French journalist "hacks" govt by inputting correct URL, later fined $4,000+ - <AUTHOR> http://arstechnica.com/tech-policy/2014/02/french-journalist-fined-4000-plus-for-publishing-public-documents/ <comment><USER2> The ruling is more complicated than that. If you can read french, I suggest you read Maitre Eolas' take on it [1].

[1] [http://www.maitre-eolas.fr/post/2014/02/07/NON%2C-on-ne- peut...](http://www.maitre-eolas.fr/post/2014/02/07/NON%2C-on-ne-peut- pas-%C3%AAtre-condamn%C3%A9-pour-utiliser-Gougleu)

<comment><USER3> I can't. Mind making a brief summary?

<comment><USER4> The main count on which Bluetouff was found guilty is that of "maintien frauduleux dans un système de traitement automatisé de données (STAD)", namely, remaining "in" a computing system (STAD) without being allowed. The key point is that Bluetouff made an important admission, apparently during his 30 hours of "garde à vue", meaning, being under arrest at the police station, where he seemingly neglected to apply his right to remain silent: he recognized that, when going up the folder hierarchy, he landed on a username- password login page. From this, according to the court, he should have inferred that the documents were private and that he had nothing to do there. Instead, he spent several hours siphoning the documents _afterwards_ , which established his intent to remain in the system despite having found out that he wasn't supposed to.

One can then discuss whether this law is fair or not, whether things would have been different had Bluetouff not made this key admission, whether it is reasonable to consider that the login page was sufficient to indicate that the documents weren't intended to be public, and whether the 3000 EUR fine is balanced or not.

Meanwhile, Bluetouff has appealed the ruling to the Cour de cassation, France's last-resort court for civil and criminal cases, whose role is to break rulings where the law was not correctly applied (without discussing the findings, only the application of the law and the adequate forms). I do not think we know yet how Bluetouff will phrase his appeal, but Eolas estimates that there would be a possible way to attack the ruling based on the court's finding that Bluetouff's retrieving the documents constitutes "vol" (theft) though it does not fall within the scope of the formal definition of theft (because the ANSES was not deprived of the files).

<comment><USER5> This is a good time to remind people: Don't talk to the police. Ever, under any circumstances - it can only hurt you, never help you. [http://www.youtube.com/watch?v=6wXkI4t7nuc](http://www.youtube.com/watch?v=6wXkI4t7nuc)

<comment><USER6> This is a very US-centric view. In some places, you have a right to remain silent, but that _can_ be used against you in a court of law...

<comment><USER7> He means don't talk to the police until your lawyer is there.

Which countries will use that against you?

<comment><USER8> UK or US, among other countries, if you are being held on 'homeland security' (read: Suspected terrorist) charges.

IE: You are required by law to answer questions/turn over passwords when suspected of such things. David Miranda being a recent and well known example.

<comment><USER7> "Let's wait until my lawyer gets here" will count against me?

You got a cite for that?

<comment><USER8> Heres the first hit on google, I'm sure many more instances, citings could be procured.

 _According to former White House Counsel Alberto Gonzales (later the former attorney general), "[t]he stream of intelligence would quickly dry up if the enemy combatants were allowed contact with outsiders during the course of an ongoing debriefing." Warren Richey, "Beyond Padilla Terror Case, Huge Legal Issues," Christian Science Monitor, August 15, 2007,[http://www.csmonitor.com/2007/0815/p01s08-usju.html](http://www.csmonitor.com/2007/0815/p01s08-usju.html). Yoo also explains that introducing a lawyer immediately after capture of an enemy combatant would disrupt interrogation as any competent defense counsel would tell his/her client to remain silent. Yoo, War by Other Means, 151._

<comment><USER9> That quote is in reference to enemy combatants, not those who fall within the regular court system. I get your point though.

<comment><USER8> As my post said _' homeland security' (read: Suspected terrorist) charges_ who are not part of the normal court system.

But this also happens to immigrants or those stopped at the border in general. [0] The right to counsel is being eroded at the edges (apparently not applied to non-citizens whenever possible).

 _Over the past year, the American Immigration Council, along with the American Immigration Lawyers Association (AILA), has documented instances where the DHS immigration agencies—Customs and Border Protection (CBP), Immigration and Customs Enforcement (ICE), and U.S. Citizenship and Immigration Services (USCIS)—have deprived noncitizens of access to counsel. For example, ICE also has taken the position that there is no right to consult with a lawyer during an interrogation. Likewise, many CBP offices outright deny access to all lawyers._ [1]

[0] [http://law.psu.edu/_file/Immigrants/LAC_Right_to_Counsel.pdf](http://law.psu.edu/_file/Immigrants/LAC_Right_to_Counsel.pdf)

[1] [http://immigrationimpact.com/2012/01/23/its-time-to- improve-...](http://immigrationimpact.com/2012/01/23/its-time-to-improve- noncitizens-access-to-counsel/)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> > Bluetouff ended up admitting in testimony that when he found the documents, > he had traveled back to the homepage that they stemmed from, where he found > an authentication page, which indicated that the documents were likely > supposed to be protected. That admission played a part in his later > conviction in the appeals court.

Of course the fine seems absurd to me personally, but this excerpt hints at a couple things one should _definitely_ not do.

<comment><USER11> This seems weird to me.

If I go to, say, the twitter homepage, I will find an authentication page, and yet most content on twitter is obviously intended to be public.

<comment><USER12> I don't know about France, but in many jurisdictions, a "reasonable person" standard is used. While I don't personally believe accessing publicly available files should be illegal in _any_ case, I do think that in the situation as described (with the admission of traveling up the path hierarchy to find a login page), most "reasonable people" would indeed infer that the files were not intended to be publicly available.

<comment><USER13> Not really. If I found a page that redirected me to a login, I would assume that that page is not intended to be publicly available, and that other content that I don't know about exists which is not intended to be publicly available.

I wouldn't infer that just because (as noted by the parent comment) [https://twitter.com/](https://twitter.com/) requires a login, I shouldn't look at [https://twitter.com/twrbrdg_itself](https://twitter.com/twrbrdg_itself)

Now, if all those pages I looked at before finding the login page had a banner saying "private, not for public consumption, don't share this with anyone who doesn't have an account", then I might think "hmm, perhaps I'm not supposed to be here".

<comment><USER12> That's not a fair analogy though. I agree that I wouldn't expect every page on twitter to be protected. But if you find a direct link to a random document indexed by Google, then check and the page that links to that document is protected, I personally anyway would assume the document itself was exposed accidentally. Obviously not everyone agrees though, which makes the reasonable person thing difficult to decide.

As for the lock on the door comment, I'd say it's more like if you noticed a store is left unlocked in the middle of the night, and therefore assume you're welcome to go in and walk around. In fact, they probably didn't leave it unlocked as an intentional invitation.

</comment></comment></comment></comment></comment><comment><USER14> happened in brazil as well.

everyone knows you only build large public projects there if money change hands. and it usually happens that the gov official get the quotes from all the companies, call the one paying him the most and tell the other quotes and that company submit a little lower than the lowest and get the job, later including several hidden fees, etc.

the, for the sao paulo subway expansion, a journalist did a search and found documents proving all that for that specific job (yellow metro line) and published them.

gov removed the documents, waited for all signs of it ever being indexed to disappear and then sued him. i think the trial is still going and they still deny those documents ever existed.

<comment> whitey-chan Do you have any links with further info on that case by any chance? Would be interesting to see how that turns out.

</comment></comment><comment><USER15> How can government agencies still can get away with accusing someone of "theft" and accessing a "private computer" and "private documents" when they just publish documents on the web, and the public is consuming them? The fact that there was a HTTPAUTH protected login page in some up path on the site does not infer that the documents should have been protected. They are or they are not. And they looked legit, i.e. public.

Esp. with government documents you are safe to assume that they are public, if they are public and look public.

<comment><USER16> Exactly. Also, the HTTPAUTH is directory based and does not necessarily include subdirectories, just like permissions on all Linux distros. So that doesn't imply in any way that subdirectories should have been private.

</comment></comment><comment><USER17> I'm really on the fence with this one. As has been pointed out, the fact that there's some auth somewhere on the server doesn't necessarily mean that those specific documents were supposed to be private. However, as a journalist he decided to publish the documents on his blog which I think we can take to mean that he assumed they were, in some way, "juicy." And he wouldn't think that if he didn't at least suspect that they were supposed to be private.

This is all assumption, of course, but I think it's pretty logical assumption.

Still, freedom of the press is a strong right. Though freedom, as they say, isn't free (there can be and often are consequences to exercising your freedoms). In this case I think he's lucky to just get what amounts to a hefty access fee. If he had stumbled onto U.S. documents he may well have found himself taking a ride in a black helicopter.

</comment><comment><USER18> How many years would he get in prison for this in US? While the interpretation of the law or the law itself are pretty bad here to begin with, at least the punishments are saner for stuff like this. US seems to have both completely terrible and easily abused hacking laws, but also extremely disproportionate punishments.

</comment><comment><USER19> This is more or less what happened to some kids applying to Harvard Business School about seven years ago: [https://freedom-to- tinker.com/blog/felten/harvard-business-s...](https://freedom-to- tinker.com/blog/felten/harvard-business-school-boots-119-applicants-hacking- admissions-site/)

Their penalty was a denial of admissions, but their hack of using a specially- crafted URL was about the same.

</comment><comment><USER20> I don't understand why he's getting fine for that. Those were publicly accessible documents, even though they were intended not to be, as indicated by the login form that Bluetouff admitted to know about.

If that's the law, then it needs to change.

</comment><comment><USER21> Reminds me of what happened to Andrew Aurenheimer, only iterated a bit more.</comment>


What to expect when dealing with potential investors - <AUTHOR> http://www.antiventurecapital.com/valuations.html Brace yourselves. <comment><USER2> The article emphasises the importance of equity (for a founder) but I'd be happy with 10% of $100 million as opposed to 90% of $10,000.

Surely a more important (but perhaps slightly more subtle) point is that VCs will perhaps impose additional constraints on the company. A good example is bringing in a new "business savvy" CEO (and/or board of directors) to potentially replace you.

Are there any legal tools that allow a founder to maintain control of the company (in a voting sense) even if the VC firm wants 50% or more equity?

If Sequoia invested in your startup and asked for 50% would YOU complain?</comment>


Stephen King's Family Business - <AUTHOR> http://www.nytimes.com/2013/08/04/magazine/stephen-kings-family-business.html?pagewanted=all

<comment><USER2> I was Stephen King's paperboy as a kid growing up for about 6 years. I never met or saw him once.

I delivered the paper each morning through his black gate, up his driveway around to the side door. The winter mornings were especially scary, as it was still dark out. One morning there was a black crow perched on the railing of his steps to the door I put the paper in. As I got closer, I figured the crow would fly, like a normal bird. However, it didn't. I got closer, 10 feet away, 5 feet, then 1 foot. I stuck my hand out to pet the crow. It didn't move, just standing there, looking right at me. The crow let me pet him for a few seconds, I stopped and then he flew away. I delivered the paper and went on my way.

That's the only story I have about the King Family. Oh, and that I never got a Christmas tip from him once. That's all.

<comment><USER3> > One morning there was a black crow perched on the railing of his steps to > the door I put the paper in...

If you ever hear the sound of approaching bootsteps in the distance... run.

</comment></comment><comment><USER4> King is my favorite writer. While none of his novels make it in my top 20, I generally enjoy most of what he writes in some fashion or another. Some of them are stinkers but they are like a finding a burnt potato chip -- the carbon taste is there but it's still a fried slice of salty goodness. I very much enjoy listening to him speak and I respect the candid look into his life that he has given the public.

I recommend to anyone who has a love for good books and especially if you have literary aspirations to give King's _On Writing_ a chance. It's a mix between an autobiography and a lesson in the craft of writing. I recommend the audio version. While I have no plans to write stories in the future, the book is fascinating. His voice takes getting used to but I wouldn't trade it for anything. I'd rather he read any of his novels than Frank Miller.

I haven't read anything from Joe Hill yet but I look forward to checking out his work as well.

<comment><USER5> Speaking as someone who is planning to write in the future - by which I mean "Edit a short story tomorrow," "Launch a Kickstarter for a novel next week," and "Participate in NaNoWriMo for the eighth or so time next month" \- I can highly recommend _On Writing_. It's one of the very few books, out of easily a hundred or two, that I first had shipped up when I moved out of state. I'm sitting across from it even now.

Speaking of the Kickstarter: [http://planetoz.net](http://planetoz.net). I'm posting a writing tutorial link to the mailing list soon!

</comment></comment><comment><USER6>
      > A rabbi named Zusya died and went to stand before the judgment seat of God. As he
      > waited for God to appear, he grew nervous thinking about his life and how little
      > he had done. He began to imagine that God was going to ask him, "Why weren't you
      > Moses or why weren't you Solomon or why weren't you David?" But when God appeared,
      > the rabbi was surprised. God simply asked, "Why weren't you Zusya?"

[http://chippit.tripod.com/tales1.html](http://chippit.tripod.com/tales1.html)

<comment><USER7> I don't get it. Why does God always have to be so vague about things?

<comment><USER8> I'm an atheist, but I enjoyed these stories. I think I understood this one, so I'll attempt to explain.

God is asking him why he didn't just relax and be true to himself. If the rabbi wasn't so worried about living up to the examples set by others, he could have fulfilled his own potential.

<comment><USER7> That makes sense, thanks for answering.</comment></comment></comment></comment>


Best Universities in the US - <AUTHOR> http://www.flickr.com/photos/gdsdigital/5059535030/sizes/l/

<comment><USER2> I can't really read it, is this the original?</comment>


NYC BigApps 3.0 - <AUTHOR> http://2011.nycbigapps.com/

<comment><AUTHOR> A couple of years ago, NYC's open data (<http://nycopendata.socrata.com/> ) seemed really exciting, but from my brief perusal of the datasets, they appeared limited. It looks like they might have beefed it up since I looked.

Maybe this will finally be the year I get around to entering.</comment>


Is Persona the Authentication System That We've All Been Waiting For? (2012) - <AUTHOR> https://xato.net/passwords/mozillas-persona-authentication/

<comment><USER2> I like Persona and – about a year ago – was thinking of using the service in a medium sized project I'm managing. I did some experiments and it (technically) worked fine for our purposes, and educating users on its use didn't seem too hard either. In the end though, I decided to roll our own (simple) authentication system because of a lack of hard guarantees that Persona (the service) would still exist a few years down the line.

I don't like to depend on external factors for long term projects that go into maintenance mode and this is very much a problem with 3rd party authentication.

We could of course try to install the Persona server ourselves, but that seemed like a bit too much effort considering the size of the project.

In short, Persona good, uncertainty around it bad. I guess it suffers from a chicken-and-egg (or critical mass) problem.

</comment><comment><USER3> Persona solved a real problem in a straight-forward manner, which, in today's web, is a surefire way to fail. People often complain about things (Facebook being a walled garden, Twitter mucking up third party clients, authentication being broken etc.), but then end up giving in to convenience.

<comment><USER4> It's easy to casually dismiss Persona's lack of adoption but there is real problems with it. For example it is not easy for hosting providers to deploy (custom domains, domain:443 may not be controlled by the provider, SSL certs, etc).

<comment><USER5> I'd love to take another run at Persona in a few years once DNSSEC gets sorted out. As the world exists today, requiring a specific response to GET /.well- known/browserid over TLS on the apex seemed like the most reasonable option.

<comment><USER4> ACME and LetsEncrypt should allow for easy to deploy and free (or cheap) certificates this year. With that and the use of SRV records to find the HTTPS endpoint, it could well be made simpler to deploy Persona this year.

(For those unfamiliar with SRV records, they're found at _service._proto.domain and contain a target name and port at which a service for domain can be found. ie: _persona-https._tcp.user.example could list provider.example:8443, and provider.example:8443 would be expected to be able to produce a certificate for user.example.)</comment></comment></comment></comment>


Cool URIs Don't change - <AUTHOR> http://www.w3.org/Provider/Style/URI <comment><AUTHOR> I just noticed that this classic piece of advice has never been directly posted to HN.

I think that giving "things" a name is one of the hard problems that programmers tackle every day. Normally our success or failure at choosing good names is kept hidden, and can only be seen by those who look at our code. Websites are one of the rare places where the world at large has to deal with our mistakes.

<comment><USER2> Yes - until we get an internet wide refactoring option:

"Apply this change to the entire freaking internet?" y/N>

</comment></comment><comment><USER3> At least make urls all lower case. Consider how tedious it is spell out a url over the phone which happens quite often. "... dot com forward slash u s e r ... no, capital U on user ... upper case U ... user is upper case U ... no, the rest of user is lower case ...after the slash ... the forward slash... I'll start again..."

<comment><USER4> Case-sensitivity was a cruel joke.

</comment></comment><comment><USER5> Unfortunately, search engine optimization is moving people to put even more topic-related words in URLs than they did 10 years ago when this was written.

</comment><comment><USER6> +1 for content negotiation. Extension-less URLs are just plain sexy.

<comment><USER7> Extension-less URLs are great, but I'm not a fan of content negotiation. I like to be able to copy and paste a URL to someone and know that they are going to retrieve the same piece of content as I did. I don't like language negotiation for the same reason - if someone finds a typo on my French language site and sends me a link to the page but I see it in English I won't know what they're talking about.

<comment><USER8> That's the conventional wisdom, but I'm not completely convinced that those are real problems.

If you send someone a content-negotiated URL you can be pretty confident that they'll see the text/html (or application/xhtml+xml :-) version).

Similarly, any typo report more specific than "there's a typo somewhere at this URL" will tell you what you need to know.</comment></comment></comment>


Beyond Floating Point – Next Generation Computer Arithmetic - <AUTHOR> http://insidehpc.com/2017/02/john-gustafson-presents-beyond-floating-point-next-generation-computer-arithmetic/ <comment><USER2> Gustafson gives a compelling argument, especially for low precision like 8b and 16b. In 8b, operations can be implemented with table lookup with FPGAs. Unums are better than IEEE but can't an application specific choice do better given that we're talking about choosing 256 numbers?

</comment><comment><USER3> This was more interesting than I expected. Who knew that many architectures have a flag that indicates that a float values is inexact, but that no language exposes that to programmers. Or that IEEE 754 isn't really a standard as much as it is a set of guidelines.

He makes a compelling argument for why his proposal of the ubit/posit represents mathematical truthful statements, while floating point lies to you. The tradeoffs make a lot of sense. No more overflow/underflow. Better closure under arithmetical operations.

"Floating point numbers are like piles of sand; every time you move them around, you lose a little sand and pick up a little dirt." -- Brian Kernighan

</comment><comment><USER4> What's really needed is an error term that can be computed in parallel with your normal floating point operation. Floating point is impossible to write correctly in practice if you don't consider the accumulated error.

<comment><USER5> There are interval arithmetic libraries for C++ that do that, and are fast in the common case where the error fits within floating point norms.</comment></comment>


Anyone have extra office space? - <AUTHOR>

My company of 5 is looking to share some space with a company that may have too much space.  We are looking at a term of 6 months have a budgets of about 2K a month.
We would need 4 dedicated desks and 1 dedicated private office (not mandatory he could work at a desk but he would need to have a duck out room so he could be on the phone.)
It would be a super plus if you allowed dogs I have a small 9lbs furry friend that would like to join us.
Here is our company www.droplocker.com
Any leads or advice would be much appreciated!
firstname.lastname@example.com <comment><USER2> Where are you located?

<comment><AUTHOR> Right now we are in San Francisco CA off of Valencia and Market st Its a bit cramped with 4 of us in a 250 sqr ft place</comment></comment>


German state of Hesse bans cloud services from schools due to privacy risks - <AUTHOR> https://thenextweb.com/privacy/2019/07/15/german-schools-ban-microsoft-office-365-amid-privacy-concerns/ <comment><USER3> I'm not German, but in the US I always thought it was a bit strange and concerning that we use taxdollars to train kids to use a proprietary, for- profit system. I understand that MS Office is (sadly) the industry standard, but how much of this is self-fulfilling, as in "it's the standard because that's what they teach, and it's what they teach because it's the standard".

You'll find similar things in school with software like Matlab; they give substantial discounts to universities for Matlab, these students because so used to it, and beg their employers to buy it, which they usually do.

Schools shouldn't be advertising vehicles for children, and I feel there should be a stronger emphasis on open technologies. Thank goodness MS can't create a proper equation editor to save their life, so LaTeX is still the standard for higher-level academia.

<comment><USER4> Software is one thing, but middle schools providing iPads to kids makes my blood boil. How on earth can you make kids work on one of the most closed down ecosystems there are?

At least on windows I can install everything I want or even run my preferred OS on a virtual machine...

<comment><USER5> Many schools provide computers running Windows or macOS to their students but prevent them from putting their own software on it anyways.

<comment><USER4> Kids do not learn by taking their freedom away. They learn something by exploring their environment. Yes, you need to prevent abuse, but simply locking down their system is just an easy way out for the school admin.

How would you feel about your boss taking away all your rights regarding software installation and browsing? As a dev, I'd be thoroughly pissed. Why do they question my authority?

But, there are people who'd install all crapware and browse Facebook all day without any restrictions. So what to do?

You give them all the power until they abuse it, then you take it away. Not the other way around.

</comment></comment></comment></comment><comment><USER6> "This effectively leaves schools with few other options, unless Microsoft gets back to them with a satisfactory solution."

While businesses are obviously reluctant to use Libreoffice because they need perfect compatibility with MS Office files, K-12 students have no such constraints. What prevents the schools from standardizing on an open-source suite like Libreoffice?

<comment><USER7> What prevents them is the inability to teach students beyond "click the button that looks _precisely_ like this to get the desired effect".

That is, they consider knowledge gained in one of these applications to be non-transferable to other, similar applications.

Never mind that nobody ever made a fuss about our driver's license system where you typically learn on a single car model, with the expectation that even the biggest idiot can cope with different placements of the lighting controls or a different number of gears on their manual transmission.

<comment><USER8> Which is strange, because Microsoft hasn't kept the same icons all along, and will change things again.

I first learned AtariWriter as a kid. Then at school something on the Apple II. In high school they were all proud to be teaching us WordPerfect 5 for DOS - the same as industry was using. By college everybody had switch to Microsoft word. Microsoft then did a major change to create the ribbon UI. I expect this trend to continue.

<comment><USER9> This is really how general computing should be taught. Go deep on a few things, but make sure to expose students to a wide enough variety of different paradigms a d systems that they can glean some of the commonalities. From there, they should be able to figure out most of the rest.

It works pretty well in programming languages as well. So long as you don't go too far afield. Lisp fefeated me until I wrote a toy one and I'm still pretty stuck on Haskell, but I've had far fewer issues with some of the more traditional languages.

<comment><USER10> Sadly it's far from this. My mom is terrible with any technology and took a computer course which taught stuff like Word. The entire instruction was basically follow fixed checklists of menus to do stuff followed by some test which is entirely about the checklist not about what you did.

She basically forgot it all within a year and is still scared to do anything complicated.

That sounds like a much better approach. Education is such a difficult thing to get right.

</comment></comment></comment></comment></comment><comment><USER11> Interesting, I just tweeted about Microsoft's parental controls this morning:

> Windows 10 parental controls requires that both the parent and the kid have > an email account and register with Microsoft.

[https://twitter.com/philshem/status/1150667995745869824?s=21](https://twitter.com/philshem/status/1150667995745869824?s=21)

</comment><comment><USER12> The foundation of the MS empire is MS Office. People use office at work because it's the path of least resistance, due to fewer conversion errors (no conversion when you are using what everyone else does), and because that is what they used in school. Have the kids learn on LibreOffice, and MS Office only has one shaky leg to stand on.

<comment><USER13> It's not that hard. I required my kids to grow up with Libreoffice (and Openoffice before that). There where hassles but they where manageable. I made sure to explain why this restriction was in place. I also was willing to fight any battle with school authorities over this issue should the need arise. Fortunately that was not necessary.

<comment><USER14> I did the same. It turned out that teachers were perfectly fine using Open/LibreOffice.

</comment></comment></comment><comment><USER15> I work at a university in Canada and it is the same unless they have cloud servers in Canada. I think we were on office 2010 till more recently. The patriot act allows US government access to any non americans data pretty easily, and it contradicts a lot of Canadian privacy law.

<comment><USER16> Microsoft is still an American company if the cloud servers are in Canada. Can't the US government tell Microsoft to hand over the data (which MS can fetch remotely) if it needs it for some terrorist investigation?

<comment><USER17> I believe you are correct, and that's why Azure has a dedicated German cloud with all the data residing in Germany and managed by a German data trustee, which should prevent US government from being able to tell Microsoft to do anything with that data[0]. If Canada happens to have a dedicated cloud region with similar policies, they should be in the clear.

0\. [https://azure.microsoft.com/en-us/global- infrastructure/germ...](https://azure.microsoft.com/en-us/global- infrastructure/germany/)

<comment><USER18> From the article: "A year later, Microsoft closed its German cloud datacenter, and schools migrated their accounts to the European cloud. Now, the HBDI states that the European cloud may offer access to US authorities; with no way for the German government to monitor such access"

<comment><USER19> This is because the old data center was run independently of MS while they own the new ones directly. Thus, the old one was legally and technically isolated from MS and any wish they might have had to access that data.

</comment></comment></comment></comment></comment><comment><USER20> IMO we should never teach proprietary software in any education system that runs on public money.

<comment><USER21> What about music classes that teach Garageband or more professional recording software like Logic or Ableton? Or art classes that teach Photoshop? Should they even be allowed to use Windows or Mac OS X? How about Google Chrome or Safari? Google search? It seems rather arbitrary to feel so strongly about word processor choice but not anything else.

<comment><USER22> >Garageband or more professional recording software like Logic or Ableton? Or art classes that teach Photoshop

Yes, schools should stop specifically teaching the UI of certain proprietary applications.

>Should they even be allowed to use Windows or Mac OS X?

Public funds should not be used to purchase those operating systems. If they were donated, they can be allowed.

>How about Google Chrome or Safari? Google search?

Those are already free, and there aren't full 5 credit courses on "How to use Chrome" like there are for MS Office and Photoshop.

<comment><USER23> It seems like you are recommending teaching something which is entirely different to what the vast majority of learners will come into contact with on a regular basis in their future lives. That is not useful and it does not prepare people for the real world.

In the United States, it is the done thing to file taxes through a proprietary software portal (as the result of extensive lobbying). [Yes, this state of affairs is a travesty] Should schools, therefore, avoid teaching people how to file taxes?

<comment><USER24> > It seems like you are recommending teaching something which is entirely > different to what the vast majority of learners will come into contact with > on a regular basis in their future lives. That is not useful and it does not > prepare people for the real world.

Many free software replacements for proprietary software are quite similar to the locked down alternatives. Maybe if people learned a different program in school then they would continue to use it in their future lives. That would increase the number of users and the chances that other people would encounter it in the real world.

Proprietary software encourages dependence on a single company and discourages learning, the primary goal of an education institution. Realistically it is near impossible to live today without encountering proprietary software, but educational institutions should be more responsible about how they frame students' relationships with it.

> In the United States, it is the done thing to file taxes through a > proprietary software portal (as the result of extensive lobbying). [Yes, > this state of affairs is a travesty] Should schools, therefore, avoid > teaching people how to file taxes?

Areas where centralization and high levels of security are important such as tax filing, flight booking, and online banking will likely use proprietary software for the foreseeable future. Rather than taking the strict stance that these activities must not occur on school grounds they should teach students how to protect themselves from potential harms of proprietary software (e.g. by running programs in isolated environments).

<comment><USER23> > Areas where centralization and high levels of security are important such as > tax filing, flight booking, and online banking will likely use proprietary > software for the foreseeable future.

Financial institutions, and government institutions, etc. will mostly be using proprietary operating systems for exactly this reason. By not teaching how they work (to a novice/intermediate level, not kernel specifics!) you preclude your students from taking most roles in such organisations. I'm not saying it's good that public services rely on private business, but it is naive to ignore it.

</comment></comment></comment></comment></comment></comment><comment><USER25> Turkey got few steps further:

Almost all ready made software recently become practically illegal to obtain in government tenders in Turkey due to "usability guarantee" requirement. Exact article translated (from the presidential administrative decree):

      All software and hardware contractors working for
      Turkish government shall provide a guarantee stating
      said soft/hard-ware does not contain backdoors and/or
      features unfit for intended use, as far as possible.

Servers for goverment services are also required to be in Turkey, even if it is not possible to set up one in situ in the respective institution. This goes so far to require all data processor to have their own or peered IXPs situated in Turkey.

<comment><USER26> So what do they use? Linux with LibreOffice?

<comment><USER27> I think both of those explicitly denounce any expectation of a fitness for any particular purpose in their licence, so if anything they'll be going backwards (according to their metric)

<comment><USER28> Sure, but that's just the license. If an ISV makes a support contract with them, they can include the necessary clauses in that contract.

<comment><USER25> Usability and fitness can only be guaranteed by original author. Others can only test and report it.

</comment></comment></comment></comment></comment><comment><USER29> Amusing. That's the data protection agency responsible for Schufa ([https://en.wikipedia.org/wiki/Schufa](https://en.wikipedia.org/wiki/Schufa)), which 15 of 16 German data protection agencies agree is breaking every relevant German data protection law. For some reason they disagree / are very lenient in their handling of Schufa. Maybe Microsoft should move their German HQ to Frankfurt or Wiesbaden.

(To make this clear: I think this is a good decision, but they are still hypocrites)

</comment><comment><USER30> It's one of sixteen states. Office 365 (and Windows 10) have been identified as not being able to be used in accordance with data privacy laws in Germany time and time again. So far, nobody got fined for using either software yet.

<comment><USER13> Do you know any authorities using Windows 10 who handle personal data? Last I looked the BSI (Bundesamt für Sicherheit in der Informationstechnik) hasn't blessed Windows 10 as appropriate over battles with MS on telemetry.

<comment><USER31> Munich is switching away from Limux towards Windows 10, which I assume also includes workstations that handle PII.

</comment></comment></comment><comment><USER32> It gets interesting. Of the three OS vendors - MS, Google, and Apple - <USER2> the latter made the effort to choose the privacy path, whereas the other two basically have a contemptuous attitude towards privacy expectations of their users. Times change, though, and we're likely to witness some interesting changes.

</comment><comment><USER33> Having heard M$ executives talk about Office, I was somewhere between shocked, horrified and appalled at the enthusiasm with which they talked about mining (Office) user data to offer "intelligent" features. Absolutely zero concern about possible privacy issues. Not even on the radar.

<comment><USER34> They don't let you disable their spying on Windows 10, why would they treat Office any differently?

I remember when a weather app using your GPS to automatically change to your current location was controversial. Now we willingly subject ourselves to corporate spying at the OS level.

<comment><USER35> When you install or activate Windows 10 there is a step during the process where they ask you what of the telemetry to enable or disable. Everyone, outside corp environments where the corp decides, goes through this process. The settings are available to change later, oo.

Why do you say they don't let you disable the telemetry for Windows 10? Honest question.

<comment><USER36> That setup process says things like "Send detailed information to Microsoft. Disabling this sends only basic data." There is no setting for not sending any data.

They also add new settings using Windows Update which you're not prompted about and which default to on, which would presumably then send information between when the update installs and when you realize it's there, even assuming you're diligent enough to notice it at all as most people obviously aren't.

</comment></comment></comment></comment><comment><USER37> The title makes it sound like this is a Germany wide thing. It's 'only' the state of Hesse which is around 6 million people. The responsibility for the education system in Germany lies primarily with the states.

</comment><comment><USER38> I wish this sense of German/European sensibleness w.r.t. things digital could be transplanted into America. I'm really quite jealous of it.

<comment><USER39> I guess it already is being done. US citizens must also be benefitting from stuff like GDPR. It does not sound sensible for companies to implement it and then wilfully exclude US citizens. I think often times companies will just comply with all data protection rules globally for everyone.

<comment><USER40> > US citizens must also be benefitting from stuff like GDPR.

My benefit so far has been countless popups that either offer a "take it or leave it" Accept button with no other options, or a link to tens of thousands of pages of legal contracts detailing the service terms of hundreds of "partners". None of these sites really seem GDPR compliant to me at all, and I'm talking about EU based sites.

US based sites are easier. Either do like here on HN and have no popup or notice or terms at all, just rightly ignoring the law which is in a foreign jurisdiction not controlled by treaty and which legally has absolutely no bearing. Or do ip block level shutdowns of access with a 451 code response, as well as adding to the TOS that those in EU jurisdiction are not permitted to use the site.

A win for everyone.

<comment><USER38> You seem entirely too gleeful about users' privacy getting violated. Very far from _" a win for everybody"_.

</comment></comment></comment></comment><comment><USER41> It seems the simple solution for Microsoft is to just stand up a data center in Germany again. The simple solution for the rest of the software world is to let people choose where their data is stored. I wrote about this earlier today: [https://blog.graphitedocs.com/the-simple-way-to-remain- gdpr-...](https://blog.graphitedocs.com/the-simple-way-to-remain-gdpr- compliant/)

<comment><USER42> Again? [https://azure.microsoft.com/en-us/global- infrastructure/germ...](https://azure.microsoft.com/en-us/global- infrastructure/germany/)

<comment><USER43> This has been discontinued: [https://news.microsoft.com/europe/2018/08/31/microsoft-to- de...](https://news.microsoft.com/europe/2018/08/31/microsoft-to-deliver- cloud-services-from-new-datacentres-in-germany-in-2019-to-meet-evolving- customer-needs/)

<comment><USER44> As an outsider looking in (from the US), what is the difference between the current Azure Germany vs the new locations they're standing up in Berlin and Frankfurt?

Frankly, I don't understand the point of the last 3 paragraphs of this announcment.

<comment><USER19> The difference is that the discontinued data center was run independently by a German company (T-Systems IIRC). MS engineered the contracts in such a way that they had no ability to access anything in this data center. That made it exclusive subject to German law. As I see it, the new data centers are run by MS directly and thus an entity that is subject to US laws and their far reaching clauses.</comment></comment></comment></comment></comment>


Scorpion Brings the Stupidest, Most Batshit Insane Hacker Scene Ever - <AUTHOR> http://io9.com/scorpion-brings-the-stupidest-most-batshit-insane-hack-1638333877

<comment><USER2> On the other end of the spectrum, while still simplified and exaggerated, there is "Person of Interest".

They _must_ have some decent technical consultants for the show because they rarely do the Hollywood style of UI and everything has a certain consistency throughout the production. They take technology terms and mostly use them correctly - most recently building a "mesh network" over NYC for private voip communication with "rolling encryption" using existing UHF TV antennae on rooftops (UHF covering up to 3GHz - standard wifi being 2.4GHz).

Could that actually be done? Dunno, maybe - probably not as simply or quickly as shown, but still, it shows effort.

</comment><comment><USER3> well, in the promos they showed briefly somebody pointing at a kid playing chess against somebody saying "kid's a genius; he's checkmated a chess master in 8 moves", which is beyond ridiculous even against a coffee player.

<comment><USER4> Don't understand why people seem to think being good at chess is directly correlated with being smart. Chess is just a game that you can get better at through practice like any other game, you can be average in all other respects but still be a great chess player. Sure lots of smart people like chess, but lots of different kinds of people like lots of things. Guy I went to school with was dumb as a rock but was ranked among the top Junior league chess players in the country or something like that cause he was awesome at the game.

Even Bobby Fischer(who reportedly had an "astronomical" IQ), and is considered to be one of the best if not the best player ever, developed his phenomenal skill through countless hours of practice and devotion because he was utterly obsessed with the game - upon beating almost the entire Soviet team singlehandedly at the world tournament, one of the players remarked that Bobby put more time into chess than the entire team combined.

It isn't really something where you have to be intelligent to do it like advanced math or physics and whatnot.

</comment></comment><comment><USER5> Hardly surprising when you consider this is the executive producer of the show:

[http://en.wikipedia.org/wiki/Walter_O%27Brien](http://en.wikipedia.org/wiki/Walter_O%27Brien)

<comment><USER6> His talk about himself and Scorpion at Global Wealth Summit

[https://www.youtube.com/watch?v=JeVVSr6Xx60](https://www.youtube.com/watch?v=JeVVSr6Xx60)

</comment></comment><comment><USER7> haha, I just tried to post this. I going to check if it was already posted but I figured HN had that part figured out to avoid duplicates. Just took me right to this post, solid solution.

Anyway, thought this was hilarious. The video is so nuts that I think it is a little funnier if you read the little writeup first. Just to give context to why they are hanging an ethernet cable out of the bottom of a 747. :)

</comment><comment><AUTHOR> And this, kids, is why we desperately need to teach computing in school.</comment>


The Evolution of Google Nexus in 3 seconds - <AUTHOR> http://gadgetlove.com/blog/the-evolution-of-the-nexus-5-in-3-seconds

<comment><AUTHOR> Saw this making the rounds and trying to see if others think there is any link between screen size and Android market share Is bigger better?</comment>


BitTorrent v2 - <AUTHOR> https://blog.libtorrent.org/2020/09/bittorrent-v2/ <comment><USER2> I make P2P tools too. [0] Let me tell you this: Bittorrent is one of the few things in the space that actually ... works.

It works not in the sense that there is a white paper that should work. Not in the sense that there are a few company-made swarms hosted on industrial servers that keep everyone up and alive, so that the thing gives the impression the 'P2P' network does work. Not in the sense that there is a very- well oiled marketing machinery talking about Web 3.0 that allows its founder to go on TechCrunch and talk about the upcoming distributed paradise.

Bittorrent works in the way you install it into your computer and it does something for you. And for that alone, it has my immense respect and attention.

It's a tool that doesn't pitch that it's a P2P tool - it doesn't try to convince you with sob stories about how using P2P helps fight against the big bad evil web. Instead, you use it because it's genuinely the best at what it does: it being P2P is not a selling point, it's just how it happens to work, and that is exactly what it should be.

That is something all P2P developers should aspire towards.

[0] Aether P2P: [https://getaether.net](https://getaether.net)

<comment><USER3> > It's a tool that doesn't pitch that it's a P2P tool - it doesn't try to > convince you with sob stories in how using P2P helps fight against the big > bad evil web. Instead, you use it because it's genuinely the best at what it > does: it being P2P is not a selling point, it's just how it happens to work, > and that is exactly what it should be.

This should be something that every creator who markets or sells products should learn. Consumers don't care how it works, it just has to be better than the solution before it. Appealing to how things ought to be moralistically doesn't work (for the vast majority of consumers). They just don't care, they want a solution to their problem.

<comment><USER4> This is exactly the problem with all cryptocurrency currently. It's a massive user experience issue, in the sense that users have to experience the technical bullshit of how the currencies work, completely missing the brilliant part of real money: it just works. I hand people money, they give me things. I swipe my credit card, I get things.

I can't remember who aid it originally, but there's a great test you can give to any statement or idea. Just immediately ask "who cares?" The best product demos I've ever seen answer who cares in each part of the pitch. The worst ones just rattle off mumbo jumbo forever.

<comment><USER5> It has been a few years, and despite a few attempts, I still don't really understand bitcoin. Yes yes ledgers and proof of work and yada yada, but I still don't know what I would need to do to buy something with bitcoin right now.

As I understand I need to do something that's pretty much exactly like opening a bank account, but transactions take forever, they cost money, and the currency is not accepted by any business I use, unlike my free credit card.

I have 55€ in my wallet and everyone on this continent knows what to do with it.

<comment><USER6> It's simple: it is an abject failure as a currency. It is fairly successful as a security for the purpose of speculation. If you aren't a financial speculator, you really don't need to pay attention to it.

<comment><USER7> It's also fairly successful as a way to _transfer_ money.

<comment><USER8> I am pretty lucky that I only have to transfer money to between 2 countries that have heavily linked banking systems (US -> Canada), but I am not entirely sure what Bitcoin would get me in terms of transferring money. The fees are quite small on Transferwise, and also, I have…I don't know what you want to call it…accountability? Reversibility? Reliability? Whatever fee I have to pay, the fact I get a known third-party with a papertrail is peace of mind.

<comment><USER9> It's great to live a in developed world during the peace time.

Sometimes you have to transfer money in and out of the country at war with it's currency in free fall and capital controls in place. At times like that "normal" ways take about 30% of the sum as transactional overhead, while bitcoin doesn't.

Sometimes "normal" ways just don't work normally. Sometimes your government is actively working against your ability to transfer your money for whatever reason — be it drug laws or capital controls or what not. Sometimes you enter account number into the "normal" system and field just turns red for no reason at all. Sometimes you have your access to "normal" system severely restricted because of your legal status and residency rights.

So yeah transferring money between Canada and US being resident of either of them and not doing anything funny — is not a use case for Bitcoin.

<comment><USER10> Does this hypothetical situation you describe exist anywhere outside of the hypothetical situation posited by a character in a Neal Stephenson novel?

Seriously in reality the specifics of any sort of wild situation like the one you describe matter. Which countries? Which currency? Which kind of illegal behavior?

And (I ask out of ignorance) in this scenario you describe why would whatever group managing whatever bitcoin exchange or whatever is being used remain virtuous and not charge a 30% markup themselves?

<comment><USER9> > Does this hypothetical situation you describe exist anywhere outside of the > hypothetical situation posited by a character in a Neal Stephenson novel?

That indeed is a bunch of real situations that have happened to me in 2014-2015 and some of that is still a thing. Check your privileges, sweet summer child.

Like seriously — for the first 30 years of my life it was outright illegal to have a bank account in a foreign country in my name. Not enforceable in practice, except I can't make wires between two.

So 2014, fucking Russia is being Russia again, USD wired from foreign clients goes in... and is sold for UAH at government mandated rate. I sit in a third country, withdraw it through ATM. Guess what? It is converted back to USD at a market rate. Of course you can still bring cash or btc in and sell it at market rate plus some margin, but not 30 damn percent.

Sometimes it's less dramatic and web interface of your bank doesn't have regexp for IBAN format of destination country. Ridiculous but have happened as well, so I have proxied IBAN that starts with GB instead of UA and that always works.

<comment><USER11> > _Check your privileges, sweet summer child._

Please don't do this here. It is needlessly condescending and insulting.

<comment><USER12> It is, but maybe start telling op?

"Does this hypothetical situation you describe exist anywhere outside of the hypothetical situation posited by a character in a Neal Stephenson novel"

<comment><USER5> That's a legitimate question

<comment><USER13> I think they're arguing about tone, not accuracy.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> > not only uses a hash tree, but it forms a hash tree for every file in the > torrent [...]

> Files that are identical can also more easily be identified across different > swarms, since their root hash only depends on the content of the file.

Wait, content addressed blobs across swarms... does that mean torrents made by completely different people at different times that happen to contain one or more identical files can benefit from each other's peers? If so this feels like a significant feature that would boost the long term health of a lot of torrents and connect more peers that could be helping each other.

<comment><USER15> This right here is the biggest new feature in my opinion, and should have been discussed in more depth in the announcement. I also think they should have pursued this avenue further before releasing v2.

Content addressing is one of the big advantages of p2p applications, and IPFS has been pushing it for a long time.

Just imagine if this was done all the way down to the piece level. You have two different torrents (say, Linux ISOs) where 20% of the pieces overlap due to similarity (maybe a point upgrade or something and you want both versions). Rather than 100% of both, you only need to download the shared pieces once. Not only that, but say that the latest version has many more seeds/peers, you could download the pieces from that swarm instead, saving the bandwidth of the older torrent's swarm for the remaining 80% you need to download.

This could probably be done client side somehow, but it would be good to see actual protocol support for it so that bittorent can move in that direction.

<comment><USER16> Only if blocks have the same offset in the same binary and if they align with the block boundaries. Otherwise, different hashes would be generated. I don't expect that to happen a lot.

<comment><USER17> There are ways around this. See "content-aware chunking", e.g. implemented using rolling hashes [1]. This is for example what rsync does.

The idea is to make blocks (slightly) variable in size. Block boundaries are determined based on a limited window of preceding bytes. This way a change in one location will only have a limited impact on the following blocks.

[1] [https://en.wikipedia.org/wiki/Rolling_hash](https://en.wikipedia.org/wiki/Rolling_hash)

<comment><USER18> Rolling hashing is really only useful for _finding_ nonaligned duplicates.

There isn't a way to advertise some "rolling hash value" in a way that allows other people with a differently-aligned copy to notice that you and them have some duplicated byte ranges.

Rolling hashes only work when one person (or two people engaged in a conversation, like rsync) already has both copies.

<comment><USER19> I think you misunderstood how the rolling hash is used in this context. It's not used to address a chunk; you'd use a plain old cryptographic hash function for that.

The rolling hash is used to find the chunk boundary: Hash a window before every byte (which is cheap with a rolling hash) and compare it against a defined bit mask. For example: Check if the first 20 bytes are zero. If so, you'd get chunks with about 2^20 bytes (1 MiB) average length.

As a good explanation, I'd encourage you to look at borgbackup's internals documentation: [https://borgbackup.readthedocs.io/en/stable/internals.html](https://borgbackup.readthedocs.io/en/stable/internals.html)

<comment><USER20> I think they understood just fine.

If I discover that the file I want to publish shares a range with an existing file, that does very little because the existing file has already chosen its chunk boundaries and I can't influence those. That ship has sailed.

I can only benefit if the a priori chunks are small enough that some subset of the identified match is still addressable. And then I may only get half of a two thirds of the improvement I was after.

<comment><USER21> The idea is that on none random data, you are able to use a heuristic that would create variable-sized chunks that fit the data. The simplest way seems to detect padding zeros and start a new block on the first following none zero byte. There probably are other ways, knowing the data type should help.

<comment><USER20> That seems fairly unlikely. Not a lot of big files have zero padding, and if they did them compress them. It will reduce your transfers more than and range substitutions ever will.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> If you want to try a client with v2 (and v1+v2 hybrid) support, I've just released PicoTorrent v0.20 [0] based on Rasterbar-libtorrent 2.0 :)

[0] [https://github.com/picotorrent/picotorrent/releases/tag/v0.2...](https://github.com/picotorrent/picotorrent/releases/tag/v0.20.0)

<comment><USER23> Nice. If anyone is wondering if they should try this, picotorrent is probably the most lightweight GUI torrent client for windows (no linux/mac version).

<comment><USER24> What are you using for the GUI layer, and what's your stance on accessibility? The fact it's Windows only gives me hope.

<comment><USER22> I'm using wxWidgets, so it's the Win32 API at the lowest layer. For accessibility I want to make it support the NVDA screen reader which I think would make it support other readers as well :)

<comment><USER25> wxWidgets is a decent choice. Not all of its controls are accessible though. Most infamously, the wxHTML control (wx's own HTML engine) isn't accessible, but the web view control (using the OS's web browsing engine) is accessible if you futz around at the native layer to force the keyboard focus into the right place. Also, on Windows, the list view control is accessible but the data view control is not. Frustratingly, the opposite is the case on Mac and (I think) GTK.

I suggest you test with Narrator rather than NVDA. Disclosure: I work on the Narrator team at Microsoft. But that's not why I say this. The reason is that NVDA and JAWS have some ugly hacks that they can use to make some GUI implementations (particularly using Win32 with GDI for graphics) accessible even if they're not accessible by design. For details, do some searching on the term "off-screen model". Narrator doesn't have this, so if your product works with Narrator, you know it's really accessible.

<comment><USER22> That's really valuable, thank you!

</comment></comment></comment></comment></comment></comment><comment><USER26> It feels like this isn't a large enough leap forward. It would be nice if BitTorrent v2 made it harder for ISPs to identify what is bit torrent traffic. AT&T artificially slows down upload speeds.

<comment><USER27> Why don't ISPs bill by the gigabyte and be done with it?

<comment><USER28> Because customers lose their minds with that model, largely as a result of conditioning that "internet" is an unlimited resource (which of course it is when instantaneous demand <= supply, but during high traffic periods that isn't the case).

Personally I understand the economics around it, but still don't like the idea of paying per GB. I would end up skipping some Netflix and would get mad at kids for playing Netflix to an empty room (much like I currently get mad when they leave the lights on in an empty room). It's nice on a personal level to avoid that.

<comment><USER29> I _really_ don't like the idea of limited bandwidth or charging per gigabyte because I know ISPs will rip people off and still not upgrade their networks to handle more traffic.

But I think it would considerably change the Internet landscape. No more listening to the _same exact song_ multiple times on Youtube or Spotify or whatever. No more downloading then deleting the same stuff over and over again. I think about it often, what a massive waste of bandwidth, I don't even know why. It's a lot of electricity used, I guess?

Even though I've got unlimited fiber, I'm looking for some sort of local "Internet cache" solution that would store _everything_ so it would be re- downloaded from my home instead of across the ocean. Would be great for outages, too.

<comment><USER30> > _It 's a lot of electricity used, I guess?_

Is it though? How much electricity is used to serve a 1080p Netflix movie several times vs. playing the same movie from a local storage medium?

If you asked me, I'd rather burn Bitcoin mining rigs if I wanted to get rid of electricity waste.

<comment><USER29> Yeah, I don't know. I just think about the bandwidth we all use sometimes and it seems extremely wasteful and it bothers me for some reason. I use around ~200-300 GB/month, which I thought was a lot until I saw how much other people use :D

<comment><USER30> > _I use around ~200-300 GB /month_

Pretty sure I use more than that in a day.

<comment><USER31> That's a lot of linux isos to download per day.

Seriously, why would you use that much data per day for? Even getting full blu-rays you wouldn't be able to watch that many.

<comment><USER30> It's more up than down.

<comment><USER31> Bless you, good sir.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> Very interesting. But I'm not totally clear -- what does this mean for compatibility with v1?

The article states that _hybrid_ torrents that support v1 and v2 can be created. But what does this mean for end-users (clients)?

Will most torrent software be upgraded to support both v1 and v2? And will a client be forced to choose from the v1 or v2 swarm, or will it be able to download from and seed to both?

I mean it _seems_ like clients would participate in both swarms -- I'd just like to know if that's confirmed.

Also, is is possible to add v2 to existing torrents "retroactively"? Who would do that? Or would this solely be for new torrents moving forwards?

<comment><USER33> A v2-aware client that also supported v1 and hybrid torrents would tick all boxes and be able to participate in multiple swarms (for the same torrent).

The main issue that I see is the existence of millions of torrents in private trackers that would have to be manually updated for v2.

Are people going to bother? I think not. So for me, v2 is practically a new- torrents-only affair.

<comment><USER34> The sites could perform a bulk update for all their torrents if they so chose.

<comment><USER35> To update you need the data so you can rehash it. A typical tracker only has the torrent files and would take a very long time and spend a lot of possibly expensive bandwidth to download all the tracked torrents. And some torrents may not be seeded all the time.

<comment><USER29> They often just have the magnet links. I haven't looked into how that works, but I think the complete data is only on the seeders' machines, and the torrent propagates through DHT.

<comment><USER36> Private trackers do not use magnet links afaik.

</comment></comment></comment></comment></comment></comment><comment><USER37> I remember one of the original bittorrent guys asking for help/recruiting on some IRC channel. He said it was a transformative project. He was laughed off as the next "wanna create mmorpg" guy. For once they were wrong.

</comment><comment><USER38> I've written a torrent client, and I'm skeptical than v2 will ever catch on. While it does solve some minor problems, it's not a large enough leap forward to justify the costs.

<comment><USER39> I don't know much about protocol version pacing, but was lack of substantial changes part of the reason it has taken 12 full years to get a client to support v2?

[http://bittorrent.org/beps/bep_0052.html](http://bittorrent.org/beps/bep_0052.html)

<comment><USER40> 3 years, not 12. BEP 52 was based on BEP 3 and kept the same metadata, including the creation date.

[http://bittorrent.org/beps/bep_0003.html](http://bittorrent.org/beps/bep_0003.html)

</comment></comment></comment><comment><USER41> SHA1 has a collision, so now it uses SHA256. How long until a SHA256 collision? Shouldn't the new protocol just add support for many modern hash functions, and client updates can disable support for hashes that become insecure later? Or does this introduce its own headaches? That's what SSH does, right?

<comment><USER42> Why not BLAKE3? I am really curious. I mean, since it exists, why not that over SHA256? Because it is relatively new?

<comment><USER43> I would guess that the reasoning is similar to why Git is moving to SHA256 (from SHA1) rather than to BLAKE3 — SHA256 was around 5 years ago and the major design change has been in the works for a while (BEP 52 dates to 2017). BLAKE3 (2019) would be a fine choice today.

<comment><USER42> I see. Thank you! By the way, I have not thought much about it, so in case you may know: would not it be possible to implement this in a way that allows swapping the hash function? So for example when we run into issues with SHA-256, change the hash function to something else.

<comment><USER43> We already can: the "swap" will just be a v3 along the same lines.

<comment><USER42> Yeah, but would not they have to create v4, v5 and so forth every N years, for different hash functions?

<comment><USER43> Sure, but this is not any more expensive than any other versioning scheme you might be thinking of. Consider also that they got 19+ years out of v1, and that there is no reason to believe SHA2 will be broken faster than SHA1.

<comment><USER42> Probably, but would it be possible to make it so that one could easily swap the hash function? Like I am curious about the details here. I think it would be. Clients probably will have to implement a couple of commonly used hash functions, and so forth. I am not sure how it would work in practice or if it is worth it at all. I am interested in all the details though.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER44> > per-file hash trees

This is huge. Now the protocol supports downloading identical files from multiple torrents simultaneously.

</comment><comment><USER45> Has there been any progress on advancing BEP-46 (mutable torrents) [0] along the standards track? I didn't see any mention of it in this announcement, despite my hopes of seeing it as a flagship feature.

[0]: [http://www.bittorrent.org/beps/bep_0046.html](http://www.bittorrent.org/beps/bep_0046.html)

<comment><USER46> The BEP itself is almost trivial. The difficult work is implementing it in a client that makes it useful for users and content providers.

In the wild west of the internet "update" really only means "add" because you don't want the source you barely trust to provide some data to issue an update that deletes all the previous download from that source. But you also want to avoid wasting storage so some size caps and rehashing old data to see if it's an incremental update will also be needed.

</comment></comment><comment><USER47> What is the current relationship between BitTorrent Inc, which I think developed the original BT v1 protocol and client, and Libtorrent? Which I think was a 3rd party BT Library written in C++ because the official version was in Python which was resources hungry.

<comment><USER48> You got your relationships wrong.

Bram Cohen developed BitTorrent and released a (Python) reference implementation in the public domain (later under MIT and then GPL licenses); he later founded BitTorrent Inc. and assigned this implementation to the company to maintain. Eventually BitTorrent Inc dropped this codebase altogether and became closed-source with a completely separate project.

Libtorrent is just one of many independent BT libraries that have been developed since Bram published the first BT client.

<comment><USER47> >You got your relationships wrong.

??

So there are no relationship between the two?

>Eventually BitTorrent Inc dropped this codebase altogether and became closed- source with a completely separate project.

That was from the acquisition of utorrent.

<comment><USER43> Correct, no relation between the two.

</comment></comment></comment></comment><comment><USER49> Talk about an un-mobile friendly website

<comment><USER50> It even manages to evade the usual "Show simplified view" bottom bar that Chrome mobile shows when it detects that a page is likely hard to read.

Rather ironically, you get a much more readable view if you select "Desktop site" in the Chrome mobile menu and then double-tap the main text column.

</comment></comment><comment><USER51> Since the article mentioned bencoding and provides sample .torrent files, I'd like to show my code for parsing and visualizing bencode structures: [https://www.nayuki.io/page/bittorrent-bencode-format- tools](https://www.nayuki.io/page/bittorrent-bencode-format-tools)

<comment><USER52> Can I suggest including an example .torrent file (for something legal) for those that don't have one to upload.

</comment></comment><comment><USER53> This is pretty cool. Per-file hash trees is something I've been missing for some time now.

</comment><comment><USER54> According to the blog, BitTorrent v2 now tightens the possible block size to power of 2. But does that still allow for the blocks to be variably sized and created by, for example, a rolling hash-based chunker, like Buzzhash or Rabin?

I'm asking, because this would allow for sharing of big files across swarms, even though the files might be slightly different.

</comment><comment><USER55> > All new features in BitTorrent v2 that are not backwards compatible have > been carefully given new names, to allow them to coexist with the v1 > counterparts.

This seems like a really cool approach that could be applied lots of other places where versioning can be tricky. But probably also hard to come up with new, good names.

</comment><comment><USER56> > It is possible to include both a v1 (btih) and v2 (btmh) info-hash in a > magnet link, for backwards compatibility.

The amount of effort into backward compat and keeping the general UX the same (ie: no overly-large new Magnet urls) is really appreciated.

Hopefully this will find quick adoption in both clients and submissions.

</comment><comment><USER57> I remember World of Warcraft using the bittorrent protocol internally to distribute updates, which was an smart use at that moment considering the horde of people downloading at the same time.

</comment><comment><USER58> > Identical files will always have the same hash and can more easily be moved > from one torrent to another (when creating torrents) without having to re- > hash anything. Files that are identical can also more easily be identified > across different swarms, since their root hash only depends on the content > of the file.

As a question for someone who knows better - does this mean that you can download single files within torrents themselves? I imagine if each file is independently hashed, this should be possible.

<comment><USER59> >As a question for someone who knows better - does this mean that you can download single files within torrents themselves?

Most torrent clients can do this already, but depending on how the torrent was created and the size the files involved you might download a some of the files on either side.

</comment></comment><comment><USER60> Does anyone know any tutorial, article or any learning material related to creating BitTorrent-powered applications? Something simple, like sharing pictures or even text files.

</comment><comment><USER61> It seems like this breaking-change would have provided an opportunity to improve compatibility with WebTorrent, which AFAIK requires a separate swarm (connected via WebRTC)

</comment><comment><USER62> There are a few things I wish this addressed, but it doesn't. Off the top of my head:

1\. the new hash function is going to be broken eventually - what happens then? 2\. support for "remixes". It would be nice to reference pieces from another torrent. Example use case: adding subtitles for a movie. Right now it requires either downloading the "main" version of the movie and getting the subtitles externally, or sharing the file from scratch.

<comment><USER63> > the new hash function is going to be broken eventually

SHA-2 will not be broken as easily as SHA-1. This seems to be a common misconception in this thread.

Wikipedia: "Since 2005, SHA-1 has not been considered secure against well- funded opponents".

This was 10 years after its introduction (1995) and 15 years ago. We had 15 friggin' years and we're finally switching git and bittorrent around. It took 2017-2005=12 years to get from first serious signs of issues to [https://shattered.io](https://shattered.io).

SHA-2 is now 19 years old and the "uh oh, better switch before it's too late" recommendation has not come yet. It's withstanding the test of time better and there haven't been 12 years to mature any weaknesses. The theoretically known attacks for SHA-2 are fairly insignificant.

Since SHA-2 had a similar construction to SHA-1 (Merkle-Dåmgard), NIST figured they better launch the SHA-3 competition at the first sign of trouble and picked something with a very different operating principle. For now, however, it's still fine. Thomas Pornin put this a bit better than I can: [https://security.stackexchange.com/a/21116/10863](https://security.stackexchange.com/a/21116/10863)

As for "what happens if/when it will be broken": we could make BitTorrentv2 another multi-crypto soup like with TLS, but then you open up a can of downgrade attacks, potential null ciphers or other such tricks simply due to increased complexity, and you still can't switch that quickly because everyone needs to take manual action in changing configuration files. Much better if we can instead do apt upgrade and let the software take care of making security decisions rather than those who install the software. (Remember that SSL was designed in 1994, when LiveScript/JavaScript didn't even exist yet, DES was state of the art, and we wrote books with algorithms because cryptography was ammunition. Having multiple options for strong/weak ciphers was not yet a crazy idea.)

</comment></comment><comment><USER31> Does anyone care to summarize the changes?

<comment><USER64> As far as I can see, TFA _is_ the summary of the protocol changes. If you want a summary of TFA, I suggest reading each section's heading and first sentence or two. Possible exceptions are the _hash trees_ and _directory structure_ sections, which are more technical than user-facing (read all or none of them).

Not trying to be rude – I found the blog post rather informative and concise!

</comment></comment><comment><USER65> Since we're on this topic, what's your torrent client of choice HN? I plainly use BitTorrent nowadays

<comment><USER66> qbittorrent, hands down :) Open source, cross platform and relatively small footprint (native), uTorrent-like UI.

I believe it uses libtorrent under the hood, so this might be integrated soon.

<comment><USER67> It seems they still can't be bothered to implement a proper "stop" button, despite many requests over the years. When the devs refuse to listen to their users, that's software I won't use.

<comment><USER66> Went to look up the issue - the dev's response seems reasonable to me.

[https://github.com/qbittorrent/qBittorrent/issues/4965](https://github.com/qbittorrent/qBittorrent/issues/4965)

The only difference between qbit's pause and uTorrent's stop is the check if files still exist.

<comment><USER67> The fact that users do not see the behavior as the same is the problem. When the users are telling you how they use your software and you respond by saying "that's bizarre, don't do that", then there's a serious disconnect. Developers should be responsive to user feedback, not dictate how their software should be used.

<comment><USER68> I think the serious disconnect is in user expectations. Developers of paid produces should be responsive to user feedback. Developers of open source software are free (legally, ethically and morally) to care or not about user feedback exactly as much as they wish.

Users of open source software are free to fork the software if the original developer isn't responsive to their particular needs. They're not entitled to demand that the original developers respond to their feedback. They're even less entitled to complain when the develop _does_ respond with a specific reason why they won't act on their feedback.

<comment><USER67> I disagree. It's one thing to not have the time or bandwidth to change or add a feature. Certainly free users aren't entitled to a developers time. It's another thing to disagree with a style of usage and refuse to accommodate users out of principle. The software is marketed as an open source replacement for utorrent. If he wanted to treat it as his little fiefdom, he shouldn't position it as a replacement for utorrent. If I had any expectation that a pull request for this feature would be accepted, I would fix it myself. But his demeanor suggests otherwise. That's not the way to approach software that positions itself as a community project.

</comment></comment></comment></comment></comment></comment></comment><comment><USER69> The Hefur tracker software is going to be adding support for BitTorrent v2 soon:

[https://github.com/abique/hefur/issues/31](https://github.com/abique/hefur/issues/31)

</comment><comment><USER70> Won't the "per-file hash trees" make it easy to detect copyright infringement? (i.e. the same .txt signature file of a release group)

<comment><USER71> Adding noise and/or padding is trivial, it would just be done on a per-file basis. Of course, this would also lose the protocol's identical file feature, but that's not a regression vs v1.

</comment></comment><comment><USER72> What are people thoughts on transmission? I have never tried BitTorrent but I am curious to hear from others who might have tried both.

<comment><USER73> Currently using transmission-remote for a headless Linux box living beside my desk, and a count approximating 1100 torrents (with the only public ones being Linux ISOs).

It works _exceedingly_ well. I've never had it falter or slow, despite the number of torrents. My preferred client for desktop and server :)

</comment></comment><comment><USER74> Can anyone give examples regarding how they are currently using BitTorrent ?

<comment><USER75> Linux ISOs downloads mostly.

</comment></comment><comment><USER76> Need to work on their mobile friendly.

</comment><comment><USER77> What is the use space of BitTorrent?

</comment><comment><USER78> just a little umh [https://www.virustotal.com/gui/file/6dbe03438a95bc295ca64d49...](https://www.virustotal.com/gui/file/6dbe03438a95bc295ca64d49e6356360adca84b093696f6fb596821c652e1e66/detection)

</comment><comment><USER79> TLDR

[https://twitter.com/markopolojarvi/status/130324298806421094...](https://twitter.com/markopolojarvi/status/1303242988064210944?s=21)

\- new hash function

\- more efficient and less error prone .torrent files

\- each file in the torrent gets its own hash meaning deduplication across torrents is feasible

\- backwards compatible with v1

</comment><comment><USER80> hmm, looks like still no support for data streaming :(

<comment><USER80> well, I meant live streaming here.

<comment><USER81> That would require mutable torrents correct?

<comment><USER80> yeah, that is one way to do that.

</comment></comment></comment></comment><comment><USER82> It would be nice to have a torrent system where noone that is uploading has all the data for a specific torrent (or at least they arent uploading the whole file to any specfic person... probably would be harder to prosecute in the event that some files become illegal)... You could take 1% of the billonaire's fortune and give it to the "victims" and everyone would be happy.

<comment><USER83> If you want to circumvent the law, you must find a legal technicality, not a technical technicality.

The key weakness in every smartass technical technicality to circumvent the law is forgetting that _intent_ is core concept when the law is interpreted in the court.

Did the defendant have intent to do X? Did the defendant use some purpose build technique to avoid doing the most literal interpretation X ? .. Yeah, defendant is guilty of doing X.

<comment><USER82> "must find a legal technicality, not a technical technicality."

I think we are ok as long as there are no precedents? Isnt that how smartass laws work?

<comment><USER84> If you want to be the next David LaMacchia or Shawn Fanning I guess.

</comment></comment></comment></comment><comment><USER85> Great! Looking forward ysing it

</comment><comment><USER86> _To me, BitTorrent feels a lot like Blockchain: interesting tech that doesn 't seem to be able to find a practical and useful application (proportionate to the attendant hype). Which is not to say that either can't, they just haven't yet. Why?_

EDIT: while I don't (yet) consider myself delirious, responses to this comment have illuminated how little I know about the influence and application of BitTorrent. In other words, I retract the above opinion.

<comment><USER87> You're delirious.

Setting aside the fact that BitTorrent came about long before BitCoin was a glint in Satoshi's eye, it's still massively used for content distribution, on top of being a foundational technology to several industrial applications: Apache Spark, for example, uses BitTorrent to shuffle/broadcast data around cluster nodes.

Even when BitTorrent alternatives are used in its place (such as IPFS, Dat, or Kademlia), BT was still a massive influence in all of their designs, and to the design of any other DHT that came about after its release.

All of these, plus other systems that are (in abstract) similar constructions, have several industrial applications for asset distribution (Netflix uses IPFS to distribute container images internally [0], Uber and Alibaba do similar things) and network management (DNS for example, is really just a DHT, as are several other network protocols)

Ever since BitTorrent came about, it has unequivocally been a resounding success. It never for a moment had to look for applications, there were already plenty since day one.

[0] [https://blog.ipfs.io/2020-02-14-improved-bitswap-for- contain...](https://blog.ipfs.io/2020-02-14-improved-bitswap-for-container- distribution/)

<comment><USER88> > it's still massively used for content distribution

Is it, though? Youtube doesn't use it, neither do Netflix, Hulu, Amazon Prime Video, Disney+, Spotify, etc. Does anybody (except for Blizzard) use it? I don't think Steam or the Epic store or the App Store or the Play Store use it, either.

I'd be extremely glad to be proven wrong.

<comment><USER48> I believe Steam uses it. The network graphs they spout show behaviours consistent with BT-like activity.

I'm pretty sure the BBC iPlayer used it too, at some point (no idea if it's still the case).

Most Linux projects use it.

Any company offering a "download manager" for 1GB+ files, is likely to be implementing something similar to BT behind the scenes.

The thing is: if bandwidth costs are a real problem for you, BT is a killer solution to offload some of those costs. If they are little more than a footnote (like for the mega-services you list), then BT is unnecessary and it will probably slow down overall performance too.

<comment><USER59> v1 of iPlayer used bittorrent, but these days it's all streaming.

</comment></comment></comment></comment></comment><comment><USER89> Is there ever going to be a production ready BitTorrent application implementation in Python or is just not feasible with the GIL? It would be nice to be able to use BitTorrent for basic p2p capabilities in a pip installable fully Python app.

</comment><comment><USER49> I feel like a lot of the terms has blockchain in nature but they never specifically state it.

<comment><USER90> Bittorrent was pioneering distributed architecture while bitcoin was still a future thought in Satoshi's mind.</comment></comment>


Requests v2.0 Python module released - <AUTHOR> http://docs.python-requests.org/en/latest/community/updates/#release-history

<comment><USER2> Congrats, Kenneth!

Requests is one of the best Python modules ever written, and I use it (literally) every day. Good stuff, man!

<3

</comment><comment><USER3> Cool! Requests has got to be my favorite Python library. There are so many times I have replaced ~80 lines of urllib2 ugliness with 2-5 lines of requests. Simple, Pythonic, pretty...

<comment><USER4> Same here, cuts having to write so much fugly code. Almost wish it was inclusive with Python itself since I primarily use the language for web dev.

<comment><AUTHOR> I don't, this would require fundamental changes to the module (such as how it handles verifying SSL certificates) and it would cause API improvements to stagnate.

It's painless to install, so I prefer it as a module I can just add to all of my routines.

I feel like stdlib is where cool Python modules go to die...

<comment><USER5> I've been thinking about your last line. The rest of this comment is musings.

I think argparse is a cool module, and definitely better than optparse or getopt for the types of things I do. Both optparse and argparse were external packages before becoming part of Python. Optparse is dead, but I don't think that argparse is dead.

Some modules have a longer cycle time than Python. For examples, the decimal module (based on the 'General Decimal Arithmetic' standard) and sqlite module (based on SQLite).

I think these modules are cool. I don't think either of them are dead. (But on the other hand, the *bdb modules and the underlying implementations are dead.)

Some modules spun off, developed for a while on their own, and merged back into Python. Two examples were 'turtle2' and 'unittest2'. I enjoyed using unittest2, and am glad that it's part of Python 2.7 and newer. I never used turtle, but it was used in some computer classes. The turtle2 author pointed out that some computers are so locked down that the teachers can't change anything, which is why a 'turtle' in the base install can be useful.

Elementtree was and is a standalone package. I use it for nearly all of my XML parsing needs. It has a C extension as an accelerator, which isn't always painless to install, especially if I want a pure-Python distribution.

But on the other hand, minidom and the other XML-SIG package are dead. Then again, I didn't think they were cool. ;)

I looked at what modules were added in 3.2 and 3.3: lzma, faulthandler, ipaddress, argparse, concurrent.futures, unittest.mock, .. and that's about it.

(Interestingly, PEP 3156 would likely replace concurrent.futures.)

So I think others agree that only the most stable of APIs should go into Python core. But I don't think that all cool Python modules which get into the core die.

<comment><AUTHOR> I guess I haven't considered restrictions on the machines where the modules are required. So there's definitely a reason for things making their way in to stdlib in those situations. (I wish the virtualenv stuff was packaged as part of core Python, to be honest...but that's a discussion for another time.)

My concern is the frustration (which may not be the right term) of having to continually bring things out of core, implement improvements, and then feed them back in to core. All the while being concerned with impact your changes may have on the entire ecosystem.

All-in-all, maybe it's just moot. This could probably just be chalked up to the ebb-and-flow of software development as a whole.

<comment><USER5> I looks like your complaint might be resolved soon. It seems that 'venv' is in Python 3.4 alpha [http://docs.python.org/3.4/library/venv.html](http://docs.python.org/3.4/library/venv.html) .

<comment><AUTHOR> Yeah. It's going to be taken care of eventually. I guess I should really get more hell-bent on converting my things to Python 3.

I'm hanging on to 2.7 for dear life. I openly acknowledge I'm a bad person for it. :(

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> What I don't understand is how this doesn't show up on top of Google's search results when you type "python rest client".

I bet TONS of time is wasted because it is harder to find this module than it should be.

<comment><USER7> requests is an HTTP library. REST is an architectural style.

<comment><USER8> Requests is a HTTP verb oriented HTTP client, REST is a HTTP verb oriented architecture. They are very compatible.

<comment><USER7> if so, OOP is purely functional programming oriented over a monoid in the category of endofunctors.

<comment><USER8> No.

</comment></comment></comment></comment></comment><comment><USER9> This is probably the single thing I miss the most when not using Python. It's a really great example of writing a library that lets the user get right to the semantics they want while simplifying a bunch of mostly unimportant details.

</comment><comment><USER10> There's a great improvement for the corporate environments too. Finally the https-over-http/connect is supported.

<comment><USER11> This has prevented me from using the official Jira python module. I literally just launched something hacky using urllib2 yesterday because of this... :(

</comment></comment><comment><USER12> Good work. I'm not in Python anymore, but every other language I'm in, I wish I had Requests.

</comment><comment><USER13> Do modules like this ever make it into the standard library?

<comment><USER11> I find it better that they stay out of the stdlib. Having to upgrade all of python just to get a new feature like CONNECT support would be unfortunate.

<comment><USER14> It also adds enormous friction to making changes/releasing updates in the first place.

</comment></comment></comment><comment><USER15> Cool! I did the `Session.prepare_request` change [1] and found the project maintainers extremely helpful and patient in discussing the best way to go about it as I stumbled around. It's a good codebase and an awesome library.

[1] [https://github.com/kennethreitz/requests/pull/1507](https://github.com/kennethreitz/requests/pull/1507)

<comment><USER16> Once again, thanks so much for that. Genuinely great work and we're so glad to have it.

</comment></comment><comment><USER17> Have they added support for SOCKS proxies yet?

I'm currently using `import requesocks as requests`.

<comment><USER18> I find it much easier to route socks requests via Polipo ([http://www.pps.univ-paris- diderot.fr/~jch/software/polipo/](http://www.pps.univ-paris- diderot.fr/~jch/software/polipo/))

Just run `polipo socksParentProxy=<host>:<port>` and then use it as a regular http proxy with requests (default port is 8123).

<comment><USER19> Which is good enough for singlular usage, it's crazy use it on servers.

</comment></comment></comment><comment><USER20> Does this finally include SNI support?

<comment><USER21> The underlying issue is with Python 2.x (which is feature frozen and won't get SNI support) but apparently Requests can support SNI if you install PyOpenSSL, ndg-httpsclien and pyasn1

ref: [https://twitter.com/mitsuhiko/status/363564610492063744](https://twitter.com/mitsuhiko/status/363564610492063744)

</comment></comment><comment><USER22> I first used requests to earlier this year to handle some obscure calls to the twitter API, and was absolutely astonished by how much work it saved me. Really amazing work.</comment>


Restarting America means people will die – five thinkers weigh moral choices - <AUTHOR> https://www.nytimes.com/2020/04/10/magazine/coronavirus-economy-debate.html <comment><USER2> We need 20 to 30 million tests a day to "restart" America. We can produce at that level, but we're not. We can debate the moral choices once someone in charge shows some competence. Until then it's basically insanity to have a defined solution and not attempt it. We're in a hole and debating throwing other people into holes instead of mass producing ladders.

<comment><USER3> We're barely testing anyone. I know of only two people tested among my NYC friends. One who is still in the hospital after surgery to improve his breathing. One who is a healthcare worker exposed to a known carrier. Two other friends exposed to a known carrier who got sick couldn't get tested because there weren't enough tests. Nor could the 5 others I know who had COVID-19-like symptoms. Nor could I.

<comment><USER4> While I don't think anyone would argue that we are testing anything approaching "enough" people in the US, I would certainly not say we're testing "almost nobody". Looking at Politico's testing tracker ( [https://www.politico.com/interactives/2020/coronavirus- testi...](https://www.politico.com/interactives/2020/coronavirus-testing-by- state-chart-of-new-cases/) ), most states outside of the hotspots in the Northeastern US have administered about 10x as many tests as they have positive cases.

New York and the surrounding areas are obviously a different matter, but at this stage I suspect that even if they did have enough physical tests and capacity to process them they would not have anywhere near enough medical staff to physically administer them. There's also the tradeoff that asking hundreds of thousands of people to leave their dwellings to seek testing would do more harm than good in areas where that necessarily involves walking, public transportation, etc.

</comment></comment></comment><comment><USER5> > The United States has a whole lot of wounds from decades of racist policies > and the criminalization of the poor. In 2011, Columbia did a study that > we've updated: At least 250,000 people die every year from poverty in > America. Now, in a pandemic, that's an open fissure.

That's an astounding figure, likely much higher than the final death toll for American C-19 cases will be. If we accept that kind of annual figure without collectively reflecting on our current system and its inequalities, what hope do we really have long-term? So much of the country is still denial that this is a real pandemic, we can't even agree on that.

<comment><USER6> In 2018, ~2.8 million Americans died, and 11.8% were in poverty as defined by the US Census criteria.

Presuming the numbers were slightly different in 2011, I have a cynical picture of how that study came to its conclusion.

</comment></comment><comment><USER7> [https://archive.md/AXPk6](https://archive.md/AXPk6)

<comment><USER8> the archive.md link returns 403 forbidden.

<comment><USER9> It seems if you're using 188.8.131.52 as your resolver they (the website operator, not Cloudflare) are returning that IP as their A record. Sigh.

<comment><USER10> 18.104.22.168 (and 22.214.171.124) are working great if you need an alternative public DNS server ([https://quad9.net](https://quad9.net))

<comment><USER9> No, but thanks. I am of the opinion that if a provider is going to blacklist me because of my choice of resolver, then they just are not worth my time working around. I am quite happy with quad1 as my DNS provider, and these archive services don't provide enough incentive for me to switch.

</comment></comment></comment></comment></comment><comment><USER11> As if people don't die every day.

</comment><comment><USER12> I keep thinking last few days, we need a communist mode. Basically, a way to change all of the normal rules to option B when necessary. Instead of making random laws that make no sense. A method of completely putting all existing loans on pause - effectively not due and not late and the next payment is effectively delayed until the communist mode is turned off. Communist mode should go a lot farther, but you get the idea.

<comment><USER13> How about instead of a "communist mode" and "capitalist" mode, what if we do what the rest of the civilized world does and have a "socialist" mode which operates alongside capitalism and provides a robust social safety net, and we considered actually funding and competently staffing government programs rather than opting for the Grover Norquist model of constantly trying to reduce government to "down to the size where we can drown it in the bathtub" and expecting the free market to pick up the slack in providing for the general welfare?

And how about we finally realize that trying to run the American government like a business and electing "CEOs in Chief" is a bad idea?

<comment><USER14> We don't need safety nets, most people have good jobs and are only having trouble because they have no savings and didn't otherwise plan for a crisis. Good lesson in personal responsibility, keep my tax money elsewhere please.

</comment></comment></comment><comment><USER15> This 'dilemma' shows with great clarity that the current economic system is dysfunctional, fragile and ultimately inhumane.

<comment><USER16> Every economic system is fragile and has dysfunction. The question is: how do we have less fragility and dysfunction; but I suspect you're getting at something else.

<comment><USER17> Yes, and the answer is clearly not American capitalism

<comment><USER18> The answer will likely include some sort of Economy, but it has to have much improved scope beyond Capitalism and needs to solve global problems.</comment></comment></comment></comment>