Show HN: Expounder – A small JavaScript library for more engaging tutorials - <AUTHOR> https://skorokithakis.github.io/expounder/ <comment><USER2> My advice would be to somehow indicate exactly the text that was expounded - maybe with a faint underline or something. When it expands out, it's sometimes difficult to track the exact words that suddenly appear.

<comment><AUTHOR> Ah, good idea. Right now you get a fade, but that's easy to miss. Of course, the intent is that the expounded text becomes a part of the overall paragraph, so you shouldn't _need_ to know what was just expounded, you just read on, so there's definitely a balance there.

Also, the text is very very easy for the website owner to style, with just a single CSS rule.

EDIT: I've added some styling information to the page, thanks.

<comment><USER3> This is the first time i heard about [https://gitcdn.xyz/](https://gitcdn.xyz/) while checking your page source.

That's actually a smart idea for a CDN :)

<comment><AUTHOR> Yep! We were using rawgit initially, but it went down on the first day for hours, so we changed to that instead.

</comment></comment></comment></comment><comment><USER4> Interesting. I personally like to use sidenotes for this type of thing on my website; it's nice to be able to scan the sidenotes for additional info without clicking on anything. On the other hand, they really don't work on mobile. BigfootJS[0] is the nicest footnote-inliner I know of that also works gracefully on small screens (unpaginated media); if you haven't seen it, take a look.

Feedback for this library:

\- It would be cool if you could set a few preset levels of expansion (TL;DR, expert, beginner, ELI5) and toggle them at the top of the page.

[0] [http://www.bigfootjs.com](http://www.bigfootjs.com)

<comment><AUTHOR> Thanks for the feedback, the tiered approach is also something I considered, although with a different method. You would tag things with a number from 1 for outermost to N for innermost and then let the user expand to the specific level. I haven't yet tried that concept, but I probably will soon!

</comment></comment><comment><USER5> This is an old idea in Hypertext called Stretch Text (since 1967!):

[https://en.wikipedia.org/wiki/StretchText](https://en.wikipedia.org/wiki/StretchText)

Every so often someone hears about the old hypertext theory and implements a Javascript or CSS version, but this is honestly one of the nicest implementations I've ever seen. Good work!

</comment><comment><USER6> This seems like something that could impact the nature of composition. I wonder if writers would write differently if they knew they could "expound".

<comment><USER7> Surely if you write with expounding in mind you'll take that into consideration in your text. You DO write the expanded text after all...

<comment><USER6> No, I don't believe I do. I think this could be implemented into a blogging platform— a new medium.

<comment><USER8> Lol yeah, I feel like I want more examples to read. Easy way to filter data you already know. I think I could learn so much faster with this if texts are written properly.

<comment><AUTHOR> I used it in "normal" usage here:

[https://www.stavros.io/posts/building-cheap-home- sensorcontr...](https://www.stavros.io/posts/building-cheap-home- sensorcontroller/)

EDIT: I've added a "real-world examples" section to the page with the above included.

</comment></comment></comment></comment></comment><comment><USER9> (As someone who can't write concisely (without inserting a lot of (unnecessary) context)) I would love (to use) an automated version ((of this) so I can just write with full context (and let people choose the level of details they want (to read))).

I would love an automated version.

</comment><comment><USER10> Wouldn't a tooltip give the same information while taking up less space and not messing up your carefully setup layout?

</comment><comment><USER11> Very nice, reminds me of telescopictext.

Here's an example that explains magnetic fields: [http://www.telescopictext.org/text/pFjkqQY9bmfvQ](http://www.telescopictext.org/text/pFjkqQY9bmfvQ)

<comment><AUTHOR> That's pretty much the same context, but I think the demo is lacking. For example, clicking on "magnetic" replaces it with "B", which confuses me even more. There's also at one point a link on "be", which is just baffling. What is there to explain about "be"?

<comment><USER11> Fully agree. Your semantics of "expounder" and "expounded" spans is much more coherent.

It's a new modality, but I think it has a lot of potential: I love explanations with "multiple levels" in general...

</comment></comment></comment><comment><USER12> I feel like this could be a really interesting tool for wikis. It'd be neat to be able to read what is, essentially, an executive summary of a topic, but then be able to drill down into a path of discovery that you're interested in.

<comment><AUTHOR> That's one of the reasons I developed this. You could essentially go into as much detail as you wanted in the topic you wanted. Of course, the writer must be careful not to overdo it, because sometimes the reader _does_ want to just read everything, but it'd be great for things a reader might be familiar with, or that not everyone will find interesting.

<comment><USER12> Yeah, nice work! I dig it.

</comment></comment></comment><comment><USER13> Reminds me a little of what Wait But Why is doing in his articles - e.g: [http://waitbutwhy.com/2016/03/cryonics.html](http://waitbutwhy.com/2016/03/cryonics.html) (look for "New to WBW? Open these.")

</comment><comment><USER14> (Click -> Tool tip) works better IMO. The sudden append of words threw off my reading rhythm.

</comment><comment><USER15> I've used something similar for talking about complex code examples. You can show only the current line you're talking about, but have a button to expand out the full example. it's pretty great. Excited to give this a try!

</comment><comment><USER16> How does a screen reader handle that ?

<comment><AUTHOR> I'm not sure (I'd appreciate some feedback by someone who uses one), but I'd think it would just read the whole text. Depends on what it does with hidden text.

<comment><USER16> I recommend reading [https://en.wikipedia.org/wiki/WAI- ARIA](https://en.wikipedia.org/wiki/WAI-ARIA)

</comment></comment></comment><comment><USER17> Great, a nice little used UI pattern. Now when will my Expounder Wikipedia viewer come?

</comment><comment><USER7> Very nice and clever. I like it it fits seamlessly into the text.

</comment><comment><USER18> I _knew_ that name looked familiar! Small world.

<comment><AUTHOR> Haha, you bastard :P</comment></comment>


Russia Paid in Rubles to Target U.S. Patriots, Confederates, Fans of Malcolm X - <AUTHOR> https://www.bloomberg.com/news/articles/2017-11-01/russia-paid-in-rubles-to-target-u-s-patriots-confederates-fans-of-malcolm-x <comment><USER2> So the story is the Russians sank Clinton's campaign by spending .008% of her total campaign costs on Facebook adds completely indistinguishable from the kind of stuff her own supporters put out?

Uh huh.

</comment><comment><USER3> So the Russians paid like ~100,000 to encourage people to stand up against racial injustice, support fallen civil servants, and promote LGBT rights groups ... those evil bastards! Defiantly worth cracking down on free speech to prevent...

</comment><comment><USER4> These social media "impressions" are a cheap inflated currency imo.</comment>


Multivariable and Vector Analysis - <AUTHOR> https://rutherglen.science.mq.edu.au/wchen/lnmvafolder/lnmva.html <comment><AUTHOR> Is there any textbook other than Apostol's that follows the same approach?</comment>


YouTube Said to Be Planning a Subscription Option - <AUTHOR> http://www.nytimes.com/2013/05/07/business/media/youtube-said-to-be-planning-a-subscription-option.html?hp&_r=0

<comment><USER2> Definitely could see this working. When I saw the headline, I thought to myself that I'd happily pay $2/month to allow my favorite YouTubers to have a little more financial and, thus, artistic freedom. I noticed a few of my favorite videomakers--the Green brothers, for example--improved their content a lot after receiving YouTube production grants. So many of the people I follow started out with really good content and then have spiraled into product promotion, etc--and I can't blame them, if they're spending that much time on videos. Plus, it'll probably make me more excited to watch the videos anyway if I'm paying for the ones I like.</comment>


The Daily Stormer Returns to the Web with Help from a Startup - <AUTHOR> https://www.propublica.org/article/spurned-by-major-companies-the-daily-stormer-returns-to-the-web <comment><USER2> "People think they are doing good by silencing white supremacists but in reality they are chipping away at constitutional rights," he said in one tweet, adding later, "Is the left evil or just stupidevil?"

Yea, he's just hosting them because he believes in free speech, not because he's also a fascist. And he doesn't understand the difference between public guarantees of free speech and personal rights not to host it.

<comment><USER3> Got any facts to backup your assertions? Free speech is hardly a tenent of facisim.

<comment><USER4> No, but exploiting the language of rights that fascists don't believe but the wider society does in to advance their interests _is_ a common (but not at all unique to them) tactic of fascists.

</comment></comment></comment><comment><USER5> Not really a "Daily Stormer"-type, but they have the cutest Hitler emoji! [88]

LOL indeed!

[88] [https://dailystormer.lol/wp-content/uploads/2017/08/Daily- St...](https://dailystormer.lol/wp-content/uploads/2017/08/Daily-Stormer- Muffugguh-829-110x75.png)

</comment><comment><USER6> Who's funding this startup?</comment>


British bank shuts website until April 2012 - <AUTHOR> http://www.theregister.co.uk/2011/04/06/halifax_shuts_site_for_a_year/ <comment><USER2> Everyone's thinking it so I'll say it: WTF?!

If Wells Fargo turned off online banking for 1 month, I'd switch banks.

I wonder if they are handling everything in-house or have hired external consultants/company to build out this wonderful new site & mobile app that will take a full year.

Now if their current system had a major exploit and the only way to fix it is to rewrite the whole thing, I guess they have no choice. At the very least they should have put together a temporary "read only" type of site that involve less/no risk on their part and provide their call centers a bit of relief.

Ballsy move (and not in a good way.)

</comment><comment><USER3> Just to clarify, it's not _entirely_ down. It's just investments. I use this bank for checking and credit card and they're both fine.

<comment><USER4> Sure, but the point continues to stand. Why not continue to provide the current site until the new one is complete and then do a switch. Unless, as melvinram mentioned, somehow there is some costly exploit that cannot be fixed unless everything is redone and its dangerous to keep the site up until its rewritten.

</comment></comment><comment><USER5> This is what happens when you bail out companies: you end up with a bunch of dynosaurs stumbling like the savages they are.

<comment><USER6> Scottish banks were bailed out? I'm not sure if you think this is an American bank, or I just don't know enough about Scotland's economics.

<comment><USER7> Scotland is part of the united kingdom. The royal bank of scotland is a UK bank and it was bailed out by the UK government.

The UK is a country comprised of four countries. Don't worry, the people that live here don't understand it either.

Great Britain is simply a geographical term applied to the actual archipelago itself.

The economic relationship between scotland and the rest of the country, particularly the government in london is a vexed question that is seen as being badly in need of a solution, but it has been pushed aside in the current economic situation.

It's basically down to the fact that while scotland has partial legislative autonomy, it is unable to raise its own tax revenues independently, but it is much deeper and more complicated than this. See [https://secure.wikimedia.org/wikipedia/en/wiki/West_Lothian_...](https://secure.wikimedia.org/wikipedia/en/wiki/West_Lothian_Question)

<comment><USER8> While that's all true, RBS isn't the bank in question.

Also, both RBS and Lloyds Banking Group (who bought/'merged with' HBOS, which was the result of the merger of Halifax and Bank of Scotland, and it's Halifax's online banking the story is about) do have special Scottish-only rights, like printing banknotes.

</comment></comment></comment></comment><comment><USER9> Frankly, if their intentions are to build a site which is more secure, and there was a gaping security flaw with the existing site, then it is good news that it won't be available for a year.

</comment><comment><USER10> Palo Alto's utility company did the same thing while they rebuilt their bill pay site. Really frustrating as a user, especially for a city at the heart of the Valley.</comment>


31 film rolls from WW2 soldier discovered & processed, results are breathtaking - <AUTHOR> https://www.youtube.com/watch?v=VaurfqIW5-k <comment><USER2> _You-fucking-Tube?!_

Possibly second only to radio as a poor choice of medium for exhibiting a collection of photographs.

Mind you, I'm sure the:

 _" Yure mom photograph dicks in da war"_

 _" Well youre mom getted raped by Hilter"_

debate in the comments, on the historical significance of the discovery, will more than make up for it.

<comment><USER3> The developer story, context, human aspects of this work were interesting to me.

Sure, I want images to consider, but as presented, I got a sense of time, history, just the impact of that work, carefully done.</comment></comment>


Counterfeit U.S. Cash Floods Crime Forums - <AUTHOR> http://krebsonsecurity.com/2014/08/counterfeit-u-s-cash-floods-crime-forums/ <comment><USER3> >'MrMouse says his single-ply bills do not have magnetic ink, and so they won't pass machines designed to look for the presence of this feature.'

Clever tip for detecting counterfeits, found in comments:

>'A good strong, neodynmium cylindrical magnet stuck to the side of something is a great way to check US currency. Just hold a bill by the corner and dangle it close to the magnet. The bill will show a slight, but very observable attraction. Easy and fast.'

<comment><USER4> nevertheless, I can hit my local CVS and pay with my $100. They will just check the security strip. Easy peasy.

<comment><USER5> I think the point was that these bills have said security strip.

<comment><USER6> Which was the GP's point as well.

</comment></comment></comment></comment><comment><USER7> Note that Krebs hasn't verified that any orders have been received (fake "reviews" in underground forums are very common). Lots of people have claimed to sell fake currency in these marketplaces and are almost always a scam. This looks like one too.

<comment><USER5> > (fake "reviews" in underground forums are very common)

Do you have any references for that? Besides the top layer of these sites, I was under the impression that if you go down your "vouchers" go down with you.

<comment><USER7> 10+ years of being involved in fighting cybercrime. He is mostly advertising on low end forums that don't have the established social networks that would punish false reviews.

</comment></comment></comment><comment><USER8> My question was "is buying counterfeit money but not using it a crime". According to this, it's not:

[http://www.secretservice.gov/money_law.shtml](http://www.secretservice.gov/money_law.shtml)

"Possession of counterfeit United States obligations with fraudulent intent is a violation"

Specifically, at least on that page, it would not appear to be a crime to buy counterfeit money as long as a) you didn't use it and b) you didn't try to sell it.

<comment><USER9> I'd be careful. I'm not a lawyer, and this is not legal advice, but that page only refers to _posession_. I seem to recall things existing that are legal to have, but illegal to purchase.

<comment><USER8> I have no intention of buying the money I was just curious specifically about the law surrounding the issue. If I did intend to buy it (for whatever reason) I certainly would check further. I just found the language on the page interesting I didn't expect it to discuss the issue in that way.

</comment></comment></comment><comment><USER10> I lived in Ecuador for 5 months, which uses the US Dollar.

A couple of local guys that worked for me had a lot of fun testing my abilities to detect fake bills, which are plentiful in Ecuador. Even when they gave me two bills and told me one was real and one was fake, I couldn't discern any difference after 5 months of them showing me all the tricks of the trade.

The copies are extremely good, and I suspect not many people in the US are going to spend the time to check if a $10 or $20 is fake.

<comment><USER11> > The copies are extremely good, and I suspect not many people in the US are > going to spend the time to check if a $10 or $20 is fake.

Many places will at least use the marker test on a $20.

<comment><USER12> From the article, the seller claims that the bills will pass the pen test, so that wouldn't help.

<comment><USER13> The pens are worthless in general. Real bills can "fail", fake bills easily pass if they care to. The Secret Service will tell you to not rely on them if you call them up and ask about them.

A friend of mine had a $10 bill checked and confiscated at a corner store a few years ago. The bill was genuine, but a few decades old and over those past decades it accumulated enough starch on it to trip the pen. He had to call the local SS field office and get them to talk the corner store into giving him back his bill (the SS looked up the serial number, said that it wasn't a serial number known to be used on counterfeits, told them that the pens were shit, and told them to give the bill back).

I say the pens are worthless because, although they can detect counterfeits that somebody ran through their ink-jet at home, those sort of counterfeits won't fool a standard "look and feel" check anyway. In fact, they may give you a false sense of confidence and distract you from the more robust "look and feel" check.

<comment><USER14> "over those past decades it accumulated enough starch on it to trip the pen"

I can't believe that's a very common case. The pens are there to deter people from playing games with their color printers, and do a pretty good job of that.

Well, at least they do a good job of making people buy starch free paper.

<comment><USER15> > The pens are there to deter people from playing games with their color > printers, and do a pretty good job of that.

The circuitry in color printers and copiers that specifically prevents reproducing certain patterns used in bills probably does a better job of that.

</comment></comment></comment></comment></comment></comment><comment><USER16> Related..I thought maybe you could claim it as prop money for the movies but no dice.

"As it turns out, the Feds have strict laws about the production of fake currency. According to the Counterfeit Detection Act of 1992, a reproduced bill must be: a.) either less than 75% or more than 150% the size of a real bill, b.) one-sided, and c.) made with only one color (so as to discourage the reproduction of identifying factors). "

[http://priceonomics.com/the-business-of-fake-hollywood- money...](http://priceonomics.com/the-business-of-fake-hollywood-money/)

</comment><comment><USER17> This post reminded me of this. [http://en.m.wikipedia.org/wiki/Hitler_Diaries](http://en.m.wikipedia.org/wiki/Hitler_Diaries)

The Robert Harris account is excellent and there is a great quote from the forger along the lines of "A document isn't real or fake, it's efficient of inefficient". I highly recommend reading the book.

</comment><comment><USER4> The primary question: How the hell do you get this to your door? If I was to order it to a physical box, I face major felony charges as the government has a website to hack, and I am not confident in some random dude's ability to secure his website with every known security hole patched.

<comment><USER18> Typically you ship to some drop address (e.g., a house you know is empty, or somewhere where they'll leave the package somewhere easy to surveil and pick up). There was a DC-area mayor who had drugs shipped to him in this kind of scheme (he was uninvolved) and had his house shot up by a SWAT team as a result.

[http://en.wikipedia.org/wiki/Berwyn_Heights,_Maryland_mayor'...](http://en.wikipedia.org/wiki/Berwyn_Heights,_Maryland_mayor's_residence_drug_raid)

<comment><USER19> _who had drugs shipped to him...(he was uninvolved)_

"had drugs shipped" is a little ambiguous: someone shipped drugs using the mayor's house as the destination; Mayor Calvo had no knowledge or involvement in this. Despite his lack of involvement, the SWAT teams shot both of his Labrador retrievers, including one that was fleeing.

Photo of the mayor and the deceased: [http://media.washingtonpost.com/wp- dyn/content/photo/2009/09...](http://media.washingtonpost.com/wp- dyn/content/photo/2009/09/19/PH2009091902247.html)

</comment></comment></comment><comment><USER20> A lot of this concern would be removed if the US switched to polymer notes. Visiting the US last year I was surprised to see people immediately suspicious of $50 notes that I gave them. I've never seen that happen in Australia, even with $100 note.

<comment><USER21> You're attributing one thing - suspicion of a particular denomination - <USER2> something which it may not be related to. It may simply be due to how common a particular denomination is used in the cash economy.

In the Eurozone, €50 notes are very frequently used - it would be unusual to be specifically suspicious of that denomination - while €100 notes are far more rare.

<comment><USER20> You could be correct although I saw many other people paying for things with $50 notes too. I didn't think they were rare. Maybe it is store policy to do the counterfeit checks on $50/100 notes?

<comment><USER22> I can count on one hand how many times I've had a 50 in my wallet. We normally use 20s in the US. When I worked in retail policy was to check anything larger than a 20.

</comment></comment></comment></comment><comment><USER23> It's funny that no one is checking serial numbers. Nowadays it would not be too hard to look up in a database if the number was issued, is in use elsewhere, or belongs to a destroyed note.

Privacy, cost and protocol issues left as an exercise.

<comment><USER24> Why not make the serial numbers also a EC digital signature?!

<comment><USER25> Wouldn't it still be susceptible to replay attacks?

<comment><USER26> Paper-based PUFs, anyone?

</comment></comment></comment></comment><comment><USER27> Do all bills have magnetic ink?

I cannot seem to find a list.

<comment><USER28> One dollars do not as of yet

<comment><USER29> No one has found a way to make convincing one dollar bills for less than a dollar.

Heck washing dollar bills is a way to get base paper for higher denominations. (one of the incentives for moving away from consistently colored currency)

<comment><USER30> Which was the premise of the first Jack Reacher novel.</comment></comment></comment></comment>


Show HN: Wildcard API – RPC between front end and back end - <AUTHOR> https://github.com/reframejs/wildcard-api#readme <comment><AUTHOR> Author here.

For those who don't know what RPC is, RPC (Remote Procedure Call) denotes the practice of calling a procedure that is defined on a remote computer (or different process) as if it were defined locally on the same computer (or different process).

Wildcard fully abstracts away serialization and the transport protocol: you simply define a function and call it remotely.

Wildcard only supports JavaScript (Browser & Node.js) for now but it could in principle support all kinds of languages.</comment>


How To Date A Female Geek - <AUTHOR> http://www.jensterjuice.com/2011/01/how-to-date-a-female-geek/ <comment><USER2> I find articles like this on how to date a female / male geek very aggravating unless they are meant to be satirical or in plain jest . Analyzing some of the things mentioned in this blog post:

 _"As opposed to their male counterparts, many female geeks are into hygiene and looking nice for public viewing. But that's where similarities end."_

Really? What is similar between geeks regardless of gender is their geeky interests and hobbies. Some kind of sad generalization about appearance and hygiene is just pathetic.

 _"Female geeks have very particular needs, and if you can't meet them, consider yourself pwn3d."_

The usage of pwn3d makes it hard to take the author's advice seriously.

 _"Tell her she's pretty"_

Hard to grasp how the author managed to figure out the golden mantra to woe all female geeks.

In conclusion the person who wrote this blog post needs to change the title to : "How to date me".

</comment><comment><USER3> Have things in common, don't be clingy, listen to her and buy stuff she likes?

So all the same shit it takes to date any other girl?

</comment><comment><USER4> Why is this on HN?</comment>


Scribble: Github Style Wikis with Live Markdown Preview - <AUTHOR> http://www.tryscribble.com

<comment><USER2> It's really not enough said.

Why this and not GitHub?

Cost?

User auth or SSO?

Custom domains?</comment>


New multi touch gestures on MacBook Air and MBP - <AUTHOR> http://wcrawford.org/2008/02/28/everytime-i-think-about-you-i-touch-my-cell/ <comment><USER2> Same here. Been using multiclutch for back/fwd pages in firefox: [http://paulstamatiou.com/2008/06/16/how-to-quickie-swipe- in-...](http://paulstamatiou.com/2008/06/16/how-to-quickie-swipe-in-firefox)

</comment><comment><USER3> I've been using this for a while. It's hit-and-miss (some programs don't let you change them, sadly) but what it works for, it does well. Very much recommended.</comment>


Cats domesticated humans - <AUTHOR> http://www.washingtonpost.com/wp-dyn/content/article/2007/06/28/AR2007062802343.html?hpid=topnews

<comment><USER2> This reminds me that a while back I read a theory (<http://www.ornery.org/essays/warwatch/2005-06-19-1.html>) that dogs and humans domesticated each other, and that "We remain deficient in the things dogs did for us; they continue to depend on us to provide them with food and protection.", and that "that dog brains and human brains underwent a shrinkage about ten thousand years ago, again at the same time."

</comment><comment><USER3> Eric Raymond suggests that hackers prefer cats rather than dogs ( <http://www.catb.org/~esr/jargon/html/miscellaneous.html> ). Do you agree? I do.

<comment><AUTHOR> Yes. I know more hackers who own cats than own dogs. However, I'm acquainted with ESR and we have acquaintances in common, so I'm not really an independent data point.</comment></comment>


gedit Port for Windows - <AUTHOR> http://ftp.gnome.org/pub/gnome/binaries/win32/gedit/2.25

<comment><AUTHOR> I absolutely love this text editor, and found windows binaries on the gnome public ftp. Everything looks to be working fine, minus a few plugins that I downloaded but otherwise well worth grabbing.

<comment><USER2> There's also a Mac OS X port out there: <http://blogs.gnome.org/pbor/2008/12/28/gedit-on-osx/>

The major cross-platform toolkits are getting better and better all the time and have come on leaps and bounds in terms of providing a native look and feel.</comment></comment>


Redstone2Phone:  Send an SMS Text from inside Minecraft.  Built with Lisp - <AUTHOR> https://boomtree.com/r2p

<comment><USER2> Is there source available somewhere? What is the Lisp component? Clojure?

<comment><AUTHOR> It's a bit of a red herring... The boomtree server is written in Lisp, but it implements a new language called bdf that the R2P app (and the whole server) are built in. All of the bdf code is viewable at the site. To see the source for the Redstone2Phone page, see: [https://boomtree.com/r2p/Sandbox?post_target=Stamps&view_mod...](https://boomtree.com/r2p/Sandbox?post_target=Stamps&view_mode=Branch)

The editor you see there is also bdf, also viewable and editable at the site.</comment></comment>


Hard Questions: Russian Ads Delivered to Congress - <AUTHOR> https://newsroom.fb.com/news/2017/10/hard-questions-russian-ads-delivered-to-congress/ <comment><USER2> '56% [of the ads] were [shown] after the election.'

'Roughly 25% of the ads were never shown to anyone.'

So Facebook (Elliot Schrage, Vice President of Policy and Communications) now argues their ad system is not very effective anyway ?! 'Never shown' is not what a client wants to hear...

</comment><comment><USER3> Techmeme summary: _About 10M people saw Russian ads on Facebook, 44% of ads were seen before Nov. 8, 50% of ads were for $3 or less; for 99% of the ads, less than $1,000 was spent_</comment>


Paint that becomes conductive when it dries - <AUTHOR> http://www.theguardian.com/technology/2014/apr/27/electric-paint-bare-conductive-paintable-wire

<comment><USER2> Just waiting for the first fool to connect live mains onto a wall... or one of those high-voltage electric cow fence supplies.

Or, more of an art form: connect a 10 kV source to a conductive wall , where the two painted lines diverge from each other. In theory, the arc should move upwards, just like in school.</comment>


Android Backdoor GhostCtrl Can Silently Record Your Audio, Video, and More - <AUTHOR> https://blog.trendmicro.com/trendlabs-security-intelligence/android-backdoor-ghostctrl-can-silently-record-your-audio-video-and-more/ <comment><USER2> Why is this being called a backdoor? Is there any indication that that's what it is? Except for the headline, the only claim even remotely as serious made in the article is that it can root some devices, and figuring out which ones is left as an exercise for the reader...

<comment><USER3> C&C servers, evasion techniques like masquerading as system package, bootstrapping the encrypted payload malware with a wrapper APK, ransomware features, piles of exfiltrated informaiton, intercepting calls and text messages, ransomware functionality... it's like a crook with a record the size of a phonebook.

<comment><USER4> But, unless I somehow missed a big point, doesn't it start with the user installing a malicious package?

<comment><USER3> Not knowingly. Sounds like there is a phony app as a phishing style infection vector:

"The malware masquerades as a legitimate or popular app that uses the names App, MMS, whatsapp, and even Pokemon GO. When the app is launched, it base64-decodes a string from the resource file and writes it down, which is actually the malicious Android Application Package (APK)."

The user has a legitimate expectation that the app sandbox containment provided by the OS works and nothing bad should happen if s/he tries out the aforementioned apps.

This type of malware are commonly called backdoors, see eg. [http://www.virusradar.com/en/glossary/backdoor](http://www.virusradar.com/en/glossary/backdoor)

<comment><USER5> That link says right at the top, "The difference between this type of malware and a legitimate application with similar functionality is that the installation is done without the user's knowledge."

I agree with @debatem1, this is not what "backdoor" commonly means, phishing does not count as "without the user's knowledge". Phishing is a _trick_ to get in the front door.

<comment><USER3> I'm not sure if you're serious, but in this case the user obviously was not intending to install a "legitimate application with similar functionality".

The user wanted to install a WhatsApp, Pokemon, etc type of application but was phished or otherwise deceived into completing the app installation interaction, and was left with no knowledge about the backdoor.

<comment><USER5> Right, you are correct, the user didn't want it. But the user's intent is not the line that distinguishes between phishing and a back door. Yes I'm serious. Phishing is a way to get people to do things they don't intend to do. Phishing involves a user interaction that is masquerading as legitimate, but is in fact malicious against the user's intent. Both phishing and back door attacks are always attempting to do something unwanted, and always intending to do it without the user knowing what's really happening. But the language "without the user's knowledge" referring to back doors means without _any_ user interaction.

I'm sure there are gray areas and situations where it's hard to distinguish, but a backdoor is most commonly defined as not involving any user interaction. A phishing attack involves user interaction. The phishing attack can be used to install a backdoor for future attacks, but that's not what happened here. This phishing attack asked the user for permission to do the things it wants to do. That's the front door.

It's a guy pretending to be the mailman ringing the doorbell and asking if he can come in, then stealing stuff while he's there. The backdoor is a thief in a mask sneaking in a slightly open window at night when nobody's home. The difference is the fake mailman asked for permission. Even though he was fake. It wasn't my intent to let a thief in the house, it was my intent to let the mailman in, but I still got robbed.

Make sense now?

This distinction is important because there are things you can do to avoid phishing, as there are in this case, but there is nothing you can do to avoid a real back door, because it happens without any signaling at all, it happens without your knowledge. So back to @debatem1's point, this should have been called a sophisticated phishing attack, rather than being called, inaccurately, a back door attack.

<comment><USER3> Backdoor is a type of persistent malware. Phishing is a way to infect a device with malware, be it a backdoor or ransomware or whatever.

There is always some infection vector associated with a backdoor.

<comment><USER5> Yes, right, that's correct. The infection vector itself is precisely what is known as the "back door". That's the point. Back doors _are_ the vector, whereas with phishing the user is the vector.

The definition of a backdoor is an attack that bypasses security and doesn't require user input. The definition of phishing is an attack that requires user input, by tricking the user into using their own credentials to authorize access.

Back doors can be opened intentionally or unintentionally by whoever designed or setup the system, but they allow an attacker to get in without involving any input or action from a legitimate user of the system.

Phishing is a way to infect a device with malware by tricking the user into installing the malware. That's exactly what happened here. GhostCtrl is malware that infects via phishing, because it requires the user to authorize it, and it does not have an attack vector it can use without the user's authorization.

It sounds like we're all straightened out and in agreement?

<comment><USER3> No, the infection vector, eg phishing or browser exploit or trojan or whatever, is what enables a back door to be installed. The back door is not an infection vector, it is the payload.

Yes, there is a type of back door that is factory installed as part of the dev process of an otherwise legitimate product. But in the context of malware, the backdoor is a payload that enables malicious remote access. Like the glossary entry I linked explains.

<comment><USER5> Yes it is possible to install a back door, _after_ you've gained access. I'm fine with calling GhostCtrl a phishing attack that installs a back door. The big question here is which part of the attack elevates access to user or root level?

The miscommunication here between us is that you're looking at what GhostCtrl does _after_ it already gained access. Because the first point of contact, the initial entry point, is using the security systems as they were designed to be used, and tricking the user into granting access to the malicious software, the attack as a whole is a phishing attack. As I understand it, the payload is not by itself elevating access, it is using access the user granted to do bad things, not achieving a higher access level.

The payload of an attack of any sort is not commonly understood to be the "back door", I think you're slightly off the mark there. You're not wrong, but you're going to have trouble talking to other people if you keep insisting on this, because the common understanding of a back door is that it's a way of getting in, by bypassing security. It's normally defined as a way of initiating an attack, not the malicious result of an already complete attack.

The only way to define a back door as you have is to have another attack in front of it. If the back door is the payload, then you have to deliver and execute the payload somehow. In the case of GhostCtrl, that mechanism is phishing.

<comment><USER3> If you scroll back, this started with "Why is this being called a backdoor? Is there any indication that that's what it is?". I linked to a glossary entry I think reflects the common usage in malware context.

Any payload is not a back door, payloads can be also ransomware, ddos bots, etc.

<comment><USER5> Okay, I think we're agreeing on the definition. You do agree that this particular backdoor depends on a successful phishing attack, right?

FWIW, I don't think that glossary entry you linked is very good. It calls a backdoor an application, but a backdoor is not always an application -- which I think you already know & mentioned in this thread. A RAT (remote access tool) is definitely not synonymous with backdoor in the common understanding. A backdoor can also be an open port, a bad password, or a variety of other entry methods. Wikipedia's entry on backdoor is better than the one you linked. [https://en.m.wikipedia.org/wiki/Backdoor_(computing)](https://en.m.wikipedia.org/wiki/Backdoor_\(computing\))

If a backdoor were always an application, and that was the common definition, then I think the question above wouldn't have been asked. One problem is that backdoor sometimes implies a vulnerability exists before any malware is installed. To call something a backdoor can send the wrong message about what someone concerned about this should do to mitigate the risks. Knowing it's a phishing attack is pretty important because it means you can and should be suspicious of apps asking for credentials and permissions. If you think it's primarily a back door, you might wrongly assume that you need to update a security patch, or that there's nothing you can do to reduce your risks.

This is why I believe @debatem1's question is reasonable and agree with it - to title this a backdoor is technically true, but it seems misleading.

<comment><USER3> I think this is going around in circles: we already covered the backdoor term in malware vs product name in contexts, and the payload vs phishing thing. If you Google for backdoor payloads, you see that it is common usage.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> > The malware masquerades as a legitimate or popular app that uses the names > App, MMS, whatsapp, and even Pokemon GO.

OK, so the attack vector here is installing dodgy stuff off the Play store? Or not the play store but from another source, such as an ad?

<comment><USER7> I believe it's only from 'third party' app stores..The official Google Play store already scans applications for such malicious content.

<comment><USER8> Even random apks are analyzed by the same service that is used by the play store.

It is still more dangerous, but known signatures are detected.

</comment></comment></comment><comment><USER9> Title is misleading, it makes it sound like the backdoor is in the Android software while this is just malware.

<comment><USER10> The point is that android makes it possible. You don't have these things on iOS because apple doesn't allow them, where google does.

<comment><USER11> Any platform which allows users to install arbitrary software of their own choosing "allows" this. GNU/Linux for example, also allows this. As do Mac, Windows, and jailbroken iOS.

<comment><USER10> This is the choice everyone makes: safety in a walled garden, or freedom outside of it. For my phone I much prefer the safety trade-off, so I would never choose android, but for my work laptop I wouldn't want to be locked down in a similar way.

</comment></comment></comment></comment><comment><USER12> Cool... can I use it to have a decent app to record a phone call? All other existing solutions require you to turn on speaker phone.

<comment><USER13> IDK how NLL's ACR works, but Android API doesn't expose audio output devices because it could lead to piracy issues, such as recording whatever is playing on Spotify. I don't think there's a way to bypass that, and if there were it would probably be banned from Google Play Store.

</comment></comment><comment><USER14> What's so special about this one compared to the other well-known trojans (like omnirat, the RAT this one is based on)?

<comment><USER15> It literally is Omnirat. From the article:

>GhostCtrl is also actually a variant (or at least based on) of the commercially sold, multiplatform OmniRAT that made headlines in November 2015.

</comment></comment><comment><USER16> So is the experience:

"Hacked Up Pokemon Go needs thse permissions" (all of them) (deny, allow), user has been trained that if they deny a permission the app won't work so they click allow?

<comment><USER17> I would assume it simply doesn't use the Android 6 permission system, so the user gets no option to deny.

</comment></comment><comment><USER18> (How) does this bypass the permissions system?

<comment><USER19> It was (still is?) a common practice to grant _all_ permissions when installing an app from Google Play. Most people don't even look at the "annoying" popup that lists permissions to be granted and just press "accept" without ever reading it.

<comment><USER17> Well it's not like there's any option to deny them. You can only not install the app, unless the app chooses to build for the Android 6 permission system.

<comment><USER19> _" You can only not install the app"_

That's what I actually do. I refuse to install apps that require broad permissions not related to their primary purpose. Though I do realize that I belong to that insignificant minority group of users.

<comment><USER17> Unfortunately, that would make my phone basically pointless. I wouldn't install damn near anything.

</comment></comment></comment></comment></comment><comment><USER20> all I see is dwarf fortress

</comment><comment><USER21> Observation: I suppose it's some kind of meme in this industry that in this kind of posts they take screenshots from MS-DOS editors opening the malware.

<comment><USER22> Just like young men sneaking around and wearing black face masks in stories about "hacking"

<comment><USER23> You mean this guy [https://www.troyhunt.com/is-this-hooded-cyber-bandit-the- web...](https://www.troyhunt.com/is-this-hooded-cyber-bandit-the-webs-most- prolific-hacker) ?

<comment><USER22> I was think worse, like this:

[http://cdn.wccftech.com/wp-content/uploads/2017/03/icloud- sc...](http://cdn.wccftech.com/wp-content/uploads/2017/03/icloud-scam.jpg)

[http://www.jordantimes.com/sites/default/files/styles/news_i...](http://www.jordantimes.com/sites/default/files/styles/news_inner/public/hacking.jpg?itok=4CuL2dZf)

etc

Usually show men in black clothes trying to climb in windows, etc.

<comment><USER24> I'm not sure what's most offensive between the paper mask and the URL using backslashes.

<comment><USER22> I really like "your.bank"

I wonder how many people would believe that works.

<comment><USER25> With current new global TLDs? Why not?

<comment><USER21> [https://your.bank](https://your.bank)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> Trend micro pipes all your HTTP data through their proxies. Avoid this company at all costs so that they can become bankrupt.</comment>


The USPTO Would Like to Partner with the Software Community - <AUTHOR> http://www.groklaw.net/article.php?story=20130104012214868 <comment><USER2> There are (at least) three valid perspectives on the patent situation within the software community but part of the reason so little constructive progress is made is that many people with strong opinions will often flat-out deny or reject the validity of the other perspectives because it is outside their experience.

Three perspectives of which most people ignore one or more:

\- Computer technology is over-run with frivolous, vague, stupid, conflicting, and contradictory patents. Any pretense of quality control by the USPTO was lost in the 1990s. This imposes a non-trivial cost on the entire ecosystem and a complete absence of quality control is arguably worse than no patents at all.

\- R&D into new computer algorithms is a non-trivial investment, frequently requiring years and millions of dollars. There is a tendency among programmers to discount the level of effort required to develop a new computer algorithm that materially extends the state-of-the-art even though most could not develop such algorithms themselves and have never been involved in such R&D. Organizations that make this investment do so looking for a return.

\- Academia is already facing difficulties in computer science because much of the state-of-the-art research is being done by private companies. Much of this research is being treated as trade secrets because (ironically) patents offer flimsy practical protection. As a consequence, there are a number of areas in computer science where the leading academic papers are literally a good half decade behind the state-of-the-art that is buried in NDAs. Lack of publication means that a lot of smart people are wasting time duplicating work. Patents were originally invented precisely to avoid this outcome. One of the reasons that I stopped reading academic computer science in some areas that interest me is that I see computer science under NDA that is much more sophisticated, which is a shame.

Any practical policy will need to take into consideration all of these perspectives. It is not as convenient and simple as "all software patents are evil!" or "software patents FTW!" but it more closely reflects the real tradeoffs.

<comment><USER3> >Academia is already facing difficulties in computer science because much of the state-of-the-art research is being done by private companies...As a consequence, there are a number of areas in computer science where the leading academic papers are literally a good half decade behind the state-of-the-art that is buried in NDAs.

Can you elaborate on which areas of CS academia you think are more sophisticated in the corporate wilds? Other than systems work at Google, I haven't encountered any subtopics which aren't dominated by ideas from traditional research centers (either university labs or academic research units at MSR, IBM, etc...)

<comment><USER4> Databases. Oracle, Microsoft, etc. have figured out a lot about how to make high-performance query execution engines and transactional storage systems and written about very little of it.

Research has caught up some, but it definitely lags.

<comment><USER5> I am sure they have a lot of tiny performance improvements. But since when is CS research about tiny performance improvements?

It's not like Oracle or anyone else has any secret algorithm which runs in linear time when all of academia only knows of exponential time solutions for the same class of problems.

<comment><USER6> If "CS research" includes "Software Engineering" then yes, query plan optimisers are definitely currently researched.

</comment></comment></comment></comment></comment><comment><USER7> "The idea that I can be presented with a problem, set out to logically solve it with the tools at hand, and wind up with a program that could not be legally used because someone else followed the same logical steps some years ago and filed for a patent on it is horrifying." -- John Carmack

<comment><USER8> That's one possible narrative. Another would be:

The idea that I can be presented with a problem, hire a dozen experts and spend millions of dollars coming up with a solution to the problem, and have someone come along and just copy the solution and use it in their own product to compete with me is horrifying.

<comment><USER9> Can you give me an example of how this would happen? If google spent millions solving a problem how would I copy the solution and integrate it into my product, considering I will never see google's codebase?

Genuinely asking, a real world situation would be cool. It seems like this would happen most when ex-employees try to compete with the large company.

<comment><USER8> The fact that it's difficult to reverse-engineer Google's technology is an accident of the kind of products it makes: web services. You can access the product while the "secret sauce" remains safely tucked away in a data center.

At the opposite end of the spectrum think of a company like Intel investing into WiMAX. Developing that standard was not cheap, but almost by definition it was something that required disclosure of the end result. Intel can try to recoup the initial investment by selling chips implementing the standard, but competitors can always undercut them on price because they didn't have to spend any money coming up with the initial design.

There is a lot of technology that's much easier to reverse engineer than it is to develop. Especially with software, where it's often very easy to dig out a copy of the firmware from a competing product and decompile it.

You might think this kind of stuff doesn't actually happen, but in the 1990's American companies hated working with the Chinese precisely for this reason. They'd take an American product and copy it right down to the silk screening on the PCB's, and sell the result for cut-rate prices.

<comment><USER10> _You might think this kind of stuff doesn't actually happen, but in the 1990's American companies hated working with the Chinese precisely for this reason. They'd take an American product and copy it right down to the silk screening on the PCB's, and sell the result for cut-rate prices._

And the world is arguably a better place now that the Chinese can make super- cheap parts and clones of American designs and sell them to people who couldn't afford them otherwise.

</comment></comment></comment></comment></comment><comment><USER8> Groklaw's editorializing has gone way downhill since the SCO days. E.g.

"I know the USPTO doesn't want to hear that software and patents totally need to get a divorce, but since most software developers believe that, maybe somebody should at least mention it to them, if only as a future topic for discussion. Most developers I know believe software is unpatentable subject matter."

Ask software developers who work in defense, aerospace, medical devices, telecommunications, video/audio processing, and other capital-intensive, R&D-intensive fields. I think you'll get a rather different answer. Indeed, as Google is finding out with the Motorola acquisition and the resulting patent situation, software engineering culture is far from uniform on this issue. The guys who write software that implements radio waveforms don't have the same views on patents as the guys who write software to optimize ad display, or for that matter the guys who write the search engines. Ironically, Google's PageRank is the subject of several patents, and Stanford's interest in the IP netted them $335 million in Google shares when they exclusively licensed it back to Google.

Although, I think this sort of round-table is a pretty good forum for figuring out more about the consensus view of software engineers...

<comment><USER11> _Ask software developers who work in defense, aerospace, medical devices, telecommunications, video/audio processing, and other capital-intensive, R &D-intensive fields._

I've worked in several of those fields, and I have yet to meet these proponents of software patents you're talking about. Any advantage to having a patent on the results of your own R&D seems to be far outweighed by the persistent threat of being sued (with or without any actual merit) by someone else who claims you're infringing on the results of their R&D.

If something was useful enough and available enough for multiple parties to invent/discover/exploit it independently, it should be self-evident that patents are not a necessary incentive for that work to take place and can only be a barrier to further innovation for all-but-one of the inventing/discovering parties. This effect is magnified many times over if the patent is not for a specific piece of software but rather for something like a data format or communications mechanism. There is a reason you can't copyright the shape of a font in the US, and I think analogous arguments apply in these cases.

Fortunately, this is less of a problem for us here in the UK where the culture is not as litigious as in the US. Still, if nothing else, the repeated attempts by the US to export its onerous IP regime are a worry for small businesses here that using technologies potentially affected by software patents granted in other jurisdictions. The whole system is just one big barrier to competition for smaller organisations who can't play political/legal games to negate the whole technical issue as the big players do.

<comment><USER8> > If something was useful enough and available enough for multiple parties to > invent/discover/exploit it independently

What makes you think the technologies in question are invented independently? Take the Motorola Mobility patents, for example. Most of the patent licensees aren't in a position to hire all the experts and do all the R&D it took Motorola to develop that technology. They just use the end result of all that R&D produced by Motorola. If there was no patent system, they would just use the end result without compensating Motorola for all the work of developing the technology.

<comment><USER11> _What makes you think the technologies in question are invented independently?_

What makes you think they aren't? That's the problem with a lot of software patents: people _can_ just run into them (or be accused of running into them and subject to the resulting legal proceedings) without even knowing they were there. Then, suddenly, possibly after years of their own R&D, they get hit with paying royalties on something that had _nothing_ to do with their own development work.

 _If there was no patent system, they would just use the end result without compensating Motorola for all the work of developing the technology._

Perhaps, but if they're really only trying to make carbon copies of what Motorola were doing, then Motorola have a huge first mover advantage anyway. Specifically, they have as long as it takes to commercialise their R&D work before they have to disclose it, because the work is a protected trade secret like any other up to that point. So as long as they keep innovating in significant ways that others couldn't, they will remain years ahead of their competitors in the market. That seems like a natural and compelling commercial incentive to me, without any need to add artificial benefits via patents.

</comment></comment></comment></comment><comment><USER12> A large problem with software patents is that feature definition and implementation have been rolled into one. Patents were designed to protect implementation - that is, you can't patent having an engine in the car, but you can patent a specific design (implementation) of an engine. In the software world I feel like that distinction has been blurred.

Even if we assume that software is patentable, the bounce back effect should not be patentable. The reason is that all the novelty is in coming up with the feature itself. I don't know whether I could come up with the bounce back effect by myself. I know for a fact that I could implement it, and so could any sufficiently strong software engineer. There is no novelty in the _implementation_ that is worthy of patent protection.

This is trade dress all over again hiding under a different name. It should be given a different status (just like business patents), and different time frames of protection. This way we still protect truly novel research in algorithms (pagerank for example), while eliminating 95% of the patents we as software engineers find so objectionable.

<comment><USER13> _The reason is that all the novelty is in coming up with the feature itself._

This is a very good point. Often times knowing the feature you need to implement is the really hard thing. Once you've decided on that, it's trivial to implement, even if you're the first to do it.

</comment></comment><comment><USER14> I'm a software developer by trade, and here is my opinion: Software should be treated as language, and thus not be patentable.

<comment><USER15> This a thousand times. It totally makes sense that you should be able to copyright code. If someone uses your exact code without permission, you can ask them to pay you.

But deciding which ideas are non-obvious is clearly something the USPTO isn't capable of, and so they should just get out of it.

</comment></comment><comment><USER16> When I was younger and far more innocent I would do things because of the sheer love of doing, learning and discovery. I'd spend hours, no, days, wiring chips together, writing code, testing, soldering, dreaming, inventing. In college I even published a paper on some work I did in robotics when pushed my my prof's to publish. It was great. I'd like to think I "invented" a few things in the process too.

Then I was "born" into the real world: One where companies who do nothing (and some who do something) have patents for stuff I had been doing for ages. You know, stuff like using pulse-width-modulation to control LED intensity (ye'old Color Kinetics), clicking buttons (multiple companies) or putting a spring in series with a microprocessor-controlled motor to control force (MIT, series- elastic actuator).

That's when I realized that what I had been "sold" about engineering, entrepreneurship and research and invention was a huge pile of bullshit. The realization was that government incompetence in perhaps one of the most important human fields of endeavor --invention-- has all but ruined what I loved to do before this epiphany.

Now you had to study Sun Tzu. Now, without your own bullshit patent to act as a shield, you had live in fear of being sued for daring to make a screen area clickable or drag-able, attach a spring to a motor, dim an LED with PWM or the myriad of "obvious to someone skilled in the art" things that are patented. Or you had to hire lawyers to ride shotgun on everything you might want embark on.

The alternative is what most of us actually have to do: We use the tools we know and what we learned to create things and explore ideas. Unless you operate at Google/Apple/Samsung scale you have no choice but to stick your head in the sand and hope that someone doesn't come after you because you app sends an email (or whatever).

I don't know what the solution might be. I have done my share of heavy-duty hardware-intensive R&D spanning years. I get it. Sometimes the difference between something flying and not is found in a seemingly minor detail. The wheel was obvious to the second guy who so it, right?

At the same time, I think it is beyond-obvious to most in tech that the US Patent Office has done a dismal job of filtering that which is "obvious to someone skilled in the art" from true invention. I am not going to draw the demarcation line myself, the subject is too complex and each discipline has it's own boundaries.

That said, if you have ever invested any time in the process of patent search I would be surprised if you did not share my sentiment: the vast majority of patents I have seen should never have been issued.

I fully expect lawyer types to say something akin to: "You have to read the claims carefully. The differences can be subtle but important". I've heard this before. My answer has always been the same: As an engineer I don't have to dive into intricate lawyer-ese to know bullshit when I see it. A spring attached to a motor to control force, you know, "F=kx", is way beyond obvious to anyone who took first-semester Physics. Yet, you lawyers manage to craft convoluted language that takes "F=kx" in the form of a motor and a spring and turns it into a patent that I now have to worry about if I do robotics (which I have done in the past).

Perhaps one of the problems is that the USPTO (I can't speak for other countries) is like a self-feeding fire: The more patents they approve the more people and companies have to file protection patents, which brings in more and more money to support more and more bureaucrats. Every patent you approve is a patent that has "job security" written all over it. If, starting on Monday, they approved patents at a rate of 10% of what they did last year they would probably have to fire 75% of their staff (just guessing).

Maybe the way to fight nonsense patents isn't to make an intellectual claim at all. Maybe the only way is to act politically in order to funnel, say, 50% of USPTO revenue to the Department of Health, or Education or completely outside of government entities. The USPTO would cease to be a self-feeding fire and they might just be forced to only pass real patents.

What if there was a rule that everyone involved in a patent that is invalidated is fired and they loose their pension? Violent, yes, but it would sure raise the bar very, very quickly to a super-high level. Which is exactly where the bar should be.

The other aspect of this is that perhaps patents should cost a lot more money and be subject to a significantly more public process where prior art is defined far more liberally than it is today. If a patent application costs started at the lesser of a million dollars or some percentage of last year's revenue the bullshit patents would go away. In the case of organizations like Google/Apple/Samsung it might cost them ten million dollars to apply for one patent and dozens of millions of dollars to actually get one patent. If a patent costs fifty million dollars I suspect we are not going to see many "slide the button this way" patents filed. Yes, this is off-the-hip and not well thought out. I get it. Take it as more of a random though out of frustration than a coherent idea.

Sometimes you just want to cry when you learn about some of the consequences of the government-sponsored monopolies created through the USPTO. Here's a particularly touching example:

[http://www.electronista.com/articles/12/06/14/speech.applica...](http://www.electronista.com/articles/12/06/14/speech.application.removed.by.apple.pending.outcome.of.hearings/)

The teachers at my kid's school asked me if would collaborate with them to help create (free) iPad apps for their developmentally-challenged students. Of course, I will, but the above bullshit patent and the many more that must exist in the dark files at the USPTO sometimes jar your reality. It is a sad note that rather than sit down and start writing code one of the first things I have to do is a patent search.

Sometimes I wish things were like when I was younger and more innocent: I could choose to help someone with my knowledge of technology and we'd all benefit from what might result (commercial or not). That, sometimes, is a tough choice to make today.

<comment><USER17> If the price of patent filing was to increase it would increase the barrier for people that don't have a lot of money. Filing in the US starts at $390. <http://www.uspto.gov/web/offices/ac/qs/ope/fee100512.htm>. I picture a person without a job and lots of time on their hands coming up with something truly unique and amazing, only to be met with an even larger barrier to entry to make sure some big company can't rip off the idea and go to product with their budget. People already face daunting forms, making the process harder only negatively effects poor people that can't afford a team of lawyers and paralegals.

Other than that I found your points on how the current system doesn't incentivize creation but dissuades it instead good, I can say I've been put off from a few of my ideas because I find a patent that's a bit too close and I really don't want to have to face that. Maybe one day when I have billions I can be a renegade, not yet though.

<comment><USER18> Okay, how about the lesser of 10% of the patent owner's monthly income or $10,000 to file? From there, it would be another $10K for the first 5 years, and $50K for 3 5-year extensions? Then the filing can be modest.. and upon approval, will be about the same to cover 5 years, and have to re-up at a higher cost.. assuming the patent is actually worth keeping active by then.

</comment></comment></comment><comment><USER19> I'm disappointed by the number of software patent apologists on this thread. The effort or the cost required to accomplish something in software is not a good argument for being granted a government monopoly on your type of solution. Code itself can be copyrighted and does not have to be shared. Novelists spend years on novels, have their exact words copyrighted, but don't expect to be granted "patents" on the ability to tell certain types of stories. We need to free programming from these illegitimate shackles. We programmers deserve to have the same freedoms as writers when we sit down to tell our stories in code.

</comment><comment><USER20> Disappointing that the first topic is writing style, not whether an invention would be trivially recreated by anyone who might need it and so shouldn't be claimed.

</comment><comment><USER21> Here is the notice on Federal Register.

[https://www.federalregister.gov/articles/2013/01/03/2012-315...](https://www.federalregister.gov/articles/2013/01/03/2012-31594/request- for-comments-and-notice-of-roundtable-events-for-partnership-for-enhancement- of-quality-of)

USPTO should go abolish itself, for the benefit of mankind.

</comment><comment><USER7> Software patents are here to stay. Don't fight a battle you can't win, the Patent Office is not going to throw away the billions of dollars they make on this... But you can make it so they get to keep their revenues, but we get to add rules that help invalidate patents, or limits how much the troll gets.

<comment><USER22> I disagree. If we can reclaim that algorithms are mathematical and therefore unpatentable we can regain our ability to actually innovate without fear.

<comment><USER23> How would you propose we do that? Write mathematical equivalents that are equal to patented algorithms then claim we didn't infringe on a patent but instead implemented the mathematical formula we wrote?

</comment></comment></comment><comment><USER24> Santa Clara held a conference on potential solutions to the software patent problems a few months ago. The proposals ranged from abolishing "computational idea patents" (Stallman says even calling them software patents is flawed) to fee-shifting. It's pretty interesting if you have a few hours to spare.

The video feed is here: [http://ammsweb.scu.edu/webcasts/mmedia1/20111014-083613-1e_o...](http://ammsweb.scu.edu/webcasts/mmedia1/20111014-083613-1e_opening/index.htm#)

Wired op-ed series based on the conference presenters: [http://www.reddit.com/r/IAmA/comments/14cb0c/im_snoop_lion_a...](http://www.reddit.com/r/IAmA/comments/14cb0c/im_snoop_lion_ask_me_anything/)

</comment><comment><USER25> If you would like to attend one of these meetings and make a point while making everybody laugh, I suggest telling a fictitious story about the time you wanted to learn how to implement a software technology by looking up an expired patent on it.

The fact that this idea is a literal joke should be quite revealing. Patents are supposed to be comprehensible. They're supposed to be the alternative of trade secrets. They're supposed to be a means by which the public learns how to do non-obvious things once they expire.

</comment><comment><USER18> Personally if the implementation is simple given the task, and the idea is obvious, or combines two existing concepts in an obvious way... it shouldn't be patentable... Anything that is a virtual representation of something real, in terms of software is an obvious idea, and shouldn't be patentable. In fact, for the most part, I can't really think of anything in terms of software, that doesn't have corresponding unique hardware for the past 20 years that is worthy of a patent.

</comment><comment><USER26> I'd be interested in seeing software patents come with source code and unit tests. The tests, in particular, would help delimit the breadth of the claims which seems to be what the USPTO feels it needs help with. Once they have executable unit tests, it seems like it would be possible to automate the search for prior art.

</comment><comment><USER27> Unfortunately, I suspect they will not get nearly a proportionate amount of input saying 'software patents delenda est', because the people who feel that way also know that the USPTO is not likely to take their input seriously.

<comment><USER28> we have a chance to find out.

</comment></comment><comment><USER29> The fox once wanted to partner with hen, so it went to the farm.

</comment><comment><USER30> "The first topic relates to how to improve clarity of claim boundaries that define the scope of patent protection for claims that use functional language."

Or to put it another way, the patent database is a _broken datastructure_ , how do we fix it?

I think it's important to take their question seriously, because if we give them serious answers it will bring home why the patent system is more broken for software than for other things.

The problem with boundaries is that in ordinary property, the incentives are to make boundaries precise. Each property owner may not mind if it's not obverious that the other guy's property is on the other side, but he wants to be sure all of _his_ property is on his side. This doesn't work in patents. The pushback comes from overstretched bureaucrats, not other property owners. So, an interesting question is, is there a way of changing this so each patent filer has the incentive to police the boundaries of other patents?

Imagine that at a given point in time, the patent database included not just the individual patents, but a '20 questions' style index, whereby any patent could be located. Crucially, no patent could be enforced against anything outside the 'bucket' in which it is indexed. (A patent could be indexed in more than one bucket, but only by paying the fee for each.)

That would give patent owners the incentive to police the boundaries of the 'buckets', and it would allow people to more easily find patents they might be infringing. It would also make clear which areas of patentable material have endemic fuzzy boundaries, so a case could be made for reform. There are large areas where the questions would be things like 'does it contain an aldehyde group?' where a tree would work well.

There is a problem with this as a datastructure, though. Any binary tree has to be rebalanced for searching it to be efficient. Even assuming that everyone can be given the incentive to make the rebalancing happen, it's not obvious how to do this. I need a diagram, I'll use this one: [http://upload.wikimedia.org/wikipedia/commons/thumb/4/43/Bin...](http://upload.wikimedia.org/wikipedia/commons/thumb/4/43/BinaryTreeRotations.svg/300px- BinaryTreeRotations.svg.png) Suppose we want to do the tree rotation as in the diagram. The problem is, we only know that the the patents descended from 'alpha' have the 'left' answer to the question in the light green node. We don't know how they relate to the question in the darker green node. So after the tree is rotated, we may need to ask that question of all the patents under 'alpha', an O(N) operation (in legal fees!) and then we may need to move some of them under the branch 'gamma', possibly triggering more rebalancing, so it's not obvious that the operation would even terminate.

So, question: Can a suitable datastructure be devised?

<comment><USER31> I like the idea of a binary tree

Would it need to be balanced? It might be better to have to play 100 questions instead of 20 rather than pay O(n) in legal fees multiple times

<comment><USER30> Well, one purpose is that currently it's impossible for a small business to find what patents you might be infringing in the millions that exist. The tree doesn't need to be completely balanced, but if it degenerates to a linked list, the search problem is no better than it is now.

</comment></comment></comment><comment><USER32> I'm sorry but I can't come, because you are not opensource enough for me. It's not you. It's me.

</comment><comment><USER33> Don't sanction the insanity. It would be better that the situation become so dire and painful that the populace wakes up than that software developers actually help make the software patent system appear as if it is reasonable and can "work" in the long run.

<comment><USER28> Well, imagine if patents included source code and were only valid for 5 years or so? Something like that?</comment></comment>


SendPolice API - <AUTHOR> https://developer.sendpolice.com/

<comment><USER2> What do you suppose is the over/under on this becoming a public utility, or just another aspect of running a proper regional 911 system?

</comment><comment><USER3> This will go downhill _fast_ once someone inadvertently loses their API key.

</comment><comment><USER4> If my messages never reach the police because your servers have a meltdown, are you going to be held liable?

This sort of service should be run by the government, not a company that may or may not be here tomorrow.

</comment><comment><USER5> Swatting as a service!

What could go wrong.</comment>


Vulnerable Wi-Fi dildo camera endoscope - <AUTHOR> https://www.pentestpartners.com/blog/vulnerable-wi-fi-dildo-camera-endoscope-yes-really/ <comment><USER2> The really bonkers thing is, its a Wifi access point rather than a client. So unless the user changes the SID to something innocuous, all the neighbors know when someone is using it, and with a bit of triangulation they can work out who (assuming they don't just tune in to the show, of course).

<comment><AUTHOR> I wonder if it broadcasts it?

I can see why it being an AP (or Ad-Hoc) might be useful though in some cases. ie: places with no wifi router. (where you might be feeling a bit frisky.)

The mind boggles.</comment></comment>


Ends, Means, and Antitrust - <AUTHOR> https://daringfireball.net/linked/2017/06/30/thompson-eu-google <comment><USER2> if you create the market than you didn't raise prices.</comment>


OpenSSL Licensing Update - <AUTHOR> https://www.openssl.org/blog/blog/2017/03/20/license/ <comment><AUTHOR> This is a huge win. The incompatibility between OpenSSL and the GPL has been one of the most notable license incompatibilities regularly encountered in practice. With this change, OpenSSL will become compatible with GPLv3, which also makes it compatible with software licensed "version 2 or later". People will no longer need to choose and port to another crypto library for license reasons.

<comment><USER2> Though worth noting that ASLv2 is _not_ compatible with straight GPLv2 (the "or later" part of "version 2 or later" is crucial). This is why some projects dual-license as MIT/ASLv2, because MIT is compatible with GPLv2.

<comment><USER3> LLVM's proposed switch included a provision to make it explicitly compatible with GPLv2. That seems like a nice precedent to follow for other projects that are considering Apache 2 as their license.

<comment><USER2> I'd say that works for LLVM only because Apple can afford lawyers who can argue that provision if it ever came to that (not that I think it ever would). AFAICT, ASLv2 is superior to BSD/MIT in all practical respects except for the GPLv2 compatibility, and if it were so trivially easy to make a version of ASLv2 that didn't have that downside, then I feel like some company would have already done that and instantly created The One Permissive License To Rule Them All ( _and in the eyes of the law,_ bind _them_ ).

Until such an exceptional provision becomes established precedent, I'd suggest that small projects stick to vetted licenses rather than pitching in with anything novel.

<comment><USER4> > AFAICT, ASLv2 is superior to BSD/MIT in all practical respects except for > the GPLv2 compatibility

Not for the companies. Many prefer MIT over ASL precisely because they don't want any sort of patent grants.

<comment><USER5> Why do they prefer to avoid patent grants? It seems unreasonable to me.

<comment><USER6> It is, but it's what they want.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> The Rust replacement for OpenSSL is coming along well.[1] It's available under Apache License version 2.0.. the MIT license, or the ISC license. That should be the future direction.

[1] [https://github.com/ctz/rustls](https://github.com/ctz/rustls)

<comment><USER8> Is rustls actually a replacement though? I can compile existing applications with rustls in stead of OpenSSL without altering the code of those applications?

<comment><USER9> Hopefully not, as one of the major problems with OpenSSL is its convoluted surface API which is easy to misconfigure.

<comment><USER10> Yeah...OpenSSL's difficulties cannot be _really_ fixed unless the the API is allowed to change.

It's a hard slog either way.

</comment></comment></comment></comment><comment><USER11> Wow. Apache 2 has a patent license section that BSD style licenses are missing. At first glance, this looks like this change is being done in bad faith.

Concretely: Contributing to apache 2 software potentially grants universal licenses for relevant patents you hold to anyone that uses the apache 2 software. Courts have not decided how viral this is. (What if I start with apache 2 code, make substantial changes, and apply it in areas the patent holder objects to, for example?)

I'm not a fan of software patents, but sloppy retroactive relicensing like this will create all sorts of legal ambiguity for users and contributors.

(Also, as the openbsd thread points out, apache 2 is license incompatible with existing openssl forks and other downstream software)

<comment><USER12> Bad faith is giving someone else seemingly open code that does something you hold a patent to and then enforcing the patent agsinst the recipient.

The explicit patent language in Apache License 2.0 is a good thing.

<comment><USER13> So what if you hold a patent on an extended version of the algorithm, but release a limited version for free? If someone extends the limited version to include the patented work, does the virality of the licence, and it being a derivative of your work, mean that you have no legal recourse?

Personally I'm against software patents, but as long as they're legal this seems like a backdoor reason you should never release code under Apache if you have patents in a related field.

</comment></comment></comment><comment><USER14> So, the major question getting asked (and theo is trolling about elsewhere) is what happens if you don't respond to the emails.

Having helped out with many relicensing exercises at this point, i'm not sure why people are so worried.

The usual tact taken is: If you cannot affirmatively get consent, you remove the code and, if still needed, have someone not involved rewrite it.

I have yet to see anywhere in all of this that actually says they plan on doing anything different (IE theo's trolling seems to be based not on reality). I looked at the press releases, details, and mailing lists. What am i missing?

<comment><USER15> The email being sent out clearly states:

"If we do not hear from you, we will assume that you have no objection."

<comment><USER16> The email can state all it wants, but from a legal point of view, assuming consent merely by absence of dissent is nonsense -- at least in the jurisdictions I'm familiar with. There are exceptions to this, but this is not one of those cases.

Just assuming that the email has been read is already a far stretch.

<comment><USER17> The process raises my eyebrows, too, but apparently that's how it was done for other projects:

* [https://mailman.videolan.org/pipermail/vlc-commits/2011-Nove...](https://mailman.videolan.org/pipermail/vlc-commits/2011-November/010353.html) (grep for "It is possible")

* [https://dolphin-emu.org/blog/2015/05/25/relicensing-dolphin/...](https://dolphin-emu.org/blog/2015/05/25/relicensing-dolphin/#a-legal-gray-area)

* [https://blogs.fsfe.org/ciaran/?p=58](https://blogs.fsfe.org/ciaran/?p=58) (grep for "it is not necessary")

<comment><USER16> Ah. In those cases, it appears that the overwhelming majority (>= 95%) of developers explicitly agreed to the relicensing, with the remaining minority at least not objecting.

That is still not assent by the remaining 5%, but was apparently sufficient for relicensing of the whole work in the relevant jurisdictions.

In that context, the quote from the OpenSSL email appears to be well-phrased, as it really only assumes the absence of objections.

</comment></comment></comment></comment></comment><comment><USER18> I didn't understand the issue with the original license well, but found Wikipedia's overview: [https://en.m.wikipedia.org/wiki/OpenSSL#Licensing](https://en.m.wikipedia.org/wiki/OpenSSL#Licensing)

</comment><comment><USER19> Seems like OpenSSL should focus on fixing their code instead of risking the alienation of past contributors. I wonder if this is to satisfy some of the big donors who want to fix OpenSSL but won't until the license is changed. I know I'd be pissed if I had contributed and then got an email saying no response implies agreement.

<comment><USER20> I think with any larger scale open source project looking to change license they basically have to assert that no response implies agreement because of the amount of people that have contributed over time and things that this leads to, such as the probability that at least one of them might have died or otherwise have become unreachable since when they contributed.

However they might have instead used some of the donor money to hire someone to do a clean-room re-implementation of the functionality for which they couldn't get the original author's blessing to change the license of. This might have been the more respectful thing to do perhaps.

<comment><USER19> If they don't do it, and just take the code someone else contributed to the project under a different copyright notice and put it under Apache 2.0, does that mean I can fork, say, Firefox or gcc and slap an MIT copyright on the source code if not all of the contributors reply to my email asking them if they agree to it?

If no, then what percentage of contributors need to agree? Or do I need to rewrite all of the code that I get noes for?

<comment><USER2> Anyone with a potential copyright claim on the source can take legal action if they believe that their rights have been violated. If you object to OpenSSL relicensing and have contributed to it, you can sue them if they go through with it. Likewise, if you violate the license of any other software project, that project can sue you. OpenSSL is betting that the vast majority of contributors will agree, and that the rest will either not care or won't sue, and if someone does sue they're hoping that person's contributions are minimal enough that they can be removed from the codebase.

<comment><USER21> The problem is that this can happen at anytime. As a user of OpenSSL, I have no guarantee that a contributor won't, at some point in the future, decide to sue over this. Once that happens, I would have to remove their contributions from _my_ copy [0], or risk being sued. Further, if enough time passes, and there are contributions under the new license, I would have to comply with both licences (which are incompatible).

The core problem here is not that they are changing the license. It is that it is now not clear what license is actually in effect; and it could very possibly end up being both.

The upside to this is that no one enforces these licenses anyway.

[0] Which might be a bigger deal in other contexts, for a security library, I should be staying up to date anyway.

</comment></comment></comment></comment></comment><comment><USER22> Finally! This should mean Debian & Ubuntu can enable SSL in Squid!

EDIT: Dammit, Squid is GPLv2.. It might make the situation worse due to the Patent clause.

So, potentially now.. GPLv2 programmes can't use OpenSSL. Nice.

</comment><comment><USER23> Although I personally think matching the OpenBSD libressl license would have been better, I still have to regard the move towards using one of the mainstream, modern standard open source licenses for such a widely used and critical software component a Good Thing. I do, however, also agree with those voicing skepticism about the "silence gives consent" bit - this is important enough to be worth doing without adding a (very) questionable practice like that to the mix. I'd suggest instead setting up some sort of "relicensing coverage" report, and use the yay/nay/no-answer status of various diffs to figure out a price tag for re-writing the bits that can't be relicensed.

I don't suppose the libressl folks could end up creating a 2-clause BSD implementation of the SSL/TLS stack that could divorce itself completely from its openssl origins? (Yes I know that's almost certainly impractical for such a large, complex and thorny code base and problem set, but it's a nice dream... maybe some cryptography researchers/companies/etc. looking to make a name the the industry could target and re-implement specific pieces/algorithms/etc...)

</comment><comment><USER24> What happens if not everyone responds to the emails?

<comment><USER25> The OpenBSD team is asking that very same question: [https://marc.info/?l=openbsd- tech&m=149028593819547&w=2](https://marc.info/?l=openbsd- tech&m=149028593819547&w=2)

<comment><USER26> Now I can respond on his behalf...

<comment><USER27> Take a look at the code they've attributed to him. I don't think he's overly concerned, not about that anyway. The overreaching attempt at re-licencing others work on the other hand...

<comment><USER26>
      > +  *) Removed old DES API.
      > +     [Rich Salz]

I'm confused. Taking credit for other people's work?</comment></comment></comment></comment></comment>


As net neutrality dies, one man wants to make Verizon pay for its sins - <AUTHOR> https://www.theverge.com/2017/8/9/16114530/net-neutrality-crusade-against-verizon-alex-nguyen-fcc <comment><USER2> The FCC refuses to comment and all Verizon says is: "Mr. Nugyen (sic) is mistaken."

They are buying time because they know that once they repeal the 2015 net neutrality protections, none of their crimes will technically be crimes anymore.

</comment><comment><USER3> People should stop saying that net neutrality died, it didn't die, it just won't be mandatory in the US, companies can still offer plans that respect net neutrality.

</comment><comment><USER4> This guy should have a gofundme page

</comment><comment><USER5> this guy is a hero</comment>


Scientist: Tata dreams of cars running on water - <AUTHOR> http://economictimes.indiatimes.com/news/news-by-industry/auto/automobiles/ratan-tata-dreams-of-cars-running-on-water-scientist/articleshow/7196217.cms

<comment><USER2> Genius! because if their cars do get fire* there's always some water to douse the flames

*<http://indianautosblog.com/2010/11/tata-nano-recall>

</comment><comment><USER3> At the risk of stating the obvious for most readers here -- the energy put into cracking water will always be more than any reaction you would receive from combining the results (hydrogen and oxygen) back.

<comment><USER4> Batteries have the same drawback, however.

<comment><USER5> That's true, but batteries are for _storing_ energy. Separating water into Hydrogen & Oxygen is for _producing_ energy. You'd need to have a battery on board to do it and you might as well use it to run the electric motor since it'd be more efficient.

<comment><USER4> I wouldn't expect anyone thinks it's a good idea to do the separation in the car. You'd do it at a plant somewhere to take advantage of economies of scale.

<comment><USER6> In which case why call them cars that run on water?

</comment></comment></comment></comment></comment><comment><USER7> attention, yet another hho-gas scam!!!

but tata isn't the first one who believed that crap. hho-gas scam has a long history, try googling for hho-gas, rhodes gas, browns gas, free energy, overunity ...

every once and a while somebody with lots of money believe's that crap. (i got interested in this free energy/overunity crap after my father got scamed, i was blown away how many believe that)

this just can't work, see laws of thermodynamics: [http://en.wikipedia.org/wiki/Thermodynamics#Laws_of_thermody...](http://en.wikipedia.org/wiki/Thermodynamics#Laws_of_thermodynamics) german speakers may be interested in that: <http://www.esowatch.com/ge/index.php?title=HHO>

</comment><comment><USER8> I'm confused. Splitting water takes energy. The hydrogen can be supplied to the car and a hydrogen fuel cell recombines it to produce energy.

So surely the cars would be running on hydrogen?

Or else, how does one get energy from water (without fusion)?

</comment><comment><USER9> But what we'd really like is to be driving their cars that run on air.

<comment><USER10> You can get one of those:

<http://www.youtube.com/watch?v=ztFDqcu8oJ4></comment></comment>


Show HN: I've made this API-linked list of 250+ crypto meetups in 60 cities - <AUTHOR> https://www.cryptomeetups.io <comment><USER2> What does API-linked mean?

<comment><AUTHOR> HN didn't allow me to spell it out in the title, i meant to say that i updates the meetup tables with the next meetups through API calls to meetup.com</comment></comment>


Show HN: SleekDB – A document database made using PHP - <AUTHOR> https://sleekdb.github.io/ <comment><USER2> This actually looks pretty useful for PHP devs that don't want to go and setup a full MongoDB application/server/etc.

Have you done any benchmarks on this at all?

Where does it start falling over and taking ages to respond?

Does `query` traverse all the JSONs each time, or do you create some sort of index to check through instead?

<comment><AUTHOR> Hi @aogl,

Yes SleekDB will read every JSON files on each query, but by default it utilizes the built-in cache feature that basically caches the result of a query. Once it caches a query, from the next time it will read only one file for that same query unless we update or write anything new there!</comment></comment>