Recutils – Tools and libraries to access plain text databases called Recfiles - <AUTHOR> https://www.gnu.org/software/recutils/ <comment><AUTHOR> At CurrySoftware we use recfiles combined with git for all business-processes (incoming and outgoing invoices, customers, etc). It allows us to automate everything we want with simple bash scripts. But we remain flexible because we can perform non-automated tasks manually.

<comment><USER2> Your processes made me think about a email based interface instead of a bash script, this may allows to easily interact with the database bot without knowing bash or python.

<comment><AUTHOR> We plan use a Telegam interface for many things (status checks, new invoices etc). Its easier and faster than E-Mail and available everywhere!

<comment><USER3> Telegram (Messenger)?

<comment><AUTHOR> Yes. Communicating with telegram from bash is simple. Check out [https://www.curry- software.com/en/blog/telegram_unit_fail/](https://www.curry- software.com/en/blog/telegram_unit_fail/) for example.

<comment><USER4> I'm wondering if it is possible also with Signal (signal.org)

<comment><USER5> Harder, since they don't have an open API and don't want people using non- standard clients. The clients are open-source though, so probably you can do it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I have a growing affinity for non-database-databases for personal and low/sparse-traffic projects. Lots less hassle.

Here's one I maintain designed for use with AWS Lambda which uses S3 as a Pythonic data-store: [https://github.com/Miserlou/NoDB](https://github.com/Miserlou/NoDB)

<comment><USER7> I'm always fascinated that people get stuck differentiating between using a database for indexing and as a canonical data store.

Like the majority of media apps, it's either impossible or a huge pain to get them to index without managing.

</comment></comment><comment><USER8> Apparently you can get output in csv (natively) and json (python one liner) without too much assle ([http://swick.2flub.org/recutils_JSON_output.html](http://swick.2flub.org/recutils_JSON_output.html)) which suddently makes it even more interesting.

</comment><comment><USER9> The link to the newer presentation video on the page is broken but this is probably the same one: [https://fscons.org/videos/2011/gnu-recutils-changed- title-an...](https://fscons.org/videos/2011/gnu-recutils-changed-title-and- subject.webm)

<comment><USER10> Thanks! I was a bit dissapointed that only the older video link was working.

</comment></comment><comment><USER11> I really like the idea of plain text data files so am really interested in this.

YAML serves this purpose too but I'm not a huge fan of indenting so recfiles look great. Anyone compared and contrasted?

Also are there other resources on this? Would be nice to have Java/C++/Python libraries. (As well as convert to parquet, arrow etc )

<comment><USER12> I have done some prototyping on a similar idea, but I think with a more idiomatic approach. The idea is mostly adding relational structure (schema) to CSV, and enabling a cleaner lexical syntax (get rid of the line noise).

Might some day dust it off and try to bring it to a more serious level (performance, tooling etc).

[http://jstimpfle.de/projects/python- wsl/main.html](http://jstimpfle.de/projects/python-wsl/main.html)

</comment></comment><comment><USER13> Fro docs:

YAML 1 is an example of a hierarchical data storage format which is much more readable than XML. The problem with YAML is that it was designed as a "data serialization language" and thus to map the data constructs usually found in programming languages. That makes it too complex for the simple task of storing plain lists of items.

I dont see how this is true. Provided sample with books is almost identical in yaml.

The main benefit over yaml looks like more control of individial fields but again, yaml based db app could do that too.

</comment><comment><USER14> I noticed this is GPLv3, which means if you use this library, all your application will have to be open source, however IANAL.

<comment><USER15> They have a page explaining their reasoning: [https://www.gnu.org/licenses/why-not- lgpl.en.html](https://www.gnu.org/licenses/why-not-lgpl.en.html)

<comment><USER16> The only reasoning they really need is "we wrote the GPL and we're gonna goddamn use it".

</comment></comment></comment><comment><USER17> This reminds me a bit of using CGI.pm's "Save" function. I built a pretty decent invoicing app using that and the searches for data in documents saved in that format are pretty fast.

I won't pretend to know the ins-and-outs of that but was told on a Perl mail list that the server created a "B-Tree" index when an initial search was made and used that afterwards.

</comment><comment><USER18> I do something similar with toml files for simple stuff. Python for piping around, but maybe this is more convenient on the commandline.

</comment><comment><USER19> Did this come out of Amazon ? I remember a similar set of tools for passing along "recs" through pipes.

</comment><comment><USER20> I guess these are quite slow (because no indexing) once you have a serious number of records? That in itself isn't a problem as long as you understand the scope of the project. I wonder why they didn't use (a well-defined subset of) CSV as the format however.

<comment><AUTHOR> CSV is neither human-readable nor -writable.

And I don't think the performance issue exists. Computers are fast nowadays. Parsing recfiles is straightforward. Also you could easily archive historic/old/probably irrelevant records.

<comment><USER20> This is why I was very careful to say "well-defined subset". I wrote a full CSV library[1], and so I'm well aware of how deceptively difficult CSV is to deal with. However with a well-defined subset (and perhaps not using "," as a separator as well) it should be editable for at least simple changes.

[1] [https://github.com/Chris00/ocaml-csv](https://github.com/Chris00/ocaml- csv)

</comment></comment></comment><comment><USER21> If you want something lighter to use text files as tables you could try TextQL: [https://github.com/dinedal/textql](https://github.com/dinedal/textql).

</comment><comment><USER22> Erm... am I the only one that's a little thrown off by the "mascot" in this project?

<comment><USER23> I'm not fond of the joke right there but alas.

ps: I hope they have org-mode interop.

<comment><USER24> It says so in the feature list so I guess they probably do.

<comment><USER23> dammit I failed at simple search, it's indeed listed</comment></comment></comment></comment>


Uber's IPO means higher fares for rides - <AUTHOR> https://www.latimes.com/business/hiltzik/la-fi-hiltzik-uber-fare-increase-20190531-story.html <comment><USER2> The last time I had this feeling was when shorting groupon. The emperor has no clothes, I can't see how UBER ends up being materially different from a donut.

<comment><USER3> The only thing I can see being successful for them is JUMP. It's an awesome service, there's no better way to get around San Francisco -- and Seattle! I assume it's as effective in other cities too. On the other hand scaling and acceptance seem pretty far off.

<comment><USER4> you're kidding, right? I gave up on using jump bikes for my own travel needs long time ago, better off just walking and getting some exercise instead of hunting down some random thing in some random direction. But I try to use the bikes (the actual ride is pretty good, if you manage to get one) to show my friends around SF when they visit. In my experience, it's almost impossible to get two (or more, god forbid) bikes without spending up to an hour dragging through the dirties parts of Tenderloin just to hunt down the thing. By the time we manage to line up two bikes, everyone is fed up and sick of shitty neighborhoods, too - easier to just uber and go where we actually need to go.

<comment><USER5> Your difficulty in finding available bikes might be because they're very popular and constantly in use, no?

<comment><USER6> It's also government artificially restricting supply to certain numbers. Asymptotic regulations are bad regulations. Variable regulations are better. For example, instead of saying that there can be N bikes allowed, they should instead determine metrics they want to achieve like utilization (rides per day) or complaints per number of bikes and let operators put as many bikes on the streets so long as the quality of life metrics they establish are satisfied.

</comment></comment></comment></comment></comment><comment><USER7> "Uber's success has been based on two unsustainable tactics: subsidizing fares and exploiting drivers"

Considering Uber loses a billion dollars a quarter, I think the only people that are being 'exploited' are investors. Investor money is going straight to drivers and riders.

<comment><USER8> Investors presumably know the risks involved. On the other hand, many drivers are inexperienced and do not know the full cost of driving for Uber (vehicle depreciation and increased liability).

<comment><USER9> > Investors presumably know the risks involved.

Except for working stiffs who are going to end up with Uber stock stuffed in their retirement accounts by unscrupulous portfolio managers.

<comment><USER10> That is absolutely a known risk of investing in anything other than very low- risk investments (and index funds I guess?).

</comment></comment></comment></comment><comment><USER11> I forgot where I read the article, but someone mentioned that the Softbank strategy seems to be to geared towards having 2 major players in ridesharing/delivery in each market. The idea was that when these companies go public, they will stop subsidizing rides as much in order to show profit, and will become viable businesses.

Because these companies have a new war chest of money, if any new upstarts come into the game, they can have a short-term price war to drive these players out. The US seems to be the first market where this strategy will play out.

<comment><USER12> is that sustainable though?

<comment><USER11> Honestly, I have no idea.

Lots of people have gotten very used to taking Uber/Lyft places. Once the prices go up, will that behavior change? The original iPhone sold at 500 to 1500 for the XSMax 512 GB. Obviously it isn't an apples to apples comparison, but I think the crux of the strategy depends on how inelastic ridesharing is.

</comment></comment></comment><comment><USER13> I've always used Uber because I've assumed that it's cheaper than Lyft and other rideshare services. I just realized I have no idea how much it is compared to others. Does anyone have a formal comparison up online?

<comment><USER14> In the ultimate 'fuck you' to customers, you will get cheaper rides on Uber under Android if you have the Lyft app installed...

<comment><USER15> Because on iOS they can't detect apps, as far as I know.

<comment><USER16> If Uber has access to file storage, can't it look for file names specific to Lyft?

<comment><USER15> Uber does not, iOS apps are sandboxed.

Further more, if you use `canOpenURL` trick to check for anything but trying to fallback when you're actually trying to open the url/app, they will flag you during the review.

</comment></comment></comment></comment></comment><comment><USER17> I mean higher fares happened a long time ago on both Uber and Lyft. I used to take regular UberX all around SF for <$10. Now I never see a regular Uber for less than $15 and regularly more than $20.

</comment><comment><USER5> I won't, since I can already use Bolt, Kapten or Cabify. The idea that Uber will somehow manage to keep people from building an app and competing is silly. There's almost no barrier of entry.

<comment><USER18> There is a barrier to entry: building a network of drivers.

If there is no drives, nobody will buy a ride over your app, drivers will then not install it because nobody is buying rides.

<comment><USER3> Every driver drives for every service in each city. There's no cost to them doing so. The only thing actually motivating them to stick to one service or another is Uber and Lyft have quota-based payouts promotions. Make your quota, get a bonus. Once they do, though, they're back at timesharing.

<comment><USER18> There is the cost of signing up to each service and entering bank details for payout. Additionally drivers aren't rational market players with perfect information. The quota alone could be enough emotional incentive for a driver to stick to only 2-3 apps.

<comment><USER3> True, though that hasn't been my experience in SF. I usually see most cars with both Lyft and Uber stickers, and I'm relaying what each driver I've spoken with has told me. Admittedly it's a small sample size.

</comment></comment></comment></comment></comment><comment><USER19> Uber's competition is quickly growing and people is realizing is just a matter of downloading an app and you get cheaper alternative, in Latin America a service called beat is giving cheaper car rides, a service called pickup is usin motorbikes instead of cars and is cheaper for both driver and users, all in all Uber doesn't have a leg to stand on and is becoming clear all it is is piramid scheme in a gigantic scale.

<comment><USER20> Less expensive does not mean those other competitors are making money. For example, Grab is burning through billions of investors cash, just like Uber [1].

Uber has motorbikes in other countries. It had a huge presence in Vietnam, until Grab took over their un-profitable business. It is just that it isn't popular in the US to take a ride from someone on a motorbike.

[1] [https://techcrunch.com/2019/03/05/grab-vision- fund/](https://techcrunch.com/2019/03/05/grab-vision-fund/)

<comment><USER21> Grab is already more expensive than conventional taxis in some places I've been recently.

<comment><USER20> ...or is it that taxis have lowered their pricing to compete?

<comment><USER21> Don't think so, for example in Bangkok the taxi rate is regulated and I believe it hasn't changed for ages.

</comment></comment></comment></comment></comment><comment><USER22> [http://archive.is/WfBip](http://archive.is/WfBip)

</comment><comment><USER23> Mmmm... unlikely. Here is where the growth helps. More drivers => more passengers => more productive use of car miles. The more time where a passenger is in the car the better, and when you factor in shared rides it gets better. Even if you factor in competition by "branding" as they say, the increase in growth is a benefit even if promotions are scaled back. If there is any place you will see increases in prices, it will probably be medium sized cities where Uber/Lyft have not achieved a great driver count and don't care to invest as much anymore.

Otherwise I would be surprised to see any major metropolitan areas ever be more expensive in the future than they are now.

<comment><USER24> That and any upstart will have a tough time getting enough Pool-type fares to keep everyone happy.

</comment></comment><comment><USER25> In the end you will have a service costing the same as a regular Taxi but without all the benefits of them being licensed. Taxi licensing may be screwed up and unfair in the US but in many parts of the world it works well.

<comment><USER26> I'm fine with Uber costing the same as a regular taxi. Riding in a taxi is a garbage experience compared to uber. Drivers making excuses not to take you after learning your destination, rude drivers, drivers who have no clue how to navigate, drivers who pretend the card machine is broken, or try to take you on winding routes to increase the fare.

Despite all the supposed downsides of ridesharing, it continues to be immensely more popular than the traditional taxi service even as the price gap closes. Because the traditional taxi service is a garbage rent seeking incumbent that needs to die for the good of all.

I catch cabs or ridesharing on a daily basis for work, and cabs are just fucking awful compared to ridesharing.

<comment><USER18> In my country, a taxi driver is legally required to drive you to your destination unless it exceeds reasonable distances (around 50km, which far above what anyone would use a taxi for here). Drivers with broken cashier machines or taxameters aren't allowed to take passengers, especially a broken taxameter might mean that passenger will pay a very much reduced fare. Most of them have GPS, and if they don't they can be liable for excess distance travelled.

Most taxi services here have excellent apps themselves and are cheaper than what Uber offered while they were allowed to operate (they are not just a glorified taxi service since non-taxi drivers aren't allowed on their service).

<comment><USER26> In my country, the driver is also legally required to drive you to your destination. It doesn't stop them from making random excuses like 'oh sorry my gps is broken'. That is an actual excuse I got from not one but two cab drivers in a row when travelling between offices in the city.

<comment><USER16> But such violations result in sanctions against the medallion holder via a transparent process.

For example (last time I was there, and I doubt that it has changed much), if you get in a cab at JFK, he _had_ to take you anywhere in Manhattan / Queens / Brooklyn / Bronx, regardless of time of day, likelihood of a return fare, disabilities, etc. Otherwise, the medallion faced sanctions.

A rideshare can simply decline.

</comment></comment></comment></comment></comment><comment><USER27> Hopefully the increase goes to the drivers...

<comment><USER28> ...the article is very, _very_ clear that it absolutely will not.

</comment></comment><comment><USER29> ...which will then push Uber customers to Lyft/Cabs. Uber doesn't have monopoly leverage.

<comment><USER30> As well as walk, bus, train, using own car and not drinking, etc.

<comment><USER15> Defs, I used to use Uber until it become cheaper to drive and pay for carpark, and mind you, parking in Australia is extortionist.</comment></comment></comment>


Russia blocks ProtonMail - <AUTHOR> https://techcrunch.com/2019/03/11/russia-blocks-protonmail/ <comment><USER2> This situation really pissed me off. FSB (Russian FBI) had problems with receiving bomb threats coming from Protonmail addresses. So, they secretly ordered (with an almost classified order) major ISPs to block Protonmail bypassing Russian's existing website/IP addresses blocking scheme.

Even worse, they ordered to __BLACKHOLE__ traffic coming to Protonmail. It means that ISPs were ordered to silently drop all traffic coming to Protonmail addresses. This raises problems not only for Russians, but for potentially for other countries as well. So, for example, someone connects from Japan to Protonmail (server is located in Europe, for instance). So, if traffic decides to go through Russian channels, for a client in Japan it will be just like Protonmail is not just responding because a Russian ISP in the chain silently drops traffic.

Again. I want to repeat this once again. FSB had problems receiving bomb threats to their addresses. Instead of configuring their mail servers to ignore Protonmail incoming mail, they ordered major ISPs in Russia to block Protonmail for EVERYONE in the country. That's so dumb.

Moreover, another recent leak coming from another Russian ISP indicates that FSB also ordered to block sending and receiving mail for certain mail addresses regardless of their domain. They ordered an ISP to block Email for certain addresses. Like, they ordered to ban all Email going from/coming to Emails starting with "putin666", like email@example.com, email@example.com, firstname.lastname@example.com, any email coming from an email staring with "putin666".

It's so dumb, oh god. They cannot configure their mail servers, but they have power to threat ISPs to ban Email for the entire country.

<comment><USER3> > _FSB (Russian FBI) had problems with receiving bomb threats coming from > Protonmail addresses_

Source?

<comment><USER2> The source is in the article, actually. This is the order from FSB that MTS operator received. They translated this as: "the mass distribution of obviously false reports of a terrorist act" in January, resulting in "mass evacuations of schools, administrative buildings and shopping centers."

Right before the IP addresses list, you can find terms "blackhole", "BGP".

The document has a signature of a head of the FSB center that handles this types of requests and orders. Also, you can see a stamp in the right bottom corner on the first page.

Full story, how a Russian internet company has actually found out about blackholing can be found here (in Russian): [https://habr.com/ru/company/tm/blog/443222/](https://habr.com/ru/company/tm/blog/443222/) In the story, you can find that MTS confirmed that they are blocking traffic and referenced the order in the original article.

<comment><USER3> If the CIA said "we got bomb threats from Tor so we need to block it," I wouldn't believe it. This source appears to have a similar level of corroboration. It looks far more likely that ProtonMail is being blocked to perpetuate the Russian elites' control of Russia's polity and economy. Not for security reasons.

<comment><USER4> The sad truth that it isn't. The most of the services they blocked were chosen for some insignificant reasons. This is what happens when you have a ruined system where every district judge can order to ban Youtube.

</comment></comment></comment></comment></comment><comment><USER5> In Russia there is an anonymous network of political Telegram channels which is read by both citizens and elite. The largest one, @russica2 acquire its information using protonmail. Looks like these measures are taken to restrict russian officials to send their information to these accounts.

<comment><USER6> They can still encrypt their emails in many other ways Just like people did before protonmail existed.

<comment><USER7> Or, since they can still access the web interface, they can still send to addresses/servers not in russia.

</comment></comment></comment><comment><USER6> I switched to protonmail after losing my gmail password.It was literally impossible to get my account back thanks to gmail "security features". The 500mb free plan is enough for personal usage. I hope other 3rd world countries don't block it following Russia.interestingly this happened not long after EU €2 million award.Probably someone read the news and googled protonmail, saw "encrypted email" in Wikipedia page and decided to block the whole thing.

<comment><USER8> Own domain. That's the most important part of email. If you have that, you can move to wherever you want.

<comment><USER9> It's also the weak point - do you trust your domain provider he won't allow a domain move / access based on parts of your personal information, like here [0]?

Also is it only domain block and not ip block?

[0] [https://medium.com/@N/how-i-lost-my-50-000-twitter- username-...](https://medium.com/@N/how-i-lost-my-50-000-twitter- username-24eb09e026dd)

<comment><USER10> You shouldn't use the almost-scammers of GoDaddy as an example. Whenever I hear any Domain horror story it's about GoDaddy, it seems like a bad idea to extrapolate from them.

</comment></comment></comment></comment><comment><USER11> IMHO, anyone who claims to care about privacy should seriously consider throwing down the ~$10 a month (I forget exactly how much it costs) to have a paid PM account. The company isn't perfect, but it's a far sight better than the majority of other providers out there. Furthermore, by paying for your account you are not only directly supporting a service that aspires to provide communications privacy, you're also helping to subsidize said service for those users who may not be able to afford a paid account (particularly important in countries where economic and governmental problems overlap).

I pay for my PM account and have had nothing but good experiences with the company and service so far (including with the VPN and with the mobile app before I ditched my iPhone). It took me years to migrate off of Gmail but since I finally managed to do it I've never looked back. Give it a shot.

<comment><USER12> 120/year is way too much for receiving spam. They are overcharging so much its not even funny.

</comment></comment><comment><USER13> In Russia now. Just successfully logged into my protonmail account over VPN. My guess is that if you're a protonmail user in Russia, you're knowledgeable enough to use a VPN.

<comment><USER14> We implemented some technical tweaks yesterday so that Russian users will no longer have any issues. Communications with Russian mail servers are also back up.

<comment><USER13> Super! I can confirm that I can use protonmail without VPN in the glorious Russian Federation.

</comment></comment></comment><comment> move-on-by Maybe this will reduce my spam rate. Also, this has increased my trust in ProtonMail.

</comment><comment><USER15> Protonmail is one of the last sane email providers. Gmail is essentially spyware and they can block your access to your account on a whim, especially if you refuse to have a phone number connected to it (phone numbers are commonly used to link your account across many different websites, that's why many of them force users to hand over their phone numbers under the guise of "security" or "2fa").

Protonmail has its problems but I hope they get over them as a company. Personally, so far I've received nothing but great customer support from them.

<comment><USER16> Protonmail has been a huge disappointment personally. It took days of trying to get my email in over the IMAP bridge, and now it still has weird spazzes where it will suddenly decide to redownload all my 30k emails, effectively making all inbound mail wait for over a day while my laptop fans fire at full speed.

On top of that, the mobile app is atrocious. It crashes at a drop of a hat, doesn't autosave drafts, and doesn't even do threading. It also makes terrible use of space, and has a permanent upsell ad in the sidebar, pushing my folders offscreen. Someone actually approved this design...

I guess for those weirdos who can live with a webmail client it's servicable, but it's an embarrassment that they've been at it this long, and this is the state of their offering.

<comment><USER17> >Protonmail has been a huge disappointment personally. It took days of trying to get my email in over the IMAP bridge, and now it still has weird spazzes where it will suddenly decide to redownload all my 30k emails

I've never had this problem, but since you mention the IMAP bridge it's worth noting that a) the linux version of the bridge is still an on-request beta rather than a freely available download despite working flawlessly for me for the last year and a half and b) you can only use the IMAP bridge with subscribed accounts. So if you're using a free account you can't use it at all, but if you have a mix of paid and free accounts only the paid accounts can use the bridge.

I find the bridge pretty nice in and of itself, but the way it's managed and monetized is a bit of a trainwreck.

</comment></comment></comment><comment><USER18> Probably a good time to start using ProtonVPN.

</comment><comment><USER19> Does ProtonMail work in China?

<comment><USER20> Yes. I recently went to China, and I set up forwarding from Gmail to ProtonMail beforehand.

</comment></comment><comment><USER21> For russians: [https://protonirockerxow.onion/login](https://protonirockerxow.onion/login)

</comment><comment><USER22> ProtonMail is a service I fully support, but these sorts of actions only underscore the importance of decentralized alternatives to email.

<comment><USER23> Email is decentralized.

The only centralized part is the DNS.

</comment></comment><comment><USER24> ehh... it's been known for awhile that protonmail is in the pockets of the US government so it's not really a loss for the russian people.

What they should be using is either Streisand[0] email with a server in a country that respects their privacy(neitherlands, panama, etc) or lavabit email[1].

[0]: [https://github.com/StreisandEffect/streisand](https://github.com/StreisandEffect/streisand) [1]: [https://lavabit.com/](https://lavabit.com/)

EDIT --

Sorry streisand doesn't in fact have an e-mail server. I thought it did at one point. I guess you can use mail-in-a-box([https://github.com/mail-in-a- box/mailinabox](https://github.com/mail-in-a-box/mailinabox)).

<comment><USER3> > _it 's been known for awhile that protonmail is in the pockets of the US > government_

Source? I thought ProtonMail were Swiss and E2E encrypted.

<comment><USER25> They have an SF office

<comment><USER3> > _they have an SF office_

I didn't know they had "support centers in San Francisco, CA, and Skopje, Macedonia" [1]. Thank you.

Still a far cry from proof of being "in the pockets of the US government" [2]. Signal, too, has American nexuses. That doesn't automatically render it compromised.

[1] [https://protonmail.com/about](https://protonmail.com/about)

[2] [https://news.ycombinator.com/item?id=19368140](https://news.ycombinator.com/item?id=19368140)</comment></comment></comment></comment>


Time To Get Out Of The Bubble And Design For The Average User (Part 2) - <AUTHOR> http://futurephilanthropreneur.wordpress.com/2010/03/05/time-to-get-out-of-the-bubble-and-design-for-the-average-user-part-2/

<comment><USER2> Great article! I agree with the idea that we need to make products easier to use for the mainstream market.</comment>


Authenticated Arbitrary Command Execution on PostgreSQL 9.3-11.2 - <AUTHOR> https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5 <comment><USER2> The "copy from program" feature allows executing a program by design, and is pretty self documenting at that.

There are various other ways you can access the system outside PG once you're a superuser which is why most hosted PG providers (like us) don't allow superuser access.</comment>


Update: An agreement with Monica Cellio (which she rejects) - the-dude https://meta.stackexchange.com/questions/340906/update-an-agreement-with-monica-cellio?cb=1 <comment><AUTHOR> That's not the title of the article ... the OP has editorialised in parens.</comment>


New LEDs are dramatically brighter and can create laser light - <AUTHOR> https://phys.org/news/2020-08-bright-tiny-scientists-nanoscale.html <comment><AUTHOR> >High-brightness lasing at submicrometer enabled by droop-free fin light- emitting diodes (LEDs)

[https://advances.sciencemag.org/content/6/33/eaba4346](https://advances.sciencemag.org/content/6/33/eaba4346)</comment>


Black friday Sci-Fi stories - alexey-neonov https://payhip.com/b/tirm <comment> alexey-neonov Like it or not - Singularity is fast approaching. So I wrote 7 Sci-Fi to celebrate this fact. How soon will it happen? Will Russians be involved? You can learn it yourself, just download e-book for free or pay whatever :) P.S. Any feedback is much appreciated</comment>


Programmer's dilemma - <AUTHOR> https://medium.com/geek-empire-1/231d7499a75 <comment><USER2> This is a prejudice held by the author, not a problem with programmers.

What is it with embedded programmers and their inability to understand you can't ask incredibly specific questions. I totally admit I'm not from the domain, but a brief google on the terms he uses show it's not a common problem to solve in programming.

Just because a programmer can't do 'insert favourite programming code' here doesn't mean they can't program. In fact with most of them, show them some other code that does it they'll be perfectly able to grasp it, use the example and write a similar program.

This seems to be especially prevalent with embedded systems programmers, etc. where articles like this with programmers complaining about the same 'other programmers don't seem to know about this niche thing that even I only use once in a blue moon' pop up constantly on HN.

The worst part of that article is the 'I gave him the API'.

Nooooooo. Programmers need examples, even as a 'oh, here's where I start' type of hint. That's one of the many glorious reasons I love SO, I can find an example of almost anything quickly just to see how it's supposed to be used.

Are you telling me you don't have 100s of examples littered throughout your existing code that can give others hints. Or that you've not already wrapped this functionality up in your own libraries? They're going to be coding everything from scratch?

That's why you ask programmers to do fairly simple stuff in interviews, because you can't guarantee what they've been using for the last 5 years. Perhaps all the stuff you do daily is wrapped in a standard company library. You are seeing if they can program, not if they can program an extremely specific thing.

If you need a genuine expert in X programming domain, don't advertise for an X programmer, advertise for an expert in X and expect to pay dearly for it.

Without knowing anything about the domain you're talking about, but from the way you're talking about it, what it sounds like you're doing is hoping to find the diamond in the rough of someone who's becoming an expert and doesn't realise it yet so you can pay peanuts for a genuinely talented developer.

Ultimately it's not an expert trap, it's simply 'my job was doing this' over and over. And doing it effectively.

</comment><comment> guard-of-terra What happens in kernel when you do malloc? Generally nothing, but the occassional brk(2) and page fault.

I tend to work on one project for several years and for some reason I'm not losing it.

</comment><comment><USER3> Previous discussion with 104 comments:

[https://news.ycombinator.com/item?id=6221117](https://news.ycombinator.com/item?id=6221117)</comment>


SnapPass – SnapChat for Passwords - <AUTHOR> https://github.com/pinterest/snappass

<comment><USER2> The repo would benefit from a few screenshots in the readme to illustrate the concept.

Cool idea!</comment>


SF mayor kicking out homeless people for Super Bowl "Fun Zone" - bro-stick https://www.vice.com/read/the-mayor-of-san-francisco-says-the-citys-homeless-have-to-leave-the-streets-for-superbowl-50-vgtrn-719

<comment><AUTHOR> I think we should pass a law that homeless people are not people. Sadly, I think many people would approve of such a law.

If you are not a land/property-owner, you have no rights!

</comment><comment> bro-stick Because it's more important that hedge fund managers and their friends not have an opportunity to get away with beating a homeless guy to death, since no one will care enough to press charges. Weakness invites aggression, so it's their own fault for being old, malnourished, etc.

Can't see anything overly brutal, vindictive or costly about that "plan" to condone and promote systematic economic discrimination.</comment>


Technologies of the Decentralized Web Summit - <AUTHOR> https://blog.mousereeve.com/technologies-of-the-decentralized-web-summit/ <comment><USER2> Watching the recorded feed from this summit is kind of nuts. You have Vint Cerf (co-inventor of TCP/IP) providing Q&A about a distributed digital archive of the internet and the first guy to ask a question is Carl Hewitt (developer of the Actor Model) and then the guy looking over his shoulder at Carl is Tim Berners-Lee (some web dude).

<comment><USER3> yes but apps? Apps are just a relict of the mobile 1.0 area, which should be dissolved by web 3.0. yes the monopolgies build their devices and used them to create more monopolies. It should be eventually by models of hardware/software symbioses which gets more benefits from collaborating (blockchain backends). Its very good to see a lot of blockchain related projects at the conference, the path to web 3.0 is open!

</comment></comment><comment><USER4> Out of these, I thought Zeronet had the best demo. Dat and IPFS are both very promising. I also thought Matrix and Interledger show a lot of potential.

</comment><comment><USER5> So wish we could have made it to this. In any case ZeroTier was conceived with Internet decentralization motives in mind specifically with the goal of making edge device connectivity easy. It can be and is used for other things but that was the original motive.

[https://www.zerotier.com/](https://www.zerotier.com/)

/no relation to ZeroNet, didn't know about that when I named it.

<comment><USER6> Nice work you people are doing. I have no opinion on features and stuff ATM except to say that VPN's plus high usability and open source is a category I like seeing expand. Far as this list, I think what keeps you off is this:

"ZeroTier endpoint nodes form a peer to peer network and use a set of pre- configured nodes called root servers (currently run by us, federation is planned) as stable anchor points for near-instantaneous zero-configuration peer location and connection setup."

Still centralized. Solve that then you might get on the list.

<comment><USER5> We wanted to build something useful in mainstream, casual, and commercial applications, not just for geeks. For that reason we took on the following non-negotiable design requirements:

\- An endpoint can join the network in <~10s. No bootstrapping time.

\- Any endpoint can reach any other endpoint in the world in <~10s (or less).

\- No configuration at all is required. It "just works." Any knob that must be tweaked or config that must be entered is a bug.

\- The endpoint must be small enough to fit in an embedded device like a thermostat, light bulb, etc. (Or at least be able to be made that small without inordinate levels of pain.)

\- Performance overhead must be on par with e.g. OpenVPN, GRE/IPSec, etc.

\- Must be mobile-friendly. (phones, tablets, etc.)

\- Must not conscript user devices into infrastructure roles without explicit opt-in.

\- Very strong resistance to sybil and DDOS attacks, at least comparable to current Internet BGP community.

\- It must be able to scale to Internet size (tens of billions of devices) without disproportionate levels of pain or discontinuities where the system suddenly "melts down."

\- The design must be simple enough to fully describe in a relatively concise RFC.

\- The design should be no more centralized than other common Internet systems like DNS and BGP.

The current design satisfies all those goals. It's zero-config, runs on phones with minimal battery life impact, could be scaled down to embedded code and memory footprints without too terribly much effort, and is no more centralized than DNS or BGP.

I'm not sure if I see the intrinsic advantage of trying to be less centralized than the Internet while still using the Internet for transport. A true decentralized new-Internet would have to use radio and user-provisioned DIY links. Centralization(X) = max(Centralization(all parts of(X)))

Pretty much everything popular right now in the decentralized Internet community is conclusively "out" for mobile and embedded use outside of niche applications where the user doesn't mind their phone becoming a hand-warmer and their battery life dropping to 45 minutes. In particular we almost certainly rule out:

\- DHTs -- too much RAM, too slow, have a warmup/bootstrap time, hard to harden against sybil attacks, and solutions to these problems involve root- server-like centralization anyway so we're back where we started.

\- Block chain -- _way_ too compute and storage intensive by many orders of magnitude.

\- Rumor mill and other noisy protocols -- _way_ too bandwidth intensive for mobile and small devices, don't scale.

\- Aggressive data replication and "raft consensus" type stuff -- too much storage and network overhead for mobile and embedded devices.

Right now our thinking revolves around making it possible to locally federate the root servers for on-site or in-personal-cloud use. But this has to be thought out very carefully so as not to negatively impact security or any of the other constraints above. We can't have people setting up sybil roots that can be used to DOS the network.

Our other thought is to create a separate community-driven institution to hold the root infrastructure. This is fraught with non-technical political difficulties of making sure this institution is well governed and sustainable.

See also:

[https://www.zerotier.com/misc/2011__A_Little_Centralization_...](https://www.zerotier.com/misc/2011__A_Little_Centralization__Tsitsiklis_Xu.pdf)

[https://en.wikipedia.org/wiki/CAP_theorem](https://en.wikipedia.org/wiki/CAP_theorem)

[http://adamierymenko.com/decentralization-i-want-to- believe/](http://adamierymenko.com/decentralization-i-want-to-believe/)

[https://whispersystems.org/blog/the-ecosystem-is- moving/](https://whispersystems.org/blog/the-ecosystem-is-moving/)

The latter post makes excellent points and gives us significant pause about federation and delegation. We have to be able to keep improving things and to respond to threats (e.g. DDOS) rapidly.

\-- Edit: meta:

I tend to disagree philosophically with the lack of pragmatism in the Internet decentralization community. It reminds me of OSI, which had some theoretically-superior ideas about networking but which never actually shipped anything that worked at scale. As a result we have IP, which works well but lacks some of the theoretical benefits of more throughly designed systems. Things that work always win over things that don't work. See also: semantic web vs. web+search, Project Xanadu vs. www.

Right now the dominant paradigm online is _highly_ centralized cloud silo networks where all traffic is MITMed by design. I think making it trivially easy to network endpoints with an end-to-end encrypted network that "just works" is a huge improvement and could enable a lot of other things.

Also note that ZT carries standard protocols over standard virtualized networks: IPv4, IPv6, etc. This means that it doesn't impose lock-in on systems built with it. It's just neutral transport.

<comment><USER6> re decentralized in general

You don't have to convince me. I'm "that guy" (probably)...

[https://news.ycombinator.com/item?id=10845128](https://news.ycombinator.com/item?id=10845128)

...who always points out that banking, auditing, database, and eCommerce fields already achieved many of Bitcoin's goals with more efficiency and simple algorithms. I particularly love your comment about how centralized version of Bitcoin could run on a RPI. Haha. Similar to my statements here:

[https://news.ycombinator.com/item?id=11184214](https://news.ycombinator.com/item?id=11184214)

Note: The tangent with "contingencies" has me describing how it boils down to politics, laws, and human cooperation in blockchain model anyway. So, why not apply that to more efficient model.

re ZeroTier design

Nice constraints. I'm going to copy your comment and excellent article for now to fully read and think on technical specifics at another time when I have more time. For now, I think you might be overstating the problem with decentralization but spot on about the crowds it attracts. ;) One thing that high-assurance taught me is we can't do everything perfectly. Our trick was to reduce our security, integrity, whatever problem down to some small component (eg TCB or kernel) everything else leveraged. It looks as if you reinvented the concept to a degree by minimizing centralization as its the "trusted" part. It might help, though, to tell (or remind) you of another thing high- assurance cemented in: often easier to do _untrusted_ computation followed by _trusted_ verifier which is simpler than computation.

Let's apply this principle to the trusted part of a scheme minimizing centralization. Instead of all in central or decentral, we can use my concept to do a central model that produces traces of what went in and came out. This is applied to as little of the scheme as possible. Maybe just registration, authentication, IP hopping, whatever. The supernodes are run by different non- profits, people, countries, and so on according to the same rules with their own financial support (or they drop out). Each receives updates on what others or a subset of others are doing in form of in/out states. Each performs fast, simple verification of that which, for some things, is basically just storing it into an in-memory database with disk persistence in case someone asks for it. Mismatches are corrected in standard ways, automated or by people. Like with banks, each organization is responsible for its users with mutually- suspicious auditing increasing their honesty. Users get a sane default on number of and which supernodes to contact with what thresholds and such. For remailer designs, I always made sure to force cooperation in two jurisdictions hostile to each other at a minimum.

Interestingly enough, the job that Google's F1 RDBMS is doing is much harder than what I just described. It's running Adwords with a strong-consistency model. CochroachDB is trying to clone it. Rather than using them, I'm just saying strong-consistency DB model with checking over computation might be get benefits of centralized and decentralized. Last benefit is replicating and checking essentially centralized programs gives us ability to use decades of work in reliability and security engineering on the implementations. Purely P2P and decentralized models are too new for high-security despite what their proponents wish. So many problems and solutions waiting to be discovered. "Tried and true beats novel or new" is my mantra for high-confidence systems.

Note: Might try out ZeroTier as well given you seemed to have open-sourced most critical part.

<comment><USER5> Everything in ZeroTier is open source except the web UI for my.zerotier.com and currently the Android and iOS GUIs. (The latter might change soon since we made the apps free.)

ZeroTier's root servers run _exactly the same code_ as ordinary nodes. They're just "blessed" in something called a "world" (see world/ and node/World.hpp) and run at stable IPs with a lot of bandwidth. There are currently 12 of them divided into two six-node clusters:

[https://www.zerotier.com/blog/?p=577](https://www.zerotier.com/blog/?p=577)

The role of the root servers is pretty minimal. They relay packets and provide P2P RENDEZVOUS services for NAT traversal. All of this is built into the ZT protocol (see node/Packet.hpp). Technically any peer can do what the roots do but the roots exist to provide zero-conf/no-bootstrap operation and a secure always-on "center" to the network.

It would in theory be possible to create some kind of consensus system whereby the world could be defined by the community, but we'd want this to be extremely sybil-resistant otherwise someone could take down the whole net by electing a bunch of sham nodes.

ZeroTier is being used for Bitcoin stuff, payment networks, etc., and we _do_ get attacked. We've had several DDOS attempts and other attempts to attack the system. So far nothing's succeeded in impacting it much.

<comment><USER6> "ZeroTier's root servers run exactly the same code as ordinary nodes. They're just "blessed" in something called a "world" (see world/ and node/World.hpp) and run at stable IPs with a lot of bandwidth. There are currently 12 of them divided into two six-node clusters:"

Looks good. I've seen similar things work in five 9 types of setups. Potential there. Some components and clustering might be simple enough for medium-to- high assurance. That nodes benefit from peer review of open code is good. That they're the same is a claim we can't check without trusted hardware plus attestation. You also can't verify that yourself unless you have endpoint and SCM security that can survive penetration and/or subversion by high-strength attackers. That problem applies to most products, though.

I overall like it at the high level I'm reviewing at. Only drawback I see is that it appears to have been written in C++. Is that correct? If so, people can't apply state-of-the-art tools to either prove absence of bugs in code (eg Astree, SPARK), verify its properties (eg Liquid Types, AutoCorres), or automatically transform it to be safer (eg Softbound+CETS, SAFEcode, Code Pointer Integrity). What few tools are available for C++ are expensive and more limited. A rewrite needs to happen at some time to deal with that. Perhaps Rust as it solves dynamic allocation and concurrency problems that even Ada ignores plus was partly validated by Dropbox's deployment in low- level, critical components.

"but we'd want this to be extremely sybil-resistant otherwise someone could take down the whole net by electing a bunch of sham nodes."

I could only speculate on that stuff. It's not my strong area and still a new- ish field. What I do know is that many systems work by (a) having simple, clear rules; (b) maintaining audit logs of at least what happens between mistrusting entities; (c) auditing that; (d) forcing financial or other corrections based on detected problems. Rules and organizations are the tricky part. From that point, it's just your code running on their servers or datacenter of their choosing.

One scheme I thought about was getting IT companies, Universities, or nonprofits involved that have long history of acting aboveboard on these things. Make sure their own security depends on it. Then, you have at least one per country in a series of countries where government can't or is unlikely to take it down. Start with privacy, tax, and data havens plus First World countries with best, cheapest backbone access. Knocks out most of the really subversive stuff right off the bat. What remains is a small amount of subversion potential plus the bigger problem of politics on protocol or rule decisions.

"and we do get attacked. We've had several DDOS attempts and other attempts to attack the system. So far nothing's succeeded in impacting it much."

Glad to see you're making it on that. Surviving those is another benefit of centralized models. Carries over to centralized with distributed checking as well if you use link encryptors and/or dedicated lines to at least key supernodes. That's for the consensus and administrative parts, I mean.

<comment><USER7> Do you have links for the tools you mention? Some of them are hard to do web searches for.

<comment><USER6> The ones I referenced are here:

[https://www.cis.upenn.edu/acg/softbound/](https://www.cis.upenn.edu/acg/softbound/)

[http://sva.cs.illinois.edu/downloads.html](http://sva.cs.illinois.edu/downloads.html)

[http://dslab.epfl.ch/proj/cpi/](http://dslab.epfl.ch/proj/cpi/)

[https://en.wikipedia.org/wiki/SPARK_(programming_language)](https://en.wikipedia.org/wiki/SPARK_\(programming_language\))

[http://goto.ucsd.edu/csolve/](http://goto.ucsd.edu/csolve/)

[http://saturn.stanford.edu/pages/overviewindex.html](http://saturn.stanford.edu/pages/overviewindex.html)

Replaced Astree with Saturn as most won't be able to afford Astree. Do test Softbound, SAFEcode, and CPI on various libraries and vulnerabilities to find what works or doesn't. Academics need feedback on that stuff and help improving those tools. There's a serious performance hit for full, memory safety like Softbound+CETS but knocking out that many vulnerabilities might easily be worth some extra servers. Have fun. :)

<comment><USER7> Thanks for that. Looks like only SPARK is available in the operating system that I use. That is one big problem with research software and software research, it is often disconnected from the programmer community.

BTW, what do you think of this tool?

[https://github.com/TrustInSoft/tis- interpreter](https://github.com/TrustInSoft/tis-interpreter)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Nearly all of these relate to blockchain tech. Which is interesting. I do ask: why _blockchain_? Are modern blockchains still cycling away on silicon to find hashes? Seems a terrifically ineffecient way to build a system. I can understand the distributed hash table / transaction tree idea, but I struggle to grasp the rationale for proof of work systems.

<comment><USER9> Proof of work is the only known way to achieve consensus among entities that don't trust _anyone_. It also provides a way to "fairly" distribute new currency among entities who don't trust anyone. It's not clear to me that the decentralized Web needs consensus, its own currency, or total lack of trust.

<comment><USER10> Which is why I like layered approaches like IPFS that separate the merkle-tree layer (hashed content) from the naming layer (IPNS, DNS, Namecoin, etc.).

There are definitely valid uses of blockchain tech but requiring it as central part of the architecture is a recipe for (re)centralization because eventually it will always grow beyond home-computer scale.

</comment></comment></comment><comment><USER11> I love the idea of a decentralized internet. I mean we already have cryptocurrencies that are decentralized, why not have that as well?

</comment><comment><USER12> While i love the idea of a Decentralised Internet, i would say that it does not solve the problems that well.

An awful lot of these techs are completely block-chain and consensus dependant. Which makes sense (you are in a byzantine environment after all) but is far from being a solved, ready to be used idea. Really far. And that is awfully unefficeint in term of power.

Additionally, except the wifi router project, none of them really solve anything. It just push the boundaries a bit.

I still like the fact we have people working on it, and i will keep working toward it, but we are so so far from solutions.

Still super nice to see some of the things here. Thanks for the hard work :)

<comment><USER13> Indeed it has been said that decentralization is the worst form of networking except all those other forms that have been tried from time to time.

(With apologies to Winston Churchill.)

</comment></comment><comment><USER14> Looks great! I believe that Matrix is actually not blockchain-related

<comment><USER15> Same as IPFS, which should probably be in the "Decentralized Web" category.

<comment><USER16> Technically it uses hash chains which blockchains are based on, so it is tangentially related. But IPFS is basically just Git (also using hash chains) with networking addons, no concensus algorithm (none needed).

</comment></comment></comment><comment><USER17> > IPFS, or InterPlanetary File System, is a distributed file storage system > that aims to replace HTTP. Both the Internet Archive and Neocities serve web > content with IPFS.

Can someone explain to someone less smart (i.e. me) why IPFS and HTTP are mutually exclusive, as the above description seems to suggest?

<comment><USER18> They're completely different protocols. But the IPFS daemon can serve as a IPFS-to-HTTP gateway to make IPFS content available to web browsers.

<comment><USER17> No sure, I understand they are different protocols, but unless IPFS turns into a protocol capable of describing application semantics (which is what HTTP is) then I don't see how it can possibly replace HTTP – file transfer is not its main purpose after all. What I'm saying, I guess, is that I don't understand why HTTP and IPFS can't coexist quite peacefully? I.e. IPFS being a lower level transport protocol upon which HTTP provides application semantics. Or is that the aim? I don't fully understand.

<comment><USER19> They coexist already. IPFS just gives you a standardized way to store files in a global p2p content-addressable filesystem (or private content-addressable filesystems, if you don't connect your IPFS server to the global network). Imagine if you tried to visit news.ycombinator.com via HTTPS while visiting Mars; the timeouts would have to be quite large.

If instead the static assets, like html, javascript, comments, and stories are stored in IPFS, then you can load them from your local IPFS server node instead. You would probably even access that node via HTTP(S), and in principle the URL in your urlbar would be exactly the same as it is now. The rendering would all have to be done in JS though, which is a bit of a change. You would configure your local IPFS node to periodically update it's local cache so that the site is as up to date as you desire. (There's some handwaving there, but I guess you could just use a cronjob to request the content, forcing it to be cached.)

In practice, posting a story or a comment might have to look a rather different in that implementation. It would probably look like a throwback to UUCP or FidoNet, where distant nodes would contact each other regularly to upload messages. You would use PKI to discard messages from non-users, and linking the good ones into your branch of the filesystem so that viewers could see them.

Things like this that require logins are where most of the handwaving is with IPFS; the actual filesystem parts seem to work pretty well.

</comment></comment></comment></comment><comment><USER20> Althea Mesh sounds like a great idea.

<comment><USER14> I'd love to get your input on the in progress whitepaper!</comment></comment>


Literary Beatdowns: Or, Excerpts from Smollett's 'Critical Review' - <AUTHOR> http://www.themillions.com/2016/07/literary-beatdowns-or.html <comment><USER2> I rather wish there were more examples of reviews of works that are more familiar to modern readers; other than William Wordsworth's "The Excursion", which I haven't read, all of the works mentioned are completely unknown to me.

I'll take Samuel Clemens on James Fennimore Cooper anyday. ([http://www.gutenberg.org/files/3172/3172-h/3172-h.htm](http://www.gutenberg.org/files/3172/3172-h/3172-h.htm))

</comment><comment><USER3> If accurate, the description of British moral culture at this time sounds abhorrent. I wonder when and how it evolved to be more compassionate toward the less fortunate.

<comment><USER4> I'm not sure it did.

Major staples of British television nowadays appear to be eviction drama and lionizing debt collectors. My wife calls the genre "poverty porn" \-- and I don't think people are watching these shows to learn more about the dire straits of their fellow citizens.</comment></comment>


How Adversarial Attacks Work - <AUTHOR> http://blog.ycombinator.com/how-adversarial-attacks-work/ <comment><USER2> This weakness is one that I think will plague self driving cars as sign recognition will be key and without some ability to insure that they cannot be dangerously fooled, it will be hard to get them certified. The canonical example is to make a no left turn sign recognize as a no right turn sign and have the car go the wrong way on a one way street.

Clearly there is a marketing opportunity for t-shirts that make you recognize as other things. Who doesn't want to show up in an image search for toasters on Google Images ? :-)

But my current best guess on how this issue will be addressed will be with classifier diversity an voting systems. While that just moves the problem into a harder and harder to synthesize data set (something that not only is adversarial to one classifier but gives the same answer on several), I believe it will get us to the point where we can trust the level of work to defeat them is sufficiently hard to make it a non-threat.

<comment><USER3> Or, simply with better machine learning.

> The border between "truth" and "false" is almost linear. The first cool > thing we can derive from it is that when you follow the gradient, once you > find the area where the predicted class changes, you can be fairly confident > that the attack is successful. On the other hand, it tells us that _the > structure the decision function is far simpler that most researchers thought > it to be_.

Humans can be fooled by optical illusions as well; but those illusions are much more limited and much more noticeable than most of these. My (very non- specialist) interpretation of the italicize clause is that a) vulnerability to these attacks is a continuum, not a binary, and b) the current ease of these attacks reflects the crudity of our current ML techniques.

<comment><USER4> Habe you seen the Monroe-Einstein illusion? There is a continuous transition from one image to the other, depending on the angular size. This feels relevant to your point.

[https://static.independent.co.uk/s3fs- public/styles/article_...](https://static.independent.co.uk/s3fs- public/styles/article_small/public/thumbnails/image/2015/04/03/14/einstein.jpg)

<comment><USER5> I wouldn't call that an illusion, but more a consequence of a high-pass/low- pass filter at different distances with limited resolution.

What I find much more disturbing is that even though I measured and _known_ those lines are parallel or that those shades of gray are the same, I can't "unsee" the illusion.

</comment></comment></comment></comment><comment><USER6> Can such methods be used to "fingerprint" proprietary datasets by tainting them ? For example, i want to make sure that my dataset is not stolen and used by someone else (Waymo?). So I taint it using an adversarial method and create a "canary test set" that will uniquely identify if my dataset has been used in some training.

<comment><USER7> I believe google maps has fake streets as a canary for their maps being scraped...

<comment><USER8> yup, in cartography these are known as trap streets

</comment></comment></comment><comment><USER9> Is there any reason to think this would work at all in the real world? All of these "attacks" require complete control of the image being fed to the classifier.

In the ATM example you don't directly load an image of the check to the computer inside the machine. You design a check in photoshop, add the noise, print it out, feed it to the machine, which takes a picture of the check. Mobile bank apps still require you to take a picture of the check so you don't have enough control there either.

Similarly in the road sign example; the lighting, angle between car and sign, dirt on the sign, etc all mean the car sees a much different image than you designed.

I'd think all of these steps mean the classifier gets a dramatically different image than you intend and the attack fails. There's maybe a vanishingly small probability it works when the stars align, but that could be easily mitigated by taking multiple consecutive images and looking for an odd results.

<comment><USER10> Goodfellow et al. demonstrate that adversarial misclassification works in the physical world: [https://arxiv.org/abs/1607.02533](https://arxiv.org/abs/1607.02533) \-- a printed image is consistently misclassified (demo here: [https://www.youtube.com/watch?v=zQ_uMenoBCk](https://www.youtube.com/watch?v=zQ_uMenoBCk))

Recent work by me and some friends demonstrates that physical-world adversarial examples can actually be made quite robust, and you can synthesize 3D adversarial objects as well, and make them consistently classify as a desired target class: [http://www.labsix.org/physical-objects-that-fool- neural-nets...](http://www.labsix.org/physical-objects-that-fool-neural-nets/)

<comment><USER9> Thanks for the links and great work! I hadn't seen any research on it making the jump to the real world yet.

</comment></comment></comment><comment><USER11> It seems like all adversarial examples I've seen so far are enabled by networks overfitting to small-scale features. By overfitting I mean that they give more importance to details compared to humans, who recognize much more the image as a whole.

Maybe the problem could be mitigated by penalizing "direct" responses to small-scale features while training, which is not a trivial thing to do though. One approach I could think of is training with multiple altered versions of the image, e.g. various amounts of blur, noise and mean/median filters applied. Or the other way around: To be more confident about a result, scale down the image to a fraction of it's size, run detection on that and compare results.

Are such techniques in use, or being researched on? I'm not too much in the loop about those topics.

<comment><USER12> "training with multiple altered versions of the image, e.g. various amounts of blur, noise and mean/median filters applied"

"Are such techniques in use"

Yes, it's called 'data augmentation': [https://medium.com/towards-data- science/deep-learning-3-more...](https://medium.com/towards-data-science/deep- learning-3-more-on-cnns-handling-overfitting-2bd5d99abe5d)

</comment></comment><comment><USER13> "Recent studies by Google Brain have shown that any machine learning classifier can be tricked to give incorrect predictions"

\-- That has to be an overly broad statement (edit: it might true if you say "neural nets" or something specific instead). I would assume they mean any standard deep learning system and maybe any system that is more or less "generalized regression" but that couldn't be "any machine learning system", I mean one could imagine a deterministic model that couldn't be "tricked".

Plus a link would be good (it's not around the quote, I don't know if it's elsewhere in the article).

<comment><USER14> >I mean one could imagine a deterministic model that couldn't be "tricked".

The models in reference are deterministic, most models for classification/regression are deterministic.

Adversarial attacks are showing that the models are chaotic (in the dynamical systems sense), they're very sensitive to their inputs.

edit: Not all models have this issue, it's been shown that all the typical image based convolutional neural networks are susceptible to this issue. My guess is that it's a more general problem of high dimensional inputs.

<comment><USER15> We've known for decades that NNs are prone to overfit. This is just another example of it. With great variance comes great ... uh ... susceptibility to unusual future inputs?

</comment></comment></comment><comment><USER16> Well, this is getting more attention because it's important for the "ad network moderation". If Google/FB fail at moderation using these methods, they'll have to HIRE lots of humans to do it for them, which often involves contracting it to outsources like Accenture. This will put downward pressure on their billion dollar revenue. Humans are expensive but vastly effective at ad moderation.

</comment><comment><USER17> Very recently, it was found that changing a single, carefully placed, pixel is enough to confuse NN classifiers. [https://arxiv.org/abs/1710.08864](https://arxiv.org/abs/1710.08864)

<comment><USER18> For 32 by 32 images

<comment><USER19> 1/(32*32) = 0.1%

</comment></comment></comment><comment><USER20> Obscurity seems like useful security here. IIUC it shouldn't be possible to e.g. trick self-driving cars with noisy signs, unless you have a copy of the classifier to train against. Thinking about ATMs, you could train against it as a black box, repeatedly inserting different patterns of noise? But it seems probably infeasible if you need to do a lot of iterations.

It also suggests that people concerned about adversarial attacks shouldn't use off-the-shelf pretrained classifiers, where attacks can be trained offline in advance. Similar to hashing algorithms and rainbow tables, maybe a practice of "salting" an off-the-shelf classifier could be effective in dodging attacks.

<comment><USER21> True. Also, just having unconnected systems that use different types of features / heuristics should be enough to at least pull the car over when they wildly disagree over what to do.

</comment></comment><comment><USER22> > Apart from the fact that nobody wants to risk having false positives, > there's a simple argument as old as machine learning itself: whatever a > human can do, a machine can be taught to do. Humans have no problem > correctly interpreting adversarial examples, so there must be a way to do it > automatically.

So by all means, the authors (and a vast majority of researchers) seem to be confident that ML/DL is the road to AGI, hence can "solve" human intelligence (given it is computational)? For how long are we gonna drag the adage that mimicking a human (Turing test) is equal to reaching human levels of intelligence?

<comment><USER23> It is not true that whatever a human can do, a machine can be taught to do. The human must have insight into HOW they do it in order to teach it, or otherwise come up with some new algorithm. There are a large class of things humans do that they don't understand the mechanics behind, and for which there also aren't algorithms.

I'm not talking empathy or philosophy. How about just folding laundry. Not just one type, not in a controlled environment, but folding any laundry anywhere.

<comment><USER24> > It is not true that whatever a human can do, a machine can be taught to do. > The human must have insight into HOW they do it in order to teach it, or > otherwise come up with some new algorithm.

Why does this mean a machine _cannot_ be taught to do it?

> There are a large class of things humans do that they don't understand the > mechanics behind,

Sure.

> and for which there also aren't algorithms.

Well, we manage to encode it in our brains.

</comment></comment></comment><comment><USER25> ELI5: Why are adversarial attacks not preventable by adding unpredictable noise to untrusted inputs?

<comment><USER26> The attacks are resistant to noise, or at least can made to be so. If every single input is tweaked in exactly the right direction, noise won't undo that. Most inputs will still be pointing in the adversarial direction. The noise will move some inputs back to their original position, but others will be pushed even further into adversarial territory.

<comment><USER25> Thanks, that makes a lot of sense.

</comment></comment></comment><comment> d--b Research is needed in that area, but surely adding some noise / blurring to sample during training and during recognition should help reduce the feasibility of the attack. Isn't that the case?

Adversarial attacks seem to point to overtraining in some sense.

<comment><USER27> Unfortunately, it is not that simple. There are multiple ways to generate adversarial examples and simple defenses help at most against the simplest attacks. Every now and again a new preprint "one simple trick defeating the latest adversarial defense technique" appears on arxiv.

I believe they are linked to the nature of DL (and ML in general) models. We try to capture very tiny manifold of natural images in the space of all possible images. We found a technique that does it well (CNNs). But by the very definition of its training we train it to output some values in a finite number of points. In the same time CNN's output outside of those points are mainly defined by the model's smoothness. We can expect that in a neighborhood of a given image the output will be roughly the same (it allows them to generalize). Far from any point of training set the model can say anything. Adversarial examples basically hint that this smoothness work well only along natural images manifold, once we step outside it is much more chaotic. Or, equivalently, the neighborhood where the CNN gives roughly the same output is a very thin "slice" that closely follows natural images manifold. Why is that? Probably there are some non-trivial topological reasons. But it is exactly what nobody understands now.

</comment></comment><comment><USER28> Am I the only one who finds the term "Adversarial Attack" a bit funny? See [1].

[1] [https://en.wikipedia.org/wiki/Pleonasm](https://en.wikipedia.org/wiki/Pleonasm)

</comment><comment><USER29> ISTM that many of the classifiers get a lot of their signal from detecting textures, and that the adversarial noise works by superimposing a different texture on the image.

</comment><comment><USER16> There is a huge industry for folks who are finding ways to bypass Facebook's/Google's ad moderation. They pay you if you craft ads as per their liking and it approved.

</comment><comment><USER30> Don't you need access to the classifier internals to train the adversarial network ? Nobody is going to publish the network weights for a check reading machine...

<comment><USER31> No, this paper by Papernot et al shows how to do blackbox attacks without knowledge of model internals. [https://arxiv.org/abs/1602.02697](https://arxiv.org/abs/1602.02697)

<comment><USER30> Thanks. But they still need to be able to use the black box a brute force number of times on shady inputs and get detailed outputs during their gradient descent. Not going to be allowed on a check reader or anything sensitive.

<comment><USER32> Not necessarily. Adversarial examples have been shown to, for instance, be transferable across different networks with different hyperparameters (e.g., number of layers) trained on disjoint subsets of a training set [0, section 4.2]. There are more references from the paper linked by the OP.

[0] [https://arxiv.org/abs/1312.6199](https://arxiv.org/abs/1312.6199)

<comment><USER30> Thanks. I wonder if adversarial training helps prevent overfitting too. Could you use adversarial training to beat alphago ?

<comment><USER33> You could not, because AlphaGo is not a classifier (so it isn't well-defined what an adversarial example is) and the input space is discrete (Go board state) and you can't do ε-small perturbations (two different states differ by at least one stone).

</comment></comment></comment></comment></comment></comment><comment><USER34> Do this attacks still work if you don't control input image bit-by-bit, but rather feed it via digital camera? While using any digits camera for input in the real world there will be some blurrines and distortion. Is it possible to construct such a noise that 1) will survive camera input 2) will be undetectable with human eyes 3) will fool a ML algorithm?

I do believe you are not able to control input image bit-by-bit in many real- world scenarios.

<comment><USER35> As has been posted elsewhere in this thread, you can 3D print objects that are consistently misclassified when viewed through a camera from any angle: [http://www.labsix.org/physical-objects-that-fool-neural- nets...](http://www.labsix.org/physical-objects-that-fool-neural-nets/)

</comment></comment><comment><USER36> Does the adversarial attack require access to the model making the predictions?

It seems like the attack relies on `doping` the input with features present in a different target, or by masking features of the existing target.

Could you so specifically attack a target without knowledge of its features?

</comment><comment><USER18> Was there a follow up to this paper? NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles [https://arxiv.org/abs/1707.03501](https://arxiv.org/abs/1707.03501)

</comment><comment><USER37> I tried the example from the blog post (Stallone <-> Reeves) in Rekognition (AWS service) and it came out correct:

[https://imgur.com/a/C0s05](https://imgur.com/a/C0s05)

</comment><comment><USER18> I don't buy any of the attacks listed here or see how the examples being imperceptible is actually a factor.

If you have the ability to modify the check why not make it actually look like it's for a 1000000 dollars (ie even to a human).

If you are going to go out and replace speed limit signs to fool self driving cars, it's probably equally dangerous whether or not the change is obvious, because if it's way out of bounds a car won't do it but if it isn't then it would also fool humans.

Anyone have some more realistic attacks that are specifically possible due to the imperceptible nature of the changes in the input? Most of the harm I've heard in examples simply comes from the fact that if you are controlling the input to an ml system, out can get it to do whatever you want even without using any of these techniques: just actually change the class of the input.

<comment><USER38> > If you have the ability to modify the check why not make it actually look > like it's for a 1000000 dollars (ie even to a human).

Humans are harder to fool. But some bank apps allow you to deposit a check by photographing it. Such apps would be fairly easy to attack.

If you limit yourself to making 100$ checks become 1000$ checks and not 1,000,000$ checks, you might even get away with it.

<comment><USER39> A few years back a friend of mine was depositing a $300.00 check at Chase. When the teller asked him how she could help he said "Oh, just depositing this three thousand dollars." She punched in the deposit for $3000.00 and gave him a receipt. It was corrected within 24 hours but the receipt and printout of his bank statement was a great conversation piece. I doubt they would have let him just walk away with the money, nevermind multiple times.

</comment></comment></comment><comment><USER40> While it's true that these attacks work well on state-of-the-art models, there are defence strategies such as including adversial examples during training. Advanced defence strategies such as [https://arxiv.org/abs/1705.07204](https://arxiv.org/abs/1705.07204) are robust to a wide array of attacks and achieve very competitive error rates.

I'm not saying it's not a problem but there are successful defence strategies already in place for many attacks.

<comment><USER41> > Although our models are more vulnerable to white-box FGSM samples compared > to the v3adv model, ensemble adversarial training significantly increases > robustness to black-box attacks that transfer FGSM samples crafted on the > holdout Inception v4.

So, I just train my new adversary on the "new" model that was trained on the previous adversarial examples. And now we're back to square one.

I suspect the problem of adversarial attacks is a problem of high-dimensional spaces, not of training on particular samples.

<comment><USER40> I'm not sure how the quote supports your argument. Adversial examples generalize well accross many different classifiers.

Shallow NN's can be fooled just as well, it seems to be more of a problem of linear models in general. Apparently Geoff Hintons Capsule Networks are more robust due to being "less linear" (Ian Goodfellow mentioned this in a recent talk, don't have the references now to back it up)

<comment><USER41> I'm not sure it's about how shallow the network is; even logistic regression can be fooled by the same techniques (e.g. 1-layer NN). That being said, maybe it does have something to do with linearity (I suspect not) or maybe it's just generally harder to deal with nonlinear functions.

</comment></comment></comment></comment><comment><USER42> I see an SaaS opportunity here, that takes your photos, adds noise, and only then uploads it to social networks.

</comment><comment><USER43> Adversarial attacks sound useful. How can we make it illegal to prevent them?

<comment><USER44> I may not completely understand the question, but I'm pretty sure "Intentionally fooling an algorithm for nefarious purposes is illegal" is both the answer, and the status quo.

</comment></comment><comment><USER45> > How is this possible? No machine learning algorithm is perfect and they make > mistakes — albeit very rarely.

Right.

</comment><comment><USER46> ATMs using neural nets - lol - nope. That is a stretch.

<comment><USER47> Effective counterexample: the USPS.

[http://www.cedar.buffalo.edu/~srihari/talks/Telcordia.pdf](http://www.cedar.buffalo.edu/~srihari/talks/Telcordia.pdf)

</comment></comment><comment><USER48> The _only_ solution is coming up with a globally-accepted open source base set of instruction for any and all AI or AI-capable code.

</comment><comment><USER49> Ah, this is why AlphaGo won't release their source code or models.

If all ML algorithms can be fooled so trivially, this shows the human mind is not an ML algorithm.

<comment><USER50> I think your logic is:

1\. All ML algorithms can be fooled trivially. 2\. The human mind cannot be fooled trivially. 3\. Therefore, the human mind is not an ML algorithm.

But claim number 2 is clearly wrong. Human minds are trivially fooled. Here's one:

[http://www.jimonlight.com/wp- content/uploads/2012/02/Paralle...](http://www.jimonlight.com/wp- content/uploads/2012/02/Parallel-Lines.gif)

This is exactly what an optical illusion is.

<comment><USER51> The problem with optical illusions like that is that they are, in their vast majority, made of abstract shapes. Most of them play with our perception of distance and depth - and the majority again work on two dimensions, only.

It's really hard to imagine an optical illusion that makes you mistake objects in the physical world for something else- say, panda for a lawn mower or a car for a pigeon, or something like that.

Note that I don't agree that this tells us anything about whether the human brain (or mind) is "like" a machine learning algorithm. To me this question has about as much meaning as asking if the brain is "like" quicksort.

The physical substrates are so clearly different that the only comparison you can make is on the level of capabilities (say, both are Turing-equivalent etc) not that of actual structures. Like, where's the 1's and 0's in the brain?

<comment><USER50> > It's really hard to imagine an optical illusion that makes you mistake > objects in the physical world for something else- say, panda for a lawn > mower or a car for a pigeon, or something like that.

Here's a physical object that makes you mistake an insect for a plant:

[https://en.wikipedia.org/wiki/Phasmatodea](https://en.wikipedia.org/wiki/Phasmatodea)

<comment><USER52> Problem is, mimicry involves copying essential properties of the target object: color, texture, shape, movement dynamics and so on. It relies on true ambiguity. Adversarial examples against neural networks (the interesting ones, anyway) involve a combination of insignificant, seemingly random permutations that only work in their totality. That's a very important difference.

<comment><USER50> > essential properties of the target object

They are only "essential" properties according to the limitations of your particular perceptual system. To a bee that can see UV light, a stick bug may look entirely different from an actual stick. An animal that hunts by scent would find them clearly distinct.

There is no such thing as "true" ambiguity unless the two objects are actually the same thing in all respects. If they are distinct but appear the same, it's because they are overlapping in some respects but not all.

<comment><USER52> _> They are only "essential" properties according to the limitations of your particular perceptual system. To a bee that can see UV light, a stick bug may look entirely different from an actual stick. An animal that hunts by scent would find them clearly distinct._

This is a very confused statement. Fist, since we are talking about image recognition we are - by definition - talking about vision in the spectrum that can be captured by a digital camera and encoded in a typical image format. Second, there definitely is such a thing as essential property. It is a matter of correlation with reality, as well as internal consistency. For example, plants are green and have leaves because of the way they use sunlight. So permuting color of all leaves in the picture is fundamentally different from permuting luminosity of some random pixels.

</comment></comment></comment></comment></comment></comment></comment><comment><USER44> > Lately, safety concerns about AI were revolving around ethics — today we are > going to talk about more pressuring[sic] and real issues.

Nice how this casually demeans peoples' worries. Of course, the (demonstrated) idea that ML algorithm would pick up on, and amplify, discrimination (among other things) isn't "real" to these guys.

Risk-scoring of loan applications actually happens to be one of the few uses of ML in the non-tec sector, and it's incredibly likely that some of them are already denying people's application because they happen to be named "La David" and not "Emil". But maybe the authors just don't consider "ethics" to ever be a "real" problem?

But "change a single pixel and the ATM gives you $1,000,000" is, apparently, a "real" and "pressing" problem.

</comment><comment><USER53> Am I the only one who thinks "adversarial attack" is both a redundant and unhelpful name?

\- Redundant: Anyone who attacks you is by definition your adversary.

\- Unhelpful: According to the article, "designing an input in a specific way to get the wrong result from the model is called an adversarial attack." That sounds much closer to spoofing attack ("a situation in which one person or program successfully masquerades as another by falsifying data" -Wikipedia). For example, a turtle masquerades as a gun by spoofing the machine learning system by changing irrelevant visual details.

<comment><USER54> Adversarial means something specific in the ML community. [https://en.wikipedia.org/wiki/Adversarial_machine_learning](https://en.wikipedia.org/wiki/Adversarial_machine_learning)</comment></comment>


Wil Shipley: Wanted Bugs. $100. Cash money. - <AUTHOR> http://www.delicious-monster.com/blog/2008/08/wanted-bugs-100-cash-money.html

<comment><USER2> LOL. Much smarter than the story I read of paying a bounty for bugs to the same people who create them.

Mozilla does this too <http://www.mozilla.org/security/bug-bounty-faq.html>

<comment><AUTHOR> _"... Much smarter than the story I read of paying a bounty for bugs to the same people who create them ..."_

I was thinking it was smarter than your average (bear) because it might entice users or new users by dangling cash in a recession climate to speed up the beta bug-hunt. Hacking users?

<comment><USER3> I think sidsavara meant people will invent bugs and then claim rewards for fixing them.

<comment><AUTHOR> _"... I think sidsavara meant people will invent bugs and then claim rewards for fixing them ..."_

I got that bit. I just think the delicious use is a better version of this as the results are harder to fake.

</comment></comment></comment></comment><comment><USER4> Dilbert: <http://joeindie.com/blog/?p=50>

</comment><comment><USER5> I've been wondering why software companies don't do this for years. Hope it works!

</comment><comment><USER6> Isn't this essentially(or exactly) spec work?

<http://www.no-spec.com/>

<comment><USER7> Nope. NO!SPEC is concerned only with design spec work, which should be blindingly obvious if you have ever read their page.

<comment><USER6> Which does not mean that Spec work is a reasonable way to work in software development.

</comment></comment></comment><comment><USER8> <http://utest.com></comment>


TomDoc 0.9.0 - <AUTHOR> http://tomdoc.org/

<comment><AUTHOR> See also [http://tom.preston-werner.com/2010/05/11/tomdoc- reasonable-r...](http://tom.preston-werner.com/2010/05/11/tomdoc-reasonable- ruby-documentation.html)

There's been some follow-up on Twitter, and Loren Segal has already written a blog post defending YARD and a YARD plugin so that you can use TomDoc and YARD together:

<http://gnuu.org/2010/05/12/whats-missing-from-tomdoc/> <http://github.com/lsegal/yard-tomdoc>

Lots of thinking about documentation in the Ruby world lately - a good thing. See also ronn and gem-man on Github.</comment>


NHS pulls plug on £11bn IT system - <AUTHOR> http://www.independent.co.uk/life-style/health-and-families/health-news/nhs-pulls-the-plug-on-its-11bn-it-system-2330906.html

<comment><USER2> From "Wednesday 03 August 2011".</comment>


BART janitor grossed $270K in pay and benefits last year - <AUTHOR> http://www.eastbaytimes.com/2016/11/01/bart-janitor-grossed-270k-in-pay-and-benefits-last-year/ <comment><USER2> Usually this happens because they aren't allowed to hire more employees but they still have the same work to do. A lot of workers don't want the extra shifts because they have a home life but there are outliers who will take every shift they can.

</comment><comment><USER3> he worked the hours and he deserves the pay. Good for him.

<comment><USER4> Contractually, yes, but I doubt he delivered that level of service to the riders. BARTs carelessness is funded by American tax payers who get nothing in return

<comment><USER5> Who is going to do the work? Obviously BART can't get enough janitors to work these shifts, hence why this guy is busting his ass 114hrs a week to make BART cleaner than it was.

</comment></comment></comment><comment><USER6> That seems really low for someone who has to live in an area like the Bay Area.

</comment><comment><USER7> I guess that puts the new-minted-grads starting salaries are $100+k in perspective that those of us not in the area hear about.

</comment><comment><USER8> Not to detract, but it's around $200k when you include just the pay and not the benefits.

</comment><comment><USER9> Good for him.</comment>


Twitter Has Become a Park Filled with Bats and Perverts - <AUTHOR> http://nymag.com/selectall/2016/03/julieanne-smolinski-quitting-twitter.html <comment><USER2> The problem isn't that there are assholes on Twitter. They've always been there. Dealing with abusive people who want to shout down things they don't agree with has always been a downside to social media, especially if you share or talk about any remotely "controversial" topic. Twitter's lack of tools to help manage that problem didn't help but no amount of tools will completely fix the issue. It's a fact of life that a minority of people are just not very nice. The real problem is that there's no _benefit_ to being on Twitter any more. The upside has vanished. The genuine conversations and _fun_ side of Twitter has been lost. It's become a crowd of people all broadcasting without wanting to engage with their followers.

I suspect it's simply a network size problem - once Twitter hit a threshold of users it got too noisy. It's ironic that Twitter's value is considered to be the size of its audience whereas that might actually be the exact thing that's killing its usefulness.

<comment><USER3> Yes, technology has removed any limits to reach large audiences in the world. Combine this with zero consequences for abusive behavior. The solution in the past has been to move to a new forum relying on the trolls to take a while to figure it out.

On the other side is the FB model where one is forced to use real names and a single account. That in turn exposes people to bullying in real life and forces the freedom of speech on a kinder-garden level.

Then there are models where identity is tied to commercial assets (Amazon, Apple) where banning has potentially devastating economic side effects.

Free anonymous accounts that cost nothing and are all powerful are not helping civilized discourse. Commercial accounts are not simple either. But what are the alternative?

<comment><USER4> How does FB expose people to real-life bullying? I'm not seeing that connection. (Or are you saying that bullying still occurs on FB using real names?)

</comment></comment></comment><comment><USER5> If Twitter had an interest addressing abuse, Twitter would strive to make it easier to report abuse than to create it. Instead, retweeting is one touch and amenable to botting while reporting is convoluted and a linear.

</comment><comment><USER6> Is this similar to perverts calling random women on the telephone? Now that I think about it, wouldn't it have been easy to detect the callers and punish them? Did that ever happen?

</comment><comment><USER7> Twitter has become what comment section at Yahoo News once was, which ultimately what YouTube became. The crowd has just shifted over to Twitter now. Nothing anywhere is any different, when it comes to unmonitored platforms.</comment>


Google Contributed $40K to AG Not Participating in Anti-Trust Investigation - <AUTHOR> https://sociable.co/web/google-contributed-40k-to-ag-not-participating-in-anti-trust-investigation/ <comment><USER2> California's AG Xavier Becerra might have some legitimate reason for staying out of this investigation, but, if so, he hasn't tweeted about it. It's interesting though, because he has in the past come out against Big Pharma, Wall Street banks, and fraudulent charities. I'm sure he'll join this lawsuit too. It just wouldn't make sense for him to stay out of it.

<comment><USER3> Yeah, they are looking to screw with his biggest employers. Cali under state law could be far more invasive than the Fed probe too.

</comment></comment><comment><USER4> What do you expect, they are playing the political money game that is U.S. politics.

</comment><comment><USER3> Iowa's AG was already bought by the banks: [http://swampland.time.com/2011/05/09/foreclosure-probe- chief...](http://swampland.time.com/2011/05/09/foreclosure-probe-chief-asked- bank-lawyers-for-money/)</comment>


Amazon Prime Photos: Impressions After 300 GB - <AUTHOR> https://blog.hiramsoftware.com/blog/amazon-prime-photos-impressions-after-300-gb/

<comment><USER2> I've tried it too, and came to pretty much the same conclusion...another place to backup...what I like about Dropbox tho is how they name files with a timestamp of when the picture was taken. I'm reluctant to enable auto-save on my Android because of how files will be named.

What I'll end up doing is going first to Dropbox, then to Amazon as a long- term backup. Annoyingly, I don't think there is a api to script this, so it will have to manual for now.

</comment><comment><USER3> He claims that Flickr changes the original uploaded photo; just to be clear, they do not do that. They do create several resized versions, but the version you uploaded is absolutely never altered. It stays bit for bit identical and can be redownloaded and the hash will be the same.

<comment><AUTHOR> Thx! I clarified that flickr changes the filename [0], which is different than changing the binary data, but for me a non-starter when looking at places to backup photos. ymmv.

[0] [http://photo.stackexchange.com/questions/12423/does- flickr-r...](http://photo.stackexchange.com/questions/12423/does-flickr- recompress-jpegs-after-upload)

</comment></comment><comment><USER4> Wonder what happen if someone write an app that continuously capture 5-8 megapixel images every few seconds and upload to Amazon?

\- None stop, looking out at front door, street, sunset, etc.

What if that app became popular and a lot of prime users start to using it?

:-)

<comment><USER5> Well for Amazon Cloud Drive specifically, I don't even think they have a public API</comment></comment>


Ask HN: Who do you go to for brochure design? - <AUTHOR> We have an existing set of templates that we need some jazzing up on. They're functional, but not as aesthetic as they should be for marketing docs.<p>It's not a redesign, more an augmentation and continuation of existing design principles. Also, we use OpenOffice for a lot of our work. Any ideas/recommendations? <comment><USER2> I have a friend who runs an indie design & print firm. <http://www.danamediagroup.com> is his co and his name is Cameron. Let him know Aaron sent you and I'm sure he'll giving you great pricing :]</comment>


For the love of God, please tell me what your company does - <AUTHOR> https://hackernoon.com/for-the-love-of-god-please-tell-me-what-your-company-does-c2f0b835ab92 <comment> david-cako > I'm confident that most people in the day-to-day of business will agree — > the more expensive the service a B2B company provides, the more > incomprehensible its website.

This is 100% accurate. There was a thread on here a few days ago about the 10 most valuable startups, and I was surprised to find that I wasn't at all familiar with several of them. I started googling and was shocked at how difficult it was to understand what the fuck their business is from their home page. It is much easier to just go on wikipedia or read a press release of some sort.

I have to wonder if the conclusion in this article is valid -- the more obscure the web marketing, the more phone calls they will get, and the easier they can do the hard-sale. I feel like most of these businesses are so cryptic and generic that it pushes people away.

<comment><USER2> > the more phone calls they will get, and the easier they can do the hard-sale

A couple of reasons:

1\. It lets them be flexible with what solutions they can offer.

2\. For companies that do a few things, it can be really difficult to be clear and concise

Example: You own a company that makes consumer facing apps with a focus on QR codes. A potential customer who wants a website for an internal use may not choose you so you end up with garbage like "we create dynamic and flexible end to end solutions to enable your core competencies"

</comment></comment><comment><USER3> I don't think they do it to upsell on the phone. I think they do it because: 1. They want investors more than they want customers, and they think investors like "media intelligence" better than "list of contacts". 2. They prefer talking about "media intelligence" when they go to parties. 3. They like talking about values and communities and making the world a better place, just like those guys on Silicon Valley.

</comment><comment><USER4> This drives me crazy. Most of the things that pop up on HN that I haven't heard of, I click the link and there's nothing there explaining what they do or what the product is.

There's a company called Deekit that was on HN recently. This is what I see when I click their product page:

[https://drive.google.com/file/d/0BxucYFiswY_vazdFTF9mUlNHb1U...](https://drive.google.com/file/d/0BxucYFiswY_vazdFTF9mUlNHb1U/view)

Not just no explanation... no text! (you have to scroll down). Note: they are not selling fashion or phones... turns out it's a shared whiteboard or something.

<comment><USER5> Hey there! I'm one of the founders here at Deekit. I see you brought out the gap in our mobile homepage not having the short summary tagline on the top image. We're actually fixing it to match it with the site you see on the desktop. Totally agree that the twitter-length summary of what the product/service is about should be always the first thing you see quickly.

PS! A collaborative whiteboard in the cloud is exactly what we do - collaborate, draw and discuss ideas on any device and anywhere :)

</comment></comment><comment><USER6> For some companies the point of such a web site is prospect qualification: If you are in the market for the product/service you'll understand what the company does; if not you won't waste the company's (or your) time contacting them. This isn't just a web issue: consider the famous sign on 880 in Oakland that stood for years and read only, "stop casting porosity".

However in general the point of the article stands...unfortunately.

<comment><USER3> That sign isn't quite famous enough for me to have heard about it. What does it mean?

<comment><USER6> It qualified you properly: you are apparently not in their customer demographic!

If you simply type "stop casting porosity sign" to a search engine you will find an enormous discussion by people who did and did not understand it. It was quite famous for decades.

</comment></comment></comment><comment><USER7> This continues to drive me absolutely nuts. At the very least you should have your elevator pitch right up front.

</comment><comment><USER8> Great article! I wish this fad goes away soon.

If I had the money I would think about hiring this company to get the contact info to a couple of reporters that could write more articles about Meltwaters bad site (and others like it).</comment>