OwnLocal (YC W10) acquires Squarespace competitor to help newspapers - <AUTHOR> http://venturebeat.com/2015/03/10/ownlocal-buys-site-builder-sidengo-to-help-turn-local-print-ads-into-digital-marketing-campaigns/

<comment><USER2> "OwnLocal (YC W10) acquires Squarespace competitor to help newspapers"

I find it funny that the acquired company is so insignificant that it is easier to refer to it by it's competitor.</comment>


So you wanna buy a used IP address block? - <AUTHOR> https://blog.strom.com/wp/?p=7561 <comment><USER2> Interesting. My ISP has been obviously buying new (used) blocks and it is a total nightmare. They bought a block which must have been used in China in some way a year of so ago. Suddenly every site thinks you are in China, prices start coming up in CNY and various georestictions apply.

Luckily you can power cycle the router and get a new IP quickly.

It's interesting as I imagine a lot of people (me included until I hit this) did not put updating GeoIP databases high on their priority lists, but it is a total pain when you're on the other side of it.

</comment><comment><USER3> I have a /24 (aka class C block) I registered back in the 90's. I currently have it routed over my business internet connection. It predates ARIN, and is considered a "legacy" block and requires no fees. I consider it personal asset and not worth selling.

<comment><USER4> Is this common? Might be a bit slow here but this sounds like hoarding.

<comment><USER5> I can only wish that I had this, but if I did, I'd absolutely keep it. I'd love to give every device on a home network a publicly-routable address. No more port forwarding, no more NAT garbage. On the other hand, I know a guy who got a /24 way back when; I think he just gave it back at some point, though not 100% sure.

<comment><USER6> It gives you some overhead on security side if you're concerned about it since you will need to filter incoming traffic once you device network interface becomes routable from internet.

<comment><USER7> No, it doesn't. NAT does not prevent inbound connections, only a stateful firewall does, and if you do have that, then NAT does not add anything.

<comment><USER8> So how are you, with your publically routed IP of (for example) 126.96.36.199 planning to connect to the GP, who has (for example) a public egress IP of 220.127.116.11, but is in fact using NAT, and his desktop's real IP is 192.168.1.20? I feel like you might be trying to point out that NAT devices _can_ be configured to forward all traffic to some backend device - while true this is disingenous because they are basically always not configured like this.

I realise NAT is unpopular with networking purists, but trying to claim that it doesn't prevent inbound connections seems to be overstating your case quite severely. I'd also note that if your firewall is stateful or not is irrelevant for the point you were trying to make - oldfashioned stateless firewalls can also block inbound connections just fine.

<comment><USER7> > So how are you, with your publically routed IP of (for example) 188.8.131.52 > planning to connect to the GP, who has (for example) a public egress IP of > 188.8.131.52, but is in fact using NAT, and his desktop's real IP is > 192.168.1.20?

By sending a packet to them that has the destination address 192.168.1.20?

You seem to be making the assumption that the only way to send a packet to the WAN interface of a NAT router is through the public internet. While being able to do that widens the attack surface, it absolutely is not the only way, and your threat model is broken if you assume that it is.

> I realise NAT is unpopular with networking purists, but trying to claim that > it doesn't prevent inbound connections seems to be overstating your case > quite severely.

No, that belief is one of the big myths that keeps people configuring insecure networks.

> I'd also note that if your firewall is stateful or not is irrelevant for the > point you were trying to make - oldfashioned stateless firewalls can also > block inbound connections just fine.

That's true and it's not. Of course, you can block all connections with a stateless firewall, and thus obviously also block all inbound connections. But a stateless firewall is very limited in selectively blocking specifically inbound connections across random protocols, and especially so if it doesn't know detailed information about your network and services to infer what constitutes a packet establishing a connection, while with a stateful firewall you can essentially just say "drop inbound connections" without any further details about your networks, and it'll do a good job at it.

Plus, you could argue about whether, for example, dropping TCP SYNs but forwarding all other TCP packets actually counts as "blocking inbound connections", given that tons of potential "inbound packets" will be forwarded to your internal systems and you really rely on your internal systems not accepting any of them as "establishing a connection" or possibly just being vulnerable to those "inbound but not establishing a connection" sort of packets.

<comment><USER8> Perhaps you could expand on the threat model you're talking about where you, as a remote attacker, can somehow get a packet with an RFC1918 dest IP sent to the WAN port of your intended victims home router.

It's perhaps worth pointing out that this discussion is very much in the context of a home network, so well-actually arguments about "maybe I have a GRE tunnel set up to this random users home router" or "maybe I'm their ISP and want to break into the router I supplied them with" won't really carry much weight - you mentioned the concept of a broken threat-model, but a threat model needs to be grounded in reality, and the reality is that unless you go _far_ out of your way to do silly things NAT is a reasonable and practical protection for home users against accidentally exposing services on their network to the internet at large.

<comment><USER7> > Perhaps you could expand on the threat model you're talking about where you, > as a remote attacker, can somehow get a packet with an RFC1918 dest IP sent > to the WAN port of your intended victims home router.

The threat model is really simple: If it's not under your control, then you shouldn't needlessly rely on it for security. And from the point where the wires leave your house, it's not under your control.

A random selection of possible attack scenarios:

\- Hooking up a DSLAM to your DSL somewhere along the path to the CO.

\- Compromising your ISP's edge routers through vulnerabilities/hard-coded passwords.

\- If your router happens to also announce its RFC1918 prefix to the outside world and your ISP's misconfigured edge routers propagate those routes in their access network, being your neighbour might be enough.

\- If your ISP is incompetent at configuring VLANs so you end up in the same VLAN as other customers in your area, again, being your neighbour might be enough.

(And yes, those are things that have happened.)

> It's perhaps worth pointing out that this discussion is very much in the > context of a home network,

Except it really isn't. For one, the context was the home network _of someone who would prefer to assign a public prefix on their home network_. That is probably very much not the kind of stereotypical home network that is generally meant when you speak about "a home network" (i.e., a bunch of consumer devices on a WiFi). And also, the distinction really is only relevant in so far as specific home networks generally are not targeted, but that doesn't really change that it's still a bad idea to completely unnecessarily have a NAT run without a stateful firewall (the NAT needs to keep all the state that the firewall needs to keep anyway), and that as soon as you do have that firewall, NAT does not add anything at all.

So, yes, it might be that in some particular setups NAT without a stateful firewall is good enough for your particular needs. But that doesn't change that the general idea that "NAT prevents inbound connections" needs to die, because it is (a) far from true in the general case and (b) even where/in so far as it is true, you are almost always better off with a stateful firewall instead, so it's a bad rule of thumb both because you actually have to understand the limits of where it applies to not end up vulnerable and because the alternative actually works better with no downsides, except in rare circumstances, and even then, it's only an economical downside (namely: buying a new device that does things properly instead of using what you already have).

<comment><USER8> Couple of points: Most of those vectors would represent extreme levels of paranoia for the average home user. If you have sufficiently motified and skilled adversaries that they are prepared to start hijacking your DSL connection, you're probably screwed before you start.

Secondly: I never said you shouldn't also have a firewall - indeed basically all NAT routers are also firewalls, and both are active by default. The added protection NAT offers is that even if an inexperienced user accidentally opens up too much in their firewall, it's unlikely that this will make their internal home network publically accessible because ordinarily attackers aren't going to be able to send packets there. This is a real and useful feature for users who don't count the Mossad in their home network threat model (which is likely almost everyone reading this).

<comment><USER7> > Couple of points: Most of those vectors would represent extreme levels of > paranoia for the average home user.

That's not really a useful measure, though, because this can be said about every single vulnerability used in a mass compromise up to the second when that mass compromise happens. The difference between "extreme levels of paranoia" and "common sense security practice" is someone somewhere deciding to use that particular vulnerability in some malware because random circumstances made a bunch of vulnerabilities that individually are kinda useless align to make an exploit chain.

> If you have sufficiently motified and skilled adversaries that they are > prepared to start hijacking your DSL connection, you're probably screwed > before you start.

Yes, that is probably true. But for one, that's not the only option I listed, and also, it doesn't change that the blanket statement "NAT prevents inbound connections" is not true and is easily misapplied by people who do not understand the details. Notice how noone ever says "NAT prevents inbound connections well enough for low-value targets, kinda"? And so, people actually believe that it does and then set up vulnerable company networks.

> The added protection NAT offers is that even if an inexperienced user > accidentally opens up too much in their firewall, it's unlikely that this > will make their internal home network publically accessible because > ordinarily attackers aren't going to be able to send packets there.

Talking about contrived examples ... in consumer devices, you rarely can actually configure firewall rules? What you can configure is "port forwarding", and that then automatically implies that tt is actually open not not just NATted. So, at best that applies to inexperienced users setting up somewhat professional equipment, presumably in a context where security matters a bit more and targeted attacks are more likely, and where the belief that "NAT prevents inbound connections" now actually puts them at risk?

edit: And not only does it put them at risk, it also makes it hard for them to notice that they are vulnerable. If you have a firewall without NAT, it's trivial to check that inbound connections are refused. If a random access from anywhere on the internet is rejected, then your default DENY rule is probably effective. With NAT, not so much.

<comment><USER8> > That's not really a useful measure, though, because this can be said about > every single vulnerability used in a mass compromise up to the second when > that mass compromise happens.

No. The difference between the vectors you described and "mass compromise malware" is that your vectors are targetted at one (or a very small number of) individual user(s), who are probably screwed either way, if a skilled attacker _really_ wants to mess with them this badly. There is no realistic way to hijack DSL connections en-masse, and an attacker skilled enough to compromise an entire ISP to the point they can start doing these sorts of things has far better options available to them than anything we're talking about here. There's a huge difference between mass-deployed malware and complex targetted attacks, which is a point you seem to continually miss in this thread.

> it doesn't change that the blanket statement "NAT prevents inbound > connections" is not true

More verbosely this could have been expressed as "NAT prevents inbound connections unless you have a NAT device that for some reason accept incoming packets for which it has no session and pick a device on the private network to route these packets to, not to mention the difficulty of getting those packets there in the first place". This "unless" is not normally needed though, as this is widely regarded to be a sufficiently difficult thing to achieve it's not worth mentioning.

>in consumer devices, you rarely can actually configure firewall rules?

On every consumer firewall/NAT box I've ever seen, it was possible to configure firewall rules. Perhaps this is a regional difference?

I also note that although you've presented a couple of ways you might be able to send arbitrary packets at the public IP of the NAT device (although I strongly dispute how practical they are), this isn't yet sufficient to manage to connect to arbitrary machines behind the NAT device - you must also find a way to force the NAT device to accept packets for which it has no existing session. Otherwise you're really just limited to things like tcp hijacking to try to MiTM a session - something you can likely do regardless of the presence of a firewall, if you really care enough.

<comment><USER7> > There is no realistic way to hijack DSL connections en-masse

So, exactly what people always say exactly up to the point where someone demonstrates the exploit chain?

> and an attacker skilled enough to compromise an entire ISP to the point they > can start doing these sorts of things has far better options available to > them than anything we're talking about here.

So ... exactly what people always say exactly up to the point where someone launches some malware?

> There's a huge difference between mass-deployed malware and complex > targetted attacks, which is a point you seem to continually miss in this > thread.

Except there really isn't. Yes, obviously there is a difference, but you can't measure how well an attack _can_ be scaled based on how well it _has_ been scaled. Now, deploying rogue DSLAMs sure is really impractical to scale, so that's not a concern other than for targeted attacks. But abusing misconfigured ISP networks might very well be easy to scale under the right circumstances. Mind you that the attacker doesn't have to be an actual neighbour, it might very well be enough to compromise one machine in a neighbourhood and then start attacking the neighbourhood from there, and if this is a misconfiguration of a large ISP, you might be able to just leverage an existing bot net to compromise large parts of their customer base.

> More verbosely this could have been expressed as "NAT prevents inbound > connections unless you have a NAT device that for some reason accept > incoming packets for which it has no session

May I rephrase this slightly for clarity?

"NAT prevents inbound connections unless it doesn't happen to be paired with a stateful firewall."

Erm ... yeah, thanks for making my point for me? Except the actually non- confusing way to put this is "NAT does not prevent inbound connections, but stateful firewalls do", obviously.

> and pick a device on the private network to route these packets to

Could it be that you just don't even understand the attack? This sounds like you think that the owner of the router would have to explicitly configure a target that could be attacked or something? If that's how you understand it, you might want to brush up on how IP routing works.

> This "unless" is not normally needed though, as this is widely regarded to > be a sufficiently difficult thing to achieve it's not worth mentioning.

Erm ... in other words: People are generally mistaken about this? Yeah, I agree.

> On every consumer firewall/NAT box I've ever seen, it was possible to > configure firewall rules.

As in, if you want to make some internal service publicly reachable, you have to separately set up a "port forwarding rule" and a "firewall rule"? That sure is how professional equipment/software does it, but not something I have seen in home routers in a long time.

> I also note that although you've presented a couple of ways you might be > able to send arbitrary packets at the public IP of the NAT device

No, I haven't. I have been talking about sending packets to the private IP addresses, the public IP address is completely not involved in any of this.

> this isn't yet sufficient to manage to connect to arbitrary machines behind > the NAT device - you must also find a way to force the NAT device to accept > packets for which it has no existing session.

Yeah, it seems like you don't understand IP routing or how the attack works.

No, you don't. You just don't. That's not how NAT works or how IP works. __Unless there is a stateful firewall on that device, in which case removing the NAT does not change anything about being able to establish inbound connections. __

To take the example of a common VLAN with your neighbours: What you need is the MAC address of the WAN interface of your neighbour that you want to attack. You might be able to just guess it, or you could find it via an ARP request, or maybe you just can see some random packets leaking from the switch. Then, you send an IP packet with your public IP address as the source IP address and your MAC address as your source MAC address to their MAC address as the destination MAC address and their internal IP address as the destination IP address. Their router, being an IP router with NAT but without a stateful firewall, will check their NAT state for the connection, not find it, check NAT rules, not find any either, therefore not rewrite anything, then do a routing table lookup which says that it should be delivered on the LAN interface, and then, potentially after an ARP lookup, deliver it to the LAN. That just is how IP works. Again: __unless there is a stateful firewall on the device __.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> My first thought when I read this was, "Why would you sell a /24, it's so valuable!". This was after reading that the whole thing is worth maybe $6,000. Which in the grand scheme of internet things, isn't that much.

But I guess they just aren't as valuable as I thought. Or the price is coming down now that ipv6 is viable.

I wonder what the peak per ip price was.

<comment> CKN23-ARIN I bought a /24 3 years ago (from the same broker as OP) for about $3500. The price is still increasing.

<comment><USER9> If $6,000 really is the peak then I've been severely overstating the value of an IPv4 address for a long time. :)

<comment><USER10> Well, the market's been active for a while now, feel free to park your money in underpriced ipv4 if you want.

<comment><USER11> I think the idea is not that ipv4 is underpriced, but not worth as much as we thought...

</comment></comment></comment></comment></comment><comment><USER12> A little history: I got an /24 in the early 90s, it was how you got on the internet back then, you sent an email to a well known email address and they sent you back a class C, no money changed hands, you couldn't get anything smaller. Also almost no one had firewalls, your subnet was open to the world.

Last month I got an out of the blue offer for the class C I registered for a startup I worked for about the same time ~3k I'm still the technical contact, the company is long gone, a drawer in a filing cabinet in a lawyer's repository somewhere, it's probably the company's largest asset now

<comment><USER13> Company IP that the lawyers didn't screw down.

</comment></comment><comment><USER14> Please jealously hoard your IPv4 blocks to make migration to IPv6 more attractive.

<comment><USER15> I heard somewhere that some developing countries as basically ipv6 only since there is no reasonable/economical way for them to get ipv4 connectivity, so maybe the problem will take care of itself as more and more people in the world come online. People have money and as long as it makes economical sense to serve more people, ipv6 will win in the end.

</comment></comment><comment><USER16> From the article:

(1) Rent for $0.20-1.20/mo - or -

(2) Sell for $20-24

Sell/rent ratio is 17-120 months. These numbers seem very different than for real estate. It's as if the cost to rent a $1M property could be as high as $60k/mo. Not really sure what to think of it, perhaps the comparison is too simplistic.

<comment><USER17> I think this implies that IP addresses are expected to be a worse investment than property? Landlords would probably be more willing to sell their land if it didn't appreciate. Conversely higher rents would be needed in order to justify holding land that depreciates.

The other possibility I can this of is that renting the block might have greater liabilities compared to outright selling it.

<comment><USER18> Right. Most of their value is in the short-mid term. At some point everybody will be using IPv6 and these old addresses won't matter much.

<comment><USER19> Ha, been hearing that exact idea since the 90s when I got on the net. ip4 will become increasingly valuable until the day it goes to almost 0. This discussion makes me want to invest in some.

</comment></comment></comment></comment><comment><USER20> I have six internet connections at work. 4 x /29 + 2 x /28 and a /26 on top of one of the others. I also have six IPv6 allocations.

Anyway, there is absolutely no real value in IPv4. You should always be able to find a small chunk somewhere. A proxy will work wonders with one IP.

Lack of imagination, or expertise will make IPv4 very expensive when it becomes scarce but unlike a diamond ...

<comment><USER21> IPv4s are absolutely needed if you're an ISP/hosting provider or if you run something else than HTTP where there's no concept of "Host" header and it's assumed that 1 IP/port == one instance of the server.

<comment><USER22> I really wish HTTP and other protocols embraced SRV records.

<comment><USER23> Hope is on the horizon:

[https://tools.ietf.org/html/draft-ietf-dnsop-svcb- httpssvc-0...](https://tools.ietf.org/html/draft-ietf-dnsop-svcb-httpssvc-01)

</comment></comment></comment></comment><comment><USER24> If they had gotten a Class B block instead, it would be worth a cool $1.3 million at the same price point.

Anybody got a figure for how much a Class A would cost these days in the unlikely event of one being up for sale? The straight-line-extrapolation $300M seems a bit high.

<comment><USER25> Amazon bought 188.8.131.52/10 for "over $50M" so a /8 would be worth over $200M.

<comment><USER26> Any reason Amazon would pay more for larger blocks instead of soaking up many small blocks? Shouldn't VPS providers care less about having fragmented blocks?

<comment><USER27> Lot more overhead for their teams to find and buy as /10 then lots of /20 . Also they publish ranges for whitelisting etc easier with fewer ranges for customers

</comment></comment></comment></comment><comment><USER28> Is it possible for an individual to purchase a IPv6 block?

<comment><USER29> Yes it appears so. But there seems to be a few requirements [0].

Also bear in mind a /64 is more than 18 quintillion addresses so it might be a bit more expensive. And it appears they only offer /48's to individual businesses if they meet the criteria but that is still billions of IPs.

[0]:[https://www.arin.net/resources/guide/ipv6/first_request/](https://www.arin.net/resources/guide/ipv6/first_request/)

<comment><USER30> /64 is just normal allocation that every home connection should get. (/48 in this notation is bigger) Given these amounts of addresses subnetting philosophy is quite different from IPv4.

<comment><USER29> I completely forgot about that difference with IPV6 and IPV4. You are right. There are still many thousands if not millions of addresses available to those who want them. And compared to IPV4 everyone on the planet could have a /64.

Here is a decently comprehensive serverfault post[0] on the subject of IPV6 subnetting.

[0]:[https://serverfault.com/questions/426183/how-does- ipv6-subne...](https://serverfault.com/questions/426183/how-does- ipv6-subnetting-work-and-how-does-it-differ-from-ipv4-subnetting)

</comment></comment></comment></comment><comment><USER31> What are the practical differences in registering a block with ARIN vs APNIC vs RIPE? If one buys a legacy block does one have to transfer it to ARIN?

<comment><USER32> Different registries have different policies about where the registrants are located. It's least complicated to manage blocks that are in the registry appropriate for your entity's location.

That said, I thought all of the legacy blocks were ARIN blocks, since they actually predate ARIN and the regional registies; but ARIN took responsibility for managing them. (I could easily br wrong)

</comment></comment><comment><USER33> Is there any ongoing cost to staying registered with ARIN or any other registry if you own a block like this?

<comment> CKN23-ARIN ARIN registration fees start at $250/yr for a /24\. [https://www.arin.net/resources/fees/fee_schedule/#service- ca...](https://www.arin.net/resources/fees/fee_schedule/#service-categories- and-fees-1)

</comment></comment><comment><USER34> Sounds interesting, anyone investing using IP blocks? Seems like it would be an weird non-correlated asset with maybe some tax advantages? How would depreciation work for IP blocks?

<comment><USER25> The hippie powers that be consider IP speculation to be immoral hoarding and try to prevent it. Somewhere I saw projections that prices will rise for the next few years then start to fall (but I also saw projections of BTC going to $100K so YMMV).</comment></comment>


Ask HN: New Year resolutions and programming/coding projects - <AUTHOR>

It's New Year again. I'm trying to come up with a list of programming-related projects for the next year as a part of my list of things-to-do-for-next-year. Do you have any programming/hacking ideas (even something like "Learn Haskell") that you want to pursue for next year? Please share! <comment><USER2> Learn Haskell! I've been using learnyouahaskell.com, book.realworldhaskell.org, and haskell.org/haskellwiki. If you get stuck, the people who hang out on #haskell (freenode) are both helpful and brilliant.

Learning Python and Scheme was fun. Learning Haskell feels like being in an 80s training montage. One day you're a nobody, the next day you're an FP- wielding superhero.

<http://www.haskell.org/haskellwiki/Applications> is good for inspiration.

<comment><USER3> A friend and I recently just started learning Haskell, and as our first project we are going to implement the kademlia DHT algorithm ( <http://en.wikipedia.org/wiki/Kademlia> ). If anyone wants to learn some Haskell and work on a dht algorithm, feel free to shoot me an email or message me on github. The repo for the project is at <http://github.com/johngunderman/buckets-dht> .

On a side note, I'm learning Haskell through the book Real World Haskell, and it is the best resource I've found so far (I've looked through "Write yourself a scheme", "learn you a haskell for great good", and "Yet another Haskell Tutorial"). Of course, it is the first one I've actually had in printed form, and that probably made a huge difference.

As you mentioned, #haskell has been a tremendous resource. I would highly recommend anyone interested in learning haskell to lurk on that channel.

</comment></comment><comment><USER4> Flightcaster's Clojure => Cascading => Hadoop infrastructure has been tempting me. Starting with Clojure I'm working my way down the stack in hopes that I'll garner insight as to how we can use this infrastructure or something similar on our own datasets.

Statistics with Incanter is another piece of this pie that seems interesting and valuable. Hopefully I'll have written something useful with these technologies by this time next year.

</comment><comment><AUTHOR> I'll start with my own. One of the projects that I'd like to work on, is to build a site with PHP,MySQL and JQuery. It's a really simple idea, but I want to learn JQuery properly and there's no better way to learn a library than to build something that uses it.

</comment><comment><USER5> Create a 'Django' for Lisp!

</comment><comment><USER6> Learn Scheme. I've been coding along with "The Little Schemer" over the break.

I feel like I need a fresh perspective before I can approach Clojure -- otw I'll just end up writing a bunch of Java with parens.

<comment><USER7> I learned a little bit of Common Lisp early in the summer and dabbled a bit with Scheme the last few months; my resolution has been to learn Scheme, honestly, alongside _The Little Schemer_ and _The Seasoned Schemer_. So, kudos and good luck!

</comment></comment><comment><USER8> Stop trying to tackle very difficult problems and launch my damn site at last!

<comment><AUTHOR> What kind of site are you building?

For me, it's about "stop spending all my time on that one boundary condition that 0.1% of the users will hit" :)

<comment><USER8> I'm building a utility site for players of a very niche MMORPG.

It will let players of that game analyze their current situation and environment better and let them communicate with allies more effectively.

I've been "working on" that project for the last 3+ years but in fact I've been mostly "screwing around" learning Common Lisp and learning/implementing some advanced algorithms like rete and implementing some advanced web framework that I'll release as open-source in a few years but not before I implement some of the crazy ideas I have that will enable a completely revolutionary way of developing web apps.

</comment></comment></comment><comment><USER9> Get some more traction for <http://BuyersVote.com>

It's stackoverflow but for product reviews, critical mass is getting there but not quite. I have some other features I want to add like "awards" which show off the best and worst rated products of the year, month, etc. It would be fun to publicly shame bad products/companies.

<comment><USER10> As someone who bases a number of purchasing decisions on online reviews (mainly amazon.com and productreview.com.au) , may I offer some feedback

It looks like you're trying to make things as simple as possible, but I feel you really need some way for people to rate things other than good/bad (up/down in your case). You need a way for someone like me to be able to see that product A is considered better than product B, and no, number of up votes doesn't do that. All it tells me is that more people purchased item A and thought is was not rubbish. This may mean the product has been on the market longer, or just has better marketing. Seeing that 50 people gave product A 3 stars, but 10 people gave 5 stars to product B carries more information

Being able to see the distribution of votes is also important. Some products are divisive, with some people loving them (5 stars) and others hating them (1 star), and other products are just uniformly considered average (3 stars). Showing this distribution also tells me more about the product than just showing me products C and D both average 3 stars

Reviews. No idea how you'll do this, but you absolutely need a means of encouraging people to write good informative reviews. Allowing users to rate reviews seems to work for some places, and productreview has some sort of rewards scheme based around reviews. Given that no product is perfect, it's a well written review that allows me to see what the faults are and figure out if they're likely to be an issue given the way I intend to use it. It's the reviews that flesh out _why_ some users gave a product 2 stars and others gave it 5. If, for example, I wanted to buy a mobile phone and I could see that the people who rated it 1 star did so because the sole carrier in that country has lousy coverage I'd know that didn't affect me as I have (being in Aus) 5 different carriers from which I can purchase said phone.

Oh, I like the clean layout of the site. looks good.</comment></comment>


Ask HN: How can I stop receiving spam phone calls? - <AUTHOR> Hi HN!
I get between 2-5 spam phone calls every day. Often, the callers' numbers have the same area code as my own number. I believe the calls are automated there are many identical messages and on the occasion that I do answer, it's usually a recording.
I've blocked dozens of phone numbers but the calls and voicemails don't stop. I keep my phone perpetually on "Do Not Disturb" excepting calls from favorites and repeat callers. Sometimes I pick up the phone and repeat "Put me on your do-not-call list" a couple times. Sometimes the recording says to press a number to stop receiving calls, and I do that as well. I've also added my number to https://www.donotcall.gov/
Nothing seems to do the trick. It's really annoying and time-consuming to check my voicemails for real messages. The red notification badge is no longer a useful way to know if I've missed a call from someone I care about.
I don't want to get a new phone number either, and I don't know if that would even solve the issue.
What can I do? <comment><USER2> Founder of Nomorobo here. We put a stop to all of those annoying robocalls, telemarketers, and spam/scam calls and texts. It's about the only thing that works nowadays.

It's not your imagination - these types of calls are out of control. According to our data, 40% of all calls made in the US are illegal, unwanted spam/scam robocalls. And those "neighbor" spoofed calls (same area code and extension) are especially prevalent now. Beginning last summer, they started to account for ~20% of all robocalls. Before that they were only about 2% of all robocall volume.

The Do Not Call list is almost completely ineffective against these types of calls. It was created 15+ years ago to stop legitimate companies from telemarketing. But today's robocallers are criminals that don't really care about the law. They have one goal - scam people and take their money.

Manually blocking calls will also get you nowhere. And please, for the love of god, don't press a number to get on their alleged "do-not-call" list. That will guarantee that you will get even more robocalls - they know you're a live number now.

On the technical side, our landline service (free) is powered by Twilio and our mobile product is available in both app stores (14 day free trial, $2 bucks a month after that). We're a PHP/Laravel shop and our team is completely remote.

To do the actual detection, our algorithm analyzes over 70M calls per month and adds over 1,300 new numbers to the blacklist every day. We built the world's largest commercial telephony honeypot (300k+ lines) and can detect new attacks within minutes of them starting (even with spoofed numbers). Just last month, Nomorobo stopped over 27 million from reaching people's phones.

I'm happy to answer any other questions that you have about robocalls. I'm kind of the "robocall guy". I won the FTC Robocall challenge back in 2013 and grew Nomorobo to be the leading robocall blocker on the market. I've even testified in front of the US Senate about the robocall epidemic.

<comment><USER3> T-Mobile offers a spam blocking service that stops calls from reaching my phone, because of that there's no way for me to gauge just how many are being blocked. What is your take on network level spam filtering?

You're blocking 1300 numbers a day. I assume the spammers rotate numbers, so if someone gets a recycled number that was on your list, what happens?

These spammers get connected to the telephone system somehow. Is there nothing that can be done to force the telecom providers to more carefully check the companies they lease mass lines to?

I tried your service before, but the calls spoofed as if they come from my area code and exchange were never blocked. Why is that?

Spam calls infuriate me like little else. I'm glad you're working to stop them but it seems to be something that will require a larger industry and/or government intervention.

Thanks for sharing any insight you have!

<comment><USER2> The spammers rotate through new numbers every few hours. We're actually _adding_ 1,300 new numbers per day and the full blacklist is over 700k entries.

As for getting connected to the phone system - Yeah, they have to jump on the phone network somewhere and, in theory, the best way to stop these guys would be to at the ingress point.

The problem is that the phone system is built for interconnection. Even just one bad actor letting the traffic on spoils the system. Layer on top of that the way the network routes calls through multiple hops through multiple carriers and tracking the calls back to the source is nearly impossible. Throw in common carrier regulations (you can't just willy nilly block calls coming over the network) and it amps up even more. Finally, allow all this to be done for fractions of pennies and you get the perfect storm for robocalls.

As for the neighbor spoofed calls, make sure that you enter your phone number in Nomorobo so that we can make sure we protect the correct number block ([Area Code]-[Exchange]-[0000-9999]). In our initial release, we were only able to identify these calls but not block them. It had to do with blocking calls from families with sequential phone numbers. But, in our last release, if you give the app contact access, we can now scrub those numbers and fully block the neighbor spoofed calls.

It's been a bit of a balancing act between being privacy conscious (not needing your email/phone number/invasive contact access) and getting the job done. The balance that we've struck is this - you don't have to give us any of that and you'll get really good protection. But, if you try out the service and start to trust us more, we can do an even better job.

And finally, yes - it's going to take a lot of effort to tackle this problem. While Nomorobo isn't perfect - admittedly, the sim ring landline version is just a crazy hack that the carriers can't stop - the past 4 years have seen some great progress in the fight.

As more and more people become aware of robocall blockers and we show that it's actually a very safe way to protect people, only then will the larger industry come along (kicking and screaming the entire way).

<comment><USER4> I've been a nomorobo customer for a long time, and I've had my full phone number entered in the system from day one. And you've had access to my contacts, too.

However, I still get the neighbor scam calls, and it's one of the most annoying things I deal with on a daily basis.

I've been thinking that I should write my own whitelist-only call screening app on top of twilight, and maybe becoming one of your biggest competitors.

That is, unless you want to take this idea and implement it yourselves, and saving me the trouble. ;)

</comment></comment></comment></comment><comment><USER5> I had the same problem a few months ago before I set up an automated virtual assistant to pre-screen calls[1]. It works with my existing phone number by forwarding all inbound calls to a small Linode box which plays an audio prompt and listens for specific keywords. (Whitelisted numbers get patched through immediately.)

Since I made that post, the system has filtered 100% of the spammers and 0% of my actual contacts. I think the non-bot spammers started to get sick of hearing my audio prompt because the number of spam calls that come in has dropped dramatically.

[1] [https://andrewchidden.com/defeating-spam-callers-with- speech...](https://andrewchidden.com/defeating-spam-callers-with-speech- recognition-and-call-forwarding/)

<comment><USER6> Impressive integration experiment! Is your phone line busy during call forwarding? Would it possible to package all this in mobile app instead? There is some Speech API available and maybe call control/recording too, but I am not sure - not an IOS dev.

<comment><USER5> Thanks! I think Google Voice has two lines in, so it'd return a busy tone when I'm in an active call with someone (one line for each person to do the call merging).

>Would it possible to package all this in mobile app instead?

Unfortunately the limiting factor would be background processing here; iOS isn't permissive enough to really replace the server. I think it might be possible by using a background service on Android though.

</comment></comment></comment><comment><USER7> Track them down and sue them in small claims court. I've collected nearly $10,000 doing this.

Short story: calling your cell phone with automated dialing equipment and automated messaging ("press 1 to talk to someone") is illegal per the TCPA. I'm not a lawyer but it's fun to be amateur attorney for a day. Definitely a time suck though...

<comment><USER3> Have you perhaps written about your experience doing this? I'd love to read about it.

<comment><USER8> Here's a presentation I found to get you started:

[https://s.ai/presentations/tcpa.pdf](https://s.ai/presentations/tcpa.pdf)

</comment></comment></comment><comment><USER9> The company is called NobelBiz and they call the technology LocalTouch which they've patented and claim to be the industry's only legal "solution" to the TCPA.

Here's their page detailing how they rotate through buckets of local numbers to present a new one on each attempt: [http://www.nobelbiz.com/solutions/telco- services/localtouch-...](http://www.nobelbiz.com/solutions/telco- services/localtouch-boost-contact-rates/)

I got to meet these shitlords not too long ago and one them explained how the local calls were great for collection agencies since the poor bastards thought the agency was just down the street. They're also regularly in court defending their patent (google for "NobelBiz v."). So you could call them to report the spammer, they might be able to add your number to their blocklist, or in the case the number isn't operated by one of their customers then they should be interested as it would indicate another company to sue.

</comment><comment><USER10> I don't receive any spam call at all, but many scam calls.

I once got an Indian Dell "virus" guy to be mad at me after 1+ hour when I got him to my VMWare Windows XP with a super inappropriate wallpaper -- before that I just told him to hold because I need to get my laptop from another building, need to poop, asking stupid questions, etc, and went back to work and pick up the phone after 25-30 minutes as a break. But the lower-tier guys often don't understand many references and attempts that you trick them, so it's not as fun as you thought. After a while, I got kinda bored, because they actually fell for my bait too easily. Tier-1 guys are garbage, if you want to have fun you have to bait them to give you tier-2.

I got a fun call last time.

I have been receiving calls from the FBI lately. A guy with Indian accent was demanding to speak to Mister so-and-so, and I was teasing him (pretending to be dumb, can't hear, fart, etc) to the point he got mad.

Then I was just listening to him going at me. After a while trying to eff my mom, he actually transferred me to another guy (tier-2) who speaks really good English. The conversation went something like this:

\- Well, see, I know too well you're not FBI. What you're gonna do?

\- Sorry man, I was just doing my job.

\- I know I can't know where you're calling from. So tell me, your English is good, and you seem pretty calm and collected, why do you have to stay up at 12 AM to do this shitty job?

\- No, I'm not in India. I'm in Texas.

\- For real?

\- Yeah, I'm a student. Someone asked me if I want to make some extra bucks over the break. It pays pretty well, better than normal jobs in here.

\- Oh, interesting.

\- Do you want to do it too? I can refer you.

\- No thanks, I have a job that pays me OK, but good luck with your ''''job.''''

\- OK, nice talking to you.

\- Nice talking to you.

Take it for what it's worth, but that seems to be the most successful scam call that I have ever received. I actually don't receive any more calls after that.

<comment><USER7> Those guys get seriously ticked off when you string them along long enough... nice job befriending that guy. Next time accept his offer to get an introduction - great intel to identify the offending party and sue them for TCPA violations.

</comment></comment><comment><USER11> Have you tried Google Voice? It has this call screening feature that requires the person calling you to give their name before it forwards the call to you like a secretary. This will block the recorded calls and you can choose to skip the screening for your friends and family.

</comment><comment><USER12> It started happening to me when I registered a domain name and made my phone number available via whois lookup. The same day I got an Indian company offering me web services for the new domain. Then it escalated and every dodgy Indian web company started calling me. I managed to change the details and update the phone number to a local law enforcement agency's number, but I guess the number was online for long enough to spread through some kind of Indian scammer network. I started getting calls offering me to remortgage my home even if I don't have a mortgage, pretend calls from the taxation office (in American accent even though I'm not in the US) and a million other things like SEO services etc. A lot of the times they'll route calls through a local VOIP number and even have a local mobile number popup in my screen. They could totally scam me if it wasn't for the Indian accent that gives it away.

</comment><comment><USER13> Answer the phone when they call and conference in the Jolly Roger telephone bot [http://www.jollyrogertelco.com](http://www.jollyrogertelco.com)

The bot will waste the telemarketers time, which is the most expensive thing that these companies are paying for. Do this enough times and the calls drop off rapidly.

<comment><USER2> We (Nomorobo) worked with Jolly Roger this holiday season and built SantaBots. Check out all the recordings at www.DoNotCallChristmas.com

</comment></comment><comment><USER14> Make sure your number isn't listed on the Whois information for any domains you own.

I had the same types of calls. Changed the phone number on my domains to an old number of mine and the spam calls stopped a few weeks later.

</comment><comment><USER15> T-Mobile claims to block scam calls now. I just turned it on a few days ago, so it's too soon to tell, but I haven't gotten any unwanted calls, where I usually get at least one a day. [https://explore.t-mobile.com/callprotection](https://explore.t-mobile.com/callprotection)

From what I've read, without trying it, nomorobo seems to be recommended. I was going to give it a whirl before I found t-mo will blocks the calls now.

<comment><USER16> I'd suggest turning on Scam ID for a bit before turning on Scam Block. It still rings, but has a "Scam Likely" caller id name.

So far it's had three false positives: the robocalls from my kid's school related to snow days and bus delays, the reminder calls from my doctor, and a fraud alert from Capital One to confirm or deny a flagged charge.

I only caught those ones because the numbers were already saved in my phone as contacts. I would have never even known about these call attempts with the Block on, whereas with Scam ID they have the option to leave a voicemail when I deny the call, plus I can look up the number later if I feel like it.

<comment><USER15> A good suggestion; as a counter-anecdote, I don't recall anything that Scam ID flagged that I cared about (they didn't leave voicemail, at least), and I've had that on since they implemented it. Don't have kids in school, but doctor/dentist calls get through. But your experience says an experiment is in order first.

</comment></comment></comment><comment><USER17> Blocking is pointless, the spam origination systems seem to be able to use multiple numbers on a rolling basis. I guess iPhone IOS added a incoming call filter api. I had been receiving so many calls on my cell that I tried some filtering apps. The HiYa app I've currently settled at seems to identify most incoming spam numbers and you can decline the calls. I think the volume of my spam calls as gone down too.

</comment><comment><USER18> Make note of the telephone number and add it to the Project Mayhem page. This effort uses code sent from VOIP phones to flood these numbers: [https://www.patreon.com/ProjectMayhem](https://www.patreon.com/ProjectMayhem)

<comment><USER19> Or not. Many of those calls use spoofed caller IDs. Not only are you not punishing the spammer, you're adding the number of a random person who have no idea this happened.

<comment><USER18> Sorry I didn't spell out everything for you. You should also feel free to do some investigating of your own, for example, call the number that appears on your caller ID. Depending upon who answers the call you may or may not choose to proceed with punishing the spammer. BTW feel free to propose a better idea if you actually have one...

<comment><USER19> I didn't say that for you. I did it for the people who are not aware of this issue. Are you upset that I gave people more information, so they don't try to block legitimate callers?

<comment><USER18> On the contrary, I'm "upset" that you cant offer those poor people a better solution.

</comment></comment></comment></comment></comment><comment><USER20> This guy had the right idea: 'How one man turns annoying cold calls into cash' ([http://www.bbc.com/news/technology-23869462](http://www.bbc.com/news/technology-23869462)) and 'Cold-call victim gets his own back' ([https://www.theguardian.com/money/2013/aug/29/cold-call- vict...](https://www.theguardian.com/money/2013/aug/29/cold-call-victim-gets- own-back)).

It depends on your situation, but it may be possible to turn lemons into sparkly lemonade!

</comment><comment><USER21> I think the best way to avoid them is by not using any landlines, but I believe it couldn't be a right option for you. I think ignoring calls from unfamiliar numbers is the only thing that we could do, and it saves your time. I just read at [http://www.whycall.me/news/consumer-wins- massive-229500-robo...](http://www.whycall.me/news/consumer-wins- massive-229500-robocall-lawsuit-against-time-warner-cable/) about suing telemarketers. It might works for you if you are dealing with legit telemarketers.

</comment><comment><USER22> I used to get tons of these calls in the US maybe 10 a week.

Not sure if it works but I tried to waste as many minutes as I can. I pick up every number. If I know it's a robocall, I leave phone on my desk without saying anything until they hang up. Maybe they realize you're a dead end and stop calling.

Another way I look at it, is how can I develop my social skills? I might string them along, make up a story. Make them so angry or become friends. You can learn how you perform in these situations. :)

</comment><comment> radford-neal This problem would stop instantly if you could press a button during a call and have 25 cents added to the caller's phone bill and perhaps get a 25 cent credit on your own bill. Anyone know why this rather obvious solution hasn't been implemented?

At a minimum, one could switch cell phone billing so that only the caller pays, not the recipient.

<comment><USER23> > At a minimum, one could switch cell phone billing so that only the caller > pays, not the recipient.

Are there any countries besides the US that charge the callee? It's completely unheard of in Europe.

I did spend some time in the US about ten years ago, and I do remember being very surprised at being charged for calls received, and even for texts received, although you have no influence on accepting them! Such a weird system.

<comment><USER24> What if you use your mobile phone to receive a million texts per day and the sender uses a different service provider. Your service provider has to pay for all that data moving through its network one way or another...

<comment><USER23> I don't know exactly how inter-provider billing works, but I assume the sender's network pays the receiving network. The sender caused the traffic, why would anyone else pay for it?

</comment></comment></comment></comment><comment><USER25> [http://www.jollyrogertelco.com/](http://www.jollyrogertelco.com/)

</comment><comment><USER26> Answering their calls make them more likely to call you the future. I don't answer any calls I don't recognize.

</comment><comment><USER27> For one data point, spam calls pretty much stopped when I switched over to Project Fi for my carrier.

Outside of that, "Do Not Disturb" 24/7, whitelist all your contacts, change your voicemail message to "I don't check my voicemail because it's constantly spam, text me", and ignore your voicemail.

</comment><comment><USER28> [https://www.npr.org/2017/07/31/540515367/familiar-looking- nu...](https://www.npr.org/2017/07/31/540515367/familiar-looking-numbers-are- the-latest-twist-in-robocalls)

<comment><USER29> I get a lot of these calls, and I figured out the pattern very quickly. Since I don't happen to know anyone with the same areacode/prefix as my cellphone, I just let all these calls go to voicemail, and none of them ever leave a message. (My area code is an overlay area code that has mostly mobile numbers.)

<comment><USER30> I do too! It's very frustrating, to the point that I've considered just getting a new phone number. The problem being I've had this number for >10 years and like the idea of an old high school friend being able to reach me without Facebook. Someone online suggested I make a complaint to the FCC but it went nowhere. I never pick up anymore but it's still annoying.

<comment><USER29> I wouldn't expect that getting a new phone number would help. I'm guessing that these scammers sequentially call all the phone numbers in an area code rather than targeting specific individuals. (If they were targeting me, they'd probably stop wasting their time after the hundredth time I didn't answer their call.)

</comment></comment></comment></comment><comment><USER31> I don't know how to stop it, but I think someone should go to jail for doing this.

<comment><USER32> Try nomorobo

</comment></comment><comment><USER33> Not a great solution for bulk calls but you could always divert to Lenny - [https://www.reddit.com/r/itslenny/](https://www.reddit.com/r/itslenny/)

</comment><comment><USER34> You may not be able to stop them, but you can certainly annoy them to all hell: [http://www.jollyrogertelco.com/](http://www.jollyrogertelco.com/)

</comment><comment><USER35> Sometimes, it's repeated calls from the same number. In those cases, both Android and IOS have some solution to block it. If it's truly random incoming numbers, then, yeah, you're stuck.

</comment><comment><USER36> I get two or three calls a week where they hang up as soon as I make a sound, even a little clapping will do. If you call them back it is of course "my bank" with urgent info about my account.

</comment><comment><USER37> Scam robocalls happen to me almost daily. I've tried blocking one of the numbers, but the calls from that number still ring on my phone. The calls appear to be using bandwidth.com's API.

</comment><comment><USER38> Same issue here. Unless I am expecting a call I keep my phone on Do Not Disturb. My friends and family know how to reach me.

</comment><comment><USER39> easy, tell them you are under 18, they wont call again</comment>


How to Write a Book with Python and Sphinx - <AUTHOR> https://medium.com/the-innovation/how-to-write-a-book-with-python-and-sphinx-66dabb814288 <comment><AUTHOR> In-depth tutorial on how you can build a technical documentation and even write your own book with a documentation generator tool, sphinx.

Happy reading!</comment>


Ted Cruz on Twitter: "Net Neutrality" Is Obamacare for the Internet - <AUTHOR> https://twitter.com/sentedcruz/status/531834493922189313 <comment><USER2> The day he becomes president is the day I change my name to Duckduck Moosehump</comment>


The machine learning community has a toxicity problem - <AUTHOR> https://www.reddit.com/r/MachineLearning/comments/hiv3vf/d_the_machine_learning_community_has_a_toxicity/ <comment><USER3> The ____ (insert scientific community/field here) has a toxicity problem.

It can be said from every single field in science (I am in the natural/health ones):

\- peer review is broken - <USER2>

\- reproducibility problem - check (try to reproduce any miracle cancer cure paper)

\- worshipping problem - check, there are kings and no one can take them down.

\- diversity problem - check. In my department 80% of the professors and PhD and postdocs are women.

\- moral and ethics are set arbitrarily - check. Morals? in Genetics? give me a brake

\- there is a cut-throat publish-or-perish mentality - check, tell me something new

\- discussions have become disrespectful - check. The time I saw Pavel Pezner giving a keynote lecture at ISMB and instead of showing his work he spend 70% of the time dressing down other people and trashing their work, Science died to me. And this was early 2000's.

Machine learning won't be the first field to notice it, and won't be the last. Science is not scientific anymore.

<comment><USER4> Is this a new phenomenon?

Max Planck had this famous quote:

> A new scientific truth does not triumph by convincing its opponents and > making them see the light, but rather because its opponents eventually die > and a new generation grows up that is familiar with it. . . . An important > scientific innovation rarely makes its way by gradually winning over and > converting its opponents: it rarely happens that Saul becomes Paul. What > does happen is that its opponents gradually die out, and that the growing > generation is familiarized with the ideas from the beginning: another > instance of the fact that the future lies with the youth.

<comment><USER5> I think this goes beyond science. People don't just change their minds. The only consistent way to get people to change is to wait until they die.

</comment></comment></comment><comment><USER6> _> At our CS faculty, only 30% of undergrads and 15% of the professors are women. Going on parental leave during a PhD or post-doc usually means the end of an academic career. However, this lack of diversity is often abused as an excuse to shield certain people from any form of criticism. Reducing every negative comment in a scientific discussion to race and gender creates a toxic environment. People are becoming afraid to engage in fear of being called a racist or sexist, which in turn reinforces the diversity problem._

This was an unexpected twist! It's rare to read such an honest, unbiased opinion on this issue.

<comment><USER7> I would go further and state that there is no "diversity" problem, whatever that should mean. There is an a priori assumption that it should be 50/50 and only then a field is just. Why CS though? There are countless other occupations where that is not given. The problems with PhD and pregnancy is a university problem. So I still think it is heavily biased.

<comment><USER8> "Why CS though?" is a weird statement here.

Why should the vast majority, or even a sizable fraction, of fields not have a gender or race balance even remotely approximating the balance of the general population? Is it not a 'should' but merely 'it's okay if they do'? If the balance was in the other direction and men or white people were being intentionally denied jobs, would that be okay?

Should it be OK for other things to be unbalanced? Should it be OK if 60% of black people can't get houses but only 10% of white people have trouble getting homes? Should it be OK if 90% of asians are turned away from emergency rooms but only 20% of mexicans are?

You can argue that race/gender genetic differences play a role but it's kind of hard to explain away the widespread imbalances here just based off DNA.

<comment><USER9> ~80% of the Nurses in the US are Female, this is no doubt due to discrimination and anti-male bias according to your worldview, correct? 87% of Garbage men in the US are Men, are you fighting for better female representation in the Garbage trade?

[https://www.beckershospitalreview.com/hr/gender-ratio-of- nur...](https://www.beckershospitalreview.com/hr/gender-ratio-of-nurses- across-50-states.html)

<comment><USER10> Yes and what gender are the doctors? Even though medicine students are 60% female? That's the issue, the prestigious more powerful jobs are largely male dominated, while the "rank and file" who takes orders (or does the dirty work) is largely female. Show me one field (that does rely on the person's ability not looks) where there are more women in the higher ranked positions and more men in the lower ranked positions.

<comment><USER9> You ignored my question.

>Show me one field (that does rely on the person's ability not looks) where there are more women in the higher ranked positions and more men in the lower ranked positions.

Nursing

<comment><USER10> The field is medicine and doctors are predominately male.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> The main take-away and problem for me is the 'arXiv dilemma', combined with shoddy scholarship: newcomers to the field regularly try to drink from the arXiv firehose and take every paper they find on there as gospel—even though it is not peer-reviewed (let's set aside the issues of peer review for that one).

The quick publication cycle creates an environment that is always just about 'beating' the state of the art, but if you look closer into the reported values, you will often find a lot of questionable experimental choices. In one of my main application areas, viz. graph classification, almost _none_ of the papers holds up (with respected to the reported performance gains) if subjected to a thorough experimental setup.

This creates a dangerous environment; in the worst case, we might _miss_ some interesting contributions because they are drowned by the noise of reviewers (here we go again!) claiming that 'It does not beat the state of the art, so it must be crap'.

<comment><USER12> >> In one of my main application areas, viz. graph classification, almost none of the papers holds up (with respected to the reported performance gains) if subjected to a thorough experimental setup.

Could you give an example? Just being curious :)

<comment><USER11> Sure thing!

For the GIN-ε ([https://arxiv.org/pdf/1810.00826.pdf](https://arxiv.org/pdf/1810.00826.pdf)), for example, the authors report a classification accuracy of 75.9±3.8 on the PROTEINS data set (classical graph benchmark data set). If you run it with a cross-validation setup that is _repeated_ to account for effects of chance, performance drops to 73.1±0.7.

Notice the drop—the second accuracy value is at least within the standard deviation of the first one, but you can see that a different experimental setup shrinks the gains quite a lot...

Same goes for different data sets. Since the gains are not super large for most papers, these changes matter a lot. But of course, the paper is now published, so no one is going to go back and change it.

FWIW: I like the GIN paper and think the authors did a good job. It's just that their experimental setup is insufficiently thorough for the data sets they are considering, thus leading to overoptimistic estimates. This is a problem because the next 'state of the art' paper has to find a way to get a slightly higher mean accuracy, at the expense of an even larger standard deviation, etc.

<comment><USER12> Thanks - it will take a while to read through the paper. I'm very surprised to see actual theoretical contributions in a (recent) neural networks paper. _Pleasantly_ surprised.

I agree the trend you point out is worrying. I suppose if this continues at some point the benchmarks are beaten, but that still tells us nothing about the true abilities of the tested systems or algorithms.

<comment><USER11> You are welcome! If you want to go further down the rabbit hole, feel free to ping me via another communication channel; I have some interesting findings to share but they are unfortunately not ready yet for public consumption.

(this sounds more ominous than I intended it to sound; the reason is plain and simple that the publication is still under review and we have no preprint)

<comment><USER12> Haha, don't worry, I thought you meant it's a draft or under review :)

I got a research interest in GNNs and the datasets used in papers like the one you link, but I have so far only dipped a toe- because I have other priorities right now. But, more if I ping you :)

</comment></comment></comment></comment></comment></comment><comment><USER13> "the way Yann LeCun talked about biases and fairness topics was insensitive"

Insensitive according to who? The most sensitive 5% of people? All statements will be deemed insensitive by at least one person somewhere. It's silly to allow the most extremely (often unreasonably) sensitive people to set the threshold for what is sensitive or insensitive speech.

<comment><USER14> Insensitive to anyone who has a moderate amount of understanding of machine learning and social empathy.

You can't plug your ears and say "it's just your training set" as a response to unfairness in ML algorithms. Real life is biased. Any real life data in our world is going to be biased. If you train algorithms on this data, they will cement any existing divides in society. So, with the understanding that researchers need to be more circumspect about ML algorithms than worrying about just the training data, consider that the upsampling algorithm in question only worked for white people because they fed it a huge amount of white faces. Claiming "it's just the training data" is one of those "well yes, but actually no" situations where ML researchers tend to miss the broader picture of how ML algorithms are used in real life, and just makes Yann look ignorant.

<comment><USER9> The real argument they were making against Lecun is whether a mathematical function can be biased. Care to explain how a gradient is racist?

<comment><USER14> >Care to explain how a gradient is racist?

Sure. Your comment's language equivalent is something along the lines of "Care to explain how words are racist?" Which yes, they are just a collection of words. They possess no consciousness and cannot be racist by themselves.

Similarly, a gradient is just a collection of vectors. It's just numbers. However, like language, it's what they represent that matters.

For example, I can create a machine learning algorithm to determine who should get a home loan. I create a gradient to optimize the algorithm to give loans to people who I think are unqualified.

The gradient can easily be racist if it optimizes heavily on something like race. Minorities tend to be lower income and so can be seen as less qualified as higher income individuals. However that's the easy argument, and also quite illegal. If you exclude race, there's 2nd degree variables that are proxies for race. Things like zip codes, job titles, whether they rent or buy. These are not explicitly illegal to filter on, though the end result is illegal if they exclude certain protected statuses. It can even be no fault of the researchers who implement the algorithm, because controlling for bias using real world data is extremely difficult. But we must do it, since it is the ethical thing to do.

And so, it's easy to see that one can optimize ML algorithms to exclude certain protected statues, which is what can make the algorithms racist.

<comment><USER9> You failed the test. The Gradient is not biased, the data is. This was of course LeCun's point... This is pure foolishness

<comment><USER14> Maybe I'm not explaining it very well. Look, so things have meaning deeper than their face value. To use a really basic example, The number 14 means nothing, it's a number. The number 88 means nothing. In the same context, they mean something not good.

There are English words that as pieces, they don't mean anything except their face value. I can string words together that mean bad things that are harmful to real humans.

Gradients are not racist by themselves, they're just math. It's like saying multiplication is racist.

But I can use multiplication as a tool in a chain to create weighted averages to create a naive Bayesean classifier to reject people for home loans.

And so too can I misapply gradient descent as a part of a larger ML model that is racially biased. For instance, I could choose a loss function that when minimized, gives biased output despite less biased input. Or, I could accidentally settle on a local minimum on the gradient in my model. There's many naive implementations of an algorithm that will just be biased no matter the unbiased inputs.

So in summary, a gradient is just math and is not racist by itself. It's being used in an algorithmic tool chain that researchers are frequently using which potentially will always produce biased output no matter the inputs (but more often than not also with biased input).

</comment></comment></comment></comment></comment></comment><comment><USER15> This is very refreshing to read - looking from the outside in, there has been a pretty clear problem with (at least the representation of) ML research along the lines highlighted here - ridiculous hype, papers again and again linked from the same researchers and institutions indicating _potential_ cliqueyness, nepotism and celebrity worship.

All very dispiriting, indicating real problems making progress in AGI beyond the clear lack of ideas.

Of course, just because these toxicity claims are being made, it doesn't mean they are accurate, but they certainly ring true.

If they are, it is good to know they are being talked about in some quarters.

<comment><USER16> I'm super curious why you were optimistic about AGI in the first place?

it seem to me that a majority of the performance gains in ML are a result of using better hardware to run brute-force statistics with larger more complex models but the algorithms themselves have been improving at a nominal rate.

<comment><USER15> I'm optimistic about AGI because I see no reason for it not to be implemented (though the time-frame is a different matter).

Going by the hype articles (which may be unrepresentative), we just seem to be moving faster and faster on an impressively powerful, but AGI-irrelevant train along a machine "learning" railway track and although I suspect plenty of people on the train would like to get off, the drivers and momentum are making that very difficult, as indicated in the OP article.

I'm completely optimistic about AGI, just think we are allowing the excitement of the advances in Artificial Unintelligence over the last few years erroneously dominate our thinking about it - at least in the sort of papers that turn up in tech-related feeds. Again, this may be unrepresentative of the top thinkers in computer science (machine-learning/whatever).

My own (layman!) opinion is that the good ideas have and will continue to come from external (or intersecting) fields, philosophy, neuroscience, etc; not computer scientists raving about the power of DeepWhatever using cloud-enabled networks.

<comment><USER16> Thanks for sharing! I totally agree with you that we seemed to focus a little too narrowly. If you haven't read it already, you might enjoy the book Range awesome look at the impact of interdisciplinary innovation

<comment><USER15> I assume you mean:

Range: How Generalists Triumph in a Specialized World by David Epstein.

I'll check it out - thank you.

</comment></comment></comment></comment></comment><comment><USER17> My group of hard core ML friends went fully private. I don't even pay attention to the public ML discourse (except on HN.) I think a big part of it is a low barrier to an international culture and academia which can be toxic in their own ways.

<comment><USER18> Why go private?

</comment></comment><comment><USER19> Also see: r/machinelearning has a toxicity problem

[https://www.reddit.com/r/MachineLearning/comments/hkc697/d_r...](https://www.reddit.com/r/MachineLearning/comments/hkc697/d_rmachinelearning_not_just_twitter_has_a)

</comment><comment><USER20> It is unfortunate that culture politics have taken over HN.

</comment><comment><USER21> > everybody is under attack, but nothing is improved.

</comment><comment><USER22> >Fifthly, machine learning, and computer science in general, have a huge diversity problem. At our CS faculty, only 30% of undergrads and 15% of the professors are women.

Yes, and the deep sea fishing, oil drilling and logging industries also aren't super diverse and have a severe lack of women. I don't see anyone complaining about that. Different groups have different preferences. I've met several women who have gone into science and IT only to find it immensely unfulfilling, as it's often a very socially isolating job by nature, and leave to switch careers.

If there's a rule or law preventing women from getting into the industry, then let us know and we'll change that. But don't criticize an entire industry because women on average chose to pursue other passions.

>At this very moment, thousands of Uyghurs are put into concentration camps based on computer vision algorithms invented by this community, and nobody seems even remotely to care.

What does he propose be done about this? Tell Chinese government bureaucrats to stop "stealing" publicly accessible research papers and code to implement tools that help commit genocide? Sue the Chinese government for violating licensing agreements that require "no violation of human rights"? Not everything should, or can be, about global politics. We should let people researching machine learning worry about machine learning, and leave the broader socio-political effects to political pundits and sociologists.

</comment><comment><USER23> The west has a fragility problem.

<comment><USER24> We cannot handle the freedom we had since the 90's. We abolished most rules that a conservative / christian society had. As it turns out we actually prefer having strict rules. These new rules are now about diversity, discrimination and racism. They fulfill the same role as the rules of the conservative / christian society. If you abide the rules, you are a good human being. If you are ever in doubt about yourself, just stick to the rules and you will be fine.

I personally don't really like this trend but I think our society is not ready to handle freedom yet.

</comment></comment><comment><USER25> I think as long as no government funding is involved, people sho0uld be free to worship whoever they want and read whatever they want and flock around posters of whatever topic they want.

If government money is being distributed, things become more interesting. But I don't think everybody is entitled to a career funded by tax payer money. So it should probably remain "cut throat" to get a good job based on government money. Whether governments have the best criteria for handing out money is another question (number of papers published might not be the best metric).

</comment><comment><USER26> I would argue that anything that becomes sufficiently popular enough to be lucrative beyond some arbitrary threshold becomes toxic. Welcome to the cycle of capitalism!

<comment><USER27> Progress < profits and control

<comment><USER28> Just a series of weighted if statements anyway...

</comment></comment></comment><comment><USER29> Agree with this point:

Sixthly, moral and ethics are set arbitrarily. The U.S. domestic politics dominate every discussion. At this very moment, thousands of Uyghurs are put into concentration camps based on computer vision algorithms invented by this community, and nobody seems even remotely to care. Adding a "broader impact" section at the end of every people will not make this stop. There are huge shitstorms because a researcher wasn't mentioned in an article. Meanwhile, the 1-billion+ people continent of Africa is virtually excluded from any meaningful ML discussion (besides a few Indaba workshops).

<comment><USER30> Maybe I am misunderstanding but... Why does a community need a moral stance on external issues? If everyone is there to do/learn/advance machine learning, isn't that the end of it? It isn't their purpose to engage with Chinese or other issues.

Edit: I think it makes sense to have a stance on Machine Learning moral issues in a machine learning group. I just don't think you need to have a stance on every issue ever.

I say this as someone always a bit frustrated that HN and Reddit etc are very US centric.

<comment><USER31> > Maybe I am misunderstanding but... Why does a community need a moral stance > on external issues? If everyone is there to do/learn/advance machine > learning, isn't that the end of it? It isn't their purpose to engage with > Chinese or other issues.

Because its wrong to write-off the mistreatment of other human beings as an external issue. It never is: we're all human and we all share the same planet.

<comment><USER30> So any group anywhere needs to have a stance on every injustice everywhere? Isn't that exhausting?

<comment><USER32> Of course it's exhausting. It would be less exhausting if more people paid attention to these things instead of viewing it as someone else's problem.

<comment><USER30> That's not true though is it? The more people get involved, the more opinions you need to weigh and the more consensus you need to get to even 1 stance.

Getting 10 people to agree a stance on the 10 issues facing you is much much easier than getting 7bn people to agree on the billions of possible issues in the known universe.

That's sort of my whole point: eithe limit the issues you have to take a stance on, or watch the amount of time taken up with stances grown exponentially.

<comment><USER32> It is true because there is no alternative. Dismissing the exponential growth and required time commitment won't make it go away, if anything it amplifies the problem and increases the number of discussion that need to happen in the end. If you have no consensus then the stance will just be taken for you by whoever screams the loudest, in modern times that is social media and advertising.

<comment><USER30> So you accept its impossible to do mathematically, But insist we still need to do it because we have no alternative? Doesn't this mean that no community can ever actually function beyond very small sizes? They will just get stuck answering infinite moral quandries?

<comment><USER32> I can't speak for what the best method of organizing for the ML community should be, but society at-large is already stuck answering these infinite moral quandaries.

<comment><USER30> So why are you insisting we do the impossible at either level?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER33> The problem is not toxisity itself. That's but a symptom. It's:

1\. People getting into positions for the wrong reasons (diversity hires), 2\. No one has any kind of backbone any more... victim culture and molycoddling shows it's ugly face, 3\. Real smart people that don't' want to content with stupid getting rightfully angry with their subpar collegues who are desperatly trying to being somewhat relevant.

Let's face it... scientists are most of the time not people persons. Most smart people don't care for your snowflake persona getting hurt by the truth. It's basically impossible to do antying in an environment that treats microaggressions as anything else but the completely infantile bullshit that they are.

GROW A FUCKING SPINE AND GROW THE FUCK UP WHINERS.</comment>


An Example Of How Government Doesn't Get Seed Funding - <AUTHOR> http://www.ottawabusinessjournal.com/291900963842686.php

<comment><AUTHOR> "But the program also requires companies to create or retain at least 100 high-value jobs, defined as above the median industrial wage in fields such as design or engineering, or invest at least $25 million over five years, and it's here where some Ottawa firms get skeptical. "

How exceedingly stupid. The government is focused on how many jobs their fund might create, instead of looking at the potential of the team/idea. And of course, it favors large established companies.

Every time I think about moving back to Ottawa, I read something like this and don't feel as bad about the high cost of living in the Bay Area....</comment>


Later: What does procrastination tell us about ourselves? - <AUTHOR> http://www.newyorker.com/arts/critics/books/2010/10/11/101011crbo_books_surowiecki?currentPage=all

<comment><USER2> By far the best article I've read on procrastination was published in the Harvard Business Review a few years ago.

It looked at behaviours like procrastination and perfectionism in terms of the psychology of the relationship of the worker with the person needing the work done. It persuasively argues that the problem lies not in poor time management skills, but in the self-esteem of the person doing the work and how they handle people being unhappy with their work.

The article posted here today is philosophical and thoughtful, whereas the HBR article is immensely practical and evidence-based. The full article is behind a paywall, but I highly recommend it!

<http://hbr.org/product/chronic-time-abuse/an/R0406F-PDF-ENG>

<comment><USER3> Looks like it's available here:

[http://www.evolutivconsultants.ro/wp- content/uploads/2010/03...](http://www.evolutivconsultants.ro/wp- content/uploads/2010/03/Chronic-Time-Abuse.pdf)

<comment><USER2> Thank you for finding this!

</comment></comment></comment><comment><USER4> A quick search turned up this great quote from a research psychologist: "Procrastination is not waiting and it is more than delaying. It is a decision to not act."

I see that he has a new book: [http://books.google.com/books?id=L4BDQxrME0IC&printsec=f...](http://books.google.com/books?id=L4BDQxrME0IC&printsec=frontcover)

Of course, I probably won't get around to reading it. :-)

<comment><USER5> Then I might suggest you start with this, much smaller, more focused book. You can probably read the entire thing in about an hour or so:

[http://www.amazon.com/Procrastinators-Digest-Concise- Solving...](http://www.amazon.com/Procrastinators-Digest-Concise-Solving- Procrastination/dp/1453528598/ref=sr_1_2?ie=UTF8&s=books&qid=1289079667&sr=8-2)

The authors of both books are good friends and Pychyl wrote the forward to Ferrari's book.

</comment></comment><comment><USER6> I will never watch a DVD that I buy, only one that I rent.

When there is no consequence to procrastination, it is inevitable. It must be true then that deadlines add value.

</comment><comment><USER7> Bookmarked. I will read it later.

<comment><USER8> i'm half way through it. it's quite interesting, but i seriously wish it were 25% as long.

i read these articles because i honestly hope to get something life changing out of them, not for the pleasure of illustrative anecdotes.

i suspect authors of such articles have a word count to meet? it's unfortunate that the economics of writing reward filling whitespace - how could we motivate writers to be as succinct as possible?

<comment><USER9> Recommended: <http://www.zapreader.com/>

Now that I'm used to it, I find I retain more this way than linear reading.

<comment><USER10> Here's a similar, stand-alone application called Dictator:

<http://dictator.sourceforge.net/dictator.html></comment></comment></comment></comment>