DoorDash confirms data breach affected 4.9M customers, workers and merchants - <AUTHOR> https://techcrunch.com/2019/09/26/doordash-data-breach/ <comment><USER2> > The information accessed is not sufficient to make fraudulent charges on > your payment card.

In other words... "We leaked a bunch of your personal information, but at least it's not enough data to steal your money!"

All of these leaks have the cumulative effect of making ineffective very commonly used security verification questions: "Can I verify that last 4 of your social? And the last 4 of your credit card?"

How long will it take for us to accept that this kind of data can no longer be assumed private? The sooner, the better, mainly so companies stop using it as a secondary form of identity verification.

<comment><USER3> Surely the actual problem here is that the responsibility for reliable identification somehow falls on the consumer, not the bank or what have you?

I'll give an example: if I get a phishing email claiming to be from my bank, and end up wiring them $1000, I'm out $1000 for not having done the due diligence for verifying that it in fact was my bank; my bank doesn't suddenly owe me $1000. Somehow, though, if some 3rd party convinces the bank they're me, and withdraws $1000 from my account, I'm at fault as a victim of "identity fraud" (and am again out $1000, but this time as a result of my bank's incompetence).

If the onus for verifying your identity were on institutions (and, consequently, the losses in cases of failure to do so) I'm confident that we would have much more reliable means of personal identification magically pop into existence.

<comment><USER4> > Somehow, though, if some 3rd party convinces the bank they're me, and > withdraws $1000 from my account, I'm at fault as a victim of "identity > fraud" (and am again out $1000, but this time as a result of my bank's > incompetence).

This isn't true, though. The bank is the one on the hook.. eventually. The problem, of course, is that you have to get the bank to agree that it wasn't you who made the withdraw..

While it sucks, I am struggling to figure out alternative solutions.

Let's suppose we did the opposite; if you tell the bank that it wasn't you, then they have to prove it was, and in the meantime they give you the money. Sounds great, but this makes fraud about as easy as you can get - open an account, deposit $50,000, then transfer it somewhere else and withdraw it to cash. Then, tell the first bank that it wasn't you that did it. Sure, they will be able to prove it was you eventually.... but according to our new rules, they have to return the money while they figure it out... you withdraw it all and flee.

There would be literally NOTHING the bank could do to prevent this sort of fraud. They could put a million checks in place, but since they would still need to 'prove' it was you when you claim it was fraudulent, and make you whole in the meantime, you could still steal the money during that time. You claim fraud, they put the money back into your account.. and then they show someone (who? an arbiter? the gov?) that they have video evidence of you making the withdraw. While the ruling is happening, you skip town with the money.

It really sucks, and I really can't think of a solution.

<comment><USER5> All of that argumentation is nice but it doesn't hold any water.

Credit card companies are by law on the hook for any fraud committed with your credit card. Everything you just wrote applies to credit cards, and yet Visa and Mastercard are doing just fine. They aren't going bankrupt just because you can file a chargeback whenever you want as a consumer.

There doesn't seem to be any doubt Banks can handle this, because they already do.

<comment><USER4> Except they AREN'T on the hook for the fraud... the merchants are. They are doing fine because they pass on the costs to the merchants.

Also, when you dispute a charge, they are able to put the money in 'escrow', basically, while they investigate... since they control both sides of the transaction (both merchant and customer), they 'keep' the money while they resolve it. If they find in the card user's favor, they deduct it from the merchant account and credit it back to the card user. Otherwise, they release the hold and the merchant can withdraw the money.

It doesn't feel like your money is being held as a card holder, because the 'money' in this case is credit, and it doesn't effect your bank account while it is being resolved. However, it DOES count against your credit limit while they resolve the issue, so it shows you that the money is still 'frozen' while they resolve it. They aren't allowed to charge interest during the dispute, but if you lose the dispute you will have to pay the interest.

This is the same thing that happens when your bank account is defrauded.. the money is frozen, and you can't withdraw it until the dispute is resolved.

<comment><USER6> > Also, when you dispute a charge, they are able to put the money in 'escrow', > basically, while they investigate... since they control both sides of the > transaction (both merchant and customer), they 'keep' the money while they > resolve it. If they find in the card user's favor, they deduct it from the > merchant account and credit it back to the card user. Otherwise, they > release the hold and the merchant can withdraw the money.

> It doesn't feel like your money is being held as a card holder, because the > 'money' in this case is credit, and it doesn't effect your bank account > while it is being resolved. However, it DOES count against your credit limit > while they resolve the issue, so it shows you that the money is still > 'frozen' while they resolve it. They aren't allowed to charge interest > during the dispute, but if you lose the dispute you will have to pay the > interest.

I knew roughly how this worked before, but it didn't occur to me until I read your explanation that this allows the credit card company or bank to invest the money while it's in escrow. So it actually _benefits_ them when fraud happens on your account.

...of course that's a thing. The bankers always win.

<comment><USER7> Visa and Mastercard are card schemes. They are just moving the money between financial institutions. The issuer (which is the financial institution from where the credit card was applied from) is providing the credit line=they own the money. The scheme ensures that the other parties always gets their money, which is why their business is really dependent on good fraud detection algorithms. The payment schema will just freeze the settlements during the dispute, but if evidence is found that it was fraud, they will lose the money. This of course happens all the time, but it is just a pricing issue. Visa charges license fees from issuer and acquirer, and every transaction costs for the merchant around 0.5-5% depending on the card.

<comment><USER7> Had to check again, visa and Mastercard actually don't carry the risk in this scenario. It's either the acquirer or issuer. Scheme acts as a judge and decides who's fault it is. However, now that 3d secure is in place, if both issuer and acquirer support it, there are really few frauds. If they don't, the risk is on the one who did not enforce 3d secure.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I'd like to point out, it's not "DoorDash" that has done anything wrong, it's these _people_ :

\- Andy Fang

\- Evan Moore

\- Stanley Tang

\- Tony Xu

They decided our security and privacy wasn't worth as much as hur hur hur growth hacking startup hur hur next uber, and couldn't be arsed to even give us a proper apology.

Look at their blog post: not one mention of the words "we sorry, we fucked up".

It's all about the other guys.

The _bad guys_.

The guys who stole your data _not us_ , and you should change your password with us to protect your account _with us_.

No. That's wrong. Look at the 295 million people who weren't affected -- all the people who don't use doordash at all!

That means the best way to protect yourself is to simply not use doordash. Delete it. Delete the email account and the bank/credit card you used with them (ask your bank/credit card company for a new number). Move if you've got to (drivers license details!?!?!?) You have no other protection now- you're fucked. They have your data, and they're only going to risk it again.

And remember how difficult it is to get in control of your data again when the next breach happens, the next time you're thinking about signing up with something, or you're getting ready to vote.

<comment><USER9> Is there something about this story that makes you think it's an issue of negligence rather than a capable intruder? We keep getting told that total security is impossible. Isn't this inevitable? Is it just that they waited too long to disclose it?

<comment><USER8> Security is a cost/benefit decision, not a binary one. More security costs more. Putting the drivers licenses and bank details of employees in the same database as the credit cards and names of customers is cheaper than putting them on separate databases. Putting them on the Internet is cheaper than having a separate network. Turning off your logs "when you don't need them" is cheaper than leaving them on all the time.

If anyone says "total security is impossible" you just say: So fucking what? That's not an excuse for spending as little on security as possible, and you know someone isn't serious about security if they avoid admitting they are responsible for the security in the first place.

</comment></comment></comment><comment><USER10> At this point HN should just have a permanent module in the top right corner announcing the latest data breach.

<comment><USER11> "Days since last publicly disclosed data breach breach: 0"

<comment><USER12> Honestly? A minutes scale might be more appropriate there. Unless we add the "Major" but then, what is major?

<comment><USER13> Nah, a minutes scale would require data entry frequently, and HN's volunteer moderators probably don't want to have to click "Reset breach counter" all the time, plus you'd need to write code for both that button and the minute counter.

Let's keep HN Javascript-light: "Days Since" is much easier to implement. Just one line of static HTML will do:

        <b>Days Since Last Breach: 0</b>

</comment></comment></comment></comment><comment><USER14> The official blog post doesn't give any information about the breach except "We noticed a third-party had unauthorized access to DoorDash data", and the TechCrunch article says that DoorDash responded that they couldn't explain how the breach happened. How are they so sure that they fixed the underlying cause if they don't even know how the third-party got access in the first place?

<comment><USER15> It seems like the breach was through a third party that only had old data, since nobody that registered after April 5, 2018 is affected.

So it's probably some service that they no longer use and doesn't really need to be fixed or investigated, since all the data they had has already been taken and they (probably) stopped giving them more data a year and a half ago.

They should really say who the third party was though. Hopefully that information comes out.

<comment><USER16> A year ago customers were complaning that their accounts were accounted despite using an unique password to DoorDash. DoorDash at that time denied any hacking incidents.

A more sinister explanation is that DoorDash knew back then who is leaking their data and removed their access. But chose to disclose only just now.

</comment></comment></comment><comment><USER17> There is a silver lining in all these data breaches. At some point in time _all_ our data will have been leaked at least once and probably more than once and subsequent leaks will not do any more damage.

The safe assumption would then be to not trust any accounts created online without some good old KYC processes in place requiring live verification of identity.

<comment><USER18> A government created physical token for every person could be the direction we are headed

<comment> munk-a Alternatively, we might be headed for sane data breach and privacy laws. Something like... if you want to store personal data then pay for an external audit or have your domain confiscated - done.

<comment><USER17> Ever since the enacting of the GDPR I've seen a substantial uptick in the number of companies that take their data liabilities serious.

<comment><USER19> Not doordash, apparently. Their CS agents and supervisors were completely unaware of GDPR and unable (or unwilling) to delete accounts.

<comment><USER17> Doordash is headquartered in San Francisco, that might have something to do with it. Do they even operate in Europe?

</comment></comment></comment></comment></comment></comment><comment><USER20> Original blog post: [https://blog.doordash.com/important-security-notice- about-yo...](https://blog.doordash.com/important-security-notice-about-your- doordash-account-ddd90ddf5996#46h35gr24e)

From the techcrunch article: "It's not clear why it took almost five months for DoorDash to publicly reveal the breach. DoorDash spokesperson Mattie Magdovitz say why [sic]."

Pretty bad. If personal identity info is exposed, it is irresponsible not to notify users immediately so they can freeze credit and watch for suspicious activity. The blog post did mention a third-party vendor, so it's possible there was a delay, but it's a whole other problem if it took this long to find a breach.

This sounds like it could be "flipboard-itis". Flipboard stored passwords insecurely in the beginning (SHA-1), but switched to bcrypt as it scaled. The passwords breached were before 2015, so possibly a similar thing here where they started out with bad security and improved with scale (but left the old stuff behind). I'm guessing Doordash did something similar and improved security as it scaled.

<comment><USER21> Huh? The blog post says April 5, 2018.

<comment><USER15> I'm not sure what you're trying to point out, but it seems like the data was stolen from a third party DoorDash uses, and that they only had data from users that registered on or before April 5, 2018. The breach actually happened on May 4, 2019.

(And the 2015 reference in the comment you're replying to is about a Flipboard breach, not DoorDash)

<comment><USER22> Well, back in 2018, TechCrunch reported that they were compromised. I believe this is the same breach as then. They just reported it one year later.

[https://techcrunch.com/2018/09/25/doordash-customers-say- the...](https://techcrunch.com/2018/09/25/doordash-customers-say-their- accounts-have-been-hacked/)

</comment></comment></comment></comment><comment><USER23> The classic trite "We take the security of our community very seriously." Nearly every corporate communication about a breach says it and often it comes out to have been demonstrably untrue.

<comment><USER24> Here's a four-year-old collection:

[https://www.troyhunt.com/we-take-security-seriously- otherwis...](https://www.troyhunt.com/we-take-security-seriously-otherwise/)

> "We take security seriously", otherwise known as "We didn't take it > seriously enough"

</comment></comment><comment><USER25> (Throwaway account)

I used to work for a third-party service provider that merchants send this sort of data to for lots of users. Considering there weren't lots of customers using this provider making similar posts, and Doordash didn't call out the provider, it wouldn't surprise me if a Doordash employee account with that provider got compromised. The blog post was carefully worded to not throw the provider under the bus, but also avoid taking blame, themselves.

The telling bit is that the last four digits of credit card numbers were sent. There are only a few types of vendors you'd send that data to.

<comment><USER26> I cant figure out what "third party provider" you send passwords to though?

<comment><USER27> Yeah. My guess is 3rd Party provider is AWS S3 and a DB backup was accessed.

</comment></comment></comment><comment><USER28> The official blog post: [https://blog.doordash.com/important-security-notice- about-yo...](https://blog.doordash.com/important-security-notice-about-your- doordash-account-ddd90ddf5996#46h35gr24e)

</comment><comment><USER29> I feel bad for the people affected but at least the scummy company got what it deserved for stealing tips (for those unaware, they used to withhold the total tips out of a delivery drivers base compensation so essentially taking the tips for themselves).

Now if they could just completely die so a more ethical competitor can take its place it would be even better.

<comment><USER30> They did no such thing, and I find it frustrating that people keep repeating this falsehood. Doordash promised to pay drives at least $X (where X was, I believe $1 or something like that) AND that the driver will make at least $Y from the delivery. The driver always gets the tip, plus a variable amount from DD. This is _exactly_ how it works for wait staff in restaurants in most states, except that is by hour instead of delivery. For example, in MA, the restaurant pays out a minimum of $3.75 (wait staff minimum wage in MA) and guarantees that the wait-person makes $11 (actual minimum wage). See [https://www.dol.gov/whd/state/tipped.htm](https://www.dol.gov/whd/state/tipped.htm)

<comment><USER29> Did they make that clear to the end customer that this is what's happening with the tips? I don't care what their contract with the delivery driver states, if they allow me to add a tip I expect that tip to go in the driver's pocket in addition to whatever they'd get paid without the tip, just like if I was giving them cash directly. If that's not what's happening they have essentially defrauded me and I wouldn't be too happy about that.

<comment><USER31> When was the last time a restaurant disclosed this arrangement to you?

<comment><USER32> Restaurants are bound by labor laws that require minimum wages to be paid to employees. As far as I know, Doordash drivers are not employees but are independent contractors which means they aren't required to be paid minimum wage under the Fair Labor Standards Act. Since they aren't required to be paid minimum wage this situation is completely different than at a restaurant

</comment></comment></comment></comment></comment><comment><USER33> DoorDash is the worst. They inexplicably banned me from their platform after giving me a credit for a bad order. I filed several support tickets over several months and kept getting canned responses about how they were "looking into the issue." Eventually I just switched to Uber Eats.

</comment><comment><USER34> I've been vending myself unique email addresses for every online account I use for about 3 years. They are nice because I can reply to them like a regular mail and my actual email account gets stripped out automagically.

I've been considering making it a product and I wonder in this case what people would want to do when the account data gets leaked?

1\. blackhole all email to the address. 2\. forward all email to some email service that is never/rarely used. 3\. flag messages that are not sent from the matching domain (doordash.com in this case). 4\. blackhole and generate a new address so the user can go back to door dash and provide a fresh email address.

I also wonder if there is any use for meta data on who's trying to email a blackholed email addrress e.g spam blacklisting.

<comment><USER35> You can do something similar with fastmail. Get a domain for your email and make an alias address of the form [anything]@[alias].domain.com . You can then make 'sending identities' for an instance of that catchall domain for the rare time you need to send email as email@example.com . You can also create rules to blackhole a specific alias email or whatever you want when you need to invalidate the email.

<comment><USER34> So how would you handle this breach with your fastmail alias?

<comment><USER35> If I start noticing annoying spam being sent to email@example.com then I make an email rule to delete it and change my doordash account email to email@example.com along with a password change with my password manager?

<comment> munk-a It'd be nice if there was a way to way that pile of emails at some authority and say "Here, this is the crap that's come of that data breach." Ditto for any authorized (but shady) third party data sharing.

Sadly we currently lack a consumer protection bureau.

<comment><USER36> This is the part the is really missing.

I use email@example.com whenever I sign up at random sites. Last night I got a bunch of spams at the just-eat [1] account (food delivery, operating in 13 countries so not a small operation).

Now I know they've been breached, but:

1\. They haven't reported it anywhere.

2\. I don't know of any meaningful action I can take.

[1] [https://en.wikipedia.org/wiki/Just_Eat](https://en.wikipedia.org/wiki/Just_Eat)

<comment><USER37> They're headquartered in the UK, so I'd start with making a complaint via the Information Comissioner's Office: [https://ico.org.uk/make-a- complaint/](https://ico.org.uk/make-a-complaint/). The best option is probably "Your personal information concerns":

> If ... you're concerned about how an organisation has handled your > information – if the information is wrong, they have lost it or disclosed it > to someone else – tell us.

</comment></comment></comment></comment></comment></comment></comment><comment><USER38> I still worry about DoorDashes security - someone has signed up for services with my email account - not an issue, I just will never verify them. But they had signed up for DoorDash, and I didn't realize it, and then I tried to sign up for the first time via the Android App with that same email account. I selected the email account to my surprise it immediately let me into the other persons account! They had ostensibly set up a password, but I didn't need it and could see their phone number and bits of their payment information. I sent in a support email for that one, and got the account closed, but still, not a great sign.

<comment><USER39> I don't understand, it just never prompted you for a password?

<comment><USER38> Nope. I was using the built in Android Account linking (like if you link up your Facebook account to an application OAuth style), but the person who set up the account couldn't have been - they would have set it up with a password as they can't access my email account.

Of note here, I never verified the account when the user first signed up, so DoorDash has always just been going on the first guy's word that they are who they say they are.

<comment><USER40> If you control the email address on the account you could get in by resetting the password, so I'm not sure what the difference is there

<comment><USER38> To me the difference is the intent - I didn't intend on entering someone else's account. If I'd tried to log in with a password/email, it would have told me the account already exists, or prompted me to reset the password, and then I'd need to request that and knowingly invade the account. This way I just walked right in without even knowing what I was doing - I didn't realize there was even a problem until I went "hey, that's not my phone number!".

</comment></comment></comment></comment></comment><comment><USER41> I propose a way to improve cybersecurity: FINE companies who loose sensitive customer data to hackers. Fines can be calculated according to the "breach severity grid" which is based on the type of data that is lost. For example:

1\. Personal address, DOB - $15. 2\. Each social security $20. 3\. Driver license number $25. 4\. Bank account numbers $30. etc.

So a loss of 4.9 million social security numbers, DOB and addresses would generate a fine of $171,500,000

Problem solved!

Now, the company will think 100x times BEFORE collecting consumer data if they can actually PROTECT IT. Build robust security FIRST!

<comment><USER42> I would add passwords to the list of fines with growing penalties based on how the passwords were stored.

Unique salt per user hash < shared salt with user hash < no salt but using strong hash < no salt and a weak algorithm like MD5 or SHA-1 < plaintext

<comment><USER41> great suggestion! loosing data that is well protected is one things, but loosing plain text personal info is totally different matter and should be punished more.

</comment></comment></comment><comment><USER43> Wonder if I'll get another $25-50 from a class action lawsuit over this.

<comment> munk-a Nah, you'll be offered 25-50$ but then they'll swap it out for 25-50$ in credit monitoring and/or applebee's coupons at the last minute.

<comment><USER44> I think I take the credit monitoring in this instance?

<comment><USER45> I'll throw it on the pile of all the other credit monitoring I've gotten from other breaches.

<comment> munk-a Sadly credit monitoring just increases the chance that your data will be breached once again - what about the option where, because you guys done goofed with my data, you're not allowed to track me anymore or store any data on me - and you're not allowed to charge me to do this nor randomly charge me if a bank tries to talk to you.

Credit Bureaus are just such steaming piles of crap.

</comment></comment></comment></comment></comment><comment><USER46> DoorDash probably forgot to tip the "third-party service provider"

<comment><USER44> No, they kept took their tip to pay the base salary instead.

</comment></comment><comment><USER47> Stealing tips and now a breach with a terrible response. These people should be in jail and their company should be shut down.

</comment><comment><USER48> I received the email. I'd asked them to delete my account 6 months ago, and they confirmed at the time they'd "deactivated" it. I guess that wasn't enough to protect me. As an American developer, GDPR seemed like a pain at first, but more and more I wish we had something similar.

</comment><comment><USER26> Disclosure on this was pretty bad. I got an email saying your password has been reset, if you didnt do this contact support.

Removed payment methods from my account and reset the password, but now I assume this was done to all users?

</comment><comment><USER49> I don't know a great deal about DoorDash, but my understanding is that they're only in the US. If so, they're not bound by the EU's GDPR data breach disclosure timescales, which are "without undue delay and, where feasible, not later than 72 hours" if they're likely to result in a high risk to the rights and freedoms of data subjects, which this seems to fit. Compare that with the apparent _five month_ delay here, with all its attendant risks to the customers whose data was made available. The EU has its flaws, but when I read stories like this I'm really happy I'm covered by GDPR.

</comment><comment><USER50> After using food delivery and takeout services, I felt the plastic waste it generates is incredible. All the folks that care even a little bit about the environment, please just get out of your homes and just dine-in. Silicon Valley startups just don't care about the environment, you can change that one person at a time.

</comment><comment><USER51> This was great to get an email about since doordash does not let users delete accounts. You can only 'deactivate' in a way that is easy to 'reactivate'. If I would have actually been allowed to delete my account many months ago when I asked maybe I wouldn't have had my information leaked.

<comment><USER52> My doordash got hacked a year ago when they did not have a special call center set up. I had no choice but to file a support ticket into the void (which was even more difficult since I did not have access to my account so I had to use a public contact form). I always suspected a breach since the account had a unique password and was only used on my personal phone which I was still in possession of. I wonder if they are just now getting around to disclosing that breach?

I did not hear back from support for 3 months (no exaggeration). I asked that they delete my account back then so you can imagine my delight to receive more security-related correspondence from this company today.

</comment></comment><comment><USER53> A 490 million dollar fine sounds reasonable. To be paid by giving each customer back $100.

</comment><comment><USER54> When the F are we going to hold people accountable for piss poor security posture.

</comment><comment><USER55> Is their password change function working? I can't seem to change my pw. It gets to SMS 2FA then appears to fail when I try to verify the token I'm sent and boots me back to the PW change page.

</comment><comment><USER56> I don't know what's more frustrating to read -- news of these seemingly constant data breaches or news that the latest Windows 10 Update just broke something else.

</comment><comment><USER57> Is there a list of all disclosed security breaches somewhere?

<comment><USER58> The best site I've used is haveibeenpwned.com, seems to be the go-to for most security breaches and has a tool that can notify you when some of your information has been compromised tied to an email address.

<comment><USER59> I don't like that because if you put in an email address it doesn't reveal whether you've already addressed the issue or not. It just shows if it was included in a breach, great for newbs to go "ooOOOooooOOoo" but useless for anything else.

I also alias email addresses for every service that allows a + sign in the email field, so now I have no way to notice quickly if the email was included in a leak. But I do have a way to know which service got breached or sold info if I start getting additional emails to any particular alias.

</comment></comment></comment><comment><USER18> A government created physical token for every person could be the direction we are headed

</comment><comment><USER60> Once again, the US is sorely lacking regulation w.r.t data breaches. In Europe the breach might have still happened but at least customers would have been told months earlier and there would be some predictable penalties for the companies. I also think that DoorDash would have been more transparent about the steps that lead up to this.

We need a US GDPR. Even if there's nothing like the right to be forgotten, we need data breach regs.

</comment><comment><USER61> Anyone know how this affects users that login via Facebook Auth with Doordash?

</comment><comment><USER62> There goes my private data; thanks doordash for the leak

</comment><comment><USER63> when will it become not ok to suck at this?

</comment><comment><USER64> >The breach happened on May 4

I don't believe for one second that they didn't know about it for five months! Can someone in the EU please report this so that it's investigated for a GDPR violation?

Edit: from the official post on blog.doordash.com:

>Earlier this month, we became aware of unusual activity involving a third- party service provider.

Of course. This is quite a bit more than the 72 hour window GDPR allows.

<comment><USER65> DoorDash doesn't operate in the EU, so I don't think they need to care about GDPR.

</comment></comment><comment><USER66> I attempted to purge my data from Doordash's servers. They refused, citing GDPR for some reason and saying the best they could do was to "deactivate" my account (while retaining my personal information).

</comment><comment><USER62> There goes my private data. Thank you DoorDash for the leak.

</comment><comment><USER67> Wow thats crazy

</comment><comment><USER68> Okay, this has been up for two whole hours, and no one has yet said "OMG, I think I'm going to lose my lunch over this!"

Get with it people! The jokes are right there.

</comment><comment><USER69> This kind of bugs and problems will open the eyes of companies to get on to blockchain. As a Blockchian enthusiast, i found it is best to store data on it. And in market many companies doing the same too. to fire more questions and query drop a mail on firstname.lastname@example.com</comment>


A sixth path towards the singularity? (response to Vernor Vinge) - <AUTHOR> http://neurocrank.blogspot.com/2008/06/sixth-path-towards-singularity.html

<comment><AUTHOR> Blogger/Blogspot is down half of the time ATM... Sorry about this.

Here's the full text :

Vernor Vinge recently reviewed various singularity scenarios advanced by experts in the field in the latest issue of the IEEE Spectrum magazine:

 _\- The AI Scenario: We create superhuman artificial intelligence (AI) in computers.

\- The IA Scenario: We enhance human intelligence through human-to-computer interfaces—that is, we achieve intelligence amplification (IA).

\- The Biomedical Scenario: We directly increase our intelligence by improving the neurological operation of our brains.

\- The Internet Scenario: Humanity, its networks, computers, and databases become sufficiently effective to be considered a superhuman being.

\- The Digital Gaia Scenario: The network of embedded microprocessors becomes sufficiently effective to be considered a superhuman being._

He gives lots of insights, but I think there's an option missing which has never discussed as far as I know. I already posted this as a comment on the journal page, but I think it's worth it's own entry.

Here's the idea: what would be the implications of using micro-electrode arrays currently used for BCI to implement direct, bidirectional brain to brain communication?

Since it has never been tried, even in animals, and since we have no idea if it could ever work, the following points are strictly speculative (yet not gratuitous, but very exciting as it's often the case with speculative stuff ;-).

Here are a few topics worth envisioning, assuming the feat is possible:

Technical issues.

\- Avoid triggering epilepsy because of the new neuronal circuits (duh...)

\- Where to put electrodes? A priori I'd put the arrays on the fronto-parietal associative networks of the convexity. Connecting medial (self related), or prefrontal, volitional structures could also be interresting, as would connecting together areas naturally unrelated to each other (even in a single brain, this could enable great synesthesia... yum!). \- Learning to communicate at a low level should't be problematic. The fundamental function of any cortical module is to communicate with another cortical module. I don't think that they would be affected by being located in different heads.

Ethical / transhuman issues.

\- Higher level cooperation: assuming that communication is really possible, would we become smarter or dumber? Would we be able to cooperate, or would it be distracting, disruptive, and in the end ineffective? Would we simply tolerate the process?

\- First person experience / phenomenal consciousness: Would we experience another person's perception/cognition? What about a non delusional influence syndrome?

\- Identity and individual self. Would this create a human "super-being", or two superhuman beings?

\- Trans-species, hybrid communication (assuming some animals are better than us at processing some kind of specialized information).

\- Developing a Brainternet? Could it be possible to scale B2B communication beyond a one to one setting, allowing global cognition?

... all of this assuming that the monkeys we'll use for preliminary experiments don't outsmart then extinguish us ...

 _runs away_

</comment><comment><USER2> This is just the IA scenario.

<comment><AUTHOR> IA is based on a hypothetical man-machine symbiosis, with direct brain to computer interfaces.

Here we tap into the power of other's people minds, and of what would happen if we could think collaboratively.

This is more of a mix between the IA and the internet scenario, except it's technically possible to implement it right now (ethical issues aside, of course).</comment></comment>


Douglas Crockford's review of The Little Schemer - <AUTHOR> http://www.amazon.com/review/RMRQUQPH2J4GB/ref=cm_cr_dp_perm?ie=UTF8&ASIN=0262560992 <comment><USER2> Nice review - I made the mistake of reading the 1 star reviews for the same book. Incredibly irritating. A book with goofy elephants, jelly stains and a ludic Socratic exposition is not everyone's cup of tea - I get that. But the fact that this book is read, reissued and somewhat relevant more than 30 yrs after its original writing deserves some consideration.

I think the most striking thing about this book is that it does not in any way require you to turn on the computer. It is a good exercise in this regard. I first read this a few years back and immediately thought that if I had to teach someone from scratch about programming I would use this first...

<comment><AUTHOR>
      > I think the most striking thing about this book is
        that it does not in any way require you to turn on the computer

YES! I love this about this series. If you're looking for something more challenging along these lines I can't recommend The Reasoned Schemer enough.

</comment></comment><comment><USER3> Also be sure to check out The Little JavaScripter if you haven't already seen it: <http://www.crockford.com/javascript/little.html>

It's an extension of this review and includes a toy Scheme REPL written in JS.

</comment><comment><USER4> Here's a scratchpad for the little schemer in Clojure I created while working through the book. I hope it helps anyone interested in reading it. [https://github.com/grinnbearit/theoretical- clojure/blob/mast...](https://github.com/grinnbearit/theoretical- clojure/blob/master/src/the_little_schemer.clj)</comment>


Echoedd.com - exchange of news, ideas, informations in general. No noise. Crazy? - <AUTHOR>

For the ones who do not prefer reading longer posts: please go to echoedd.com, check it out and tell me what you think. Thanks
For others that don't mind spending a few minutes on a, hopefully interesting, story...here it is:
I've made a system like a month ago, which would enable people to submit to and get the most interesting ideas, news, videos...etc...from the world (each city, country..would be included, big or small... Big dreams right?). I guess I could describe it as "Twitter (or even Facebook) without the noise...oh and it's location based". Up until now I was thinking whether I should publish it or not, but considering the fact that it's my b-day today (yeeehuu)...here it is (http://www.echoedd.com). Hopefully, someone will find it useful.
I'm embarrassed by the design, part of the code. and a few more things. I know, I know, not everything works, but it will - very soon, but even besides that feel free to be brutally honest and tell me what you think.
It's 6a.m. here. Time to go to bed...
Thanks.
Mladen @madmadjo (twitter) @max (echoedd) <comment><AUTHOR> My main post (to which I'm responding now) was actually written on 24. December, which I also spent by working on my little project. I just pasted it here, from notepad, but now it got some weird paragraphs.

Paul, fix this mate.

</comment><comment><USER2> Clickable: <http://www.echoedd.com></comment>


How to interview your interviewers when you're looking for a job - <AUTHOR> https://medium.freecodecamp.org/how-to-interview-your-interviewers-when-youre-looking-for-a-job-d848bc3a910 <comment><USER2> I get three sentences and: > Keep the story going. Sign up for an extra free read.

> You've completed your member preview for this month, but when you sign up > for a free Medium account, you get one more story.

Free code camp needs to charge for blog posts now? OR is this a medium thing and freecodecamp is not aware that this happens?

<comment><USER3> Medium. If you view in incognito mode or in mobile app then you wont see it.

<comment><USER2> That's sad - I wonder if freecodecamp even knows that some visitors will see this?

I would donate some server space and spin up a free wordpress for them to avoid this kind digital hostage taking.

<comment><USER3> They're probably one of Medium's biggest publications so I'd guess they're part of the Partner Program >> [https://help.medium.com/hc/en- us/articles/115011694187-Join-...](https://help.medium.com/hc/en- us/articles/115011694187-Join-Partner-Program)

</comment></comment></comment></comment><comment><USER3> > Are there any internal politics I need to watch out for?

This seems like an odd question to be asking in a final interview - which the author themselves says will most likely be with the founders.</comment>


Microsoft releases new all-in-one Office app for iOS and Android - <AUTHOR> https://arstechnica.com/gadgets/2020/02/microsoft-releases-new-all-in-one-office-app-for-ios-and-android/ <comment><USER2> And parts of it are written in React Native which positively adds to the recent RN conversation.

</comment><comment><USER3> Used it also while in beta. Pretty stable and fast (on Android). Thumbs up to all the MS team</comment>


Ask HN: Where/how to get more pre-regs for free WP hosting service? - <AUTHOR> We just started taking pre-regs for WebPub - a free WordPress hosting service:
http://WebPub.online
Obviously, the primary driver of our business model is the volume of free users, so we're looking to set the ball rolling with pre-regs.
I submitted the URL here yesterday which did not pickup any upvotes but the logs showed some 31 visits from here of which, 4 registered (thank you guys - and gal).
While we continue working on identifying avenues to announce/promote WebPub, I'd highly appreciate any feedback/suggestions from all here.
Thanks. <comment><USER2> How do you plan on generating revenue to keep something like this running? I can't imagine anybody would be that interested in free hosting if they can't even be confident it will be around in 6 months. What makes your service worth the risk?

<comment><AUTHOR> Thanks for your feedback. Actually, I'm not the one who is offering this. WebPub is a startup launched by a group of seasoned IT entrepreneurs with a combined industry experience of 70+ years. (I am a consultant there.)

The company is adequately funded with multiple revenue streams planned for the long run.

</comment></comment><comment><AUTHOR> Nothing? Nothing at all?</comment>


Apple reportedly launching subscription news service - <AUTHOR> https://www.theverge.com/2018/4/17/17246332/apple-news-subscription-service-rumors <comment><AUTHOR> See: [https://news.ycombinator.com/item?id=16865872](https://news.ycombinator.com/item?id=16865872)</comment>


A First Foray into Kubernetes - <AUTHOR> http://dev-blog.xoom.com/2015/05/06/first-foray-kubernetes/

<comment><USER2> My experience is similar. The Kubernetes community is really helpful and active on IRC. Getting started is a matter of hours, not days. The Kismatic packages are a big part of making that easy.

<comment><AUTHOR> Thanks @glibgil we want to make sure that the Kubernetes community continues to grow and blossoms.

</comment></comment><comment><USER3> I really like that Xoom is taking a phased approach with their service discovery model and not completely throwing out ZK right away. Shows that you can gradually bring Kubernetes into your environment without needing to re- think the entire stack, thanks to K8S's modular and extensible design.</comment>


Advice for Successful Dieting - <AUTHOR> http://dalethoughts.com/2012/02/advice-for-successful-dieting/

<comment><USER2> There really is no secret to losing weight. It's very simple: eat less, exercise more.

The food being served in developed countries are highly processed, and make us very prone to gaining weight. Highly processed carbs turn into blood sugar very easily, and if you live a sedentary lifestyle, like most of us, then that blood sugar gets turned into body fat. It's very basic biochemistry. The reason why we are eating highly-processed carbs is because food manufacturers get a high profit margin from feeding us from pre-processed food rather than original ingredients.

If you want to lose weight, the key is to either burn the blood sugar by exercising, or by denying your body the blood sugar in the first place, through a low-highly-processed carb diet.

But what that entails is rejecting the current 21st century lifestyle of eating quick, convenient meals, and working so much that you spend your entire life in front of a computer. You really need to change your lifestyle in order to lose weight and have a healthier body.

I spent several years working and doing nothing after college and gaining massive weight (over 50 lbs). About 8 years ago, I decided to lose weight, and just by exercising and eating marginally less, I went down down about 20 lbs. But the vast amount of my weight loss came when I did the South Beach diet, and lost another 30 lbs. That's when I realized how terrible highly processed carbs are.

I kept that weight off for about 3 years, until I started focusing on side projects and working about 16 hrs a day in total. I stopped exercising completely for the last 3 years and since then, I've gained back about 20 lbs.

My goal this year is to lose those 20 lbs (actually in the next 4 months, fingers crossed), and to work less. I've already started cooking the majority of our meals, and having complete control of the ingredients helps a lot.

<comment><AUTHOR> Congratulations on your weight loss. I agree, the basic formula is simple. However, there are definitely some behaviors and environments that are more conducive to eating less.

Same thing with exercise. There are some environments that lead to more exercise. When I studied abroad in France, I lost a lot of weight because I walked everywhere and ate less overall.

Good luck with your last 20 pounds!

</comment></comment><comment><USER3> +1 on everything on the post. I lost 17 kg on the paleo diet( net loss, as I have gained a fair amount of muscle following gymnastic bodies WODs), but it's sometimes difficult to follow when you are traveling a lot, as I do. You don't realize how the vast majority of food you find on bars, cafeteria and restaurants is based on wheat or sugar till you try to avoid them!

Since january i am following a semipaleo Lean gains diet( semi paleo in the sense that I mostly avoid grains and sugar, but drink some milk or have some pasta or a cookie every now and then). I had regained some 4 kgs before chrismas due to really poor diet( only 3 months that I didn't take care of the diet and ...bam!). Now I've managed to lose 2 kgs and improved strenght(only cardio is 15 min once or twice a week as active recovery). Definetely experiencing a nice body recomposition... Lets see if I can get to 10% body fat this way...( now I am more on the 20% :/

</comment><comment><USER4> Some good tips here, thanks. Shameless plug to follow..

For me I've just started back up on the diet thing but I use a gadget called a fitbit to help me. I did this a couple years back and it worked really well. Basically the fitbit (an internet connected pedometer basically) logs all my steps and calories burned during the day and I log the food I eat and as long as I keep burning more then I eat weight loss! Have already lost about 2 1/2 lbs since I started back up on this a week ago.

Ok now the shameless plug.. I'm running a contest on youtube right now sponsored by fitbit if anyone wants to win one: <http://www.youtube.com/watch?v=5cWEn0RF3-Q>

<comment><USER5> Yeah fitbit is great. If you follow a calorie counting diet it helps you by adjusting the allowed amount of calories based on how much you move. It is also an amazing motivator to get off your butt.

</comment></comment><comment><USER6> I would add that you need to be realistic about what is possible. Realize you can easily fluctuate your weight plus or minus ten pounds. A pound of water isn't very much, and your body's glycogen stores plus water can amount to 5-10 pounds. So low carb dieting will lead to weight loss of that much very quickly as you use this up.

Don't succumb, like this article does, by treating this as meaningful or sustainable. Realistically, a pound of fat loss in a week is extremely good, and amounts to a 3500 Calorie deficit. Most people can't do much better than this without quite extreme measures, so you can not get demotivated when a 5-10 pound loss in the first week doesn't continue.

<comment><AUTHOR> Yea the water weight with low carb diets is significant. With cheat days on slow carb diet I'd usually gain back anywhere between 3-5 pounds.

I find that I generally feel better overall when I eat less carbs. My advice, however, is applicable to whatever diet you choose.

</comment></comment><comment><USER7> > 3\. Your environment is stronger than your willpower.

False.

I lost 30kg last year and this article goes against mant things I learned during this process.

Losing weight is all about willpower. People are solving the wrong problem. Instead of trying to find the perfect diet you should be trying to increase your willpower.

Felling hungry is inevitable, sure you can eat veggies until you are bloated (like the article suggest) but you will still fell hungry when you see someone eating a pizza.

<comment><AUTHOR> That's great you lost 30 kg.

>Felling hungry is inevitable, sure you can eat veggies until you are bloated (like the article suggest) but you will still fell hungry when you see someone eating a pizza.

The idea is that when you get a pizza craving from someone eating pizza, you're in an environment where you don't have pizza available to you.

What kind of things did you learn when you lost all your weight?

</comment></comment><comment><USER8> Best book on fat loss and getting ripped is Tom Venuto's "Burn the Fat, Feed the Muscle" - <http://www.burnthefat.com>

It's around 500 pages, but once you read it, you'll never have to read another book diet/nutrition. This book, and the title, explains it all.

<comment><USER5> Yuk, this page hit me with a "don't leave this page" alert when I closed the window. A good book will sell itself.

</comment></comment><comment><USER9> I posted this a while back:

Eat Like A Caveman To Lose Weight

<http://www.medicalnewstoday.com/articles/237563.php>

It's obvious, but missing from the title is the fact you also need to add exercise.

</comment><comment><USER10> What an interesting article! I want to try this one. I really want to lose some pounds. Im on calorie counting recently but sometimes I am not in the mood to list all the food I ate for a day. I hope this will help me. I want to lose 20 to 40 pounds before the year ends.

<comment><AUTHOR> Yea calorie counting is a pain. Which diet were you thinking about trying? Slow carb or intermittent fasting?

<comment><USER10> I think I would try the slow carb, it looks interesting to me. I hope this will be effective to me.

<comment><AUTHOR> Awesome. I look forward to hearing how you like it.</comment></comment></comment></comment>


Avoid CloudAtCost - <AUTHOR>

I found the following email in my inbox today:
http://pastebin.com/gKfpWiWN
Note the following:
I never received the original initial email about this emergency maintainance. I doubt they actually sent that. I have a couple of accounts and none of them received the initial email.
Promising 'we will never have an outage again moving forward' is a dangerous thing to say for a company that deletes daily cronjobs from their clients servers because the disk IO that the daily jobs generate result in kernel panics or read-only remount of your VPS fileystems. (Is this a fix for that issue? Who knows .. communication is not their best skill)
So even though these folks run VMWare, which is perfectly capable of migrating VMs or simply suspending and resuming VMs, they decide to POWER OFF your VMs and tell you via email that you can MANUALLY turn then back on.
I know I can't complain because I paid $35 for a lifetime server and you get what you pay for. But seriously, this is all so incredibly amateur hour. <comment><USER2> Other than that, is the server good ?</comment>


Ask HN: Please review our startup Euraeka.com - <AUTHOR>

Euraeka.com is an artificial intelligence search discovery and recommendation engine for news. The site is entirely algorithmic but its ranking mechanisms are based on human preferences. Euraeka uses a massive machine learning model trained on the preferences of million of users about what news are worth reading. However, it also includes objective metrics of content quality based on natural language processing. The objective metrics are used to dampen down the propensity of the crowd to get swayed too much over controversial fads. In fact, we can measure controversial topics directly and you can use the sorting mechanism to get Controversial, Engaging or Popular news. One of the most important features of Euraeka is its deception detection mechanism. Again, using natural language processing techniques the site can detect deceptive intent in news articles. We think this feature is something long overdue in the news market - i.e. a barometer of lying essentially. Along the same lines the site can also detect political bias in news (liberal/conservative). Finally, the site also can learn a user's preferences and will recommend news based on those preferences. Any feedback on features or user interface will be appreciated. More detailed info available at http://www,euraeka.com/faq <comment><USER4> Where do you get this data on millions of users?

The name is impossible to spell.

The misleading, engaging, etc filters are interesting, but kind of hand-wavy. It's not apparent why and how "Miami Heat's Dwyane Wade sues ex-business partner for libel" or "The SEVEN SECRETS of SMART PARENTS" are "misleading" (and compared to what?).

You need an information/interaction designer to go over the site and make the important things important. Right now nothing really catches the eye.

on /faq: " _ulterior_ motives", not "alterior"

Good luck!

<comment><AUTHOR> We've nee collecting top rated news from Yahoo News, NYT, Washington Post, etc for the last 3 years. Almost all major sources have sections "Most viewed", "most read", "most email" etc. So as we have been collecting the top ranked news we also kept track of topics that have been top ranked at multiple sources. For instance, if a news article on Iran's riot gets to the top ranked in both NYT and Yahoo News it gets more points in our training set.

As far as your other point, Misleading is really a less legally loaded word than "deceptive". You are right, it's not very clear why the articles are misleading but the bottom line is that the language used in the article has high "deception markers" that other articles from the day. So when you sort by Misleading, it's not really that the article is beyond a doubt deceptive, it's just the ones with higher rate of deception markers (i.e. content and structural indicators associated with deception). The science behind is pretty solid and comes from forensic psychiatry - i.e. interviews/interrogations with criminals and analyzing their statements for deception hints. So for alack of a better term Euraeka essentially implements a linguistic polygraph. Thanks for the other comments, we'll work on fixing the issues.

<comment><USER4> Are you conflating/clustering articles? ie what constitutes the "same story" in your system?

Those "most viewed", etc boxes are often placed by editors, not by impartial algorithms. How do you control for that?

<comment><AUTHOR> Yes, we definitely have clustering. In fact, it's more extensive than simple word distances like cosine b/c we also take into account synonyms and word relationships (set membership, etc). For instance, in our system sentences like "Tiger chases antilope down the river" is very closely "related" to the sentence "Lion is pursuing a buffalo by the lake" b/c both sentences essentially say that a large cat is pursuing a prey of bovine origin near a water source. In terms of the "most viewed" and how we control for that - <USER2> I said we cross-track news on multiple news sites and weight the cross posted one more often. We also cross-validated the most important tags for an article by using Google Trends data. Basically we tracked topics on multiple sites and then performed some statistical analysis to see how those topics did over time based on their presence on the web (topic momentum and longevity). We also run a partial search engine in house that crawls a subset of the web so we can ensure that the numbers we get from Google/Yahoo are legit. Finally, there is linguistic theory of topic popularity and how memes propagate over time. We use some of that theory to control for the crowd effect - i.e. sometimes people pick up and spread topics that are of no real importance to the world. Example: Paris Hilton's latest escapades may be widely discussed online and appear important news but the latest report on the recession estimates and projections is of much higher "impact" to society. So we try to account/estimate some of that "impact". Combining all factors gives an article a composite score. No two article really have the same score but a lot of articles cluster close to each other in terms of their "importance" cores. We fed the articles in a machine learning algorithm that is a combination of Support Vector Machine, Neural Network, and Naive Bayes and when a new article is fetched by our crawler the model "preditc" its various scores (controversial, engaging, popular) based on the data set that it has already learned. Deception detection is much trickier and is almost entirely analysis based - i.e. no machine learning there. There is quite a bit of research on deception detection published online. Just search google for "deception detection ext:pdf" and it will come back with a lot of results.

</comment></comment></comment></comment><comment><USER5> I think the concept is very intriguing and if what you say is what is on your site and you have actually made it by collecting all the information in the last 3 years from all the major news websites, I think you will end up being bought pretty soon. Rather, what you should do is patent your process asap, if you haven't done it already and then license it. Amazing and good luck.

<comment><AUTHOR> The patent application is in the works. As far as the the data set - <USER3> definitely have it. In fact we were thinking of releasing it under some type of open license (i.e. creative commons) after the site gets some traction. In terms of search engines - we ARE in fact a search engine. Just type something in the box at the top and you can also use the available 4 score to filter rank search results. So the search works just like google but you get to sort the results by Controversial, Popular, Engaging, and Deceptive. Some pretty interesting combinations can be created using the scores. Like for instance, you can search for "paris hilton" but you are interested in her scandalous "achievements" rather than her community work. Well, then you search for "paris hilton" and sort by Controversial. Google can't give you that - i.e. sort results based on what impact are they likely to have on people. Thanks for suggestions!

<comment><USER5> I tried it for a couple of keywords with different ways of sorting and it seems to be working great.

My personal feedback for this would be: to make it sticky you need to have something similar to what google news webpage looks like and have 3 sections (controversial, popular, engaging) in every section. And then you should have similar features (keyword news and number of news article in every section) and I will make it my homepage, no kidding. Currently, you are not utilizing the complete web space very efficiently.

<comment><AUTHOR> Yes, this is what we were thinking of having eventually - separate sections based on score. The current design is something we threw together very quickly to get it out of the door. Btw, the article tags are clickable and run a search for that tag in the background. Also, you can filter news by domain. As we accumulate more data, we can start ranking domains based on the articles they have produced so far. Kinda like PageRank but not based on links. Finally, the algorithm can guess authoriship and cluster articles based on author as well. So again, we can rank authors/people after some time. This seems to be a much needed feature as this links discusses: [http://threeminds.organic.com/2009/06/docs_are_old- school_we...](http://threeminds.organic.com/2009/06/docs_are_old- school_we_need_pa.html)

I think the above article came up on HN today.

</comment></comment></comment></comment><comment><USER6> Just wanted to say thanks for the comments. We've worked hard on this, and there's obviously still a ways to go....but we definitely appreciate the constructive criticism, and the time taken to reply.

jack

</comment><comment><USER5> Another point I want to add, is if this is possible, your algorithm should definitely be added into any search engine page rank system to not only get rid of click fraud but also improve the searches.</comment>


Is Ember Data just unfinished or fundamentally broken? - <AUTHOR> http://nragaz.com/post/41076138457/is-ember-data-just-unfinished-or-fundamentally-broken

<comment><USER2> If Ember-Data isn't ready for production, and Ember is, then why is it in the documentation on <http://emberjs.com>? Either it's ready to be used, and can go in the official guides, or it isn't, and the guides should recommend something that is ready to use.

<comment><AUTHOR> That's my feeling too - I've gotten a number of responses to the effect of "well, there hasn't been a release" but the official line at conferences, talks, and in the documentation is "this is the way to use Ember" so I think that's a distinction without a difference.

</comment></comment><comment><USER3> I'm facing a similar situation, and my big question is: What's the alternative? Do I just roll my own REST layer on top of basic Ember objects or has someone figured out a working alternative?

<comment><USER4> ember-rest and ember-resource are two much simpler alternatives.

However, neither has the ambition or potential power of ember-data. Transactions are becoming better defined, it's possible to attach a model to a transaction much like you said and to commit that transaction independently of any default transaction.

Ever other library I've looked at for this, and the roll-your-own solution would require that you implement hacks like cloning an existing model before editing, and won't actually gain you much.

Another thing to consider, while the adapter is called the RESTAdapter, it is tightly coupled with a particular way of using Rails models. And unfortunately, at least when I was considering this approach, replacing it gets you back to the "roll-your-own" solution, so much of the state management logic was actually in the RESTAdapter that using a different way to pack multiple models required reimplementing it.

It would be nice if the store would support an API that can update a model offline, or create a savable copy in a transaction, or handle a type of master-master synchronization when connection was restored. It has definately improved and the vision seems to be getting more concrete.

</comment></comment><comment><USER5> Certainly unfinished. Unlike Ember, Data hasn't had any releases. There's a reason for this. We don't think it's stable enough to recommend to anyone unwilling to do some hacking.

<comment><AUTHOR> For sure. To that end, I spend a lot of time reviewing issues and contributing as best I can. From what I've seen, though, I'm not sure if it's even capable of being finished in a way that makes sense.

<comment><USER5> I'm pretty confident in Yehuda and Tom's ability to figure things out. It's a very difficult problem to solve, as evidenced by the slow pace of progress, but I think it is a solvable one.</comment></comment></comment>


AWS Announces Microsoft Active Directory Single Sign On Services - <AUTHOR> https://aws.amazon.com/blogs/apn/active-directory-single-sign-on-sso-on-aws-with-bitium/?adbsc=social_blogs_20151208_56104456&adbid=916314751739224&adbpl=fb&adbpr=153063591397681 <comment><USER2> The title is misleading, this is not an AWS announcement nor is it an AWS offering.

</comment><comment><USER3> How is this new? AWS having SAML 2.0 support is old news being demonstrated at no less than two ReInvent conferences.</comment>


AT&T takes the phone out of iPhone - <AUTHOR> http://news.cnet.com/8301-27080_3-10358156-245.html

<comment><USER2> Realizing of course that there are any number of factors that could cause a difference...

...I've never had problems with with AT&T's network here in Rochester, NY. The calls sound very good, I have generally good reception everywhere and I get a dropped call maybe once every week or two - not out of the norm for any cell phone I've used.

I am pissed at AT&T for other reasons - when I went to PAX a few weeks ago the data network basically crashed and a voicemail I received didn't come in until _Tuesday_ when I connected in JFK, the MMS/tethering debacle, the plan pricing.

But the quality of their network here is something I can't actually complain about.

(It seems like I see _tons_ of iPhones out and about, so I don't think it's that we have a lesser percentage of iPhone users than other areas. Maybe we're just spread out more or have a better tower/phone ratio than more densely packed areas?)

<comment><USER3> That seems to be it. If you approach any area sufficiently dense with geeks/gadget fiends, permanent or temporary, the actual data use by iPhones strangles AT&Ts network.

Looks, walks and quacks like a classic case of oversold capacity.

My first year with the 3G was an experience like yours: network problems were something other people complained about. But in the last 4 or 5 months, my experience has quickly and notably nosedived.

<comment><USER4> I'm really interested to see how other networks keep up with iphone's notorious data usage in the coming year.

Then we'll really see whether it's ATT being incompetent or if this device truly was a paradigm shift (sorry) in how people are using their phones which threw everyone (and their networks) for a loop.

</comment></comment></comment><comment><USER5> I'm pretty close to dropping my iPhone for something else soon. I love the phone itself. Minus a few bugs here and there its the best phone I have ever used and likely the best on the market. But AT&T is a joke. Anywhere with high density population and your phone seizes to function. I'm in Manhattan. I often wait 2 hrs for voicemail and texts and about 6 out of 10 calls end in a drop. Outside of NY my phone works much better. Internet seems to be 3x faster and no dropped calls. I'm close to leaving and returning to Verizon. iPhone: An expensive paper weight.

</comment><comment><USER4> Why is she talking about her boyfriend and polling her friends on facebook?

Is this a blog entry or a news story?

<comment><USER6> I agree. Is seems a bit underhanded that the journalist used her job to punish the cell phone company she's angry at. If she really wants to get back at them, she needs to prove her case with hard data and not circumstantial evidence.

</comment></comment><comment><AUTHOR> Yeah same. It drops quite a bit in the Los Angeles area. Wonder if this is a big city problem? =)

</comment><comment><USER7> Neither my wife or myself have been able to keep a single call up for an entire conversation here in Chicago. This includes downtown, north side, by the lake, etc. Conversations from iPhone -> iPhone are always garbled.

</comment><comment><USER8> To make it worse... my Iphone now has 'Coma Modes'. This is a GREAT toy...but a horrible phone. My Nokia might have had only snake, but it NEVER dropped a call.</comment>


Game theoretic illustration of speculative bubbles - <AUTHOR> http://theincidentaleconomist.com/asset-bubbles-and-the-whats-23-of-the-average-game/

<comment><USER2> This article suggest speculation can be seen as a constant-sum game, similar to a poker game. People know the only money they make is at the expense of someone else. People who enter the market as investors (as opposed to speculators) get thus ripped off by speculators, because they don't always know they are taking part to the game.</comment>


Hey HN: My quick-n-dirty Sunday "fun-day" project: crashmybrowser.com - <AUTHOR> http://crashmybrowser.com

<comment><USER2> Running only one test only ties up one CPU. (Chrome 6.0.472.63, mac osx 10.6)

I'm posting this while running the infinite loop. Just killed the tab, alls fine. Same with fork bomb.

Heap death didn't do anything

Frog blast got the tab's ram up to 900MB (I've got 4GB, so it didn't even hit swap) and then died. The tab was still running fine. Not sure why it dies.

Element overflow just pushed the CPU up to 100%. Core 2 Duo is having no problems still functioning. The joy of multicore.

For the record. My browser has not crashed. The worst that happened was that the tab became non responsive and it tied up one CPU. As such, running multiple tests at once isn't really working, as the page doesn't respond.

Interesting site though. I like it.

<comment><AUTHOR> Thanks for the info -- I want to update it later with results from others. One quick question: can you open up the error console and see if the browser stays on its feet? The "frog blast" seems to trigger a crash once the error console is opened on FF/Safari.

<comment><USER2> I somehow got frog blast to run twice. Closing the tab only killed one of them, and I got a "the following pages are non-responsive: Kill/Wait" dialogue with no pages listed. When I chose wait, it still tied up one CPU. When I chose Kill it killed the rogue mystery process

</comment></comment></comment><comment><AUTHOR> So, if you decide to try any of the "tests", let me know how it goes. I've played around with them in Firefox and Webkit so far, with some occasionally really gnarly results.

I'm trying to agitate for some sanity in the way Firefox and Safari especially handle tabs and resources; figured a good way to do that is to demonstrate why they need work.

Someday soon-ish I'll add some clickable information about the various tests.</comment>


Show HN: Create a chiptune from your Git contributions graph with Web Audio API - <AUTHOR> https://github.com/johnBartos/contributions-chiptune <comment><USER2> Reminds me of the Anthem spreadsheet software in Douglas Adams' novel, Dirk Gently's Holistic Detective Agency:

"But the silliest feature of all was that if you wanted your company accounts represented as a piece of music, it could do that as well. Well, I thought it was silly. The corporate world went bananas over it."

"The yearly accounts of most British companies emerged sounding like the Dead March from Saul, but in Japan they went for it like a pack of rats. It produced lots of cheery company anthems that started well, but if you were going to criticise you'd probably say that they tended to get a bit loud and squeaky at the end. Did spectacular business in the States, which was the main thing, commercially."

</comment><comment><USER3> Super cool idea but I tried a few profiles, they all pretty much sounded the same. Maybe needs a bit of randomness with the username as a seed or something.

<comment><AUTHOR> The problem is one in the same with volume: identical frequencies in the same week result in constructive interference leading to a louder tone, which drowns out the others. I need to set the gain such that the max for any one frequency is 0.1 per week.

I agree it could use some randomness. To maintain harmony, however, I've made each note a perfect 5th of eachother. Maybe I could adjust the ratio to make perfect Nths instead.

</comment></comment><comment><USER4> Love it! I agree though, it needs some more factors to make various Githubs different.

</comment><comment><USER5> ignore the warning about lowering the volume at your own risk.

<comment><AUTHOR> Sorry! I set the gain to 1/10th of default but if several of the same tones are being played at once it's a bit loud. What I should do is reduce the gain on each subsequent oscillator of the same tone.</comment></comment>


The Game Of Go: A Programmer's Perspective - <AUTHOR> http://needforair.com/blog/2012/04/18/game-of-go/

<comment><USER2> This article also illustrates how important it is as a researcher to publicize yourself well. Mogo really only had a very small part in the breakthroughs that were made. Yet it is heralded in every such article as the bot that made it all happen.

For those that are curious what happened, there are some seminal references:

Monte Carlo Go. Bernd Brügmann - This introduced the basic idea.

Monte-Carlo Go Developments. Bruno Bouzy - Bouzy is the guy that kept hammering at the original Brügmann idea while everyone else thought it was a dead end.

Efficient Selectivity and Backup Operators in Monte-Carlo Tree Search. Remi Coulom - This was really _the_ breakthrough paper, that showed how to combine Monte Carlo simulations with a tree search. Was also the first MC bot to win the gold medals.

Mogo replaced the ad-hock operators in the last paper with an algorithm with more mathematical grounding (UCT). Even though the name is now very well known, most top Go programs, including the last research published about Mogo, actually already dropped the idea and went back to more ad-hock formulas again.

The article also makes the common mistake that the position is evaluated using random games. Calling them random is quite misleading. It seems to be necessary to include some knowledge in them, but too much knowledge hurts the strength again - regardless of any speed impact. It's an open problem to fundamentally understand exactly what kind of knowledge helps the program to actually play stronger.

What happened in Go is also a nice illustration that if you want to make a computer good at an AI task, the key is finding an algorithm that approximately-linearly improves with the computing power you throw at it. If you do this, you crack the wall. Algorithmic and hardware improvements will do the rest in the years to come.

<comment><USER3> Just for fun, I wrapped those three papers and a Gelly UCT paper up in a zip file, in case anybody wants to read them: <http://dl.dropbox.com/u/25636/go_papers.zip>

</comment></comment><comment><USER4> I worked on UCT-based (one-arm bandit algorithm) go players for 3 semesters. It was truly a great, if often frustrating, experience.

It's a tough problem to get your head around. Sure, the premise makes sense- that the Monte Carlo heuristic plus the UCT tree-exploration algorithm balances promising nodes with uncertain ones to intelligently expand the tree. But tweaking that algorithm usually hurt performance more than helped, and the tweaks that did improve gameplay were non-intuitive.

One semester our goal was to improve the random-playout generator to play slightly more human-like games. It turns out that almost any play enhancements made in the Monte Carlo simulator crippled performance (for instance: instead of playing randomly, search the board for an opportunity to capture the opponent). The best result we had was achieved by applying the capture-if- possible heuristic on only two positions per random move (ex: at the beginning of the MC-simulator's move, pick two positions randomly- if moving in either one captures the opponent, do it). Applying that heuristic on any more than 2 positions per move made the random games play out more slowly than it was worth. Needless to say, a lot of time was spent testing our tweaks (which itself was quite time consuming).

It was frustrating to see our initial seemingly sensible tweaks cripple performance, and it definitely took some time to calibrate ourselves to the problem at hand. But I probably learned more about programming while working on Go than in any other 3-semester span.

Peter Drake's Orego player is a great starting point for exploring the UCT algorithm (Peter Drake wrote a popular Java textbook you may have used in undergrad). I highly encourage people interested in AI to check it out:

<https://sites.google.com/site/drpeterdrake/research/orego>

<comment><USER5> I'm confused as to why you would want to capture. My understanding is that pro players try to avoid having to actually capture unless necessary. (I.e. if they are winning a capturing race then the right move is always to tenuki unless the other player does something that demands a response.)

<comment><USER4> Real-life tactics unfortunately don't make for good heuristics in the Monte Carlo simulator.

Our goal was to improve overall gameplay by making the Monte Carlo simulator play slightly more realistically than random. Keep in mind that when the Monte Carlo simulator plays completely random games, it still does pretty good. I believe it's on par with GnuGo, a good pre-UCT go player, on a 9x9 board on a modern quad-core.

Whether a heuristic applied within the MC-simulator generates sample games that better assess the strength of a move is a tricky question to ponder. But it seems reasonable that most non-random tactics, however simple, would accomplish that (such as proximity- or capture-based tactics).

The reason that good real-life tactics do not correlate with improved gameplay when implemented in MC-simulators is because the logic required for even simple tactics can reduce the number of semi-random games the computer can play by several orders of magnitude. Picking a random move is extremely quick (choosing a number with a Mersenne Twister is faster than adding two numbers- compare that to the operations required to determine how many pieces surround a given position). That's partly why very simple heuristics like capture-if- possible are only effective if they're applied on a few (2, in our case) open board positions per move in a MC-simulated game. So its just slightly non- random.

Anyway I hope that made sense. It's a weird problem to think about at first, but it's actually really fun to play around with. I recommend checking out Drake's implementation.

<comment><USER6> Choosing a number with a MT is not faster than adding two numbers (which can typically be done in a single cycle).

<comment><USER4> Yeah that might have been an exaggeration. But as I recall, once you have the MT seeded and fired up, getting a new number requires little more than a bit shift. Anyway it was substantially faster than simple alternatives I tried (including other PRNGs). One early theory I had was that using a faster PRNG than MT could lead to a better result even if it wasn't as evenly distributed. I think MT proved to be the best solution though.

</comment></comment></comment></comment></comment><comment><USER7> For what it's worth, I wrote a similar post recently that some might find interesting:

[http://blog.printf.net/articles/2012/02/23/computers-are- ver...](http://blog.printf.net/articles/2012/02/23/computers-are-very-good-at- the-game-of-go)

<comment><USER8> Good post, and I agree: it is a little sad to see the game cracked in a way that sheds so little light on human cognition.

</comment></comment><comment><USER9> MoGo beats 5d KGS now? Kind of depressing if true, this day felt much longer off half a decade ago... But I won't believe it until I see a few of these games as they are played myself :)

<comment><USER10> Zen beat Takemiya Masaki a few weeks ago in a non-blitz two-game match at five and four stones. It didn't even use an excessive amount of hardware, just a couple of boxes:

[http://gogameguru.com/zen-computer-go-program-beats- takemiya...](http://gogameguru.com/zen-computer-go-program-beats-takemiya- masaki-4-stones/)

<comment><USER11> Actually, the author considers them to be a blitz game.. [http://gogameguru.com/zen-computer-go-program-beats- takemiya...](http://gogameguru.com/zen-computer-go-program-beats-takemiya- masaki-4-stones/#comment-3856)

<comment><USER10> Fair enough. I'd call it a "quick" game, analogous to quick games in chess. It was 25 minutes of main time and 5x30 sec byo-yomi periods, IIRC.

Not the kind of blitz people play on KGS, at least.

<comment><USER12> Go often takes a lot more moves (~300+) to finish than chess. 25min per player / 150 moves = 10 seconds a move per player.

Compared to ~40 in a chess game would be 2 min per side / 20 moves = 10 seconds a move. (<http://www.chessgames.com/chessstats.html>)

<comment><USER3> A game with 5x30 sec byo-yomi could take quite a bit longer than the 25 minutes free time, so that's not a good comparison.

<https://en.wikipedia.org/wiki/Byoyomi>

After the 25 is up, each player can make as many moves in 30 seconds as they'd like, the 5 means that they can overstep that bound 5 times (by 30 second increments).

</comment></comment></comment></comment></comment></comment><comment><USER13> I love the game of "Go" -- it's so strategic and it's particularly difficult when you're playing against a human. The mobile app I have for it is okay, but not great, probably due to the issues regarding algorithmic complexity. In fact, I like it a bit more than chess.

I urge anyone to try it.

<comment><USER14> One of my best friends is extremely well ranked at chess (his highest ELO was ~2200, he was in France's top 20 of his age group when we were in high school), and has a marked disdain for go.

Any players well versed in the two games care to expound on any key differences in terms of strategy/balance between the two?

<comment><USER10> I'm of moderate strength at both, being a chess expert and a 1d-1k KGS. Some brief comments:

\- Go makes me confront my fear of heuristics. My unconscious ability to pattern match the right moves is always ahead of my ability to understand why they are right, although I try to catch it up by thinking really hard. It's a unique experience.

\- Both the rules and strategy of Go feel more elegant in the mathematical sense of being a composition of simple ideas, which I like. Chess feels more like a set of arbitrary pieces of knowledge.

\- The handicap system in Go is an objectively awesome way to have players of different strengths play competitively. In chess, you can almost never play with someone 400 rating points your inferior and have it be a satisfyingly competitive game -- giving piece or pawn odds changes the game completely. In Go, if you give someone four stones, it feels like you're still playing Go.

\- When watching strong players, I like the fact that there aren't draws in Go. It makes the game dramatic until the end.

\- I like chess problems better than Go problems, and I personally find a level of beauty and variety in amazing chess brilliancies which surpasses what I perceive in great Go moves. I don't know of a Go equivalent to <http://timkr.home.xs4all.nl/chess/chess.html>.

\- At least at an amateur level, it's harder to make a critical, near- irrecoverable mistake in Go -- there's not as much of a snowball effect making an advantage into a bigger advantage. That makes it feel less stressful for me when playing long games.

<comment><USER15> Go problems feel super compelling to me. Typical problems can be boring "counting" exercises, but I find it hard to beat something like the ear reddening move: <http://senseis.xmp.net/?EarReddeningMove>

There is a great series on youtube on fantastic moves from professional games with commentary in English: [http://www.youtube.com/watch?v=CJ9Oexs59CE&feature=relmf...](http://www.youtube.com/watch?v=CJ9Oexs59CE&feature=relmfu)

They are really beautiful in part because they become tesuji through a confluence of factors that reverberate across the entire board. It can be hard to see for amateurs (including me) but once you give them the right context and insight, they become startlingly brilliant.

Also, it's interesting you find it hard to make a critical mistake in Go - this feels very common to me. For example, a decision like deciding to defend a group instead of sacrificing it (which comes up all the time) often snowballs really quickly.

<comment><USER10> _Also, it's interesting you find it hard to make a critical mistake in Go - this feels very common to me. For example, a decision like deciding to defend a group instead of sacrificing it (which comes up all the time) often snowballs really quickly._

I do that too, but you have a lot of room to back out before your one mistake becomes a losing mistake. If I neglect a group inappropriately, and then make it heavy, and then try desperately to defend it, and eventually fail to survive with no compensation, that's a lot of mistakes; and I usually could have chosen to stop and cut my losses for quite a while before it came fatal.

In chess, you can have long sequences in the midgame and endgame when the game is on a fine tactical balance, and one not-obviously-awful, ill-considered move can either put you in an immediately resignable state or make you spend the rest of the game fighting on the brink of defeat, trying to draw. And that's not really a style of play you can opt out of if your opponent chooses it.

</comment></comment></comment></comment></comment><comment><USER16> I learnt Go by watching this anime on Netflix called 'Hikaru no Go'. Its pretty kiddish, but fun, and really inspires you to learn the game!

</comment><comment><USER17> That's a really fascinating peek at the methods used! I love that they use multi-armed bandit models and that they built a heuristic that wins partly because it's highly parallelizable. This is how you beat a human mind.

</comment><comment><USER18> This seems like a really interesting area of research. As far as I can tell from my (limited) background on chess/go/etc algorithms, they seem to include lots of hard-coded scenarios (like a bunch of chess openings) and brute force searching.

Are there any teams working on more, I don't know, human-seeming algorithms? Everyone seems to agree that humans are good at these games from pattern recognition on a large corpus of game experiences.

I'm out of my element here and realize I'm approaching "Even though I don't understand what you do, I'm going to assume it's easy for you to implement my suggestion" territory, but what if you encoded positions as general shapes rather than stone-by-stone? What if you played through lots and lots of games and built up Bayesian probability models of how likely certain combinations of shapes lead to victories? I mean, when a human go player looks at a board position and sizes it up what are they doing?

I guess if we aren't particularly good at computer vision and understanding how the human mind works yet, then there are hard problems here, but it seems like a neat sort of interdisciplinary approach.

edit: It looks like NeuroGo[1] linked to from an article in a different comment is more akin to what I'm thinking. It's just not very good.... ha.

[1] [http://webdocs.cs.ualberta.ca/~emarkus/neurogo/neurogo1996.h...](http://webdocs.cs.ualberta.ca/~emarkus/neurogo/neurogo1996.html)

<comment><USER19> > As far as I can tell from my (limited) background on chess/go/etc > algorithms, they seem to include lots of hard-coded scenarios (like a bunch > of chess openings) and brute force searching.

When playing chess at an advanced level, you need to know a fair number of different openings (that even have names). Chess AI programs have a huge library of openings, endings and other game situations that are evaluated.

In contrast, Go does not have a "library" of openings the same way chess does. There are simply too many ways a game can progress. However, in Go, there are many "micro patterns" that repeat over and over again, and you have to learn some of these even at a beginner level. There are numerous recurring formations, like the "Ladder", where one player inevitably loses and it should be recognized after 3-5 stones are in a specific form.

So Go has these patterns that recur, but they aren't as clear and simple as in chess. While a ladder can be recognized after just a few stones, the outcome may depend on a stone on the other side of the board, that may be have been there for 100 turns. This is what makes pattern recognition tricky for Go AI.

</comment></comment><comment><USER20> I lost a large bet in 2010 on being able to create a computer program capable of beating my roommate at Go. UCT was my go-to solution to this problem but my opponent was able to beat my creation on a 13x13 board since he spent every free waking moment playing Go against a commercial app on the iPhone. My UCT- based creation ended up beating me but losing against someone who trained intensively for six weeks.

</comment><comment><USER21> Go is a fantastic game. It's also a great analogy of the eastern philosophy with its emphasis on balance and long-term strategic vision.

<comment><AUTHOR> That's what I really like about Go. You always need to balance short-term greed and captures against vision.

There is also the balance between keeping your groups strong and claiming a lot of territory.

<comment><USER22> Exactly. I generally find that when I am over zealous when playing I tend to lose.

I find it similar to what I learned from practicing softer martial arts: the person that becomes tense/rigid loses.

<comment><USER23> Yeah. Cheng Man-ch'ing. "Invest in loss."

</comment></comment></comment></comment><comment><USER24> The fact that computers have such a hard time is a reason it is worth playing and makes Go attractive. The fact that chess can be reduced just makes chess unappealing.

<comment><USER25> This isn't the first time I've seen this sentiment about Go from (I presume) a programmer, and I have always found it puzzling. It seems like the opposite of the Seneca quote, "Men love their country, not because it is great, but because it is their own." Loving Go because it is hard for a computer seems like a scornful reason to love it compared to loving it because it is Go. Like loving your wife because she is beautiful, it is intrinsically temporary. There are better places to search for mystical appreciation for human cognition, specifically places that lack definitions like starting, ending and success.

What I find attractive about Go is that it emphasizes subtle influences over outright attacks. Everything is vague, slowly coming into focus. You feel more like you're trying to secretly drive a Ouija board than trying to eliminate the opponent. I seldom feel like, this is the move that ruined my game, whereas with chess I can almost always immediately identify the move that costs me the game.

Then again, I am terrible at Go and I hardly ever play, but I have a sense, possibly illegitimate, that getting better at Go would make my whole life better, whereas getting better at chess would simply make me a better conniver, and I'm already pretty good.

<comment><USER24> It is not a scornful sentiment, it is the same appreciation that you are referring to. Just like computing 2+2 is not the same as theoretical mathematics and creativity in mathematics, finding a game that is not computer reducible is an aspect of beauty in the game that is not present in chess because it is reducible. edit: seems that go programs are quite advanced and may overtake human players as well, though the methods are a bit different from chess

</comment></comment></comment><comment><USER26> am I the only one who thought the title is a pun on Game of thrones and Go as in Go (programming language)?

<comment><USER27> I didn't make that connection. But even if that was the intention, who cares?</comment></comment>


Legal Case Strained Troubled Web Activist - <AUTHOR> http://online.wsj.com/article/SB10001424127887324581504578238692048200404.html

<comment><USER2> This is the first article I've come across that includes statements from his GF. Instead of a private suicide, it is looking more and more like a public tragedy. The last few paragraphs show that he was not 'alone' in the forever- alone-nobody-loves-me sense. He had friends, loved ones, and a special someone who made him smile with tickle fights. Of course, none of these things really matter when you're drowning in the pangs of bipolar lows or depression but they certainly help alleviate some of the pain.

In the absence of the legal case, even the continual cycles of highs and lows is typical for many of us. But I have no idea what I would do if I was faced with financial ruin and a multi-decade no-computer-access prison sentence. My entire life revolves around computers and has done so for 20+ years since I was 10. I changed schools, moved away from loving family, left high-paying jobs, and gave up financial security just to continually pursue the singular passion of my life - programming. The thought of not being able to program is my version of hell. If you tell me I can't code for the rest of my life, I might as well not exist.

As irrational as someone else's suicide always appears, I fail to see a rational response to being in a situation where 10 years of imprisonment is the best possible outcome.

<comment><USER3> 10 years of prison is a long time, but it's hardly the end of life, especially when you're in your 20s to begin with. Yes your aspirations and career will take a massive setback but still, sitting it out is more rational option than suicide.

EDIT: I'm curious as to reason for downvoting, aside from sheer disagreement.

<comment><USER4> Are you facing prison time? Who knows how the prospect would play on your mind. Perhaps you would be able to compartmentalize it in your mind and be able to handle it.

It may not be so easy for others like Aaron. Everyone deals with these issues differently.

<comment><USER3> Hate to ruin your ad hominem argument, but many moons ago in a different place I was involved in activism that would land you in prison without due process.

And even if I didn't, it has nothing to do with rationalization of suicide.

<comment><USER4> Yeah you have all the answers.</comment></comment></comment></comment></comment>


Ask HN: What are your biggest challenges with Pagerduty, OpsGenie and VictorOps? - <AUTHOR> I'm currently evaluating all three solutions right now. From my preliminary eval, Splunk seems to provide more context than PD and VO. On-call scheduling and escalation features are similar. PD seems to have more advanced features, more integrations(some 2-way, which is nice), VO has better reporting. What are your greatest challenges while dealing with incidents with either these solutions? What critical features are missing in either solutions that have affected the way you deal with incidents? <comment><USER2> PagerDuty is all about the reporting and tracking of incidents and alerts. But it has some rough edges.

First, there is no search function. Use command-F or control-F in your browser. That's all you get.

Second, you are very limited in the types of things you can merge with other things. You can't merge incidents with alerts or vice-versa. I think incidents can be merged with other incidents, but alerts can't be merged with other alerts. But I might have that backwards.

It is impossible to have a large account with PagerDuty where you can hand off administration of entire chunks of the organization to someone else. This makes it impossible to set up teams to do their own self-service, and you're always going to be reliant on a central group of administrators who can be trusted not to screw up things for the entire company.

I had no prior experience with PagerDuty, but recently I've had to deal with it a fair amount. It's pretty clunky, although they are the biggest company in the field.

You would think this would make them an ideal choice for large Enterprise companies, but it seems to me that even large Enterprises are dumping them for OpsGenie or other solutions in this space.</comment>


Ask HN: How do phone spammers know my location? - <AUTHOR> For the past month my cell phone has been receiving the same robo call from various phone numbers. This is normal. What's new is that the calling number changes based on my physical location. I took a trip to Massachusetts and the spam calls were Massachusetts numbers. I spent a night in Washington DC and the calls changed to Washington DC area codes. How does the spammer know which phone number to "call" from to match my location? Is this likely a malicious app, are websites tracking my IP address, or is there some other path for spammers to behave this way? How could I even find out how this information is leaked? <comment><USER2> You can fairly easily get the current location for a mobile, at least down to a specific country and state.

Basically you pretend that your sending an SMS to the device and the home network will return you some data which includes the serving network, from this data you can guess location fairly accurately.

It's a little dodgy, some networks will put filtering in place to stop this, but not many bother.

If you want to see it in action here's somewhere selling the service masked through a basic JSON API - [https://www.messagebird.com/en/lookup](https://www.messagebird.com/en/lookup)

</comment><comment><USER3> It's called "neighborhood" caller ID spoofing and its extremely common and accessible to almost any would-be scammer. It's illegal, but its hard to take enforcement against.

[1][https://www.cbsnews.com/news/robocaller-hit-with- record-120-...](https://www.cbsnews.com/news/robocaller-hit-with- record-120-million-fine/)</comment>