Why or Why Aren't You Using Scala? - <AUTHOR> http://isaacmosquera.com/post/91453379885/why-or-why-arent-you-using-scala

<comment><USER2> I'm using it because due to performance and maturity requirements I decided to build my app on the JVM. Among the JVM frameworks I selected Play for its features (development workflow, statelessness, async, REST/JSON). Given the choice of Java or Scala, I selected Scala because it is more expressive (less, clearer code) and the functional style makes it easier to work in asynchronous and immutable style. Also, I wanted strong typing and didn't want to use Groovy or Clojure.

</comment><comment><USER3> 1\. The type system is too complicated.

2\. It's difficult to find implicits. If I am looking for a Haskell typeclass instance, I know it will probably be defined either in the same module as the type, or the same module as the typeclass. I couldn't work out where to find implicits.

<comment><USER4> It's easy to get lost in the type system if you use type-complex frameworks like Slick.

Right now, there are a lot of frameworks to choose from and to evaluate. And there are a lot of "experiments" going on. I think that this will improve as the community matures and settles on fewer ways to do things.

We've been using Scala now for 18 months in production, and I sometimes feel that library designers need to step back and try to not overuse the power of the language.</comment></comment>


Analyzing S3 and CloudFront access logs with AWS RedShift - <AUTHOR> http://techblog.thescore.com/analyzing-s3-and-cloudfront-access-logs-with-redshift/

<comment><USER2> If you would like to have a look on something more tailored to log data, feel free to try: [http://www.sumologic.com/](http://www.sumologic.com/)

It's more flexible, but by default pure huge batch processing will be slower.

</comment><comment><USER3> Glad to see Canadians still like hockey almost twice as much as the other sports ;)</comment>


Why Prison?: An Economic Critique - <AUTHOR> https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2928219 <comment><USER2> I posted about how punishment is almost always gratuitous a while back: [https://news.ycombinator.com/item?id=13286085](https://news.ycombinator.com/item?id=13286085)

(The summary looks interesting - I'm commenting here to remind myself to read this tomorrow...)</comment>


The Era of Symbol Fonts - <AUTHOR> http://alistapart.com/article/the-era-of-symbol-fonts For what it's worth the Timepiece ligature demo appears to have been hacked - I've let ALA know and submitted it to Google's malware checker. Would probably avoid visiting that link for the time being. <comment><USER2> Using icons in a navbar instead of labels tends to make it harder to use, not easier.

Look at the example this article uses. It shows a house without a door, a calculator, a multi-story building and a shopping cart.

The house usually means 'Home', 'Exit', or 'Location'. The shopping cart usually means 'Purchase', 'Cart' or 'Checkout'. Those are fairly clear. But then, why would you use a calculator for 'Contact'? And how is the multi-story building different from the house?

More often than not, when I visit a website that uses symbols in its navbar instead of text, I need to mouseover to find out what the heck the buttons are for.

When symbols are used in tandem with text links, I do find it often makes navbars easier to use, but to replace the text links altogether, the symbols need to be completely unambiguous – and that's hard to accomplish if your navbar consists of multiple similar links like 'order', 'checkout', 'cart', 'currency', 'shipping', etc.

<comment><USER3> Yeah yeah, everyone should know about the perils of "Mystery Meat Navigation" from the 1996 book "Web Pages That Suck."

I'm sure that the icons were being used only as demonstration here, and that no one would actually do such a thing in this day and age.

<comment><USER2> _"no one would actually do such a thing in this day and age"_

You'd think!

<http://www.cardiffcontemporary.co.uk/content.asp> (Do try the 'Accessibility' link)

Also: <http://explore.bfi.org.uk/> (Keep scrolling...)

</comment></comment></comment><comment><USER4> I've been away from the frontlines of webdev for a few years now - is there a reason why we're not all using SVGs yet?

Symbol fonts (even though I use them myself in native mobile apps) seem like a bridge hack, not a sustainable, long-term thing.

It seems incredibly silly to model images as characters when we already have the concept of images built into HTML. I'd very happily ditch symbol fonts as soon as iOS supports SVGs...

<comment><USER5> If you copy and paste the clock (or if a non-JS supporting screen reader or search engine encounters it), you get a time such as 12:04:37. That's pretty cool, and I'd be interested to know if SVG can do something similar.

<comment><USER4> That seems to be an _incredibly_ fringe use case to justify the "wrong" implementation (i.e., modeling images as text when your protocol already has affordances for images).

</comment></comment></comment><comment><USER6> I'm skeptical that most websites would see a performance improvement in switching from images to symbol fonts. Github is doing it close to optimally:

\- custom webfont that has exactly what they need (26k)

\- loaded in js to minimize downloads (only one of woff and eot)

\- served with very long cache lifetime

\- served via cdn

But even then they have the problem that all text display has to wait for the font to download.

Most sites are going to skip some of these, so I expect the change to symbol fonts to hurt most websites that try it.

If you do try it, definitely A/B test it to make sure it really is speeding up pageloads for your users.

<comment><USER7> For me, the #1 concern is mobile zooming and retina displays.

No more blurry pixellated edges that suddenly make your site look like total crap. Instead, it's as sharp as a printed page!

For me, improving page loading speeds are a secondary concern -- and as long as symbol fonts don't make the page noticeably _slower_ to load, all is good.

<comment><USER6> I agree: the vector sharpness of symbol fonts is their strongest selling point. I'm just worried that the article leading with "improving performance is a constant process" is going to make people think symbol fonts will speed up their pages.

</comment></comment></comment><comment><USER8> I still believe using fonts to show icons is a hack. When we have better support for SVG files in browsers I believe that will be the most popular way of displaying icons. Simply because icon fonts are harder to user and edit. With SVG files the icons are delivered in XML format that can easily be manipulated by eg. JS. The downside is of course the many server requests it will require - one per icon.

<comment><AUTHOR> Not if you use fragment URLs: a single SVG with all your icons then reference icons.svg#telephone_icon or whatever. More info at [http://www.broken- links.com/2012/08/14/better-svg-sprites-wi...](http://www.broken- links.com/2012/08/14/better-svg-sprites-with-fragment-identifiers/)

<comment><USER6> This is Firefox and IE10 only so far: <http://caniuse.com/#feat=svg-fragment>

</comment></comment></comment><comment><USER9> Whoa! First time I've heard of using ligatures to render meaningful text as icons. That's a pretty cool hack!

Probably not fit for mainstream use though - hard to maintain, especially if you factor in i18n...

</comment><comment><USER10> Although we keep saying SVG will fix this, doesn't this seem like SVG has failed and maybe we need to come up with a new way to do vector on the web?

<comment><USER11> I think SVG is finally arriving. Look at D3 for instance.</comment></comment>


Does RentACoder.com Work? - <AUTHOR> http://itscommonsensestupid.blogspot.com/2009/05/does-rentacodercom-work.html

<comment><USER2> I've also never used rentacoder, but my observations, and the observations of others that I've heard leveled against it rarely stem from "the price is too good to be true".

Commonly the problem is that a client requests a specific attribute, let's say a local Win32 client, and the responses are almost all form letters that are clearly pitching the dev team's PHP/JSP/ASP experience: something clearly not useful for the client's needs. Can they do the job? Probably, in the same way the client could pick up a book on C++ development and figure it out himself.

Another thing I've seen that makes me doubt their success is the opposite extreme: clients give _hopelessly_ vague requirements ("I want a facebook-like service") and people come back with "We have a lot of experience with PHP, it will be $1234". How do they know how much time it will take to satisfy the client? They don't even really know what he wants! What are they going to do when they run over budget? As a customer, how can I be sure they'll fix things after they think they've done a fair amount of work for their quoted dollar amount?

Lastly, some other people have also seen problems and posted trolls to those sites, asking people to provide solutions to the halting problem or travelling salesman problems: obvious impossible problems to anyone with basic comp-sci understanding (I'm not formally comp-sci educated, so I don't want to sound like I'm coming from on-high here), but people will reply with bids for these programs! The general problem is a perception of a lack of quality, and the specific problem is RAC and other similar sites don't offer any easy way to verify that the coders in question meet any sort of quality bar.

<comment><USER3> There are things like Topcoder which use competitions to build components and other projects. Topcoder's business is a lot different but I could see them doing a rental of sorts. Seeing someone's past history and rating gives a great insight to their expertise.

</comment></comment><comment><USER4> Exactly, RAC is all about the race to the bottom. It's like buying a car for $50. Yea, you're only out $50 but you most probably won't get a car that will take you where you need to go. It's for people who are already convinced that they are going to get ripped off so they might as well get ripped of for less.</comment>


The death of neoliberalism from within - <AUTHOR> http://www.theguardian.com/commentisfree/2016/may/31/witnessing-death-neoliberalism-imf-economists <comment><USER3> Neoliberalism is not a school of economic thought. It's not an actual ideology that anyone associates themselves with. It's a word without any concrete meaning thrown around in order to avoid real discussion.

The free market is not failing. Current markets that are failing are hardly "free." What is failing is a system of government regulation and control that supports wall street and the rich at the expense of the middle class.

The governments and their federal banks created every single problem called out in the article. To turn around, blame free-markets, and propose more government as the solution is disgustingly disingenuous.

The IMF itself is not a proponent of the free market. It exists precisely to support excess government spending and to bail rich bondholders who make donations to politicians. Nothing lassiez faire about that.

The laissez faire solution to an overspending government would be bondholders losing money, currency depreciating, and poor leaders being held accountable - to which the IMF is diametrically opposed.

<comment><USER4> Of course it is an explicit ideology that many associate themselves with (though not by name, since it's become something of a slur because it's so obviously religious about the "free market" and hated because of this). It's explained clearly in TFA.

Of course, the classic rabid libertarian answer -- any time any economic failure happens, blame regulations. When we free the markets, and the markets fail to provide anything we want (income equality, fairness, a middle class, a healthy society) -- the obvious conclusion? The markets aren't free enough. Deregulate, so the wealthy can make a killing abusing the poor more than they already do.

<comment><USER5> Noam Chomsky, that rabid right-wing libertarian:

 _What's called the capitalist system is very far from any model of capitalism or market. Take the fossil fuels industries: there was a recent study by the IMF which tried to estimate the subsidy that energy corporations get from governments. The total was colossal. I think it was around $5 trillion annually. That's got nothing to do with markets and capitalism._

[https://www.jacobinmag.com/2015/09/noam-chomsky-bernie- sande...](https://www.jacobinmag.com/2015/09/noam-chomsky-bernie-sanders- greece-tsipras-grexit-austerity-neoliberalism-protest/)

\--

The problem is that capitalists use the language of free markets, but are not actually proponents of its wide application, just where it benefits them. Or to put it more pithily: _capitalists don 't like capitalism_. So you get localized deregulations and strong regulations (example [1]) where it benefits them. But we should distinguish the cases.

[1] [http://www.wsj.com/articles/trade-groups-for-chemical- firms-...](http://www.wsj.com/articles/trade-groups-for-chemical-firms-in-a- twist-seek-more-u-s-regulation-1450348202)

<comment><USER6> OMG. Very true. The hypocrisy is sickening and finally people are waking up to it. For example, look at Paul Ryan. Tea Party, no-liberal , yada, yada, yada comes from a privileged wealth family owning a construction business fed from government contracts.

<comment><USER7> Uhm... no. Him being from a wealthy family is not an example of hypocrisy. Nor is his family business being fed with government contracts. You've _badly_ misunderstood the issue if you think that's hypocrisy.

The question is... has he been a strong proponent of extra licensing requirements for government contractors. Licensing requirements that his family is able to easily handle, but will push out smaller competitors. That would be hypocrisy.

Has he supported legislation against subcontracting or legislation that artificially limits who the government (or private industry) can hire?

It's not hypocritical to offer services to the government. You're confusing neoliberals with anarchists.

</comment></comment></comment></comment></comment><comment><USER8> We're seeing more and more of these types of articles coming up, but they're all talking about different aspects of the same issue: inability to share growth with wide swaths of the population. In the west, our quality of life has never been higher and products/services have never been cheaper. This has been caused in large part by automation, lean manufacturing, globalization, etc. and each one of these is net positive for society. The problem seems to be that it's become difficult to share these gains with labour in the classical sense; and our society, taxation system, social contract are all based around this meaning of labour.

When I see articles about: \- Austerity, \- Wage growth, \- Universal basic income, \- Death of middle class, \- Rise of right-wing parties, \- Anti-free trade lobbying, \- Donald Trump and Bernie Sanders; I read all of them with same lens. I know my knowledge of economics is medium at best, but I'm starting to look twice at ideas such as UBI. Maybe there needs to be a rethink of the Western social contract around labour.

<comment><USER9> The biggest problem, when I look at the American labor market, is that it seems physically unjust.

The sweat of a person's brow and the wear and tear on their body should have some intrinsic value above and beyond what the market will bear.

That someone working as a farm hand, mover, framer, or roofer gets paid a pittance compared to what I earn for sitting in a climate controlled office, moving my fingers, and thinking? I can't reconcile that with any definition of "fair."

UBI is perhaps one way to address this. Wealth transfer to increase robotics usage and physical mechanization / automation application is perhaps another.

But no one should end up with a broken body at 65 just because we stopped aspiring to do better by each other.

<comment><USER10> >That someone working as a farm hand, mover, framer, or roofer gets paid a pittance compared to what I earn for sitting in a climate controlled office, moving my fingers, and thinking? I can't reconcile that with any definition of "fair."

We all know manual labor isn't that productive, so there's an upper limit on how much the laborer can be paid (the marginal productivity). The problem is the exploitation: the wages unorganized workers receive are far, far below their marginal productivity.

</comment></comment></comment><comment><USER11> The article seems a bit vague as to what it means by neoliberalism. It seems to mean the belief that unregulated free markets won't go wrong which I'm not sure anyone really had. Some bits seem to work OK like letting people trade goods and services and some lead to problems like German banks lending to property speculators in Greece and then wanting to be bailed out when the whole thing tanks. The latter was more straight dumb than anything else, at least with hindsight. I'm not sure there's anyone saying I'm a neoliberal and funding the Greek bubble was a good idea. It's a bit of a strawman.

</comment><comment><USER12> Related to this, I've separately submitted the actual IMF paper [0] referenced (but not linked, the link goes to a Financial Times story about the report) in the article, which has more depth than the somewhat broader-but-fuzzier Guardian article.

[0] [https://news.ycombinator.com/item?id=11831092](https://news.ycombinator.com/item?id=11831092)

</comment><comment><USER13> [http://stumblingandmumbling.typepad.com/stumbling_and_mumbli...](http://stumblingandmumbling.typepad.com/stumbling_and_mumbling/2016/04/over- estimating-neoliberialism.html) points out that "neoliberalism" isn't a thing, ie. not a coherent philosophy. It's just a name for ad hoc greed by many diverse individuals.

<comment><USER14> well argued opposing view: [http://www.perc.org.uk/project_posts/the- difficulty-of-neoli...](http://www.perc.org.uk/project_posts/the-difficulty- of-neoliberalism/)

"The reason 'neoliberalism' appears to defy easy definition (especially to those with an orthodox training in economics or policy science) is that it refers to a necessarily interdisciplinary, colonising process. It is not about the use of markets or competition to solve narrowly economic problems, but about extending them to address fundamental problems of modernity – a sociological concept if ever there was one. For the same reasons, it remains endlessly incomplete, pushing the boundaries of economic rationality into more and more new territories."

</comment></comment><comment><USER15> Somewhat tangentially, I wonder if the kind of misrepresentation* present in this article is going to get better or worse in the future.

The fact that, in a lot of cases, it's trivial to go read the source [0] makes me feel that it should dwindle. However, it seems that, with the substantial increase in content available, having more strident views is required to be heard.

* by misrepresentation I mean that the article was by no means a denial of "neo-liberalism". It was generally very positive about free market economics but looked at 2 niche areas and concluded that 1) short term capital controls may sometimes be worth doing and 2) deficit reduction isn't that valuable in very prosperous countries but is in weaker economies. Not quite what Mr Chakrabortty said it said.

[0] [http://www.imf.org/external/pubs/ft/fandd/2016/06/ostry.htm](http://www.imf.org/external/pubs/ft/fandd/2016/06/ostry.htm)

</comment><comment><USER16> I am glad the author cites Red Plenty. That is a really excellent book that I think a lot of HN readers would like. It really takes you into frame of mind since lost, with poignance and good characters.

It is important to note we live in an age of diminished expectations not just for what capitalism can do but for what government can do, too. Thus, I'm not sure if the fact neoliberalism is disappointing actually means we need a new system.

Do we need bigger government, than the current trend, in the US? The government is projected to grow quite a lot as is. We spend more and more money on education and health care every year, with disappointing results. Look at the Medicaid experiment in Oregon: Finkelstein et al (2015) find very little positive health impacts. Obamacare has cut the number of uninsured, but I would guess its impact on actual health will turn out to be very mild. Access to health care and spending on health care are not very much correlated with health outcomes, as the more costly health care is based on deliberate obfuscation or sloppy statistics or promises meager gains (e.g., slightly shrinking a tumor) in the first place. Neither charter schools, on average, nor public school reforms seem to have helped close the opportunity gap much. The Iraq/Afghanistan wars cost like $2 trillion. Many of the largest public pension plans around the US do not have enough assets to make ends meet, even counting on delusional 7 percent returns! Prisons exploded, and nobody seems happy with that. That land-use regulation has become baroque and suffocating shakedown is something I don't think I need to convince anyone in the Bay of. The best cars are made in non-union shops (e.g., tesla and all the new southern factories).

It is interesting that things generally are moving slowly on all fronts, but I don't think that's necessarily a reason to change course. If you are stuck in a slow left lane of traffic, it doesn't necessarily mean you should get in the right lane.

</comment><comment><USER17> The big question then is what replaces laissez faire economics and how? How do we take the best of the free market while ensuring that governments and public sectors are also robust? I feel like software and technology must have a huge role here, but don't know enough to be able to point out specific solutions.

<comment><USER18> I think free markets are fine.

We just need a huge revaluation of capital. Downwards.

<comment><USER19> Isn't the "death of neoliberalism from within" just the market adjusting itself? I think the situation completely fits what free markets propose.

The problem is not that the system isn't working but rather that it is working too well and we're witnessing the painful consequences of self-adjusting markets.

Self-regulation is cool on paper but in the end we're talking about real people suffering real consequences and, even if the system is adjusting itself, the slowness of "the markets" to realize capital has to trickle down for them to survive (and the resistance of the current capital holders to do so) is producing a lost generation (at best) in the transition.

Of course, the fact that nations (the entities supposed to backpressure the power of capital accumulation) are underlyingly controlled by the very same people not interested in changes to the status quo isn't helping at all.

The system is working as advertised. The society just wasn't told what it all really meant.

<comment><USER7> The more severe problem is that there is a rather strong argument being made by the "Mises brand of neoliberal" that the primary cause of these problems is the lack of neoliberalism in the central-banking world.

Their argument is essentially that the economy-wide boom/bust paradigm is driven by the motivations of the central banks. Normally individual industries and companies would experience fluctuation, but it would not be nearly as damaging without the central banks attempting to 'synchronize' the economy.

</comment></comment></comment></comment><comment><USER20> Reminds me of this: [http://m.youtube.com/watch?v=qOP2V_np2c0](http://m.youtube.com/watch?v=qOP2V_np2c0)

I personally believe it is all the automation and outsourcing that is changing the fundamentals and causing a drop in the demand for human labor - <USER2> undermining our trusty wage-based mechanisms to get money to the masses, who then spend it back on necessities. The drop in demand means less investment and lending. So the money supply shrinks.

The "Great Depression" was coined as a term by Hoover because it sounded calmer than the term commonly used at the time: FINANCIAL PANIC.

A lot of it was caused by automation leading to overproduction by farmers while simultaneously laying off their workers. It took years to build up a manufacturing economy, and it helped that after WW2 the USA had no competitors. So we became #1.

</comment><comment><USER21> The author correlates low growth with high inequality, that is, the money is being held at the top and if only it were redistributed to the middle, the growth floodgates would open.

But look where else the growth is: emerging markets in the developing countries. So, the rich are not taking from the middle class, the middle class is losing its value to the developing countries. As low-friction information gets to developing countries, they are able to supplant the western middle class in the manufacturing and service sectors. This problem will be exacerbated as western businesses continue to automate.

The solution here is not protectionism or the stricter regulation of markets, but is for the western middle class to adapt to the changing paradigm. How to do that is the essential policy question.

</comment><comment><USER7> > Two British examples [of neoliberalism], suggests Will Davies – author of > the Limits of Neoliberalism – would be the NHS and universities "where > classrooms are being transformed into supermarkets".

Without taking a bit of Davies' argument into the article, that seems to badly undercut the argument. I'm not sure I can imagine a segment of society less neoliberal than either of them. (particularly by comparison to other western democracies)

<comment><USER3> Exactly, there's nothing free-market about government run Health Care or Schools.

This is another case of people using words they don't understand.

<comment><USER22> As a general rule, I'd be very cautious before assuming that a columnist for The Economist doesn't understand what he is talking about. You may disagree with his conclusions, but that's a different matter.

What I believe he's talking about is the introduction of free market dynamics to schools and single-payer health care, two institutions that have been resolutely socialist (in the classical sense of the word) for a long, long time. His belief is that these "modernizations" are destroying the institutions.

<comment><USER3> The author of the editorial is from the guardian, not the Economist.

The individual using the NHS/Schools as examples was the IMF author, not the editorial writer.

I never said either didn't understand economics. I said he didn't understand some of the words he was using. I was referring to the use of "neoliberalism" & "laissez faire"

<comment><USER12> > The author of the editorial is from the guardian, not the Economist.

True.

> The individual using the NHS/Schools as examples was the IMF author, not the > editorial writer.

False. The NHS/Schools example comes (as is explicitly stated in the Guardian piece) from Will Davies, author of _The Limits of Neoliberalism_ , a completely separate work from the IMF report.

</comment></comment></comment></comment></comment><comment><USER23> the thing about capitalism is that capitalism has no ideology, only the profit motive (nothing wrong with that)

if tomorrow the capitalists of the world were to figure out that communism is more profitable and efficient for conducting business, they would change their ideology accordingly.

capitalism can't die because capitalism is innate to human beings; it is infinitely adaptable and flexible

<comment><USER4> Profit motive above all else is literally the prototypical example of an ideology, just not one that most people would publicly espouse.

<comment><USER24> No, it's one that everyone and all life espouses. All human interactions are transactions which express this 'ideology' as you misleadingly call it. Eric Berne understood this in 'Games People Play'. You transact because you get value; you profit. Only dead people don't transact which is why we dispose of their bodies. The profit motive is why we're alive and why evolution of life on this planet has arisen. It's deep within our genes.

<comment><USER4> A beautifully expressed fundamentalist ideology; you are incapable of even comprehending that there exist views other than your own.

</comment></comment></comment></comment><comment><USER25> We are witnessing the death of the hypervisor (global banking), not the virtual machine (nation-state agreements) or the underlying operating system (cultural norms) or the underlying hardware. (nature)

</comment><comment><USER26> Communists have been saying neoliberalism(nonsense term, which serves as an insult)/capitalism is going to fall, but it ain't happening. It's stronger than ever. They're like Christians expecting rapture.

<comment><USER27> Are you serious? Capitalism has been failing most of this planet! You just don't think it's failing because you live in a mid-to-high income nation. One day those nations will run out of others to have war with and steal from. The earth has a lot of resources, but it's finite. This will all end one day.

<comment><USER28> That is so very far removed from the historical reality.

Look up a chart of Global real GDP/capita over time. You may suspect that all this wealth goes to the wealthy (unlikely even from a historical perspective, look at all the servants Bill Gates doesn't have that even a slightly well-off English family would have). If you think this, you can lookup a chart of GDP/capita growth per country across the world. Failing this, there are charts with real GDP growth split across income levels (though not for all countries).

Failures in capitalism are usually a failure in governance. It's no surprise at all that countries with repressive or unstable regimes have the worst economies. Many countries which were once poor are now rich - even over the lifespan of people still living. The Asian tigers went from terrible conditions to skyscrapers in less than 30-40 years. People's grandchildren could expect to make 7 to 8 times as much as their grandparents.

Every country is better off today than it was in the 1500s, 1600s, 1700s, 1800s, and the start of the 1900s. Wars are less frequent for almost the entire globe.

You have a failed understanding of economics. We don't compete/steal from others when our quality of living goes up. Instead, we raise the quality of living of others. Look at China: when they started making our consumer goods, many people's quality of living went from mud huts to apartment high-rises with Starbucks downstairs. And we didn't really lose out - on average, we found new types of jobs, mostly service jobs, which it turns out we can do more productively than we could produce consumer goods.

Look, the Earth has many more resources than we are currently using. We could produce food for the world with only a tiny fraction of the world's irrigated land. If we run low on a particular resource, we will pivot past that rarity with engineering, both social and physical. Malthusian predictions have thus far all failed spectacularly. In fact, the more population we have, the more specialized we can be, and the better off we are. It's not theory - it's what history has shown us, over and over again, across the world.</comment></comment></comment>


The Race to Deliver a Lucid Dream Machine Is Full of Fits and Starts - <AUTHOR> https://builtin.com/hardware/induce-lucid-dream-technology <comment><USER2> As someone who gets vivid lucid dreams as well as sleep paralysis, you don't want them. Trust me.

<comment><AUTHOR> actually I've had a few lucid dreams but generally only when my life is threatened in the dream, then I realize that it is a dream and I can slow down the person or thing threatening my life to get out of it.

So as essentially my lucid dreams have been nightmares, I guess you're right one doesn't want them.

<comment><USER2> Yea. I've had many kinds, but even the more benign ones can be terrifying.

For several years I got recurring ones where I would wake up, just where I went to sleep and some person came in and disemboweled me and I had limited control to move away.

The fact the dream place was exactly my room from real life is what made it terrifying</comment></comment></comment>


How to avoid being "fan boy" or "fan girl" when building relationships with people you admire - <AUTHOR> http://www.escapefromcubiclenation.com/get_a_life_blog/2008/06/how-to-avoid-be.html <comment><USER2> My strategy is to completely ignore my heroes, so I don't freak them out by revealing myself as a fan boy, and then hope they come and chat with me first.

How is it working, pg? Are we BFF yet?

</comment><comment><USER3> I think this can be summed up easily as just treat the person like a human. Even humans accomplish great things sometimes. These heroes even worship other people and the more calm you are, the more respectful you will often come off as. I observe this in Guido when he talks about Django. Guido is obviously a very capable guy and he talks admirably about Django without dropping into fanboyism.

Perhaps the real lesson is to pretend the person is your equal, which they probably could be, and let it go from there. They'll appreciate it. If they don't, well, you should probably stay away from that maniacal maniac.

<comment><USER4> _pretend the person is your equal_

Why pretend?

Every one of us has something special and unique to offer. No need to "compare" our personal offerings. Just find it and share it.

<comment><USER3> If the person is a fanboy, they probably won't think they're equal. Pretending will at least get them part of the way until they know it's true.

</comment></comment></comment><comment><USER5> I think I have this same problem when I become infatuated with a girl.

<comment><USER6> The problem is that you refer to it as "becoming infatuated." Replace that with "start liking" and you should be okay.

</comment></comment><comment><USER7> must...resist...temptation!...

</comment><comment><USER8> Stay on message.

</comment><comment><USER9> _sharing your every accomplishment since getting a gold star for "most cooperative" in preschool._

A "most cooperative" star in preschool is a negative not a positive. Being especially obedient especially early should not impress anyone.

<comment><USER5> Unless you were a crafty little devil and used the supposed obedience to easily get away with mischief and worm your way out of trouble, much to the dismay of your peers.

<comment><USER9> Haha, yes, well, I'm not sure that's an accomplishment you'd want to brag about either :)</comment></comment></comment>


What I wish I knew before contributing to Open Source - <AUTHOR> https://medium.com/@giacomo_59737/what-i-wish-i-knew-before-contributing-to-open-source-dd63acd20696 <comment><USER2> I hope the project didn't have ill intentions but it would be good to make sure the rebase wasn't accidental because "git" is famous for letting people perform surprisingly-irreversible actions on repos.

<comment><USER3> > it would be good to make sure the rebase wasn't accidental

Based on the github issue[1], it reads like the rebase/squash was intentional.

[1]: [https://github.com/Harvey- OS/harvey/issues/698](https://github.com/Harvey-OS/harvey/issues/698)</comment></comment>


Facebook CEO Zuckerberg Leveraged User Data to Help Friends and Punish Rivals - <AUTHOR> https://www.macrumors.com/2019/04/16/facebook-user-data-leverage-tactics/ <comment><USER2> 1\. Is anyone shocked? 2\. The conversation on data privacy has got to start including some dialogue on _actual value_ that's being given back to the consumer using the product. I don't think 'getting the opportunity to use the tool' or 'you can choose not to use Facebooks' hold a lot of water, because the consent process is flawed and not transparent. Not that it could ever conceivably happen, but imagine if you could visualize the ultimate monetization of your data by Facebook on sign up. There's just such a massive disconnect between what you get and how much you're profited from as a Facebook user.

</comment><comment><USER3> Every quarter there are similar headlines regarding Facebook or Zuckerberg. At what point will it stop? From today's bit, it sounds like many executives were aware of this, including the beloved "lean in" Sheryl.

</comment><comment><USER4> Extensive discussion of original source (NBC News report): [https://news.ycombinator.com/item?id=19672795](https://news.ycombinator.com/item?id=19672795)

</comment><comment><USER5> We need to roll back the protections that the social media companies have and make them more like phone companies.</comment>


Abusing the PHP Query String Parser to Bypass IDS, IPS, and WAF - <AUTHOR> https://www.secjuice.com/abusing-php-query-string-parser-bypass-ids-ips-waf/ <comment><USER2> Or, "why you shouldn't rely on IDS, IPS, and WAF".

<comment><USER3> For anything?

<comment><USER2> I like Signal Science just as a product in general, and have used it to accomplish a variety of security tasks for clients. I am not sold on the core promise of WAF/RASP, where you front an insecure application with a middlebox that resolves security problems for you, and I think I'm squarely in the mainstream of security industry opinion on that.

<comment><USER4> In a situation where you're saddled with an insecure application you can't touch, I think a WAF can make sense.

In the situation I hope many people are in, where they have a production application they own that they can quicky continuously deploy to - what's the WAF for?

<comment><USER5> There's a concept that you should use several products in highly secure environments.

For example, if your input validation is written in PHP, you might want to write another layer in front, i.e. in your reverse proxy layer, using something like [https://github.com/nbs-system/naxsi](https://github.com/nbs- system/naxsi). The way, neither just a PHP bug nor a lua bug should defeat you.

In reality, they're probably written by the same person, and thus it's probably a logic bug that will result in a hack and, assuming a zero sum game in engineering time, I'd probably rather focus on protective monitoring than rewriting the same input validation.

But there you go. In much the same way, if you don't really believe you can trust cisco or huawei to protect against their respective governments, then you layer both and hope they keep each other in check.

<comment><USER5> True @tptacek, but we're talking about systems where you'd rather the system fail closed than leak anything. Not something one would really normally consider for their uber for hedgehogs app.

Personally, I'm not really a big fan of the baseline for the guidence being behind closed doors, I prefer to be able to read said validation, but the guidence does exist and is parroted around the industry occasionally.

<comment><USER6> You can click on the timestamp of a comment and reply to it there so you don't have to @ people like a barbarian.

<comment><USER7> You can give the usability information about this website without calling a group of people barbarians.

<comment><USER6> I jokingly compared a single person to a barbarian without calling anyone a barbarian, like a barbarian.

<comment><USER8> Then again, we are in discussion regarding PHP, so someone's bound to point out we're a bunch of neanthardal barbarians just because of that. So it could have been just a kneejerk reaction.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> If you do _positive_ validation, you probably won't be affected by this.

In other words: check that the id is a string with digits only.

Don't search for invalid characters like ASCII NUL or for clever escapes, because there are too many ways of abuse.

Use ctype_digit() for numerical ids and stop with a validation error if ctype_digit() does not return TRUE.

[https://www.php.net/manual/en/function.ctype- digit.php](https://www.php.net/manual/en/function.ctype-digit.php)

For more complicated cases (like an id with lowercase letters and digits) preg_match() can be used, for example: preg_match('/^[a-z0-9]+$/').

</comment><comment><USER10> Nothing is abused, nothing is bypassed.

The article makes it sound like IDS/IPS&WAF are intended to do input validation so it fits the applications model of the data.

They are not.

They are intended to harden the whole stack a little bit against yet undiscovered vulnerabilities.

By the same logic, this "article" could claim that it is possible to abuse Pythons strip() function to bypass WAF rules because filtering for the user name "root" will not filter out " root" and many login systems do strip whitespace before processing the input.

This applies to any language. Here on HN I can log in as "founderling" or " founderling" just fine.

If you want to filter out something in WAF, you 1) have to do it right and 2) do not do it for input validation at all.

It has nothing to do with the language if you fail at 1 and or 2.

</comment><comment><USER11> If you wonder why PHP does this, I think it comes from our old friend _register_globals_. In the past, query string, request body and cookie values were automatically made into global variables, so they needed to have variable-friendly names.

<comment><USER12> Correct, this behavior is well-known and has been around for 20+ years. Leading spaces are removed and additionally other spaces or dots are converted to an underscore.

For this reason, many frameworks ignore the default $_GET structure and instead access the raw URI query in $_SERVER['QUERY_STRING'].

</comment></comment><comment><USER13> Seeing a lot of WAF-hate. Additional rules could fix this.

Flame-bait Proposal:

Or, "why you shouldn't use PHP" or any other language the silently converts badly-encoded input for you?

</comment><comment><USER14> Hrm... the solution is to keep your PHP codebase up to date...?

<comment><USER15> The solution is to throw out your WAF.

<comment><USER16> WAF has it's purpose but it's clearly not a silver bullet. Nothing is.

<comment><USER17> WAF is brittle and breaks more than it fixes IMO. It's just regex against URL's in 99% of cases. If you think you need one, you need to fix the app code, there will be more vulnerabilities it doesn't block

<comment><USER16> WAF provides a lot of other things, such as IP based filtering.

</comment></comment></comment></comment></comment><comment><USER18> parse_str also does not work the same as the parser generating $_GET because it doesn't replace control characters: [https://bugs.php.net/bug.php?id=76255](https://bugs.php.net/bug.php?id=76255)</comment>


JavaScript: the weird parts - <AUTHOR> http://charlieharvey.org.uk/page/javascript_the_weird_parts <comment><USER2> That is one badly written article.</comment>


Ask HN: HN Any way for individual to gain access to Dark Pool trading data - <AUTHOR> Hi trading experts, back in 2012 I did a few months of scraping and momentum trading in a legitimate day-trading shop, as a summer job. I still remember the ECNs e.g. ARCA (I think it was $1.75 per hand back then, way more expensive then the usual $0.50 ones but they offered some rebates).
But what fascinated me most was the Dark Pools. They were the most expensive ones, with the cheapest came as $2 per hand, if I remember correctly. But they are very valuable tools if you want to cover position quickly when the market suddenly goes against you.
My question is: Fast forward to today. My understanding is that Dark Pools registered with SEC only reports transactions, not buyers/sellers, as described in the following article:
https://therealdeal.com/2020/05/18/mystery-investor-dumps-big-stake-in-real-estate-fund/
But so far I couldn't find any information on those Dark Pools. I know they are lucrative and individuals only can participate in if they trade in bulk (i.e. setting up a day trading firm), but what about historical data? Any place to see them?
Thanks in advance. <comment><AUTHOR> Some more fun facts:

Back then my best stock was CIM (still alive as of today) as it moved very slowly during the day. I was only good at scalping i.e. you add liquidity on both sides of the trade and hopefully they got filled at the same time, a bit like market making but in reality not the same.

CIM was really suitable for scalping at that time and I was really good at it, so they raised my limit to 10 or 20 hands per trade (you start from 1 hand and gradually move up), but then they told me that CIM was pretty much capped around 10/20K per trade so I need to learn other techniques. I tried some momentum trading but lost all the $$ I won so I quit after a few months.

I still remember they told us that I need to find something that has at least 1 million per day and less than $10 while moving slowly during the day, so that the liquidity is good and we don't lose much if a trend hit. I also noticed that whenever my order got filled quickly I was on the wrong side of the trade, so I learned a bit about tape reading and improved my revenue. The other stock I traded was NLY but I lost badly on that one.

</comment><comment><USER2> Interested as well if anyone has an answer to provide

<comment><AUTHOR> Yeah this is really interesting. Back then the dark pools are indeed dark as we didn't see depth but the liquidity was really good and the big players typically used them for large volume trading. The mentor also asked us to set up different colors for different types of ECNs and different volumes so we could read the tape easily.</comment></comment>


Teachable Machine: Teach a machine using your camera, live in the browser - <AUTHOR> https://www.blog.google/topics/machine-learning/now-anyone-can-explore-machine-learning-no-coding-required/ <comment><USER2> deeplearn.js author here...

We do _not_ send _any_ webcam / audio data back to a server, all of the computation is totally client side. The storage API requests are just downloading weights of a pretrained model.

We're thinking about releasing a blog post explaining the technical details of this project, would people be interested?

<comment><USER3> Yes please! :)

And some quick questions:

What network topology do you use, and on what model is it based (e.g. "inception")?

What kind of data have you used to pretrain the model?

<comment><USER2> We're using SqueezeNet ([https://github.com/DeepScale/SqueezeNet](https://github.com/DeepScale/SqueezeNet)), which is similar to Inception (trained on the same ImageNet dataset) but is much smaller - 5MB instead of inception's 100MB - and inference is much much quicker.

The application takes webcam frames and infers through SqueezeNet, producing a 1000D logits vector for each frame. These can be thought of as unnormalized probabilities for each of ImageNet's 1000 classes.

During the collection phase, we collect these vectors for each class in browser memory, and during inference we pass the frame through SqueezeNet and do k-nearest neighbors to find the class with the most similar logits vector. KNN is quick because we vectorize it as one large matrix multiplication.

I'll go deeper in a blog post soon :)

<comment><USER3> Interesting!

I'm curious why you've used a different classification algorithm on top of a neural network. I would expect that a neural network on top of a pretrained network could give similar results, with the benefit of simpler code. Is performance the reason?

Anyway, I'm looking forward to your blog post.

<comment><USER2> Training a neural network on top would require a "proper" training phase, and finding the right hyperparameters that work everywhere turned out to be tricky. Actually, this is what we did originally, in the blog post we'll try to show demos of each of the approaches and explain why they don't work.

KNN also makes training "instant", and the code much much simpler.

<comment><USER3> That makes sense.

By the way, I think your software could become very popular on the Raspberry Pi, because it would be very cheap and fun to use it for all sorts of applications (e.g. home automation).

<comment><USER2> [https://github.com/PAIR-code/deeplearnjs/issues/158](https://github.com/PAIR- code/deeplearnjs/issues/158)

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> Pretty neat! Good overview without overwhelming right off the bat. Would be cool if they showed off common pitfalls like over fitting, or even segued into general statistics!

</comment><comment><USER5> How long before I can teach my computer gestures that are mapped to real computer functions? For example, scroll up/down, switch apps, save document, cut/copy/paste, etc.

One could probably map each gesture to a regular USB device that acts as a second keyboard and mouse? The hard part is identifying enough unique gestures?

<comment><USER6> You mean a device such as the Leap Motion Controller? [http://store- eur.leapmotion.com/products/leap-motion-control...](http://store- eur.leapmotion.com/products/leap-motion-controller) They seem to offer a VR headset add-on these days, but I've only ever seen the 'basic' controller in action, which worked okay-ish.

<comment><USER5> I think that's infrared but the same idea. That never quite worked. Also, Leap didn't continue to refine their hardware for consumers. They have next generation hardware that's going directly into VR headsets, but you can't buy it.

[https://www.engadget.com/2014/08/28/leap-motion-s-next- senso...](https://www.engadget.com/2014/08/28/leap-motion-s-next-sensor-is- designed-specifically-for-virtual-r/)

<comment><USER6> Seems to me that you can buy the SDK[0] (which is not much more than a Controller and a bracket to hold in against your VR headset of choice), so at least they've made some progress since 2014. [0]: [http://store- eur.leapmotion.com/products/universal-vr-develo...](http://store- eur.leapmotion.com/products/universal-vr-developer-bundle)

</comment></comment></comment></comment><comment><USER3> I don't have a camera here. Did anyone try it? How does it work?

<comment><USER7> Surprisingly well!

It's a _really_ well put together demo & tutorial.

I held a pen up next to me and held the green button.

Then did the same with a mouse.

It would flick between the two if I was holding nothing, so I held the orange button for a bit while holding nothing.

Worked pretty much every time.

Training is fast enough with a few hundred images per class that I didn't notice any delay.

<comment><USER3> What do you mean exactly by "held the green button"?

I can't run the demo here (browser not capable enough, and no camera) and I'm getting really curious what this is about.

<comment><USER8> Watch the demo video in the link, it explains the green button

<comment><USER3> Thanks!

</comment></comment></comment></comment></comment><comment><USER9> The value-add for this demo is amazing, it's going to be many people's first approachable experience of ml, or things just like this will be. I expect a lot more of this stuff to appear in UI/UX. It's fun, intuitive, and a game changer away from dumb screens to fully interactive machines with their own knowledge graph.

</comment><comment><USER10> You can solve problems using Machine learning without coding from a while ago.. azure machine learning have this features from more than a year ago.

I've solve regression, classification and recommendation problems with it and the best part is it deploys an web service with a few clicks.

<comment><USER11> But you would need to have:

1 a working phone

2 a valid credit card

To use azure which places a too high bar on students. I mean I've tried to argue for graduated restrictions so basically students with .edu emails should be able to do some things without entering a credit card number but the fact that it is not possible suggests this isn't a priority for azure.

Google says this finds on your browser so there's little infrastructure cost for this demo, right?

<comment><USER12> There is a student offer that doesn't require credit card [https://azure.microsoft.com/en-us/offers/ms- azr-0144p/](https://azure.microsoft.com/en-us/offers/ms-azr-0144p/)

<comment><USER13> But IIRC it doesn't include ML tools.

</comment></comment></comment></comment><comment><USER14> Does anyone know what this uses under the hood? I loved the demo, but I would like a similarly easy way to get started locally with Python, for example.

Is there an ML library that can easily start capturing images from the webcam so you can play around with training a model?

<comment><USER8> It says it in the video: [https://deeplearnjs.org](https://deeplearnjs.org)

<comment><USER15> he is not asking for the learning library

<comment><USER16> What does he ask then? The whole code of this is on Github.

</comment></comment></comment></comment><comment><USER17> be aware, at least in Chrome, once you give teachablemachine.withgoogle.com permission to use you camera, unless you revoke that permission is has permission to use your camera without further permission including from iframes. In other words every ad from and analytics from Google could start injecting camera access.

I wish chrome would give the option to only give permission "this time" and I wish it didn't allow camera access from cross domain iframes.

<comment><USER18> But won't it be on just that FQDN alone? Google analytics and ads are served from a totally different domain. What's the actual concern here?

<comment><USER19> So you are contending we are secure via DNS?

<comment><USER20> That's one of these arguments that may attack the parent in isolation, but makes absolutely no sense in the context of the thread they were replying to.

Because if you assume an attacker to have control over DNS, the security model of giving permission on a per-domain basis is broken anyway, and the initial concern with granting google this access is already subsumed in your general paranoia.

<comment><USER21> No it isn't. TLS helps ensure you aren't talking to a rogue server and HSTS ensures you can be spoofed in the first http request to a new server.

</comment></comment></comment></comment></comment><comment><USER22> What makes it non-mobile? Is it something about the expected performance of the JS? or are there apis being used im not thinking about?

<comment><USER2> It works on mobile, it's just slow. Every time we read and write from memory we have to pack and unpack 32 bit floats as 4 bytes without bit shifting operators >.>

<comment> white-flame Isn't that what ArrayBuffers can do for you at nearly the same amortized speed as C unions?

</comment></comment></comment><comment><USER23> this is really cool, openframeworks-esque in browser javascript

if you like this I would highly recommend looking at openframeworks.

the interactive browser part excites me want to try to make something with deeplearn.js

</comment><comment><USER24> Hmm. I wonder if one could train this with dick pics and embed into popular messenger apps client-side... "this picture was classified as a penis", to counter morons sending their dick as first message.

</comment><comment><USER25> Am I the only paranoid one who thinks this is just Google's way of capturing millions of faces in their database? Or did Apple beat them to it?

<comment><USER26> The faces are unlabeled, and I'm not sure what that data would be good for. If Google really wanted face data, they could look at:

\- Gmail / Google Plus / Google Apps profile pictures

\- Google Street View

\- Google Hangouts

\- implementing a primitive Face ID or Snapchat-style camera on Google Android

\- the large mass of face pictures that they index with Google Images

<comment><USER27> Google Photos seems like the absolute best bet there, they're "organizing" them there by default.

<comment><USER26> Can't believe I forgot about that one! I'm an avid Google Photos user, and they definitely have some pretty amazing unsupervised clustering for faces.

</comment></comment></comment></comment><comment><USER28> i bet it's fine tuning an ImageNet CNN

<comment><USER2> kinda, ya

<comment><USER28> What do u think?</comment></comment></comment>


Man who made passwords hard regrets rules that 'drive people crazy' - <AUTHOR> http://www.cbc.ca/radio/asithappens/as-it-happens-wednesday-edition-1.4240252/man-who-made-passwords-hard-to-remember-regrets-rules-that-drive-people-crazy-1.4240255 <comment><USER2> Recent discussion: [https://news.ycombinator.com/item?id=14967731](https://news.ycombinator.com/item?id=14967731)

</comment><comment><USER3> The worst part of password rules is that every site has its own.

One requires a symbol, another doesn't allow symbols. A third requires 12 characters, a fourth only allows 8.

And they only tell you the rules when you're creating a password. They could at least remind us of the rules so we could remember how we had to mangle the password to match.

<comment><USER4> Or sites that require at least one symbol, but then mysteriously disallow a handful of common symbols (e.g. I used a site the other day where exclamation points were not allowed). Makes password generators like 1Password's useless about half the time, since 1Password rightly will pick from all (most?) common symbols on a standard US keyboard.

And of course, why would the site tell the user of its obscure symbol requirements _before_ the user tries to enter their brand new password? No, I guess they think it's better to leave it at "a symbol is required" and then reject symbols users use one-by-one.

<comment><USER5> Maybe password rules should be represented as an HTML5 attribute in the input field.

1Password and LastPass et. al. could read this rule and then adjust the password generator accordingly.

<comment><USER6> What reasons are there for these restrictions in the first place?

<comment><USER5> The length requirements are logical if they have reasonable minimums and very high maximums.

It doesn't make sense to limit special characters, etc. Especially as everyone should be using a password manager anyways. I suspect most of these odd requirements are a result of design by committee and pointy haired bosses. Maybe requirements from legal departments?

As long as the annoying requirements are in place, we might as well try and get password mangers to work with them. LastPass has a generator which can be manually configured, but making the step automated would be helpful.

<comment><USER7> > very high maximums

What does "very high" mean here? And why would you need it? Usually, you just have a maximum request size in the web server, and people are never going to hit that with actual passwords.

<comment><USER4> Algorithms like bcrypt may have a maximum supported length: for bcrypt, over about 50 characters and things get dicey [1]. If you're running something computationally expensive like scrypt tuned properly, you don't want malicious entities to be able to send you a 32K password request, probably - easier to force them to keep it small (like < 50 chars), then block them based on request throughput.

[1] [https://security.stackexchange.com/a/39851/1373](https://security.stackexchange.com/a/39851/1373)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> If I cannot use my passwords -- I always give my favorite password a try: ''; truncate table users;

<comment><USER9> Would this be a crime if it worked?

<comment><USER10> It probably should, since it would mean that the site isn't hashing passwords with even the most ancient cipher. Bonus ineptness points are given for not using a prepared statement or sanitizing the SQL query.

As a software developer, I'm okay with that being criminal negligence.

<comment><USER9> Cute.

I am still curious if this would be a criminal offense for the person that did the SQL injection attack.

<comment><USER8> In the US, the "Computer Fraud and Abuse Act" _could_ apply. The case would revolve around "intent".

Explaining to interrogating officers that you hated password forms and wanted revenge would be 1 to 5 years in federal prison (better than state). Explaining to interrogating officers that you accidentally copy pasted wrong - the case would be dropped. This is why you need see a lawyer always before answering questions you will be mislead.

"intentionally accesses a computer without authorization or exceeds authorized access" [1] [https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act](https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act)

[https://www.nacdl.org/cfaa/](https://www.nacdl.org/cfaa/)

</comment></comment></comment></comment></comment><comment><USER11> It is relevant that NIST 800-53 Rev. 5 has dropped password complexity and rotation requirements because they make things worse, not better.

</comment><comment><USER12> Some sites are just insane.

[https://github.com/duffn/dumb-password-rules](https://github.com/duffn/dumb- password-rules)

<comment><USER13> Apple iTunes/Apple ID pwd rules is really annoying.

Microsoft online service incl (based still on the decades old 1997's Hotmail login system is archaic) has an upper limit of 8 (or so) chars. (Office365/Outlook.com/etc)

<comment><USER14> What? That's incorrect - I've recently had 1Password change my Outlook.com password, and it's much more than 8 characters.

</comment></comment></comment><comment><USER15> Cool. Now can we find the person responsible for "smart quotes"?

<comment><USER16> Aren't this the correct quotation marks? " means inch or seconds and is only used because most keyboard layouts make it hard to type the correct quotation marks.

<comment><USER17> Inches and seconds should really use ″, U+2033 Double Prime, if you're not going to use the ASCII quotation mark for everything.

<comment><USER18> The amusing thing is that we never care about this distinction in handwriting. "Oh, your two tiny vertical-ish lines denoting 'inch' are not ever-so-slightly slanted..."

<comment><USER19> In my handwriting, all quotation marks are pretty heavily slanted. That doesn't mean I would consider them distinct from hypothetical vertical marks. Fancy quotes are a display choice, not a distinct glyph.

</comment></comment></comment></comment></comment><comment><USER20> > Burr said he prefers phrases from literature.

I distinctly recall seeing somebody post a comment a few years ago -- I think it was here on HN, though I'm not sure -- to the effect that they had used a line from an obscure poem _in Afrikaans_ as a password, and it was cracked. -- Oh! HN Search comes through for me: here's a recent HN comment [0] by someone who also recalled it, with a link to the original [1].

[0] [https://news.ycombinator.com/item?id=14781311](https://news.ycombinator.com/item?id=14781311)

[1] [https://www.reddit.com/r/Bitcoin/comments/1ptuf3/brain_walle...](https://www.reddit.com/r/Bitcoin/comments/1ptuf3/brain_wallet_disaster/)

</comment><comment><USER21> I referenced this article today at work involving a discussion about password security, 2FA and actual customer experience.

Tonight I was dealing with Wells Fargo for a password reset. They have a max of 14 characters and a generally awful interface. I took screenshots of the process to use as a guide of things to avoid.

</comment><comment><USER22> This nearly could have been on The Onion :)

</comment><comment><USER23> I had an idea for a website password system: instead of letting the user set a password, you just give them one. Prevents password reuse, which is the only thing that ever really commonly gets anyone's account hijacked in my opinion.

Doesn't even have to be strong, could be one word from the top 10k English words. Require reset after 5 failed attempts.

Would there be anything wrong with this approach (besides being sort of user- hostile), or have I misunderstood the website account security threat model?

<comment><USER24> A 1 in 2000 chance of correctly guessing someone's password could lead to lots of attempts which at best would cause lots of password resets and at worst cause lots of compromised accounts.

<comment><USER25> yeah with this method, there's a good chance your password will always need a reset.

</comment></comment></comment><comment><USER26> Is Diceware still recommended?

[http://world.std.com/~reinhold/diceware.html](http://world.std.com/~reinhold/diceware.html)

<comment><USER27> Yes. Using diceware (with actual dice) is still the most reliable way for a normal person to create a strong password. Use diceware. Ignore this guy's bad advice.

</comment></comment><comment><USER28> Our university forces us to change the password every 150 days. It is such a pain in the __s, because there are too many apps on too many devices need to update the password. I asked the IT department, can you guys consider to stop this and find an alternative security policy? The answer is no, because this security policy is in the state law.

<comment><USER29> If you're really hellbent on it, you can probably tell the IT department they are full of shit and ask for the citation to the state code number - I am no state code scholar, but I have never heard of anything like this. In the NW States I am familiar with I could not find a single code section that even remotely touched on passwords at state schools. It would be an odd thing to legislate. Some states are goofy though.

<comment><USER28> Just checked, by a little bit of googling, I did find it in a gov document.

<comment><USER30> Care to share? Curious minds want to know :-)

</comment></comment></comment></comment><comment><USER31> U2F and Yubikeys if you're serious about it.

</comment><comment><USER32> Relevant xkcd: [https://xkcd.com/936/](https://xkcd.com/936/)

</comment><comment><USER33> Duh. Obviously. And not like it's secure either. THe worst part is some sites ask you to change your password every month/3months/etc. That kinda sucks.

</comment><comment><USER34> password must contain 8 characters and the temperature of the room you're currently occupying, in degrees kelvin

<comment><USER35> Kelvin is not expressed in degrees; it's just "Kelvin". Now to really throw people for a loop, tell them to do it in degrees Rankine (even less people know what that is).

</comment></comment><comment><USER36> Have his rules even been proven to be right? There's that famous xkcd comic about passwords and password strength checkers like [https://howsecureismypassword.net](https://howsecureismypassword.net) that seem to imply otherwise. Short passwords with symbols seem easier to crack than longer ones with words put together a human could remember.

<comment><USER37> Right about what, specifically? Being random is good. Being short wasn't part of the rules. Rotation is pretty bad. And words don't fix the core problem of making a good password because people love picking non-random words.

In general, every two random characters is worth as much as one random word. I personally find it as easy to remember three random characters as a word, so I get better mileage out of random characters.

<comment><USER38> > Rotation is pretty bad

Rotation is great if it's implemented correctly. The problem is that it's too much of a burden on users, therefore they implement it poorly, and then it's less useful or a weakness.

<comment><USER39> Rotation makes people pick things like Winter2017 or write it down, and it offers little safety because being compromised for 3 months isn't that much better than being compromised for a year.

</comment></comment></comment></comment><comment><USER40> This guy sounds like a joker with no understanding of information theory.

</comment><comment><USER41> This guy must be a joker with a name like Bill Burr.

edit: for those who down-voted, one of the most famous comedians in the US at the moment is also named Bill Burr.</comment>


Memory randomization (ASLR) coming to Mac OS X Leopard - <AUTHOR> http://blogs.zdnet.com/security/?p=595 <comment><USER2> This has been available for Linux since 2001. <http://pax.grsecurity.net/></comment>


Arrington Gets an Anybot - <AUTHOR> http://techcrunch.com/2010/07/08/anybots-arrington-robot/

<comment><USER2> That was awkward on so many levels. It makes me think that when people are driving these things, they'll be just as annoying as they are online.

<comment><USER3> That is something we worry about. There seems to be a little bit of a disconnect at first, like interactions that happen in a computer screen are somehow less real than face to face ones. The hope is that bumping in to people with a robot is sort of like making faces in a teleconference: it's maybe something you do when you are first trying it out, but once you start using it for actual work you stop.

I know that we have certainly moved past that here using them (we use them to keep in communication with our manufacturer). Hopefully having 2 way video + the fact that the robots will be used almost exclusively in business settings will help us avoid the Penny Arcade Internet Fuckwad Theory <http://www.penny- arcade.com/comic/2004/3/19/>

<comment><USER2> ... or maybe Arrington is always that annoying in the office. ;-)

</comment></comment></comment><comment><USER4> Very cool! My wishlist:

1\. 360 degree camera (so I can walk in any direction without turning around) 2\. 3D vision (in the operator interface!) 3\. Wings, jet pack 4\. Multiple lasers 5\. Vuvezula

<comment><USER5> 1\. would also allow you to strafe...

</comment></comment><comment><USER6> Wow. Absolutely incredible. How annoying Arrington is, I mean. The robot's pretty neat too.

</comment><comment><USER7> A far as telepresence for Chinese / Indian factories goes, wouldn't it be cheaper / less awkward to hire a guy to walk around w/a laptop running iChat / google voice-vid? Labor in those countries is practically free.

</comment><comment><USER8> This video just made my day!

<comment><USER9> More videos:

<http://www.anybots.com/>

<http://anybots.com/#anyblog>

<comment><USER10> I suspect jl has better ways to see anybots than videos ;)

</comment></comment></comment><comment><USER11> First thing I thought about after reading this was the robot waiter in Rocky IV.

While this is certainly very cool (and I would totally buy one just to play with if money was no object), I'm rather skeptical about how many of these things they're going to manage to sell - $15k is pretty steep for iChat on wheels.

<comment><USER12> Don't forget the green laser pointer.

I agree that this is way too expensive. I bet, just like the Segway, a lot of the money goes to keeping it on two wheels when a 4 wheel device would do just fine. I'd like to hear the economical justification that a company uses to buy this.

<comment><USER13> I don't think it's that expensive -- seems like it would be pretty useful in a warehouse to check up on things. Still cheaper than flying an engineer in San Fran to the UPS warehouse in Kentucky.

I think people are assuming it will be used in the way Arrington used it -- remote presence. It's more useful as a way to survey places that you normally don't want to hang around in due to danger or noise, such as noisy server rooms, giant inventory/shipping warehouses, buildings that are in the middle of construction, outsourced manufacturing facilities in china, chemical plants, water/sewage sanitation facilities, chip manufacturing clean rooms, etc.

When my dad worked for Monsanto, he had to drive 60 miles out of his way to the chemical plant just to look at pipes, knobs, and dials to ensure that the manufacturing process was properly replicated -- that would seem like a perfect fit.

<comment><USER12> I know something _like_ this is useful but there are other devices that cost < $1000 that do the same thing.

For example: If you put the head/camera of the Rovio on a stick you essentially have the same thing, except this device costs only $300. What is the extra $14,700 for? It just doesn't make sense to spend so much on a simple device. [http://www.slashgear.com/wowwee-rovio-videos-wifi-remote- web...](http://www.slashgear.com/wowwee-rovio-videos-wifi-remote-webcam- demo-2317185/)

<comment><USER14> Rovio is currently $159 at Amazon:

[http://www.amazon.com/WowWee-Rovio-Enabled-Robotic- WebCam/dp...](http://www.amazon.com/WowWee-Rovio-Enabled-Robotic- WebCam/dp/B001CQLGD6)

I don't know how much longer I can hold out before clicking the buy button.

[Edit:] After reading the product reviews, the Rovio appears to have a number of issues (i.e. poor battery life, poor video) Does anyone on HN have one of these?

</comment></comment></comment></comment></comment><comment><USER15> "...$15,000 per unit. That may sound a little steep, but keep in mind that the robot can be used by multiple people, though only one can be logged in at a time."

What does that even mean?

<comment><USER16> I think they mean you can't have two or more people trying to control the bot at the same time.

<comment><USER15> Yes, but then why does he say 'keep in mind that the robot can be used by multiple people'. Is this any different than, say, two people sharing a pencil?

<comment><USER17> He's just pointing out that a business wouldn't need to contemplate buying a $15,000 anybot for each employee when they can be handed off depending on who needs it at any given moment.

Not sure why the author felt like pointing that out.

</comment></comment></comment></comment><comment><USER18> Very cool, I guess the next step would be to give it a decent sized screen for 2 way communication.

</comment><comment><USER19> That's some pretty pathetic collision avoidance, given that the website advertises "Its built-in guidance system takes care of the rest by avoiding furniture & people..."

<comment><USER20> Really? It experienced the worst-case scenario -- running directly into something at full speed -- and came away completely unharmed. "Rock solid" would be how I'd describe it.

It would be very tough to implement "collision avoidance" without being overbearing on what the user can or cannot do. For example, it would be extremely annoying if the robot's collision avoidance made it actively try to stay away from walls "because the user could potentially make a sudden turn at full speed towards the wall, and then a collision could result, so therefore we should try to avoid that scenario because, damn it, we _promised collision avoidance!_ ".

The net effect would be that the user might have a very good reason for wanting to drive close to a wall, but can't because of artificial limits imposed by the software.

It's better to not waste time on those kinds of 'features' and instead focus on making the core experience better. In this case, focusing on the two-way video and reducing chat lag time.

Incidentally, those kinds of 'features' seem like exactly the kind of thing that a mature company would focus on (waste time on) and lose sight of making the actual product better, because it combines so many things that mature companies would like -- delivering on promises to the user, it sounds good on paper, etc. But it loses sight of the fact that the goal is to make the end product better, not to deliver a laundry list of things.

<comment><USER21> Why does the collision avoidance has to be a hard limit? Allow it to be toggled on and off at will by the operator and it solves all problems you mentioned.

Collision off on cramped places with furniture.

Collision on when too many moving object (people walking around).

<comment><USER3> Actually we allow people to hit walls, for the reasons you mention above, but we make sure that the robot slows down a little before hitting them. Basically we allow any movement but you can only go fast when you are in an open area and if the robot detects that you are going to barely clip an obstacle you barely miss it instead (thats the hope anyway)

-Benjie, anybots obstacle avoidance guy

<comment><USER22> what happens if I drive it down stairs?

<comment><USER3> It depends on how long the stairway is. It has a bumper around the head to protect it, but odds are you are going to need some repairs.

We are using the Hokuyo Lidar sensor: [http://www.hokuyo- aut.jp/02sensor/07scanner/urg_04lx_ug01.ht...](http://www.hokuyo- aut.jp/02sensor/07scanner/urg_04lx_ug01.html) which sees an ankle height slice of the world so stairs down are invisible to us at the moment. :/

<comment><USER19> Hey, I think my original post was totally misinterpreted. I was referring to the instance near the beginning where Arrington drove the robot forward, directly into Dan Casner, a few times. That mistake will almost certainly be repeated by everybody who uses QA, as they try to get a better view of the people they're talking to. So, I was commenting on the lack of a hard limit on how close one can get to objects directly in front of the robot. Will this be addressed in the final implementation?

I believe there might also be a ROS package that detects ankles (well, legs) in 2D scans, which could help.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> That looks a lot like Daniel Graystone's household robot (in Caprica)

</comment><comment><USER24> I'm reminded of the robots from Suspended (Infocom game). We'll have some anybot robots that tuned for audio, some for video, some for ... what were the others?

</comment><comment><USER25> You should be able to drive it to a power outlet or docking station for charging. Or maybe it should drive there itself?

<comment><USER3> It has one. Autodocking isn't finished yet, but on the work queue. You can see the dock in the background of the video (it's the white C shaped thing sitting on the ground)

</comment></comment><comment><USER16> I would love to get a couple and race them around the office. Friday afternoons just got more interesting!

</comment><comment><USER26> The title should say Arrington becomes an Anybot.

<comment><USER27> How about Arrington becomes an Annoybot?

</comment></comment><comment><USER28> nice work</comment>


The world will only get weirder - <AUTHOR> http://stevecoast.com/2015/03/27/the-world-will-only-get-weirder/ <comment><USER2> Interesting. I think we might see the same effect with curing diseases. At some point in the future all the major ones might be taken care of, and most people will die from weird one-off/extremely rare conditions.</comment>


Ask HN: Trademark it yourself? - <AUTHOR>

Has anyone gone through the process of obtaining a trademark without a lawyer?
My project is in an early stage where it's just three of us building the product and not spending any money on things like IP lawyers.
We have a domain name that is very good, though, and it's important to trademark our name so that we don't face any legal challenges to the URL from someone holding a similar trademark.
What do you think? Is this something we can do on our own? <comment><USER2> Yes, I've done it. It's pretty easy to do on your own. The only tricky part is understanding 'classes' and picking the correct ones.

Learn the difference between (TM) and (R) --The former is you claiming use of a trademark and the latter is having a formally registered trademark.

Anyone can claim use of a mark (TM), but getting a real registered trademark (R) requires jumping through all of the correct hoops (forms/fees), and someone at USPTO validating your claims.

There's often some confusing language about 'use' of your mark in commerce. If a mark is not used/maintained, it is abandoned. Similarly, you ought to be using the mark to get it registered.

Many companies make very questionable (nearly fraudulent) trademark claims with (TM) designations that would obviously _NEVER_ be approved by the USPTO. I classic example is Intel claiming a trademark (TM) on the word "Core" when it has been in common use in the specific area of commerce (class) for a long time before Intel started asserting the bogus claim.

If you do some digging and studying, you'll find getting a registered trademark is really fairly simple.

</comment><comment><USER3> I've got my own Trademark a few times in the UK, you can do it all online. There is even a new "Right start" system where you only pay half until its accepted, then pay the other half.</comment>