To Anyone Who Thinks They're Falling Behind in Life - <AUTHOR> http://www.huffingtonpost.com/jamie-varon/to-anyone-who-thinks-theyre-falling-behind_b_9190758.html?utm_hp_ref=mostpopular <comment><USER2> "Some people say good things come to those who wait. Truth is good things come to those who work. Who work later, who work harder. You're willing to go farther than anyone else to get them. If you are waiting for good things to come to you, it'll be waiting for a pretty long time." (from a Chrysler commercial featuring Dr. Dre)

I also partly agree with the author that you shouldn't beat up yourself to the point that you feel down and miserable every single day. One needs to find a balance between both taking time to step back and relax but also working hard to change certain things in your life which you don't like or aren't happy with. If you always take things as they are, I don't think you will be able to change a lot (obviously if you want to change anything in the first place).

</comment><comment><USER3> While I sort of get the point the author is trying to make, you're not going to become more creative without trying to become creative. It's not about just waiting for something to happen - it's about putting the work in. Motivation is overrated, discipline is what you need.</comment>


Why rivals Google and Apple agree on HTML5 - <AUTHOR> http://tech.fortune.cnn.com/2010/12/06/why-rivals-google-and-apple-agree-on-html5

<comment><USER2> They don't agree, they both need it to be ahead of the competition in the web arena. Microsoft lost a lot of time trying to hold the web back while they milked the most of the desktop world. Now they are catching up in desperation as they see their internet flagship IE sink to lowest levels ever.

So, all agree in HTML5, they all support it, because they all need it.

<comment><USER3> I don't think that the idea of Microsoft "trying to hold back the web" has ever crossed my mind, but damn if that isnt true. They are even shipping an IE7-level browser with Windows Phone 7

<comment><USER4> Oh, absolutely. That was their beef with Netscape, way back when: Netscape was a platform for delivering apps independent of the OS. NS was very explicit about it, talking about "crossware", applications written in HTML+JS+Java that would work on any OS where Netscape ran. It was premature—NS's one big crossware app, Netcaster, was slow and clunky—but still very scary to anybody that sold OSes.

(Edit: actually, it probably wasn't scary to any OS vendor but MS; the others were all happy to think that users might move to applications that could run on their OSes, too.)

</comment></comment></comment><comment><USER5> Google and Apple benefit from the volume of sales of apps through their "app" stores. By supporting a standard (and helping it be a good one, not one that has many proprietary interpretations), they can help extend the reach of apps, reduce development cost/time of app developers, and possibly increasing the volume of apps that get sold through their stores.

</comment><comment><USER6> This article says a lot about HTML5 but I don't think the author actually knows what it is. He's not a programmer and he seems to start from the position that programming languages are things which can be "owned."

<comment><USER7> If a single entity controls the platform for it, a programming language is effectively owned. For all practical purposes, Apple owns the platform for Objective-C. If more apps are developed using a cross-platform standard like HTML5 than a single-platform like iOS, that reduces lock-in, so why would Google or Apple want that? That Google want HTML5 to succeed (despite their own Android platform) is pretty much given. The author, however, is arguing that Apple _also_ wants HTML5 to succeed. Why? To prevent another platform from successfully competing with iOS, so that Apple can continue to offer the best user experience.

</comment></comment><comment><USER8> I think he's trying to say that Apple don't view it as a zero sum game in that they either get ios developers or some other platform does. By promoting HTML5 everyone gets those developers, including them, and so if everyone developers in html5 they essentially have all the competition plus who ever is natively developing, so they have access to a host of programs that might otherwise only be available on competing platforms.</comment>


Ultra-Low Latency Scenarios - <AUTHOR> https://antmedia.io/ultra-low-latency-scenarios/ <comment><USER2> Dunno if surveillance needs ultra-low latency. Actions taken on the ULL timescale would require people at the site who usually would have a view of the threat.</comment>


Sorry, RSA, I'm just not buying it - <AUTHOR> https://gist.github.com/0xabad1dea/8101758 <comment><USER2> True/sad story. So at Sun when I was building crypto tools for Java I wanted to be able to use the RSA public key algorithm in the class loader (part of a capabilities based security system). We negotiated with RSA for a right to use their patent in Java, which proceeded right up until the final contract came back (which our lawyer signed but I did not get a chance to review) where the wording was changed to be a license to BSAFE rather than the patent. Clearly I wasn't going to put BSAFE into the JVM, I l already had an implementation of their algorithm in Java. There was never a good explanation for how the lawyer got so "confused" at the last minute and "forgot" to have these changes reveiwed by the engineer leading the project.

Given the sort of shenanigans we've been reading about I would not be surprised to hear that someone who was neither a Sun or RSADSI employee said "spike this deal".

[edit: clarity]

<comment><USER3> I don't understand your "spike this deal" idiom. I can't make sense of an analogy to a spiked drink (rufie) or spiked football (scoring a point). The closest I can find is "spike somebody's guns" meaning "to spoil someone's plans". Do you mean someone wanted to prevent you from using RSA's patent in the JVM?

(I initially assumed you meant "force this deal".)

<comment><USER2> Sorry, it means to 'deny successful execution of the plan'. Originally spiking gun barrels a modern example was environmentalists driving spikes into old growth redwood trees that would cause massive damage to a chain saw blade should a logger try to harvest tree. Generally doing something which prevents a deal from actually working to make up for the fact that you were unsuccessful in preventing the deal from being agreed to in the first place.

<comment><USER4> Let's get our terms right. Tree-spikers are not environmentalists, they are vicious extremists. They are terrorists. The spikes don't just damage saw blades, they send sharp steel shards flying in all directions with the intent to to seriously injure or kill loggers or sawmill workers.

<comment><USER5> No argument on substance; someone who has no problem maiming or murdering in order, not even to save the life of a tree, but merely to punish people for having in some way been associated with a tree's demise, so places himself far beyond any civilized pale. Such a person deserves at the very least a stiff term in prison; should he succeed in his vile endeavor, he is best rewarded with a cigarette, if he wants one, and a nice sunny place to stand and enjoy it. (In case that's not sufficiently clear, I am talking about execution by firing squad.)

But you might want to avoid that word 'terrorist'. It tends to give people an excuse to shut off their brains and feel good about it, where convoluted rhetoric like mine tends to serve as an attractive nuisance ("I could give up on this, but then whoever wrote it might look smarter than me") for long enough to get a point across.

<comment><USER6> Advocating extreme violence (an execution with a firing squad) for a group as a punishment for violence( against tree loggers). Amazing hypocrisy.

<comment><USER5> Hypocrisy, sir? You astonish me. Is it hypocrisy to suggest that the punishment for maiming or murder, with the vilest of malice aforethought, should be judicial execution? -- a life, ended quickly and without suffering, for a life irrevocably ruined or destroyed in gory, agonizing horror? I think not!

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Not sure if this tidbit made Hacker News -- the OpenSSL project added Dual_EC_DRBG support at the request of a paying customer: [http://openssl.6102.n7.nabble.com/Consequences-to-draw- from-...](http://openssl.6102.n7.nabble.com/Consequences-to-draw-from-the- latest-Snowden-revelations-td46453.html#a46455)

They're under NDA and cannot reveal the customer's name. The thread doesn't say how much the customer paid, does anybody know? A friend told me 600k USD last night, but I cannot find any sources that back this up.

<comment><USER8> It's worth pointing out that at the scale mentioned, there's no reason that the "paying customer" had to be The United States National Security Agency. It was a published algorithm, and OpenSSL is used in countless commercial projects. It would have been entirely reasonable for one of these to have come to OpenSSL requesting implementation (albeit as part of a NSA-funded internal project with a 400% markup), and the request would have seemed entirely reasonable.

I don't think you can tar the OpenSSL folks with this without much better evidence.

<comment><USER9> OTOH, the fact that the delivered code had a bug rendering it unusable suggests whoever requested it didn't really need to _use_ it – or they'd have discovered the bug earlier. That's vaguely suggestive the client may have paid for its inclusion for mere show, or as a favor for another entity.

I wonder: is the client which paid for the non-functional implementation, which if I understand correctly is now scheduled for deletion rather than fix, entitled to a refund?

<comment><USER10> "Implement ALL the algoirthms" sounds like a requirement drafted by somebody enamoured of the standard rather than by somebody looking at what they were actually going to use.

"Our product is compatible with all of <impressive sounding standard>" may, indeed, have been worth the money to the customer even if the value was marketing rather than technoloogy

</comment></comment></comment></comment><comment><USER11> NSA didn't need to backdoor DES when they just forced everyone to use weak keys:

> 1979 - Present, DES: The Data Encryption Standard was altered by the NSA to > make it harder to mathematically attack but easier to attack via Brute Force > methods. The original version of DES, called Lucifer, used a block and key > length of 128-bits and was vulnerable to differential cryptanalysis. NSA > requested that the already small DES key size of 64-bits be shrunk even more > to 48-bits, IBM resisted and they compromised on 56-bits11. This key size > allowed the NSA to break communications secured by DES.

[http://ethanheilman.tumblr.com/post/70646748808/a-brief- hist...](http://ethanheilman.tumblr.com/post/70646748808/a-brief-history-of- nsa-backdoors)

This is why any known NSA employee from security standards groups (including IETF and Trusted Computing Group [1]) must be forbidden to participate in the making of that standard. Their role there can only be seen as to facilitate weakening of the standards, either by weakening the algorithms themselves, or if that's too hard and/or obvious, to convince everyone else to use a weaker version of it (which NIST kind of tried to do with SHA-3 recently, too).

As long as there's any chance of NSA being involved even remotely in a security standard, I'm going to lose faith in that whole standard and the group.

[1] - [http://www.securitycurrent.com/en/writers/richard- stiennon/i...](http://www.securitycurrent.com/en/writers/richard-stiennon/it- is-time-for-the-trusted-computer-group-to-repudiate-the-nsa)

<comment><USER12> I did consider trying to work in the part where they shortened the keys and eventually DES became useless because of it, but it was a bit of a diversion from the salient (heh) reason I put this on the timeline, that they improved the s-boxes without explanation and that colors any subsequent requests they made to do similar.

</comment></comment><comment><USER13> I think there are two types of commentators on this issue. Those who've been involved in negotiating agreements like this and those who haven't. Those who have can see how something like this happens. Those who haven't cannot believe how something like this could happen. It's important to remember/realize that _no one_ , outside a handful of folks, understood what the NSA was up to until the last 12 months. Heck, at one point not too far back it was probably prestigious to mention you worked closely with the NSA on developing your technology. Help you impress a few corporate execs and close some deals.

<comment><USER14> _It 's important to remember/realize that no one, outside a handful of folks, understood what the NSA was up to until the last 12 months._

There were loads of people - members of the general public, security researchers, government watchdog types, privacy advocates, crazy conspiracy nuts, etc. - who very strongly suspected, for good reason, exactly what turned out to be going on.

ECHELON started in the 1960s. Rumors about it were everywhere by the early 1990s. It became so famous it was featured in pop-culture movies, TV shows, and video games.

There was at least one good book (note 2005 publication) that showed how it was possible to piece together some pretty good guesses about what was happening from unclassified information:

[http://www.amazon.com/Chatter-Dispatches-Secret-Global- Eaves...](http://www.amazon.com/Chatter-Dispatches-Secret-Global- Eavesdropping/dp/1400060346/ref=sr_1_2)

In short, that book argues the NSA was expanding its eavesdropping capabilities so enormously, so quickly, that the only reasonable target for it was "everything." There simply weren't enough top-secret, diplomatic, or encrypted messages to justify the infrastructure devoted to the task; the NSA had to be developing the ability to listen to absolutely anything it wanted to.

<comment><USER15> Frankly, if somebody started talking about ECHELON about 1 year ago, I immediately put him into "9/11 truthers and other conspiracy theorist" category.

<comment><USER16> Instead of revealing your ignorance, you could read up on ECHELON, which was becoming a bigger issue in Europe already in the 90's, there was an investigation by the European Parliament in 2000/2001, and coincidentally 9/11 is probably the reason why the US&Britain didn't get to bear the cost at the time. Now they are (Boeing, CISCO, IBM, ...) and will probably continue to for some time to come.

<comment><USER17> Given the lack of mass outrage, I think people are still in some sort of denial. Or perhaps its seen as being too huge to really do anything meaningful about. In the UK, politicians are still mostly trying to sort of shrug it off. Even across Europe, there is not real outrage at the fact that the UK, as a sort of internet EU to US hub, is selling out the EU to the US. Its all too muted for my liking. Cant help thinking that behind the scenes the US is trying to broker some sort of deal. I dunno, intelligence sharing or whatever.

</comment></comment></comment></comment></comment><comment><USER18> Are EMC/RSA denying that they took money from the NSA? That alone seems damning, since I can't think of any way that the existence of such a contract for any stated purpose doesn't undermine the credibility of the company fatally.

<comment><USER19> Really, "implement this, it'll help us get our pet standard through the process" isn't _that_ unlikely a request to get - standard processes are rife with shenanigans at the best of times, and more companies/agencies than you'd hope take part in those.

Also, note that "the NSA is backdooring American crypto" has not always been considered a likely proposition.

(Of course, all of the above is bad/wrong; it's just not _that_ much worse than you'd expect. " _That_ much worse than you'd expect" is [http://en.wikipedia.org/wiki/RSA_Security#Security_breach.](http://en.wikipedia.org/wiki/RSA_Security#Security_breach.))

<comment><USER18> Sure, it's exactly the sort of request you would expect.

It's also exactly the sort of request you need to stay well shut of if you want credibility as a crypto provider to business and consumers. Any interactions with agencies like the NSA taint you, regardless of the intent. By their very nature they are suspect in this context.

</comment></comment></comment><comment><USER20> I don't think the, "We trusted the NSA" explanation makes them look stupid or negligent. This article does reference the fact that people are now retroactively claiming understanding of some of these revelations, but I think the writer forgets that this might apply to him as well.

NOW it makes perfect sense to see how terrible this is, but we haven't always just blatantly assumed the NSA was out to get us. They used to not have the worst reputation in the world in the security community, right? I'm not the best authority for this, but from what I could gather they played a kind of spooky-but-helpful role prior to the Snowden leaks in the intelligence community - that is, you could generally _trust_ they were thought to have the community's best interest at heart, even if they couldn't say why.

<comment><USER21> "It's not true. It's not true. It's not true.

"...

"It's old news."

I'm loosely quoting a source I can't remember, but I think it was ridiculing a repeated tactic of some candidate. It's a dynamic that seems to play out a lot if you know to look for it in issues that involve a lot of public relations games.

I think you are right to emphasize how little we remember when we learned what. That's why the above tactic works so well. It lets politicians' dance around their tactical mistakes and change positions without undermining their own base. It is also how disingenuous people can now able to talk about "welcoming debate" and have a large portion of the population perceive this as advocating some reasonable middle ground.

<comment><USER22> "It's not true. It's not true. It's not true.

"...

"It's old news."

Anyone older than 22 or so who doesn't recognized that as a time-worn and common tactic hasn't been thinking critically.

<comment><USER23> Not sure why this continues to work myself.

<comment><USER22> I think people get into rhythms and follow the script they've learned. This plays out in the large and in the small. We've all probably had multiple arguments where A says one thing, and B automatically retorts in defense rather than thinking about what we're talking about or even just letting it go. I think a lot of marriages run like that.

People unfortunately think a well spoken response is the same as a truthful response. If the PR flack or representative or CEO seems otherwise calm and unflustered - smooth - then that serves the "reasonable response and explanation" part of that scenario's script.

We are very, very easily lead.

</comment></comment></comment></comment></comment><comment><USER24> "As a bonus, all the other algorithms are apparently faster and that's generally a desirable property."

I apologize for discussing a technical topic in whats likely to be a political crypto-rage flamewar, but I've been digesting some thoughts about this and the figure of merit of processing required per bit of randomness is probably interesting, in that for a given set of professional grade RNGs (not algorithms implemented by idiots) the more processing required to generate a bit of randomness, the more likely it is someone's sticking a nasty backdoor in.

Or rephrased the more time you spend sticking magic "nothing up my sleeves" constants into a bit, the more likely something unpleasant is getting stuck in there.

(edited to add I'm talking about "real" RNGs not implying the worlds simplest shortest LFSR is magically better than a real RNG just because its really fast... I'm talking about more "in class" performance comparisons than joke vs real.)

<comment><USER25> It depends on what you are talking about, sometimes you want a slow protocol, since it makes bruteforcing the original value more complicated.

I can't wrap my head around why that would matter for a PRNG, but it sometimes does have value.

<comment><USER26> And that's exactly what had everyone else scratching their heads, too!

There are plenty of slow random number generators. They're easily built from cryptographic hash functions [1]. Heck, use something like Bcrypt as your hash and you can get as many seconds per number as you like. The reason we don't use them even though they work perfectly well is that they are too slow.

The challenge is making a fast PRNG that can maintains the properties of cryptographic randomness. That's why everyone was so confused with dual EC.

[1] [http://en.wikipedia.org/wiki/Cryptographic_hash_function#Use...](http://en.wikipedia.org/wiki/Cryptographic_hash_function#Use_in_building_other_cryptographic_primitives)

</comment></comment></comment><comment><USER27> Here's a question: Do we think Snowden is intentionally misleading us to attack RSA and EMC, or that he's actually releasing as little information as he can to get us on the right track toward fixing things? Why would this particular piece of information be selected if it was not a real problem?

<comment><USER28> I'm tired of having to correct people on this, but here goes: Snowden is not leaking anything anymore. He leaked most of the documents he had to some selected journalists a long time ago and it is now up to them to analyze them and responsibly report whatever interesting information there is to be learned from them.

<comment><USER27> Thank you for clarifying, Mike.

Deciding what is responsible is likely a coordinated effort. I think the same argument applies. Do we think someone might be being irresponsible here? Sensationalism, or real problem?

<comment><USER29> Yeah, I'm not too knowledgeable about the whole situtation, but I wish Snowden had leaked the documents to the public. It sucks having to trust the press. Assumedly if Snowden didn't like how they were handling it he'd step in in some way, though.

<comment><USER11> If he did, they'd just yell that he put everyone in life-threatening danger, like they did with Manning and also Wikileaks. I guess he wanted to avoid that level of accusations, although people like Mike Rogers still say that about him anyway:

[http://www.techdirt.com/articles/20131223/02311625673/rep- mi...](http://www.techdirt.com/articles/20131223/02311625673/rep-mike-rogers- goes-national-tv-to-lie-about-nsa-programs-snowden.shtml)

<comment><USER30> A post by Greenwald on the subject of "dump it all" vs. "vet and dribble":

[http://utdocuments.blogspot.com.br/2013/12/questionsresponse...](http://utdocuments.blogspot.com.br/2013/12/questionsresponses- for-journalists.html)

</comment></comment></comment></comment></comment></comment><comment><USER31> We're responding to our valued customers as fast as we can over on Twitter. [https://twitter.com/RSAInsecurity](https://twitter.com/RSAInsecurity)

<comment><USER17> $10M says the NSA is a valued customer.

</comment></comment><comment><USER32> Note up until this transition around 2001 the NSA was focused on controlling the key length of cryptography available.

They gave up on that and chose to focus instead on stealing the keys

<comment><USER17> Is this to do with when a certain strength of cryptology was catagorised as a weapon and there for not allowed to be exported from the USA? Does this mean that that was relaxed becasue the NSA, or whoever, eventually got a back door or whatever?

<comment><USER32> Yes.

It wasn't just a matter of one "back door" but a matter of knowing that (1) people usually use codes incorrectly or screw up the key management and (2) if you give them a little help the key management will always be screwed up.

</comment></comment></comment><comment><USER33> tl;dr point by point on why RSA's press statement makes them lying liars who lie, and that they were wilfully negligent from 2007-2013 _at the very least._

<comment><USER34> I really needed someone to summarize the article in one sentence (who has time to read more than one) and at the same time editorialize. Now I don't have to read the article or reason. Super convenient. Thanks!

</comment></comment><comment><USER35> What did you expect? RSA got purchased by EMC in 2006. That's the kiss of death in terms if any semblance of ethics. Someone in EMC would have known about this and swayed decision making.

</comment><comment><USER36> And the stock-market shrugged.

[https://www.google.com/finance?q=NYSE:EMC](https://www.google.com/finance?q=NYSE:EMC)

<comment><USER37> EMC bought RSA for $2bn. With a market cap of $51BN, why would you expect RSA to be a major component? The $10M NSA payment was apparently 30% of that particular RSA group's revenue.

And even if RSA was standalone, should we expect a major impact on the company's sales? It's not like Wells Fargo is going to stop using RSA keyfobs because of this. Although I admit I don't know where most of their income comes from.

<comment><USER38> > why would you expect RSA to be a major component?

Now that everything is public, would you choose to trust your data to EMC hardware and software?

<comment><USER37> I highly doubt that, at the level that EMCs deals take place, this news will have much impact. Only once have I tried to deal with RSA, and their software was so difficult to use (this was around 2006), there's no way we'd choose it by technical merits.

And something RSA did before EMC bought them doesn't really have any impact on EMC or VMWare anyways.

</comment></comment></comment></comment><comment><USER39> "we continued to rely upon NIST as the arbiter of that discussion"

This seems like a reasonable position to me, but I'm not in the field. Can someone tell me why it's not reasonable, in the face of all sorts of theories and suspicions being thrown about, to rely on the leading standards body as to whether the algorithm is flawed?

</comment><comment><USER40> > assume it was publicly documented at the time that BSAFE defaulted to Dual > EC

Was it? Before it was revealed to be the BSAFE default I was going around saying that no one would have chosen to use it anyways, so it was probably a pretty ineffectual backdoor except if it ever was option for a downgrading attack.

</comment><comment><USER41> That's a dead corp imho. Do we have any famous customer's list floating around?

<comment><USER42> We use RSA tokens at the financial institution I work for. I'll be checking in with our CTO tomorrow (was out sick today) to see about removing them from our systems.

</comment></comment><comment><USER43> With a quarterly income of $587 million in Q2 of 2012, isn't 10 million dollars "chump change" for EMC? Perhaps it's more of a lubricant for the larger picture of deals and pressures.

<comment><USER44> I worked for RSA back in the 1990s. Back then at least, the sales staff's pay was based heavily on commission. It has a sliding structure that meant that people who sold more got a higher percentage. $10m might not have been a lot to EMC, but to the sales guy it probably meant over $50k, maybe over $100k. That one sale alone would have blasted him/her past the quota and bumped up the commission percentage.

</comment></comment><comment><USER45> NSA deserves an award for accomplishing this for just $10 million.

</comment><comment><USER46> Kind of odd: this seems like something better suited to a blog post than a Gist.

<comment><USER12> My blog has been accruing more personal things and whiny rants lately. I decided to separate this from my doubtlessly profound philosophical ramblings about the meaning of life and Skyrim. All in all, a list of markdown gists is just about as functional as tumblr...

<comment><USER47> Which is why I made gist.io:

[http://gist.io/8101758](http://gist.io/8101758) (the OP's content, but nicely formatted for reading on any size screen, and with attention to typographic detail.)

</comment></comment></comment><comment><USER48> What if we literally didn't buy it?</comment>


Facebook turned on face recognition silently - <AUTHOR> https://imgur.com/a/tK8eW <comment><USER2> So, here's the weird catch-22. Or perhaps, the illusion of choice.

There are two people who are in a photo. One wishes Facebook to use face recognition, the other does not.

Facebook will run face recognition on the photo regardless, but how will they know who wants to be recognized, and who doesn't?

Simply, they have a model of your face already trained. And they recognize you in photos--you have no say whether or not they will. All this option does is hide the notifications when they do recognize you.

<comment><USER3> Which is why I do not want _anybody_ to make any pictures of me, especially not if they are active on social media. There are exactly two pictures of me online, the one is 30 years old, the other about 10. The quickest way to get me pissed off is to point a camera at me.

<comment><USER4> I find that a little bit sad. Both of my parents have passed away (fairly young), and they were somewhat camera-shy when they were alive (not for the same reasons you are, but the result is the same). I have barely a handful of photos of them, and that's often a source of disappointment and sadness for me.

I get that rampant data collection is unacceptable, and companies are terribly poor stewards of our personal data, but at the end of the day I have precious little in a visual sense with which to remember my parents.

I think it's entirely reasonable to request that your friends not post pictures of you on social media, though, and get pissed at them when they ignore your wishes.

<comment><USER5> Just as a curious observation, i wonder whether that sadness and disappointment would have been around before cameras and photos were invented.

After all, there was of course a time when no one had photos of their parents or their family.

<comment><USER4> Good point. It's hard to be sad about something that doens't exist and you can't fathom as a possible technology. Commissioning painted portraits were certainly a thing before photography, but I assume you had to be decently well off to afford that, and of course that's going to capture you in a staged setting, nothing remotely candid.

</comment></comment></comment></comment></comment><comment><USER6> I got nearly the same notification, except mine defaulted to off, it said "This setting is off, but you can turn it on any time".

My guess is that they based the setting on another setting. For example there was some photo tagging thing added _years_ ago, and I disabled that. Most of my timeline and tagging settings are set to Custom or require review.

<comment><USER7> Countries laws? Are you in Europe perhaps?

<comment><USER8> Mine was off by default, and I'm in the US. I think it was based on the older face recognition setting which I disabled when it first came out.

</comment></comment></comment><comment><USER9> The fact that they notified you means it wasn't exactly silent. I saw this notification and turned it off. I wish it hadn't been opt-out and had been an opt-in thing instead.

<comment><USER10> There's no notification unless you visit Facebook.com, that I no longer do regularly.

<comment><USER11> I saw it in the app. So this is not accurate.

<comment><USER12> Was it a push notification? Or did you have to open the app to see it?

It's silent unless there was a proactive message to you from Facebook that your face will start to be recognized. This facial recognition happens even when you're not using the app.

So Facebook is waiting for you to take action before telling you anything. That is not proactive, it is silent.

What if you don't go on Facebook any more but have an account? You'd never know this was happening.

<comment><USER13> They warned me that they activated it, so it wasn't _silent_ , it was just _opt-out_ (not that it's particularly better, but let's use non-clickbait terms)

<comment><USER12> It may be silent for some people and you're intentionally ignoring that. For someone who has an account but does not regularly log in, this change is silent. Yes, you saw the message, but that was by chance. Many others will have this feature silently enabled without their knowledge.

<comment><USER14> "I didnt get any mail. I also havent checked my mailbox for packages."

"I didnt get your email. I have not logged into my account lately."

It seems like semantics. You expect facebook to send an EXTERNAL notification to an operating system like ios/android or to an email provider like gmail/hotmail. Other people consider it not silent for facebook to make sure it shows up in their newsfeed.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I think this is notification is sort of the opposite of what people think it is.

Facebook has had facial recognition and tag suggestions based on facial recognition for a long time. For example this [1] article from June 2017 explains how to turn it off.

This new notification is about a global on/off switch that disable all facial recognition, because Facebook is going to start doing more than tag suggestions with facial recognition [2][3]. For example they are trying to detect when people are impersonating you online.

The global face recognition setting defaulted to off for me, probably because I had tag suggestions disabled already.

[1] [https://www.lifewire.com/how-to-disable-facebooks-facial- rec...](https://www.lifewire.com/how-to-disable-facebooks-facial-recognition- feature-2487265)

[2] [https://newsroom.fb.com/news/2017/12/managing-your- identity-...](https://newsroom.fb.com/news/2017/12/managing-your-identity-on- facebook-with-face-recognition-technology/)

[3] [http://www.firstpost.com/tech/news-analysis/facebook-face- re...](http://www.firstpost.com/tech/news-analysis/facebook-face-recognition- optional-tool-is-widely-rolling-out-to-users-but-raises-a-lot-of- concerns-4369533.html)

</comment><comment><USER15> Russian photographer took photos of random people in the subway in Saint- Petersburg and later could easily find their social network profiles [1] [2]

The creators of the app (FindFace) that indexes face data do not have any respect for privacy and boast how good their app is.

I think browsers should issue a warning before uploading photo to internet. Maybe then less people will want to publish their photo online.

[1] [https://www.theguardian.com/world/2016/apr/14/russian- photog...](https://www.theguardian.com/world/2016/apr/14/russian-photographer- yegor-tsvetkov-identifies-strangers-facial-recognition-app)

[2] [https://birdinflight.com/ru/vdohnovenie/fotoproect/06042016-...](https://birdinflight.com/ru/vdohnovenie/fotoproect/06042016-face- big-data.html)

</comment><comment><USER12> More than a decade ago Mark Zuckerberg said that anyone who gave him a photo of themselves was a "dumb fuck". His entire plan this whole time has been to do exactly this kind of thing (edit: because he thinks it is profit- maximizing), and he thinks you're a dumb fuck (just like me) for uploading your photo to let him use in the maximum-scary-surveillance way.

We should all just get off Facebook. The problem is that you can't leave even after you "delete" your account, and they have your photos tagged and matched to your email even if you never signed up anyway since all your "dumb fuck" friends gave Mark Zuckerberg their email passwords too - so even if you never sign up, your friends already ratted you out and gave up your email and photos anyway.

<comment><USER16> This is why I think the 'right to be forgotten' legislation might actually be a GOOD thing. Sure, it's some extra work when designing a new system, and lots of legacy systems require expensive rework, and a few twats will abuse the right to have Google redact journalistic information about their personal misadventures from the public sphere. But it's still my private data, so _I_ should have the right to forbid companies I don't trust from storing and processing it. And they should be legally forced to oblige and have processes in place so that such request can be truly honored.

<comment><USER17> Yeah, if you think Facebook would EVER honour a system like that then I have many, many bridges in stock for you :)

To most people, flicking a bit from 0 to 1 is enough to convince them your data is "deleted", however, in the database, what people never see, is that it the column name is actually "hidden".

:)

</comment></comment></comment><comment><USER18> "Help protect from strangers using your photo" Ironic

<comment><USER19> Ironic. They could save others from abusing your privacy, but not themselves.

</comment></comment><comment><USER20> "This setting is on, but you can turn it off any time, which applies to features we may add later".

Note the features we may add later part. Facebook is getting creepier by the day.

</comment><comment><USER21> You can hardly call it "silent" while screenshotting their disclaimer about it.

</comment><comment><USER22> So link surveillance cameras to the Facebook face recognition and cell phone location data of users and law enforcement will be so much easier.

A law enforcement json API

<comment><USER23> As Facebook's user rate declines, I genuinely believe they'll start generating larger and larger revenue from this exact thing.

A majority of the population's data is already there, they can survive for decades by renting out that data.

<comment><USER24> And people will have the FBI going through their mail because an algorithm written by someone who lived by "move fast and break things" flagged them as a commie (or whatever the equivalent is 30yr from now) over some combination of things they posted in high school.

If you spread incompetence around just right the end result is approximately the same as malice.

</comment></comment></comment><comment><USER25> Here's the press release announcing the new control from December.

> People gave us feedback that they would find it easier to manage face > recognition through a simple setting, so we're pairing these tools with a > single "on/off" control. If your tag suggestions setting is currently set to > "none," then your default face recognition setting will be set to "off" and > will remain that way until you decide to change it.

[https://newsroom.fb.com/news/2017/12/managing-your- identity-...](https://newsroom.fb.com/news/2017/12/managing-your-identity-on- facebook-with-face-recognition-technology/)

</comment><comment><USER26> This has always been active ¯\\_(ツ)_/¯

<comment><USER27> True, there is nothing stopping them from running this in the background to make additional linkages between people and places to sell to third parties without having to share where those linkages come from.

<comment><USER27> Plus if you opt out you're only opting out of the social aspects of this recognition, not the revenue models behind it.

<comment><USER28> Thank you for pointing this out. They don't claim that they won't recognize your face if you opt out... they just won't suggest it to your friends.

</comment></comment></comment></comment><comment><USER29> I'm imaging a Probability Zero or Black Mirror short where Facebook insists some scammer is using your face and attempts to shut them down. They are unable to log into services because they used Facebook login for convenience. In the end, it turns out the imposter randomly had an identical face and was perhaps a long list twin.

</comment><comment><USER30> If facial recognition bothers you enough to be paranoid, I would highly suggest deleting all Facebook products.

</comment><comment><USER31> Here is the facebook site explaining how this works/will work.

[https://www.facebook.com/about/basics/manage-your- privacy/fa...](https://www.facebook.com/about/basics/manage-your-privacy/face- recognition)

<comment><USER32> I have to assume that this UX is intentionally awful:

Go to Settings.

Go to More.

Tap Privacy Shortcuts.

Tap More Settings.

Tap Face Recognition.

Tap Do you want Facebook to be able to recognize you in photos and videos?

Select No if you don't want to let Facebook recognize you in photos and videos.

Also, this set of steps doesn't work on the desktop browser. I don't see More or Privacy Shortcuts in My Settings, only in the ? menu at the top (clicked by accident). Once you go to More, I don't see any section for Face Recognition anywhere on the page.

<comment><USER33> I can click the little arrow, go to settings, and there's a "Face Recognition" entry in the sidebar, between "Language" and "Notifications".

This is on the desktop website. Sounds like it's hidden deeper if you visit from a phone?

<comment><USER34> Yes, but for me instead of "Face Recognition" it's under "Timeline and Tagging Settings", and then it's the third suggestion under "Tagging".

<comment><USER32> I don't see anything but a divider between "Language" and "Notifications", and for me the only "face" anywhere on the "Timeline and Tagging" page is "Facebook".

Even on mobile the set of steps they published doesn't work. "More Settings" leads to a generic settings page with no "face" as well.

</comment></comment></comment></comment></comment><comment><USER35> I wish I could activate it once to see all the previous photos of me that aren't tagged, then turn it off so it doesn't do it in the background. Not that its any safer, but it would make me feel better about it.

<comment><USER33> Are you sure it's not going in the background anyhow? I thought they've been using facial recognition to tag pictures for years...

</comment></comment><comment><USER36> Algorithm is good, but not best. Facebook is offering me to tag my dad on my own pictures. :v [https://imgur.com/a/fqDGS](https://imgur.com/a/fqDGS)

<comment><USER37> it's like a weird dystopian complement to your father

</comment></comment><comment><USER38> I am still waiting for this feature in the UK, but European courts keep blocking it. It pisses me off: I should be able to opt-in if I want to.

<comment><USER39> >I should be able to opt-in if I want to.

As the top comment suggests, if Facebook runs face recognition on pictures of you and those pictures contain other people, there is no guarantee that they have opted into the program as well. You wouldn't just be making a choice for yourself.

<comment><USER33> Well, either Facebook doesn't have training data for the opt-out users, or they _do_ , and they use it to ensure that those users aren't publicly tagged (my paranoia says that they're still tagged internally, regardless of the option that's selected).

Either way, it would only need to identify those users who have actually opted in.

</comment></comment></comment><comment><USER40> Did anyone else notice that FB mentioned accessibility as one of the reasons that people should opt-in to face recognition? I wonder whether this was something that the FB Accessibility team actually asked for, or whether this is just a do-good sounding excuse for a program that FB wants to (clandestinely, apparently) launch.

</comment><comment><USER41> Not sure that you can consider the activation silent, given that they prompted people in their news feeds.

</comment><comment><USER42> Not really silent, right? Unless you meant there was no press coverage about the feature.

<comment><USER43> They silently asked for your consent. As-in, they didn't. The feature is opt- out, with their interests first, and your privacy and consent second.

<comment><USER33> The feature is "opt-out" in the sense that they based the default on some other privacy setting. It was disabled by default, for me. But I've been fairly diligent over the years, going through and disabling the things that I didn't want.

</comment></comment></comment><comment><USER44> I'm OK with this, under the condition that Facebook only uses it to alert you of photos you likely appear in, i.e. those two first examples of what it can do.

I would not allow them to show those results to other people.

</comment><comment><USER45> I got this notification in my Facebook mobile app with slightly different wording. I went into the settings, and it was turned off.

I wonder if they realized they need to show this to all users in order to get some sort of consent.

</comment><comment> nappy-doo Google Photos has had it on for years -- not sure what the big deal here is?!?

<comment><USER46> Google Photos' was only within your account, and didn't assign any of the faces to you unless you manually assigned it as "me". Later they included the option (via opt-in) to have Google suggest that your friends share with you photos that have you.

Facebook's is platform-wide, and you don't have the option of tagging faces but not assigning them to you or to specific people.

</comment></comment><comment><USER47> Is there an easy way to mistrain this?

<comment><USER13> Definitely: tag yourself in photos that aren't you. Eventually Facebook will think that's you.

</comment></comment><comment><USER48> I'm fine with this, but how do I find those photos where I'm being automatically tagged in?

</comment><comment><USER49> What possibilities for the user will GDPR bring into such situations, if any?

</comment><comment><USER50> I hope they make a new function:

* Join the group of people that looks like me

</comment><comment><USER51> Anyone have a handy link to where I can opt out of this?

<comment><USER52> Direct link:[https://www.facebook.com/settings?tab=facerec](https://www.facebook.com/settings?tab=facerec)

</comment></comment><comment><USER53> so how can one believe by turning it off will really make it disabled? After all it's all about a CSS/JS animation ;)

</comment><comment><USER54> How is this silent? They told you about it...

</comment><comment><USER55> Just wanted to point out. IF YOU ARE NOT THE CUSTOMER, THEN YOU ARE THE PRODUCT!

<comment><USER56> From the HN guidelines:

 _Please don 't use uppercase for emphasis. If you want to emphasize a word or phrase, put asterisks around it and it will get italicized._

<comment><USER55> I'd forgotten that one. Thank you.</comment></comment></comment>


Revenue/User in Social Networks - <AUTHOR>

I saw this comment at:
http://tristateventuresblog.com/2007/10/25/microsoft-facebook-aoltime-warner/
No social network has been able to surpass the $3/user/year mark. Facebook has a shot at it though, they need to do a lot of work and I think could double it to $6 per user per year. Myspace i believe is around $5/user/year now. It takes years and luck to go beyond $3. I don't know why but that's been the magic number. And that's in a popular network, smaller networks generate less revenue. Myspace was at $3/user/year in revenue when they were acquired. Facebook's value is users actually like being on facebook. Facebook needs a social search engine and email platform though.
Comments? <comment><USER2> How did they come up with these numbers?</comment>


All 637,000 followers of Wikileaks Subject to US Government Subpoena - <AUTHOR> http://www.salon.com/news/opinion/glenn_greenwald/2011/01/07/twitter/

<comment><USER2> Am I missing something? It seems like they're asking for specific users' accounts. I don't see where they are requesting 637,000 users' information.

<comment><USER3> I think they are talking about section B of attachment A ([http://www.salon.com/news/opinion/glenn_greenwald/2011/01/07...](http://www.salon.com/news/opinion/glenn_greenwald/2011/01/07/twitter/subpoena.pdf)) :

"B. All records and other information relating to the account(s) and time period in Part A, including:

1\. Records of user activity for any connections made to or from the Account, including the date,time,length and method of connections, data transfer volume, user name, and source and destination Internet Protocol address(es);"

I guess it depends on how they are defining connection. Connection could mean a user following that account, replying or direct messaging. On the other hand they might just want details on each time the user named in the subpoena logged into their account.

I am guessing that this isn't a request for 637,000 users information because Twitter has notified those accounts where information has been requested and they certainly have not notified 637,000 people.

</comment></comment><comment><USER4> Direct link to subpoena:

[http://www.salon.com/news/opinion/glenn_greenwald/2011/01/07...](http://www.salon.com/news/opinion/glenn_greenwald/2011/01/07/twitter/subpoena.pdf)

</comment><comment><USER5> Aren't all websites subject to government subpoena?

<comment><USER6> It has to be a real subpoena, signed by a judge, not just a 'request'. This information must then be used as part of an official criminal investigation. So far, there are no criminal indictments, only backroom spycraft and intimidation.

</comment></comment><comment><USER7> grrr. This headline is misleading and sensationalist; nothing in the linked article supports the assertion that the order is for all of the followers of @wikileaks. It's bad enough that the Government is subpoenaing the information of people who actually did things in cooperation with wikileaks (including a legislator from a foreign government), we don't need misleading and downright false headlines muddying the debate.

 __removed __

EDIT:

OK, I had not seen the tweet from @wikileaks when I wrote the above. I still think the headline is misleading. But that's up to you to decide.

<comment><USER8> according to [http://www.zdnet.com/blog/igeneration/us-subpoenas- wikileaks...](http://www.zdnet.com/blog/igeneration/us-subpoenas-wikileaks- tweets-and-why-this-could-affect-you/7610):

 _Update (12:20am GMT): Mark Stephens on the BBC News also makes clear that the court order will also cover the "600,000 odd followers that Wikileaks has on Twitter"._

<comment><USER7> If it really does, that's an overreach by the prosecutor and the judge should not grant the order.

But my reading of the order linked by Glenn Greenwald is that it is asking for information on the named twitter accounts, not the recipients of messages from those accounts.</comment></comment></comment>


'Sparrow for Windows' was never an official Sparrow client, not weeks away - <AUTHOR> http://www.theverge.com/2012/7/21/3174803/sparrow-for-windows-never-existed

<comment><USER2> The saddest part about the verge writing this summary garbage is that they wrote it for HN _and_ it got upvotes.

Hopefully the digg revival works so all these spammy little rags don't have time for HN.

<comment><USER3> What's 'garbage' about the Verge write-up? They've spoken to a source close to Dom Leca and given a no nonsense summary.

Also what's 'spammy' about The Verge? From what I've read they've got some great writers who typically write thorough and reasonably well researched articles.

<comment><USER2> I'd probably start with "their entire business model is spammy" - they're a reskin of Engadget, the blog that pioneered The AOL Way whereby "journalists" and "writers" earn their pennies by taking someone else's story and doing their best to make sure they take all the value and traffic for it.

Their source for this story was most likely an intern they pay to stare at HN, Reddit, etc looking for bandwagons to jump on - that's why they offer no unique news that wasn't lifted from the blog post they summarize except for their mystery person who adds some panache by suggesting it was never official when right or wrong it doesn't really matter but if they're lucky the parties involved will take the bait and write more blog posts The Verge can summarize too.

<comment><USER3> I respect your opinion. But that sounds a lot like conjecture. Ellis Hamburger is an employee of Verge with decent credentials. The article we're discussing also looks like an original with their own source.

I'm genuinely interested to see some examples of 'spammy' write-ups from The Verge. My understanding was Josh Topolsky started The Verge for the very reason that Engadget was becoming what you're describing; ie. No original write-ups and short summaries by freelance writers.

<comment><USER2> Of course it's conjecture - there's no way to prove they didn't spot a trending topic and start firing up the content factory to capitalize on it by already churning out _five_ articles on Google acquiring Sparrow.

Here's a cute example of how high quality they are - they copied a paragraph from the email sent out to Sparrow users and describe it as:

> We've just heard from Sparrow, and Dom Leca notably mentioned that the > current Sparrow apps will receive no new features

[http://www.theverge.com/2012/7/20/3172222/google-buys- sparro...](http://www.theverge.com/2012/7/20/3172222/google-buys-sparrow- mail/in/2936538)</comment></comment></comment></comment></comment>


Show HN: Overstated – React state management library that's delightful to use - <AUTHOR> https://github.com/fabiospampinato/overstated <comment><AUTHOR> Author here. I've kind of rewritten unstated [0], because building large-ish apps with it was starting to become troublesome. Overstated is:

\- Even simpler: connecting to the stores via `useStore` of `connect` is much more ergonomic than unstated's `Subscribe` component.

\- Much more performant: it encourages the user to use only the state/methods he needs (via a selector function) so it can re-render components only when absolutely necessary.

\- TypeScript friendly: our `useStore` hook is fully typed and makes writing components a joy (I think this is huge once you actually get to try it).

What do you think? :)

[0] [https://github.com/jamiebuilds/unstated](https://github.com/jamiebuilds/unstated)</comment>


What Bill Gates Said - <AUTHOR> https://twitter.com/ramez/status/1192886826802958337 <comment><USER2> Assuming 10 percent capital gains taxed as income every year (it's not), Bill Gates would pay something like $4 billion a year following his own plan ($6.379 billion under Elizabeth's wealth tax).

If marginal income tax rate would be raised to 60 percent for income over $100 million per year, it would be equal to Elizabeth's wealth tax.</comment>


"Pirate Patch" Unblocks The Pirate Bay In a Blink - <AUTHOR> http://torrentfreak.com/pirate-patch-unblocks-the-pirate-bay-in-a-blink-120821/ <comment><USER2> This patch brings back good memories.

Memories when I was a child and I had to run various "patches" or "resident programs" to run games.

Oddly enough they were phrased similarly and shared that same, excessive, punctuation.

Will the next Pirate Bay patch feature an intro?

</comment><comment><USER3> Clever name, but all it does is edit a hosts file. Not sure why this is so highly rated on HN.

</comment><comment><USER4> if anyone is interested i wrote a python script a few years ago that is similar (from the examples it looks like i was annoyed by wikileaks being blocked) - it automates the patching of your hosts file and adds some extra metadata. <https://github.com/andrewcooke/GhettoNet>

</comment><comment><USER5> <http://elite.so/tpp/proxy.txt> URL used by the script to get the IP.

</comment><comment><USER6> As do Google Cache links, I hear.

</comment><comment><USER7> haha whats next? "Turn off your virus check, it's a false positive!!!!"

<comment><USER8> Yeah, running an .exe ? Why would I do that ?

      "Your hosts file has been updated.
      Thank you for your automatic donation
      to our fund from your bitcoin wallet"

</comment></comment><comment><USER9> If it auto-updates, maybe this can be a early step towards a more resilient DNS system that route around damage.</comment>


Video, Freedom And Mozilla - <AUTHOR> http://weblogs.mozillazine.org/roc/archives/2010/01/video_freedom_a.html

<comment><USER2> "- But I could just download gst-plugins-ugly and I'd be OK. - That's a selfish attitude. Everyone should be able to browse the Web with a free software stack without having to jump through arcane hoops to download and install software (whose use is legally questionable)."

I'll tell you what's selfish: going out of your way to cripple the experience of your users just so your extremist ideological views can prevail (and they won't anyway).

I don't think the deliberate weakening of the #1 open-source browser over such trivial matters is a win either, ideological or otherwise.

I love Firefox and I hope this sorry state of affairs will be quickly resolved sensibly before irrecoverable damage has been done.

</opiniated>

<comment><USER3> Everybody's selfish, but Mozilla is also short-sighted ... they cannot and will not be able to have an influence on the defacto standards for codecs if they aren't popular enough.

This was the right time to really push for HTML5 and standards ... to push Flash/Silverlight/Quicktime out of the way. Safari, Chrome, Opera and Firefox combined have enough market-share to do that.

But no ... they take the same stance as Linux distros, all proprietary stuff is evil, ban it all. Unfortunately, while they have a point (H264 is not safe) ... they'll just lose users to Chrome or Safari.

<comment><USER4> This is exactly how we ended up with things like ActiveX and Flash in the first place. It's not enough to make things just work today. Mozilla is right to be thinking about what happens a few years down the road.

Mozilla has enough market share to make it relevant to web _developers_. Who will have to learn about the issue, and support Firefox. The users don't matter nearly as much.

<comment><USER3> > _This is exactly how we ended up with things like ActiveX and Flash in the > first place._

No, and I really don't see the resemblance. We ended up with ActiveX, Flash and Java (you forgot about it) in the first place, because there was no other way to get around the browser's limitations.

In fact it's quite the opposite ... wasn't XmlHttpRequest implemented first as an ActiveX object in IExplorer 5? Or do you think some standards body magically came up with it and everyone was happy?

H264 is the current standard for video, with lots of tools and lots of momentum ... in order to replace it you'll have to put a whole lot more on the table than ideology.

</comment></comment></comment></comment><comment><USER5> Mozilla's decision to push for Ogg seems like a classic programmer's response. They're attempting to solve the problem with an _engineering_ solution.

Unfortunately, this won't be enough. If Mozilla want to usurp H.264, they'll either need a huge market share or budget (which they don't have) or technological superiority over H.264 (I don't think this is the case either). They're also fighting against Apple, who want H.264 to succeed.

<comment><USER6> Mozilla isn't making any choices. supporting theora is their only option due to patents surrounding H.264. It has nothing to do with engineering, and everything to do with copyright and patents.

<comment><USER7> They're not supporting H.264 because they don't want to promote Windows 7 (or Mac OS X) over Linux. They could easily implement H.264 support for all operating systems that license H.264, and then let websites dynamically choose what to send based on what the operating system supports. However, that means Firefox would work better on Windows 7 and Mac OS X than it would on 100% legit Linux distros.

<comment><USER8> I think this is an incredibly silly decision. Basically it boils down to "operating systems A and B support feature X while C doesn't, but we don't want operating system C to be at disadvantage so we will just disable access to feature X on A and B too."

</comment></comment></comment></comment><comment><USER9> There was a recent HN post on this topic that garnered a lot of discussion:

<http://news.ycombinator.com/item?id=1070780>

This new blog-post from Robert O'Callahan (one of the Mozilla developers who worked on the <video> element) explains Mozilla's position much better than anyone in the HN thread did, touching on things like patent licensing, using GStreamer, and idealism.

<comment><USER10> Idealism is an excellent way to loose users to Chrome.

<comment><USER11> Or a way to make users even more die-hard Firefox users. I don't understand how this is extremely idealistic. This is an excellent way to show how software patents are bad.

<comment><USER10> Sure, I'm agreed software patents are bad. But average users just want stuff to work.

Remember those music players that didn't play mp3 files so they didn't have to pay a few cent royalty? No me either, but they existed for a time. Everyone wanted to play mp3 files, so the players that could play them won out.

<comment><USER12> >Sure, I'm agreed software patents are bad. But average users just want stuff to work.

Right. Yet you've said before that you'll get rid of your iPhone if "they put Flash on it". How do you reconcile your position that "average users just want stuff to work" against being so vehemontly against Flash on the iPhone?

<comment><USER10> ? Flash is amongst the worst examples of 'stuff that works'. Flash _doesn't_ work. It pegs your CPU at 100%, crashes, and generally ends up in mess.

 _IF_ they can get flash to work, and not crash, and not eat battery, and not peg CPU, then I'd probably welcome it. But they haven't managed to do that in the last 10 years with the standard versions of flash, so I think it's extremely unlikely they'd manage it on slimmed down hardware like the iPhone.

</comment></comment></comment></comment></comment></comment><comment><USER13> Since 2004, Mozilla has had baked-in support for automatically installing Flash on the first encounter if the plugin is not found. A nice little yellow infobar pops down (a brilliant UI innovation), prompting you to install it with a few clicks, even without root access on both Windows and Linux.

They've also recently implemented automatic update checking for Flash. Since it's their biggest security hole, they throw up a big nasty "update now" warning on launch if you're using a known-vulnerable version.

Mozilla initially distributed the Flash binaries under license themselves via addons.mozilla.org -- I'm not sure if they still do so.

Flash is shitty, nonredistributable, closed-source, restricted-platform, proprietary, and patented but they're willing to go to great lengths to help their users use it. Why not do the same thing for ffmpeg, which is merely patented?

</comment><comment><USER14> Other issues aside, I don't understand why supporting a proprietary Flash plugin from a single vendor is better than opening support for a standardized (albeit similarly patent-encumbered) video format with open-source implementations.

<comment><USER15> I (as an end user) don't care so much about freaking patents. I only see that my MBP sounds like a fighter jet when playing flash videos, not when playing h.264 videos.

</comment></comment><comment><USER16> From the article: _It pushes the software freedom issues from the browser (where we have leverage to possibly change the codec situation)_

This is what it's all really about: trying to use Mozilla's leverage to foist an unpopular and inferior technology on an unwilling web. Remind you of the antics of any other company with a popular browser?

Power corrupts. Thank god Firefox doesn't have the same market share as IE did. Webkit ftw, here.

</comment><comment><USER17> The discussion I've seen surrounding the issue is mostly centered around the user (browser) and video quality. The thing that most stuck out to me from the post, buried in the end, was the (potential) restrictions that could be placed on creating h.264 content and publishing it on the web. I think that this is the biggest relevant issue I've seen yet with h.264. Apparently these issues are still potential and still under wraps, but I would not be in favor of effective restrictions on including the <video> tag in a website.

</comment><comment><USER18> Sorry for being very off-topic, but that three-column layout (or more in higher res?) of the text makes it hard for me to read. Resizing also makes me lose where I was reading.

Sorry, again.

<comment><USER7> It looks great in IE--its all one column.

Sometimes lacking a "feature" can be a feature in itself.

</comment></comment><comment><USER19> Once google completes its merger with On2 (February), we'll get free and open video codec for free on youtube. Firefox and chrome will include it. This is why I think we'll never get Theora on youtube, but all hope is not lost thanks to vp7 or whatever they end up calling it.

</comment><comment><USER20> With all the discussion going on, I was looking for a comparison of the codecs and found this website: <http://people.xiph.org/~greg/video/ytcompare/comparison.html>

If you ask me, the h264 vs ogv versions were not that different at the same bit-rates (sure, maybe a little). My point is, I'd really like to see more actual data before we enter endless discussions and most of us don't know what's actually talked about.

<comment><USER21> Problem is not that Theora isn't capable enough now that MozCo has poured money on it. The problem is that Google and every other video service has already their videos in h264, which is playable in Flash. So if YouTube were to support Theora they'd need to re-encode all their videos, and store them as duplicates.

Another problem with Theora is hardware. There is a lot of hardware h264 encoders and decoders, allowing even cellphones to play HD h264. AFAIK there is absolute no Theora hardware currently.

<comment><USER20> Sounds like a chicken and egg problem to me. If we collectively ignore ogv because there are no current hardware en/decoders, then why should anyone build it? These things are built when enough demand is present. For that, the push from the Mozilla foundation seems to be reasonable. Once there is more demand, the tech comes automatically. If we clinge to H264, nobody will ever build the right hardware. It's basically a demand based resource allocation problem, and Firefox is doing the demand part. Seems reasonable to me.

</comment></comment></comment><comment><USER14> He touched a very important point. Many people do not realize that GPL and LPGL are fundamentally incompatible with patents (intentionally) and that in many cases it is a ticking bomb.

When he writes "The software license permits you to redistribute and use the code, but the MPEG-LA can still stop you", he means section 7 of the GPL (2.0). I think many people who use the GPL for their software do not realize that later on a single company (patent holder) can stop the redistribution of that software.

<comment><USER3> Any patent holder with relevant patents can stop redistribution of a software, regardless of license ... GPL or not.

</comment></comment><comment><USER22> This is idotic. By _not_ supporting h.264 and _not_ getting in trouble if and when MPEG-LA decides to cease and desist, they are making it much easier for h.264 to become completely ingrained because h.264 is what works NOW and it is what is widely supported NOW. Why? Who among the vast majority of blithering idiots in the world knows or cares about the patent issues with h.264? Outside of Hacker News and the Mozilla corporation, I'd put that number at just about nil.

Yo, has anyone started work on a Mozilla fork that _does_ support h.264 either through native support or plugins?

edit: Also, if no one _does_ sue, then the whole thing will have been simply an exercise in idiocy.

</comment><comment><USER23> If one were to create an open-source "proxy extension" for Firefox to shim H264 support via proprietary binary blobs dynamically loaded into the proxy, how do you think that would go?

<comment><USER21> why proprietary binary blobs and not FOSS ffmpeg/libavcodec?

edit: but I like that idea... Would it be possible to create an Fx extension/plugin to enable h264 playback? I mean, QT and Flash plugins do already play h264 video with Firefox in <object>/<embed> -tags.

<comment><USER23> That's exactly what I'm trying to ask. Not if it were technically possible, but if it would be worth the while.

Why bother using a FOSS implementation of a patent-encumbered technology? FOSS for EMCA standards (.NET, Java) is great, but FOSS for h264 is kinda pointless (which is part of the argument in TFA)

<comment><USER21> Because most of the world is not under US jurisdiction.

</comment></comment></comment></comment><comment><USER24> Well, if Bilski goes our way, then this whole issue is mute, right? Or are there some other restrictions on the codec?

I agree that OGV is pretty much Mozilla's only option for now.

<comment><USER25> Not mute. No.

It's called a moo point. You know, like a cow's opinion.

<comment><USER24> Heh, sorry, it's early.

*moot</comment></comment></comment>


John Doe 1991 (2015) - <AUTHOR> https://medium.com/@IjeomaOluo/john-doe-1991-36ada62f17cf <comment><USER2> Is the article saying that in 2013 a man was kicked out of a Seattle cafe and a convenience store for being black?

<comment><USER3> (Not justification) I'm guessing it wasn't because he was black but his general appearance. If he was being treated for cancer, at least in my experience other family members, he probably looked something closer to emancipated than healthy. He probably didn't carry himself well. And if he'd just wandered out of the hospital (in patient?) he may not have been dressed well. He was probably being treated like a homeless person.</comment></comment>


Knowm.org – "Intelligent Machine Technology" - <AUTHOR> http://news.ezii.de/posts/Agj2SxD8v2B3B46gp/knowm-org-intelligent-machine-technology <comment><USER2>
        knowm.org - "Intelligent Machine Technology" knowm.org
        ManuelArno 1 point an hour ago 0 Comments

        Please log in to comment.

Is there anything actually there?</comment>


Is Android fragmented or is this the new rate of innovation? - <AUTHOR> http://www.engadget.com/2010/05/22/entelligence-is-android-fragmented-or-is-this-the-new-rate-of-i/

<comment><USER2> Five years ago many handsets were obsolete they day you bought them. I'll take fragmentation over slow progress any day. And I did for a year and a half.

In October 2008 I got a Google G1 the day it came out, replacing a tired Blackberry. This phone is the poster child for Android fragmentation, running a now-ancient version of the OS. But I could run most apps, and despite its relatively slow speed and limited non-SD memory, I believe it was the best alternative to an iPhone at the time.

Thanks to Google my new phone is an HTC Evo 4G. Same apps, same basic OS experience, only with the performance and phone features that make a G1 look like a toy. This is the platform I want: innovation as fast as possible on hardware and software at the same time. HTC is keeping up just fine and I'm betting developers will too.

<comment><USER3> Yes, but an iPhone 2G could reasonably run _all_ apps except for a few hardware features not present (MMS, GPS, OpenGL ES 2.0, video camera) because it received all OS updates. And until iPhone OS 4.0 comes out that effectively end-of-lifes the 2G, one could be reasonably happy with the post-sale support of the original iPhone with two years of major upgrades, three including security/bug updates.

The thing that scares me off the Android platform is the OS fragmentation. The sheer fact that I have to hack my device to upgrade it mind-boggles me. The fact that the G1 is not receiving what is becoming the greatest OS upgrade for the Android a mere _1.5 years after release_ is discouraging beyond the least.

<comment><USER4> Most users don't know what OS version they are running or care. Those that do can "hack" it (feels wrong to call installing an OS hacking).

<comment><USER3> I have heard of (not actually experienced as I do not have an Android phone) programs on the Android Market stating "You must have Android 2.0+ to run" or "Does not work on XXXXXX device with 1.5, but we're working on support!" While most users don't care, developers do. Because Apple offers the upgrades free through iTunes ("New update! Click here!"), the number of upgraded iPhones 2Gs with 3.0 (opposed to the 1.0) nears 100%. Thus most developers can just build against the latest OS, get to use the new APIs, and be okay.

However, I do admit the loss of the 2G upgrade changes things a bit, and I would like to see how Apple handles it. The easiest answer is that the App Store allows one to select devices that are incompatible with certain builds, however I would love to see a universal binary situation supporting the old OSs much like PPC/x86 or iPhone/iPad apps.

<comment><USER5> I've updated my iPod Touch once, and it wasn't free.

<comment><USER6> Indeed, only iPhone upgrades are "Free", because they're subsidized. But the majority of people don't seem to get that just because you're not paying something at that particular point in time doesn't mean you didn't incur that cost over a stretch of time. It's also why people still think of iPhones as being worth $200 when in fact they are worth $600, and why they get so angry when they get hit with the early termination fee.

</comment></comment></comment></comment></comment></comment><comment><USER7> I see that the author of this article is not particularly reassured, and neither am I.

What I learned here is that Google employees are grandmasters at parsing. ("The fact that the phone you bought three months ago won't work with the software we launched today does not meet the _technical_ definition of 'platform fragmentation'". Imagine my relief.)

I've also learned that, not surprisingly, Google engineers have no experience selling hardware. They seem to think they're still programming for the web, where you can push out ten new apps every week and people are _happy_ about it. When a customer buys hardware they want some assurance that its makers will support it throughout its operational lifetime, and will not simply throw the unit over the wall, dust off their hands, and move on to the "more innovative" new product of the week.

My hypothesis is that Google will continue to find that the cellphone market has a natural rate of product obsolescence that is difficult to fight. The good news is that the entire installed base turns over every two to three years. (To a programmer who has to support ancient garbage like IE, this sounds too good to be true - three years is actually really fast.) The bad news is that, in the USA at least, you can't really make everyone buy a new phone more often than once every 12 to 18 months, because the subsidies don't come along more often than that. To "innovate" the hardware any faster just produces a mismatch between yourself and the customers. One party or the other is going to be uncomfortable, disoriented, and potentially resentful.

<comment><USER8> I dunno. One of Apple's big innovations with the iPhone was to take the carriers out the loop when it came to software updates. This remains a big benefit of their plug it into a computer strategy (aka "digital hub").

Google appears to be aiming for the same thing, but OTA and with a more carrot and stick approach. Look here's a shiny new version of Android with new features and better speed. Oh, you can't have it for 6 months because your phone vendor wants to muck around with it to no great purpose, well that's a shame, but don't get suckered next time you upgrade.

You seem to be claiming it's all about hardware (apparently all phones released so far can do 2.1 _if_ updates are available), when it's really all about carrier and phone vendor relationships.

Personally if the maps app gets updated once a week then that strikes me as good for the customer, they shouldn't really have to care.

<comment><USER9> You're saying what I'm thinking. I have a (European) HTC Hero and HTC combined with T-Mobile make the crappiest, most sluggish update experience possible. I am very disappointed with them - so much that will probably buy an iPhone next time around.

Also HTC's Sense UI is a perfect case of what you call "phone vendor wants to muck around with it to no great purpose".

<comment><USER10> I also have a HTC Hero and exactly the same experience. I don't care for the Sense UI and next time I'll get a phone that runs the native Android UI (a Google phone or they should force that any phone with alternative UI's also can run the native UIso upgrades are possible) or an iPhone.

The future looks good for Android but there's still a lot of work to be done.

</comment></comment></comment></comment><comment><USER5> Fragmentation killed J2ME development for me. It was impossible to keep doing it as an Indie, because you needed to test your app on hundreds of devices.

So I worry a lot about this aspect for Android, but I have some hopes that it won't become as much of an issue.

The main reason is that all Android phones still have the same software basis. They have the same virtual machine and so on (except for the OS versions, but there won't be hundreds that soon). So the issue of having different bugs on every phone should be greatly reduced.

Another thing I hope is that it will be easier to do refunds, so I would worry less about pissing off customers when my app doesn't work on their phone. (I don't actually know how refunds work for Androids, but there must be a way?).

With the most common payment channel for J2ME apps, premium SMS, it was very difficult to do refunds. Typically you would only learn what phone the customer has after he sent the SMS, by which point it would have been to late to tell him that the app won't actually work for him.

Anyway, I just decide to be optimistic about Android for now.

<comment><USER11> The Android market allows users to refund within 24 hours of the purchase once per app. So if they buy and discover it doesn't work on their phone, they just open the market up and select "Uninstall and refund."

</comment></comment><comment><USER12> "Devices going obsolete in months and new operating systems released on weekly cycles make it difficult for even Google's best partners to keep pace."

I don't have an Android mobile but I do have a first generation iPhone. The day iPhone OS 4 was announced and I learned most of the features wouldn't be available for my iPhone it was like it lost all its utility and I immediately thought of it as obsolete.

It's stupid because it's a perfectly working device even without the latest updates but it's been really hard to keep those thoughts away. It's like I need a new iPhone (and I don't!).

All this to say I wonder how people with an Android mobile deal with this kind of thinking since there's a new Android OS version twice a year against a new iPhone OS version every two years.

I'm sure most people don't care about OS updates but most of us here do, right?

<comment><USER13> Developers certainly care about OS updates. What frustrates me the most about Android fragmentation, and a really essential difference between the Android and iPhone platform, is that you can still buy a new phone running 1.5! You can't buy a new iPhone running OS 2.

<comment><USER7> You can't even buy a _used_ iPhone running OS2, unless the original owner never plugged it in to iTunes or was really consistent about clicking "no".

<comment><USER14> I know it's not what you're talking about, but the way you've written that has just given me a rush of nostalgia for OS2, the awesome OS stabbed in the back by MS. My first encounter with the BOFH was in a friends OS2 magazine.

*removes rose tinted glasses :)

</comment></comment></comment></comment><comment><USER15> The support will come in only if one of android running phones leap frogs the existing mobiles by a huge margin. That would compel google to shift to a strategy that would include 'marriage' with a device and less chaotic market presence.

Google is better at dealing with uncertain or probabilistic business strategies. They have more faith in fragmented strategies.

Apple is linear because it can afford to be. And it has paid off so far.

Learning from other consumer markets like cars makes me believe android powered phones will offer consumers choice.

However I do believe the Rolls Royce of the mobile market will be the iPhone for sometime to come.

</comment><comment><USER16> The iPhone was not only a revolution in hardware and experience, the concept of regular software updates that made the phone significantly faster and better was a great feat too.

But there's no reason this should only happen every year. Google is a capable dev house and far less cautious releasing new software. We all like google and the web and open source because it allows extremely fast and transparent iterative updates.

I don't think google will or should slow down improving android. I'd hope the hardware manufacturers experiment with shipping their own vanilla android devices and learn exactly what customers and the market flock to.

Don't forget a Moto Droid is still a badass phone despite what iPhone 4 or froyo offer. If you want the cutting edge you can install hacked firmware. Or buy a nexus one. Or wait until your carrier will help subsidize a whole new phone just like we've always done. There's no problem here as a consumer or for google as a os vendor.

</comment><comment><USER17> I have a Verizon Eris now for few weeks. I just upgraded to 2.1 and it's been better, but the total feel is not as good as the 15 min I spent with iPhone (latest model).

Eris is cool phone but buttons respond slowly. I know it's not the Droid or Incredible but it shouldn't be so laggy. I now have pinch/zoom but it's so NOT smooth. Feels like graphics stutter. The turn by turn NAV is the best part. But I'm coming from Windows Mobile with Verizon Touch and it sucked!!! This touch keyboard is much better than WinMo but iPhone is still better.

The Eris has no help on the phone itself and it took me a while to figure it out. The iPhone I had mastered in the store in 10 min.

I'm stuck for two years and depressed about it since I want the new iPhone, even though have not seen it.

<comment><USER18> Take that phone back tomorrow. You have 60 days, I think. I had an Eris for about a week too. I just sent it back and bought a 3GS on Craigslist. You could even trade it in for the Incredible, which you'll be much happier with.

</comment></comment><comment><USER19> I find this really interesting on two levels.

Firstly, the issue to 'free' and what that means in terms of what we can expect from a company which gives us something for 'free'.

The dynamic involved in getting something for nothing in modern society, is incredibly complex. In almost every situation, when a company gives something for free, the transaction holds a huge amount of value for the company in question. In a sense we are paying them, but they are able to hold us (the consumer) to ransom, because we didn't pay any money for the privilege.

Perhaps - due to this - there is going to come a time when, companies and people, elect to obtain a certain level of service by dipping into their wallets? Maybe a swing back to the days of paid models would be actually be beneficial to the consumer?

Secondly - I think this is interesting because Android is an open-source OS, and I've found that open-source OSs generally look after users with legacy hardware. That old 486 box you had in the early nineties could potentially still run Linux and be secure.

Bearing this in mind - why does Android have to be any different .. and will it remain different for the foreseeable future?

</comment><comment> mike-cardwell I got a G1 17 months ago on T-Mobile in the UK. During this time it has been upgraded OTA to 1.1, 1.5 and then 1.6. Also during this time, I've never come across an app which required a version of Android which I don't have. I'm not disputing they exist, just that they're very rare.

Next month, my contract comes up for renewal and I'll probably get a Desire. I think it will come with 2.1, but will be upgraded OTA to 2.2 shortly afterwards. I expect it will have several more upgrades before my contract comes up for renewal again.

I don't see what the problem is. I don't feel as though I have an obsolete device and it still runs all the apps I've tried for it...

</comment><comment><USER20> The platform fragmentation itself wouldn't be so bad if Google had some baseline quality standards on the Android Market. Google hides their own applications for 1.x users that are 2.x only. Why don't third party apps behave this way too? Even if they don't want to force developers to support phones that were brand new 6 months ago they could at least save the end user the frustration of blind luck compatibility.</comment>


Evercookie - <AUTHOR> http://en.wikipedia.org/wiki/Evercookie

<comment><USER2> I've found Evercookie to be really useful in eliminating spam.

Despite having captchas and per user send limits on my site, Nigerians were submitting tons of forms through my site a while back trying to trick users with the same scams that are popular on Craigslist. They know to clear their cookies, etc. Adding Evercookie cut down on the number of spam messages considerably just by keeping a count of the number of messages sent from a particular computer and blocking messages after more than a certain number per day.

Perhaps most satisfying, I implemented it so the message appeared to have been sent successfully even when it was blocked. So there are Nigerians happily working away all day "sending" message on my site still thinking it is working. I sometimes get hundreds of blocked message notifications per day.

<comment><USER3> If you're already implementing messages like that another fun thing to do when the person goes way past the threshold is start making the site slow/buggy. Add in random sleeps, redirect to a random valid or error page, etc. Basically make the site increasingly buggy. The added benefit is that is breaks any automated scripts people might be scamming with.

That's what I did when we marked an account as obvious spam. Usually that was when an account was created and the same or next day sent 1000+ messages to random other users. Basically the person using the account would think the messages got sent but really they usually hit either a keyword/bayes moderation or a similarity throttle and the messages were put into a moderation queue rather than delivered immediately. Once the moderator picks "obvious spam", for that account the site gets buggier and buggier for 30 days until the account gets completely shut down and the person can't log in with it anymore. I did that for 30 days because I didn't want to warn them their account had been flagged and just have them create a new one.

Basically it's a spammer tarpit.

</comment></comment><comment><USER4> Barring all ethical issues aside, while most are just "use whatever other readily available storage", I enjoyed this hack of a storage method:

 _"Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out"_

</comment><comment><USER5> This, on linux, is defeated by Chrome's Incognito mode. It's why I didn't use it to track spammers on ragechat.com.

Edit: that, and it tries to use silverlight to store some silverlight based cookies, and people would just get big "Install Silverlight!" button/adverts coming up.

<comment><USER6> Careful though: older versions of flash will still store cookies even if you're in incognito mode ([http://www.google.com/support/forum/p/Chrome/thread?tid=072d...](http://www.google.com/support/forum/p/Chrome/thread?tid=072def08b84998f8&hl=en)). This is especially true with many linux installations, as often times they have older versions of flash for compatibility purposes (64 bit flash... ugh...)

</comment></comment><comment><USER7> Evercookie is the herpes of user tracking. Wear protection (don't run JavaScript from untrusted websites).

Still, there are some interesting ideas for places to hide trackers. I wonder which parts actually survive (as wiki suggests that something does) after doing a full "clear browsing data" on something like Chrome (which comes with a super helpful link to clear Flash cookies).

<comment><USER4> Also, isn't the best way to defend against this once it's there not to try to clear it only to have it come back later, but to shuffle it's content so much that their perpetrator can't make use of it? The core of it is it's resiliency thanks to redundancy, so let's corrupt it so that the information becomes noise.

<comment><USER8> Indeed. I would love a browser plug-in that fucked with cookies and spread disinformation.

</comment></comment></comment><comment><USER9> Awesome, my client requested just that for his project.

I wish I was kidding.

<comment><USER10> Evercookie isn't evil, it's just a tool; it's how you use it that matters. Using it to keep track of users for spam or troll purposes is perfectly fine to me.

</comment></comment><comment><USER11> Some communities seem to act like magnets for trolls and abusive behavior. I use evercookies on one of my websites to keep the trolls out. Works tremendously well. It has allowed the community there to really flourish, absent petty personal attacks and troublemakers.

</comment><comment><USER12> I wouldn't be surprised to find out that this is already in use by ad networks.

<comment><USER13> I would be, at least for ad networks based in the United States or Europe. The rhetoric around online privacy has gotten rather heated lately, and they're trying to avoid government regulation by being on their best behavior and trying to self-regulate. Evercookies are the opposite of that - it'd be like holding up a sign saying 'make me a target'.

Back when things were a little less heated (aka a couple of years ago), some companies did use a combination of cookies and Local Shared Objects in order to provide redundancy - information deleted from one was later restored by the other. Those companies have almost certainly stopped.

Not that it indicates any wrongdoing, because there's a class-action lawsuit for _everything_ remotely advertising-related, but there's been a ton of class-action lawsuits in the Flash cookie space. I believe the ones involving actively rewriting deleted information have largely been settled, and now it's mostly lawyers trolling companies for the use of Flash cookies to store _any_ type of information more complicated than a volume setting.

For a recent example, search for Del Vecchio vs Amazon.

<comment><USER12> Ah very cool. Tangentially related: I've been helping a client get some affiliate marketing set up, and the email-based affiliates require CAN-SPAM compliance. Basically, this requires a generic unsubscribe link where people can put in their email address to be added to a "suppression file" blacklist, which the affiliates can then download. It's intended to act as a shared blacklist when you're working with multiple affiliates, but I'm wondering what's to stop someone from just harvesting suppression files?

<comment><USER14> I believe CAN-SPAM has provisions against that, but several vendors have standardized on storing the suppression files as a list of md5s. Of course that is not bulletproof (the source space is small, especially among the big mail providers) but at the moment it seems to have shifted the economics favorably.

</comment></comment></comment></comment><comment><USER15> This page was nominated for deletion on 27 October 2010.

<comment><USER16> The result of the discussion was nomination withdrawn.</comment></comment>


Ask HN: What do i need to learn to build this? - <AUTHOR>

I am a college student, taking the summer off. I know html / some css and plan on learning js over the summer.
As an alternative, I'd like to build a website to do the following, and wanted to know what should I learn to build it (I am a fast learner, I think). Should I go the ruby/rails way or the python/django way. The goal is to be able to start coding by mid may and get something usable by the beginning of july (before college starts).
The site would have a clean UI with just one comment box at the top, and below it would be previously entered text. Like twitter, but a little bigger text, and a bigger limit on the number of characters. It would not require any username/login (though I guess that would lead to more spam, and a whole bunch of issues). Also I am trying to build it for my campus, and was wondering what would be the fastest way to develop and deploy it so that I can get something out before the beginning of August ?
Thanks. <comment><USER2> Don't get into the Rails vs Django war. Just pick up any one of them and start coding. Both frameworks are highly productive and very easy to pick up.

If you go with Rails, you can use Heroku for hosting which is free to start with. If you go with Python, you can use Google Appengine, which is free as well for starters.

<comment><USER3> +1 Choose whichever language you feel comfortable with / can get free books of.

</comment></comment><comment><USER4> honestly, I would use sinatra.rb, and deploy to heroku, using their free version (at first). For me that's the fastest way to get a simple idea up and working.</comment>


Ytterby: The Tiny Swedish Island That Gave the Periodic Table 4 Elements - <AUTHOR> http://www.slate.com/id/2258112/

<comment><USER2> Didn't you mean to link to this article: <http://www.slate.com/id/2258112/entry/2260782/>

</comment><comment><USER3> Ytterby is not an island. It is a village _on_ an island: <http://en.wikipedia.org/wiki/Ytterby>

<comment><USER4> There are also several other places named "Ytterby", translated the name means something like "outer village". (I happen to live in one of the other ones :))

Pointless map of Ytterbys in Sweden: <http://kartor.eniro.se/m/pBGRL>

<comment> s-phi-nl Just out of curiosity would "Ytterboe" mean "from Ytterby"? I'm wondering because my college has a dorm named "Ytterboe".

<comment><USER4> Nope, Ytterboe isn't swedish. "Person living in Ytterby" is "Ytterbybo", which is close but not quite the same.

</comment></comment></comment></comment><comment><USER5> John you might need to consider Ytterby for "The Geek Atlas II".</comment>


Explosive UFO Report in NYT Mentions 'Off-World Vehicles Not Made on This Earth' - <AUTHOR> https://www.yahoo.com/huffpost/ufo-off-world-vehicles-065525258.html <comment><USER2> NYT story posted here [https://news.ycombinator.com/item?id=23931960](https://news.ycombinator.com/item?id=23931960)</comment>


I built an Android app to easily listen to brain state altering binaural beats - <AUTHOR> https://play.google.com/store/apps/details?id=com.UnjinxApps.brainWaves <comment><USER2> But why

<comment><AUTHOR> Because some people find it useful.

<comment><USER2> I guess some people enjoy the placebo effect. I can't seem to get my grandmother to stop wasting money on homeopathy.

<comment><AUTHOR> Yeah mate. I'm not claiming binaural beats are completely backed up by scientific research. And if it doesn't help you or cause you problems then you shouldn't use it. But if you're someone who likes binaural beats for whatever reason then I just have an app with a very easy to use interface for you to use. I personally don't see anything wrong in it.</comment></comment></comment></comment>


Scans on astonauts reveal serious damage to eyes and brains - <AUTHOR> http://www.dailymail.co.uk/sciencetech/article-2114320/Can-humanity-cope-long-term-space-travel-Scans-reveal-damage-brains-eyes-astronauts.html

<comment><USER2> Well, darn. We're just going to have to figure out antigravity.

But for the next few hundred years, maybe we should use those rotating space stations and spacecraft that I remember seeing in books when I was a kid.

<http://www.dvandom.com/coriolis/spacestation.html>

</comment><comment><USER3> Is this caused by zero-g or by the low pressure (0.3 bar) environment of the ISS/Shuttle?</comment>