FBI put Anonymous 'hacktivist' Jeremy Hammond on terrorism watchlist - <AUTHOR> http://www.theguardian.com/us-news/2015/feb/02/fbi-anonymous-hacktivist-jeremy-hammond-terrorism-watchlist <comment><USER2> It almost sounds like a farce:

1\. US Gov. passes Executive Order permitting: a) the Depart. of State to identify individuals/organizations as "terrorist/terrorist organizations"; b) the CIA to put individuals (including citizens) on targeted kills lists; c) the FBI to put people on a Terrorist Watchlist;

2\. There is no oversight to the process and the Government is not required to disclose who is on the list(s) or even the criteria to get on the list;

3\. When the first (known) CIA targeted killing of a US citizen failed and the US Gov. was sued, the Court dismissed the case finding the Courts can not perform a Constitutional review, because such an Executive Order falls squarely within the Political Question Doctrine;

4\. When the Government successfully killed the US Citizen, using a military drone strike, in a Country the US was not authorized to use the Use of Force (under International Law)...no one cared because the individual was Muslim and the Government assured us this was a guy with ties to Islamic terrorism. In fact, you can see in this article the such an attitude permeates all the way to the EFF, where one of EFF's Senior Staff Attorneys says he wouldn't have issue if Hammond had ties to Al-Qaida or Islamic State, but this is solely concerning to them because it is likely Anonymous;

5\. Now the US Gov. has again extended their new found powers and now people are split...but what is really alarming is the people who think, well this guy was a piece of shit, so the Gov. got it right...no harm no foul.

This is not end of the World, sky is falling commentary, but wake up. It is never OK for any Government to have secret lists of any kind much less kill lists...and it is even more telling that the US Gov. refuses to disclose the lists (in full, certainly some lists are public) or the criteria/process.

<comment><USER3> > 4\. When the Government successfully killed the US Citizen, using a military > drone strike, in a Country the US was not authorized to use the Use of Force > (under International Law)...no one cared because the individual was Muslim > and the Government assured us this was a guy with ties to Islamic terrorism.

It's pretty offensive to muslims to lead your characterization of al-Awlaki with the fact that he was Muslim, rather than the fact that he went to Yemen and took up arms against the United States while inciting violence against the country. U.S. Citizenship isn't a blanket immunity against U.S. military action. It's certain that the U.S. killed Americans who went and fought for the Nazis in Europe. Few people would challenge the validity of such actions. Does it become wrong because you make a list instead of doing it indiscriminately?

And ultimately, it's deeply counter-productive to try and lump people like Hammond together with people like al-Awlaki. Military action against foreign aggressors is a fundamental right of sovereign nations. People will not give it up. If you tell them that such actions must be subject to "law" all you'll accomplish is distorting and diluting the law to accommodate the sorts of actions that must be taken against foreign aggressors. The law should not try to insert itself into foreign military matters. It's not a fight it will win, and it will be the downfall of the law.

<comment><USER4> > rather than the fact that he went to Yemen and took up arms against the > United States while inciting violence against the country.

It is difficult to call it a fact since there was no trial, no due process, nor evidence cited by US government in the killing of its citizen. Perhaps there was secret evidence presented in secret to a secret court, but that's rather grim consolation.

Also the concept of law should absolutely insert itself into matters of foreign military matters. WWI and WWII were both horror shows, Western civilization rightly decided to do their best not to repeat the worst of the atrocities committed therein. You seem all to eager to return to a world where Western governments kill millions without consequence.

<comment><USER3> > It is difficult to call it a fact since there was no trial, no due process, > nor evidence cited by US government in the killing of its citizen.

Trials, due process, evidence, these are domestic legal concepts. They don't apply to military actions on foreign soil.

> Also the concept of law should absolutely insert itself into matters of > foreign military matters.

Rule of law depends on the institutional capital of the judiciary. The judiciary inserting itself into diplomatic and military matters costs institutional capital. The more the judiciary stays out of the foreign affairs of the military, the easier it is to keep the military out of the domestic affairs of the judiciary. And ultimately when you make politically necessary things illegal, you set the rule of law up for failure.

<comment><USER5> _They don 't apply to military actions on foreign soil._

Assassination by drone is (or should be) considered a political act, not a military one.

<comment><USER6> All military acts are political.

</comment></comment></comment></comment></comment></comment><comment><USER7> Step 1: Create overreaching laws and sell them to the public with the word "terrorist".

Step 2: Evolve the definition of the world "terrorist" behind the scenes.

We are seeing similar word play in Canada as the word "terrorist" evolves into "radicalized". Of important utility to our government as they attempt to shift public perception of environmentalists over to "radical" or "extreme" due to the prominence of our oil industry. With success expect these sorts of labels to be slowly painted over our Native population in some old fashioned establishment racism.

<comment><USER5> I have no problem at all assigning the label "terrorist" to people who do things like this ([http://en.wikipedia.org/wiki/University_of_Washington_firebo...](http://en.wikipedia.org/wiki/University_of_Washington_firebombing_incident)).

<comment><USER7> I wasn't really referring to the ELF or related groups. I was referring to specifically Canadian examples of activits, often native with land right claims, protesting unsound industry.

</comment></comment></comment><comment><USER8> We are rapidly moving towards a world where political dissent equals terrorism. People that create movements that carry momentim, outside the traditional political corridors of power shall be watched and persecuted. Should the trend continue, do not be surprised when people start to go missing.

<comment><USER9> That and blowing up buildings, sure.

<comment><USER10> I don't think junto has an issue with the concept of terrorism encompassing the blowing up of buildings. And I think that you know that.

<comment><USER9> You're right. I chose a snarky way to disagree with their premise. I should have just contested it directly. Sorry.

<comment><USER11> Seem to keep happening for you, so I'm not sure how sorry you really are.

<comment><USER9> In the sense you mean it: not sorry at all. More like, "you're right, and that was my least favorite comment of mine on the thread".

</comment></comment></comment></comment></comment></comment><comment><USER12> A decade ago I knew Jeremy, a very little. Not enough to be particularly interesting even then, yet alone now, and I haven't spoken to him since he went to jail for the first time (I think around 2005).

I hugely admire his morals, and that he lives his life by them so completely. And I agree with a lot of them. But, at least from the vague impression I have based off old (and no-doubt memory-distorted) conversations with him, mainly on IRC, and on news reports in the last couple of years, I'm not too sure "possible terrorist" isn't a fitting label for him. He's always wanted to fight against big chunks of society.

As far as I know he's never committed or planned to commit any violent crime, but his personality and view of the world make me think that he'd be willing to if he thought there was a greater good to come from it. The first thing he was caught and locked up for was stealing 1000s of credit cards from a right- wing website and using them - if I remember correctly, to donate to a charity. Those people who suffered at the hands of his credit card fraud were people he didn't know, but was willing to justify it morally in that they had donated or purchased something from this right wing website. And yes it was a very right- wing site, it was very much within the norms of the American political spectrum, it's not like they were neo-nazis or the KKK.

Maybe I'm doing him a disservice, and maybe the FBI were just abusing terrorism laws to crack down on (relatively-)innocent hackers. But the truth is that if I were in their shoes, Jeremy Hammond would scare me as much as the next plane from Al-Queda.

(And while on the subject of surveillance... I created a fake account from Tor to write this. Can't imagine anyone would really care about my saying I knew him, hell I'm 99% sure he wouldn't even remember my name, but I'd rather not make that tie if it hasn't already been made.)

<comment><USER9> _As far as I know he 's never committed or planned to commit any violent crime_

Hammond was arrested for violently protesting a holocaust-denier at a German restaurant in suburban Chicago. He and his companions entered the place wearing masks, apparently threw paint, and then glassware; one person was injured.

He also also plead guilty to battery after he threw red paint at and then struck a police officer in a 2004 gay rights rally.

If your definition of violence includes property damage, he was also arrested for tearing down and burning a Chicago 2016 Olympic campaign banner.

The latter two incidents --- with the cops and the sign --- who gives a shit, I guess. After watching the Chicago NATO protests a few years back, I gained some sympathy for the police and what they face with "Black Bloc" "protestors", but those situations are generally so fucked up and fraught it's hard to confidently take a side; the overwhelming majority of protestors work in good faith.

But the first incident --- storming a restaurant and throwing glassware because they're hosting a private event for a holocaust-denier --- that's unequivocally violent and criminal. The corrective for bad speech is more speech, not violence.

<comment><USER13> Some fraction of those black bloc people are usually agent provocateurs. At least here in germany the far right and left is subverted by payed informants and undercover police to the extend that it wasn't feasible to prosecute the most prominent far right party because a significant fraction of their leadership had been police informants for years.

<comment><USER9> If by "agent provocateurs" you mean "assholes who are not good-faith protestors but instead seizing on the opportunity to revel in mayhem with the protection of a big crowd of people to disappear into", sure, I absolutely believe that's the case.

If by "agent provocateurs" you mean "the police sent people in as agents to incite violence", you've lost me.

In any case: none of that could possible apply to the Edelweiss restaurant incident with Hammond.

<comment><USER14> There's certainly room for interpretation, but when I look at stuff like:

[http://www.wsws.org/en/articles/2012/05/terr-m21.html](http://www.wsws.org/en/articles/2012/05/terr-m21.html)

from Norway, I'm not thinking: great way to support the right to peacefully assemble and protest.

</comment></comment></comment></comment></comment><comment><USER15> I wonder why we use the term "terrorism", as opposed to paramilitary organization, which I think is a more relevant construct. Terrorism defines a group based on its methods which are supposed to deliver fear or some kind of mass hysteria to the public.

A paramilitary organization may or may not use tactics of terror, and even if they do, their tactics may be a small part of why they are harmful and relevant.

Under this construct, we can talk about cartels, IS/ISIL, Al Qaeda, IRA, and so on.

And you know how in every large forum, when someone talks about the definition of terrorism, inevitably states also get pulled into the discussion, such as the actions of the US / Russia / China? That's because terrorism is an over- inclusive lens of discussion or perception, which means it requires "discretion" to use the term. It genuinely is wishy-washy.

<comment><USER9> Most domestic terrorist groups the FBI tracks don't really fit the definition of "paramilitary organizations".

Terrorism describes the strategy of pinpoint deployment of outlandish violence to coerce policy by generating fear. That's one strategy used by paramilitary organizations, but so is "seize and hold territory" or "persistently disrupt supply lines". Islamist terrorists don't target JFK airport in the hopes of disrupting our military supply lines. They do it to provoke the US public by creating fear.

Having said that: I'm not sure what coherent public policy objective is served by singling out "terrorism" from other violent crimes. At the level of law enforcement, criminal violence if criminal violence whether it be in the service of a bank robbery or a radical animal rights protest.

<comment><USER15> But I think it's actually a good thing that some domestic terrorist groups don't fit the definition of paramilitary organization. To make our construct useful in public policy, we should be able to propose broad treatment across all members of a construct and be able to predict consistent outcome. We should be interested in developing useful tools for policy talk, and being able to make grounded generalizations is super useful.

I don't think the Unabomber or Anonymous fits in the same policy discussion as IS or Al Qaeda, because I think these problems suggest very divergent courses of policy. Every time we have to make caveats to our category, every time we must exercise discretion in interpretation, we will find our construct proportionally less robust.

Imagine a government rule which authorizes military action against IS, cartels, or Al Qaeda, including assassinations and characterized by an absence of legal process. Whether or not I agree with this rule, I can accept that it is sensible and potentially productive to at least talk about. I can accept that these groups have common characteristics which behave consistently following military or civilian interventions, thus permitting policy generalizations. I can also see that there is an intuitive connection between the solution and the problem.

What is hard to accept is that Unabomber and Anonymous should be on that same table for discussion, because what the overinclusion of these groups do is move the line of justification to remove legal process a little closer to home, and a little more into the realm of capricious discretion. It's hard to accept that some domestic terrorists are anything like an organization that has revenue streams, human resource management, infrastructure, administration, a paramilitary force, and so on, and so it's hard to connect the solution to the problem.

Of course, behind all of this is the assumption that terrorist organizations are so mighty that they have graduated beyond the class of criminal and into sub-state actor, and that ordinary civilian instruments are totally inadequate, and that military solutions are the only effective solutions.

</comment></comment></comment><comment><USER16> The thing is, there's no formal, "prove it" review, by a jury, grand jury or judge. It's just some dude in the FBI who doesn't like someone, and decides to fuck with them. They're supposed to be an investigating agency, but now they just skip ahead to punishment.

Some guy fucking with you, is what our government has descended to.

</comment><comment><USER9> The Daily Dot broke this story and provided the actual documents, the meat of which is:

        DO NOT ADVISE THIS INDIVIDUAL THAT THEY MAY BE ON A TERRORIST WATCHLIST.

        CONTACT THE TERRORIST SCREENING CENTER AT [REDACTED] DURING THIS ENCOUNTER.
        IF THIS WOULD EXTEND THE SCOPE OR DURATION  OF THE ENCOUNTER, CONTACT THE TSC
        IMMEDIATELY THEREAFTER. IF YOU ARE A BORDER PATROL OFFICER, IMMEDIATELY
        CALL THE NTC.

        ATTEMPT TO OBTAIN SUFFICIENT IDENTIFYING INFORMATION DURING THE ENCOUNTER,
        WITHOUT OTHERWISE EXTENDING THE SCOPE OR DURATION OF THE ENCOUNTER, TO ASSIST THE
        TSC IN DETERMINING WHETHER OR NOT THE NAME OR IDENTIFIER(S) YOU QUERIED BELONGS
        TO AN INDIVIDUAL IDENTIFIED AS HAVING POSSIBLE TIES WITH TERRORISM.

        DO NOT DETAIN OR ARREST THIS INDIVIDUAL UNLESS THERE IS EVIDENCE OF A VIOLATION OF
        FEDERAL, STATE, OR LOCAL STATUTE(S).

Some observations:

First, this looks like boilerplate text. If so, "DO NOT ADVISE..." means, in general, "do not advise _anyone_ on a terrorist watchlist that they are on the watchlist". That text would make sense if, for instance, this is what an LEO sees on their MDT screen when they look up someone's identity. Counterterrorist workers want to collect information from LEOs, so they need to flag people to get reports --- but they don't want that to come at the expense of tipping off terrorism subjects that they're under investigation. That's a warning that might make a lot of public policy sense when the FBI is tracking Abdul Kadir and his plot to blow up JFK, but not as much sense for Jeremy Hammond.

The all-caps text and awkward structure of the prose sort of suggests that's what this is: the stuff that shows up on the cop's MDT screen when they run someone's identity and they've been flagged.

Second, each of the three paragraphs in this notice to LEOs directs the officer not to detain the subject based on the notice. Presumably that's because doing so can generate evidence that will then be excluded at trial, because merely being on a watchlist does not provide the police with probable cause to search or arrest.

Finally, people should remember that while our immediate association to the word "terrorism" is 9/11 and Islamist militants, the FBI tracks a pretty broad range of domestic terrorist groups --- including parts of the militia movement, radical animal rights groups, white supremacist groups, and "anarchist extremists", a category they surely didn't make up for Hammond, but which Hammond could easily have fallen into.

(In case it needs saying, while it may once have been the case in the '60s and '70s that there were radical anarchist groups that merited special tracking at a national level, I do not think the "anarchist extremists" of 2015 --- even the ones who try to scare the horses the mounted police are riding at the NATO protests --- qualify as "terrorists". The separatist militia movement, though? I'm glad we're calling them what they are.)

<comment><USER17> I'd also add that the "REDACTED" bit makes it look arbitrarily suspicious. The FBI terrorist screening center isn't a secret thing. They've got contact info on the FBI site which I can confirm rings to a phone inside the building.

Or, at least it did, before they moved from Reston to Vienna.

<comment><USER9> Sure, but I assume it's the DOJ that redacted that bit :)

</comment></comment></comment><comment><USER18> torthrowaway123:

> A decade ago I knew Jeremy, a very little. Not enough to be particularly > interesting even then, yet alone now, and I haven't spoken to him since he > went to jail for the first time (I think around 2005).

> (And while on the subject of surveillance... I created a fake account from > Tor to write this. Can't imagine anyone would really care about my saying I > knew him, hell I'm 99% sure he wouldn't even remember my name, but I'd > rather not make that tie if it hasn't already been made.)

I think this illustrates the real concern a lot of people may have over this story than the hair-splitting semantics about defining the word "terrorist".

How do we know who's labeled a terrorist and who isn't?

What if we're associated with someone on a terror watch list without knowing this?

What if you're on a watch list and don't know it?

What recourse do any of us have?

<comment><USER9> You don't, and can't. The purpose of having watchlists is so counterterrorist investigators can quietly monitor the movements of people they think will organize terrorist attacks. Notifying the people on the list defeats that purpose: it ensures that none of the people it's watching will incriminate themselves, or lead counterterrorist investigations to the other members of the plot.

That doesn't mean the lists aren't fraught or regularly abused. For instance, you surely cross a line from "legitimate investigative tool" to "tool of oppression" when the watchlist ensures you get an extra hour of screening at the TSA checkpoint.

<comment><USER18> > You don't, and can't. The purpose of having watchlists is so > counterterrorist investigators can quietly monitor the movements of people > they think will organize terrorist attacks. Notifying the people on the list > defeats that purpose: it ensures that none of the people it's watching will > incriminate themselves, or lead counterterrorist investigations to the other > members of the plot.

Fair enough.

> That doesn't mean the lists aren't fraught or regularly abused. For > instance, you surely cross a line from "legitimate investigative tool" to > "tool of oppression" when the watchlist ensures you get an extra hour of > screening at the TSA checkpoint.

At this point, I want to say, "What can be done about this abuse?!" but I don't really have any answers. The best we can hope for is some form of independent oversight from someone who can remain some degree of objectively neutral (which is to say, not buddy-buddy with law enforcement), but who also can be trusted not to leak stuff to the press.

I dunno, does anyone have better ideas? This is way outside of my comfort zone.

</comment></comment></comment><comment><USER19> Oh the Irony since the United States of America was founded by Terrorists.

<comment><USER9> This is definitely message- board- clever, but I'm not sure what it's supposed to mean. Stipulate that the United States was founded by terrorists. Now what? What's the implication of that fact on public policy today?

<comment><USER20> He's probably just trying to point out that the founders would likely be on terrorist watch lists today.

<comment><USER9> If you actually believe the founders to have been terrorists, what's interesting about that?

<comment><USER14> You know, I found this list of google hits interesting in light of this sub- thread. Now obviously, I should probably have substituted "Britain" for "United Kingdom"... but still -- who's under the rule of which over-reaching global power these days?:

        https://www.google.no/search?q=american+war+freedom+united+kingdom

</comment></comment></comment></comment></comment><comment><USER11> Has someone told the FBI about Berlin? They might want to put the whole city on the list just to be sure considering possible co-conspirators. Probably add Hamburg too.

</comment><comment><USER21> Jeremy was involved in a number of actual attacks together with other "members" of Anonymous.

It may not seem like terrorism in the typical sense you think, but disrupting computer systems randomly and maliciously is a type of terrorism.

I think it is perfectly reasonable to consider this particular individual a type of terrorist based on his actions. ( see other comments about his additional violent actions and suggestions )

If you think you can go around doing whatever you want with computers, and not have the government add you to a number of lists, then you are in some serious denial.

An alternative example: I don't hack random people, nor do I advocate violence, but I recently purchased some aluminum powder and red iron oxide off the internet. If I was added to the watchlist just for purchasing those substances, then -that- would be much more ridiculous.

<comment><USER22> You are out of your mind. You are equating pennies of damage done by Anonymous with terrorism, which involves killing people for instilling fear and reaching unpopular political goals.

<comment><USER9> Terrorism seems to be uniformly violent, but it is not always murderous. Extreme property damage is a tool of terrorism as well. But hacking is virtually never violent, and Stratfor wasn't an exception to that.

We may be jumping to conclusions when we suggest that Hammond's inclusion on a watchlist means that the FBI views Anonymous as a terrorist group. What he did with Anonymous is surely what got their attention, but his other affiliations seem like a more likely grounds for being added to a list of people to flag.

<comment><USER20> Throwing paint on some old racist's books (at a book signing) and knocking their dinner to the floor is terrorism? Sure, it's worse to throw paint/ink than a pie at them, but it's not terrorism. Maybe nuisance-ism.

<comment><USER9> They didn't just throw paint. Someone left in an ambulance. And what does "old racist" have to do with anything? People who attack women getting abortions believe they're acting to prevent _actual murders_. We don't consider the substance of their positions when we rightfully send them to prison for doing that. You don't get to bust up a restaurant and attack a senior citizen because you don't like what he has to say. The antidote to bad speech is more speech, not violence.

<comment><USER20> >Someone left in an ambulance.

And you think that was by design. A guy said "Hey, I think I'll go ruin their books and their dinner, and then I'll maim one of them half to death pour encourager les autres? No, someone fell on broken dinnerware and received a cut(s).

>We don't consider the substance of their positions when we rightfully send them to prison for doing that.

We do, according to you. That's exactly what we're doing when we maintain terrorist watch lists of people who have committed no crimes, or when the crimes are as minor as this dinner crashing, or the Olympic flag burning. In the dinner crashing, tellingly, Hammond was found guilty of disorderly conduct and sentenced to four days in jail.

>The antidote to bad speech is more speech, not violence.

I'm not making a unqualified defense of Hammond's behavior. I'm saying that it isn't terrorism.

<comment><USER9> I don't think it's terrorism either. Just because we don't agree about everything doesn't mean we _disagree_ about everything. I responded to a comment upthread that suggested Hammond was nonviolent. Hammond is not nonviolent.

On this particular subthread, I'm pointing out that Hammond's inclusion in a watchlist doesn't necessarily mean that Anonymous is a terrorist group (obviously, I don't think it is). He had other affiliations that freaked the USG out. As I've said elsewhere on the thread, this being 2015 and not 1970, I don't think the USG has a reasonable fear that "anarchist extremists" are terrorist groups.</comment></comment></comment></comment></comment></comment></comment>


Show HN: The Latest - the best 10 links right now - <AUTHOR> http://latest.is

<comment><USER2> How about the next 10?

</comment><comment><USER3> \- Thanks for sharing.</comment>


What I Learned from Creating a High School Social Network - <AUTHOR> https://medium.com/@jsrmath/what-i-learned-from-creating-a-high-school-social-network-c37fcd0fb4b0#.na6ea4l99 <comment><USER2> I made a social network in middle school. Nobody used it, but that taught me how to write terrible PHP applications.

With that same knowledge I made another social network ~2/3 years later for an online community, and it worked better. Eventually I shut it down. In 2012 I revived it and very quickly learned the value of not mixing your business and presentation logic (refactoring the codebase to be maintainable was an absolute chore), and of preventing XSS and XSRF (someone set their avatar to the URL "/logout").

<comment><USER3> A lot of people make a lot of money from writing terrible PHP applications that solve a particular business need. Sometimes it's shocking to me to be honest!

<comment><USER4> I guess you've never heard of Sharepoint :)

<comment><USER5> Tell me, what's that space like? Know it's a thing, (intranet sites or some such?), but that's about it. Very curious about it, heard people make a lot in there.

<comment><USER4> I've heard of guys earning north of $150 per hour and the demand is quite high. It's pretty big in the corporate world, back in 2011 78% of Fortune 500 companies were using it. It's an Intranet/Document management platform and it collaborates with MS Office.

</comment></comment></comment></comment></comment><comment><USER2> > If you were a high school senior and your schoolmates were handing you > transcripts of all their juicy gossip on a silver, digital platter, what > would you do?

If I was actually handed that info on a silver platter, willingly, then who knows.

But that's not your situation. In your situation, I'd be violating the trust of my entire school. That's neither a good idea ethically nor socially.

<comment><USER6> I think you are slightly misrepresenting the author. His sarcastic comment about "bulletproof moral guidelines" seems to indicate that he isn't proud of this particular moral transgression. And while I don't think he was right to read the messages, you have to consider that the people using the service literally had no idea who they were sending messages to. I think that makes it a bit different from reading messages that were intended for one person that the speaker knew well. Not that that excuses the behavior, but I do think it explains some of the rationale. Also, who didn't make stupid immoral decisions in high school?

<comment><AUTHOR> This is pretty accurate. tl;dr: What I did wasn't great but it could have been a lot worse (see all the things I made it a point of not doing), and that gives you something to think about when it comes to data and privacy.

<comment><USER7> Wow, that's a pretty unimpressive response. It's bad enough you did it, but I seriously doubt you realize how wrong what you have done really is when you discount that wrong doing so easily.

To make it clear: You advertised an anonymous service to a community you're a direct member of and didn't disclose your involvement in it. You not only willingly broke a moral code that you knew about, but you actually misrepresented the service in your advertisement and broke any trust you had with everyone who participated. That's a pretty serious wrong doing that warrants a little more self reflection and much more empathy towards the people you screwed over.

</comment></comment></comment></comment><comment><USER8> Somebody get this guy a YC appointment. He has the right idea, and needs to scale it up.

<comment><USER9> Scaling an anonymous social network targeted to high schoolers... I shudder at the thought of the minefields you would be required to navigate.

* Privacy * Bullying * Under age pornography

Facebook, Instagram, Snapshat etc all struggle with this across their networks.

Something designed for a user base that is almost exclusively under 18.... Shudder.

College students have trouble conducting themselves online in a proper fashion - just look at Yik Yak and the headwinds it is facing.

<comment><USER8> Such negativism. This is YC. Accentuate the positive, eliminate the negative.[1] Yik Yak has a $400M valuation.

[1] [https://www.youtube.com/watch?v=fZUmAbi0Vm4](https://www.youtube.com/watch?v=fZUmAbi0Vm4)

<comment><USER9> I tend to be skeptical at times. A 400m valuation for a local anonymous chat application? Yup, I'm skeptical. Actually, I think it is ridiculous.

<comment><USER10> _A 400m valuation for a local anonymous chat application? Yup, I 'm skeptical._

You'd be wrong.

[http://www.wsj.com/articles/year-old-messaging-app-yik- yak-d...](http://www.wsj.com/articles/year-old-messaging-app-yik-yak-draws- big-valuation-1416791097)

Perhaps you meant you disagree that valuation makes sense?

</comment></comment></comment></comment></comment><comment><USER11> Rad! Throw some sentiment analysis on that corpus and let your classmates know how they feel!

</comment><comment><USER12> Great read! Really well written too. Kudos to you for being so open about everything - I can't imagine many high schoolers would have written with as much candour as you did in the "You ≠ your app" section.

</comment><comment><USER13> What percentage of students used it?

<comment><USER14> > I accumulated a total of over 500 registered users (out of about 800 > 9th-12th graders)

<comment><USER15> Technically its not "out of" because in the linked article:

"Hunter ID number (a number which I could validate but not easily trace to a particular person)"

I'd read that as some minimal formatting and the correct number of digits and you're in.

I suspect there were no small number of school admins, teachers, parents, ex students, middle/grade school students, outright adult pedos, etc.

More like 500 registered users out of a billion internet users.

<comment><USER14> He also points out (just a few words from the bit you quote) that virtually everyone registered with an email address that included their name, so he knew who everyone was.

</comment></comment></comment></comment><comment><USER16> Where can I join freshStart?

<comment><USER17> Enroll in Hunter College High School.</comment></comment>


Show HN: Agile in IT, beyond development teams (book) - <AUTHOR> http://www.agileorgdesign.com/2015/06/scale-agile-vertical-horizontal.html

<comment><USER2> It brings out flaw in usual understanding/implementation of agile. my intro to agile came from typical scrum, team of 5-8, standups etc.</comment>


Ignition Partners VC Frank Artale resigns in light of misconduct allegations - <AUTHOR> https://techcrunch.com/2017/07/12/ignition-partners-vc-frank-artale-resigns-in-light-of-misconduct-allegations <comment><USER2> I don't think we have seen the last resignation related to sexual harassment. It is a shame that people cannot conduct themselves in a manner that is respectful to one another. I understand being attracted to someone after all we are all human. But using authority, position as a VC, etc is such an abuse of power. I wish they could have just thought about how the women would feel to be treated so poorly. If they could not do that, I wish they would have thought how their own life could be affected should their actions become known. Maybe then many of these women would have not be subjected to such crass behavior.</comment>


The 30-Year-Old Macintosh and a Conversation With Steve Jobs - <AUTHOR> http://bits.blogs.nytimes.com/2014/01/24/the-30-year-old-macintosh-and-a-lost-conversation-with-steve-jobs/ To celebrate the 30 year anniversary or the Mac, Steven Levy released an unseen and raw interview with Steve Jobs. <comment><USER2> Such a great wordsmith Steve Jobs was.

I'm so conflicted --- I like Richard Stallman's freedom defending approach, and I also like the capitalist fruits of Steve Jobs...

Anyone else on here want to help make a serious run for Nobel Peace Prize for Stallman?

<comment><USER3> There's a single-mindedness about both of them which, while undoubtedly a contributor to their greatness, also makes them divisive, unable to compromise, and therefore very bad candidates for the Nobel Peace prize.

<comment><USER4> Stallman is in a class by himself. Jobs eventually let them build Macs with fans, let iTunes for Windows ship, etc. Whereas Stallman has never wavered. Doesn't he still surf the web via email?

</comment></comment></comment><comment><USER5> Ever since I stumbled upon this Steve Jobs submission on HN [1], anything positive I read about this man is disdain. There's a dark cloud hanging around his work. I'm getting the vibe that others are feeling the same way too.

I do realize the products Apple has built are the result of the ingenuity of thousands of Apple employees so one can't just discredit their hard work.

\-- Cynical me

[1] [https://news.ycombinator.com/item?id=7111531](https://news.ycombinator.com/item?id=7111531)

<comment><USER6> It's only been 24 hours since that link was posted - praise & disdain both tend to come in waves.

People have many facets - not all are good. It's dangerous to play someone up as a savior when they're simply human.

</comment></comment><comment><USER7> Just FYI, the interview book was originally released in 2000.</comment>


How Paypal and Reddit faked their way to traction - <AUTHOR> https://medium.com/@sanguit/how-paypal-and-reddit-faked-their-way-to-traction-9411fb583205 <comment><USER2> Title should be "How Medium is trying to fake their way to traction"...</comment>


KDE Frameworks 5.60.0 Released - <AUTHOR> http://kde.org/announcements/kde-frameworks-5.60.0.php <comment><USER2> Good overall but hard for me to understand why WebKit got downgraded.

<comment><USER3> >Downgrade KDEWebKit from Tier 3 to Porting Aids

>Summary: QtWebKit is dead, even the "revived" version has no changes since more than a year.

[https://phabricator.kde.org/D21400](https://phabricator.kde.org/D21400)</comment></comment>


Rust caching on CircleCI using sccache - <AUTHOR> https://firstname.lastname@example.com/rust-caching-on-circleci-using-sccache-c996344f0115 <comment><USER2> I had a few CircleCI jobs where downloading and uploading the cache took about 5-10 minutes, while the actual build step only took 1-2 minutes... And of course, it gets worse with time.

In case the author reads this: Thanks for the writeup!</comment>


A depthcam? A webkinect? Streaming depth data over a binary WebSocket - <AUTHOR> http://blog.mackerron.com/2012/02/03/depthcam-webkinect/

<comment><AUTHOR> Nodester seems to be temporarily down. This is now running on <http://ec2-176-34-165-33.eu-west-1.compute.amazonaws.com> (and, as soon as the DNS propagates, <http://depthcam.mackerron.com>).

Edit: Knocking off now, so there won't be a lot to see again until about 10am GMT.

</comment><comment><USER2> Pure awesome!! How about synching two Kinects for a more complete space? Grouping pixels into meta-primitive triangles? Agree w/jskopek about positioning a color video camera near the Kinect for sampling color of each primitive. Can't wait to see further developments!

</comment><comment><USER3> Goes to show how close we are to 3d chatting. If this could be combined with a high quality video feed and some clever, C3-style mapping technologies, you could probably get a much more engaging video chat experience.

I wonder if this might be 3D 'killer app'?</comment>


Ask HN: What web browsers(desktop and mobile) do you target for your project? - <AUTHOR> What is the minimum version you target for each OS and browser vendor? How did you decide on this? <comment><USER2> Work (ecommerce): IE 11 + Safari/Firefox/Chrome going back quite a few versions. IE 11 still brings in a non-trivial amount of revenue.

Personal side projects: Modern Safari/Firefox/Chrome. Best effort support for Legacy Edge and older browsers.</comment>


Show HN: Sitebot.ai – Automatic website testing based on users' clicks - <AUTHOR> https://sitebot.ai/ <comment><AUTHOR> Hi, I'm the maker of sitebot.ai.

I felt that website testing was necessary for my web dev work, but I wasn't satisfied with tools that require you to create and maintain tests yourself. I created sitebot.ai to automatize website testing. The service converts website users' clicks to patterns and tests that the site keeps working.</comment>


Writing a personal automation API - <AUTHOR> https://dev.to/anotherdevblog/every-developer-should-write-a-personal-automation-api <comment><USER2> Laziness ftw! -> [http://threevirtues.com/](http://threevirtues.com/)

Really not trying to self-promote, but genuinely interested in laziness as a quality of great developers. I talked about it at a javascript meetup [https://www.youtube.com/watch?v=JuqVmhJ4tDA](https://www.youtube.com/watch?v=JuqVmhJ4tDA) (Ignore the David Foster Wallace hair, the math error. Security folks don't worry that address is not valid).

I bought up lzy.io and wanted to make a lazy manifesto, but I don't think we need any more manifestos, So I just collected some examples of programmers taking laziness to new levels good and bad!

<comment><USER3> Funny that you mention laziness, because most programmers I know work harder and are under more stress than most other people.

<comment><USER2> Hence the title "Working Hard to be Lazy"...

Here's a basic programming example say you're writing some front end javascript to make a call to another site's api... if you have to do it once, you probably will set the headers, and make the call right? Well if you have to do it three or more times, it pays to be lazy and write some sort of function to wrap the fetch call and automatically set the headers for you each time.

This is the laziness that I'm advocating. It's not about people that don't put effort in, it's about maximizing efficiency and taking processes approach. In many cases truly lazy people will work twice as hard now to avoid work in the future.

<comment><USER4> I know lazy developers. They would just copy and paste the api call three times. And if the api call really only needs to happen three times they might be lauded for taking a pragmatic approach rather than over engineering.

<comment><USER2> [https://en.wikipedia.org/wiki/Rule_of_three_(computer_progra...](https://en.wikipedia.org/wiki/Rule_of_three_\(computer_programming\))

Totally agree that if you are only doing something exactly three times, probably not worth it. That being said when was the last time you were absolutely sure the requirements won't change? Only the Sith deal in absolutes.

<comment><USER5> Has anybody else noticed that "Only Sith deal in absolutes" is an absolute? Genuinely curious if it's just so obvious that it's never talked about, or if people just don't stop to think abouy it...

(I mean, it's a pretty good piece of advice... we just never talk about the irony)

<comment><USER6> > Has anybody else noticed that "Only Sith deal in absolutes" is an absolute? > Genuinely curious if it's just so obvious that it's never talked about, or > if people just don't stop to think abouy it...

I think you're just not usually around the people who talk about it. Here are some example image macros.

[http://img.memecdn.com/only-sith-deals-an- absolutes_fb_51269...](http://img.memecdn.com/only-sith-deals-an- absolutes_fb_512697.jpg)

[https://img.memecdn.com/who-amp-039-s-really-on-the-dark- sid...](https://img.memecdn.com/who-amp-039-s-really-on-the-dark- side_fb_6700751.jpg)

[https://i.pinimg.com/originals/d9/32/8c/d9328c625f6f47e8d8a9...](https://i.pinimg.com/originals/d9/32/8c/d9328c625f6f47e8d8a99be102a56415.jpg)

[https://pics.me.me/only-a-sith-deals-in-absolutes-that- itsel...](https://pics.me.me/only-a-sith-deals-in-absolutes-that-itself-is- an-20291123.png)

[https://pics.onsizzle.com/whats-wrong-obi-wan-kenobi- tells-a...](https://pics.onsizzle.com/whats-wrong-obi-wan-kenobi-tells-anakin- that-only-sith-7661489.png)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Maybe I just tried it at the wrong time, but several years ago I tried IFTTT for a few weeks. Events frequently fired late or not at all. It seemed useless in a situation where you needed some confidence in the timeliness or consistency of events.

Does anyone use IFTTT heavily and have a better experience? Are you able to rely on it?

<comment><USER8> I moved to a self-hosted Huginn instance instead for the very same reasons... (and the fact that it doesn't allow for any granular control)

</comment></comment><comment><USER9> Off-topic but every time I open their site I am blown away by how fast their pages load. It's an absolute delight to navigate their blog.

<comment><USER10> Pretty annoying, though, that they hijack users' familiarity with the red dot to deliver the useless notification that "You are not logged in on this device".

<comment><USER11> It's essentially an ad that gets you to click it by making you think you are somehow logged in on a site you don't have an account on. I emailed them about this because I think it's an awful pattern, and did get a response but not one that indicated they understood the problem with this deceptive marketing technique. It makes me avoid clicking links to dev.to.

</comment></comment></comment><comment><USER12> Although a fun activity, do not set high expectations out of personal automation. I think the quoted XKCD [1] (also [2]) strip illustrates the glory and peril of personal automation enough.

Automation makes most sense in the true context where it belongs, "business." Automating a complicated e-mail marketing process with targeting, statistics and all makes sense because you need tens of thousands of instances of that process to be executed to create business value.

Except for rare idiosyncratic use cases, spending time in personal automation is more of a hobbyist and educational activity. Further, if the use case is not "that" rare, there is almost always "an app for that" anyway. Therefore, have no high expectations out of that.

With that disclaimer in mind, if you are into it, check out the open-source project Huginn [3] that can "Create agents that monitor and act on your behalf." for personal automation. Lastly, the industry standard of cloud API integration currently might be Zapier [4], which has more integrations, (business) battle-tested features compared to end-user oriented IFTTT.

\----

1: [https://xkcd.com/1319/](https://xkcd.com/1319/)

2: [https://xkcd.com/1205/](https://xkcd.com/1205/)

3: [https://github.com/huginn/huginn](https://github.com/huginn/huginn)

4: [https://zapier.com](https://zapier.com)

<comment><USER13> The comic strip was tough to swallow for me, having spent the last few months automating configuration of my Windows workstation setup I use for 3D/VR. I was doing freelance jobs and had my workstation collapse a few times during aggressive deadline sprints so I figured I would automate the rebuild so that reinstalling the OS becomes more of a Plan A than a Plan B.

Why am I posting this here? I am honestly on the fence about whether this has been a good use of my time. It took longer than expected and I had to use Powershell for some of it, which was just dreadful. It _was_ 'for business' but I am still not sure it was a great call. Has anyone else out there found themselves automating something like this? Was it worth it?

<comment><USER14> Automating something usually involves a risk from predicting the future: the cost of automation is amortized over the number of repetitions, but you don't always repeat everything.

It's generally cheaper to automate something if you can perform it on a command line. With command history, it's easy enough to copy the commands and turn them into a script with appropriate parameterization.

It doesn't help you a great deal with Windows if you've been doing everything with GUIs. But Powershell itself is an investment that can pay off. If you can automate more everyday tasks, the pain of learning is amortized away.

I generally stick with the Unix-like shell that Cygwin gives me, and use the same commands and idioms on as I do on Linux and on Mac, on the very few occasions I use a Mac.

<comment><USER13> My setup script starts by making a backup of the registry, then configuring Python. I use Python for most of the rest and Powershell only where necessary. Contrary to what my comment may suggest, I am actually a software minimalist. A large part of my setup involves removing clutter from the desktop environment. I have avoided cygwin partially just so I'm not scared of native windows command line, which I find not quite as bad as Powershell to work with, but more limited in interacting with the OS of course. I am familiar with basic linux Bash already and that's what I'm comparing all of this to. Maybe now is a good time to adopt cygwin because, well, better late than never.

<comment><USER14> Getting Cygwin set up right takes a little bit of work - it's much easier if you're familiar with configuring a Linux shell and terminal to taste. Out of the box, it's a bit rough; kind of similar to how Emacs is a bit rough.

I am scared of the Windows command line - not because it's scary, but because it's so limited. I feel almost helpless, all my tools are missing, it's just so awful.

In practice, the reason I use Windows is mostly games, but it's rare I fire them up these days - I have to upgrade and/or re-verify my Steam account almost every time I start the client. Outside of that the browser and the terminal are almost all I use, and I can have them just as easily elsewhere.

My point being my experience may not translate to your environment quite as well.

Registry in Cygwin is mounted under /proc/registry:

        ~$ ls -l /proc/registry/HKEY_CURRENT_USER/Software/Microsoft/Windows
        total 0
        dr-xr-x--- 72 SYSTEM  SYSTEM 0 Dec 16 23:57  CurrentVersion
        dr-xr-x---  2 SYSTEM  SYSTEM 0 Dec 13 01:58  DWM
        dr-xr-x---  4 SYSTEM  SYSTEM 0 Dec 13 01:48  PrivacySettingsBeforeCreatorsUpdate
        dr-xr-x---  6 SYSTEM  SYSTEM 0 Dec 13 01:52  Shell
        dr-xr-x---  4 SYSTEM  SYSTEM 0 Dec 13 01:47  TabletPC
        dr-xr-x---  3 SYSTEM  SYSTEM 0 Dec 13 01:47 'Windows Error Reporting'
        dr-xr-----  3 barrkel None   0 Dec 13 01:58  Winlogon

It's read-only however. Cygwin `regtool` lets you poke values in.

</comment></comment></comment></comment></comment><comment><USER15> Instead of IFTTT, I've been using node-red for my automation needs. Really enjoying it.

<comment><USER16> I also use node-red for my automation needs very successfully. I found IFTTT to be unreliable and limited for my purposes, and node-red has also filled the void left by the closure of Yahoo Pipes.

</comment></comment><comment><USER17> Significant portion of my days (maybe 30%) is doing repetitive things I do every day. So really thinking about how to improve, automate, or save a few minutes during the morning or evening routine would pay off greatly.

When I think of personal automation api. It would be to help me with my routines

1\. Shower 2\. Shave 3\. Brush teeth. 4\. Check email 5\. Plan my day 4\. Make breakfast 5\. Exercise 6\. Sleep

Any of the above could be optimized to be excellent.

For example playing my favorite podcast automatically while I go to the bathroom would be nice. But knowing/using the best shampoo, soap, or toothpaste is also of great value. Same with what breakfast to prepare/eat. Or the gym/workout routine to follow. Technology might help a little, but some active thinking about what and how to optimize is needed.

<comment><USER18> Right click -> Sort Room/Desk/Bookshelf/Bathroom is the feature I want for life.

</comment></comment><comment><USER19> I never understood IFTTT.

Every person I asked used it to sync some stuff from A to B, never heard something interesting...

<comment><USER20> It's a gimmick, and gimped when it comes to what you really want to do. E.g. each integration "thing" is superficial and you can't script most of it. You're locked into their crappy UI and "endpoint" data.

You're better off renting a entire VPS and creating code that polls all your data sources and create your own task pipeline.

</comment></comment><comment><USER21> I'm thinking of doing this to better enable work from an iPad. Mostly in terms of things like having push button access to command line tools via api, everything from compilers to pandoc. But the real sticking point is that there's no universal easy way to actually get a file attached to a http request with iOS sandboxing---the best I can come up with is emailing everything in and building the api around reading subject lines. Which seems a little... hassle-full?

<comment><USER22> On Android there's a bunch of apps which will register as a share target and let you configure a bunch of HTTP endpoints of your choosing to send it to, I would be surprised if there isn't an iOS equivalent?

<comment><USER21> Hmmmm.... I wonder if there's a way to do this with pythonista. It does have a share sheet module. Combine that with the base64 point below...

</comment></comment></comment><comment><USER23> For me the hard part is finding what to automate. Automation is not only about saving time but taking away the annoying stuff as well making your efforts more efficient. There is no silly graph to predict how valuable an automation will be. Python started as a simple bash like scripting language and nowadays it grown to epic proportions. Automation needs time to mature. People tend to overestimate the value of their time vs the value of automation. Even the language we speak took thousands of years to develop, talking about huge waste of time. But hey someone has to push human progress forward.

<comment><USER24> [https://xkcd.com/1205/](https://xkcd.com/1205/)

</comment></comment><comment><USER25> I use Zapier for this since you can inject code via Python between tasks if needed. Also filters and such. IFTTT is great for consumer stuff but not having multisteps has been annoying.

</comment><comment><USER26> Author cites the all too relevant XKCD with regards to "automating things".

Curious to hear if anyone else is making IFTTT work for them on a daily basis. My initial experience with IFTTT was buggy, tasks would fire inconsistently, with no clear way to debug.

<comment><USER27> Not me (but also curious to hear!).

I tried it but never understood the value they provide for users with basic programming and scripting knowledge.

I either use the API directly, or, if not available or I only need some quick and dirty solution, resort to web browser automation tools like Kantu.

<comment><USER28> Why would I bother doing that instead of just using an existing recipe? The benefit is laziness.

<comment><USER29> Because the existing recipes are one-size-fits-all. If you need an sort of customization, you end up rolling your own anyway. Many of us started coding for that kind.of reason to begin with.

<comment><USER28> Well, yea. But ignoring the existence of the recipes that you do need just because you want a custom one for something else is silly.

</comment></comment></comment></comment></comment><comment><USER30> I'm still unable to use cron properly. i'm too lo-tech for this</comment>


Bit.ly Goes Pro, Tells Goo.gl To Suck.it - <AUTHOR> http://www.techcrunch.com/2009/12/14/bit-ly-pro-google-suck-it/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+Techcrunch+(TechCrunch)&utm_content=Google+Reader

<comment><USER2> Awesome, now instead of merely having no idea where a link on Twitter is taking me, I can be left in the dark by links from many other top websites as well! And to think this entire "space" could have been avoided by Twitter not counting URLs against message length.

It has been interesting to follow the trend through the years back to where we started. In the beginning we had <http://foo.com/bar.cgi?p=123>. Then there was a big movement to bring context to URLs and we got <http://foo.com/2005/01/01/my-post/>. Now even Google and Facebook are determined to bring us full circle to our inferior origins. It'd be funny if it weren't so sad.</comment>


Managing TLS connections using Lua and Lua coroutines (2018) - <AUTHOR> http://boston.conman.org/2018/07/23.1 <comment> as-j We use lua and coroutines heavily in an embedded Linux project. We use ubus, and uloop from OpenWRT, which have Lua bindings^1. It works really well, and makes some very nice to read code in the final application.

It's nice to see someone using it well, and Lua's lack of a good TLS/HTTPS bindings is a bit sad.

Lua does have it's issues, and can be a pain. But it's an incredibly powerful little language that really fits our needs well on a embedded system with restricted ram. Debugging an app when are 4 coroutines deep and have 4 stack traces unrolled on the screen...isn't so fun.

\---

1) Though they leave a bit to be desired, and we've cleaned them up. I need to remember to try and see if we can it get upstreamed.</comment>


Security Economics of the Internet of Things - <AUTHOR> https://www.schneier.com/blog/archives/2016/10/security_econom_1.html <comment><USER2> There is another way this problem will be solved. (For certain interpretations of the word "solved").

Tort law.

Manufacturers negligently sell defective products in the marketplace. (Reference the litany of weeping by Schneier and others about the sloppy and amateurish software in the IoT universe).

Harm befalls the customer or a reasonably foreseeable third party (oh, hypothetically, Dyn? Or anyone who sustains severe economic damage from a DDoS attack).

Lawsuit against manufacturer, distributor, and retailer ensues. Your favorite contingency fee tort lawyer at work here. No win? No pay.

Win or settle.

Now distributors and retailers will no longer sell malformed IoT devices because they have an economic incentive to not do so.

Or their insurance carriers will raise insurance premiums to cover the risk. Another economic incentive to not sell crappy products that will participate willingly in a DDoS attack.

In short, Schneier misses the economic incentives and the marketplace at work. He misses it because law is not his domain of expertise. Time will bring a lawsuit or two and he will become aware of this.

And we have avoided a Federal Department of Things (Internet) being inflicted upon us. That, I submit, is a boon of immense value.</comment>


Fast String Searching With Suffix Trees - <AUTHOR> http://marknelson.us/1996/08/01/suffix-trees/ Summary: Building a Suffix Tree (in O(n) time and space) allows you to search for substrings in O(m) time (m being size of substring).<p>Link is to article describing algorithm and giving sample code in C++. <comment><AUTHOR> Summary: Building a Suffix Tree (in O(n) time and space) allows you to search for substrings in O(m) time (m being size of substring).

Link is to article describing algorithm and giving sample code in C++.</comment>


2009: The Year in Haskell - <AUTHOR> http://haskellwebnews.wordpress.com/2009/12/20/the-year-in-haskell/

<comment><USER2> Fantastic. What a quality-link-dense article.

</comment><comment><USER3> can someone give the comparison between erlang and haskell?

<comment><USER4> Google would be glad to oblige to a fellow scientist!

</comment></comment><comment><USER5> Well looking at the industry exposure that haskell has got one may presume that functional programming may be making there way into the world of commercial software.</comment>


Show HN: Weekend project - Chardin.js, simple overlay instructions for apps - <AUTHOR> http://heelhook.github.com/chardin.js/ <comment><USER2> I love this and the fact that it works on mobile devices.

</comment><comment><USER3> Awesome! Thanks for sharing</comment>


Does it make sense to build for iOS or Android first? - <AUTHOR>

If you're releasing a mobile app, what are the pros/cons of releasing on iOS before Android? A lot of popular apps are released on iOS first - any Android proponents out there? <comment><USER2> I think you should program for iOS first. Think about a company like Instagram, they made the app for only iPhone users, then it became popular. Once the app was released for Android, millions of people downloaded it in less than 24 hours. In my opinion iOS apps gets more attention then Android apps. Android apps aren't a bad place to start though, there are some really good Android apps I use everyday.

</comment><comment><USER3> It should depend on the type of app you're building. If the monetization is important (e.g., it's a paid app), then I hear that iOS is still the way to go. (As kavalec points out, the trend is slowly changing though.) If it's important for you to have wide distribution of the app, then Android has a larger reach and this will only increase over time.

</comment><comment><USER4> 1\. The trend seems to be towards Android.

2\. Apple seems to be making more, not less, difficult to code iPhone apps.

</comment><comment><USER5> Totally iOS. (1) Non-trivial Android development is much more difficult due to fragmentation and random bugs, (2) in AppStore, your chances of at least breaking even are way higher than in Google Play.</comment>


Hackers are using Apple's "Find My" service to remotely hold devices for ransom - <AUTHOR> https://www.macrumors.com/2017/09/20/hackers-find-my-iphone-remote-mac-lock/ <comment><USER2> If you directly access the "Find My" service in iCloud.com even if you have 2FA enabled and you even deny the access from another device where you are signed in, it just asks you to change you password but the session remain active...</comment>


A special app for "Tu Bishvat" - <AUTHOR> http://treenderapp.com <comment><AUTHOR> This is just a fun project I did with a friend of mine. It's a "dating" app to find your soul mate tree :) (No money, no ads, no affiliate links, no data collecting, just pure fun!)</comment>


Fuckit.py – The Python error steamroller - <AUTHOR> https://github.com/ajalt/fuckitpy <comment><USER2> From the test suite:

def test_context_manager(): with fuckit: pass

        assert 'P' != 'NP' # proof is left as an excercise for the reader

</comment><comment><USER3> From the implementation:

         try:
             [...]
         except IOError:
             # Worst-case scenario we can only catch errors at a granularity
             # of the whole function.
             [...]
         else:
             # If we have access to the source, we can silence errors on a
             # per-expression basis, which is "better".
             [...]

and then:

        def __exit__(self, exc_type, exc_value, traceback):
            # Returning True prevents the error from propagating. Don't silence
            # KeyboardInterrupt or SystemExit. We aren't monsters.

Brilliant.

</comment><comment><USER4> I've been searching for something similar I saw years ago. It was a python library that would remove "heretical" code or something like that. Any error would be "eradicated".

It was funny! There was a religious or medieval theme or something. I can never find it...

<comment><USER5> Vigil, the eternal morally vigilant programming language:

[https://github.com/munificent/vigil](https://github.com/munificent/vigil)

<comment><USER6> This needs SCM support added too it. After all, what use is it if its grand moral vision can be reversed by a simple git checkout?

</comment></comment></comment><comment><USER7> Works as advertised. I just added it to my project and now all tests are 100% passing! Even 1 == 0!

<comment><USER8> Well to be fair...

[http://lmgtfy.com/?q=zero+factorial](http://lmgtfy.com/?q=zero+factorial)

<comment><USER9> That took me a few seconds, well played.

</comment></comment></comment><comment><USER10> "This module is like violence: if it doesn't work, you just need more of it."

How could anyone not love this tool?

<comment><USER11> It's the Serious Sam of Python programming ... moar bullets

</comment></comment><comment><USER12> In my previous life I was maintaining some backend services. One of the most common reasons for a service dying was a typo in a name in some rarely visited code path. I was tempted to write a similar module that would be a little bit smarter: when some identifier (variable, method, etc.) was not found, instead of raising an exception, try to find a similarly named thing and use that instead. I never did find a good way of implementing that.

<comment><USER13> That's probably for the best.

<comment><USER14> Seriously, that's asking for unpredictable behavior. Maybe if it printed the suggestion to the logs and then failed it would be ok.

<comment><USER13> Yes, it's crazy. I saw a Python library a while ago that when would pip install any missing module, even if it's because of a typo. Crazy.

</comment></comment></comment></comment><comment><USER15> Looks to be inspired by fuckit.js:

[https://github.com/mattdiamond/fuckitjs](https://github.com/mattdiamond/fuckitjs)

So if you want the same thing but for JS give the above a shot.

<comment><USER16> JS doesn't really need an extra library for that, does it?

</comment></comment><comment><USER17> There's also this for your text conversion needs.

[http://bazaar.launchpad.net/~leonardr/beautifulsoup/bs4/view...](http://bazaar.launchpad.net/~leonardr/beautifulsoup/bs4/view/head:/bs4/dammit.py)

</comment><comment><USER18> Visual Basic has/had this and not as a joke. It was called "On Error Resume Next."

</comment><comment><USER19> previous discussion - [https://news.ycombinator.com/item?id=6858855](https://news.ycombinator.com/item?id=6858855)

<comment><USER20> There's debate in that thread whether this project is satire or not. I must admit it looks remarkably like satire, especially the test suite.

That said, I have met some developers who would find this as an advantage and might actually try to put it into use. Generally these are folks who prefer the default soldier-on-in-the-face-of-errors behavior from sh and perl.

<comment><USER21> > Generally these are folks who prefer the default soldier-on-in-the-face-of- > errors behavior from ... perl.

Nobody in the Perl world prefers that, outside of people who are complete newbies. In fact, collectively Perl has been yelling at newbies for decades that anything not containing `use strict;` and `use warnings;` is almost without fail broken code, mainly because there are a lot of very old and outdated tutorials which introduce these modules as optional and/or way too late.

<comment><USER20> > Nobody in the Perl world prefers that, outside of people who are complete > newbies

I think these are actually old-bies. They don't opt-in to `use strict;` because they like it that way. I suppose they just have an astonishingly high pain threshold.

<comment><USER21> To be clear here: You can be a perl newbie even after you've been writing Perl for decades. I know this because i sometimes see code like that in companies that don't value their employee education, or heck, their employee. Period. You'll have a guy who's been writing Perl for 15 years and never got past the small 500 word tutorial he once read back then. He may be old and have the years, but he's still a newbie since he doesn't know shit.

That said, i've never met these people outside of said companies and especially not on the internet and most decidedly not anywhere near any sort of perl community. They've all been strict 9-5ers for whom the coding is a burden to bear to pay the bills and nothing else.

The people who're old and in the community? They're on the same Kwalitee train as everyone else.

</comment></comment></comment></comment></comment><comment><USER22> Ah, this leads to some of my favourite python bugs. Silent failures because you are catching and ignoring an error in some higher calling function where the error type that was once designed to deal with a single case is now overly broad. I've almost given up using try/catch for KeyErrors as a result.

<comment><USER23> Python uses try/except, not try/catch. The only reason to catch KeyError is to detect missing keys, so if you are trying to do that, only wrap your dict access rather than wrapping large blocks of code where anything could happen. If you are writing code to ignore errors, that is a bug in your own code, not a python bug.

<comment><USER22> Yes. s/python bugs/bugs in my python code

</comment></comment></comment><comment><USER24> The license model is great.

<comment><USER25> Yup. The WTFPL is an actual, (semi)-recognized license used in other projects: [https://en.wikipedia.org/wiki/WTFPL](https://en.wikipedia.org/wiki/WTFPL)

<comment><USER26> It's not an OSI approved license, nor does it actually grant any rights. If you use the WTFPL then you are preventing others from legally using it.

<comment><USER25> Yeah, good to mention it here explicitly. The Wikipedia page linked above has a nice summary of its "compatibility":

      DFSG compatible   Yes
      FSF approved      Yes
      OSI approved      No
      GPL compatible    Yes
      Copyleft          No
      Linking from code with a different license  Yes

</comment></comment></comment></comment><comment><USER27> From last time around:

[https://news.ycombinator.com/item?id=6858855](https://news.ycombinator.com/item?id=6858855)

</comment><comment><USER28> The tests are gold

</comment><comment><USER29> I'm definitely going to use this thing!</comment>


Grandfather builds Web browser for autistic boy  - <AUTHOR> http://www.boston.com/news/nation/articles/2008/06/03/grandfather_builds_web_browser_for_autistic_boy/ <comment><USER2> This is truly awesome, though autism hasn't effect my family directly, the idea of open source solving a problem bigger than just hackers wanting more control of their software is great. When there isn't a market big enough for a commercial vendor to step in and build something, open source is the only viable alternative.

</comment><comment><USER3> To me, the most interesting part of the article was this:

 _LeSieur didn't create the browser by consulting with people who are considered experts in disorders on the autism spectrum. The small software company he runs, People CD Inc., essentially designed the Zac Browser to meet Zackary's needs, and figured that the approach would likely help other autistic children._

It seems to me that this was a questionable decision at best. It's great to design the product to meet his grandson's needs, if it is intended only for his grandson. However, if he wants it to be likely to help other autistic children, he really ought to be speaking to other domain experts in the field. There's no good reason, in my opinion, for cutting yourself off from the research.

</comment><comment><USER4> I think there are some lessons to be learned here for general users as well.

Just because the majority of people aren't on the autism spectrum doesn't mean that they should have to be subjected to distractions and confusing interfaces.

Sure, an interface for a six year old would be overly simplistic for the average user, but most of the tools out there fail remarkably in the other direction.

</comment><comment><USER5> I think ultimately, software like this makes for interesting stories, but little more. Kids like this need voice recognition, and multi-touch. Sugar Labs is doing great stuff, but I think that hardware and basic HCI paradigm shifts should be the focus.

</comment><comment><USER6> Is there a mirror for the software?

<comment><USER2> zacbrowser.com

</comment></comment><comment><USER7> :)</comment>


RIM CEO says company 'seriously' considered switch to Android - <AUTHOR> http://www.bgr.com/2012/08/03/rim-ceo-thorsten-heins-interview-android/ <comment><USER2> I don't quite get how he can still see BBM as a big differentiator. All its "unique" features are available on WhatsApp which is cross platform and growing rapidly (and also already has a huge userbase, especially outside the US). People also hate having to remember a 10(?) digit number for an IM service, WhatsApp solition with the phone number is very elegant</comment>


An Easy Way to Increase Creativity - <AUTHOR> http://www.scientificamerican.com/article.cfm?id=an-easy-way-to-increase-c

<comment><USER2> Previously submitted:

<http://news.ycombinator.com/item?id=716818></comment>


A Survey of Symbolic Execution Techniques (2018) - <AUTHOR> https://arxiv.org/abs/1610.00502 <comment><USER2> This is a solid paper if you want to learn something about SymbEx. If it _really_ interests you and you want something more tutorial oriented, pick up a copy of Practical Binary Analysis, out recently from nostarch. The last chapters are a tutorial intro to it using Triton. If you're a functional programmer and already know some Haskell or Ocaml or are able to pick it up quickly, check out BAP, the binary analysis platform, its got a bunch of tools/analysis built in already for this stuff and there's a fair amount of fascinating research done using or on the platform itself.

[https://practicalbinaryanalysis.com/](https://practicalbinaryanalysis.com/)

[https://github.com/BinaryAnalysisPlatform/bap](https://github.com/BinaryAnalysisPlatform/bap)

Cool fact about BAP, there's a really weird but very cool embedded lisp that allows you to drive execution of single instructions via meta programming. It works via a term rewriting system. Seriously one of the coolest lisps I've found out in the wild.

[http://binaryanalysisplatform.github.io/bap/api/master/Bap_p...](http://binaryanalysisplatform.github.io/bap/api/master/Bap_primus.Std.Primus.Lisp.html)

Also, the docs for the project are borderline decadent in their completeness and the team responsible are quite active via gitter. For real, if you're interested in binary analysis, check it out.

<comment><USER3> No offence intended I don't really see the value of this book WRT to this paper. The paper seems to be about HLLs where the book, great as it surely is, is 90% about, well, binaries.

Given that I won't have time to learn binary analysis (there's no payback for me), is it really worth getting the book just for the final chapter, which I presume is not going to cover HLLs anyway?

<comment><USER2> I mean, my comment was pretty straight forward as to the relation? The book has full, detailed code listings and provides a vm with runnable code, you end the book building an automatic exploitation engine for a C++ program, so it does cover HLLs? The binaries in the book are all C/C++ programs. I guess I don't really get the comment(no offense taken), given that techniques like symbex are used on binaries written in HLLs. The paper itself is a survey of the tradeoffs inherent in different implementations of symbex. So, if you want to get a sense of what symbex is, read the paper and follow up with some of the endnotes, if you want to build an application that actually uses symbex buy the book and work through it. Hope this helps!

</comment></comment></comment><comment><USER4> I'm curious, HN. Apart from Fujitsu, do any of you use Symbolic Execution in an Industrial setting or in your day-to-day job ? I'm starting to see fuzzing 'largely' adopted, and an uptick of interest in proof (see recent partnership between Nvidia and AdaCore on Spark2014 for firmware), but not much on Symbolic Execution ?

Apart from Trail of Bits, University Research teams, and automatic patching competitions ?

Anyone using cbmc, Klee, angr, s2e ?

<comment> jor-el I have come across many pentesting labs using these tools to deal with obfuscated binaries. You can check Quakslab's blog, they have articles on this [0]. Another interesting project is of cracking Tigress VM using Symbolic execution [1]. The use has dramatically increased in past few years as many new tools are available and also hardware is more performant now. I am also using these tools in my day-to-day job to deal with obfuscated binaries and reverse engineering. I use Miasm [2].

PS: My company is hiring for such roles [https://www.reddit.com/r/netsec/comments/b90hep/rnetsecs_q2_...](https://www.reddit.com/r/netsec/comments/b90hep/rnetsecs_q2_2019_information_security_hiring/ek374i0)

[0] [https://blog.quarkslab.com/deobfuscation-recovering-an- ollvm...](https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm- protected-program.html) [1] [https://blog.quarkslab.com/deobfuscation- recovering-an-ollvm...](https://blog.quarkslab.com/deobfuscation-recovering- an-ollvm-protected-program.html) [2] [https://github.com/cea- sec/miasm](https://github.com/cea-sec/miasm)

<comment><USER2> Yeah, this is it. Security firms specializing in static/dynamic analysis are going to be using this stuff. Vulnerability hunting, things like that.

<comment><USER5> Doing exactly that, and hiring: [https://news.ycombinator.com/item?id=19797601](https://news.ycombinator.com/item?id=19797601)

<comment><USER6> Funny that none of your posts mention that it's (I think) Raytheon. Do you think you get less responses if you mention it's a major defense contractor?

<comment><USER5> Multiple reasons:

Big companies are frequently composed of components with distinct culture, benefits, legal entity, and so on. People get to know one part, then assume that all parts are that way. I'm in a component with compensation that is better than average for the big company. The association isn't beneficial.

Using the big company name means adhering to corporate branding requirements. People could somehow imagine me to be issuing official corporate communications, which is far from the truth.

I might get more responses, but would I want them? We're fighting to keep out the toxic people who want to focus on politics. We have important work to do.

There is an absurd Glassdoor review out there. If that is to be believed, we pay highly experienced cleared specialists about as much as they'd make cooking food at In-N-Out or Chick-Fil-A. Our office would be empty if that were the pay being offered.

<comment><USER2> lol, fighting to keep out "toxic people" who "want to focus on politics" means you hire people cool with making weapons of war. I for one am glad the person who asked you that did so, because I _do not_ work for defense contractors, and I don't need to waste my time looking into a place that would filter out anyone with conscience.

<comment><USER5> That is a different sort of "toxic" and a different sort of "politics", but yeah we don't want that either. I was referring to the sort of people you'd find in Google or even HP, backstabbing and undermining to jockey for position in the corporate hierarchy.

People with a conscience can feel that it is wrong to devote their efforts to tracking people all across the internet to sell ads and other junk. (Facebook, Google, etc.) They can feel that it is important to support their country, and that it would be wrong to pass up a reasonable opportunity to do so. With a better conscience, you would feel guilty about how you benefit from the nation without contributing much, and of course you would stop supporting violent hate groups that pretend to be otherwise.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Is anyone here using Symbolic Execution for something _besides_ source code verification?

I'm attempting to use the technique right now in the context of writing an execution tracer for a bytecode VM runtime, where I want to "recover" ABI types for arbitrary bytecode (that I don't have the source to), in order to emit traces that describe what's going on in high-level terms (e.g. "foo[x][y].z = 3" rather than "$329f = ($329f & (~(1 << 32) << 8)) | (%r25 & 0xff)".)

So I'm doing a static-analysis pass of the bytecode (essentially a decompilation pass) which symbolically executes math ops to build up symbolic formulae representing the math being done, and to associate program-counter positions in the bytecode with value bindings in the formulae; and then I'm feeding those associations to the runtime tracer, so that it can notice when it's on an "interesting" PC position and feed its current register/stack value into an instance of the associated formula, for me to emit once I get all the bindings of the formula filled in.

So far I haven't found any texts or papers talking about using symbolic execution in this context (to recover information lost due to previous compilation, in a pass "within" a tracer, JIT, transpiler, or anything else that starts with bytecode or IR), which is kind of annoying. Anyone have any resources? Projects that use this technique? (I'm thinking that this is something you'd see done in sufficiently-advanced game-console emulators, as a "deoptimization" pass to recover structure to help dynamic recompilation optimize better.)

Also, related question: if I've got a stack machine, and _all_ the jumps in the ISA are indirect jumps (but with literal values pushed on the stack), is there any way to recover the edges between basic blocks _without_ doing a symbolic exec over the stack ops (i.e. to discover, among all the DUPs and SWAPs and such, which constant stack-slot the jump op is actually receiving)? I'm pretty sure there is a "weaker" method, but I'm stymied here by my lack of compiler-theory education; everything I google about dominance hierarchies and such assumes you're starting with a model of a register machine with direct jumps (where the edges are context-free extractable from the jump ops).

<comment><USER8> That's roughly how I do it for Eveem.org (Ethereum VM decompiler) - what you see there is essentially an output from the symbolic execution trace.

</comment></comment><comment><USER8> Oh oh, a room for a shameless plug! :)

I managed to use symbolic execution to build a smart contract decompiler - Eveem.org. What you see there is essentially a trace from a symbolic execution of an Ethereum contract, plus some postprocessing.

</comment><comment><USER9> "Sometimes you can't see how important something is in its moment, even if it seems kindof important. This is probably one of those times."

> Cyber Grand Challenge highlights from DEF CON 24, August 6, 2016

</comment><comment><USER10> > Soundness prevents false negatives, i.e., all possible unsafe inputs are > guaranteed to be found, while completeness prevents false positives, i.e., > input values deemed unsafe are actually unsafe.

I really dislike this definition. It is confusing and backwards from normal math/logic parlance.

<comment><USER11> Isn't this the normal definition for, say, type systems? A sound type system will never accept an invalid program (no false negatives) but may reject correct programs.

<comment><USER10> The problem is really this:

> all possible unsafe inputs are guaranteed to be found

A sound system can reject all programs and still be sound. Therefore, it does not follow that all possible unsafe inputs are guaranteed to be found.

In my view, focusing on program acceptance or rejection is not really helpful.

</comment></comment></comment><comment><USER3> Oh heck yes, this is interesting to me.

In part answer to touisteur, I don't use it and can't see myself ever using it in industry where it's just 'get stuff done' and if it's not too buggy it goes into production. Which is a real downer.</comment>