taking this particularly seriously in public, if I remember correctly (restaurants and pubs weren't closed until 20th). Suggests at least someone realised the gravity of the situation!

</comment><comment><USER24> As someone from the UK, I'm really appreciative of all of the people who are actively looking into the app and highlighting privacy, security and other concerns.

My main concern with all of the contact tracing apps is that I live near a very busy road, hundreds of people per day walk past my house and they're going to be about 3 meters away from my phone, albeit through a brick wall and a 6' hedge. My concern is that the apps will pick up the random passers by and I'll be forced to isolate my family based on a false detection.

Maybe this isn't an issue and these apps will have protection against this sort of false positive. I've yet to hear either way.

edit: Thanks for all the answers! Definitely helped calm the concerns about this sort of false-positive.

<comment><USER10> > I'll be forced to isolate my family based on a false detection.

Installation of the app is voluntary, and there's no sign that's going to change. Forced installation would probably be politically and logistically impossible.

If this was a problem, workarounds include deciding that the app wasn't usable in your situation, or turning off bluetooth on your phone while at home.

</comment></comment><comment><USER25> Here is the approach Switzerland it taking [2]. All open source and decentralised privacy-preserving. Available for any other state to use.

It is the responsibility of the app user to get tested or quarantine themselves if the app shows you have been in contact. No central authority knows who you have been in contact with or who you are.

The installation of the App will also most likely be voluntary.

[1] [https://github.com/DP-3T/documents](https://github.com/DP-3T/documents)

[2] [https://github.com/DP-3T/dp3t-app-android- ch](https://github.com/DP-3T/dp3t-app-android-ch)

</comment><comment><USER26> Interesting to see from the docs that it seems to have been built by VMWare Pivotal, rather than an internal NHS(X) team.

<comment><USER27> This was mentioned by the media some days ago, eg [https://www.bbc.co.uk/news/technology-52551273](https://www.bbc.co.uk/news/technology-52551273)

</comment></comment><comment><USER28> This is again one of those cases where, even though it's nice to see the source code, it's very hard to verify what's actually running on our devices. The same case with Signal and other secure messaging apps.

How would a scheme work, that (within the confines of the current App Store regime) allowed users to verify the source code look? Could Apple/Google maybe hash every file as part of the compilation/linking process, and then concatenate that in some way and include it in the signed binary and expose it in the App Store?

It would be really neat with some process where I can clone a repo on my machine, run some script and get an identifier, and verify that it is the same as what is being shown in the App Store on my device.

<comment><USER29> It's pretty simple to reverse engineer an Android binary. While most Android apps ship with code obfuscation, it's relatively easy to get around. Using that method, one could determine if the publicly available app came from the same source code (it would at least allow you to determine no extra nasty bits had been added).

iOS is a little harder. If you have the dsym files it's pretty trivial to the same exercise as Android. NHSX could choose to release them so people could again verify it more or less matches.

<comment><USER4> There's no obfuscation that I could see on the Android app, which should help with this. Certainly when looking across to the source release, it was a familiar codebase (modulo the fact the reversed version was in pseudo-java, and the original codebase is in Kotlin).

</comment></comment></comment><comment><USER30> This is a big step. I've previously been pretty against the NHS's approach (being mostly centralised etc), but I'm very happy to see that they've open sourced it. Does this also contain the server side that does the matching?

<comment><USER31> No it doesn't. Neither does it include some of the configuration values you need to build the mobile apps. It looks like this was a last minute political decision to open source the code in the face of growing public disquiet rather than a co-ordinated effort.

<comment><USER4> It takes about 5 minutes to obtain the API keys from the Android app to be able to build it. It was also a pretty well-documented process to get the Android app to build (unlike some Android "open source" projects that seem to be designed to be impossible to actually build!)

Open sourcing the app was actually planned all along - when Matt Hancock announced the app several weeks ago [1], he said it would be open sourced at the time.

[1] [https://www.theguardian.com/politics/2020/apr/12/uk-app- to-t...](https://www.theguardian.com/politics/2020/apr/12/uk-app-to-track- coronavirus-spread-to-be-launched)

</comment></comment></comment><comment><USER32> Very interesting. We probably won't need it fully up and running for another week or two so hopefully bugs will be out by then.

For context, there are two ways of doing digital contact tracing.

A centralised system which tracks everyone all the time and runs a central algorithm for deciding whether someone is at risk on all that data. This is what China, South Korea, and Taiwan have done. Advantage: it seems to work. Disadvantage: government has a database of literally everyone's movements. In SK they also use CCTV and other data, it's a nightmarish panopticon.

"Minimally disclosive" contact tracing. This keeps as much data as possible on the device and only share some of it with other devices or central servers. Obviously, designing these protocols is a balancing act between privacy and functionality. Different groups have designed protocols that make different choices there.

The two main competing protocols are DP-3T, on which Google/Apple have based their API and PEPP-PT / ROBERT which some countries including the UK have been building their solution. Until very recently, Germany was also using PEPP-PT but they have switched to DP-3T.

Both protocols make trade-offs between the amount of information which leaks and the usefulness of the tool. That's important. Installing an app based on either will strictly reduce your current privacy.

Both frameworks use pseudo-random rotating keys which are exchanged over Bluetooth. In PEPP-PT a central server manages a rotating private key which is used to generate a set of time-gated ephemeral IDs for each device. Devices exchange and log these IDs. When a health authority determines that someone is infected, they issue them a key which allows them to upload all their logged IDs to the central server. (Optionally, they can just allow them to self report which NHSX seems to be doing) The server is able to determine who the infected person's phone has logged a contact with and notify those people. A random sample of additional people also receive notification messages which their phones are able to discard as invalid decoy messages. Because relatively rich data goes to the server, real time data on interaction patterns of the infected is available and notification algorithms can be tested and tweaked. Since we don't know exactly how Bluetooth propagation and covid infection map to each other, this may end up being an important step.

In DP-3T, the keys are generated on the devices and IDs are stored only on the devices. If a central server authorises you to do so (based on a confirmed diagnosed infection), you broadcast the IDs of all the devices you have been in proximity to. All devices regularly download a list of IDs and check the list for one of their own rotating ID numbers. If they match, the user is notified and is able to pre-emptively isolate.

The second approach reduces the consequences of a nefarious central operator but at the cost of sharing more information with more people (since everyone sees the list of possibly-infected IDs). In other words, even in privacy terms, this is not a perfect approach either. That information can be used to carry out re-identification attacks and reveal infected users if certain conditions are met.

From a privacy point of view, I think many people would prefer the latter (possibly allow malicious attacker, if they are able to do certain not-so-easy things to determine that they were infected) since most people in the UK will not consider that deeply private and secret information about themselves. Many of my friends who got it have posted about it on FB, twitter, etc. The former, which gives a state actor more information seems like a greater breach of privacy.

A final point which I think is super important: we don't know if either of these minimally disclosive options work in practice. No-one has used them in the wild yet. If they both worked then we could say - DP-3T has fewer privacy implications, they both work, therefore it is strictly superior.

Since we don't know whether they both work (or even if either one works), we are instead left with a balancing act between privacy and usefulness which is not an easy one.

Of course, if due to API support reasons, only the OEM supported protocol can be made to work then regardless of any theoretical arguments, that is the one that we will need to use. I suspect we will know by the end of the weekend if their implementation works in practice.

I would like to see statutory safeguards put in place for this data. If they really need it then I get that, but it is important that if we do not have the technical safeguard we have legal ones.

(Also, Google/Apple had a difficult choice to make here because they operate everywhere. They had to pick something that they feel comfortable rolling out to their devices in every country.)

<comment><USER33> Thanks for the explanation - very helpful. I was wondering if you might have time to go into more detail on this:

> A random sample of additional people also receive notification messages > which their phones are able to discard as invalid decoy messages

<comment><USER32> Basically, if you didn't do this, then people could snoop on your message traffic and even though the payload was encrypted, they would be able to tell that you received a warning message about having been in contact with an infected person.

By sending decoys, everyone gets the occasional such message as far as any attacker is concerned, and no information is disclosed.

</comment></comment></comment><comment><USER34> Did the NHS have any good reasons why they weren't going to work with Google and Apple (who surely have more expertise for this)?

Why not work on a single open source iOS + Android app that is shared and used in all countries so we can get cross border tracing?

If governments are concerned about Google and Apple getting access to data, what's the argument against the above where each country uses their own servers to store tracing data?

<comment><USER4> The NHS wanted the ability to model "risk-from" a contact, rather than only "risk-to". In the decentralised approach, infected users upload a list of their own identifiers, these are broadcast, and everyone checks if they've been near one. There needs to be a threshold picked that will trigger to alert you - probably "contact-minutes" with an infected person.

The NHS approach is less binary, as they believe based on the rate of spread that it's necessary to request people report symptoms and share their own anonymous contact log. Based on the level of exposure the "suspected individual" had with other known/suspected infected people, combined with the number of other known/suspected infected people you were near, your advice can be tailored. You might be told to isolate, but then you're asked to report symptoms regularly. Others in the same position as you will be doing so as well - there is potential here to actually tell people they no longer need to self isolate if the "group" don't have any symptoms emerging, based on the epidemiology and the rate people are believed to develop symptoms in the population.

There's a good write-up of this actually in the NCSC security report and post - [https://www.ncsc.gov.uk/files/NHS-app-security- paper%20V0.1....](https://www.ncsc.gov.uk/files/NHS-app-security- paper%20V0.1.pdf) and [https://www.ncsc.gov.uk/blog-post/security-behind-nhs- contac...](https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contact- tracing-app). It explains a lot about the rationale, and not only for security, also in terms of the approach and how the app is designed to work when people have symptoms etc.

<comment><USER34> Thanks for that I'll have a read.

Is there any discussion about other countries using this NHS app (the repo says MIT license)?

Each country could customise the alert heuristic but it seems like a waste of resources for each country to code their own app for a global problem.

<comment><USER4> > Thanks for that I'll have a read.

> Is there any discussion about other countries using this NHS app (the repo > says MIT license)?

> Each country could customise the alert heuristic but it seems like a waste > of resources for each country to code their own app for a global problem.

Not seen any other country talking about this yet although it only came out today in source form, and still is technically in limited beta. I imagine Australia and Singapore will be interested in the iOS Bluetooth in sleep workaround method, as that does appear to be novel and not really done before.

If you implement the same basic API, it would be easy for another country to implement. The nice aspect of this design is that you can have an MVP (like UK has right now) while you evolve the more complex heuristics and models on the backend, and add those as you develop them. I'd agree it's a waste to build multiple apps, and I imagine countries will be looking at this approach now, and the value of an app with real working code, versus trying to build something.

The Bluetooth protocol itself is designed to support multiple countries using it - the outer message contains a country code flag so you know which country's health system you'd need to communicate with in order to exchange info of a proximity event.

<comment><USER34> > the iOS Bluetooth in sleep workaround method

Why do they need to find a workaround? Can't Apple tell them the best way or push an iOS patch to help?

<comment><USER4> > > the iOS Bluetooth in sleep workaround method

> Why do they need to find a workaround? Can't Apple tell them the best way or > push an iOS patch to help?

Apple seem to take the view governments should use their decentralised approach, or not do it, and don't seem to have been willing to help governments do this without using their "joint approach" with Google.

I am normally the first to back anything decentralised. But in this case, the stated goals of the app (from a very good NCSC writeup I've linked elsewhere in these comments) simply don't work with a decentralised approach (namely being able to do risk-from calculation, not just risk-to, and being able to gather and model from symptoms whether others should keep isolating or can go back to normal).

Given Apple said it wouldn't help anyone not wanting to go "their" way, it's quite reassuring to see that engineers do what they do best, finding a new workaround, and making details of it available for any other devs... Perhaps Australia can use this in their app now to fix their issues with Bluetooth and iOS.

</comment></comment></comment></comment></comment></comment><comment><USER35> For reference Austrias Red Cross App is here: [https://github.com/austrianredcross](https://github.com/austrianredcross)

<comment><USER4> Interesting - it looks like they've gone down the route of having a way for people to do a "digital handshake" (both press the button, and have devices within a short distance of each other) to create their contact pairings.

I do wonder how many people will use this feature, or remember to use it. This would seem to reduce false positives, but make it much less useful at scale (i.e. it won't help trace people who were on a train or bus).

</comment></comment><comment><USER36> Contact not contract in the title?

</comment><comment><USER37> Twitter user probing for safety & security issues 'india now NHS next'

[https://mobile.twitter.com/fs0c131y/status/12584360338400215...](https://mobile.twitter.com/fs0c131y/status/1258436033840021504)

</comment><comment><USER38> Any contract tracing system that is not time limited and disposable by design is a surveillance system being introduced in the guise of contact tracing.

My ideal tracing system would include disposable components, such as time- boxed smart cards, that are disposed of when an epidemic wave (cycle) ends. If the pandemic has multiple waves, each wave will entail producing a new series of disposable components.

Another important aspect of a genuine tracing system would be that it does not hook into infrastructure of surveillance capitalism behemoths.

The regrettable fact is that this contact tracing app will definitely become a requirement for getting a job, and very likely at some point a de facto identity and civil passport for being able to access modern infrastructure and urban areas.

<comment><USER39> >The regrettable fact is that this contact tracing app will definitely become a requirement for getting a job, and very likely at some point a de facto identity and civil passport for being able to access modern infrastructure and urban areas.

Should be an easy fix now that the app is open-sourced: just build a version of the app with all the tracking code stripped out, leaving a mock UI that always says "no contact detected"

<comment><USER38> The issue is not that. This is raising private corporate infrastructure (Google, Apple, etc.) to a quasi-governmental role. Something so tightly bound with fundamental civil and human rights concerns, should not depend on these giants. Think China's Baidu.

And here is a deliciously ironic title and article:

 _China 's Dystopian Tech Could Be Contagious_

[https://www.theatlantic.com/technology/archive/2018/02/china...](https://www.theatlantic.com/technology/archive/2018/02/chinas- dangerous-dream-of-urban-control/553097/)

</comment></comment></comment><comment><USER40> Contact not contract

</comment><comment><USER41> s/contract/contact/

</comment><comment><USER42> Whelp, we've sure entered into the twilight zone of digital privacy quickly. A month ago we were saying "15 days to flatten the curve", today we have MRAPS busting up protests and digital privacy continuing to circle the drain... and THE PEOPLE LIKE IT THIS WAY?

</comment><comment><USER43> There's a code review, of sorts, (from an ex-Googler) here:

[https://lockdownsceptics.org/code-review-of-fergusons- model/](https://lockdownsceptics.org/code-review-of-fergusons-model/)

<comment><USER44> I'm not entirely convinced a site called "lockdownsceptics" where almost every article is about how the lockdown is stupid, unconstitutional, fascist, etc. and uncritically reposting articles by people like Toby Young is going to be even slightly unbiased about that model.

<comment><USER10> From the article:

> On a personal level, I'd go further and suggest that all academic > epidemiology be defunded.

That's a hell of an extremist position to take.

It's also an anonymous report, not a code review, with the evidence presented being some graphs produced with no idea the author had any idea they knew what they were doing.

Pretty ironic that the author says "this situation has come about due to rampant credentialism and I'm tired of it" \- but implies they know what they're talking about because they used to work at Google.

</comment></comment></comment><comment><USER45> Can we stop pretending that if half the population refuses to wear masks and/or stay-at-home to spare others that they are going to be open and honest and assist contact tracing when there is no obligation to do so? Why would they bother?

<comment><USER37> Im pretty opposite to those folks. Still im not installing anything.</comment></comment>


Mozilla donated $25,000 to JS-Git - <AUTHOR> https://www.bountysource.com/fundraisers/325

<comment><USER2> I don't know Tim Caswell and whether he's capable of building this probject, but his progress so far sounds pretty unfocused.

      I designed a stream system that's both lightweight and works great in both node.js and browser environments. I spent a day creating a module loader for chrome apps so I could use common.js style modules.

That's after taking almost $20,000 for a Kickstarter campaign in which he detailed the risks:

       But in the case that I'm still wrong and it's way harder than I thought, I can promise that the project will have enough of a head start to survive on its own and be usable before the funds run out.

His repo is open source but there doesn't seem to be any committers apart from Tim. Being able to clone a repo is far from being in a usable state. The actual work that was committed seems to have taken place in a little under two months from April to June.

I get that personal projects can be hard to see through, but Tim is asking for tens of thousands of dollars without explaining how he will approach things differently this time around, or even acknowledging he failed his previous backers.

<comment><USER3> I'm sorry the progress seems to disorganized. I've recently moved to doing work in the main js-git repo to make things more obvious to people.

As far as the first fund-raiser, I was able to stretch the money farther than I had anticipated but as I mentioned in the second fund-raiser, has a slow start.

It's hard to build a large library like this when basic things like streams, packages, module loading, and binary data are so varied and there are no accepted standard ways to work. This is pioneering work, not paving cowpaths.

<comment><USER2> Thanks for taking the time to reply. I would be shocked if there wasn't already a Common.js implementation for the browser.

How do backers know that you are going to be able to effectively use the money this time?

<comment><USER3> What do you mean by common.js implementation? The only thing I know of that survived the common.js movement was that node.js adopted it's module file format. That format requires either sync I/O, XHR loading and wrapping or a build-step or build-server to use in the browser. There are libraries out there that try to solve the module problem in the browser, but there are certainly no clear winners and nothing that doesn't have serious limitations or drawbacks in one way or another.

Also as I mentioned and you quoted, I found a great way to load common.js modules in chrome apps that nobody had done before, but it only really works in that unique environment.

But modules are just the tip of the iceberg. I need a way to handle I/O actions, streams, TCP, fs, db, etc. All these interactions and APIs need to work cross-platform in a variety of different runtimes. I can't even start implementing git clone over a TCP socket till I have a TCP socket API to program against.

But like I said in the bountysource, most of that is all now solved more or less. I have a much better understanding of what needs to be done and I am starting out this phase knowing how git works internally down to even the huffman encoding bits inside the deflate inside the objects inside the packfile stream inside the git clone stream.

I also have more time this round and less conferences that I have committed to speak at or visit. (I think I only have two more trips the rest of the year actually)

</comment></comment></comment></comment><comment><USER4> Update: Since the Mozilla pledge came through, JS-Git has seen some last minute support. If you believe in the project, you have 10 hours left to pledge!</comment>


The Economics of Status (2006) - <AUTHOR> http://daviddfriedman.blogspot.com/2006/10/economics-of-status.html <comment><USER2> The conclusion that there is no truly hierarchical measure of status, because there are fractally distributed groups for which you could have status within, is wrong on it's face.

As an example, nearly everyone on the planet knows who the US President and Pope are and recognize them as the highest status (even if you don't like them - don't ask me why this is). If one of those people walked into any of those smaller groups, they would inherit the highest status immediately, without having to do any of the in-group activities.

<comment><USER3> Talented Actors and salespeople are often able to capture what they call "local star power" : situational periods of top status based on charisma or relevant skill. But local status is usually fleeting compared to global status, which is generally determined by some combination of power and attractiveness to potential mates. It doesn't matter if you crown yourself King of the Middle Kingdom if you have no desirable courtiers orbiting your throne. So there are many different nested and intertwined status hierarchies (athletic, scientific, creative, etc), but not nearly enough to accommodate most status-seekers. Intentional communities - often religious - are one of the few examples that subvert external status criteria successfully over significant periods.

<comment><USER2> Well put. The author of the piece seems to errantly assume that because there are local maxima, it eliminates the idea of a global maximum.

Unfortunately this concept holds neither in mathematics, nor within the psyche.

</comment></comment></comment><comment><USER4> But there are lots of ways that relative status really matters in a not-just- subjective way.

If a number of people are competing with you, your relative status within the group is an important factor for determining winning conditions.

If ten people are competing for one job, none of them have any reason to care about an effect which, say, increase the education-level of all of them. But each might be willing to take a class if it increased their chance of getting the relative to the other.

<comment><USER5> Relative status is what matters. The author, being an extreme libertarian, is uncomfortable with that idea, because he doesn't want to admit that relative wealth and wealth inequality, matter.

<comment><USER6> Going though the comments, it seems like few agree with the the article, yet it has been up-voted to the front page. I guess the people who are voting are different from those who are commenting. People who like the article are less inclined to comment, but rather vote.

<comment><USER7> One might upvote for different reasons rather than agreement. I've upvoted submissions because I disagreed but still found an interesting argument, or because it generated a good discussion in the comments.

</comment></comment></comment></comment><comment><USER8> Status seeking, being inherently zero-sum, is a pursuit that will only leave you unfulfilled in the end. In fact, I think the very fabric of human existence is predicated on this inequality that status emphasizes.

As for myself, I try to fight against it by refusing to share information that's not contextually relevant. It kind of sucks sometimes, but I think it's the "status-free" way to do something. Living in MA, I always manage to be amazed as some Ivy-League graduates slip the fact that they attended an Ivy League school into a conversation that has nothing to do with their education or pedigree.

<comment><USER9> Did you read the article? The whole point was that status is NOT inherently zero sum, since everyone uses different criteria to determine their own status.

<comment><USER8> Yup. I disagree with it, obviously. I don't think the author gives sufficient evidence to prove that it's not zero sum. Can everyone be of high status? The answer is obviously no. Like I mentioned before, the very idea of status to begin with is relative. If status is _not_ zero sum, that means that everyone can be of "high status". I believe such a thing is nonsensical, and so, impossible.

<comment><USER10> The argument he makes, that you have apparently missed, is that which values constitute status are different for different people.

I think you're low status because you can't crush 300kg deadlifts like me, you think I'm low status because I don't appreciate classic music like you.

Everybody can be high status if they care to define status in terms of the things they're good at.

<comment><USER11> The problem with that argument is that status isn't determined by the person seeking it, it's determined by those deciding whether to mate with the status seeker. That's where our hardwired impulses toward status seeking derive from...our need to perpetuate the species.

That doesn't mean that it's necessarily zero sum, but it means we're not completely in control of framing it the way that you and the article are suggesting. But you are right that there are different dimensions of status because different people value different characteristics. Some people are attracted to strong men that can lift 300 pounds and others prefer the refinement of a knowledge of classical music. But if you choose to define your status to far from the societal norms, you won't find others that agree with that framing and you'll be isolated out of the gene pool.

This is somewhat of an oversimplification and we use status for more than just mate selection, but our dimensions for status seeking are still based on how we want to attract sexual partners.

<comment><USER10>
        > The problem with that argument

You haven't actually outlined any problems with that argument, you've simply stated that status in the eye of the beholder isn't perfectly aligned with that of the status holder.

<comment><USER11> You said:

> Everybody can be high status if they care to define status in terms of the > things they're good at.

I'm arguing that you don't get to define status for yourself, so there are limits to how you can distinguish yourself and still claim status. You have to be graded on a recognized dimension of status. That makes it virtually impossible for everyone to be high status.

Also, certain dimensions of status are far more universal than others. I don't care how much you can bench press, you're going to be almost universally seen as lower status than a handsome, movie-star actor. Those dimensions of status are so widespread that you really can't define your way past them.

And it works in reverse too...certain dimensions are almost universally unrecognized. For example, I can hold my breath for just over 8 minutes. That puts me in elite company and people are almost always impressed by it. A couple of decades ago, going that long without breathing would have met the medical definition of death despite my never having lost consciousness. But I can assure you that it confers basically zero status, no matter how much I'd like it to.

<comment><USER12> > But I can assure you that it confers basically zero status, no matter how > much I'd like it to.

You could learn to free dive in a couple of weeks and use your capacity for breath holding to get yourself on most countries' national team (doubt that would cut it for the US team, but you could win some regional meets). Being a national athlete confers decent status, more so if you pick up a medal.

From a quick Google for an example, the current NZ and 4th global women's record for women is 7 minutes 45 in static apnea [1], and she easily beat the men's champion, so 8 minutes would presumably be very good. I'm basing the mapping from "apnea capability" to "free diving capability" off what a free diving friend told me.

(I don't disagree with the rest of your point.)

[1] [http://www.nzherald.co.nz/sport/news/article.cfm?c_id=4&obje...](http://www.nzherald.co.nz/sport/news/article.cfm?c_id=4&objectid=11738805)

<comment><USER11> Heh...freediving is the context in which one learns to hold his breath for that long :) Unfortunately, my static times don't translate as well into dynamic times. I'm basically limited to 2-3 minutes underwater when I'm moving. My PB for depth is around 50m, which is nowhere near elite.

I basically came to freediving too late in life to ever be world class in any of the disciplines. The funny thing is that, when it comes to status, what little my freediving training has gained me has come from the associated weight loss.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> I used to know that guy when he _was_ King of the Middle Kingdom in the Society for Creative Anachronism. He was an extreme libertarian long before it was fashionable. He wrote "The Machinery of Freedom" in 1971. It's an extreme expression of "markets can do anything".

</comment><comment><USER14> Status is closely related to authority and power. I'm not going to pretend I'm the top of a ladder and have power. Power is a real objective thing and it is a zero sum game. We must not let people get so powerful, no matter how "nice" they are. That's the real argument for equality, but more importantly equity.

</comment><comment><USER15> Ah, but the problem with discussions of status is that "not chasing status" is a status in and of itself. It's status all the way down!!

You will never get rid of it.

<comment><USER16> "You cannot not communicate" \-- Paul Watzlawick[1]

Incidentally, most of his writing is pretty amazing. "How Real is Real?", for example.

One of my favorite example is the experiment where two people are ( _ostensibly_ , as in all psychology experiments) asked to figure out how to spot disease patterns in certainly images of blood cells.

The experimental setup is that subjects A and B each have a screen a button to indicate whether the picture shows a diseased or healthy cell and a light showing them whether they were right.

The nasty bit is that whereas A's light is hooked up to his answers, B's light is not. It is also hooked up to A's and they aren't shown the same pictures. So A gets proper feedback whereas B gets essentially random feedback.

Since the task is not that hard, the As quickly figure out the simple rule, whereas the Bs concoct ever more elaborate theories.

The _really_ nasty bit is that they then bring A and B together to discuss and present their findings. And it turns out that the Bs almost without fail convince the As that they are wrong, because how could such a ridiculously simple answer be correct, whereas the As are convinced by the sophisticated answers the Bs have come up with.

Explains so much.

[1] [https://en.wikipedia.org/wiki/Paul_Watzlawick](https://en.wikipedia.org/wiki/Paul_Watzlawick)

</comment></comment><comment><USER17> Genuine question: I've never understood the non zero sum game idea in the context of economic inequality. If I win more than you lose, overall it's a non zero sum game, as in, our combined gaines are greater than before (the pie is larger), but you still lose(you get a smaller piece). Would someone be interested in highlighting some counter arguments to this?

<comment><USER18> The idea of non-zero-sum games is that a regulator interested in public welfare would still let the two people you described play that "game," and then would be able to tax and redistribute in such a way that both "players" are still better off for having played.

With zero-sum games the habitual loser would eventually wise up and wish to stop playing

<comment><USER17> Not sure I understand your point, in a zero-sum game the third party could still do some redistribution to keep the habitual loser "in the game"

Update: scratch the above, you're right. But in my experience the ones arguing that we're in a non zero-sum game also argue against redistribution.

</comment></comment></comment><comment><USER19> Even better, de-emphasize status. Status concerns are practically embedded in the "elite" professions (finance, law, consulting), but in technology people spend a lot less time worrying about that. And that's healthy.

<comment><USER20> Keith Johnstone (pioneered improv theater) makes a pretty convincing argument in his book Impro that status is the most important thing to humans (and that much of our interactions involve status). It's the invisible fabric of our life in society that we aren't supposed to talk about.

Also, plenty of psychological research has shown that status is usually valued more than money in one's job, where status encompasses things like "my boss tells me I'm doing a good job" (which means more coming from your boss or the VP than the intern) or "my team appreciates the work I do".

</comment></comment><comment><USER21> I'm sorry to call you out on this, but when I click on the link for your username, I see lots of info you've listed to communicate your status as a successful and accomplished member of the tech community. Presumably that info is there because you think it is relevant and of interest to the technology people here on HN.

Oh, and yes, if you or someone else clicks on both our links you'll see that you have far more karma here than I do, suggesting that perhaps your opinion on these matters should be valued over mine, and/or that you can both dish out and weather down-votes more than I can, both because of your higher status here.

[edit: slight grammar tweak for clarity]

<comment><USER19> Ok then, I just deleted my bio, if that helps.

As for HN points, that just indicates procrastination (spending too much time on HN).

<comment><USER9> Well, now you are trying to increase your status as someone who doesn't care about status. The fact that you felt it worthwhile to delete your bio, just to prove to some random internet stranger that you don't care about status, clearly shows that you care.

It is ok to care about how others perceive you. We are social creatures, and we care about what others think. That isn't a bad thing.

<comment><USER19> I assure you I'm a nerd with no social standing whatsoever, and I'm almost flattered to be considered otherwise here in this thread.

And yes we're social creatures, and we all want to be understood and appreciated. But that's quite a different thing from pursuing social status.

<comment><USER9> I don't think it IS different.... being 'understood and appreciated' is exactly what social status is.

<comment><USER19> No, social status is a zero sum /ranking/ of individuals and inherently competitive.

[https://en.wikipedia.org/wiki/Social_status](https://en.wikipedia.org/wiki/Social_status)

</comment></comment></comment></comment></comment></comment><comment><USER22> Not knowing who the author was, I read this thinking it must've been written by a teenager taking his first stabs at intellectual discussion of socioeconomics. Turns out he's Trump's ambassador to Israel. I can't decide which is less credible.

 _We all value status._

It's easy to miss how bad this generalization is since this piece is entirely generalization. It reveals the assumption underpinning Friedman's argument — that status is important to everyone. He seems to think that those who don't value traditional signifiers of status must find other ways to scratch that itch.

I understand this is a short blog piece but you can't credibly talk about status in a societal sense without also acknowledging the ways in which each society tends to limit the rights of those at the very bottom of its status hierarchy. Status is not just self-perception, it has a very tangible, external impact on someone's well-being in a society.

The biggest problem with this piece is that it doesn't acknowledge the very real possibility that status simply matters less to some people than others. The best people I know are the ones who devote the least amount of energy to comparing themselves to everyone around them. Personally I believe that striving for a level of detachment from competitive self-evaluation is a lot more important than achieving any of the forms of status Friedman seems to care about.

Maybe instead of moving towards Friedman's capitalist utopia where everyone can be high-status we should instead strive for a place where status just matters less to everyone.

<comment> barry-cotter > Turns out he's Trump's ambassador to Israel.

Author of the linked blog.

[https://en.wikipedia.org/wiki/David_D._Friedman](https://en.wikipedia.org/wiki/David_D._Friedman)

David Director Friedman (born February 12, 1945) is an American economist, physicist, legal scholar, and libertarian theorist. He is known for his textbook writings on microeconomics and the libertarian theory of anarcho- capitalism, which is the subject of his most popular book, The Machinery of Freedom.[2] Besides The Machinery of Freedom, he has authored several other books and articles, including Price Theory: An Intermediate Text (1986), Law's Order: What Economics Has to Do with Law and Why It Matters (2000), Hidden Order: The Economics of Everyday Life (1996), and Future Imperfect (2008).[3]

Trump's ambassador to Israel

[https://en.wikipedia.org/wiki/David_M._Friedman](https://en.wikipedia.org/wiki/David_M._Friedman)

David Melech Friedman is an American bankruptcy lawyer.</comment></comment>


Marc Benioff: Future Software Will Look Like Facebook - <AUTHOR> http://tech.slashdot.org/story/12/09/20/163225/salesforce-ceo-benioff-future-software-will-look-like-facebook

<comment><USER2> _If people can collaborate on tagging a photo, he added, they could easily do the same with a product or business problem_

Is this not the Google Wave Fallacy?

</comment><comment><USER3> If that is what the future is going to look like, I am getting rid of my computers now and taking up gardening and bird watching.

<comment><USER4> I like your plan. Let's join forces and disrupt the gardening and bird watching space using cutting edge crowdsourced location aware mobile technology.

<comment><USER5> _cutting edge crowdsourced location aware mobile technology._

Is that like one of those Swiss army knives with a built-in compass?

<comment><USER4> Yes, like that. Oh did I mention that it uses GPGPU accelerated cloud computing?

</comment></comment></comment></comment><comment><USER6> This has already been happening for quite a while now. Not exactly a radical prediction.

Learning management systems like Blackboard and Instructure Canvas are basically imitating facebook now. Edmodo goes the other way and basically starts from facebook and then adds in some learning/teaching features like quizzes and assignments.

Of course github has taken off the past few years, and it has feeds and likes (starring projects) and follows.

As someone commented on slashdot, even AutoCAD added a 'design feed' feature <http://www.autocadws.com/blog/introducing-the-design-feed/>

For things that aren't enough to warrant social attention to 'like' (like posting 100 times), there seems to be more use of badges like on forums and stack exchange.

</comment><comment><USER7> Whenever I see statements of this form, I find myself adding "except when it doesn't" to the end and then finding it much more acceptable.

Future software will look like Facebook except when it doesn't.

Much better.

</comment><comment><USER8> Feed-based enterprise products can be a nightmare for users to follow. There must be structured filtering, categorizing, subsets etc to make sure you can find needed information quickly, not miss important stuff and not having to read through absolutely everything in the newsfeed. For many types of information, using the newsfeed paradigm would be absolutely incorrect.

<comment><USER9> Agreed any feed based system, even with filters adhears to one fixed albeit customised set of filters. When you can have a different filter set that takes into account what is important to you right there and now, which changes. Then it will be more managable, but that is still away of as predicting the weather 100% right all the time. Compters are good after all at learning from there mistakes once said mistakes have been highlighted to them, it is when they learn human mistakes which the human is unaware of that starts to become an area of conflict.

But if feed based products were the way to go then USENET would of been growing in popularity above and beyond the binary feeds.

We after all as humans are still pefecting ourselfs and with that we are shy of any software that dictates direction for us. For most a forum were the input feeds are moderated and sanatised by others prior to you getting it is the common form, be it via crowd sourced forums like this or teirs of managment filtering what is interesting. Though the ability to overide those filters is just as important than having them and any other way is dictating and controlling the information in a way that makes most uncomfortable in the expectation that they are missing something which to them is important. Just as if this forum had no search option and the ability to view only the deemed top news items, well you know how that would work out badly, even if most don't use search or the new options much.

</comment></comment><comment><USER10> It's not futuristic anymore. It's today's software. Future is still being cooked in someone's bedroom. Right now.

</comment><comment><USER11> Over a year ago, I wrote up an early product requirements doc for how law enforcement investigations will function if investigators could follow cases, evidence, firearms, events, suspects, persons of interest, locations similar to how we follow people on Twitter or Facebook. It would make it incredibly easier for them to be notified when something changes, instead of having to manually be alerted about something of relevance.

</comment><comment><USER12> My hunch is _yes_ , there are successful patterns in Facebook that will propagate to many other software categories, both because they are beneficial and users have een trained to expect them... but then _no_ , those patterns won't dominate completely, because certain countervailing needs will change/moderate/negate them.

For example, the 'news feed' is super compelling and attention-grabbing, but at least partially in attention-abusive ways. By intermixing updates of wildly different importance, provenance, and topic, a heightened sense of novelty is created. By the use of reverse-chronological order, a false urgency is created -- "I must read/reply before it scrolls out of view!" -- even when the topics aren't really urgent. So this pattern is a sugar/steroid/stimulant for engagements... against which the mentally-healthy will eventually have to _disengage_ and replace with something more respectful of their attention, with truer cues about novelty and importance.

So I expect the 'feed' pattern to be copied everywhere it might offer a quick bit of 'sizzle' to interactions... but also for new ameliorative antipatterns to be developed, and modify or displace the 'feed', as well. Especially in productive contexts where entertainment/diversion/distraction is _not_ the highest value, it will be tried but then modified or discarded.

<comment><USER13> It is ADD for sure, but there is a measured dopamine response to this type of interaction. The easiest way to understand the history of any object is through a timeline, so when appropriate I do think you are going to see a lot more of it.

From my vantage all of the modern social networks feel like the newest incarnation of the blog model, which has always had that timeline model.

Nir Eyal has some nice thoughts on it: <http://www.nirandfar.com/2012/08/the- webs-slot-machine.html>

<comment><USER12> If you want a summary history for a unified object, the revchron presentation is natural and minimally abusive. (Though, we may yet find better standard presentations for hiding info that is attention-grabbing but lower-value.)

Mixing _unrelated_ things, and making this mixed-history the default view, and optimizing it relentlessly for impressions/engagement -- those are all thiings that trend towards abusing people's attention. People will become more aware and less tolerant of such 'false excitement' UX over time, presenting more opportunities for designs and businesses that respect rather than squander our mental cycles.

<comment><USER13> Good perspective!

</comment></comment></comment></comment><comment><USER14> Seriously what the fuck is with all these articles lately that are just links to Slashdot?

</comment><comment><USER5> Facebook looks like tv listings and classifieds pages from old print magazines to me. If the future of software looks like facebook, there will be a hell of a lot of disappointed people.

<comment><USER15> Salesforce isn't exactly known for good taste in UI themselves. And feeds? Seriously? More ADD isn't going to make anyone more profits

</comment></comment><comment><USER16> Sussman must get so pissed after reading stuff like this (after he wgets the page and opens it up in his email client, that is).</comment>


Scientist Hack Plants to Turn Biomass into Fuel Using the Sun - <AUTHOR> http://www.nature.com/ncomms/2016/160404/ncomms11134/full/ncomms11134.html <comment><USER2> I found this a bit impenetrable, can someone who understands it better than I can, provide a not so technical explanation of how it works? thanks!

<comment><USER3> They're hoping to make producing cellulostic ethanol easier.

They found out that by combining photosynthetic pigment with the enzymes plant-eating fungus use to break cellulose down, they can speed up the process. The pigment absorbs light and produces electrons needed by the enzymes to do their work.

<comment><USER2> Cheers. I feel slightly less dumb now :)</comment></comment></comment>


Software Checklists – can they be useful? - <AUTHOR> http://www.solipsys.co.uk/new/SoftwareChecklist.html?HN_20160711 <comment><USER2> Betteridge's Law of Headlines[0] says the answer is "No."

[0] [https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...](https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)</comment>


Zynga Buys NaturalMotion For $527M - <AUTHOR> http://techcrunch.com/2014/01/30/zynga-naturalmotion/ <comment><USER2> They buried the lead... Zynga _has_ $527M??

Much like Sauron's tower in Mordor that collapsed once the foe was vanquished, you kinda expected Zynga to implode once Pincus was ousted.

<comment><USER3> I came here expecting to see something like this at the top position. Apart from the standard rant about how completely unconstructive criticism -- in fact just outright insulting whole people and companies from the safety of anonymity -- seems to rule around here, there are a couple of other things I'd like to say.

HN would greatly benefit from a regional filter -- as in, a filter of which comments I read, not who can post them. WTF do I care what some guy in Australia thinks of a very prominent Bay Area employer? He doesn't have friends and neighbors who work there, we do. Geographic community still means something, and much of the news on HN happens in _our_ locale.

(Honestly, I have a difficult time taking any developer who doesn't live here seriously, but that's a different discussion.)

Second, up/down voting is conflated with "makes me feel good/not good" \-- a better system would allow feedback to be more nuanced: agree/disagree, insightful, well-researched, funny etc. So we could have filters on discussions for what's actually insightful, not just what gives people the fuzzy comfort of knowing their preconceptions can remain safe and unchallenged for one more day, because the world has made low someone who has actual accomplishments (and mistakes)

<comment><USER4> _(Honestly, I have a difficult time taking any developer who doesn 't live here seriously, but that's a different discussion.)_

That's lovely. People outside your precious bay area don't have any sort of interesting insight (It's a Jeep thing; you wouldn't understand)? Your whole rant is pretty hilarious in this context.

 _...in fact just outright insulting whole people and companies..._

Yes, by all means. Attack the person you're replying to right before you dismiss all developers outside of your little geographical echo chamber as inferior.

Finally, I'd like to apologize on behalf of all the stupid foreigners (read: non-Bay-Area-ites) who are offending you so badly with our deplorable misuse of the voting system. You're right; we're simply afraid that you're cutting down our sad little misconceptions about the big, scary world (which, of course, comprises solely the place where you live, as nothing else really matters).

I'm not sure if you understand it, but your attitude is a big part of the reason some of us would never, ever move there. I'm sure you find this just peachy, which would also be your own failure.

<comment><USER3> A) parentheticals are aside comments

B) I'm not saying that _all_ outside programmers are inferior. I'm saying that, given a uniformly random sample of Bay Area vs. outside programmer, I would expect the Bay Area programmer to be "better" for some set of objective measures.

If you don't think that, then you also have to disagree with basic market dynamics. Good programmers can earn more money here, and expose themselves to significant upside opportunities -- both social and financial -- which simply cannot be offered in the same quantity elsewhere. So if you show me a programmer who doesn't live in a place where they are exposed to those opportunities, I have to conclude one of only a few options:

1) not a good enough programmer to work at a company where they would be exposed to those opportunities

2) too risk-adverse or pessimistic to believe that they could leverage those opportunities, such that the cost of living here would be outweighed by the potential benefits -- which, if that is what this person believes about themselves, then perhaps #1 also applies

3) extreme aversion to city or suburban living? Or severe miscalculation of the cost-benefit of living here.

Certainly there are some cases where people who don't live here -- the center of the universe as far as technology careers are concerned -- are actually very highly skilled _and_ leveraging those skills in their own communities. John Carmack doesn't live here, nor does Matz.

But I think you have to admit that those are exceptional cases. The average case is that you have an average programmer -- how else do you interpret the decision not to live in a place which affords objectively superior upside scenarios?

 _I 'm not sure if you understand it, but your attitude is a big part of the reason some of us would never, ever move there. I'm sure you find this just peachy, which would also be your own failure._

Yeah I get it and I'm sorry for offending you. But I think there are certainly some realities at play, and one of them is that not all places attract talent equally. Nobody bats an eye if I said "community theater in Peoria does not attract the best acting talent," somehow that's an obvious statement -- of course if one was truly talented they'd have found a more rewarding stage.

Why is the same principle upsetting when applied to your own profession? Talented developers will find their way to the place which best rewards them. The biggest rewards tend to be available in the SF Bay Area. Ergo, to the extent that talent and compensation, opportunity etc are correlated -- the better talent is found here.

 _Finally, I 'd like to apologize on behalf of all the stupid foreigners..._

This is an unnecessary reaction. I think you must know what I'm saying here is that the voting seems to have a tendency to indicate popular sentiment, and not thoughtfulness, or insight. Consequently, it tends to punish provocative or controversial statements.

<comment><USER5> You forgot (4) -- doesn't like the idea of living in the U.S.

Having a great job in a great city with warm weather is nice and all, but that's a fragile little bubble. To my sensibilities, the U.S. society, government, media, and military is a crazy disaster.

<comment><USER6> He forgot a million other options too. At one point, I wasn't a Silicon Valley worker because I preferred to live near family.

At present, I don't even know if I should be personally offended or not -- I technically _work_ in Silicon Valley, but I _live_ on the other coast, where the cost of living is dramatically lower.

That isn't to say his remarks weren't offensive either way, because basing a programmer's quality on something as arbitrary as where someone happens to live seems pretty naive.

<comment><USER3> I offer you the opportunity to open your company's office in whichever city you prefer -- I'll bankroll the first three years of rent. Work on the hardest, most challenging thing you think you can deliver, which also can actually deliver real value to your customer -- i.e., solve a difficult and useful problem. I'm also paying for the first few years' salaries of your early employees.

Where would you open your office and why? Do you think the location of your family would be an important factor in determining the likelihood of success? Sure, _you_ might be happier there -- are you going to be able to fill the 20 most important roles in your with high quality people?

There are probably a small few fields where it makes sense to not be over here. The rest, you're probably going to have a difficult time rationalizing not picking SF/SV.

 _He forgot a million other options too_

I forgot maybe two important, distinct reasons which don't fold into the ones mentioned. Valuing family time higher than financial opportunities being one of them.

<comment><USER5> From now on, any business that I create will be seeded with remote talent. Even if talent is local, the business processes will be optimized to allow seamless remote work. The benefits are just too great.

See 37 Signals and Art & Logic.

I'll grant that SV probably has the most favourable funding environment.

Case in point: recently I've been looking at art talent, and the difference in quality between paying market rates for Disney-quality talent vs. hitting up my professional network and friends is just astounding.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> This is impressive. I think the perception is Zynga is this poor little company that is on its last legs when in reality they are still making money and fresh off the press of the IPO they've still got a bit of money to play with and this is a smart play if I do say so myself.

It'll be interesting to see if NaturalMotion is kept as a separate entity to that of Zynga or it is merged with the current company. The 15% Zynga staff cull that just happened I guess is a sign that they're going to be using their new-found employee purchases over at NaturalMotion in place of the 15% they just laid off.

Whether or not this purchase saves Zynga remains to be seen. CSR Racing is a fantastic game, really fantastic and well played. I've been playing it for a while now on the train to work, the mechanics and graphics are stellar for a mobile game.

<comment><USER8> I agree. The NaturalMotion portfolio has lots of really great IP in it. Clumsy Ninja is such a charming character and CSR performs well critically and financially.

In my opinion, take a page from the Arthur Anderson / Phillip Morris playbook and rename the entire company. It will make recruiting easier for them and probably please investors by shedding some of Zynga's negative brand halo.

</comment></comment><comment><USER9> NaturalMotion technology is excellent and this is a smart buy. Can't believe they sold. Quality products, above the bar tech, best physics on mobile probably. Check out Backbreaker and Clumsy Ninja.

</comment><comment><USER10> I was told from an employee that they were laying off a bunch of people today....

Did this not happen? Or it is overshadowed by the mass spend on this acquisition?

<comment><USER11> Third paragraph of the article, last sentence.

(There is also sad news today, with layoffs for 15 percent of the company's workforce.)

<comment><USER12> Pump and dump: Buy up a new hit, throw out the old talent.

</comment></comment></comment><comment><USER13> Well look what happened to OMGPop when Zynga bought them ([http://en.wikipedia.org/wiki/OMGPop](http://en.wikipedia.org/wiki/OMGPop)). Not convinced at all.

</comment><comment><USER14> Wow, I didn't even realize they had 527M to spend on anything, yet they are closing studios, canceling games, laying off good people...

<comment><USER15> They're trying to stop the bleed on their cash, recognizing they're going to have to essentially build an entirely new company (and likely understanding the time and expense involved).

<comment><USER14> But can't they re-purpose the existing studios, employees and have it cost way less than $527 million? I mean is $527 million worth saving the time of re- purposing the studios and employees? I just dont know. I guess to them it is...

</comment></comment></comment><comment><USER16> Not surprising that they put themselves up for sale - Clumsy Ninja never hit top 10 grossing. That was their ticket to the Billionaires Club and they missed the mark.

Still a great outcome for the NaturalMotion guys. Welcome to the Borg.

<comment><USER17> Clumsy Ninja was never meant to make a ton of money. It was to show off their tech - they also sell highly valuable middleware for games.

</comment></comment><comment><USER18> Did Zynga lay off 15% of its workforce to recoup the $527M investment in NaturalMotion? See [https://news.ycombinator.com/item?id=7153709](https://news.ycombinator.com/item?id=7153709)

That article says they'll take a $17M charge this year on the lay off and then save about $33M/year. Discounted at 6% per annum that works out to $533M. See [http://www.wolframalpha.com/input/?i=-17+%2B+Sum%5B33%2F1.06...](http://www.wolframalpha.com/input/?i=-17+%2B+Sum%5B33%2F1.06%5En%2C%7Bn%2C1%2Cinf%7D%5D)

This article says Zynga has "about $1.2 billion in cash and marketable securities on hand." But a dailyfinance article suggests companies aren't really as cash rich as they seem; their money is locked up in offshore tax havens; they can't repatriate it without paying tax on it: [http://www.dailyfinance.com/2011/07/25/why-are-rich- companie...](http://www.dailyfinance.com/2011/07/25/why-are-rich-companies- laying-off-poor-workers/)

</comment><comment><USER19> This strikes me as track behavior. They got a big winner by chance, and are back at the betting window putting the money into the next favored horse, hoping to come out ahead again. They'll do this until they lose big. Seriously, though, half a billion dollars?

</comment><comment><USER20> I know Torsten from a european startup accelerator where he was a mentor for gaming...super smart guy, deeply understands mobile gaming, a great talker and a hacker at heart. Congrats :)

</comment><comment><USER21> Zynga's still around? I thought that particular titanic-of-the-internet had sunk already.

</comment><comment><USER22> I feel like NaturalMotion has been around for a long time. I remember playing with some of their ragdoll physics simluations at least 7 years ago.

<comment><USER23> They've been around for a while. Even before getting into mobile they did high end 3D platform stuff for console games like grand theft auto.

<comment><USER24> They have indeed - long enough that their angel round was almost derailed by 9/11.

</comment></comment></comment><comment><USER25> Why would they spend half a billion dollars on a studio that only has one hit game?

<comment><USER26> Their middleware is very valuable. They have probably the best behavioral procedural animation system that is most notably used by Rockstar Games in GTAIV&V, Max Payne 3 and Red Dead Redemption.

<comment><USER27> It doesn't really fit with Zynga's portfolio though, does it?

<comment><USER28> That's the point, isn't it? Zynga wants to expand its mobile skillset.

</comment></comment></comment></comment><comment><USER29> Why is this on HN but not Zynga laying off 300 people?

<comment><USER30> It is. In fact, it ranks higher than this post right now.

<comment><USER29> Good, when I posted it wasn't.</comment></comment></comment>


Vote what you want the Webpack team to focus on - <AUTHOR> https://webpack.js.org/vote/ <comment><USER2> DISCLAIMER: (dupe comment) This was an alpha feature that got leaked that we didn't expect to be circulated. Therefore we don't have UX/UI yet. We would love help and support so PR's, suggestions, issues are all welcome on github.com/webpack/webpack.js.org

</comment><comment><USER3> "Your browser is not supported" on Safari[1]...seriously? Chrome is not the One True Browser. What bleeding edge feature could a poll possibly be relying on?

[1]Safari v10.0, OS X v10.11.6 (El Capitan)

<comment><USER4> I'd tell you, but I got "You are not logged in. [Login with Github]", at which point I lost interest.

<comment><USER5> hey, you're a meme now [https://imgflip.com/i/1ep7b0](https://imgflip.com/i/1ep7b0)

<comment><USER5> here's the template for the meme [https://imgflip.com/memetemplate/85156256/hacker-new- comment](https://imgflip.com/memetemplate/85156256/hacker-new-comment)

</comment></comment></comment></comment><comment><USER6> It's got to be expanding documentation or writing more tutorials. There's so much you can do with webpack, but as a beginner I found it hard to wade through 3rd party blog posts to figure out best practices.

<comment><USER2> Have you checked out webpack.js.org/concepts. webpack.js.org is our entire new documentation effort designed initially for first time users.

Take a look and feel free to submit an issue if there are things that are still confusing or you would like to see more of.

<comment><USER7> Wow. This documentation is so much better than what was previously available. Thank you from the bottom of my heart.

The one thing I will point out is that from a UX perspective the font you are using "Cabin", is naturally smaller and more compact than more common sans fonts (e.g. Open Sans, Century Gothic).

Because of this, even though your site is font-size 16, everything appears smaller than it would normally be.

<comment><USER2> Coming from a no-design-ux background, I never considered this and it would be a perfect issue on our github. Would you be interested in creating it? github.com/webpack/webpack.js.org/issues/new

</comment></comment></comment></comment><comment><USER8> The entry I wish I saw in there: "Persistent chunk cache so that compiles are incremental even on restart of webpack." Once you start getting a large number of assets into a deployment pipeline, recompiling everything from scratch every time becomes very painful. Wish webpack could help here out of the box without needing handrolled caching solutions.

<comment><USER2> There is potentially a plugin that might work for you but an RFC on our core repo would be worth the time. Check out hard-source-webpack-plugin and see if that helps you.

<comment><USER8> Thanks so much for the pointer to that plugin; it looks like it does exactly what I'm looking for. It's a testament to webpack's configurability that a plugin can get deep enough into the guts to do that. I remember looking at [https://github.com/webpack/webpack/issues/250](https://github.com/webpack/webpack/issues/250) ("Cache build information between webpack processes") back in the day and even now it looks like it's still open/unresolved/tagged "difficult."

</comment></comment></comment><comment><USER9> Be more easy and allow to works not only with nodejs, also more flexible manipulations with dist files in wwwroot.

</comment><comment><USER10> 'Write documentation MVP' is listed, seriously. Glad I switched to being a server-side dev.

<comment><USER11> I was actually kinda surprised by that- at least since I've started using it, I've found the documentation to be quite helpful.</comment></comment>


Microsoft calls for $5B investment in U.S. education - Suraj-Sun http://www.computerworld.com/s/article/print/9231800/Microsoft_calls_for_5B_investment_in_U.S._education

<comment><AUTHOR> >>To pay for the $500-million-a-year investment in education, Smith proposed that Congress add 20,000 high-skill immigration visas dedicated to workers in STEM fields to the existing 85,000 H-1B visas allowed each year. Congress should charge $10,000 for each of the 20,000 H-1Bs, he said. H-1B applications normally cost about $2,800 for large companies.

As a current H1B holder, this infuriates me. How is it a rational plan to more than triple the cost of H1Bs? Doing so will only make it more difficult for skilled foreigners to find jobs in the United States, creating a very large shortage in the short term.</comment>


A tool to search for Python code using jQuery-like selectors - <AUTHOR> https://github.com/caioariede/pyq <comment><USER2> Interesting idea, and a great exercise for learning more about parsing, CSS selectors, and command-line interfaces.

One point of (hopefully) constructive criticism: I'm not completely sold on the CSS selector syntax. Attribute selectors are semantically meaningful in the DOM, not as much so in Python.

Providing a more Pythonic query language might make it easier for users to guess the purpose of queries and to build complex queries of their own. For instance:

        class * extends IntegerField
        class FloatField
        class FloatField: def *
        class FloatField: def to*
        from collections import Counter

or perhaps:

        class FloatField: def to*(foo)
        for * in *: if * is None

(or perhaps even `for $1 in _: if $1 is None`. There are probably better ways than what I described to express the wildcard part, especially if you want to distinguish these from `_ args`, ` __kwargs`...)

Anyways, it's always awesome to see people putting their work out there, and I hope you'll continue to do so!

<comment><AUTHOR> I agree with you. I'm also not convinced that these kind of selectors are good to match Python code. It was more an exercise to develop a generic library that helps implementing jQuery-like selectors [1].

Even if the project doesn't go too far, it was a good fun for my weekend.

[1]: [https://github.com/caioariede/pyq/tree/master/sizzle](https://github.com/caioariede/pyq/tree/master/sizzle)</comment></comment>


The Dart VM is now 50% faster than V8 on the two Octane benchmarks - <AUTHOR> http://news.dartlang.org/2012/12/dart-vm-improves-performance-by-50.html

<comment><USER2> Why is Dart able to run so much faster than JS?

The Dart team came from the V8 team, and presumably they're still involved in V8. I'd expect any optimizations that were developed for Dart and were applicable to JS would be backported into the V8 engine, so there must be something different about the Dart language that enables more optimizations.

From what I've seen of Dart, if you ignore the type annotations (like the VM does), and you don't consider syntax, the only performance-relevant difference between JS and Dart is the OOP system, which wouldn't explain a 50% performance difference...

<comment><USER3> Unlike JavaScript, Dart was created with performance (and tooling) in mind. There are a few people involved who worked on several VMs such as HotSpot or V8. JavaScript didn't have that kind of guidance. There are some features in JavaScript which make optimizations very difficult or even next to impossible.

The most obvious ones are probably `eval`, `with` (each property can mean something different with every iteration), and messing around with `arguments` (changing values of that pseudo array also changes the values of the actual named parameters).

You can also change, overwrite, and delete everything. `this` can also refer to something different each time.

Those quirks make JavaScript VMs very complicated and they also result in many surprises. For example, using `delete` can degrade performance quite a bit and adding properties to built-in objects can break some optimization-related heuristics.

Dart just skipped all of that really nasty stuff.

Well, to be fair, they also skipped one of the very useful nasty parts: on- stack replacement (OSR). If there is just one long-running function it won't get optimized (it won't get replaced - right there on the stack - with an optimized version).

Generally, this doesn't matter much, but there are some cases where it's really inconvenient.

It's safe to assume that they will address this once they are done with all optimizations they deem more important. I'd guess it will happen before they hit the big 1.0 (M1 = 0.1-ish).

<comment><USER4> > very useful nasty parts: on-stack replacement (OSR) ... > Generally, this > doesn't matter much, but there are some cases where it's really > inconvenient.

If you have a real world application [not a microbenchmark] that suffers from the fact that Dart VM does not implement OSR please add it to <https://code.google.com/p/dart/issues/detail?id=6787>

<comment><USER3> One could argue that every application which would benefit from OSR is essentially a micro benchmark.

I can't disagree with that, because that statement is absolutely true. The only difference between those two kinds of programs is the intention of the programmer. In both cases you have at least one heavy function which is called just once. As far as the VM is concerned, there is no difference whatsoever.

But it's also true that there are sometimes long running functions which are aren't frequently called. In Java, JavaScript, or C# you won't have to worry about that kind of thing. You won't have to break it down in smaller pieces just for the sake of spreading the load across more function calls.

<comment><USER4> My point is: you don't have to worry in Dart either. If the code you are shipping is suffering due to the lack of OSR and you have to work around that --- just add an example to the bug and we will fix it.

</comment></comment></comment></comment></comment><comment><USER5> It's not really a fair comparison as the dart versions are more-or-less completely statically typed. If they wanted this to be fair they'd be using untyped (typing is "optional" in dart).

If you're allowed to modify the code in substantial and performance altering ways for one language, you should be allowed to for the other as well (the JS versions of both those benchmarks have substantial perf problems).

This is especially egregious given that the DeltaBlue tests is ported from untyped smalltalk, so the JS version is actually closer to the original.

<comment><USER4> [disclaimer: I work on the Dart VM]

Dart is actually not statically typed: in production mode (which is default) type annotations are ignored completely, in checked mode they are translated to runtime type guards and not checked globally&statically during compilation. For more details please take a look at: <http://www.dartlang.org/articles/why- dart-types/>

Published benchmark scores are coming from the production mode. Even if you remove all type annotations performance will not change a bit.

In fact by design Dart VM does not use _any_ information provided in type annotations to perform optimizations.</comment></comment>


GPT-What: Intro to the next big thing - <AUTHOR> https://medium.com/@jesalg/gpt-what-intro-to-the-next-big-thing-ea1b92c4cbbc <comment> dane-pgp > What are those 175 billion parameters?

> According to Geoffrey Hinton — the godfather of 'deep learning' — parameter > can be thought of as a synapse in a human brain ...

> They're far, far smaller, the biggest ones we have right now have about a > billion synapses. That's about a million times smaller than the brain.

So his estimate is now off by a factor of about 100? How long will it take for the next couple of 100-fold increases in parameter count?</comment>


Tenants fume over apartment complex's new Facebook addendum - <AUTHOR> https://www.ksl.com/?sid=39954863&nid=148&title=unlike-tenants-fume-over-apartment-complexs-new-facebook-addendum <comment><USER2> How is that even an "addendum"? "Here, you have signed some contract some unspecified time ago; and now we're unilaterally changing it: you must friend us on FB, plus you must wear a yellow hat at all times. Also, you owe us your firstborn." IANAL, but any of that is beyond ridiculous.

<comment><USER3> _Here, you have signed some contract some unspecified time ago; and now we 're unilaterally changing it_

They're taking inspiration from the world of software-as-a-service EULAs?

</comment></comment><comment><USER4> The apartment complex wants to retroactively force tenants to like the complex on Facebook. This is all the way shady.

It's times like this that I wish there was 'dislike' option to counteract bad actors like this.</comment>