Voting system to be used in West Virginia elections is vulnerable - grey-area https://twitter.com/GossiTheDog/status/1026603800365330432 <comment><AUTHOR> "'You take a photo of your photo ID and then they take a selfie of themselves,' Kersey explained. 'Facial recognition software is then deployed to compare the photo on the ID and the photo of the person who took the picture.'"

So it sounds like they verify your identity based on two photos that you provide? So if two photos provided by an unknown person match, then they become a trusted person? Even if there's a separate step that matches that to the DMV database or something... all you actually need is a photo of the person you want to impersonate.

But pretending to be someone else for remote voting is already a weak point, and one that would be expensive to exploit on a large enough scale to make a difference. The much much bigger risk is that we have absolutely no way to verify that the votes recorded are correct. This company's app sends the vote to the company's server which stores it in this company's database. That's three steps at which the votes can be easily changed.

The question to ask with any proposed voting system is: how can we verify that the counts are accurate? The _only_ way to do that in anything close to a trustworthy manner, is by having an established network of trusted agents (one or more witnesses from each interested party organization at each physical voting location) monitor a human-visible process for collecting paper ballots which can be counted and recounted at will by multiple groups of interested parties.

Any system where the votes are _ever_ hidden away from witnesses and accessible, say, in a back room with an unlocked door leading to an empty alleyway ... or on any computer system, is inherently insecure.

<comment><USER2> > So it sounds like they verify your identity based on two photos that you > provide? So if two photos provided by an unknown person match, then they > become a trusted person? Even if there's a separate step that matches that > to the DMV database or something... all you actually need is a photo of the > person you want to impersonate.

I recently signed up for two different mobile banks (Monzo and bunq). Both of them verified my identity by having me take a photo of my passport, but then also recording a video of myself (with my face clearly visible) saying an exact phrase they specified, in one case "My name is $legalname and I'd like to open a Monzo account" and in the other a sequence of random numbers.

That seems way more secure.

<comment><USER3> The problem isn't who opened the account, it's whether they authorized a massive electronic transfer somewhere.

The problem with voting is not and has never been physical people people voting fraudulently. It is the alteration of the votes on a central machine. (For example as an easily editable excel file on at least on occasion)

The extra barriers to confirm the physical person standing at the booth is a redirection of a serious problem with Putin into a little more voter suppression.

<comment><USER4> There is no way to be sure that voting is private and uncoerced with remote voting. Someone from a spouse to a precinct captain could be watching you vote on your phone under some threat of penalty.

<comment><USER5> Nobody stops the interface from allowing the voters to vote as many times as they want before the deadline. Only the last vote counts. If the vote is tied to an ID then it's definitely going to be unique.

</comment></comment></comment></comment></comment><comment><USER6> If there is one thing I fail to understand it is the impulse to electronic-ify our elections.

Why? Do we have a history of securing computers and keeping them secure over time? No.

Are computerized elections understandable to laypersons? No. Worse; even if the election was tallied faithfully by a computerized system, a demagogic candidate can whip up fervour and call the election into question.

And without bug bounties there is no legal way for whitehats to pentest these things. We're stuck with shitty scans and guessing at best. Even so, from what I've seen I fail to see why we should trust these votings systems.

But the public doesn't care. They don't understand that code is just data and it can alter itself. The voting machine industry has lobbyists. The paper ballot industry doesn't exist.

<comment><USER7> > If there is one thing I fail to understand it is the impulse to electronic- > ify our elections.

The part that gets me is that there is no organic, grassroots push from the people who actually vote to implement electronic voting.

Usually when someone, or many people, advocate for a cause, they have something to gain from it.

Who is advocating for electronic voting and what do they stand to gain?

<comment><USER8> There's always people complaining how backwards it is that we don't have electronic voting, how it suppresses the youth vote, etc.

<comment><USER9> Interesting! I'd never heard the idea that the lack of electronic voting suppresses the youth vote. Do you have a link for someone arguing that position?

<comment><USER8> [https://www.bbc.com/news/business-39955468](https://www.bbc.com/news/business-39955468)

> Online voting is a good way to engage with younger voters, busy workers, and > even Estonians living abroad, Mr Koitmae says.

<comment><USER10> There are several miles of difference between what they said and 'claiming that not having it suppresses the youth vote.'

</comment></comment></comment></comment></comment></comment><comment><USER11> As noted later in the thread, this is specifically for people who are overseas at the time of the election and not broadly.

That said, this system seems like a bizarre choice given the apparent security issues discussed in the thread.

</comment><comment><USER12> €54 million spent in Ireland. End result:

"In 2012, KMK Metals Recycling paid €70,267 for 7,500 e-voting machines; 1,232 transport/storage trolleys; 2,142 hand trolleys and 4,787 metal tilt tables."

[https://en.wikipedia.org/wiki/Electronic_voting_in_Ireland](https://en.wikipedia.org/wiki/Electronic_voting_in_Ireland)

<comment><USER13> Electronic voting has been tried in a bunch of countries, and subsequently scrapped. We had these abominations in the Netherlands too, they turned out to be insecure, and now we're back to pencil and paper.

And still, despite all the solid arguments against electronic voting and the actual experience with those machines, a certain class of influential people keeps bringing it up. Sometimes they're gadget-crazy policy makers who just can't fathom why we're still using a pencil in 2018 (because it works, is transparent, can be understood by any layperson, and instils trust). Sometimes they're politicians who absolutely must have the all the results of an election the same night, and only computers can do that (despite exit polls working pretty well, and there really is no rush).

Recently, some are arguing for electronic voting because it would mean people with sight impairments can vote assisted by headphones rather than by a trusted person (there a solutions for the classic paper ballot in the form of a Braille-embossed mould that work pretty well in Germany, you don't need a computer for this).

It's a constant battle to keep the public informed about the problems with, and undesirability of, electronic voting after each assault in the media. Why can't we keep this cornerstone of democracy a process powered by pencils, paper, and people instead of opaque IT solutions?

See: [https://en.wikipedia.org/wiki/Electronic_voting_by_country#N...](https://en.wikipedia.org/wiki/Electronic_voting_by_country#Netherlands)

<comment><USER14> You don't even need pencil, just different paper ballots. In most cases at least.

</comment></comment></comment><comment><USER15> What the hell kind of a company name is "Voatz"? Can you buy Voatz with Flooz and Beenz Bux?

[https://en.wikipedia.org/wiki/Flooz.com](https://en.wikipedia.org/wiki/Flooz.com)

[https://en.wikipedia.org/wiki/Beenz.com](https://en.wikipedia.org/wiki/Beenz.com)

<comment><USER16> I thought it was that Reddit alternative for fascists.

<comment> fake-name They added a 'z'.

Considering their security practices and cluelessness, they also seem to be mostly for fascists.

</comment></comment></comment><comment><USER17> What exactly does the blockchain part of the voting app provide here? Are there any details known about how this is supposed to work, especially how to ensure that votes are actually anonymous in this case?

And using facial recognition to make sure the right person votes just sounds like it'll end up either trivially exploitable or just cause many legitimate people to be denied as their faces can't be matched.

What exactly is wrong with voting by mail? It's pretty easy to do, and it ensures anonymity by wrapping two envelopes inside each other.

<comment><USER15> >What exactly does the blockchain part of the voting app provide here?

It was essential for bilking investors out of $2.4 million.

[https://www.vanityfair.com/news/2018/08/smartphone-voting- is...](https://www.vanityfair.com/news/2018/08/smartphone-voting-is-coming- just-in-time-for-midterms-voatz)

>"A HORRIFICALLY BAD IDEA": SMARTPHONE VOTING IS COMING, JUST IN TIME FOR THE MIDTERMS

>A Boston-based start-up promises to let West Virginians vote via app. Critics call it "the Theranos of voting."

>Enter Voatz. With a name reminiscent of a plot device in Idiocracy, Voatz is a mobile election-voting-software start-up that wants to let you vote from your phone.

</comment></comment><comment><USER18> Everyone here that I've read so far is close to going fringe conspiracy theorist on this issue. Electronic machines in the US are hard to hack en masse, because they require you to take them apart...and most neighboring jurisdictions don't even have a matching processes or voting systems. You all seem to say that paper ballots are safer and more transparent...but that's just factually wrong. Where do you think the term "ballot stuffing" comes from? There are videos of the Russian election just this past year of boxes being stuffed with paper ballots. It happened in the 1800s in the US, especially around the time when black Americans could begin voting.

The solution is simple and most places already do this, but each voting machine prints a matching paper receipt that can be matched with an electronic record. My jurisdiction already does this, it prints out of the back of the machine when you're done, but my vote is also electronic.

Those of you insinuating that Republicans (generally this is what people are hinting at) or Democrats are conspiring to rig elections via electronic voting are acting insane. If either party wanted to rig the election they could do it with paper or electronic ballots...and I highly doubt the vote tallies would be so close or that both parties would have so many seats flip every 8-10 years in toss up areas.

<comment><USER19> Ballot stuffing is a diagnosable problem. Electronics obfuscate. It's the principle that matters.

<comment><USER18> Not really? Because we don't pool the votes together into a mass pool, we can see a county by county break down of votes, if the votes are off people are going to notice in the electronic world. Not just that but as I said, you can have both a paper and digital ballot for verification. You can also have "check-in" numbers (which I believe most polling places do) to make sure the number of check-ins match the vote tally.

</comment></comment></comment><comment><USER20> Wait it's called _what_?

Sounds very professional. Sounds like the system I want counting my votes. Maybe they won out over v0tr.io and Votester?

<comment><USER21> Voat.co was also already taken.

</comment></comment><comment><USER22> I feel like all these solutions right now are very business driven. Is there a legit open source alternative?

Voting is a legit hard problem but it influences you more than you realize. The setup of the election basically determines the outcome of the election.

I think that the one thing that could improve democracy globally is an internationally agreed upon open-source verified voting system.

None of these startups will last long enough to have an impact.

There are many problems, voter identity is definitely one. You need some sort of public ledger (the blockchain isn't the worst idea, however proceed with caution).

</comment><comment><USER23> I wrote this up:

[https://davidgerard.co.uk/blockchain/2018/08/07/west- virgini...](https://davidgerard.co.uk/blockchain/2018/08/07/west-virginia-and- the-voatz-blockchain-voting-system-scaling-and-security-concerns/)

They're sloppy with security, and they're ludicrously unable to scale.

And they've put this out in an environment with state-backed hackers. It's very blockchain.

</comment><comment><USER24> Never heard of voatz before. AIUI [https://en.m.wikipedia.org/wiki/Helios_Voting](https://en.m.wikipedia.org/wiki/Helios_Voting) is the closest we have to working electronic voting.

<comment><USER25> Helios works pretty well, and I believe is in actual use for some college elections with people trying to break it.

I'm curious to see an implementation of a variant called 'BeleniosRF'[1], which adds the requirement that voting be receipt-free (RF)

[1]: [https://eprint.iacr.org/2015/629.pdf](https://eprint.iacr.org/2015/629.pdf)

</comment></comment><comment><USER26> Voting presents uniquely difficult challenges, you need integrity, strong authentication, verifiability, _and_ anonymization.

As others have stated, this particular scheme's weakness to tampering lies at the receiving end of the app's server.

There are other privacy problems with the "send a selfie" of the on-duty soldiers I won't get in to.

But ultimately, voting has unique constraints. The voter needs to be able to verify their vote was counted correctly, outside observers need to be able to verify totals, but _not_ identify individual votes, and the whole system needs assurances only those who are supposed to vote, do so.

</comment><comment><USER27> They literally based their entire software off of IBM's "Marbles" program.

That's just a Blockchain PoC. The fact that they're trying to take the simplest, most exploitable form of Blockchain and dressing it up as an innovation already puts a bad taste in my mouth, but the fact that this garbage software is now being used for a federal election is horrifying.

It also doesn't help that more than one of the leaders of this company are Russian nationals...

</comment><comment><USER28> >Note that the article is pretty clear: this is only for those people overseas, mostly troops stationed abroad. Still a terrible idea, but somewhat less terrible than statewide voting via mobile phone.

^Tweet in sub...chain (how the fuck do we describe twitter comments?)

It's horrible, but I almost hope somebody hack these votes in the most disruptive, obvious way. I think the country could use a good slap in the face when it comes to both infosec and voting security.

</comment><comment><USER29> What happens when we receive more votes then the population of West Virginia? Will this information be hidden from the public until it doesn't matter anymore?

</comment><comment><USER30> This sounds like that someone/group needs to make very obvious invalidating changes to this. Of course, you'd be tampering with federal systems... But take your pick: secret plausible tampering vs 'Votey McVoteface' and 'Iluv Dems' combined with 100m votes in a state with 8m people

</comment><comment><USER31> I initially read that as "Voat to be used in West Virginia elections" and became immediately alarmed. Always google your company name first folks.

</comment><comment><USER32> Obligatory why electronic voting is a bad idea: [https://www.youtube.com/watch?v=w3_0x6oaDmI](https://www.youtube.com/watch?v=w3_0x6oaDmI)

<comment><USER33> Obligatory "I rigged an electronic vote" video: [https://www.youtube.com/watch?v=DzBI33kOiKc](https://www.youtube.com/watch?v=DzBI33kOiKc)

</comment></comment><comment><USER34> Seems to me that voter IDs should be based on PKI, and the rolls should be self-published under a per-voter key.

<comment><USER35> Not enough voters would handle their keys securely. Maybe if every voter was given some kind of hardware which could sign their votes offline. That's a big, risky, upfront expense, though.

<comment><USER36> Still wouldn't work probably -- think of how many times the average person misplaces their _car keys_ in a given year. Now give them a piece of hardware, that they're only going to use every 2 years (which is a stretch given Americans' voting patterns, so realistically it's every 4 years if ever), and tell them to (1) keep it safe and (2) remember where they put it.

</comment></comment></comment><comment><USER37> An automated voting system is very efficient. You only need one person to change all the votes...

A good thing about so much people involved in voting is that is harder to cheat. Even an state agent like Russia can influence elections only so much. It was very effective because it just needed to change a few percentage points to tip the balance.

The bi-partisan system, gerrymandering and sub-standard education makes democracy fragile. Automated voting systems are much more dangerous.

> "It's internet voting on people's horribly secured devices, over our > horrible networks, to servers that are very difficult to secure without a > physical paper record of the vote."

This is a good summary of a few of the problems.

<comment><USER38> Someone else said the same thing and got downvoted to hell, but let's be clear: while it's very obvious that Russia assisted the Trump campaign and bought ads for Trump, there has never been any evidence or even suspicion that they were involved in direct vote manipulation regardless of what clickbait headlines may imply.

<comment><USER28> I'm curious if you consider a phishing attack a "hack."

More clear: is calling a company, pretending to be their IT, and getting their root credentials, "hacking?"

<comment><USER39> I don't. It's fraud. A hack is technical. The fact that you get access to a computer system isn't what makes a hack a hack.

In terms of democracy.

People can be mislead whether by internal or external sources.

Democracy works slowly. The important thing is that they have another chance to vote in a few years to vote in their interest.

Things that affect the effectiveness of a democracy include a limited franchise (e.g. a test to ensure only "educated" voters are allowed, restrictions on people who have previously been jailed, precinct voting[1] with voting on a working day); ballot stuffing; gerrymandered districts and excessive malapportionment; insufficient sensitivity to changes in public opinion (e.g. not enough legislators); supermajority requirements (on ordinary bills) and vetoes for small groups.

[1]: Since not everyone will be aware of what precinct voting is, it's a system where you are allocated to a certain voting centre. So you live in Ballotsville South: therefore, you're only allowed to vote at the Ballotsville South Primary School.

Other jurisdictions permit people the freedom to select the voting centre based on convenience. Every voting centre in some district will have a ballot and a record for you. In some broader district they may not have a record for you but they still allow you to vote by keeping your ballot inside a sealed envelope: then they can confirm your entitlement and open your ballot or destroy it as appropriate.

</comment></comment></comment></comment><comment><USER40> It is only for overseas military from WV using mobile devices for voting on foreign soil.

No cause for concern.</comment>


Change OSX Terminal theme on the fly when you SSH - <AUTHOR> http://tempe.st/2011/04/change-your-terminal-theme-when-you-ssh-into-a-server/

<comment><USER2> Interesting bug in this example:

Since the AppleScript instructs the terminal to change _the current session_'s theme, if ssh exits while you're in another tab (say due to a disconnect), the tab which is currently frontmost will have its theme changed to 'Solarized Dark', while the tab you had run ssh in will stay as 'Solarized Light'.

Of course, this won't show up in testing -- and will be rather surprising when it does show up. :-)

<comment><USER3> I hate Terminal's AppleScript implementation. For example, this does not work:

       tell application "Terminal"
          set my_tab to first tab of first window
          get container of my_tab
       end tell

In nearly everything else I've seen, "get container of" works.

Or consider this. It changes the settings of the first tab of the first window to the first settings set. It works great:

       tell application "Terminal"
          set current settings of first tab of first window to first settings set
       end tell

However, a trivial change that in any sane implementation would be exactly equivalent fails:

       tell application "Terminal"
          set first_set to first settings set
          set current settings of first tab of first window to first_set
       end tell

Changing it slightly makes it work:

       tell application "Terminal"
          set first_set to a reference to first settings set
          set current settings of first tab of first window to first_set
       end tell

AppleScript is the most frustrating language I've ever tried to work with because of things like this.

</comment></comment><comment><USER4> That's kind of nifty, but I still prefer reading the hostname on the connection. I use a variation of Steve Losh's awesome zsh prompt and that helps make things petty obvious (if anything, because some of the remote shells won't have the beefed up prompt)

<comment><AUTHOR> I also have the hostname on the prompt, but sometimes having a contrasting theme can help :)

</comment></comment><comment><USER5> Sorry, but I can't see sh*t on those Solarized themes which you call the "best theme ever created".

<comment><USER6> Well thanks for sharing, I guess; a lot of people apparently really like those themes if the recent HN thread is anything to go by: <http://news.ycombinator.com/item?id=2393976>

Anyway, that wasn't the point of the post; you could use this technique just as well with whatever color schemes that you _can_ see shit on.</comment></comment>


Blue Apron's 90% Drop Makes It Third Worst U.S. IPO This Decade - <AUTHOR> https://www.bloomberg.com/news/articles/2018-12-18/blue-apron-s-90-drop-makes-it-third-worst-u-s-ipo-this-decade <comment><USER2> Good. I hope they fail. This is an insanely wasteful business model, and any claims they make about sustainability are ancillary at best.

<comment><USER3> But is it less wasteful than grocery stores, which trash _so much_ of their stock/produce?

<comment><USER4> no

<comment><USER3> Any source to support that?

</comment></comment></comment></comment><comment><USER5> As much as I love certain aspects of the US, companies like Blue Apron just serve as a reminder of the absolutely twisted and unhealthy relationship that Americans seems to have regarding their daily meals.

I know people who eat out multiple times a week (with their spouse), every week of the year, and other people who eat out every day during lunch. I guess it's somewhat understandable if you're single and maybe even working at one of the places where they have catered lunch, but if you have a family at home and have to actually pay for restaurants yourself it's a huge item on your monthly expenses.

And that's just the economics of it. Let's not even talk about how having catered meals for nearly every occasion distances you from the act and ritual of preparing a meal together with your family, taking the time, sitting down and enjoying it.

<comment><USER6> >As much as I love certain aspects of the US, companies like Blue Apron just serve as a reminder of the absolutely twisted and unhealthy relationship that Americans seems to have regarding their daily meals.

Eh. Most Americans can't afford this type of service, even if they think they can. 10$ for a meal is insanely expensive, sure going out to eat once in a while but not for multiple meals a week. You can eat for multiple days off of 10$, one of their 10$ meals can be less than 1/3 of a 2k kcal diet's needs meaning you need 25-35ish dollars a day to survive off their service.

This is for suckers, like the 'dollar shave club' customers that don't realize they can buy the exact same blades they sell (at least initially) direct from the manufacturer (Dorco) or spend far less and use a safety razor. Or suckers that fall for 'loot crate' type services where you get garbage product, sometimes stuff that just didn't sell well retail, and are told you're getting a bargain.

<comment><USER7> > You can eat for multiple days off of 10$, one of their 10$ meals can be less > than 1/3 of a 2k kcal diet's needs meaning you need 25-35ish dollars a day > to survive off their service.

Well, surely, you were trying to survive off their meals you'd use the family plan, where it's $9/serving, rather than the $10/serving plan.

Plus, we're talking Blue Apron, not Soylent; it's not even aimed at people living off of it.

</comment></comment></comment><comment><USER8> If I were to do a start up right now, I think I would do a meal kit start up (not that I actually know what I'm doing). There's still a market for it—people really like the kits—it's the business model that's the problem. I think the delivery part is where they go wrong. It's too expensive to cold pack these things every day and deliver them to individual addresses.

I'd try to partner with restaurants to prepare the meal kits. Restaurants have a staff that's trained to handle food, plus a kitchen to do it safely, and time during the day when they're not busy. Oh, and they already received regular large food deliveries. Restaurants are well distributed enough that it's easy enough for people to pick up a kit on the way home from work.

From the point of the startup, there's not intense capital costs, you just have organize orders and pickups and ensure quality.

<comment><USER9> I think the cost to subsidize this program is too much. I have countless flyers for $50 off first order etc etc.

I think if I were to enter this space, I would start a B2B meal prep where I have staff go into grocery stores, put together boxes that the stores own customers can buy. I'm not talking about the prepped food, but boxes with all the ingredients. Stores retain some lost customers from these meal kits and people get the experience of cooking something new.

</comment></comment><comment><USER6> "Company with absurdly expensive food that still requires considerable preparation gets rejected by non-tech workers".

Federal minimum wage is $7.25 and median HOUSEHOLD income is around 59k so let's look at their pricing: the cheapest plan they offer is $39.96 a week for 4 servings a week ranging to $143.84 for 16 servings a week for $143.84.

That means 1-day's kcals for someone on a 2k kcal diet is $25.68 to $39.96 a day depending on the plan. PURE INSANITY.

<comment><USER10> What food has the most calories per dolar?

<comment><USER11> >What food has the most calories per dolar?

For DIY food my wild guess would be butter. My somewhat educated guess for prepared food would be something off the value menu at McDonalds/Burger King/Wendys.

<comment><USER12> My first guess would have been rice. Rice is super cheap. According to [1], it's oils and flours, followed closely by rice and sugar.

Butter is around $5/lb for 32 x 100-Kcal servings, so it's only around 640 Kcal/$. That would put it pretty far down the list, below milk and eggs, and on par with lentils.

[1]: [https://efficiencyiseverything.com/the-highest-calorie- per-d...](https://efficiencyiseverything.com/the-highest-calorie-per-dollar- food-in-human-history-flour-vs-oil/)

</comment></comment></comment></comment><comment><USER13> Doesn't matter, had exit.

</comment><comment><AUTHOR> Why the article got dupe?

<comment><USER14> because an article about this is already on the front page, and you should have checked for duplicates before submitting.

<comment><AUTHOR> ohh, thanks!

</comment></comment></comment><comment><USER15> This surprises me in no way.

<comment><USER16> I'm more surprised that it's not the worst, then again "a provider of helicopter transport for offshore oil drillers" does sound like a worse idea</comment></comment>


How I survived one week without an adblocker - <AUTHOR> http://bitboxer.de/2011/11/27/how-i-survived-one-week-without-an-adblocker/ <comment><USER2> There are two things wrong with this article.

First, it doesn't even mention that without an adblocker your being tracked all over the place by advertisers. (A practice that is btw clearly illegal in many countries, even if they haven't explicitly wrote it into the law yet.)

Second, but this is more subjective, I have a rather different experience with turning off adblockers. Almost every website becomes several times (!) slower, and is full moving distractions trying to get my attention. Sorry, I can't read that way offline, and I won't read that way online. Only when advertising stops disrupting my experience and is only passively present (like it is in old-fashioned dead tree publications) will I turn off the adblocker.

I the mean time, I only make exceptions for sites that a) understand I have no obligation to download their ads, and ask nicely, and b) are very careful about the ads they put on their site.

<comment><USER3> Opt-out here:

<http://www.networkadvertising.org/managing/opt_out.asp>

Or disallow cookies from ad networks, so they can't track.

<comment><USER4> Firefox addon that does the same thing, albeit on a superset of advertisers: [https://addons.mozilla.org/en-US/firefox/addon/beef-taco- tar...](https://addons.mozilla.org/en-US/firefox/addon/beef-taco-targeted- advertising/)

</comment></comment></comment><comment><USER5> Am i the only one who never uses an adblock? I have two reasons for that, first is that it seems unfair to use a site and not pay back in a meaningful way. Almost like stealing. Second is that i don't visit a huge number of unique sites every day and the ones i visit are respectful enough to not make nuisance. I rarely come across any super annoying ad. I am kind of surprised how others simply take it for granted that everyone else uses an adblock. I have been living very well without an adblock for last 5 years.

<comment><USER6> But don't you actually have to _click_ the ad to help the site?

<comment><USER7> There's three main ways people buy online advertising:

\- cost per thousand impressions (CPM) \- cost per click (CPC) \- cost per action (CPA), where the action is something that takes place after the click, like signing up for Netflix.

If the ad buy was CPM, using an ad blocker takes revenue from the site they'd otherwise receive. If not, not.

</comment></comment></comment><comment><USER8> I believe it was after reading a discussion here on HN that I began a similar experiment. It's been almost a week and I agree with bitboxer's assessment overall. Most of the ads seem to stay out of the way.

Some are overwhelming or at the very least a bit annoying. The first that pops to mind is space.com - which kept showing a footer ad even though I clicked the "X" - but that's only my immediate example because I'd been to that site more yesterday due to the Mars launch than I have in quite some time.

I noticed that a lot of newpapers seem to have ads that make me want to turn and run away. The full page ads with the "Click to continue" link at the top right. Forbes.com comes to mind immediately. Those ads are repulsive and make me never want to return. And while on the subject, any site that shows a 10 - 15 second video ad before a 15 second video clip will no longer get any of my attention, links, clicks, etc.

If I'm going to continue to try to use the web with ads enabled, I have to draw a line as to what is and isn't acceptable. I haven't tried bitboxer's fork yet, but it sounds like a step in the right direction. To take it further, it might be useful (to owners and visitors) to have a means for site owners to find out whether they are explicitly being blocked and hence losing potential income due of obnoxious advertising.

<comment><AUTHOR> Yes, an information for site owners why they are blocked would be great. But I don't know how we could implement this in a good way. If someone has Ideas in this direction I would love to hear them!

<comment><USER8> Since most ad blockers are whitelist-only, I assume that people using a blacklist ad blocker are explicitly blocking sites with annoying ads. Of course that's merely a generalization based on how I think I would use it.

If the stats are shown historically, a site owner could see that after a redesign or some changes on their site, or maybe after signing up with a new ad vendor, that there was a spike in their ad blocks and rethink their design or deal with said vendor.

I don't know if any of this would play out as I'm visualizing it, but I do feel opening up the conversation between site-owner and visitor to figure out what can be considered useful advertising is good for everyone.

</comment></comment></comment><comment><USER9> I spent a long time browsing without an ad blocker. I only started using one a couple years ago after getting hit by a 0-day exploit in an advertisement on a major website.

Now I whitelist the sites that I know don't host third-party script/media content (basically, text/image-only). There aren't many of them, unfortunately.

At present my two choices are: Send ad revenue to websites I like and get my machine owned by exploits, OR, browse without worrying about those exploits AND without the annoyance of advertisements. The latter is a vastly superior choice, even if there is some moral argument to be made about how I'm depriving those websites of revenue.

If someone has a sound technical solution for this problem, I'd love to be able to uninstall adblock plus. It tends to erroneously hide non-ad content sometimes.

<comment><USER10> >If someone has a sound technical solution for this problem

<http://en.wikipedia.org/wiki/Linux> works pretty well. I'm not trying to be pedantic, of course - Linux is immune to Windows exploits, of course, and cross platform exploits, such as for Flash, generally don't work unless specifically targeted against Linux, which in practice doesn't happen on a scattershot distribution method like an ad network.

<comment> mkr-hn That's not a sound technical solution if you prefer or need a different OS, like Windows or one of the Apples.

<comment><USER11> Nothing is a sound technical solution if you prefer or are required to be in a situation where it is not possible to employ.

</comment></comment></comment></comment><comment><USER12> As I began reading this, I thought "ugh, someone making hyperbole about how terrible they thought ads were on the web" (I seriously doubt anyone has been able to do NO adblock-free browsing in 10 years, while using VMs, other computers, family computers, etc.). And then I read the part about clicking an ad, and... wow. I've never thought to click an ad before. Even an ad for a product I want to buy right then, I assumed would take me to some shady site or the main site only via some shady pop-up or something. I kind of really want to see what clicking ads does now.

<comment><USER13> Same here. Most of the time the sites with the most annoying ads are ones you wouldn't want to frequent anyway so you rarely deal with it. To me ads are just there and I skip over them. Sometimes they catch my attention but they're really not all that annoying. It seems that adblocking is something that was more useful back in the 90's. These days ads are pretty unobtrusive for the most part. There's a bit of pop over here and there for some newsletter they want you to sign up for but it takes less than a second to click out of and they load fast and only display when fully loaded. I thought this was a lot of hyperbole too.

</comment></comment><comment><USER14> Even if ads are less obtrusive then they once where .. the thing that really annoys me when using a browser without an ad blocker is page loads getting hung up waiting on responses from ads.somedomain.com

</comment><comment><USER15> So ads are less annoying now than they were a couple of years ago...

Is it perhaps because they've adapted to the increasingly common practice of adblocker(and browsers which prohibit unprompted javascript popups)? Let's not forget that adblocker is a great thing, if only because it incentivized a move towards less obtrusive ads.

Another thing: ads may be less visibily intrusive but things like tracking cookies are still widely (100%?) used. So if privacy is any sort of a concern, an adblocker is probably still a good thing to have.

</comment><comment><USER16> I don't understand how such thing could be on the front page of Hacker News - this is ridiculous. It's sooo hardcore to browse the web without an adblocker... and survive. I'm sorry, but this is not what a site like HN should be about...

</comment><comment><USER17> I like this article. I'll have at look at the forked ad-blocker sometime.

It depends on the type of site you visit, but most sites realise that ads are hated and obnoxious ads can cause visitors to leave.

Punishing bad ads, and letting site owners know that they lost a visitor because of the obnoxious ad, is important. Whether that'll counteract the hordes of idiots who'll happily click those ads (see "evony" my lord) is another matter.

</comment><comment><USER18> > I actually clicked on an advert that interested me. It was the ad for a > computer game I wanted to buy. And after seeing the trailer on the ad-site I > bought it.

I would not be so sure about that. Without seeing the ad, you might have never watched the trailer. Or maybe a week later when you see the trailer for a different reason you suddenly realize that there is a better game you want to buy. Advertisements are sneaky that way.

I have Adblock enabled and don't ever want to disable it. Those few times I am on a different computer/working inside a virtual machine are enough to stumble upon many ads that are intrusive and annoying. I really wish advertisement would go away alltogether. Of course this won't happen anytime soon, but alternative ways to reward website creators like flattr, paypal donations, beerware license or a simple subscription model are getting more common.

</comment><comment><USER19> I also use adblock to blacklist everything facebook. I don't have an account, and was often waiting for some fb.com stuff loading on pages. I've whitelisted ads on a handful of sites that explicitly and politely asked their users to do so (reddit, osnews,but NOT arstechnica).

</comment><comment><USER20> The world on its head, we need an article on hackernews to tell us how 90% of the users are experiencing the web. ;)

</comment><comment><USER21> Adblock for Chrome - [https://chrome.google.com/webstore/detail/gighmmpiobklfepjoc...](https://chrome.google.com/webstore/detail/gighmmpiobklfepjocnamgkkbiglidom) have an option where you can "Show ads everywhere except for these domains..." (screenshot - <https://skitch.com/brajeshwar/gmw2e/adblock-options>). Isn't that what you're looking for?

<comment><AUTHOR> That is the manual approach the Adblock Plus had, too. But I have added a nice gui method for that in my fork :) . In my fork you can simply click on the adblock plus icon in the url bar and activate the adblocker for that site. Behind the scene that will add the site to the list you show in that options screen.

</comment></comment><comment><USER3> Glad you found out that just because a small minority is abusing the system, its not a good idea to destroy the income stream of all sites. I would love to block people that block the ads on my sites. I respect my users by placing only relevant and non-intrusive ads. If a user doesn't respect me by blocking all my ads, they can find their information or entertainment somewhere else, for all I care.

<comment> mkr-hn You lose the chance to prove your value to someone if you block them. I usually whitelist sites that I find useful. I've had Penny Arcade whitelisted for years.

<comment><USER3> I can't block them, there is no way to do that reliably.

But if I had a brick-and-mortar store, I also wouldn't hand out free products to people who tell me "I may pay the second time".

<comment><USER22> Detecting a hidden DOM element, as described in a comment above, that wouldn't do it?

<comment><USER3> But that's only asuming JS is enabled.

</comment></comment></comment></comment></comment><comment><USER23> My 'adblock' is simply not having flash enabled. I haven't seen a particularly annoying ad in ages.

<comment><USER24> Is there a way to disable flash but whitelist domains whose flash assets I will display? (Meaning I want to whitelist the domain actually serving the asset, not the page displaying them.) I suspect that approach would get rid of 90% of flash ads, while still allowing me to watch youtube or play the occasional flash game.

<comment><USER25> Flashblock (for Firefox) does this.

</comment></comment></comment><comment><USER26> An easier solution than forking Adblock Plus to add per-site configurations would be to create a custom filter list. Instead of subscribing to popular Adblock lists like Fanboy's List or EasyList, create a minimal filter list that just blocks the most egregious ads. I'm sure quite a few people might opt for such a list because they hate annoying ads, but feel like that want to support sites they like (by viewing their ads).

</comment><comment><USER27> I don't understand why you would single out ads. For me the whole experience of a site is what counts. If a site gives me a bad experience, whether due to ads or something else, I don't visit it anymore. Most news aggregators put the site you'll be visiting next to the link, so if you keep an eye on that you can use your brain as "negative experience blocker".

</comment><comment><USER28> adblock is a waste of time.

i use 3 browsers, a mobile phone, a tablet... i would go insane with something unpractical as adblockers.

Just use this instead: <http://someonewhocares.org/hosts/>

work with any browser, any OS.

<comment><USER29> Interesting concept. I see this list has been updated recently, do you know if it gets updated regularly?

</comment></comment><comment><USER30> Please look up "where" and "were" in a dictionary. I couldn't focus on the content of the article because I had to reread every sentence containing one of those words.</comment>


Letter From a VC: Seeking Feedback - <AUTHOR> http://www.thefunded.com/funds/item/4162

<comment><USER2> For those of you who aren't already members of thefunded, I highly recommend it. There's so many shady VCs out there and it's just one more tool to cut through the crap.

</comment><comment><USER3> Seems from the comments that what entrepreneurs want most is speedy responses.</comment>


Quantum Darwinism, an Idea to Explain Objective Reality, Passes First Tests - <AUTHOR> https://www.quantamagazine.org/quantum-darwinism-an-idea-to-explain-objective-reality-passes-first-tests-20190722/ <comment><USER2> I was quoted in this piece, and adapted some of my correspondence with the author into a blog post: [http://blog.jessriedel.com/2019/07/24/faq-about- experimental...](http://blog.jessriedel.com/2019/07/24/faq-about-experimental- quantum-darwinism/)

<comment><USER3> Are the actual papers available online? On arxiv.org?

<comment><USER2> Yes, they are linked from the blog post. The experimental papers are arXiv numbers 1803.01913, 1808.07388, and 1809.10456. The basic theoretical papers are available from the Wikipedia page on quantum Darwinism, also linked.

<comment><USER3> Ok, thanks!

</comment></comment></comment></comment><comment><USER4> I don't know if the analogy to darwinian evolution makes much sense, it seems to me that it makes more sense to see this as a way of error-correcting our reality, that is to say quantum phenomenon occur because anything else would cause a severe inconsistency.

<comment><USER2> It is indeed a stretch, but it's just supposed to be an evocative name not a perfect analogy. In particular, quantum Darwinism has a notion of fittest types of information, and this information is replicated, but it crucially does not feature a notion of mutation, so in particular it cannot result in increasing complexity/sophistication over time as produced by biological Darwinism.

<comment><USER5> Evocative "sorta" names have a tendency to spread misinformation when the scientific details are opaque to most people. It's not a practice that I think is okay.

<comment><USER2> Then you should probably express your displeasure to guy who picked the name :)

Seriously though, all evocative names are imperfect. Laymen always over interpret them. I don't like "quantum Darwinism" much, but if your standard is that the name of a mathematical concept not be misinterpreted, then basically all English words are out.

<comment><USER6> Relevant xkcd: [https://xkcd.com/895/](https://xkcd.com/895/)

</comment></comment></comment></comment></comment><comment><USER7> Zurek explaining some of it @ [https://www.youtube.com/watch?v=27zMdaBgt6g](https://www.youtube.com/watch?v=27zMdaBgt6g)

</comment><comment><USER8> Really good article but I'm unconvinced about those pointer states. The classicly observed values simply have overwhelmingly higher probability.

<comment><USER9> I also view the apearance of classical physics as you say, but I am not sure if that rules out this concept in the article. I admittedly don't really understand what the article is saying. (It takes me alot of work to understand these things.) The author does admit that this is just an implementation of the basic laws of quantum maechanics. I suppose why this is interesting is just that in large systems the aggregate behavior does not always follow obviously from the basic rules.

I would like to write down what I considered to be the standard motivation for why the classical solution arises, which is in other words why it is more probable, as you point out.

In the Feynman path integral formalism, any paths in the system is possible, with an amplitude proprotional to the exponential of the action. (Action as in a Lagrangian). For paths that are an extremum of the action, there is the least destructive interference between neighboring paths, since there is the smallest phase change between these neighboring paths. Of course this extremum of the action is, not coincidentally, the classical solution, which is the result from the lagrangian formulation of classical machanics.

</comment></comment><comment><USER10> From the first paragraph of the article:

> An atom typically can't be assigned a definite position, for example — we > can merely calculate the probability of finding it in various places.

Is this really the case? Or maybe author meant 'electron' instead of 'atom'?

I mean, if we wouldn't be able of calculating the position of an Atom, how could "A Boy And His Atom" would be possible?

[https://www.youtube.com/watch?v=oSCX78-8-q0](https://www.youtube.com/watch?v=oSCX78-8-q0)

<comment><USER11> There is a limit to the precision of a position measurement of any particle, and atoms are made of many particles. The Heisenberg Uncertainty Principle states that the uncertainty of the position and momentum of a particle are related. In particular, the product of the errors has a constant lower bound. Visually, if you think of (1d) position and (1d) momentum plotted on a 2d graph, then Heisenberg's principle means that particles are not points, but rectangles with a minimum area.

</comment></comment><comment><USER12> I can tell when I don't truly understand something by my ability to disagree, or make counter arguments. In this case it sounds reasonable -- that the probability distributions of the quantum scale somehow cohere because of a Darwinian mechanism. But if you told me, oh, actually the center of mass of the probability distributions is perceived as the real location, that makes sense too.

<comment><USER13> I know it's just an off the cuff example, but that one seems easy to argue against -- in the double slit experiment, the particle is perceived to go through both slits, not through the middle.

</comment></comment><comment><USER14> > possible only because pointer states of quantum objects exist

I knew it was pointers! So observation is the universe's GC? I feel better knowing that life is here at least to collapse enough wave functions to keep things humming along nicely. (Ever wake up and feel that you must have been stopped-and-copied over the night??)

<comment><USER15> I know this is a joke, but QD specifically excludes the requirement of a living observer.

</comment></comment><comment><USER16> Wrap this up in an visualization animation and I'm sure I could understand it.

</comment><comment><USER17> Here's a rebuttal from a physicist [https://motls.blogspot.com/2019/07/quanta- magazines-anti-qua...](https://motls.blogspot.com/2019/07/quanta-magazines- anti-quantum-zeal.html)

<comment><USER18> The rebuttal takes a view which is close to my heart—but [Motl] puts it so viciously, dismisses without genuine inquiry or curiosity the intriguing claims of the article, and plays so much faster and looser with his ideas than the author he critiques—you can taste his contrition. Ball and [Motl] are probably both mistaken about what QD actually explains.

Edit: fixed names

<comment><USER19> For future reference, "Luboš Motl" and "puts it so viciously, dismisses without genuine inquiry or curiosity [....], and plays so much faster and looser with his ideas than the author he critiques—you can taste his contrition" are pretty much synonymous. The man's a troll with a PhD.

</comment></comment></comment><comment><USER20> I sort of got this but I found this article full of clunky analogies including the "Darwinism" tag itself.

</comment><comment><USER21> Is there even such a thing as objective reality?

<comment><USER22> Would the Universe exist if there were no conscious beings to observe it?

</comment></comment><comment><USER23> So much for parallel universes?

</comment><comment><USER24> Damn I feel stupid.

<comment><USER25> Don't. I just got my PhD (working on quantum computing at a good school) and I do not really get the point they are making. It is interesting, but esoteric even for people working in related fields.

However, it is a great opportunity to start learning more about it!

<comment><USER26> My comment isn't useful, but I really can't get a handle on anything "quantum" related. The only thing I _sort_ of understand is that if you could entangle a massive amount of photons/electrons, you could have "quantum radar" which would be jam-proof.

I don't really understand even that though. Could you verify an electron reflecting back is entangled with an electron you have on hand, or are they all just "entangled" with something or "entangled" with some spin (which could be replicated)?

<comment><USER27> >My comment isn't useful, but I really can't get a handle on anything "quantum" related.

That is probably because you have tried to read "applications" papers/articles (some of them of dubious scientific value, and more sci-fi/futurology) without properly understanding the fundamentals first. I strongly recommend "Quantum Mechanics", Cohen-Tannoudji et al. The first two chapters are the best introduction to quantum mechanics I've read: concise and to the point, starting from experiment and explaining the key ideas of quantum theory, and then the mathematical formulation.

<comment><USER26> Thanks for the recommendation!

</comment></comment></comment></comment></comment><comment><USER28> As a layman I just can't get past the glaring reality of: we simply do not possess the means (i.e. equipment/tools) to examine/measure/control the fundamental elements of matter without utterly affecting the outcome in ways we are not able to control, understand or accurately predict.

I don't believe there is any amount of quantum theories that will get us past this fundamental boundary.

<comment><USER13> It can be made to work in at least some cases -- for example, QED is a theory about how individual photons and electrons behave that's in truly fantastic agreement with experimental results.

There's a deep philosophical question about whether we can every truly learn the _real_ fundamental laws of nature, sure; but it certainly looks like we can get very very close, perhaps arbitrarily close.</comment></comment>


A New & Improved jQuery Script to Automatically Preload images from CSS - <AUTHOR> http://www.filamentgroup.com/lab/update_automatically_preload_images_from_css_with_jquery/

<comment><USER2> 403 forbidden</comment>


New anti-encryption bill worse than EARN IT - <AUTHOR> https://tutanota.com/blog/posts/lawful-access-encrypted-data-act-backdoor/ <comment><USER2> If the requirement is for US Companies to provide encryption backdoors what about allowing someone to provide their own PGP (or other) certs -- would that side-step the requirement since the encryption is being performed by the user and not the company?</comment>


How to pick an accountant for your online business - <AUTHOR> http://fortuito.us/2007/06/how_to_pick_an_accountant_for <comment><USER2> Thanks! I find these kinds of articles much more useful than the Nth article about Rails, because, being a tech guy, it's the business stuff I need to work harder at to do well.

</comment><comment><USER3> The content's worth reading, but the page's style means page up/down skip text because it's grayed out and unreadable near the screen's boundaries.</comment>


LD_PRELOAD is super fun. And easy - <AUTHOR> http://jvns.ca/blog/2014/11/27/ld-preload-is-super-fun-and-easy/

<comment><USER2> _So if you didn't want your program to be attacked like this, you could: statically link your program... "_

That's not really possible on Linux anymore, is it?

<comment><USER3> Of course it is. AFAIRF Valgrind works by replacing malloc() and free() that way.

<comment><USER2> I meant: it's not possible to statically link programs on Linux anymore, is it?

<comment><USER4> Yes, it's possible. Just pass -static to gcc, for example.

</comment></comment></comment></comment><comment><USER5> One of the funniest class I had when I was a student was to rewrite malloc and replace it using LD_PRELOAD then try to run Firefox for example.</comment>