Oculus Joins Facebook - <AUTHOR> http://www.oculusvr.com/blog/oculus-joins-facebook/ <comment><USER2> Oculus just went from something incredibly amazing that I couldn't wait to be a part of to something that I want nothing to do with. I suspect I'm not alone. Humans are emotional creatures, not always driven by strict rationality. Maybe I'll feel differently in a year.

<comment><USER3> I don't believe for a second you won't buy one. There's always this sort of grousing, and it never matters in the long run.

<comment><USER4> The problem for Facebook is that since there is such a distaste for them in the dev community that they are going to have a hard time attracting developers if a worthy competitor comes along. Devs are going to want to target a more open platform, unless there is a massive advantage to going the Facebook route. On the web, building a Facebook app is enticing because you get access to a massive audience. For VR, your audience are people who have the hardware, so until there is a large number of people who own VR goggles the power really is in the hands of the developers and what platforms they build their killer apps on.

</comment></comment></comment><comment><USER5> Curious to see HN's negative reaction to this announcement. The sentiment appears to originate with gamers.

Gamers, particularly PC gamers, are a minority of computing end users. Minorities get less attention than the mainstream. Oculus VR chose gamers, particularly PC gamers, as its beachhead. The dedicated attention from such a world-changing technology must have been special. The backlash against losing that special status is understandable.

But VR's potential isn't limited to gamers. That is what Facebook recognised and is capitalising on with this acquisition. Oculus, as a (perhaps _the_ ) leader in the consumer VR space, is well positioned to shape the future of VR and with it consumer computing. They had a choice between a niche and the market, and they are reaching for the moon.

The expanded mandate means gamers will become a minority of Oculus's customer base. It does not follow that their experience nor expectations should degrade. Preëmptively burning Facebook and Oculus for thinking big seems petty.

I am open-minded about Oculus's future at Facebook. It is possible that Facebook will mis-manage Oculus and squander its lead. It's also possible that an independent Oculus would have missed the forest for the trees. That by going 100% for gaming, it would have forsaken a greater destiny. Barring back- seat driving by Facebook management, Oculus has more options at Facebook. More options are good for a young company at the beginning of a open-ended road.

<comment><USER6> The negative reaction isn't because of any of that, it's because it's Facebook.

Microsoft, Apple, Google, Valve, hell even Dell would have all been acceptable acquirers for most PC gamers backing the Oculus Rift.

<comment><USER5> What is a specific likely worst-case you have in mind with Facebook?

Risks with other potential acquisition partners:

(1) Valve - limited scope. Valve would be fine if Oculus's future were limited to gaming. But they add little value, in balance sheet or experience, for a broader play. Valve + Oculus is only marginally better positioned, for revolutionising computing, than an independent Oculus.

(2) Microsoft - too conservative. Big organisation without a history of funding moon shots. As for pairing Oculus with Xbox, I'd copy the concerns with Valve.

(3) Dell - underinvestment. Dell is undergoing a private-equity turnaround focussed on optimising operating metrics for an IPO. Not a healthy environment for an open-ended, capital-hungry start-up with an adventurous future.

Apple would have been a fine home for Oculus. I suspect VR's market isn't mature enough for Cupertino. But I do not see a material difference between Google and Facebook. Privacy concerns exist at both, and both have a mixed record of integrating acquisitions. What both have is lots of ambition and the surplus capital and experience with which to fuel it.

<comment><USER7>
      What is is a specific likely worst-case
      you have in mind with Facebook?

That they realise there's no overlap between their products, so they discontinue the VR products and transfer the employees to web ad targeting.

More precisely they make a play for the "VR socialisation" arena but it's a half-hearted attempt because VR socialisation is some manager's pet project rather than their core business, facebook vr socialisation goes the way of Second Life, and the consequence is the same.

<comment><USER5> > *[Facebook] discontinue the VR products and transfer the employees to web ad > targeting"

Oculus has 50 employees [1]. Facebook did not pay $40 million per employee to scrap their product.

Oculus is also a bleeding-edge hardware start-up. It was more likely to drop dead all on its own than at the hands of well-capitalised owner.

[1] [http://www.crunchbase.com/company/oculus- vr](http://www.crunchbase.com/company/oculus-vr)

<comment><USER7>
      Facebook did not pay $400 million per employee
      to scrap their product.

If paying a lot makes acquisitions succeed, maybe facebook should have paid more to make the acquisition even more successful :)

This deal reminds me of ebay buying Skype: Two technology companies, both with reasonable products, but nothing to do with each other.

<comment><USER8> Nothing to do with each other, but eBay made $1.4B on the deal.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> This is a god damned tragedy. (And the smartest move Zuck has ever made.)

VR was supposed to be a new frontier, I have been so excited to see finally the Next Thing was coming and it feels so much like the early days of the web and computing. But now it's owned by the worst company on the planet when it comes to choosing inspired thinking and pushing humanity forward instead of just trying to get inside of our lives (and now our heads.) I am frankly terrified.

Thank God for Valve, I hope they hit the gas and leapfrog these guys now on the tech and poach as many of them as they can. Thank goodness there is still plenty of work left to do and Facebook doesn't own all the VR patents. I am so fucking scared of a world where Facebook has a monopoly on VR. I really hope it doesn't happen.

<comment><USER9> > VR was supposed to be a new frontier, I have been so excited to see finally > the Next Thing was coming and it feels so much like the early days of the > web and computing.

VR has been the Next Thing since before there was a World Wide Web, if not the internet itself. Maybe this time is different, maybe not.

<comment><USER4> this time is different

<comment><USER10> This time is _even more_ different than the last time!

<comment><USER11> This time the technology is mature enough to support the vision, and isn't laughably poor and expensive.

</comment></comment></comment></comment></comment><comment><USER12> This is a good move by Facebook. VR is going to be huge, huge huge. It might even be as big as Bitcoin. :)

I think what Oculus did was massively de-risk their next ten years. In their business plans, there were undoubtedly very large gray circles with things like "gain overwhelming market share (how?)" and lists of competitors that included, well, everyone in tech.

If you had to pick a tech company to leverage your disruptive new consumer technology, and make sure it kept the 'awesome', and was hacker friendly, who would you go to?

In exchange, they probably lopped another 10-50x of potential value off the top of their company. Not that they won't see some of that realized in Facebook if this is succesful -- they will. But, they will be sharing the gain around in exchange for getting access to that giant global customer base and being able to tap the considerable resources available at FB.

<comment><USER13> _> If you had to pick a tech company to leverage your disruptive new consumer technology, and make sure it kept the 'awesome', and was hacker friendly, who would you go to?_

google

<comment><USER14> I expected Microsoft to grab them and I'm surprised they didn't. Would've made a smart fit with Xbox and given them easy ways to directly integrate it with their OSs. Would work well with gaming, education, eventually business, mobile and so on. $2b a few months ago would've been a small price to pay to get in early on this, unless they have something comparable up their sleeves from the research division.

<comment><USER15> Well, Don Mattrick left last year and Marc Whitten's leaving/just left, so I don't really find it surprising.

</comment></comment></comment></comment><comment><USER16> This is extremely disappointing. This technology had the potential to be much bigger than Facebook. The Occulus was poised to create an entirely new industry. They were pioneering a technology never before seen, with a legend like John Carmack pushing the state of the art. I cannot think of a more colossal mistake to make as a founder. Palmer Luckey has shown he has absolutely no faith in his ability nor that of his team. Occulus had nothing but success in their future. They had investors beating down their doors with money, developers announcing support for the platform before even getting a dev-kit, and consumers itching to grab hold of their product.

Facebook is the antithesis to Occulus. They have never created any technology, they add zero value to the the real world, and have no future potential in the long run. Occulus selling to Facebook would have been like Tesla selling to Proctor and Gamble after they released the Roadster. A company with a technology so radical it can change the industry, succumbing to weakness and cashing out to an old money company that has no expertise in the field for some chump change.

I am filled with sadness and disappointment. I believe Palmer Luckey will regret this decision.

</comment><comment><USER17> I don't want a "general-purpose VR headset". There are already many devices described that way (that work well enough for that purpose.) I wanted something built exclusively for the extreme requirements of gaming, and I feel this acquisition is going to distract the Oculus team from that. Facebook has no experience whatsoever in that domain, and the only way I see Oculus benefiting from this is the huge cash reserves they'll have access to once acquired. Truth be told, I was really hoping they'd get acquired by Valve - that'd strengthen their existing partnership (which I'm sure will cease to exist post acquisition), give them a good team to work with wrt. videogames and VR in general, and put them in an environment where their core focus is the same as that of their parent company. In this case, if the "experiment" fails, Facebook will almost certainly dump the project. Every time someone says "... we're going to make X a platform" before they actually have X, a kitten dies somewhere. There are still technical issues with the Oculus headset, and I'm afraid Facebook's "platform" focus is going to draw attention away from that. In short, I don't see this working. If fact, if Oculus fails, it might set the entire VR industry back several years. Luckily, we still have some hope in the form of Valve.

What a waste. I hate Facebook for doing this. And I'm not too happy with Oculus for accepting this either.

<comment><USER18> >I wanted something built exclusively for the extreme requirements of gaming, and I feel this acquisition is going to distract the Oculus team from that. Facebook has no experience whatsoever in that domain

com'n, VR FPV in FarmVille would be an experience to die for :)

<comment><USER17> Wouldn't it be better if we simply started farming IRL then?

Don't even get me started on the silliness that is Farmville - no more than a glorified Skinner box.

</comment></comment></comment><comment><USER19> Facebook is rapidly becoming a seriously dominant technology player. I used to think of them as a "flavour of the year" play, but I'm having to readjust that perspective pretty hard.

It looks like they really are driving a long term strategy of being at the core on human -> human communication.

<comment><USER20> Yeah, I see this as a big move for FB, much bigger than for Oculus.

Someone I know had already identified FB as one of the Big Four several years ago, analogizing to the Big Four during the robber baron days of steel and rail. The other three are Apple, Amazon, and Google.

All four have some sort of machine learning / AI race going on. They are not the only ones around (Twitter, for example).

But this is pretty big. Google has the Glasses project. Apple probably has something cooking somewhere. And I have no idea about Amazon.

I also wonder if FB will keep the team together. It'd be a shame for John Caramak to skip out after the acquisition.

<comment><USER21> I'm (pretty)sure Facebook will leave Oculus alone; it would be dumb if they didn't, especially with all the anti-Facebook sentiment in our current zeitgeit. This is definitely a long term play towards becoming a major technology company. It's interesting to see what Facebook will become when "Facebook the website" is gone.

<comment><USER20> I'm also interested to see if the Second Life team gets shopped around, or if they will still try to stay independent.

</comment></comment></comment></comment><comment><USER22> I was excited about Oculus even though I wasn't necessarily going to buy one. But this acquisition is like Elon Musk announcing that Tesla will build a small 1 litre diesel car next, or SpaceX's next mission is to Detroit.

I mean, I'm sure Facebook has some amazing PHP and Python on their backend servers but has anyone not checked out the awfulness that is Facebook's web site ? UX is not supposed to be a four letter word.

What do Oculus gain from this that they couldn't have obtained with their $2.4m Kickstarter ? I don't believe Facebook won't be monitoring every penny spent there.

Oculus was not our last hope, there is another: [https://www.kickstarter.com/projects/avegantglyph/a-mobile-p...](https://www.kickstarter.com/projects/avegantglyph/a-mobile- personal-theater-with-built-in-premium-au)

</comment><comment><USER23> I wonder does this have anything to do with Sony announcing her own VR project Morpheus. Technology wise Sony's alternative didn't show much advantage, but industry support wise it showed that it's a very very prominent opponent Oculus VR has to beat. Selling it to Facebook seems to me an indication that the leadership no longer believe that Oculus can be as successful in the gaming industry as they hoped.

<comment><USER24> Or, to phrase it differently, maybe they cared most about VR technologies going mainstream, and were only doing it themselves because nobody else seemed to be.

</comment></comment><comment><USER25> I wish they joined valve. Or even Msft for that matter, we'd atleast get integration with xbox.

</comment><comment><USER26> Ouch, no thanks. Talk about dashed hopes and dreams.

</comment><comment><USER27> See main discussion at: [https://news.ycombinator.com/item?id=7469115](https://news.ycombinator.com/item?id=7469115)

</comment><comment><USER28> I can't imagine Carmack working for Facebook. This is surreal. As Palmer noted in his blog post he was skeptical when Facebook first approached them with the idea. I suppose Facebook eventually made a monetary offer they couldn't refuse. Whether Facebook makes it a VR advertising unit or Facebook Glass, it's likely to be something very different from what Oculus envisioned as an independent company.

</comment><comment><USER29> It's rather entertaining to see the difference in comments between the Oculus announcement page and the Facebook page.

</comment><comment><USER30> I can't believe Carmack is thrilled about being part of Facebook. His twitter feed seems a little sparse today...

<comment><USER31> He's too busy talking to Ferrari dealers, hopefully.

<comment><USER32> He was already crazy rich off id, though. He had his own aerospace company that he funded out of his own pocket for several years. He isn't the kind of guy who really needed another break - I always got the impression he left Zenimax for Occulus because he wanted to get back at the front of the tech revolution train after going in the back seat for a decade.

<comment><USER33> Didn't his space company run out of cash? This could help re-fund that.

<comment><USER34> That's right, Carmack said Armadillo Aerospace would "[...] probably stay in hibernation until there's another liquidity event where I'm comfortable throwing another million dollars a year into things." ( [http://www.newspacejournal.com/2013/08/01/carmack- armadillo-...](http://www.newspacejournal.com/2013/08/01/carmack-armadillo- aerospace-in-hibernation-mode/) )

</comment></comment></comment></comment></comment><comment><USER35> For the sake of kicking off a discussion...

"Facebook [...] a company focused on connecting people, investing in internet access for the world and pushing an open computing platform."

Can anyone put facts or numbers to those last two statements? Is Facebook putting any concerted effort beyond PR/vanity projects into those goals?

<comment><USER36> I imagine the investing in internet access for the world is wholly because one way to grow their own user numbers is to get more people connected to the internet - if they can just spend enough money to associate people with that messaging as their advertising budget - then they may start off with a good relationship to those new internet users.

<comment><USER37> At this point the only way to grow their user numbers significantly is to get more people connected to the internet. The question is whether it's something they seriously think they can do or just an attempt to convince Wall Street they have growth potential.

</comment></comment></comment><comment><USER38> > We were in talks about maybe bringing a version of Minecraft to Oculus. I > just cancelled that deal. Facebook creeps me out.

[https://twitter.com/notch/status/448586381565390848](https://twitter.com/notch/status/448586381565390848)

</comment><comment><USER39> I said this on the other thread, but this is the most terrifyingly awesome technology acquisition I've ever seen. Facebook chat in two years: put on a headset and get teleported to a room in a virtual world where you can talk to your friends' avatars. Skype and Google+ Hangouts suddenly seem very 20th century.

I've always found Facebook's stock to be a ridiculously risky long-term investment since their entire growth plan is predicated on monetizing an already established customer base, where a single event that causes people to switch en masse to a more private/secure social network would destroy the company. After today's acquisition I no longer think this.

<comment><USER26> > put on a headset and get teleported to a room in a virtual world where you > can talk to your friends' avatars.

Uhm...No thanks. Second life has already been tried.

Why does this idea keep coming up? It sucks every.single.time.

<comment><USER39> Either you're misunderstanding me or you're equating an anthill with the pyramids of Giza. In Second Life, your avatar is a sprite on a screen. With Oculus Rift + Virtuix Omni, your avatar is _you_. It's like the Matrix. Or Avatar. Or a [lower resolution] lucid dream where you can interact with people from the real world in video game maps. For me, that's truly awesome in the literal sense of the word.

<comment><USER26> No, I understand you exactly. But I'm also paying attention to the last 30 years where this keeps getting tried and either it doesn't work or it degenerates into a 2nd life analog.

There's nothing magical about 2nd life, but in a first person POV and in 3d.

<comment><USER39> Would you find it magical if it were truly immersive 3d where eye movements would scroll and an Omni-like 3D treadmill actually worked?

<comment><USER26> No it's even worse. Now I have to work even harder to have the marginal experience I can have from my desk.

</comment></comment></comment></comment></comment></comment><comment><USER40> I cannot imagine how Carmack is excited about this

<comment><USER41> Maybe he gets enough cash out of it to restart Armadillo.

</comment></comment><comment><USER42> I too am instinctively repelled by this acquisition. I did prefer the idea of the technology remaining independent and supported on multiple platforms.

MS, Apple, Google, Sony all have their own closed(* Android is arguable, I know) devices that they would prefer to limit the technology to. The benefit to Facebook is to have a primary interface perhaps hosted on another platform but not completely dependent on it.

I can think of three obvious negatives:

Carmack's apparently successful work using mobile graphics hardware to generate acceptable output for the Rift could allow a much wider adoption among the casual users who don't have a hardcore gaming PC/latest generation console. Facebook might focus on producing a low-cost version that lacks the resolution/low latency which would be preferable to gamers / professional 3D users. An extensive patent portfolio could inhibit higher-end competitors from easily addressing that market.

The second concern is that Facebook would in political superpower-like ways abuse the power to grant access to a popular VR platform and demand concessions such as mandatory Facebook accounts for gaming, an egregious cut of royalties, banning of anything that "replicates Facebook functionality" etc.

Thirdly, is the probably the most common knee-jerk consumer issue; ultra creepy Facebook, logging and mining everything that you foveate on, from the ad logos in virtual environments to the facial/bodily features of your friends' avatars. They build a more detailed model of your own desires and motivations than you consciously have of yourself.

</comment><comment><USER43> Any chance this deal can be called off? Terrible decision.

</comment><comment><USER44> So the backlash seems to be:

* Because the Oculus guys are seen to have sold out.

* Because Facebook is seen to be a ruthless exploiter of personal information.

I, for one, was actually days away from buying an Oculus device but I'm going to hold off for now. It's a combination of the negativity from here being infectious and the fact that if Facebook decided to buy now, maybe there's something much bigger on the horizon (apart from the DK2).

</comment><comment><USER45> I hope Valve releases their own VR headset now, and locks Oculus out of Steam, with only their own VR headset being compatible. Valve has already done all the same research, and are even ahead of Oculus. I could see them turning it into a product by mid-2015, which is probably sooner than Oculus' own consumer version.

<comment><USER46> They don't need to lock out other headsets, that's kind of the opposite of their service model and philosphy. But they would have the advantage of controlling the distrobution platform, their in-house software/engine, and their hardware. Lots of advantages there, similar to Apple.

Theirs will likely become the superior product, organically.

<comment><USER32> I just hope they make it a hackable platform like they claim the steam controller will be, and like steamOS already kind of is. Because we can know for damn sure if there is profit opportunity in Occulus any openness about it will be stomped into the dirt.

</comment></comment></comment><comment><USER47> >...it might not seem obvious why Oculus is partnering with Facebook...But when you consider it more carefully, we're culturally aligned with a focus on innovating and hiring the best and brightest

Looks like ALL companies in this world would be a good fit for a facebook acquisition.

</comment><comment><USER48> At least some of Facebook's history of arbitrary platform creation and destruction has to do with their youth as a company. They are growing up and we've seen successively fewer missteps in the past two years.

So there is room to hope for a successful partnership. Oculus has a really phenomenal product and partnering with Facebook is going to scale that product MUCH faster than it would've otherwise. This could be the perfect deal for both companies.

Don't get me wrong, my heart sank when I heard it was Facebook. And the WSJ's article on how disingenuous they were with their kickstarter backers is still real. But in the truly long-term, we might look back on today as a big moment for virtual reality.

</comment><comment><USER49> /r/oculus isn't happy: [http://www.reddit.com/r/oculus/comments/21cvry/facebook_acqu...](http://www.reddit.com/r/oculus/comments/21cvry/facebook_acquires_oculus_vr/)

<comment><USER50> Checkout this prescient thread on /r/oculus/: [http://www.reddit.com/r/oculus/comments/1wf6mg/so_no_way_to_...](http://www.reddit.com/r/oculus/comments/1wf6mg/so_no_way_to_confirm_this_but_my_friend_works_in/)

</comment></comment><comment><USER47> Rules of being acquired:

1st rule: you do not talk about the money 2nd rule: you DO NOT talk about the MONEY 3rd rule: you talk about how the acquirer and acquiree shares the same vision and dreams that would enable the acquiree to build great things.

</comment><comment><USER51> I could be wrong, and I even think this might be an unpopular opinion (I'm not a huge FB fan, FWIW), but I think this is pretty good for Oculus. It's exposure writ large. Also funding, but from a Marketing perspective this can open some serious doors for them.

That said, I'm saddened. A possible greater exposure could have happened from another company purchasing it, Apple for instance, or even (some will shudder), Google.

I'm not going to give up on Oculus just yet though, but I'm somewhat disapointed. Even if Facebook doesn't ruin it, it's... well, it's still Facebook.

<comment><USER52> I shuddered at the Apple suggestion, not the Google one.

With Google there would still be a very excellent chance the device would run across PCs (Windows/Linux and Macs) and maybe even iOS devices (if Apple allowed it) along with Android. With Apple, obviously not, it would be Mac/iOS only and fuck everyone else.

<comment><USER51> True enough, though certainly the same with Microsoft, and possibly Google (Android only?). Maybe Facebook will be the one really only open one? I only worry that real games will not get a chance and we'll have a glut of "Totally Immersive Candy Crush!!!"

</comment></comment></comment><comment><USER53> Sony is probably happy as heck since it effectively resets everything to give their project a chance. Also, I am a little sick of the "joined" terminology. You got bought and are no longer in control of your companies destiny. Unless you pull a NeXT, "joined" is not true.

</comment><comment><USER54> _At first glance, it might not seem obvious why Oculus is partnering with Facebook, a company focused on connecting people, investing in internet access for the world and pushing an open computing platform._

An "open computing platform"? What are they talking about?

</comment><comment><USER55> "The affect heuristic is an instance of substitution, in which the answer to an easy question (How do I feel about it?) serves as an answer to a much harder question (What do I think about it?)."

</comment><comment><USER56> It seems from the reaction that for Facebook this wasn't just a $2 billion deal but a $3 billion deal — $2 billion in cash, plus $1 billion of Oculus' value wiped out by the announcement.

</comment><comment><USER57> Wow, I thought the real-life James Halliday was going to be Palmer Luckey, Gabe Newell, or John Carmack. I didn't pick that it could be Mark Zuckerberg!

</comment><comment><USER58> It sounds to me like Oculus just sold out. Great now instead of a new way to game we are going to have something like Lawnmower Man Facebook.

</comment><comment><USER59> Pretty funny that all the comments on the linked article are tied to Facebook

</comment><comment><USER60> One word - metaverse. That is all.</comment>


Hack of MacRumors forums exposes password data for 860,000 users - <AUTHOR> http://arstechnica.com/security/2013/11/hack-of-macrumors-forums-exposes-password-data-for-860000-users/ <comment><USER2> I really, really, really wish that GoPHP5 Round Two [1] takes off and all the popular blog & forum programs get on board.

PHP 5.3.7 is the first version of PHP that is _guaranteed_ to come with a proper implementation of bcrypt. All versions before 5.3.7 either don't support it at all, depend on the OS to support it, or have the wrong implementation. phpass won't help you; it just produces a weaker, "portable", md5-based hash, as it does in WordPress by default.

As a result, no open-source blog or forum program that needs to support PHP versions lower than 5.3.7 can use bcrypt by default. Since the world isn't going to abandon PHP any time soon, the only option is to force every web hosting company to upgrade PHP to 5.3.7 or higher.

[1] [https://groups.google.com/forum/#!topic/php- fig/ogp03OHbVJ0](https://groups.google.com/forum/#!topic/php-fig/ogp03OHbVJ0)

</comment><comment><USER3> Disclaimer: I'm biased towards security.

I can't understand the superficiality in doing security-related activities (not being hacked of course, but the leakage of passwords because of md5+salt...).

Or better, I can understand that security is not priority 1 when one launches a new product, but there should be periodic reviews, similarly as reviews of the ux/ui, the branding/communication, the algorithms...

Someone should make a good post like: you can launch a website without x, y, z. When you reach 1k users, you need to implement x. At 10k you must have y. You can't think to 1M users without z.

<comment><USER2> MacRumors didn't design their own password storage scheme, they just used the popular VBulletin forum software. I don't think it makes sense to ask people to switch forum softwares when they reach a certain number of members.

It may or many not be VBulletin's fault that the site was hacked in the first place, but it's definitely VBulletin's fault that it uses md5 by default. Absolutely no excuses there, since supporting PHP 4.4 is not a valid excuse. The only fault of MacRumors operators that I can think of is that they used a vulnerable piece of software.

Unfortunately, forums aren't cool anymore, so few people write them anymore and it's difficult to find forum software that meets modern standards.

<comment><USER3> It's not the point who the fault is, it's that if MacRumors/VBulletin grows the amount of users, they (jointly, the former, the latter) need to take into account security.

<comment><USER4> So you are saying at a certain point they should security-audit the software they run on.

At what point does that mean the source of the PHP forum-software? At what point does that mean the source of PHP itself? On what point does that become the source of the operating system PHP runs on?

Add to this any other component involved which may or may not expose a security-risk, like MySQL, Email-servers, etc.

I think while your attitude may be the right one, your statement is overly simplistic.

<comment><USER5> Making sure the password hashing mechanism is secure would be a good starting point...

</comment></comment></comment></comment></comment><comment><USER6> Question: why half of the salt isn't hardcoded in the application code? That would make a database access completely useless without a deeper penetration, and it's really easy to implement.

<comment><USER2> A hardcoded second salt is called a _pepper_ , and some programs use it. Unfortunately, with a popular and outdated PHP app like VBulletin, it won't be too difficult for an attacker to obtain both the DB dump and whatever configuration file that contains the pepper. All those PHP files just sit inside the document root, and everyone knows exactly where they are.

</comment></comment><comment><USER7> Obligatory: [http://codahale.com/how-to-safely-store-a- password/](http://codahale.com/how-to-safely-store-a-password/)

</comment><comment><USER8> How many times does this have to happen before we realize passwords are a terrible authentication method? It is ridiculous.

<comment><USER9> The alternative you'd put forward is?

<comment><USER10> I'd like my phone to ask for some pin or my fingerprint when I want to login something. No username, password or anything. Like bluetooth pairing, I'd pair my phone with services that I register and they could trigger my phone to ask my confirmation.

<comment><USER11> That sounds just like TOTP.

I use Google Authenticator on iOS and Android. It's just a standards-compliant (RFC 6238) TOTP app, not anything Google specific. I've got six logins using it - gmail, Dropbox, Amazon (AWS), Github, Digital Ocean, and an internal service.

One thing that is a bit badly done - and I understand why - is making it easy to have "redundant duplicates". When setting up a new TOTP three factor auth account, I need to get my iPhone, iPad, and Android phone all together and manually type in the seeds (or QR code them) to all three to ensure I'm not completely screwed if I lose the only device with the magic tokens…

I'd love to have more of my important stuff secured with TFA/TOTP.

</comment></comment></comment></comment><comment><USER12> The MD5 passwords are not the issue here. The main issue is that the hacker logged in with the admin credentials.

Ofcourse the passwords should be encrypted but what about all the other data?

So the question is: should we store all data encrypted? Because it's not if, but when will the data get exposed.

</comment><comment><USER13> Oh crap, I have an account with them…

</comment><comment><USER14> it confirms that most mac users have extremely short passwords (airhorn)

-> the mac user

</comment><comment><USER15> md5+salt.... that isn't so terrible, is it.

<comment><USER3> It is, in fact.

hash(pwd) -> attacker can build a rainbow table and password cracking becomes a table lookup. Required storage depends on the length of the hash value, and md5 is only 128 bits.

hash(salt|pwd) -> no rainbow table because of salt. The attacker can use a dictionary attack. Time depends on how fast she can compute the hash, and again md5 is pretty fast.

Solution: [http://en.wikipedia.org/wiki/Key_stretching](http://en.wikipedia.org/wiki/Key_stretching)

<comment><USER15> Well, it's worse than bcrypt/scrypt, but it's still not primitive md5/sha without hash, or just symmetric encryption as in Adobe...

<comment><USER11> "Worse than", as in "six orders of magnitude worse than"

Hashcat on a single PC (with an appropriate video card) can test over 5 _billion_ passwords/second, and salted MD5 passwords barely slow it down at all (the Joomla result below is for MD5(password + 32CharSalt)). The salt helps, because I can't just look the hash up in a rainbow table (or google for it), but you should expect any password to have ever been made public from any other exploit to be on somebody's wordlist and to fall in seconds to any attacker with a few hundred bucks worth of video card, and any combo of two or three dictionary words with or without obvious letter-number substitutions to fall in well under an hour.

With bcrypt, that comes down to under 4 thousand attempt per second. That makes password cracking one million times harder.

from [http://hashcat.net/oclhashcat-plus/](http://hashcat.net/oclhashcat- plus/)

      MD5: 5144M c/s
      Joomla (MD5): 4609M c/s
      bcrypt: 3788 c/s

<comment><USER11> I see from another comment that vBulletin uses MD5(MD5(password)+salt) - I'd expect hashcat to be able to still blast through that at something north of 2 billion c/s…

That'll search the entire 32million entry list of Rockyou passwords in under a tenth of a second, and all 9-lower-case-letter passwords in an hour - or two hours if you include all 9char combinations with a single leading uppercase char. The rulesets that hashcat can use almost certainly means that any admin password which was human-created and under about 20 characters in that leak has already been cracked (anything made out of names or dictionary words with guessable letter/number/punctuation substitutions and leading/trailing digits - M1ffyTheC@t is not unguessable)

<comment><USER16> Modern password cracking is really quite sophisticated. They've taken to using words and phrases from common websites such as wikipedia in addition to ordinary words.

<comment><USER11> You really can't manage passwords in your head any more. At least not enough of them.

In my head I've got three banking passwords, two domain registrar passwords, and one "important email account password" (which is backed with TFA) that's the email that password resets get sent to - all are 16 random chars, and also two five word GPG passphrases. Those are _only_ in my head (well, one GPG passphrase is also in a sealed envelope in work's safe). Everything else is in 1Password locked behind a 7 word (intentionally misspelled) pass phrase – there are right now 866 sets of credentials in there - mostly 16 or 25 character (depending on when they were created/updated) random upper/lower/digits/special strings - with a few exceptions where sites/services won't let me use 25char passwords or sometimes prohibit "special characters" (Like your slow cryptographically secure hash function is susceptible to SQLi or XSS? That's why I can't use quotes or angle brackets? Really? Or are you actually incompetent?)

The 1Password file is synced between 4 machines in two physical locations plus 3 mobile devices, and time machine archived on one machine in both physical places - and one of those time machine archives is EncFS encrypted and stored on Dropbox and archived on S3 weekly, the other is daily rsynced to a pair of local drives. The passphrase isn't written down anywhere - but a hint which'd remind _me_ of the passphrase but would be innocuous/meaningless without sufficient context is written down and safely stored in two places. I _would_ be screwed without my 1Password data.

In my more paranoid moments, I wonder if both EncFS and 1Password's encryption is reliable enough to make leaking that file to Dropbox (which means S3/Amazon, which means the NSA if they're ever curious enough to ask Dropbox and/or Amazon for it). I also wonder about the attack vectors I've opened by having the 1Password file and app on two iOS devices - potentially leaking them to Apple and hence the NSA. But if the NSA ever come looking at _me_ specifically, I'm going to assume I've lost everything already. I don't _think_ any of that'll get caught up in dragnet surveillance though (except for when I get clients asking me to mail them hosting/admin/registrar credentials to their gmail or yahoo email addresses - _facepalm_ )

(Actually, I also have my AppleID password "in my head" \- since I need to type it in too many places where 1Password can't autofill it for me...)

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> great, just fucking great, first adobe, then macrumor, how many times do I need to change password in a single month

<comment><USER18> Stop using one password for everything then. A manager like 1Password is almost an essential tool for the security conscious.

<comment><USER19> are these services safe?

<comment><USER20> Don't know about 1Password, but LastPass encrypts all passwords client-side. Only marginally less safe than storing passwords in an encrypted file on your personal machine.

<comment><USER21> Or use KeePass. And you can store the KeePass database on DropBox.

<comment><USER22> I use KeePass. It's great. I looked at LastPass but I didn't like that it is "Browser Based". I know it is supposed to be working "offline" but somehow I felt safer using KeePass where I can use the programs own UI, make sure the exe doesn't "phone home" and where I can directly see the encrpted db file and do with that as I please.

At first I worried about what would happen should the db file get corrupted somehow. But then I set up the backup tools with which I can keep as many backups in as many places as I want, so unless the db file gets corrupted in _all_ places, I think I will be fine.</comment></comment></comment></comment></comment></comment>


ChromaShift: Browser-based game written in ClojureScript - <AUTHOR> http://kodowa.nko3.jit.su/

<comment><USER2> Written by us (kodowa) in 48 hours for the NodeKnockout using Light Table :D

EDIT: video of it in action here: <https://www.youtube.com/watch?v=v09DnU4vQ74>

<comment><USER3> How was working with light table?

<comment><USER4> I fully expect an unbiased evaluation.

<comment><USER3> Haha, I saw the comment and wasn't even thinking about the author! Well. Nevermind then.

<comment><USER2> Actually I did take some interesting things away from the experience. Not sure how broadly applicable they'll necessarily be though. A blog post on it is forthcoming.

</comment></comment></comment></comment></comment><comment><USER5> Cool use of WebSockets and nifty concept! Is the source available anywhere?

A couple things I noticed in the Chrome developer console:

\- Got two "Not allow to load local resource" errors with local paths to file://C://Users/chris/..., you probably want to fix those.

\- There's a lot of logging going on in the console (player info and JSON network packets), probably not necessary in the deployed version.

I liked that you can enable / disable mines in the other player's viewport.

Looks like there's only one level though, in my opinion, the game (even as an prototype/MVP of sorts) could have greatly benefited if you added some more levels and maybe a leaderboard before releasing.

<comment><USER2> This was for a coding competition[1], all assets had to be created in 48 hours - I would've loved to have gotten more done, but I'm happy with where we landed.. Especially since it _really_ came down to the wire. :) Here's our entry [2]

[1]: <http://nodeknockout.com> [2]: <http://nodeknockout.com/teams/kodowa>

<comment><USER5> Ah well of course, should've dug deeper :). Very nice job for 48h!

</comment></comment></comment><comment><USER6> Cool game, and really nice work in 48 hours!

I realize security probably not on the top of your feature list in 48 hours, but since I work for a security company doing security assessments it's is one of the first things I think about. I noticed an issue that will let me win without racing.

The reason I bring this up is not, in any way, to diminish your work, but to highlight that you don't get much security for free in these types of frameworks. So this isn't a big deal for this game, but in case somebody was using this for a more sensitive project they may want to be careful.

</comment><comment><USER7> "Looking for a match.."

Using FF16 with Noscript installed. I do have all listed domains enabled, but sometimes there seem to be hidden script domains.

</comment><comment><USER8> Sorry for being offtopic,

Could Clojurescript become the primary clojure implementation, replacing the JVM, someday in the future?

<comment><USER9> That's a secondary priority, wish list goal. Work is being done to separate out the JavaScript bits and to beef up the analysis bits. However, the JVM Clojure implementation is stable and reliable. There isn't a really pressing need to replace it. Self-hosting languages are neat, but Clojure has always been about pragmatism. Stability and performance are paramount in the ClojureScript compiler. That being said, it's a fun goal, so there are various projects working on alternative backends, Clojure-in-Clojure JVM targets, etc. And patches towards that goal are welcome in ClojureScript!

<comment><USER8> Its in the secondry priority

What? Shifting the main development to JS so that clojurescript may be called clojure? So we might see the main development shifting from 'targeting the JVM' to 'targeting JS' ???

<comment><USER9> I'm not sure what you're asking... Clojure is a language that, as an explicit design goal, embraces a host platform. Two of those hosts, actively maintained by registered Clojure contributors, are the JVM and JavaScript. The JVM ecosystem came first, has access to a generally superior host platform and libraries, is implemented largely in Java, and contains many required components to bootstrap ClojureScript. ClojureScript is implemented in JVM- Based Clojure, reusing some of those Java components (like the reader), lacking in features that generally make less sense in target environments (ie. eval in browsers), and generally acts as a complementary library for JVM Clojure web apps. Being a Clojure dialect, there is community interest in reusing some of ClojureScript's implementation, meta circularly, for additional platforms including Lua, ChickenScheme, LLVM/ObjC, .NET, and yes, the JVM. If the people working on those projects want to contribute modularity and platform abstraction improvements to ClojureScript's reader, analyzer, code generator, build infrastructure, or libraries, their patches will be actively considered.

<comment><USER8> Oh do not mind that...

I was just asking a noobish question

1: What will be the primary clojure platform in the future?

It will be JVM.

2: Do clojurescript and clojure compete?

No. :)

</comment></comment></comment></comment></comment><comment><USER10> Please, please allow the 'up' arrow to jump :/</comment>


If a map isn't a reference variable, what is it? - <AUTHOR> https://dave.cheney.net/2017/04/30/if-a-map-isnt-a-reference-variable-what-is-it <comment><USER2> How did Go, a language designed from scratch by top people with unlimited funding, end up as such a muddle?</comment>


Exploration of Kelly's Principles at Lockheed Martin - <AUTHOR> http://worldofskunkworks.blogspot.se/2013/01/how-to-manage-successful-skunk-works.html

<comment><USER2> The change of title seems a bit tasteless on the 70th anniversary of Stalingrad - could the submitter change it back please?

[Of course the US was vital to winning WW2, but so were the efforts of many other countries].

<comment><USER3> Thanks you, I also find the title extremely arrogant and offensive to many people. All 4 of my grandparents fought the Germans on the Eastern Front, go tell them how the U.S. won WWII.

</comment></comment><comment><USER4> The US won WW2 quite simply because of its massive production and population base. Most of the technology was already provided by the Brits. This is not to demean the efforts of the USA who really were the saviours of the Allies. Without USA, WW2 more than likely would have been lost or turned into something like the 100 years war.

<comment><USER5> Or just as likely, the Soviet Union would have just steamrolled over all of Germany and probably kept going until they got to the English Channel.

<comment><USER6> With the USA, there would have been a sharp reduction in supplies due to having no Lend Lease Act.

<comment><USER7> Yeah, was going to say the Soviets were being beaten badly before the US helped them. They then returned the favor by enslaving everyone they "liberated".</comment></comment></comment></comment>


Shale Boom Is Slowing Just When the World Needs Oil Most - <AUTHOR> https://www.wsj.com/articles/shale-boom-is-slowing-just-when-the-world-needs-oil-most-11569795047?mod=rsswn <comment><USER2> Interesting article let down by in irrelevant title. Nothing in there about how the world needs oil.</comment>


How to know when someone is in trouble in the water - <AUTHOR> http://mobile.slate.com/articles/health_and_science/family/2013/06/rescuing_drowning_children_how_to_know_when_someone_is_in_trouble_in_the.html <comment><USER2> Beware: it is very dangerous to attempt to rescue a full-grown person who is drowning. A person who is drowning has temporarily lost their mind and will happily drown their would-be rescuer in an attempt to stay above the water. Approach a drowning person from behind and hold them above the water by their armpits.

<comment><USER3> _Approach a drowning person from behind and hold them above the water by their armpits_

Unless you're a trained lifeguard this is poor advice. As stated above you don't want to get within touching/grabbing distance of a drowning person. Get some sort of intermediary between you and them, a stick, rope, shirt, pants whatever. Something that you can drop if you are at risk.

To the point below about their instincts of not grabbing it. Don't leave it out where they need to reach for it. Hit them in the head or arms with the stick or piece of clothing and they'll grab it. My first few pool rescues with a lifebouy I'd leave it within their grasp and they'd not grab it. If I hit them in the head or hands with it they'd grab it every time.

<comment><USER4> I had a lady next to me start to drown and grab me in a pool when I was getting my diving certification. Despite having a supply of air, wetsuit, fins and buoyancy control device on, she got that drowning sensation when her respirator came out. Once she had someone to hold onto, sanity was restored but I totally got why drowning people are dangerous from then on.

<comment><USER5> I used to teach scuba, and people would occasionally freak out and grab me as if they were trying to drown me. I wasn't too concerned about my own safety in those cases, because years of play in the ocean had taught me not to panic when unexpectedly shoved underwater. You always have some air in your lungs. Stay calm, and it will give you the time you need (unless you're in extreme conditions).

Just swim _down_ when you are grabbed. If you kick and thrash to try to raise yourself to get your head above the water, they will feel you raising them up and try to climb on top of you for safety. So you shovel water with your arms to push yourself farther _down_ , pulling them down just enough that their heads go underwater, too, and they'll release you quickly. They are struggling desperately to keep their heads above water and won't hang on to something that's pulling them under. Your head is already underwater, so it won't hurt _you_ to go a little deeper, but if _you_ panic and try to fight toward the surface, they might hold you under until it's too late for you. Go _down_.

Once they release, you push back out of reach, get your air at the surface, and figure out how to help them.

</comment></comment></comment></comment><comment><USER6> I can confirm the article. Almost drowned once in a river: I let myself go with the current and, once I tried swimming back, realized I accidentally went into strong currents.

I tried swimming harder, but eventually got tired and sunk. Despite my friends being about 20/30 meters away from me, they didn't realize I was drowning. I couldn't scream for help nor do anything but trying to stick my head out and breathe. I couldn't stay afloat long enough to cause any water splash either.

Fortunately I touched a rock that was sticking out from the bottom with my foot and stood there for a bit to recover and go back.

Be careful this summer!

<comment><USER7> Ditto. I remember my drowning in a swimming pool very vividly. I was around 9 at the time, couldn't swim and was sitting on one of those foam floats. A friend of mine (he didn't know about my lack of swimming ability) pushed me off the float right in the middle of the deep end. This is where the article's description really hits home with me:

1\. I wasn't able to stay afloat in my vertical position (as described)

2\. I tried to scream for help, but ended up with a mouth full of chlorine water each time

3\. No adults/kids were reacting to me at all

4\. I accepted (3) and decided to take matters into my own hands

5\. Took the biggest breath I could (wasn't very big), stuck my head underwater, opened my eyes and "swam" as hard as I could to the edge of the pool ... I blacked out on the way

6\. An adult found me unconscious underwater, holding onto the side of the pool, blue in the face

7\. CPR

8\. I'm here to tell the tale \o/

(edit: formatting)

<comment><USER8> Doesn't sound like the drowning reflex kicked in for you, there.

</comment></comment></comment><comment><USER9> This get re-published every summer for good reason. Drowning happens frequently and it's theoretically preventable if people knew what to look for.

Also, be careful if you have to save a drowning person. The drowning response will cause them to instinctively push you under in an effort to get above water, so make sure you have your own floatation device so they don't end up drowning you.

<comment><USER10> IIRC, half of the year's drowning deaths in Finland I occur during the solstice, which is happening this very instant.

</comment></comment><comment><USER11> I've seen articles like this before, and whenever I read them I think about a time on vacation when I could quite possibly have drowned. I had traveled abroad with some friends and went into relatively shallow water. However, I hadn't swam at all in many years, and I was also out of shape.

We decided to have a swimming race. About halfway through I was completely exhausted, both from being out of shape and not being a very good swimmer in the first place. At that point I stopped to rest and realized that my feet couldn't hit the bottom. I recall my mouth being above and then below water, along with panic. I don't remember exactly what happened, but I got the idea to try and backfloat, which I was able to do. After resting a bit I was able to direct myself to shallow water again.

At the time I didn't think too much of it, but when I reflect upon it I think that I was drowning. My friends were indeed not far away, and I couldn't yell or thrash my hands around. It's scary to consider that I could have died while so close to them!

</comment><comment><USER12> """How did this captain know—from 50 feet away—what the father couldn't recognize from just 10? Drowning is not the violent, splashing call for help that most people expect. The captain was trained to recognize drowning by experts and years of experience. The father, on the other hand, had learned what drowning looks like by watching television. (...) Drowning is almost always a deceptively quiet event."""

I think there should be a law against showing kicking&screaming drowning people in movies. I'm not a fan of censorship otherwise, but here we have a clear case where movies occasionally lead to lost lives.

<comment><USER13> You would need a much more comprehensive overview process to eliminate misleading information from movies, even if it were limited to life- threatening misinformation!

One instance I can think of is MRI magnets. Often, a medical drama will cut to someone pushing a button and the magnet coming on. In reality, the magnets are always on and bringing metal objects within range can have dire consequences.

The whole movie _Home Alone_ depicts life-threatening pranks on the burglars. c.f. dropping a clothing iron 3 stories onto someone's face.

<comment><USER14> Banning the portrayal of drivers looking at their passengers while talking to them would probably save more lives than banning inaccurate portrayals of drowning.

<comment><USER13> Correct. However, drowning is high on the list[1] of common causes of injury death for children. Vehicle accidents are the 1st for ages 5-24.

[1] [http://www.cdc.gov/injury/wisqars/pdf/10LCID_Unintentional_D...](http://www.cdc.gov/injury/wisqars/pdf/10LCID_Unintentional_Deaths_2010-a.pdf)

</comment></comment></comment></comment><comment><USER15> In addition to the point of this piece, please read the following for comprehensive guidelines with regard to water safety:

[http://www.redcross.org/prepare/disaster/water- safety](http://www.redcross.org/prepare/disaster/water-safety)

For those heading to the beach, please be aware of the _rip current_ phenomenon:

[https://en.wikipedia.org/wiki/Rip_current](https://en.wikipedia.org/wiki/Rip_current)

[http://www.ripcurrents.noaa.gov](http://www.ripcurrents.noaa.gov)

</comment><comment><USER16> From my relative who was a Boat & Water Safety person in Minnesota regarding this article:

This is a song I have been singing for years. Drowning is silent, fast, and deadly. One of the best videos I have seen on this subject is "The Reasons People Drown", produced by Dr. Pia. It is excellent, chilling, and should be watched by everyone who is responsible for or who cares about small children and non-swimmers who venture near the water.

Drowning victims are helpless, and without intervention, will be dead in one minute or less. Most drowning victims perish within 6 feet of safety, and that safety often is a person who could have rescued them if they had known what was happening within arms reach.

Re-read the description of a drowning victim and then compare it to the sight of a child at play. There are many similarities and if you are not vigilant you will never notice the differences.

If your child is near the water, you need to be near your child. And, it is not possible to adequately monitor a child in the water and read a book at the same time. Pay attention to the child only, and don't try to keep an eye on more than two at one time!

</comment><comment><USER17> This device on IndieGogo seems really promising:

[http://www.indiegogo.com/projects/the-seal-wearable-swim- mon...](http://www.indiegogo.com/projects/the-seal-wearable-swim-monitoring- and-drowning-detection-system?browse_v=old_no_dropdown)

It is just too easy not to notice a drowning person, especially a child, even if they are right in front of you.

<comment><USER18> How does it work? I assume it's a water pressure sensor which requires more than a foot or two of water to activate, and some kind of timer, combined with the transmitter? (otherwise a collar doesn't really work -- I can keep my neck immersed in water all day and not drown...)

<comment><USER19> From another site [1], it seems as if it monitors the amount of time spent underwater, and is activated if this exceeds a preset amount of time.

[1] [http://www.slate.com/blogs/future_tense/2013/05/28/seal_syst...](http://www.slate.com/blogs/future_tense/2013/05/28/seal_system_indiegogo_campaign_is_raising_money_for_drowning_detection_technology.html)

</comment></comment></comment><comment><USER20> The absence of screaming and waving seems obvious after reading it, I realize I am really am conditioned to think if people aren't screaming...etc they aren't in trouble.

That said there is definitely some lifeguard propaganda in the article (who knew such a thing existed?):

"From beginning to end of the Instinctive Drowning Response people's bodies remain upright in the water, with no evidence of a supporting kick. _Unless rescued by a trained lifeguard,_ these drowning people can only struggle on the surface of the water from 20 to 60 seconds before submersion occurs."

<comment><USER21> A drowning person will endanger his rescuer by instinctively climbing onto the highest point available (the rescuer's head).

If you see someone drowning, alert a lifeguard if possible. Depending on the situation, the proper action might require the rescuer to counter intuitively drag the person under water. On the other hand, if no life guard is present, don't just let someone drown, but saving them is a risk.

source: I was a "victim" for lifeguard training.

<comment><USER22> Just curious...let's say that you see someone drowning, you aren't a trained lifeguard, and there aren't any lifeguards around. Could an untrained person rescue that person safely? Any tips?

<comment><USER21> First, the primary job for any rescuer is to not become another victim.

Be prepared for a _violent_ altercation with the victim. The person is dying and not thinking normally. Don't be afraid to hurt the person to protect yourself.

If the situation is too much, back off and wait for the victim to lose consciousness. Pulling a drowning person from the water takes more than just strong swimming.

And again, I was only the dummy for real life guards so I basically got to act the worst possible situation. I'm sure some rescues look just like Baywatch portrays.

<comment><USER23> Is it a good idea to approach from behind and force the parson to lay back on you? (A headlock basically.) This gets their mouth out of the water so they can breath.

Once they breath for a bit they'll calm down and can help in their rescue.

</comment></comment></comment></comment></comment><comment><USER24> I worked as a lifeguard in high school and had to save a kid once.

I didn't even think he was having trouble until one of the counselors yelled, "DIMINOTEN!" He was taking a swim test and looked just like all the other kids, except he wasn't going anywhere.

Being a lifeguard is a silly job. 99.999% of the time you're doing nothing but sitting in a chair, trying not to fall asleep. It's that ONE time when you need to be paying attention that's critical and matters absolutely.

<comment><USER25> what is "diminoten"?

<comment><USER26> his name

</comment></comment></comment><comment><USER27> This is an excellent article, it was posted around 3 years ago from the original source and there was some great discussion at the time, revolving around some of the questions and opinions currently being discussed here in the comments.

[https://news.ycombinator.com/item?id=1492835](https://news.ycombinator.com/item?id=1492835)

It's good to see it resurface, definitely one of the more memorable articles I've ever read.

<comment><USER28> Agreed - the articles and the commentary are fascinating.

</comment></comment><comment><USER29> A video would be helpful. I'm not confident I could recognize all those signs from the descriptions.

<comment><USER30> Only lifeguards need to be able to spot it at 50'. And they'll get training.

For everyone else: you only need to spot the silence. People in water make noise and move. If anyone isn't doing that, talk to them. You don't have to say "hey, are you drowning?" just "hi" or strike up some small talk.

If they aren't responding and don't seem to be doing anything but bobbing along with their mouth barely above water, that continued silence is what should urge you into further action.

</comment></comment><comment><USER13> Here[1] is the publication where the article gets its description of _Instinctive Drowning Response_. Skip to page 14 (pdf).

[1] [http://www.uscg.mil/hq/cg5/cg534/On%20Scene/OSFall06.pdf](http://www.uscg.mil/hq/cg5/cg534/On%20Scene/OSFall06.pdf)

</comment><comment><USER31> I spent a couple of summers as a lifeguard at a college swimming pool, and I have seen this first-hand.

As a lifeguard, I was well trained in how to rescue but not particularly well trained in how to _recognize_ a drowning victim. There was a time I watched a boy bobbing up and down in the water, looking upward, mouth open, but not appearing to gasp for breath, the whole time wondering if he was in trouble. Luckily he was less than two yards from his mother, and she eventually picked him up. (Also luckily for me, she didn't think anything of it, or I might have been in trouble -- she probably didn't recognize that he was actually drowning either!) Only when I read the original publication of this article was I certain that he had been drowning at the time.

A side-note so that I don't seem like a complete abomination of a lifeguard: I did save a drowning victim at that pool. She displayed the TV-portrayed signs of drowning after jumping off the diving board with no idea how to swim. Probably due to the adrenaline rush, the rescue is a bit fuzzy, but that's where the lifeguard training kicks in.

<comment><USER32> >She displayed the TV-portrayed signs of drowning after jumping off the diving board with no idea how to swim. Probably due to the adrenaline rush, the rescue is a bit fuzzy, but that's where the lifeguard training kicks in.

My guess is that the reason was that she was not drowning yet. She probably _would_ have if you hadn't saved her, but in her case she had a few pre- drowning moments in which to react. The difference would be that she consciously knew that she was screwed as soon as she was in the water, since she didn't know how to swim.

<comment><USER33> Yes, something most people don't know about drowning is that it is typically defined as the point at which breathing is interrupted and the person is mostly motionless, usually perpendicular to the surface of the water. Sometimes before beginning to drown a person will become a distressed swimmer, which is what people think of as stereotypical drowning behavior. People in this stage often need rescuing, but they are not drowning. The trick is that while people often go from distressed to drowning, people that are drowning may never go through the distressed stage.

</comment></comment></comment><comment><USER3> Another bit that makes drowning deceptive is that most of the time the victim will be in relatively shallow water or fairly close to the edge of the pool. If you can't swim its usually hard to get out to deep/open water (unless in a beach break) so a lot of kids that struggle will do so within a foot or two of being able to reach a wall or shallow enough water to stand up in.

<comment><USER34> Which brings up the obvious advice: if you're going to take your kids to the beach, or to the pool, teach them how to swim! Teach them young enough that they haven't yet developed an instinctive fear of water; then they'll be natural swimmers for life. (I learned to swim at about age 6 months.) If you can't teach them yourself, find a program at the local pool or rec center.

<comment><USER35> I don't think you really learned to swim at 6 months. At that age you are learning to be comfortable with the water, but you have a ways to go before you can actually swim. Your parents probably told you that you were able to swim because you were successful in whatever they were trying to do at that age.

source: My children are in infant swim classes.

<comment><USER34> _I don 't think you really learned to swim at 6 months._

You're correct that my statement is only true for certain values of "swim". :) Being comfortable with the water is probably a more accurate description of what's achievable at that age, yes.

However, I used the term "swim" to make the point that what kids learn as infants is just the beginning; to really reduce their risk of drowning, they have to continue advancing to the point where the really can "actually swim". I was at that point by about age 4 1/2.

</comment></comment></comment></comment><comment><USER36> I first read this article right around the time my son was born. I soon realized this is a really good mindset for supervising young children as well. If your kid is playing out of sight and you don't hear them for a while, go find them and see what they are doing.

"Listening for silence" is a really good skill to learn.

</comment><comment><USER37> Well, I had almost drowned once. I had a personal flotation device and I knew swimming! We were out rafting, and I had swayed away from the raft swimming in light rapids (the instructor said its very safe - which it wasn't). When I realized that the rapids were overwhelming me, I tried to stay afloat (a flotation device and know-how of floating works - but I guess I was panicked!), but did not help too much. It took me sometime to realize I was drowning, and in the meantime I had told another raft that had approached to help - that I was fine (overconfidence?). When the reality hit, it was bad, and I could not even scream. I did wave my hands, on to which my friends on the raft threw a rope, and I survived.

Even swimmers (I consider myself below average) can drown. "Panic" is to blame here. The following article explains a similar case quite here (search for "scuba-diving"):

[http://www.gladwell.com/2000/2000_08_21_a_choking.html](http://www.gladwell.com/2000/2000_08_21_a_choking.html)

</comment><comment><USER38> The link was for the mobile slate site. This is the non-mobile version:

[http://www.slate.com/articles/health_and_science/family/2013...](http://www.slate.com/articles/health_and_science/family/2013/06/rescuing_drowning_children_how_to_know_when_someone_is_in_trouble_in_the.html)

</comment><comment><USER39> If this topic interests you, please consider engaging with Colin's Hope if you are able. I used to work with a member of their board of directors, and I know from direct experience that the organization is incredibly passionate about their cause.

[https://www.colinshope.org](https://www.colinshope.org)

</comment><comment><USER40> When I was 10 I was at a water park and they had some sort of artificial wave generator in one of the pools. It wasn't until last year (when I first read the article) that I realized that what I experienced in that pool was Instinctive Drowning Response. Naturally I realized at the time that I had been in some sort of trouble, but not that that was drowning. The power of the whole "kicking and screaming" trope, I guess.

One of my classmates from school actually swam by me in the pool (while I was drowning) and tried to get me closer to a rope which was hanging by the pool's edge... and when he failed he promptly swam off and did nothing more. (Not that I think that he realized the full gravity of the situation and simply wanted me to die or anything.)

</comment><comment><USER41> I'm not sure if you did this on purpose, but THANK YOU for posting the mobile version of the site. It removes a lot of the distracting spam from the main version.

I think more people should try to find a mobile version of a submission before submitting it.

</comment><comment><USER42> This happened to me once in a pool and until I read an article like this I didn't even know I was drowning. I was 5 or 6 and was in a swimming class. I remember going up and down and not being able to say anything or do anything but that. I don't think anyone noticed me but I may be wrong. What saved me was that the pool bottom was slanted so every time I went down I touched it just a bit but enough to push me slowly to the shallower end.

<comment><USER35> It is really scary to think that you could have drowned in swimming class. I will definitely be attentive of my own children when they are learning. Glad you survived!

</comment></comment><comment><USER43> Wow, that was uncomfortable to read. I had forgotten about a time where this happened to me in a regular in-ground pool (I was very young.) I can confirm the description of the article: arms extended, cant speak, mouth going in and out of the water with my head tilted up etc.

A friend noticed and got me to safety; my dad was confused and I felt very weird/blurry about how I had reacted.

Thanks.

</comment><comment><USER44> If you're going to swim in open water (not a pool) and there is a lifeguard, tell them you're going to go swimming and ask if there is anything you should be aware of.

They often have insights into certain areas, underwater terrain, currents and the influence of tidal changes. Also by talking with them, they will be more aware of your location.

</comment><comment><USER45> Some day cameras will monitor what happens in a pool and software will be good enough to figure out when someone is drowning, releasing the nearest floatation device from the bottom of the pool.

</comment><comment><USER46>
        color: rgb(102,102,102)

Seriously?

Why do so many publishers make their content so hard to read?

(Once I fixed that with inspectElement, the article was good.)

<comment><USER47> You're using chrome on windows right? The linked URL is their mobile site and the text container has been 3dtransformed forcing grayscale antialiasing which Chrome does poorly.

Check it out on Firefox or IE and you'll see what I mean.

It will look much better on a mobile device as well. If you drop "mobile." from the url you'll get their normal desktop site which also has much better type in Windows Chrome.

<comment><USER46> I'm using Firefox.

I do have some ambient light. Maybe if I replaced the curtains in my window with true blackout curtains this would look ok.

</comment></comment></comment><comment><USER48> grab the drowning person by their hair, while approaching from the rear.

</comment><comment><USER49> Unrelated, but why does Slate disable pinchzoom for mobile devices?</comment>


Technopoly: The Surrender of Culture to Technology - <AUTHOR> http://en.wikipedia.org/wiki/Technopoly:_the_Surrender_of_Culture_to_Technology

<comment><AUTHOR> Postman claims that tools "attack culture…[and] bid to become culture", subordinating existing traditions, politics, and religions. Postman cites the example of the telescope destroying the Judeo-Christian belief that the Earth is the centre of the solar system, bringing about a "collapse…of the moral centre of gravity in the West".

<comment><USER2> That is some amazingly sloppy research work on his part, and he just seems to have an axe to grind, so he is okay with the sloppiness. The geocentric model is due to Ptolemy and Aristotle, Greek philosopher/scientists pre-dating Christianity by centuries who were both probably almost completely unaware of the Jews. Copernicus, author of the heleocentic model, was a Roman Catholic and Pope Clement VII found the theory interesting [1]. Galileo, creator of the telescope, was also a Roman Catholic, was also a personal friend of the Pope Urban VIII, the pope at the time of his trial by the Inquisition [2]. Pope Urban VIII supported the heliocentric model, the trial was related to other issues. Galileo's favorite daughter was a cloistered nun, and we have their letters still [3].

1: [http://en.wikipedia.org/wiki/Nicolaus_Copernicus#Heliocentri...](http://en.wikipedia.org/wiki/Nicolaus_Copernicus#Heliocentrism)

2: [http://en.wikipedia.org/wiki/Galileo_affair](http://en.wikipedia.org/wiki/Galileo_affair)

3: [http://www.amazon.com/Galileos-Daughter-Historical-Memoir- Sc...](http://www.amazon.com/Galileos-Daughter-Historical-Memoir- Science/dp/B008PHMGHU)

<comment><AUTHOR> He writes books for a wider audience and I think he is speaking broadly in terms of the bigger picture. It was a belief among ordinary people that the earth was flat and the center of the universe. The telescope probably had the most to do with changing that world view. I think we have to take what pop-sci writers say with a grain of salt (Michio Kaku for example.)

<comment><USER2> Except that is the whole primary thesis of his book, and it is based on trivially falsified premises.

(At the time ordinary people had probably no real conception of the general order of the universe, being uneducated illiterate peasants. The educated at the time mostly viewed the Earth as sperical, because of the ancient Greek philosopher/scientists, and the Earth as the center of the Pysical Universe, again because of the ancient Greek philosopher/scientists.)

<comment><AUTHOR> Ah, I didn't realize that. I haven't read this book, but did read his "Amusing Ourselves to Death." Thanks.

<comment><USER2> I'm going completely off of the Wikipedia page you posted, I haven't read the book either, so it could be really misrepresenting the book. But the whole "theocratic -> technocratic society" step seems to be based on that shallow argument.

"Amusing Ourselves to Death" seems like a good book, I have a copy but have yet to read it.</comment></comment></comment></comment></comment></comment>


How 'Deepfakes' Threaten Cybersecurity - <AUTHOR> https://www.darkreading.com/application-security/toxic-data-how-deepfakes-threaten-cybersecurity-/a/d-id/1333538 <comment><USER2> It's terrifying to think one could create a false video of you doing something reprehensible.</comment>


Big Hacks in Little Paradise - The Story of the First Naples Startup Battle - <AUTHOR> http://www.kpkaiser.com/entrepreneurship/big-hacks-in-little-paradise-the-story-of-the-first-naples-startup-battle/

<comment><USER2> So cool to see these kind of events happening in Naples!</comment>


Telehealth will be free, no copays, they said. But patients are getting billed - <AUTHOR> https://khn.org/news/telehealth-will-be-free-no-copays-they-said-but-angry-patients-are-getting-billed/ <comment><USER2> If you're wondering what's happening here, this is a shady tactic used by health providers to squeeze out of pocket money from patients. It happens also when your health plan clearly states that things like preventive care are covered with no-copay and outside of the deductible.

The loophole they exploit is claiming ignorance about coverage that's not under the umbrella of your deductible.

They can do this because when they check with the plan provider they don't have to, or want to do a lengthy inquiry in relation to the patient's situation and their plan. That check is usually a 2 minutes call. So they go with a blanket scenario which is:

"A patient is here for a consultation. Based on their coverage how much can I get out of their pocket?"

That's literally the only validation they are interested in doing.

Of course, you can try to fight this, but the process for this is probably so long that it's not worth your time. So they get away with it all the time. Most people don't even want to deal with this. Going to the doctor is already stressing enough, so 75 USD less is not worth it more stress. And they do this because nobody says anything and patients don't understand well enough their coverage. The average person hardly understands the concept of a deductible.

If people were actually fighting back this it would be harder for healthcare providers to charge fees they are not entitled to.

Healthcare in the US is one of the most exploitative and unethical industries. They don't care about the patients, they only care about their money. And I'm not talking about the nurses and doctors. Most of them are simply cogs of that system. They may have knowledge of these shady things but rarely can control them (except the ones that have private practices)

I'm talking about the organizations that insure patients and the organizations that provide healthcare. Patients are always in the middle of a constant tug between insurers and providers.

In a situation where someone has to lose something, you better believe it would be the patient.

<comment><USER3> The more I learn about the US healthcare system, the more i'm sad for everyone living there.

All these loads and loads of information you need to know to go to the doctor. How can regular people ever get the healthcare they need, and we're not even talking about the vulnerable, low income, low schooled.

This. Is. Ridiculous.

I'll take socialism over this nonsense any day of the week.

<comment><USER4> The most interesting thing is that most of this healthcare is tied to employment. So now in the past few weeks when 25 million people have been laid off, they have also effectively lost their health insurance. Now they cannot afford to go to the doctor and cannot afford their prescriptions.

As of December 2019, 26 million people in the US were inunsured. Since then, around 26 million more have lost their jobs - effectively losing their healthcare. So now as of today, around 52 million people in a country of 320 million have no access to primary healthcare.

[https://www.kff.org/uninsured/issue-brief/key-facts-about- th...](https://www.kff.org/uninsured/issue-brief/key-facts-about-the- uninsured-population/)

<comment><USER5> The more I think of it, the more it seems like..

COVID-19 is the symptom.

Capitalism is the disease.

This comment will of course, get heavily downvoted, and likely flagged.

But, it appears we are reaching a reckoning. This virus does not give a damn if you're rich or poor. Insured or not. It's going to take out anyone that it can. And the poor, and those on the fringe, are going to get hit the hardest.

</comment></comment></comment></comment><comment><USER6> This is 100% political but imo this industry really just needs to be nationalized ASAP. You literally have people who are working as essential workers worried about paying for healthcare coverage or how much an appointment will cost. There will be many US citizens who will die due to this. This will also include the wealthy...

Also my health insurance still says my premium was not paid but when I called them up in TX they said everything was paid up. Then they said I'd need a bill audit at their other location in GA and I haven't heard anything since. This is after paying all bills and calling their customer service. Most likely their backend billing systems are not talking but no one cares to fix it. It's a fucking disgrace.

<comment><USER7> The crazy thing is that most people, on both sides of the aisle, are unhappy with the current system. Unfortunately, nobody seems to agree on how to fix it.

<comment><USER6> Single payer is a possibility but not the only possibly. DE/NL have private insurance + universal coverage and it works just fine. But the shenanigans insurance companies get up to are not allowed there.

I'd prefer single payer but either one works and but regulated insurance will be more politically palatable in the USA.

</comment></comment></comment><comment><USER8> Pre COVID I tripped over something related. In some states insurance is required to cover telehealth (including mine). So I had a feel visit with my specialist but then after it turned out it wasn't covered. I debated it with them and after much back and forth eventually discovered no, because I'm on an employer self funded plan (the majority of plans) state insurance laws don't apply.

Another good one is, go to most oncologists these days and you'll expect to pay your co pay. What they won't often tell you is that you'll also be separately billed for what they call a "facility fee". This can be anywhere from $180 to $450 and can obviously be quite a surprise. So your $20 copay can become anything up to $470 depending on your plan. Their justification for this is that they are "hospital based" even if they aren't. And even if you might attend a cardiologist or neurologist in the same speciality building and they don't charge facility fees. It's just another way to extract more money from the system.</comment>


Python Code Quality: Tools and Best Practices - <AUTHOR> https://realpython.com/python-code-quality/ <comment><USER2> Wow, great article! It's been only a month I started learning python by myself so it's really helpful to learn about code standarts. Thanks for sharing! Can't wait to use those tools on my programs.</comment>


On windows 8 and backwards compatibility   - <AUTHOR> http://puntium.tumblr.com/post/6170137442/on-windows-8-and-backwards-compatibility

<comment><USER2> Windows 8 has backward-compatibility because they've built an identical operating system for phones (eventually), tablets, convertible tablets/laptops, laptops, and full-blown desktops. That helps reduce the x86/ARM fragmentation that they're already going to be dealing with, and it lets you plug mice and keyboards into tablets.</comment>


Niantic's apps collect a surprising amount of data about where users go - <AUTHOR> https://kotaku.com/the-creators-of-pokemon-go-mapped-the-world-now-theyre-1838974714 <comment><USER2> I worked at Niantic (originally on Pokemon Go) since the day they officially spun out from Google until a few months ago.

I am speaking solely for myself when I say that, While the company has plenty of flaws, it is very serious about privacy protections. It was drilled into every engineer from day one that we were dealing with really sensitive data. Not just any old data - kids were a target audience and so we were dealing with realtime location data from children under 13.

Niantic took a lot of time and effort to ensure that this data was deleted, obfuscated or has as much precision removed as possible, as quickly as possible.

I don't like how Niantic handled some things, but their stance on privacy was never one of them.

(Again, this is my personal opinion. I definitely don't speak for Niantic.)

<comment><USER3> I was very active in the Ingress community around that time and while I appreciate their efforts, I don't think they were very successful in this regard. Using IITC (3rd party Ingress planning suite) we could track people's paths pretty well, to the point where you could easily see how others ran their routes and could intercept them if you wanted to say hi, or something more nefarious. I know at least one woman in the community changed their account because of a stalking problem.

I didn't totally mind the lack of location privacy since the game made it pretty clear you could run into people if you really wanted, but I wouldn't give them flying marks on the privacy issue. For Pokemon Go I'm sure they were far more careful, but Ingress really felt like the Wild West.

<comment><USER4> IITC was explicitly a violation of the ToS and Niantic made efforts to foil it and ban those identified as using it until player outrage made them give up. The nature of the game also was antithetical to the notion of privacy since you could predict player movements just on the basis of field layouts. Anyone playing in an area also quickly learned the approximate locations of home and work for other players solely on the basis of habitual game activity. I mean, the whole point of the game was geolocation, it seems odd to me that anyone would have some kind of problem with that for Ingress.

<comment><USER5> From what I can read you've never been stalked by a creep…

<comment><USER6> I think the point of the comment is that by playing the game, you broadcast pretty sensitive data. It would be like if you were constantly uploading geotagged photos for everyone to see, and being surprised about people learning your location.

I really hate that this sounds like 'victim blaming', but if a threat vector for you is being stalked by a creep, and you don't want people to know where you are, then maybe voluntarily constantly broadcasting your location to the public isn't the best idea?

<comment><USER7> What if you innocently play the game and THEN get a stalker, who uses game data to identify work, home, etc.

If anybody can get a stalker, then nobody is safe playing this game... ?

<comment><USER8> That's a matter for police then. Any thing involving location data and semi- public information could land you a stalker.

Anything can happen to anyone. Whether to care about it at all, involve the state or solve it solve it yourself depends on probabilities involved.

<comment><USER7> So privacy doesn't matter? And the police are the right solution for all invasions of your privacy? Do I get the local police involved if remote attackers use personal information to drain my bank account?

"The police" (local?) are a solution for certain kinds of problems, but that's it.

Consider restraining orders and all the victims these orders failed to protect. Far more effective is a large dog or other adult humans.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> How is this a surprise? The original nitanic red-v-blue game was totally about geo-location.

Interesting read but the hook of _surprising_ doesn't grab me. What amazes me is that I can't find a page to do experimental A/B testing in these users for $.

<comment><USER10> Because it is a paid-for app instead of a gratis one. People expect they "paid off" the privacy invasion that way. Turns out, they did not.

<comment><USER11> That's an interesting assumption of people, and I can see where they might come to that, but the logic is unfortunately flawed. Just because publishers/developers might feel the need to monetize user data on free apps to make money, doesn't mean they won't also do it for paid apps to make _more_ money.

Betting a business is going to leave money on the table because it's the nice thing to do is not a winning strategy on the consumers part.

</comment></comment></comment><comment><USER12> I guess it's suprising if you've never looked into it, but even back when their only game was Ingress, it was a gamified way of giving them location data that they can sell to help optimize mapping software.

I guess I had my first real wake-up call about how much data is being collected and used was when I got an Android update, and google maps had pre- filled entries for my home and work addresses based on where I spent most of my time at certain parts of the day.

<comment><USER13> Yes the entire purpose of Ingress was to make meat modules walk to under- documented locations, take pictures, and indicate points of interest. The meat modules seemed to think it was "fun". Hard to explain.

<comment><USER14> Was a player, but to this day I still can't figure out why "Go there, take pictures, and 'capture' a location" can be THAT beneficial when it come to map software optimization.

I know the game certainly records my location which maybe good for discovering walk route, but other data they've collected seems (I guess) useless. How can picture of sculptures improve map quality? Kind curious.

<comment><USER15> A level 40 player (deeply committed to get that high) creates a stop with a photo of a statue in his back yard fountain so he could cheat. You could wait until multiple people submit it, or just allow it and just see how many people visit it. Either way, you get validation data on it.

Conversely, a player creates a stop for a new statue that was just placed outside of a government building in the last few weeks. This stop gets visited hundreds or thousands of times a day. You've now identified a hub. This hub can be used to validate the existence of other items of interest in the near vicinity.

<comment><USER14> It makes more sense now, but I still got questions.

You see, when you created an in-game location, you're inviting players to go there, regardless whether or not the location is popular in the real life. Dedicated players may take a detour from their normal day-to-day route just to hit that location to gain in-game advantages, which will generate data noise if the map software wants to use players data to improve their product for normal non-player users.

Also, let's don't forget products like Google Maps and Bing Maps are already collecting users locations. And in addition to the location, it also knows where the user was, where the user wants to go and how the user would go there (Take bus, drive, walk etc). That, is high quality data (Better than a Niantic game could provide) that generates profit directly.

All the reasons combine, I think I still have some doubts about that business model.

<comment><USER16> A couple points here.

First, you get data about how pedestrians can reach all the truly popular locations. If you also get extra data about how pedestrians can reach various irrelevant locations, okay, that doesn't have value but that's not harmful; what matters is that all kinds of niche landmarks that would be interesting to tourists are somewhere in your data.

Second, people making a detour from their normal day-to-day route to reach some location is the whole point - these are local people with knowledge of how their city works; you don't want to measure how tourists usually get from landmark A to landmark B; you'd want to see what shortcuts an optimizing local would take when getting from landmark A to landmark B - which is different than simply looking at random people walking habits with no intent to optimize the route; the gamification provides an incentive to optimize routes and allows you to harvest the knowledge of that optimization.

If someone tells google maps that they want to go from A to B, and google maps tracks how they got there, then it doesn't harvest any information about the best route because the user doesn't know it, they wanted a recommendation and likely tried to follow it even if it's very suboptimal, so you'll just get a reprocessed version of the data you already had (and gave to that user). On the other hand the data from Niantic is useful so that Google maps can make a _better_ recommendation.

Third issue is that the Niantic process also allows you to detect undesirable routes. If Google maps directs a tourist from A to B through a shortcut that's passable but unpleasant in some manner, then they'll take that route; and if they send another one there, they'll also go there, because they don't know better and the alternatives are (probably) not obvious. You'll only get a signal of people not going there if it's _really_ bad e.g. impassable.

Niantic, however, can detect that most people who want to go from A to B (because of game incentives) but who _know_ all the routes from A to B (instead of asking for directions like the google maps usecase) are intentionally taking a longer route for whatever reason - which is again useful data for improving Google Maps recommendations.

</comment></comment></comment></comment></comment></comment><comment><USER17> An important point is that it doesn't just passively collect location data, it actively moves players to locations.

<comment><USER18> Yes, there have been instances where people have been trying to put portals into fenced off locations such as army bases or shipping yards. Useful to learn about what's there... and those pictures could be useful in conflicts too.

[https://community.ingress.com/en/discussion/comment/19749](https://community.ingress.com/en/discussion/comment/19749) [https://community.ingress.com/en/discussion/3117/portals- in-...](https://community.ingress.com/en/discussion/3117/portals-in-military- bases) [https://www.reddit.com/r/Ingress/comments/alenbc/portal_in_r...](https://www.reddit.com/r/Ingress/comments/alenbc/portal_in_restricted_military_base/)

</comment></comment><comment><USER19> I really cannot imagine being surprised about this

<comment><USER20> "Wow! That is surprising!"

I gave it a shot. How did I do? It isn't very surprising no, I think the author just added that in to add a nefarious tone to the article.

</comment></comment><comment><USER21> > "If you have mobile computing and services people are using while moving > around in the world," said Hanke in a 2016 talk to the Berkeley School of > Business, "the question we asked ourselves was, 'Could these services > influence how people behave in the physical world? Could the products > they're using cause them to walk a different path, drive a different path, > divert from the trajectory that they're normally going to go on? If you > could do that through information services that you're offering to people, > there's tremendous opportunity for businesses that might want to change the > behavior of people to get them to go places where they wouldn't otherwise > go." He added: "We were also interested in being an advertising company."

I think it's crystal clear where this is going. Why you would even bother giving the excuse of "we accidentally added code to collect all this random metadata about you, sorry about that" given this is beyond me.

<comment><USER22> In case you forgot, Hanke was already working for the biggest advertising company in the world when he had that brilliant insight.

</comment></comment><comment><USER23> An free-to-play mobile game that requires GPS location to work collects location data. Also at 11, water determined to be wet.

<comment><USER24> Well not only that, but the whole game mechanic is that you have to get close to specific points of interest in order to activate them. Obviously for the game to work, they need to know you are at said point of interest...

It's like accusing the airline you used to knowing where you traveled to...

<comment><USER22> It's an observation, not an accusation.

And you missed the part where the airline makes most of it's money from passengers paying to be moved around, whereas Niantic makes nearly $0 from anything players give them money for.

<comment><USER2> >Niantic makes nearly $0 from anything players give them money for.

I am under NDA so all I can say is that publicly available data (sensortower or appanie for example) says Niantic has received literally billions of dollars from in-app purchases from players. This may or may not be correct but the amount is likely not "nearly $0"

<comment><USER23> Never underestimate how much people will spend on fancy hats (See Fortnight & Dota)

</comment></comment></comment></comment></comment><comment><USER15> There's a pokemon stop in the center of the pentagon courtyard area. You can pretty much only get there as a visitor or as someone related to the government / military.

If you want to talk about a really easy way to create a tracking system for senior military officials, just mark their young aides and you'll be able to find them internationally.

<comment><USER22> The military has been wrestling for years with the problem of troops broadcasting their movements to the world, intentionally and accidentally.

<comment><USER25> Centuries, indeed.

</comment></comment></comment><comment><USER26> I don't mean to be glib but this is a surprise to who exactly? I only know Niantic from Pokemon Go (which requires your GPS to be enabled, presumably) and they're owned by a company whose entire business model is data collection for targeted advertising. I'm not sure this is a particularly surprising outcome for a 'free' game if I'm totally honest.

</comment><comment><USER27> "Surprising"

</comment><comment><USER28> [https://www.networkworld.com/article/3099092/the-cia-nsa- and...](https://www.networkworld.com/article/3099092/the-cia-nsa-and-pokmon- go.html)

</comment><comment><USER29> this was pretty known, I'm astonished that just _now_ it was made "public"</comment>