The Snowden Principle - <AUTHOR> https://pressfreedomfoundation.org/blog/2013/06/snowden-principle <comment><USER2> I don't really disagree with the principle, but it seems to more or less be a statement of the idea of "whistleblowing". Snowden is a high-profile current example of a whistleblower, but it might be going a bit too far to credit him with the principle itself! Even sticking to relatively contemporary U.S. history, you could call it the Buxtun principle, among other names.

On the topic of naming: I didn't realize until some googling just now that "whistleblower" itself is a neologism, dating to the '70s, and coined by Ralph Nader. He wanted to give the concept a positive spin by analogizing it to a referee pointing out dirty play, vs. alternatives like "leaker" and "informant" that have negative connotations. I'm not much of a fan of Nader's subsequent political career, but in retrospect that was a pretty successful move.

<comment><USER3> _I don 't really disagree with the principle, but it seems to more or less be a statement of the idea of "whistleblowing". Snowden is a high-profile current example of a whistleblower, but it might be going a bit too far to credit him with the principle itself!_

An example (in a different domain) of [http://en.wikipedia.org/wiki/Stigler%27s_law_of_eponymy](http://en.wikipedia.org/wiki/Stigler%27s_law_of_eponymy)

</comment></comment><comment><USER4> Yep, and now all the major media & blow-hards have to back pedal on their smear campaigns, as little by little everything he claimed turns out to be true:

[http://news.cnet.com/8301-13578_3-57589495-38/nsa-admits- lis...](http://news.cnet.com/8301-13578_3-57589495-38/nsa-admits-listening- to-u.s-phone-calls-without-warrants/)

</comment><comment><USER5> I think the Founding Fathers would approve of this. Despite their being the elite in society they identified that there must be a a design for a government that discretely limited its ability to screw the people at will. The Bill Of Rights was their way to make it obvious that government must be limited and that its existence is dependent on the people's will, not the other way around.

<comment><USER6> Most of Founding Fathers were also slave owners. Could we stop bringing people of the past with their dubious morale into the modern times when we all are more educated? Otherwise, we could equally use What Would Jesus Do principle.

[http://global.britannica.com/EBchecked/topic/1269536/The- Fou...](http://global.britannica.com/EBchecked/topic/1269536/The-Founding- Fathers-and-Slavery)

<comment><USER7> Being a good lawyer and a defensor of good principles does not imply living a good life. At all.

Also, do not think they understood slavery exactly as you do. As a matter of fact, what they wrote probably paves the way to where we are today.

</comment></comment></comment><comment><USER8> "My sole motive is to inform the public as to that which is done in their name and that which is done against them"

Must read for anyone interested in understanding the principle behind Snowden's acts. As requested in the article I also joined [https://optin.stopwatching.us/](https://optin.stopwatching.us/) campaign.

</comment><comment><USER9> _For the sake of argument -- This should be called The Snowden Principle._

For the sake of argument let's say we don't call this the Snowden principle, because that would mean we are in an argument with uninformed people who are so arrogant that they think they are the first generation to wrestle with tough decisions and lofty ideals. Forty years ago my parents could have called this "the Ellsberg Principle" and I am sure that HNers from other countries can easily come up with examples from not so recent history in their country. Can we please try and raise the level of dialogue and expect a little more of ourselves before running to twitter/blog/HN?

<comment><USER10> I would prefer not to call it this, merely because the combination of "snowden," "secrets," and "catch-22" really screw up search results.

</comment></comment><comment><USER11> I see a lot of people conflating the messenger with the message.

Forget about your tendencies towards fascination with a "cult of personality" and see these abuses of our 4th Amendment rights for what they truly are.

</comment><comment><USER12> The problem with this is that it assumes perfect judgement from the whistleblower. I explain this more here: [http://danielmiessler.com/blog/why- its-dangerous-to-call-whi...](http://danielmiessler.com/blog/why-its- dangerous-to-call-whistleblowers-heroes)

</comment><comment><USER13> "My sole motive is to inform the public as to that which is done in their name and that which is done against them."

Ah, but I don't believe his actions have been consistent with this motive at all - and actions do speak louder than words. Since publicly revealing himself as the whistleblower, he's made a significant portion of the story about him and not about the issues he claims to care about - for much of the media and public, it's become just another human-interest saga with Snowden as the star.

If your sole motive is _truly_ to inform the public about a cause, leak your leaks and then do whatever in hell you can to stay out of the way and not blow it. Perhaps he's just a glory hound, perhaps he really means what he says and didn't realize what effects his actions would have - but either way, Snowden did his cause a lot of damage when he put himself at the center of the story. We'd all be a lot better off if we'd never heard his name.

<comment><USER14> A slightly different take:

"My Creeping Concern that the NSA Leaker Edward Snowden is not who he Purports to be…"

[http://www.globalresearch.ca/my-creeping-concern-that-the- ns...](http://www.globalresearch.ca/my-creeping-concern-that-the-nsa-leaker- edward-snowden-is-not-who-he-purports-to-be/5339161)

<comment><USER15> That is _slightly_ different?

Well coached PR person for the purpose of making us all aware of how scared we should be, to spread public fear is not just _slightly_ different from courageous whistleblower.</comment></comment></comment>


FutureAdvisor (YC S10) Launches investment advisor for the 99% - <AUTHOR> http://betakit.com/2012/03/20/futureadvisor-launches-investment-tool-for-the-99-percent

<comment><USER2> If you haven't tried FutureAdvisor, try it. I've been using them since I first heard about them over a year ago on HackerNews, and let its recommendations guide my Fidelity portfolio.</comment>


There's nothing wrong with my no-email policy - <AUTHOR> https://www.theguardian.com/technology/2020/jan/24/theres-nothing-wrong-with-my-no-email-policy <comment><USER2> It's easy to tweet anger at someone, less so in an email, and even less when you need to write,package, address, stamp, and send a letter. Probably cuts out a lot of the crap and only gets things that matter or what people are really passionate about.

<comment><USER3> It's probably just as easy to send an angry email. But something a public medium like twitter doesn't really allow is subsequent apologies - people are often afraid of admitting guilt publicly.

Running a quite large site, we get our share of angry support (email) tickets. Although we don't have to take any shit, we are generally nicer than we have to be ("Please find some mental counseling. Issuing death threats over not getting your ticket answered within two hours is not normal.") and received our share of apologies.

We also regularly get shit thrown our way via twitter, but don't expect any apologies there.

<comment><USER4> Twitter (and in general social media) is probably a good thing to avoid for communication if you are not a large company that can staff up for it. Threads can devolve very quickly into "campaigns". I would not want to have my medical staff spinning a bunch of cycles with pr related stuff or being subjected to mobs.

</comment></comment></comment><comment><USER5> Do what works for you. I absolutely love email. I'll pick up the phone and call someone too, but most things I do aren't so urgent I need to call you and interrupt whatever you're doing right this second so that you can give me your full, undivided attention.

I use email to remind myself of things I need to follow up on, coordinate events, and keep new engagements in a single stream of consciousness. It works well for me.

I don't typically get to 0-inbox, I usually have maybe 10-30 emails in my inbox which are all read and are all there for a reason (listed above and more). I religiously unsubscribe from things (or don't subscribe in the first place) and I will admit it takes some work to keep organized.

I also have all notifications turned off and my email only fetches once/hour anyway. I actually get excited when I get new emails because typically there's something in progress and it's some sort of update or new information I can use to do something I want to do.

So there's nothing wrong with a no-email policy. But I there's also nothing wrong with email. Everything comes down to the processes YOU like and find the most beneficial.

<comment><USER6> > Do what works for you.

This person should be doing what works best for their constituents, not for them and their staff.

<comment> m-p-3 If it doesn't work for him, then it's not optimal for his constituents either.

<comment><USER7> Or _he 's_ not optimal for his constituents...

<comment> m-p-3 Apparently he is, or he won't be re-elected because of this choice.

</comment></comment></comment></comment></comment><comment><USER8> > Letters, phone calls, and, where appropriate, surgery appointments are > perfectly adequate for people who genuinely need my help

The insinuation that just because someone may not want to use a particular communication channel (or conversely, may need to use a particular channel), that they then are not genuine in their request for help is disingenuous and self-serving. Someone may genuinely need help and may likewise genuinely want to use email because they do not have ready access to a phone, or find it vastly more inconvenient, and need help in a manner faster than mail or setting up a surgery appointment affords.

<comment><USER9> The same could be said, in a domain more familiar to HNers, of bug reports.

If you don't take bug reports as tweets, or in e-mails, but insist that 1) they go into a bug tracker, and 2) that they evidence some care (such as, instead of saying, 'X is broken', include a list of steps to reproduce, and an expected outcome) then, well, you must be self serving, and feel that these bugs are not genuine or important.

But, you'll also have a greater capacity to actually deal with the requests where someone made the effort to report a bug in a useful fashion.

<comment><USER10> MPs are supposed to serve all their consistuents, though. Open source maintainers' duty to their users is more controversial; but I think most people would agree it's not as strong as an MP's.

> then, well, you must be self serving, and feel that these bugs are not > genuine or important.

It's harder to keep track of bugs that aren't on a bugtracker (hence the name) if you don't have time to fix them right now.

I regularly fix easy bugs submitted to me on IRC, but if I can't do it right now, then I require the user to open an issue on my bugtracker or else I'll forget it and fix one of the other 216 bugs on my bugtracker instead.

<comment><USER11> > MPs are supposed to serve all their consistuents, though

Yes, and that responsibility predates computers. So let's not pretend that they only became capable of doing this effectively After Twitter was developed, just because you and others don't want to bother with sending a letter.

</comment></comment></comment></comment><comment><USER12> likewise there is nothing wrong with my "no phonecalls" policy and yet people still insist on me using it, ill often contact people or companies about things and get the response "just give me a call" why? theres no reason they cant simply reply using the method i contacted them with but thats not all

first up phone calls tend to go "off the rails" no one simply answers the question and says goodbye and hangs up so you waste a lot of time, not only that but theres the fact that phone calls arent very private, not only is the person youre talking to hearing you but anyone within earshot and the person on the other end of the phone is usually oblivious or ignorant to your location and who may be around you, if they ask something which you may consider sensitive you then have to avoid the question (and potentially reply by a more private means of communication after, wasting more time)

youre also put on the spot, theres no time to consider your response to something youve been asked you have to respond pretty much instantly which can go wrong in many ways, its why salespeople like to use the phone, its much easier to get someone to agree to something they otherwise wouldnt if they had more time to consider what theyd been asked

sadly the bottom line is we are all at some point usually forced to use a method of communication we arent comfortable with, the best you can do is try to minimise it

<comment><USER13> Nothing wrong with my "email only" policy either - no phone or video calls. Granted, I don't work in sales or customer support, but in the "back office".

My working, thinking, and writing style requires big blocks of focused time, with no interruptions. A phone call or a scheduled meeting is a sure way to disrupt and reduce my productivity. I reserve phone/video calls only for personal purpose, not work-related, and even then it's rare.

Surprisingly, in my X years of working I've found that most people are willing to tolerate or adapt to my preferred communication methods.

On occasion, in particular when I need to interact with those working at large corporations, I've had people who just insist on "hopping on a call", even after repeated explanation. Every time I've begrudgingly agreed, I've regretted my decision, lost time, and less productive discussion.

Email is (near) perfect for me, as I can batch them at the start/end of my day. I get to sit back, think things through, and reply at my own convenience.

</comment></comment><comment><USER14> Seems to work for Don Knuth: [https://www-cs- faculty.stanford.edu/~knuth/email.html](https://www-cs- faculty.stanford.edu/~knuth/email.html)

<comment><USER15> Donald Knuth also does reply to email; he just doesn't tell you he does. I once got a response from him late in the evening, well after any secretary would have gone home.

<comment><USER14> Knight or Knuth?

</comment></comment></comment><comment><USER16> The key quote:

" Much of the organised abuse which has caused many MPs to "burn out" and withdraw from public life results from their opening up themselves and their long-suffering staff to interactive online communications by email and social media. Indeed several have confided that they wish they had adopted my unshakable policy right at the outset."

I think there's some wisdom here—-and he is indeed protecting his staff; he wouldn't be filtering all the email himself.

</comment><comment><USER17> Having just finished Cal Newport's 'Deep Work', I recall the section about Donald Knuth's similar stance[0] of no-email.

[0] [https://www-cs-faculty.stanford.edu/~knuth/email.html](https://www-cs- faculty.stanford.edu/~knuth/email.html)

<comment><USER18> That's fine, but then the MP should hire an assistant to manage their email if it detracts from their deep work. Donald Knuth does not have a sworn duty to represent people; he could go and live in the woods for all it would matter

<comment><USER11> They had a sworn duty to represent people even before the computer was invented. He's not failing that obligation by not answering email, tweeting his every though or ignoring Facebook friend requests. Your preferred path of communication isn't the same as his, that doesn't mean he's failing to communicate.

</comment></comment></comment><comment><USER19> [https://www.writetothem.com/](https://www.writetothem.com/)

A website that you can use to send your MP a message. Not quite as convenient as using email directly but almost so. They have a fax machine purely so that Julian Lewis' constitutes can contact their MP.

<comment><USER20> For Julian Lewis, it now refers people (with a broken link) to the Parliament website.

e.g. [https://www.writetothem.com/write?who=47046&pc=SO42+7ZN](https://www.writetothem.com/write?who=47046&pc=SO42+7ZN)

<comment><USER19> Ah, the fax machine must have died.

</comment></comment></comment><comment><USER21> ... unless you would struggle to address a printed letter due to a disability, Have anxiety, a full-time job or anything else that prevents you from physically attending a surgery appointment, or can't speak. Or all of the above.

<comment><USER20> It would need to be all the above, and without anyone to help with writing an address (I'm sure someone at the post office would help), and without knowing how to print the address onto the envelope, but still able to use email.

And he's a Tory MP, so in any case this hypothetical disabled person is wasting their time.

</comment></comment><comment><USER22> >>> "There is nothing "mysterious" about the fact that I do not use email for constituency correspondence: it is openly stated on the homepage of my – very extensive – website"

LOL. Might want to look into that: www.julianlewis.net (do not click)

It directs to a spam / scam domain...

If only someone had a pen ready to write to him...

<comment><USER20> It redirected to a scam site the first time I opened it, but a minute later (after a "curl" looked OK and I opened a private tab) it worked fine.

</comment></comment><comment><USER23> ... surgery appointment?

This guy is a politician, right? Not a surgeon? Can someone explain?

<comment><USER24> It's a political term in the UK to refer to meetings with constituents: [https://en.wikipedia.org/wiki/Surgery_(politics)](https://en.wikipedia.org/wiki/Surgery_\(politics\))

</comment></comment><comment><USER25> Honestly, I can't fault him for this -- and I say that as a person who uses email as my primary communications method.

His reasoning makes sense to me, and if his constituents don't mind, then it's hard to say there's something wrong with his approach.

</comment><comment><USER26> Wikipedia says that this guy has been an MP since 1997. Presumably that means he has won many elections and thus his constituents do not think his no-email policy is a problem.

<comment><USER27> Or that he has a safe seat.</comment></comment>


A Gentle Introduction to the Nix Family (2019) - <AUTHOR> https://ebzzry.io/en/nix/ <comment><USER2> If this is of interest, I've been publicly releasing a series of educational Nix videos I originally recorded for developers at Shopify that you may also enjoy: [https://www.youtube.com/playlist?list=PLRGI9KQ3_HP_OFRG6R-p4...](https://www.youtube.com/playlist?list=PLRGI9KQ3_HP_OFRG6R-p4iFgMSK1t5BHs)

<comment><USER3> I had to log in just so I could upvote and thank you for doing these! My biggest issue with nix on MacOS (besides not grokking the DSL even after a couple years) is that there are a decent handful of packages that dont support Darwin. How do you handle those?

<comment><USER2> Some of them actually do support darwin and we have a function in our company overlay:

        withDarwinEnabled = drv:
        drv.overrideAttrs (oldAttrs: {
          meta = with super.stdenv.lib.platforms; {
            platforms = darwin ++ oldAttrs.meta.platforms;
          };
        });

but really, we've only run into a couple of things we've cared about that are Linux-only, and just PR'd fixes upstream and duplicated them to our overlay temporarily.

</comment></comment></comment><comment><USER4> I use NixOS as my main OS on my Blade 15.

It was a bit confusing to set up all the bumblebee stuff to use the RTX2080 on demand for my ML tasks (nixGL is the solution).

All my projects include a `default.nix` to start a shell with all the necessary dependencies.

I'm very happy with it now. I'll never look back.

</comment><comment><USER5> This is a fun read. Curious how this works for large systems:

> This shell instance is special because it only contains sufficient > information just to make GNU Hello, available. We can even inspect the value > of $PATH, here:

> (list of 20 or so paths to binaries)

Do binary path lookups slow to a crawl when you've got 100s or 1000s of separate directory paths to look through? IIUC, there's a separate directory added to PATH for each binary right? Which presumably would be a disk I/O to read the file list for PATH matching for each command.

<comment><USER6> Good question, you can of course test this yourself with `time`.

In the case of Bash, non-built-in commands are stored in a lookup table, exposed via the hash built-in (`help hash`). So, there should only be a one- time performance hit per shell instance.

Generally speaking, stat'ing hundreds of directories is surprisingly quick, most binaries do it all the time, when loading libraries for example. You can `strace` to see the numerous file tree crawls.

</comment></comment><comment><AUTHOR> I have struggled with understanding Nix package manager for a long time. I use it on my macOS as a daily driver, but never understood the various pieces involved for me to comfortable make changes to my configuration. `nix-env -i` and `nix-env -e` were all I was comfortable with.

This blog post does a good job of breaking down the Nix package manager's knowledge into decent sized chunks that one can easily understand and reason about.

</comment><comment><USER7> The Esperanto translation is fantastic

<comment><USER8> I did not notice that at first! It appears to be complete too.

</comment></comment><comment><USER9> Everyone read this!

This Nix/Guix level of package management is what every distribution should aim for.

<comment><USER10> NixOS is available, not sure what other distros offer that it doesn't.

<comment><USER11> An easy, relatively worry free installation/out of the box experience? The option to install uncommon software in a way that may be crappy but would work (make install?)?

That's what's holding me back, although I'm fascinated by the concept.

<comment><USER12> I would say the installation experience might be a bit more involved, but once it's installed it's much more worry-free for me. On every other distribution I've used (including Ubuntu and co), it's very easy to break the system completely. On Nix, it's almost impossible because you can always boot directly into the state before your update. Once you've set up your configuration, you can install it instantly on other machines by copying one file. On other distributions, you would have to re-install and configure everything by hand. Many of the tweaks for which you usually have to read Arch Wiki are also built into Nix, so you just have to write services.myService.myOption = foo; and you're done.

For the second point, if you've got a package that just builds with the usual ./configure, make, make install, here is all you need to get a nix package for it:

      { stdenv }:
      stdenv.mkDerivation {
        name = "my-package";
        src = ./.;
        buildInputs = [ ... whatever dependencies you need ...];
      }

And the standard build commands will be run automatically. The only thing that's kind of annoying is installing binary distributions of packages since they need to be patched to work on Nix, but it's not the end of the world. Also, nixpkgs is so universal that I very rarely find myself having to add a package that's not in it.

<comment><USER11> Thanks!

> The only thing that's kind of annoying is installing binary distributions of > packages since they need to be patched

This worries me, as every once in a while I do feel like using some proprietary app. What does it even mean more precisely? What about Steam games and such? Would it make sense to run them in a container or something like that?

I suppose I like to use unpopular software in general. How would I use (make a package or otherwise install) the odd go, python, js, nim, rust ... project that is made with its own weird build system? If I made a package for it I could very comfortably make changes to the code and directly recompile/reinstall, right?

<comment><USER13> For Steam, NixOS actually builds a full FHS with all the packages from SteamOS and then runs Steam within that using a simple chroot. It works surprisingly well and can also be used for stubborn software that cannot work without FHS and without messing up the rest of your system.

</comment></comment></comment></comment></comment></comment><comment><USER14> Would love to see NixOS available as an image for Windows Subsystem for Linux. Looks like it's been an open issue for awhile.

[https://github.com/NixOS/nixpkgs/issues/30391](https://github.com/NixOS/nixpkgs/issues/30391)

Seems someone may have figured it out -

[https://github.com/Trundle/NixOS-WSL](https://github.com/Trundle/NixOS-WSL)

</comment><comment><USER15> I love the mood in this writing

</comment><comment><USER16> > We can even inspect the value of $PATH, here:

> (...)

> Your output is going to be different from mine because of the hashes in the > store paths.

Does this mean that a nix install is not reproducible? If the same installation is performed twice, the file names and contents will be different due to some randomness?

<comment><USER17> The hashes will only be different if you install different versions of the derivation (package). All the inputs of a derivation, so even selected plugins and compile options influence the hash.

That said, if me and you agreed on a specific git commit of the nixpkgs repo and build some packages from that, our hashes would be the same. This knowledge is also used to download packages from the binary cache. You can see the automatic building of the packages on hydra.nixos.org, from there they will be made avaiable on the binary cache.</comment></comment>


Show HN: Piratica is your new source of free, high-quality technical content. - <AUTHOR> http://piratica.co/ Hi! <comment><AUTHOR> Hey guys!

I know there isn't much on the landing page at the moment, so I'll leave a little bit here about what we're doing with Piratica.

Basically, it's more difficult to find technical resources than it should be. With Piratica we want to foster a community-curated environment where anyone can go to learn about anything technical.

Want to find some resources on Python? Just check out the Python tag and you'll see everything that our members thought was good enough to share. Same goes with any other topic.

We want to make life easier for you, so check out the site and leave us your email so we can let you know when we launch.

Cheers!</comment>


Facebook unveils the Portal - <AUTHOR> https://www.washingtonpost.com/technology/2018/10/08/facebook-unveils-portal-video-chat-camera-people-who-still-trust-facebook/ <comment><USER2> I probably trust Facebook with this camera less than I trust Amazon with their Echo or even the new Fire TV devices. That being said, I don't really see a huge need for this - perhaps some people do though.

The most I've needed a webcam lately has been for work and we're having meetings where we are frequently sharing desktops or documents, so needing to be followed around while I pace/walk is unnecessary. I've occasionally used FaceTime for friends and family but that's mostly just BSing around and my iPhone works just fine.

Perhaps Facebook has a lot of market research showing there's enough people to either make this work or they're willing to take a chance and hope it catches on.

</comment><comment><USER3> >identifies the shape of people within its 140-degree field of view and pans and zooms to make sure they're all always in the frame.

Assuming the videos produced can go places other than just Facebook I could see this being useful for youtubers and other people who produce videos on their own. Or at least, the autopan/zoom technology will be useful but possibly in another device.

No more interrupting your yoga demonstration to move the camera because your head is now out of shot.

No more realizing that half of your face was periodically out of shot during the 10 minute review/monologue/whatever that you just finished recording.</comment>


Hacking Gmail's UX with 'From' Fields – Another Phishing Vector - <AUTHOR> https://blog.cotten.io/hacking-gmail-with-weird-from-fields-d6494254722f <comment><USER2> You think that's bad? There's a Google Inbox and Gmail spoofing vulnerability which has been disclosed for over a year, and it's still not fixed.

Vulnerability details: [https://eligrey.com/blog/google-inbox-spoofing- vulnerability...](https://eligrey.com/blog/google-inbox-spoofing- vulnerability/)

Screenshot: [https://go.eligrey.com/t/screenshots/google-inbox- spoofing-o...](https://go.eligrey.com/t/screenshots/google-inbox-spoofing-on- android)

PoC demo (open on Android using Google Inbox or Gmail): [https://dangerous.link/gmail-and-inbox-spoofing-on- android](https://dangerous.link/gmail-and-inbox-spoofing-on-android)

<comment><USER3> Clicking this PoC link on iOS shows that the iOS Mail app suffers the same UI vulnerability. It appears like you are emailing firstname.lastname@example.com, when you are not.

<comment><USER4> Same for K9 Mail in Android. Clicking on the mail address reveals the real Destination though.

</comment></comment></comment><comment><USER5> A different one than the article but also weird/dangerous, it (was? is still?) possible to manipulate someone else's contact identifiers.

This may have been fixed, but I stopped using gmail years ago so I'm not sure..

For example imagine Alice emails Bob and Chad, and in the To: field for Bob she gives Bob a different "Name" like "Brad" <email@example.com>. If Chad replies to this email, Bob will now be in his contact list as Brad. The email is still email@example.com but you can see how it could be malicious, or at least fodder for fun pranks.

<comment><USER6> This drives me fucking crazy.

I have a long history of emailing a particular dude, call him Greg. Greg's email address does not have any periods in it. Gmail ignores periods, yes, but many other clients don't, so I want to never type Greg's email with a period. Further, I want to be able to reliably grep and join my own email exports.

Upon buying a new phone I received an email from Frank, who cc'd Greg. Fucking Frank has Greg's email address with a period in it.

From now on, no matter what I do, my phone autocomplete's Greg's email address with a period. At first I manually fixed it every time, but at this point I've given up. Now I'm as bad as Frank. It's like this virus that goes from Frank to Frank polluting the data as it goes.

If my contacts are going to be changeable by other people can they _at the very least_ ask me first? Greg is on Gmail, can Gmail not auto-switch Greg to his canonical email unless I specifically request it not to? If Greg is going to be changed, why on earth is it one way (the right way) in my web inbox and a completely different way in my phone?

<comment><USER5> Brutal.

In my case, my friend's name got replaced with something like "Schookums Bear <3" after replying to an email from his fiance.

</comment></comment></comment><comment><USER7> I just naturally assumed Gmail only filed things into Sent when it... sent them. I know that it _does_ "pay attention" to what it's sending: if you're accessing Gmail through IMAP/SMTP you don't need to have your client store sent messages on the server; Gmail will populate them there for you when you send through their SMTP server.

<comment><USER8> My best guess would be that it is caused by the fact that GMail doesn't really have folders per se. It emulates them when it's syncing with your client through IMAP and the web interface shows you folder icons, but these are really labels. In the case of the "sent" label I'd guess it's just a well- optimized search over "From:" headers of all the mails stored in "All Mail". If this is the case, then it appears that this search isn't as accurate as one would wish it was.

</comment></comment><comment><USER9> Is someone collecting these attack vectors somewhere?

That would help prevent anyone writing an email client to make the same mistake.

<comment><USER10> I wrote @ronomon/mime, an email parser which enforces RFC 2822 3.6.2 and which also detects a variety of attack vectors before they can reach the email client.

A summary of these vectors are listed in the README (amongst various sanity checks): [https://github.com/ronomon/mime#robust](https://github.com/ronomon/mime#robust)

Just through checking everything about an email carefully, @ronomon/mime has detected and brought to light some interesting attack vectors, for example a malformed email which crashes Apple Mail. This was disclosed to Apple's security team although they did not see any actual security implications.

Another interesting attack vector was an email containing millions of empty multiparts, which was able to crash several popular email servers. This was disclosed through Snyk, here are the details: [https://snyk.io/blog/how-to- crash-an-email-server-with-a-sin...](https://snyk.io/blog/how-to-crash-an- email-server-with-a-single-email)

</comment></comment><comment><USER11> I believe this has been a known issue for years now.

<comment><USER12> Indeed it has. It's been there so long I think it must be considered a feature.

<comment><AUTHOR> As @romed notes above, it looks like it _is_ intended as a feature. One which I think sacrifices majority-security for minority-utility.

</comment></comment></comment><comment> martin-adams This reminds me of the issue where spam emails with a calendar invite would not only appear on your Google calendar, but if the event was triggered, would give you a notification. I believe they fixed this one.

</comment><comment><USER13> This is a feature, not a bug, and it's required to get enterprise business.

<comment><USER14> What enterprise use case exists for telling me I've sent email that I haven't actually sent?

<comment><USER13> First, note that a great many enterprise use cases are total nonsense. But still: people want to be able to put messages into gmail from random other systems and have the "sent" label be applied, so they can treat it as a system of record.

<comment><USER15> You wouldn't do that by sending an email to the account. You'd do that by logging in with IMAP and importing an email that way.

<comment><USER16> That's how you would do it if course, but not everyone knows or understand IMAP. Everyone knows how to send an email</comment></comment></comment></comment></comment>


How to Create Headlines That Get Retweeted - <AUTHOR> http://www.fourhourworkweek.com/blog/2010/08/30/popular-retweets/?utm_source=feedburner <comment><USER2> "How to flood the world with pointless drivel created for magpies."</comment>


Ask HN: It's 2011. Why is web encryption still coupled with verification? - <AUTHOR>

Seriously. If I want to know I'm looking at the real Paypal website, Paypal can shell out to Verisign or whomever to reassure me. If I want to code a site in my garage, and prevent logins from being scraped on any wifi connection, why the hell should I have to pay for my identity to be validated? Are Mozilla and MS and Google all in business with GeoTrust to the extent that there can't be a header that says, ENCRYPT THIS CONNECTION? With or without validation? With or without warning a user?
Come to think of it, a self-signed SSL cert generates a bazillion warnings in the browser that get worse every year, but have you ever seen a browser warn you that you're about to submit your password over a totally unsecured, unencrypted connection? No!
GeoTrust still wants to see $5M in net worth to "make" you as a CA. What a racket. <comment><USER2> There was a great discussion about this a month or so ago (<http://news.ycombinator.com/item?id=2376431>). I'd highly encourage you to read the comments that were made.

As Lanzaa pointed out here, encryption without identity validation is worthless. If anyone can MITM your connection without you knowing about it, your encryption isn't doing you any good. That being said, there is certainly value to the "SSH model", where you verify the destination's fingerprint the first time you connect and any time it changes. That at least gives you the opportunity to know if someone is attacking you.

<comment><AUTHOR> Why can't encryption still be useful if you (not your browser, you personally) trust what's in your URL bar?

<comment><USER2> I'd argue that in order to trust what's in your address bar, you have to have "verification": if you're not sure who's on the other end, you can't trust the address bar. Whether that knowledge comes from a PKI system like browsers use now or an SSH-style system is a separate issue.

</comment></comment></comment><comment><USER3> The lack of opportunistic encryption in most protocols is indeed depressing. Clearly a case of the perfect (end to end authentication) being the enemy of the good (protection from passive eavesdropping), although in fairness, active MITM attacks are much easier on most IP networks than on something like the PSTN or in-person with which people are more intuitively familiar, at least near the endpoints (or by carriers)

We really need some kind of caching of keys, like ssh does, where users are alerted only if a key changes. Combine that with some smart way to do real authentication after the fact (i.e. start using a site, don't trust it much, but when you're ready to start using it for high trust stuff, do a more in- depth validation), and security for end users would be vastly improved.

</comment><comment><USER4> Verification is vital to security.

In your example having a self signed certificate would be worthless. If someone is performing a Man In The Middle attack on your users then they can also sign their own certificate while impersonating your site. Without verification your users would not know the connection to your site is compromised.

While the current system is not ideal, you should not try to completely do away with verification.

<comment><USER3> Passive MITM is MUCH higher risk in the wild than active MITM. Active MITM also generally disrupts service or otherwise leaves evidence, so it eventually gets found; passive can go on forever.

The best thing would be opportunistic encryption, possibly using cached keys, for all traffic, combined with endpoint authentication (and maybe multiple levels, like SSL, SSL-EV, SSL-Real-Authentication-By-Humans) on top of that. Ideally, as close as possible as end to end, but if some security wasn't end to end, it might still be useful (i.e. various wireless and wired lan security protocols).

<comment><AUTHOR> Don't forget too that most browsers will poll the user whether to accept a self-signed cert for the page the user's trying to load, but will simply fail when a service in that page tries to pull data over SSL from a domain with a self-signed cert. Flash, JS, etc.

I've been experimenting recently with spreading out databases geographically and letting clients (and to a lesser extent, DNS) do the bulk of the load balancing on data-intensive projects. I've gotten some great results. But right now, users would have to pre-visit a page at each data site and approve it in the browser. Or I could get a massively expensive wildcard cert and then make A-records for each of those sites, but I'd rather just access them straight through their IP addresses for speed.

The whole thing just irks me. All I want to do is make sure this line is encrypted between the end user and their ISP. That should be mandatory these days; but instead I have to pay for a cert on every single DB server?!

<comment><USER5> _All I want to do is make sure this line is encrypted between the end user and their ISP_

No you don't. What you want is to make the line secure. Encryption alone does not make a secure line. Period.

</comment></comment></comment></comment><comment><USER6> I think what everyone is missing in this argument is that, with certificate issuers like GoDaddy out there, identity is no longer certain.

At the speed that they turn around certificates, their really can't be much verification going on if any.

<comment><USER7> That's definitely true. Basic SSL hardly amounts to verification beyond the ability to find a valid credit card, yet browsers will accept the generated certs without a question.

To the OP's point, I'm perfectly happy to generate self signed certs, but I find that browsers make using them more inconvenient than necessary. That's the part that seems a bit conspiratorial to me. It wouldn't be hard at all to pop up a very clearly worded message "this is a self-signed certificate with fingerprint xxx, would you like to accept it [once] [every time]". Safari and Firefox aren't too far far from this, but I find chrome and IE to be obtuse at best.

</comment></comment><comment><USER8> I remember reading about something like this before (I'll try to find the article if I can). Basically, the reason for verification being so pricy is partially based on the illusion that this is _really_ worth something.

An example (from the article): banks used to build enormous, unreasonably large buildings with pillars and impressive entranceways. People were more likely to trust a bank that could afford such a building because it showed that they would be there for a long time to come.

Similarly, if a website is willing to pay to be verified then it indicates (at least to me) that they didn't put up the site on a whim. They're in it for the long term and this is (supposedly) backed by a company I can trust.

</comment><comment><USER9> Because if I'm on your wifi in your garage, I can spoof a site that has signed, unverified certificates and steal logins just as easily as if it were over the clear.

All I have to do is drop a machine on the network, say it's paypal.com and give it my own self signed SSL. Your computer looks on the network, finds paypal.com, pulls it up and you just implicitly trust the self signed SSL.

Encrpytion without verification is just security theatre.

<comment><AUTHOR> so... how about browsers warn when they're pulling a an address off a DNS they've never heard of, and that isn't listed and isn't verified? Wouldn't that be a much saner way of dealing with the problem?

<comment><USER10> <http://www.thoughtcrime.org/software/sslstrip/>

DNS has nothing to do with it. They can arp-spoof your machine into thinking their machine is the gateway. Then all your traffic goes through their machine. If you don't verify certificates, then they could just present you a self-signed cert that they used to decrypt your requests, then re-encrypt them and forward to the real site. If your browser didn't warn you, you'd never know.

Seriously, watch the video. Even though your browser warns you, you're still very vulnerable. If you just type bankofamerica.com, anybody on your network could easily trick you in to divulging your password. You have to type the "https" in yourself and trust that your browser verifies certificates correctly.

edit: wrong link. =(</comment></comment></comment>


Toned Ear: Ear Training - <AUTHOR> https://tonedear.com/ <comment><USER2> Has anyone used these to successfully learn absolute pitch themselves?</comment>


Jclouds Clojure support - <AUTHOR> http://anyweight.blogspot.com/2010/05/new-jclouds-hardens-cloud-provisioning.html

<comment><USER2> I just looked through the startup guides for RimuHosting, EC2, and appengine. Looks good, and it is probably a good idea to have a good exit strategy for any cloud provider.

</comment><comment><USER3> I'm very happy to see this! Sorry for my ignorance, but does anyone know if there are any other projects along the same vein?</comment>


France bans the publication of statistical information about judges' decisions - <AUTHOR> https://www.artificiallawyer.com/2019/06/04/france-bans-judge-analytics-5-years-in-prison-for-rule-breakers/ <comment><USER3> >After all, how can a society dictate how its citizens are allowed to use data and interpret it – if that data is already placed in public view, by a public body, such as a court?

I'm totally flabbergasted at how public domain is now not only censored, but sharing of it is punishable by prison time...

>This seems to be like giving someone access to a public library, but banning them from reading certain books that are sitting right there on the shelf for all to see. This is a sort of coercive censorship, but of the most bizarre kind – as it's the censorship of justice's own output.

The phrasing of the law is more close to being allowed to read important books about historical events, but you are forbidden to summarize or think about the conclusions of said events and share your findings. I can't seem to think of another way to rationalize those who approved this into law other than the judges simply didn't like the public knowing 'how they think'. What a truly bizarre verdict.

<comment><USER4> The article is misleading, it's not what the law says. The law specifically forbids the use of personally identifiable data (ie judges and clerks name) to conduct statistical analysis predictions. This seems to be in line with the privacy laws that require prior consent to allow this kind of private data processing (by private I specifically mean related to identifiable individuals)

<comment><USER5> The government doesn't have the right to privacy. If you work for the government, people should have the right to know your name and what choices you made in an official capacity. France is practicing the opposite of transparency.

<comment><USER6> > The government doesn't have the right to privacy.

France clearly disagrees.

I think that's misguided on France's part, but it's not "censorship" per se.

</comment></comment></comment></comment><comment><USER7> This is preposterous. Judges are acting predictably in making critical decisions about people's lives. Instead of trying to fix the bias/predictability problem, France moves to censor data revealing said predictability.

Edit: grammar.

<comment><USER8> There is a long tradition of shielding judges from any sort of accountability in France. It is illegal for instance to criticize a court decision.

Even the most appalling wrongdoings have no consequences on judges. Like the judge instructing the Outreau case (an alleged poedophile ring that resulted in dozens of people sent to jail and/or loosing custody of their children, before the whole case collapsed when it became clear the only evidence was the false testimony of a single person). The judge responsible faced a parliamentary hearing, where he appeared unfit for the job, incapable of even speaking in public. As far as I am aware it didn't even dent his career. Or the Nice court affair, where the president of the court was caught tipping off a gangster from his freemason lodge. The judge was quietly sent to retirement and never saw the bars of a jail.

Judges in France are highly politicized, as the "mur des cons" scandal illustrated. There is a long tradition of judges prosecuting a political party before resigning to take a senior position in a competing party (Thierry Jean- Pierre, Eva Joly, Eric Halphen, etc).

It is therefore unsurprising to see some law trying to prevent surfacing any evidence of partiality and/or wrong doing.

<comment><USER9> "It is illegal for instance to criticize a court decision."

this can't be for real.

when did France become so conservative?

<comment><USER10> Clovis baptism?

You have to understand that France has some other traits that are way more progressive than in the US: crossing the street is not a crime, you won't be arrested for drinking in the street, women work more than in the US, and they get married less, birth control and abortions are covered by insurance.

The balance is different than in the US, but people have a longer life expectancy with a way lower GDP/capita, so something is seriously right.

<comment><USER11> What does any of this have to do with censorship? Are you saying France is forgiven because they have other progressive policies? Seems like a very strange stance to take.

<comment><USER10> that was an answer to "when did France become so conservative?"

</comment></comment></comment></comment></comment></comment><comment><USER12> Is there a good article on this that isn't from a source that seems pretty unashamedly biased in favor of the AI companies?

<comment><USER13> The article directly links to the legal text: [https://www.legifrance.gouv.fr/eli/loi/2019/3/23/2019-222/jo...](https://www.legifrance.gouv.fr/eli/loi/2019/3/23/2019-222/jo/article_33)

> « Les données d'identité des magistrats et des membres du greffe ne peuvent > faire l'objet d'une réutilisation ayant pour objet ou pour effet d'évaluer, > d'analyser, de comparer ou de prédire leurs pratiques professionnelles > réelles ou supposées. La violation de cette interdiction est punie des > peines prévues aux articles 226-18,226-24 et 226-31 du code pénal, sans > préjudice des mesures et sanctions prévues par la loi n° 78-17 du 6 janvier > 1978 relative à l'informatique, aux fichiers et aux libertés. » ;

Which translates roughly to:

> The identity data of magistrates and members of the greffe can not be re- > used for the purpose or effect of evaluating, analyzing, comparing or > predicting their actual or alleged professional practices. Violation of this > prohibition is punished by the penalties provided for in Articles > 226-18,226-24 and 226-31 of the Penal Code, without prejudice to the > measures and sanctions provided for by Law No. 78-17 of 6 January 1978 > relating to data processing, files and freedoms

</comment></comment><comment><USER14> Ok, so French citizens/entities are bard from analyzing legal decisions. But, like, uh, how does this stop a non-French entity from doing the very same thing? ... and then making it available to the world!

You know, cause a non-French entity is outside of France's jurisdiction.

<comment><USER15> Surely an enterprising person will do this.

There's a law in France regardiung the release of exit polls on the day of an election - basically, you are restricted from releasing these polls before the polls close so as not to impact people who vote later in the day. The law applies to French media in France, but it doesn't apply to non-French media entities. Hence, if you are looking for exit polling date on the day of the election, you hit up a French-language source in Switzerland or Belgium that carries the polling instead of the local French news site.

I suspect this legal analysis could be a more lucrative and sustainable use case for a non-French-but-still-French-language startup to make their way.

</comment></comment><comment><USER16> This is the second time I am reading some absolutely ridiculous new law from France. The other time was when I learnt paternity tests and DNA testing is illegal in France too.

Source:

[https://www.thelocal.fr/20181220/french-ban-on-dna- testing-c...](https://www.thelocal.fr/20181220/french-ban-on-dna-testing-cant- stop-the-craze)

[https://www.ibdna.com/paternity-testing-ban-upheld-in- france...](https://www.ibdna.com/paternity-testing-ban-upheld-in-france/)

[https://en.wikipedia.org/wiki/DNA_paternity_testing#France](https://en.wikipedia.org/wiki/DNA_paternity_testing#France)

[https://www.irishtimes.com/news/french-men-s-insecurity- over...](https://www.irishtimes.com/news/french-men-s-insecurity-over- paternity-of-offspring-creating-a-society-of-doubt-1.773569)

<comment><USER17> But what's the point of paternity testing if it's not within the frame of a legal procedure? And if there's a legal procedure, then it's legal.

<comment><USER16> As a parent, if you caught your SO cheating on you, you would probably also want to check if the kid is yours or not before divorce. Last thing you would want to have to do is paying child support for a kid which came from your SO cheating and not yours.

<comment><USER17> > _you would probably also want to check if the kid is yours or not before > divorce_

Why? If you have doubts, then the DNA test will be ordered in the divorce proceedings.

<comment><USER5> It raises the costs of paternity testing. Instead of privately, cheaply performing a test, you have to do it publicly and expensively. This _de facto_ stops many men from performing tests, which is significant and not something you can just dismiss. Legal restrictions on consensual activity is not normal and needs a good justification for it. It's the norm to be free to do as you please as long as all parties involved consent.

Maybe you want to figure out if the child is genetically yours before you initiate divorce.

<comment><USER17> The legal costs of a divorce are not very high in France (I should know) justice is quite different from the US. And a legal paternity test is 150€, which is cheaper than what most private labs offer.

> _consensual activity_

> _all parties involved consent_

Well that's the crux of it, indeed. Most private testing is not done in a consensual way because that would require the assent of the child, which is likely minor, meaning it requires the assent of both its legal parents. If you have the assent of both the father and mother, it's easy (and free) to ask a court to allow the testing.

<comment><USER18> I'm not sure if you need the consent of both guardians normally.

<comment><USER17> It is required, but the consent of the other parent is _assumed_ in normal circumstances. In a lack of trust situation like this one, the consent of the other parent cannot be assumed.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> I think before the pitchforks are raised, folks should try to get familiar with the concepts laid out in this charter published last December by the European Commission for the Efficiency of Justice. Then you can raise the pitchforks in an informed manner.

[https://rm.coe.int/ethical-charter-en-for- publication-4-dece...](https://rm.coe.int/ethical-charter-en-for- publication-4-december-2018/16808f699c)

</comment><comment><USER20> From the article it sounds like they banned any kind of statistical analysis. I can understand that you might want to put a temporary ban on AI's that directly advise judges, however this seems excessive.

<comment><USER4> This is not what the law says. In France, judgements are anonymized before being published, however the name of the judges and their teams are kept. The law says that the names of the judges cannot be used to predict or analyse decisions from a specific judge/court. Although I can understand why it would be appealing to do so (eg to prove bias...), it could easily be misused to put judges under political pressure, or encourage court shopping by less ethical entities. Also this seems in line with data privacy laws, where you must get prior consent in order to use personally identifiable data. It has nothing to do with analysis of legal decisions in general.

</comment></comment><comment><USER21> Isn't the L. 10-1 article also worth a note? The first paragraph seems to be worded so as to give them legalese to prevent collecting the data in bulk. IANAL but to me that reads like "you may access the data but we reserve the right to deny you bulk access" (by repetitive and systematic download, aka web scraping).

> Les tiers peuvent se faire délivrer copie des jugements, sous réserve des > demandes abusives, en particulier par leur nombre ou par leur caractère > répétitif ou systématique.

[https://www.legifrance.gouv.fr/eli/loi/2019/3/23/2019-222/jo...](https://www.legifrance.gouv.fr/eli/loi/2019/3/23/2019-222/jo/article_33)

</comment><comment><USER22> I'm sure there must be a better way to word the title. I seriously had no idea what it's trying to say without reading first few sentences of the article. Or was that the intention?

(the stupid capitalization doesn't help either)

<comment><USER23> Ya not a great title. I had to read the title a few times before I got it.

That capitalization nomenclature is called "Title Case"... typically used for newspaper/article titles. It comes from a time when it was more time consuming (and sometimes impossible) to add emphasis to words in some other way using the typesetter. Newspaper sections were typically ALL CAPS and article titles were Title Case. This allowed for different levels of emphasis using the same character set. It's not really necessary anymore but it lives on out of tradition.

</comment></comment><comment><USER24> I was curious why a law like that would not cause more scrutinity other than that one website. After looking it up, the law is from this past March and has only been discussed by a couple of French-language sites. This is not causing more alarm because the data was previously available only in printed form, which meant that typically only a lawyer would access it, and only on a case- per-case basis. So in practice the data is being made more easily available, but in a limited form. They're basically handling this like it's a whois request.

The law specifically state that what is illegal is publishing data identifying a judge ("Les _données d 'identité_ des magistrats et des membres du greffe ne peuvent faire l'objet..."), so publishing general or anonymized stats is legal. For stats regarding a judge I guess one would have to rely on the previously available printed format. Why that is I have no idea, the only argument I've seen is some vague reference to protecting againt "judge/lawyer AI", which I can't make sense of in this context (is judge AI even a thing?). This seems to me to be some kind of over-reaction to new tech.

I've come to call these type of laws 'Peak French': unforeseen issue on the horizon? No worries, just lock everything down and pretend the problem is solved.

</comment><comment><USER25> Watch out: it's about "personal identities"... Like name for example. But replacing the name by an id might be ok: it's still possible to build a model for every judge (as a function) but not to link it to a person!

Moreover, please keep in mind that the french system is quite different from the US/UK. In France, Judges are really tighly controlled by the law. In US/UK they're more "free". So this kind of software has more value in US/UK where the personality of the judge matter more

</comment><comment><USER26> The site is pretty hammered. Mirror here: [http://archive.is/kPqeg](http://archive.is/kPqeg)

</comment><comment><USER27> Sounds like a _totally backwards and nonsensical_ way to solve the (possibly legitimate) problems that they have:

\- you can choose to release _partially anonymized data_ (like without identities of judges etc.), and have laws _preventing the use of ML to de- anonymize data statistically_ (examples of this can be seem with medical data, this can work fine)

\- ...you CAN'T _have the data available_ but _prevent people from using it_

 _Or did we completely misunderstood what this was about?_

Dunno WTF is with this pattern of legislations cropping around the EU (like the copyright directives etc.) that seem the product of what can only be explained by (a) _levels of incompetence bordering actual mental-impairment_ from the part of the legislators, or (b) _a really dark agenda being played out behind the scenes_ (thing Germany cca. 1939-ish...).

 _This is sad because some of us really love the idea of the EU open society!_

It's like there's some dark force trying to destroy it and its countries from within under the guise of "protecting" imaginary "rights".

</comment><comment><USER28> > In short, they didn't like how the pattern of their decisions – now > relatively easy to model – were potentially open for all to see.

The article nonchalantly displays bias but it does seem like AI scared French judges about their class job security. If this is the case, more than anything, it validates AI in the judiciary.

</comment><comment><USER29> Here an example of an analysis of past french judge rulings. [https://medium.com/@supralegem/the-impartiality-of-some- judg...](https://medium.com/@supralegem/the-impartiality-of-some-judges- undermined-by-artificial-intelligence-c54cac85c4c4)

</comment><comment><USER30> wait a minute, was this decision made by a judge? Did anyone see this coming?

<comment><USER21> Judges don't get to create rules in Roman Law systems like they do in Common Law systems.

This is (rider?) legalese that got lobbed into a larger legislative reform.

[https://www.legifrance.gouv.fr/eli/loi/2019/3/23/2019-222/jo...](https://www.legifrance.gouv.fr/eli/loi/2019/3/23/2019-222/jo/article_33)

<comment><USER31> Facts in a case shape decisions or should do. Parliamentary lawmakers can never anticipate the application of their laws to cover all possible disputes. Common law is evolutionary and recognizes our inability to be omniscient & lay down rules worthy of eternal justification. Moreover the logic in a case is preserved and provides a basis for deciding similar situations via precedent.

</comment></comment></comment><comment><USER32> Holding the users/abusers of AI to account is more important and effective than regulating the AI technology itself.

We must never let someone say things like "It's not me that's racist, it was the AI that made the decision!"

</comment><comment><USER33> Presumably the same conclusions - this judge is lenient, this one harsh - <USER2> what people familiar with the courts would have in their minds anyway. And those people would have reached those conclusions using a neural network.

If this law is real the story might evolve. People in the law industry will know how to structure an offshore entity that can do the analysis. And people who get the results are going to know how to act like they didn't need the computer.

<comment><USER8> But if you present hard evidence it might challenge the official fiction of a fair and impartial legal process.

</comment></comment><comment><USER34> Last time I checked, freedom of thought was a part of article 10.

A challenge through line of EU institutes may well be able to cancel this law.

</comment><comment><USER35> [https://i.imgur.com/AzZLlDu.png](https://i.imgur.com/AzZLlDu.png)

</comment><comment><USER36> Can you publish the algorithms and the method of scrapping data and let the client make the final assembly of the pieces?</comment>


Photonic Bell states creation around rotating black holes - <AUTHOR> https://arxiv.org/abs/1608.06822 <comment><USER2> I studied quantum information/foundations to research level, so may be able to give some input and obviate some of the wilder interpretations. This paper isn't directly in my field of interest (don't know much about relativity), so I'm happy to be corrected if I say something stupid.

You've probably heard that quantum information processing uses the "qubit" as an information primitive. A qubit is not itself a particle, but a "degree of freedom" which can be in one of a range of states. This degree of freedom could be spin, polarization, energy, and so on and so on. Unlike bits, a pair of qubits can be entangled, which means that their joint state is not decomposable into a statistical mixture of independent pairs of states.

The paper considers two degrees of freedom associated with photons emitted from the accretion disks of spinning black holes: polarization and orbital angular momentum (OAM). Essentially, there are two qubits per photon. After some reasonable assumptions and calculations we find that the two qubits are highly entangled; in fact, as entangled as it's possible for two qubits to be. The author speculates that may be able to detect this by measuring such photons with modern equipment. I suppose the motivation is that we might be able to use them for actual information processing tasks (although as far as I can see there's no benefit to this over preparing entangled qubits ourselves).

That's about it, I think. No time-travel, no communication, but a small point of interest.

</comment><comment><USER3> I haven't read the paper yet (too much to do). But I wonder why it's posted in the "General Physics (physics.gen-ph)" category rather than under "General Relativity and Quantum Cosmology (gr-qc)" where most papers with similar topics are traditionally submitted.

The physics.gen-ph category on arXiv is a little odd, a little uncomfortable, and hard to describe. Here are a couple of quotes from discusions of arXiv moderation commenting on it:

"There is one middle option between acceptance and rejection: Dubious papers can be shunted to a category called "general physics," or "gen-ph." At best, gen-ph is a home for papers that don't fit neatly into any other category; at worst, it is a crackpot dumping ground. Either way, it allows moderators to dodge the drama that comes with out-and-out rejections. For many authors, though, being relegated to gen-ph is just as galling as being rejected outright: As one such researcher told Reyes-Galindo, having his paper reclassified to gen-ph felt like a deliberate attempt to diminish the paper's impact." \-- [http://oren365.tech/news/What-Counts-as- Science](http://oren365.tech/news/What-Counts-as-Science)? (via Google cache)

"Personally, I have never had a problem with the arXiv moderation. I had a paper reclassified from gen-ph to gr-qc once by a well-meaning moderator, which is how I learned that gen-ph is the dump for borderline crackpottery. (How would I have known? I don't read gen-ph. I was just assuming someone reads it.)" \-- [http://backreaction.blogspot.com/2016/05/the-holy-grail- of-c...](http://backreaction.blogspot.com/2016/05/the-holy-grail-of-crackpot- filtering.html)

EDIT: I don't mean this as direct criticism of this paper, which might potentially be fantastic and just fit better in the general category for one reason or another than in gr-qc. (Or, some moderator might have been too harsh: entirely possible!) But I wanted to share some of the unspoken background information that many physicists would think about when seeing this link.

<comment><AUTHOR> After you read the paper, will you share us your thoughts on it, please?!!

</comment></comment><comment><USER4> Something to note: More times than not, asking a liberal arts major about how quantum mechanics works is usually more valid and reputable than the preprint arXiv

<comment><USER5> You better had substantiate that claim.

</comment></comment><comment><USER6> It seems the very author of the paper on the arxiv posted the link here (ovidiu69 here, Ovidiu Racorean of the paper), and maybe he is willing to answer some specific questions?

Ovidiu, being a researcher, can you please tell what your scientific CV is, especially related to the topics of the paper?

I see you've submitted different papers to arxiv:

[https://arxiv.org/find/all/1/au:+Racorean_Ovidiu/0/1/0/all/0...](https://arxiv.org/find/all/1/au:+Racorean_Ovidiu/0/1/0/all/0/1)

Have you had any interactions and/or reactions from the other researchers in the fields? Have you published somewhere else?

</comment><comment><USER7> The stretch is that in the future blackhole state can be changed and send information back in time? Not seeing it.

<comment><USER8> Sorta worked in Interstellar, though perhaps not in the way you're describing. ;)

</comment></comment><comment><USER9> Are they suggesting black holes can be used as quantum computers?

<comment><USER10> Absolutely not. You could (if it's true, at a glance it's not terribly convincing) use this as a probe of curved-space QED (a very difficult field) or as a method to measure of the spin of black holes (currently done by different dark magic which isn't very reliable).

</comment></comment><comment><USER11> Good idea for a science fiction story.

<comment><USER12> My thoughts too.

Perhaps they are talking to each other.. .

Edit -- You and I really are quite alike in thought sometimes. You must come and visit Southampton sometime now the house is a bit more sorted.

<comment><USER13> My thoughts too.

No, really! :)

This was ragingly interesting, but outside papers like these I wondered what the application of this at this stage might be; Great sci-fi could be had, was my conclusion.

</comment></comment></comment><comment><USER14> Oh man. Can we change this to [https://arxiv.org/abs/1608.06822](https://arxiv.org/abs/1608.06822) ? This "write up" is very bad, and clearly comes from somebody who doesn't really grasp quantum mechanics, and the connection to QUESS is... not good, although this paper and that idea share certain buzzwords.</comment>


Why I Stand While I Work and Sit on Breaks - <AUTHOR> http://uxmovement.com/resources/why-i-stand-while-i-work-and-sit-on-breaks

<comment><USER2> Yup, it's pretty bad for you. I try to stand as much as possible, but standing desks aren't exactly cheap, and I don't have a dresser that's the right height.

NYTimes ran a few articles a while back about this very subject..

[http://opinionator.blogs.nytimes.com/2010/02/23/stand-up- whi...](http://opinionator.blogs.nytimes.com/2010/02/23/stand-up-while-you- read-this/)

[http://well.blogs.nytimes.com/2010/07/14/phys-ed-the-men- who...](http://well.blogs.nytimes.com/2010/07/14/phys-ed-the-men-who-stare-at- screens/)

A key point: "The men worked out, then sat in cars and in front of televisions for hours, and their risk of heart disease soared, despite the exercise. Their workouts did not counteract the ill effects of sitting."</comment>