Monads for Java/C++ programmers - <AUTHOR> http://irekjozwiak.com/entry/2009/06/13/Monads-for-Java-C---programmers.html <comment><USER2> Ok well, in my free time, I was reading learnyouahaskell.com (Which, by the way, is pretty great but a bit slow-ish if you aren't new in the functional way of thinking).

And I was kind of anticipating monads since I keep hearing that they just blow your mind and are hard to understand. So, I was happy to read this article and found it quite good actually :) Good job to the author.

Here's how I can summarize it: monads are a kind of pattern which "implements" ">>=" and "return" as a Int implements "eq" or "ord". The job of >>= is to act a little bit like the Null Pointer pattern in the OO world. For instance, if everything is ok, it returns the good value else it throws an exception or return an error value. However, to use the >>= function, you need to encapsulate your first value. Depending of monads, that "encapsulated" value may be different. In this article, we were working with the Maybe type, however, monads can be of any type. So, the "return" function takes care of encapsulating the value in the right type so that the >>= function can use it.

Anyhow, that's what I understood ;-) And I'll continue to read learnyouhaskell.com

</comment><comment><USER3> I don't know, I read all these painful explanations of what monads are...combined with more stretches of the imagination to explain plausible uses for them. In the end, the authors achieve neither, with me.

I tend to write these off with "yeah, in my 20s and early 30s whilst in graduate Comp. Sci. schooling I enjoyed all this esoteric crap, too". :-)

<comment><USER4> This is mostly because the monad abstraction is mostly useless in non-lazy languages. It's more useful in lazy languages because objects with monadic types can then be written self-referentially without trouble. It also hurts that Java and C++ syntax is extremely specialized towards avoiding the use of abstractions.

<comment><USER5> C++ may be overly complex but it is in an entirely different league than Java in terms of syntactical abstractions that you can implement on top of it.

<comment><USER4> That's true. But there's still a syntactic cost and a cognitive cost to making useful abstractions that can be much less verbosely and more comfortably made in other languages. And I find myself going with less clean designs because of it.

<comment><USER5> I agree with that.

</comment></comment></comment></comment></comment><comment><USER6> Pft, dude whatever. This is HN. We don't want lame-o languages like Java, or boring monads like Maybe. We want crazy languages like JavaScript, and the mother of all monads, the continuation monad. Here's an equivalent to what's posted in this article, but more powerful, and in JavaScript:

        // Haskell typeclass equivalent is >>=
        // which has a signature of:
        // m a -> (a -> m b) -> m b
        // which in our case, is the more specific:
        // Cont a b -> (b -> Cont a c) -> Cont a c
        function bind(x, y) {
            return function(k, end) {
                return x(function(result) { return y(result)(k, end); }, end);
            }
        }

        // 'yes' can also serve as identity for this monad. Haskell monad typeclass
        // equivalent is 'return', not to be confused with JavaScript return. if
        // this were an applicative functor, we would call it 'pure' instead, even
        // though it does the same thing.
        // b -> Cont a b
        function yes(x) {
            return function(k, end) { return k(x); };
        }

        // bail out.
        // a -> Cont a b
        function no(x) {
            return function(k, end) { return end(x); };
        }

        // look up a user ID from a name string, in the context of a continuation
        // monad. our type signature for this in Haskell would be:
        // String -> Cont String UserId
        // or something.
        // 'UserId' would be a newtype wrapper around Integer, to prevent
        // accidentally conflating it with account balance or another numeric type.
        function userid_from_name(person_name) {
            switch (person_name) {
                case "Irek": return yes(1); // we have three user names in our system
                case "John": return yes(2);
                case "Alex": return yes(3);
                case "Nick": return yes(1); // Nick is on the same acct as Irek
                default: return no("No account associated with name " + person_name);
            }
        }

        // UserId -> Cont String Balance
        // 'Balance' would also be a wrapper around Integer type
        function balance_from_userid(userid) {
            switch (userid) {
                case 1: return yes(1000000); // some amounts for a couple of accounts
                case 2: return yes(75000);
                default: return no("No balance associated with account #" + userid);
            }
        }

        // Balance -> Cont String Balance
        // we could do something fancier here if we liked, like pass the difference
        // between the minimum required balance for a loan and the actual balance.
        function balance_qualifies_for_loan(balance) {
            if (balance > 200000) return yes(balance);
            else return no("Insufficient funds for loan, current balance is " + balance);
        }

        // tada. put it all together.
        // String -> String
        function name_qualifies_for_loan(person_name) {
            return bind(bind(userid_from_name(person_name), balance_from_userid),
                        balance_qualifies_for_loan)(
                function(x) { return "This person qualifies for a loan. Their \
                                      account has a balance of: " + x; },
                function(x) { return "Do not issue loan, reason given: " + x; }
            );
        }

Test some output:

        > name_qualifies_for_loan("Irek");
        "This person qualifies for a loan. Their account has a balance of:
        1000000"

        > name_qualifies_for_loan("John");
        "Do not issue loan, reason given: Insufficient funds for loan, current
        balance is 75000"

        > name_qualifies_for_loan("Alex");
        "Do not issue loan, reason given: No balance associated with account #3"

        > name_qualifies_for_loan("Nick");
        "This person qualifies for a loan. Their account has a balance of:
        1000000"

        > name_qualifies_for_loan("Foo");
        "Do not issue loan, reason given: No account associated with name Foo"

Pure functional. Holler at a player.

<comment><USER7> This example actually looks a bit contrived... If your language supports exceptions, but doesn't support nice syntax for monads (i.e. you still have to write all the levels with bind and parentheses), why not simply throw() on error? I guess you would normally write something to support function like _bindl(person_name, [userid_from_name, balance_from_userid, balance_qualifies_for_loan])_ anyways... but that's still not that nice.

The call becomes simpler: _balance_qualifies_for_loan(balance_from_userid(userid_from_name(person_name)))_ , as well as functions which just return the value or throw.

<comment><USER6> You are critiquing this as if I were suggesting people use it in production JavaScript code, which I'm not. It's a demonstration. Did you read the original article? It has an example that's even more contrived (and also incomplete.) You aren't even pointing out the biggest reason not to use monads in JavaScript (no hints, sorry!)

I'm going to go eat a burrito now.

<comment><USER7> Ok - I guess I deserved a big WHOOOOSH. I actually thought you were being serious.

<comment><USER6> All good :)

Implementing exceptions with the continuation monad is straightforward. As you can see, that's sort of how it's used here. You can also recreate the State monad, Maybe, and others, deriving each from the continuation monad. I don't recommend this for actual use in JS, because JS lacks tail call optimization, which means any serious use of monads will cause stack overflows straight away.

But it gets crazier: you can implement the continuation monad using JavaScript exceptions. And JavaScript exceptions _do_ cause the stack to reset (with a performance penalty). So if you derive a continuation monad in JS from its built-in exceptions mechanism, you can implement the other monads without breaking the stack.

<comment><USER8> You can also implement them with a setTimeout(0), which gives the browser's event loop a chance to run so that you don't lock up the browser forever. I did something like this with ArcLite, resetting the stack with a setTimeout(0) after ever top-level definition was parsed, so that it didn't take 30 seconds of unresponsive browser for the standard library to load. It occurred to me afterwards that I could've used this to implement continuations, but by then I was pretty much done with Arc development.

<comment><USER6> This has actually been done, in Inria's HOP project with Scheme->JS</comment></comment></comment></comment></comment></comment></comment>


Ask HN: If you could start from scratch, would you still use LAMP? - <AUTHOR>

I have a bit of time and a bit of financing (enough to give me a "runway", not enough to say "fuck you").
Now I want to explore some ideas from more than ten years ago that have been made possible with things like the iPhone, iPad, and their derivatives. I imagine a fancy-looking front-end, probably starting with the iPad, connected to some database/business operations on the back-end, for small businesses in a certain industry. I've thought about a native iPad app for the front-end but figure it'd be both safer and cheaper to build a web app instead. Also, if someone wants to run the front-end on an Android device, I want this to be easy to arrange.
What toolset at the back-end would you recommend for someone who can start with zero legacy code? I am aware that you throw the first version away and then rebuild anyway, still I'd like to use the "right", future-proof technologies from the get-go.
So for the front-end, I suppose there's the holy trinity of HTML, CSS, and JavaScript; but for the back-end? Is LAMP still in use/the way to go, or should I invest in something else? <comment><USER2> Okay, so you want to build a web application. I think you are making this more complicated than it needs to be.

You don't need to get too exotic. While these choices are important, they shouldn't be a point of paralysis. You wouldn't be making a bad decision to go the route of Python or Ruby on the Lamp side. Otherwise you could look at .NET, but that's not an area I know a lot about.

Perhaps your best bet is to find your technical cofounder and let this person make the decision based on his/her strengths.

<comment><AUTHOR> So you're saying the back-end is still basically the same as it was a few years ago and stable?

<comment><USER2> You would be standing on the shoulders of giants. Just do a bit of research to see what other big players on the net are running on. Lots of Python, Ruby and PHP. You won't find as many people suggest PHP, but much of Facebook runs on PHP (though this is a case where the company now wishes it could have a "do over" on that one.)

</comment></comment></comment><comment><USER3> Personally, I would make the P Python and not PHP. I really do not like working in the latter.

The thing about it, with the new development model of abstracting the UI away from the server and writing it in the trinity (I love that and am going to steal it). The back end choice becomes less important. Say you start writing services in PHP and decide later that "yeah this thing is a tar ball", you can just write your next service in Python or Java or Ruby or whatever. Sure you still have to maintain the old ones and possibly port them to your new language of choice, but what you don't have to do it port over an entire server side UI layer which has traditionally been a difficult proposition. They are riddled with proprietary idioms that don't one for one translate to a different languages web framework.

</comment><comment><USER4> LAMP is definitely still the way to go.

In my office Perl is the P, and we use the Catalyst framework on top of it.

With these frameworks most of them use the MVC pattern. This allows for you to easily jack in different front ends or "Views". At my job we use e-mail, JSON, XML, and templated HTML(Template Toolkit) Views.

[http://en.wikipedia.org/wiki/Model%E2%80%93View%E2%80%93Cont...](http://en.wikipedia.org/wiki/Model%E2%80%93View%E2%80%93Controller) <http://en.wikipedia.org/wiki/Catalyst_%28software%29> <http://perl.org>

</comment><comment><USER5> I have used PHP in a multi year project, and I think that PHP is just plain godawful.

I am happy to use [LB]A[MP]P where [LB] is Linux or BSD (BSD preferred), [MP] is MySQL or PostgreSQL (mostly PostgreSQL preferred) and the final 'P' can either (1) fall back to Perl or (2) spring forward to Python.

I have used Rails and Rails is fun but I am not convinced that they have emerged from scaling purgatory yet.

</comment><comment><USER6> Not only should you roll with LAMP, but you should get yourself a framework, too. The top comment in this thread from about a year ago says it all, particularly the first bullet point: <http://news.ycombinator.com/item?id=773447>

<comment><USER6> Actually, I should amend this in the interest of not being a hypocrite, seeing as I'm building out a side project right now on top of Cassandra, which is arguably much slower to get out of the gate with than SQL. But in this case I know from the get-go that I'm going to have massive data on my hands and that I'd have to be sharding a SQL implementation almost immediately, so in the long run it's worth the outlay now.

Otherwise, as much as I'd love to toy around with node.js or Tornado or some such, I've got no good excuse and I'm sticking with Django because a.) I'm already familiar with it, b.) batteries are included, and c.) I can move very quickly with it.

</comment></comment><comment><USER7> I agree with most of the posts here.

For me, while PHP isn't the most exciting technology right now...it works. I have wanted to master Ruby and Python for some time now. However, I am still pretty much a novice in them. I use them here and there for non critical scripts in hopes that I will be proficient enough in them to use as a go to language.

Until then I have to use PHP in which I can write really elegant code really fast.</comment>


Four MLs and a Python (2015) - <AUTHOR> https://thebreakfastpost.com/2015/04/22/four-mls-and-a-python/ <comment><USER2> I'm really grateful for this guy's posts. It can be a nightmare figuring out how compilation works across different MLs. I just ported my Ponyo library for Standard ML to support MLton and his guides were a great aid. Keep up the good work!

<comment><USER3> Thank you!

Did you notice this one? [https://thebreakfastpost.com/2016/06/11/naming- conventions-i...](https://thebreakfastpost.com/2016/06/11/naming-conventions- in-standard-ml/) It's definitely a bikeshed moment, but I had meant to drop you a line to ask you why you chose This_Sort_Of_Naming for structures in Ponyo. It seemed a bit of an outlier.

I'm delighted to see you're still doing bits of work on Ponyo. I have a pleasant pipe-dream that, while frameworks and libraries for other languages rot because of language evolution, decades of random tiny personal SML library projects - written for a somehow still-modern language that never changes - eventually turn out to constitute a genuinely sound basis for new development work.

<comment><USER2> Ha! It's funny (and great!) to be featured there. The particulars of the naming convention are pure preference I suppose (and I recently simplified the naming of files [perhaps to the detriment of convention?]). I'm still trying to figure out proper naming conventions though and I'm not completely consistent. This makes the automated documentation generation I've tried to put in place hard...

Anyway I'd like to point out that the namespacing exists at all because all structures in Standard ML are global by default. Some implementations have compilation managers that allow you to hide certain exports but Poly/ML does not. In general, if I define a String structure, I just overwrote the Basis String structure. (Ponyo exports a Basis structure up front that exports all overwritten Basis structures so you always have a way back). You could always overwrite these yourself, but _Ponyo_ itself prefixes all structures with their path for pseudo namespacing. But Ponyo also exposes them in a hierarchy for ease of use (the Ponyo structure embeds the Net structure which embeds the Http structure, etc.). But the original named structures are still accessible too. The worst part is signatures and functors. In the Standard ML standard, functors and signatures cannot exist inside of structures. This is a pain in the butt... And some non-standard extensions exist to support this (at least in SML/NJ maybe also in MLton). So in those cases you must ignore the structure access convention (Ponyo.Net.Http...) and use the full real name (Ponyo_Container_Dict). So in the worst case it's C-like (with only string/prefix "namespaces") and in the best case you can access and make shortcuts to intermediate structures (structure H = Ponyo.Net.Http).

<comment><USER3> Yes, it's disappointing that you can't just open a structure to wrap an entire other SML library or program. SML's module mechanism is usually very tidy but it has its awkward aspects, a pity for an otherwise so elegant language.

</comment></comment></comment></comment><comment><USER4>
      (ns fourmls.core
        (:gen-class))

      (defn csv-line-to-doubles
        [line]
        (map #(Double. %)
             (clojure.string/split line #",")))

      (defn barf-if-different-lengths
        [s1 s2]
        (if (not= (count s1)
                  (count s2))
          (throw (Exception. "Mismatched lengths"))
          s2))

      (defn sum-csv-lines
        [prev curr]
        (if (nil? prev)
          (csv-line-to-doubles curr)
          (->> curr
               csv-line-to-doubles
               (barf-if-different-lengths prev)
               (interleave prev)
               (partition 2)
               (map (partial apply +)))))

      (defn -main
        "I don't do a whole lot ... yet."
        [filename]
        (println
         (clojure.string/join
          ","
          (map str
               (reduce sum-csv-lines
                       nil
                       (->> filename
                            clojure.java.io/reader
                            line-seq))))))

<comment><USER5> Very nice.

Perhaps using (partition 2 1 _) could be a clearer way to view the prev line instead of the reduce on a nil?

</comment></comment><comment><USER6> This article doesn't talk at all about safety, which is one gigantic advantage modern statically typed languages have over traditional dynamically typed ones.

It also doesn't talk at all about the pain of having to wrestle with the compiler in statically typed languages in order to get the damn thing to compile, nor with having to deal with inscrutable error messages that sometimes need years of type theory courses under your belt to understand.

<comment><USER7> Discussing "safety" isn't safe unless you properly define your terms. That is, otherwise, you don't know what type of "safe" people will interpret your words to mean.

(Sorry, tongue got stuck in my cheek.)

Of course, you probably mean type-safety? For example, if you try to add an integer and a string in Python you'll get a TypeError.

Hindley Milner proves that we can infer the most general type of a program. I wonder if your concerns about safety are misplaced, but then I think of languages where one _can_ add 1 and '1' and then I think you've certainly got a point.

<comment><USER8> php for example(?)

type casting there always seems horrible

</comment></comment></comment><comment> a-nikolaev A probably better OCaml implementation:

[https://gist.githubusercontent.com/a-nikolaev/b6fb099ebb28d7...](https://gist.githubusercontent.com/a-nikolaev/b6fb099ebb28d7f58e71e51981960920/raw/244d73198fdd7f2db7db2d3f359e746763275742/sumup.ml)

With similar improvements to the solution posted in the article's comments, tail recursive, and no need for regular expressions. Works about 15% faster.

</comment><comment><USER9> I did a similar comparison of expression evaluation in C, C++, Haskell, OCaml, Go and Python. Oh Java too:

[https://gist.github.com/maedoc/cfd893b8fed9ee57f1d3](https://gist.github.com/maedoc/cfd893b8fed9ee57f1d3)

I enjoy these kind of comparisons more for the Rosetta Stone aspect than benchmarks, but I can't say they'd be useful for a real world project language choice.

</comment><comment><USER10> > That's Python 3. Python 2 was about a second faster.

Of course it was.</comment>


key++ the programming language they don't want you to use #WETHEBEST - <AUTHOR> https://github.com/rrshaban/keyplusplus <comment><USER2> Isn't the best way to print for success Tweeting?</comment>


Can Facebook really make ads unblockable? - <AUTHOR> https://freedom-to-tinker.com/blog/randomwalker/can-facebook-really-make-ads-unblockable/ <comment><USER3> One thing I find annoying about their rhetoric is this rationalization that people want advertising to teach them about new interests and things they might be interested in. People do want to learn more about what they're interested in, but I can't think of a less honest source than an advertiser.

I'll grant that targeted advertising is better than untargeted advertising, but no advertising is still strongly preferred (I'd even pay a couple bucks a month for it). This is why tons of users use adblockers - it's just a better experience.

I understand advertising is what funds Facebook and I get why they care about it, but don't also try and tell me why advertising is something the users _want_. Users don't want it and the experience would be better without it (and without all the tons of engineers dedicated to making it better instead of working on the core product).

<comment><USER4> > People do want to learn more about what they're interested in, but I can't > think of a less honest source than an advertiser.

The opposite side of this is people that think ads are the worst things ever. I really don't understand what the big deal is. It's not like a random ad is going to brainwash me into buying something I never wanted in the first place. Ads being too distracting (e.g. flashing, videos) and a malware source is a different story though.

<comment><USER5> > It's not like a random ad is going to brainwash me into buying something I > never wanted in the first place

Absolutely they do, that's their entire purpose. It has various names such as 'acquired need', a prime example that gained universal acceptance being fabric conditioner.

Sugared water is another prime example, I'm sure you can name some brands and mentally picture their bottles lying in a bed of ice cubes.

<comment><USER6> You are right that this is there intention, but it is not always the effect. Think about SPAM. Have you ever fallen for any of those emails?

<comment><USER7> People fall for them _all the time._ Most of the more poorly worded ones are actually trying to filter out intelligent users, since they will end up being a waste of the spammer's time.

<comment><USER6> Yes, some people do. That doesn't mean that everyone does, which was the point that seanwilson was making.

</comment></comment></comment></comment></comment></comment><comment><USER8> And meanwhile Axel Springer won an interim injunction to have Eyeo (makers of Adblock Plus) stop accidentally filtering tweets and other live content on their "news" sites. Ignoring Eyeo's whitelisting business model for a moment, Eyeo's laywers are right in explaining that the filters accidentally block non-ads because sites deliberately make the actual content fit into ads' patterns, which then requires updated filters.

The interesting part is that Axel Springer's lawyers argue that filtering content undermines freedom of press. IANAL, but that's like saying if I put headphones on because I don't want to hear the public radio at a train station, then I'm filtering content and restricting freedom of press. The judge accepted the argument, but it doesn't make sense logically and goes against another pillar of contemporary societies: informational self- determination. If we don't fight this, we might actually end up in a world as depicted in that one Black Mirror episode[1].

Sorry, couldn't find anything in English: [http://www.heise.de/newsticker/meldung/Adblock-Plus-Axel- Spr...](http://www.heise.de/newsticker/meldung/Adblock-Plus-Axel-Springer- erwirkt-Einstweilige-Verfuegung-wegen-Overblocking-3294993.html)

[1] [https://en.wikipedia.org/wiki/Fifteen_Million_Merits](https://en.wikipedia.org/wiki/Fifteen_Million_Merits)

<comment><USER9> I mean, I'm going out of my way to try to stop my computer from running code I don't like. (In this case, advertising and tracking code.) There are tonnes of alternatives I could try, but I think the easiest way for me to block Facebook ads is just to stop visiting Facebook.

Ads are more than just annoying. They take away my valuable time and resources. I don't care what business model you think I'm destroying, my attention is mine and mine alone, and I will not have it wrenched away from me by dancing bottles of soap accompanied by the whir of my computers fans as it struggles to play yet another poorly coded flash applet. (I realize Facebook ads very rarely use flash, but they are still distracting in the worst way.)

Facebook can try to do a lot of things here, but they can never win my trust back after all these years, and I consequently refuse to trust their advertising platform more than any other. It's an intruder into my system, I will not allow it to run, and they may kindly deal with it and move on. I run my life ad free, I stopped watching television for similar reasons because I didn't feel like paying money for a service that seemed engineered to waste my time with product placement. If your business model does not agree with my preferences, too bad. I'm still not letting you run your code on my computer.

<comment><USER8> I don't go to the movies anymore. You have to sit through ads in the beginning, then they pause to sell snacks, and all the while you have to cope with people's disruptions. On top of that, you cannot temporarily enable subtitles or seek back to rewatch a moment. And let's not forget how expensive it is for a single showing. I suppose if you treat it like a real theater or a concert, then it's fine, but it's not comparable to watching a movie yourself or with two friends.

<comment><USER10> That's why I like living in a (relatively) large city. Here we have enough audience to sustain a couple of "weirder" theaters without concessions, ads or interruptions which show older and/or more independent films.

</comment></comment></comment></comment><comment><USER11> Very interesting! I had earlier proposed[1] that FB would have to start this arms race, of making ads that look different to human users, but not to computers.

The article points out that FB seems to be in a losing position since they need their ads to say "suggested post" and give those posts special options -- so ad blockers can always just look for that.

I think they can be a little more devious though -- say, make the CSS really complex so that the letters for "suggested post" only appear in the right positions for legit adds, and then have it load the options for the element from somewhere else. But that comes with a major code-complexity/debugging cost.

[1] [https://news.ycombinator.com/item?id=12255612](https://news.ycombinator.com/item?id=12255612)

<comment><USER12> Even that is a losing battle, as you would then just identify the class(es) that result in the 'correct' position of letters.

Ultimately it is an unwinnable battle, but one they can fight as long as they want.

<comment><USER13> I disagree. I don't see how it can be unwinnable.

Even if it were an endless game of whack-a-mole, _free adblock plugins_ don't have a fraction of the resources of Facebook.

Publishers became greedy, ads became intrusive, and users reacted by flocking to adblockers.

Now the users have taken it too far and publishers are forced to respond.

No one is owed an ad-free experience.

<comment><USER12> The cost to deliver 'unblocked' ads is exponentially more expensive than the cost to block ads. Ads also have to be properly identified to avoid CAN-SPAM issues, so unless they ignore those laws, it will always be relatively 'easy' to programmatically identify ads.

</comment></comment></comment></comment><comment><USER14> I'd be happy if all ads became served from the same domain, an integral part of the page (no popovers, popups, focus stealers, etc) and not-dynamic. That would remove 90% of my objections to them.

Third party ads with javascript can and have been used to introduce malware, through deception or zero-day/drive-by exploits, even on otherwise reputable sites. It is for that reason that I block ads.

<comment><USER15> I now whitelist javascript and use an adblocker after being hit by a drive-by javascript exploit that installed a bitcoin miner.

After taking these precautions, I haven't had an issue with malware since.

</comment></comment><comment><USER16> IMO it's certainly possible to make ads unblockable. Right now they just aren't trying very hard. It's all about the footprints. This article claims that laws requiring ads to be marked as such would preclude them from removing these footprints, but that isn't necessarily true. For example, Facebook could have two images of identical size, one that says the word "sponsored" and one that is blank, stored on their servers. Every post - sponsored or not - <USER2> reference the image like "/image.png?postid=123" and the server would decide based on the post ID which image to actually serve. Unless adblockers could implement machine vision, they wouldn't be able to distinguish this.

Facebook could also go the hostile route - when they detect an ad blocker, just display a blank overlay saying that you can't use Facebook with an ad blocker enabled. Ads are here to stay.

<comment><USER12> I believe this would violate ease-of-access rules - screen readers would have to be able to tell a user, so if an image is used, the alt/title tag would be set to 'sponsored'.

<comment><USER16> I suppose, but that's not a legal issue, that's a usability issue. There's no law that says I have to use alt/title tags.

<comment><USER7> The ADA might want to disagree with you:

"The Department is currently developing regulations specifically addressing the accessibility of goods and services offered via the web by entities covered by the ADA. The fact that the regulatory process is not yet complete in no way indicates that web services are not already covered by title III." — Statement of Interest of the United States Department of Justice in NAD v. Netflix (page 10)

<comment><USER16> _> by entities covered by the ADA_

Is Facebook covered by the ADA? I can't imagine that they are, as it is not an essential service. According to [1]:

 _" The Americans with Disabilities Act (ADA) and, if the government entities receive federal funding, the Rehabilitation Act of 1973 generally require that state and local governments provide qualified individuals with disabilities equal access to their programs, services, or activities unless doing so would fundamentally alter the nature of their programs, services, or activities or would impose an undue burden"._

But that has _nothing_ to do with private organizations that are not receiving federal funding or providing access to government funded services.

[1] [https://www.ada.gov/pcatoolkit/chap5toolkit.htm](https://www.ada.gov/pcatoolkit/chap5toolkit.htm)

<comment><USER7> You may notice that the quote in my original post is from the DoJ to _Netflix_. If Netflix is subject, why wouldn't Facebook be?

The ADA also applies to privately owned stores as well, so there is certainly precedent. Ever wonder why your office building has a certain number of handicapped parking spots in its parking lot? The ADA is why.

<comment><USER16> What you're referring to is not a court ruling, but rather an opinion letter penned by the DOJ in a case to which it was not even a party. It holds _no_ legal weight.

<comment><USER7> That courts are current split on whether it applies or not indicates that there is some weight to the DOJ's opinion. That Netflix decided to ultimately settle instead of forcing the issue does not speak well of their confidence in succeeding (or their willingness to bear the costs of getting to a decision).

However it ends up finally playing out in the courts, if Facebook were to fail to properly label sponsored content in tags, you can bet someone will take them to court over it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Can King Cnut turn back the tide?

If your users rebel against your business model, it's a brave (foolish? short- term?) business decision to fight your users.

Fine for companies who can only generate value from a user by ads (don't like ads? Goodbye, good riddance), but FB gets immeasurable value from network effects and user data. An interesting strategy, then.

</comment><comment><USER18> I bet they won't get around my advanced uBlock filter:

facebook.com

</comment><comment><USER19> It could be feasible to circumvent this "attack" by drawing posts and ads in canvas elements.

But then again, the blocker could "look at the pixels".

Basically, if a human can tell the difference, a piece of software will eventually be able too.

With DRM we had the "if you can see it, you can copy" law. Here might apply the corollary "If you can tell it apart, you can filter it out".

<comment><USER12> It wouldn't even need to 'look at the pixels', it would only have to identify the appropriate canvas elements.

<comment><USER19> I was thinking of canvas elements with no differences between them. Same size, same properties, random id.

In such scenario you'd have to "look at the pixels". The contents are programatically rendered and they're not subject to DOM inspecting.

<comment><USER12> If it became prevalent enough, then theoretically you could update the *block extensions to identify the javascript (or libraries) that are used to render the ads and nullify them.

My guess is that actually implementing this kind of thing would not be worth the cost.

</comment></comment></comment></comment><comment><USER20> It's a very contraditory move to bet high in AI and block-Adblock tech at the same time.

<comment><USER12> I get the feeling that the future-business side of Facebook and the in-app advertising side of Facebook are not very connected.

<comment><USER20> And this is a huge business opportunity.

</comment></comment></comment><comment><USER21> One day, a company is going to find a way to disrupt ads, as in creating a viable way for websites and mobile apps to easily make money from free products that doesn't involve inserting ads, and it will usher in the next Web X.0

<comment><USER22> I wouldn't quite hold my breath on that one. Anything like that is going to have to both get users to open their wallets, and do so at a rate which matches or exceeds the current levels of revenue gained by ads.

The closest thing we have now might be Patreon, and while it's successful for solo artists and small groups, I doubt a Patreon like model is going to be funding the New York Times.

</comment></comment><comment><USER23> I really don't have an issue with ads, I have a problem with shitty ads. If Facebook put a quarter of those adblock blocking resources into getting appropriate ads, none of this would be an issue. That goes for the rest of the internet. People use adblockers because it's completely intrusive and awful to see.

<comment><USER24> The latest rash of them have been grotesque "one weird trick" type ones. I'm not sure why they're even selling spots to whatever idiots are making these, because it's undoubtedly driving users away and pushing people to install ad blockers to not look at that nasty garbage.

<comment><USER23> Because they are probably making more money accepting them, than they are losing money from getting blocked.

</comment></comment></comment><comment><USER25> > Can Facebook really make ads unblockable?

Of course they can. It's called product placement.

</comment><comment><USER26> anyone can make ads unblockable, just host them yourself and don't use a lot of javascipt

<comment><USER27> That will only be unblockable until someone submits a filter for it, and then every ad blocker will block it.

<comment><USER28> Not only that, but that exact example is already blocked by default in Easylist by this rule:

Static filter /ads/ad. found in: EasyList</comment></comment></comment>


Scaling Mobile Messaging at Airbnb - <AUTHOR> https://medium.com/airbnb-engineering/messaging-sync-scaling-mobile-messaging-at-airbnb-659142036f06 <comment><USER2> This might be the first use of "turn of the century" that I've seen relating to 2k – it's wonderful, thanks :)

</comment><comment><USER3> This is the sort of thing that came to mind around the recent Twilio stock price drop driven by Uber's decreased use.

The whole article is about mobile messaging, but SMS isn't involved at all. I understand Airbnb does use SMS, but apparently only for specific use cases.

It's a bid sad, I think, that SMS is being displaced by either in-app messaging services or brand aggregated things like FB messenger. SMS has the advantage that if I don't like my mobile network, I could change providers and not change my address. The whole messaging space is now set to be highly fragmented.

<comment><USER4> "SMS has the advantage that if I don't like my mobile network, I could change providers and not change my address."

Only if you live somewhere number porting is possible. I live in China, where it is not.

If I switch carriers, I'll have to switch phone numbers, but luckily iMessage, WeChat etc. can be carried to my new phone.

<comment><USER5> WhatsApp is dongled to ones phone number. Changing the phone number means loosing your WhatsApp account.

Whereas WeChat, iMessage and others aren't dongled to a phone number.

How do the WhatsApp users change their workplace? Do you use your private phone (BYOD)? Or otherwise you are screwed, right(?), when you switch the workplace, you loose your work cell phone number, and your WhatsApp account. Or is there a way to mitigate this?

<comment><USER4> You can migrate to a new phone number (and keep settings, contacts etc.) but your contacts need to save your new number in their phones. So not seamless like WeChat. iMessage May Ni be straightforward depending on which address you set as your default outgoing address, I use my personal email address, but many people use their phone numbers.

<comment><USER6> This is not accurate. I move countries a lot and change SIMs (and by extension, phone numbers) and the only time recipients note a number change is when I change handsets. As far as I can tell, new phone numbers are stacked upon the existing user ID which is ostensibly based on the handset (likely the IMEI) and nothing much changes to the recipient until that combination is broken.

Weechat's implementation circa last July left a lot to be desired as it couldn't even federate on its own network - messages I received on my iPad were not present on my Android! Perhaps they've addressed this since but (not to be deliberately contrarian) seamless is far from the adjective I'd use; indeed they seemed miles behind their Western contemporaries and more in the league of Line (another large Chinese messenger application for those unfamiliar). I understand they have a huge Asian user-base so there's presumably a gravity factor, but it certainly didn't seem like they had it together at all.

<comment><USER4> Are you talking about using temporary SIMs when traveling? In that case there's no need to go through the phone number change process.

If you are permanently changing your phone number, and want new people to be able to send you messages, then I think you need to follow the process here: [https://www.whatsapp.com/faq/en/android/27585377](https://www.whatsapp.com/faq/en/android/27585377)

</comment></comment></comment></comment></comment></comment><comment><USER7> Nice read. This is something we wanted to solve for our mobile applications too but we don't get enough traffic (per article, you guys are ~100k msgs/hr) to justify the engineering time required for this.

I don't use Airbnb as often as I should but I'm wondering do you guys have data on the users who simply use text messaging on the mobile devices (or other instant messengers?).

What led to the decision to spend time optimizing mobile messaging within the Airbnb app than just finding an easier path to connect users through text messaging?

<comment><USER8> What did you end up using ? Have you heard of Layer?

<comment><USER7> Thanks for the tip, and I'll be sure to mention Layer as a solution if/when we tackle this problem in the future. I just checked their site and it looks very promising.

After trying to find a solution earlier this year with my product manager, we decided to just stick to what we had (which was simply manual refresh in the messaging view by the user), due to engineering time/cost.

Since messaging is not a top priority in the app, we agreed to come back to the problem in the future. However, it is absolutely something I would like to solve given the chance. However, at the end of the day, this kind of messaging solution requires the work of backend engineers which will take up development time.

</comment></comment></comment><comment><USER9> How is the latency when the app is open and waiting to receive a reply?

From one of the diagrams it sounds like the API requests a delta update if it receives a push notification, but if the user has disabled push notifications, will the client still know to request an update? Also receiving a notification and then using a new connection to request an update is still slower than something like a web socket/long poll connection where new updates are immediately pushed to clients. Would love to hear how this works.

</comment><comment><USER10> I've only skimmed the article (as of yet), but how is this superior/better than just a dedicated server plus DB for messaging with a simple READ(all), REPLY(to_message) API?

This seems like an interesting technical problem, but I can't help but feel that there's a significantly easier solution available. As a bonus: other than the fact that you can see messages in the app, I wonder how this is better than simply using SMS or a personalized anonymous email address per host-guest pair.

I've seen variants of this particular problem solved so often I'm surprised there's no open source back-end/platform that solves the back-end piece of this.

disclaimer: I haven't worked with anything on this scale, personally.

<comment><USER11> Sending an SMS costs money, and for many users email isn't as reliably seen as something like an app push notification.

<comment><USER10> I was referring to what huangc10 suggested with letting users communicate "offline" via SMS. I'm also skeptical that email is less reliable than an app push notification. The post itself even suggests that before they made adjustments to their messaging system there were some unreliability. I'd think that the use of email in the way outlined in the post is a pretty "solved problem".

</comment></comment></comment><comment><USER5> What monitoring solution do you use these days? You were one of the early NR adopters, but the graph looks like DG. (In case you can share this info.)

<comment><USER12> Engineer at Airbnb, but unrelated to this launch.

We use both products extensively internally; datadog for custom metrics deployed next to features and alerts in code ([https://github.com/airbnb/interferon](https://github.com/airbnb/interferon)), and New Relic for opinionated application health/performance and client side monitoring.

Two talks we've done about our usage of Datadog and New Relic (respectively):

[https://www.youtube.com/watch?v=MYmVu_IMC20](https://www.youtube.com/watch?v=MYmVu_IMC20) [https://www.youtube.com/watch?v=fd_Kla4f86E](https://www.youtube.com/watch?v=fd_Kla4f86E)

Disclaimer: I'm the presenter in the second talk.

</comment></comment><comment><USER13> scaling (x) at (x)....snore......

<comment><USER11> Is this comment really necessary? What's wrong with companies writing articles about how they solved a complex problem?</comment></comment>


Map reduce and MongoDB - <AUTHOR> http://blog.boxedice.com/2010/06/21/map-reduce-and-mongodb/

<comment><USER2> At the start of the OP the author says that he has not seen any other language docs that are as good as the PHP ones. I have to disagree with that. The docs are fairly good, but they're not great. And they're not exactly easily portable.

Using RI and RDOC for Ruby projects has opened _my_ eyes to what great documentation is...</comment>


Ask HN: If you had to pick one of these Locations to hire remotely from? - <AUTHOR> As a Non-U.S. Remote Company, which of those 3 countries you've seen most success with and you would recommend to hire from for our software openings and why (cons, pros)?
1. U.S. (Limited to Texas & Boston) 2. Spain
3. Argentina
Would really appreciate your help. <comment><USER2> What timezone are you in, what is your native language, and what is your culture? In that order.

In my experience those are the biggest factors.

I find it hard to work with India because they are about 12 hours different from me, thus we are never in the office at the same time unless someone makes an effort to come in when they are normally sleeping. Working with Germany is almost as bad, we only get a couple hours in the early morning (our time) when we can catch them in the office.

When you share a native language communication is easier. (though be careful every once in a while some expression takes a different meaning in different countries). One of the best ways to get around this is set an office language and only hire people who know it (this might mean making all your people learn a different language)

I haven't worked with Argentina, and only minimally with Spain (meaning I might be wrong), but my understanding of both countries is their culture doesn't really understand time. In the US if someone says 9am they mean 9am and 9:05 will make them mad. In Spain/Argentina 9am might stretch as late as 10:30am and nobody cares. When the two cultures meet there is friction because of this. There are many other variations of problems where culture will cause two people to think the other is an idiot. It is worth learning something about the other culture.

Beyond that, my experience is you will find good and bad people in every country. Even if you could state that one is better than the other, you can find enough great people in the others as to not make a difference - if you are willing to search hard enough.

What I have found most helpful is airplanes. Every few months someone flying to visit the people on the other team is very helpful. When face to face you realize the other person is smart, not an idiot who can barely program (it is surprising how often this is assumed). Also when working next to the other person you see things they are doing that they are doing "because nothing else works" when there is a better way (or sometimes you know your tools team needs to fix something for the remote team).</comment>


Liberation Mono - Ultimate Coding / Source Code Font - <AUTHOR> http://peterc.org/2008/61-liberation-mono-ultimate-coding-source-code-font.html <comment><USER2> I use Consolas, and it's been my favorite until now.

The thing is, Consolas is beautiful.. but not as functional as Liberation Mono. It's a very "plain" font, but for screenful after screenful of code, fancy isn't what I need.

Liberation Mono isn't going to win any beauty awards, the MS typography team did a great job with their Vista fonts... But I think Liberation Mono is the ideal "productivity" font for hard-core coders.

<comment><USER3> Yep, Consolas is a very beautiful and functional typeface. Note: on Linux use a patched Cairo for better LCD subpixel rendering, set to sight hinting--it looks MUCH better than the default (cairo-lcd in Arch Linux AUR, Ubuntu comes with a tweaked version by default, afaik)

</comment></comment><comment><USER4> It looks nice, but I haven't found anything I like more than Consolas on Windows.

</comment><comment><USER5> DejaVu Sans Mono for me.

<comment><USER6> Me too. I've tried Liberation, but find it a bit smooshed, so I have to have a slightly bigger type to find it as readable (so, while it seems like more code would fit on a screen than DejaVu I end up with slightly less because I need it to be 11 point instead of 10).

<comment><USER2> Funny.. I found Liberation to be huge. At size 10, it's about the same pixel- size as Consolas at size 12!

<comment><USER6> I've never used Consolas...but it's the small height of Liberation that bugs me. For some reason it hurts legibility for me far more than I would have expected. I'm trying it again, at 10 points just to see if maybe it was a "what I'm used to" thing, but I think I'll be going back to Deja Vu. I might give Consolas a try...I've heard so many good things about it. Screenshots don't make me love it, but one can't really know until using it for a while.</comment></comment></comment></comment>


Dangerous new hot zones are spreading around the world - <AUTHOR> https://www.washingtonpost.com/graphics/2019/national/climate-environment/climate-change-world/ <comment><USER2> Make sure to join the global climate strike on the 20th and contact your representatives so that action is taken to reduce GHG emissions.

<comment><USER3> What will reducing GHG emissions accomplish ?

<comment><USER4> It will allow more time to adapt farming practices and cultivars, building codes and buildings, water supply, clothing, society and more. Faster pace would cause disastrous droughts and likely local famine. Bigger number of deaths. Nasty immigration waves we have problems dealing with. And so on.

<comment><USER3> How much more time ? Is it significantly more time ?</comment></comment></comment></comment>


Show HN: Crammut. A trello for e-learning - <AUTHOR> http://crammut.com/ <comment><USER2> Great news! I'm sure this hard work will pay off. :) Go, team!

</comment><comment><USER3> I hope they like it! :)</comment>


Applying medical statistics to Backblaze Hard Drive stats - <AUTHOR> https://medium.com/@simonerni/applying-medical-statistics-to-the-backblaze-hard-drive-stats-36227cfd5372 <comment><USER2> Love the idea of applying statistical techniques typically used in field x to data from field y.

I'm always seeing places to apply manufacturing process control statistics like control charting [0] and process capability index [1] 'in the wild'.

[0] [https://en.m.wikipedia.org/wiki/Control_chart](https://en.m.wikipedia.org/wiki/Control_chart) [1] [https://en.m.wikipedia.org/wiki/Process_capability_index](https://en.m.wikipedia.org/wiki/Process_capability_index)

</comment><comment><USER3> wasn't this done before?

[https://bioinformare.blogspot.ca/2016/02/survival- analysis-o...](https://bioinformare.blogspot.ca/2016/02/survival-analysis-of- hard-disk-drive.html)

<comment><AUTHOR> Thanks for pointing that out! I didn't know that he did it as well, I just think its a really good way to visualize the data and to draw some conclusions from it.</comment></comment>


Ask HN: Why is labour priced differently from physical goods - <AUTHOR> How come labor i.e high skilled labor is priced differently from physical goods. eg an iPhone retail price is still ~700$ regardless of retail location. Yet the hourly rate of a skilled engineer varies wildly depending on region | locality. Assuming the skills & quality of an engineer are consistent across locales. yeah, market forces could've a play, but isn't it one of those cases where the market mis-prices a product | good ? <comment><USER2> You can price something based on cost, or price it closer to value.

A stapler's price is much lower than its value, but because lots of people make staplers, the price is closer to its cost. Same with restaurants etc.

But an iPhone and MacBook has less competitors so it's priced closer to value.

Engineers are a middle ground. In SF, you can get a top notch engineer easily. The price becomes more cost-based - how much does it cost for someone to live there, or what is the competition offering.

In something like Kuala Lumpur, the number of engineers who know Big O are rare. So it's more value based - how much money does the engineer bring to the company.

But even so, the cost based pricing in places like SF is a lot higher than value based pricing elsewhere. After all, the reason prices are so inflated there is because all the money sloshing through tech giants and VCs.

</comment><comment><USER3> Physical goods are easy and cheap to move. Highly skilled labour much less so.

<comment><USER4> In terms of market efficiency, this is labor market having a high cost of arbitrage

</comment></comment><comment><AUTHOR> another example would be cars: price of cars remains consistent across locales and software as well. with software even more funny, since the main cost of the software is due to software engineers.</comment>


Show HN: Accordion Chrome Extension – no more tl;dr - <AUTHOR> https://chrome.google.com/webstore/detail/accordion-display/ahnfnbnadopmloofgoigdhkkjmpfjhld <comment><USER2> Cool idea but it's sad that it only works on tagged content

<comment><AUTHOR> thanks. A new version is coming out in js, so no browser add on necessary. It will find the main points, supporting content, etc. automatically, so you can still use number keys to cut to the chase. Will post when its released.

This has been an idea of mine for 8 years and just got around to hacking away at it.</comment></comment>


Average cost of a weeklong vacation in cities around the world - <AUTHOR> https://www.marketwatch.com/story/only-one-city-in-the-world-costs-more-for-a-weeklong-vacation-than-reykjavik-2018-11-28 <comment><USER2> No all-inclusive resorts in Mexico?

It costs me about $1750 USD / person to stay about a week in an all-inclusive resort in Cancun, including flight, resort, fees and transfer to resort from airport, flying from NY. And I tend to book just 3-4 months before we want to go.

Running the numbers considering food and alcohol is included and I don't need to rent a car, it's about the same as other places I've been (Las Vegas, Chicago, Boston) if not sometimes less (parking in downtown Chicago is incredibly expensive IMO).</comment>


Rackspace Response to PRISM - <AUTHOR> https://community.rackspace.com/general/f/34/p/791/1347#1347 <comment><USER2> I was thinking about Rackspace and PRISM today (I spend > $10K/month at Rackspace) ... and that thread about how all this could harm the startup ecosystem.

If the Govt/NSA wanted access to certain metadata and a company refused (like some claim Twitter did), what's to stop them from going to Amazon or Rackspace and throwing their weight around to get access that way? Or, if that didn't work, they could just keep going up the OSI layers (or tier 1 providers) until they get the access they want OR can force it be threatening to disrupt service.

My point is, even awesome companies like Rackspace are dependent on less-than- awesome companies for some types of infrastructure.

<comment><USER3> _DING_ _DING_ _DING_ we have a winner.

Any company that doesn't comply and hand the data by API will have it's links scraped. Sure it's more costly. That's why they go through the arm twisting.

</comment></comment><comment><USER4> Probably one of the better responses that we've seen.

Regardless of my earlier posts, I'm actually inclined to believe these service providers.

I'm curious, has anyone seen/heard anything from CA's? I imagine it would be much easier to just create a split network route at the ISP layer and decrypt all traffic.

Wouldn't be that crazy if you had all of the root keys.

<comment><USER5> Ugh, this keeps coming up. No amount of cooperation from Certificate Authorities will enable _passive attacks_ on SSL.

All the CA does is cryptographically certify "this is the public key that the Company (eg. Google) gave me"; they never see the corresponding private key.

Cooperation from the CA might give the NSA their own certificates for Google, which would allow for an _active_ man-in-the-middle attack. Certificate pinning would defeat that, and doing that on the fly in the Internet at large would be a serious undertaking.

But if they want to decrypt traffic passively and they don't know about serious SSL vulnerabilities, they would have to have Google's private key. And with Perfect Forward Secrecy, even that is not sufficient. (PFS requires an active attack because the session key can only be determined if you're actually one of the two doing the handshake, or you know how to factor very large numbers.)

<comment><USER6> 1) Generating certificates on the fly for arbitrary domains has been the usual operating mode for transparent proxies for at least 8 years. 2) There have been many public SSL vulnerabilities in the last year. To think that there might be some non-public ones is not a stretch. 3) If anyone can factor very large numbers, it is the NSA. The move to ECC for Suite B has been interpreted to imply this may be becoming more feasible.

<comment><USER7> Large-scale active attacks on SSL are infeasible, as many applications (Chrome included) support certificate pinning.

Furthermore, this would be easily reproducible evidence that they are actively intercepting (and proxying) traffic. Never happen.

</comment></comment></comment></comment><comment><USER8> > A blanket warrant covering thousands of customers cannot possibly comply > with the Fourth Amendment

How about a blanket FISA order?

<comment><USER9> I saw the word "blanket" and cringed as well.

</comment></comment><comment><USER10> Dmitry's followup at the bottom of the page is both insightful and indicative of our nitpicking attitude to this. Is metadata covered under this? How about their routing and network equipment's logs? In the same time, when do we stop asking clarifying questions and arguing about the semantics of the message, a process that might turn into legalese and then lawyers talking to each-other?

<comment><USER11> Strip away the accompanying material and the statement reduces to:

"We have never been served with a blanket warrant, or anything close to it, that requires us to give data owned by multiple customers."

Those are the words that need to be examined for loopholes.

</comment></comment><comment><USER7> Note well that Rackspace offers primarily dedicated server services, which would make it rather difficult for them to participate in PRISM as shown. You'd tend to notice if someone rebooted your box and installed a service. :D

Nothing stopping NSA from splitting their transit fibers on the (3), Telia, and Qwest sides though.

What's going to be really interesting is how PRISM integrates with AWS, once some brave Amazon soul decides to self-immolate for our own intellectual curiosity.

<comment><USER12> Maybe you would, maybe you wouldn't.

See, that's part of the problem in terms of economic calculation when dealing with a surveillance society -> since it's largely impossible to quantify the amount of lost business due to various surveillance / justice actions, as the methods and individual events in which such actions took place may never see the light of day, a society could be going bankrupt due to an overly large security division, and never know it.

Let's consider a real-life plausible scenario: a DEA agent gets a tip from a questionable source about a large shipment of Molly coming in tonight on the docks (cliche, but let's roll with it). The information isn't good enough to get a warrant, but the DEA hasn't had a bust in a while, and the agents are being pressured to find something to justify their jobs. This DEA agent figures that it wouldn't hurt to have a look around (nothing illegal there, right?), and spotting nothing immediately out on the docks, begins to think that it's a bust. The agent notices that an upper window is open on one of the warehouses, and that there are voices being heard within; it would take a little effort, shimmying up the side, but the agent could peak through the window (questionable)...and maybe even climb inside if the agent sees something. The agent climbs up, and hears rising voices from within. Not seeing anyone, the agent climbs in.

The agent, walking on top of some crates, sees the owners of the voices, and after listening for several moments, realizes that it's just a typical worker's spat. The agent goes to leave, not seeing anything of interest...but as the agent moves, one of the crates topples, pushing the one in front of it, and so on in a domino fashion. The agent manages to leave undiscovered, but not before $30 million in Lowe's Italian Chandeliers are dropped three stories onto a hard concrete floor.

The workers will be blamed for not stacking the crates correctly, and the owner of the warehouse cited. The insurance company will, of course, cover the costs of the damaged merchandise. However, the cost to society, for this overstep, was more than a minor civil rights violation...it was more than those workers make in a decade, possibly their lives.

And that's kind of at the heart of these infringements...when the intelligence agencies screw up, when the police screw up, it's not like they're shouldered with that debt; it's charged to society as the cost of doing business...no different from what the bankers did recently when they 'privatized the gains, and socialized the losses.'

<comment><USER13> I can't really tell if I agree with you or not, but that was a hell of a story. I feel like I just watched an episode of Magnum P.I.

</comment></comment></comment><comment><USER14> They don't address Government back doors into their routers as a result of CALEA etc.

See: [http://www.cisco.com/en/US/docs/routers/7600/ios/12.2SR/conf...](http://www.cisco.com/en/US/docs/routers/7600/ios/12.2SR/configuration/lawful_intercept/76LIch2.html)

and: [http://en.wikipedia.org/wiki/Communications_Assistance_for_L...](http://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act)

</comment><comment><USER15> From the point of view of any non-resident alien who has US cloud data, this is a _very_ ponderable answer. We know what the Fourth Amendment says. The problem is that apparently (IANAL!) the US courts are upholding the idea that _the Fourth Amendment does not apply to the US-based cloud data of non-US- resident non-US-citizens_. I've heard a couple of people suggesting that this interpretation is based on the idea of border search, but that's neither here nor there: the upshot is that, unlike for example the US property of non-US- resident non-US-citizens, which is protected by the Takings Clause, the US cloud data of non-resident aliens seems to have no Constitutional protection. This seems to be the Constitutional foundation of FISA [http://www.gpo.gov/fdsys/pkg/STATUTE-92/pdf/STATUTE-92-Pg178...](http://www.gpo.gov/fdsys/pkg/STATUTE-92/pdf/STATUTE-92-Pg1783.pdf) 702 [http://www.govtrack.us/congress/bills/110/hr6304/text](http://www.govtrack.us/congress/bills/110/hr6304/text) , the law which allows the NSA to get Foreign Intelligence Surveillance Orders against non-resident aliens. _Absolutely the only thing_ the government has to prove to the FISC court to get one of these orders is that the targets are (more likely than not!) non-resident aliens. No probable cause, no standard of suspicion for anything: the government doesn't even have to state its motivation. And the "Notwithstanding any other provision of law" language in 702 seems to sweep away any other statute law you (or Rackspace etc.) might want to use against the order. (Again IANAL.)

So how are we to interpret

"Based on our interpretation of the Fourth Amendment and ECPA, we are of the view that Rackspace is prohibited from accessing and turning over customer data stored on a customer's server or other storage device in a U.S. data center without a properly issued, lawful request ( e.g. search warrants, court orders, Foreign Intelligence Surveillance Orders) from a U.S. court with appropriate jurisdiction over Rackspace and the data sought."

? Coming right after the recitation of the Fourth Amendment, this gives the impression that Rackspace will only hand out your data in response to a warrant (or warrant-like-thing) that demonstrates probable cause. But in fact, when the customer is a non-resident alien, the order is a FISA 702 order, and the court is the FISC, probable cause never comes into it: the US can (completely properly and lawfully!) get such an order for no stated reason at all. Imagine the following conversation in 1860:

Q: I hear that you have slaves on your Virginia cotton plantation. Is this really true?

A: The Fifth Amendment to the US Constitution states that 'No person shall [...] be deprived of life, liberty, or property, without due process of law'. No-one is forcibly detained on this plantation except fully in accordance with the law and the Fifth Amendment.

This answer seeks to suggest that the only prisoners on the plantation are convicted criminals, which is false - the plantation is worked by slaves. But in fact the answer is precisely true though devious: slaves have no rights under the law, while the Fifth Amendment does not apply to slaves. I really hope this isn't the correct way to interpret Rackspace's statement as well.

<comment><USER16> Maybe it's time to compile a list of alternative non-US cloud services? I would be particularly interested in a non-US hosting company comparable to Linode.

<comment><USER17> I use Bytemark, based in the UK. They have a cloud service in beta: [http://bigv.io/](http://bigv.io/)

<comment><USER18> Is the privacy outlook for the UK very good?

<comment><USER19> Not especially.

[http://en.wikipedia.org/wiki/Regulation_of_Investigatory_Pow...](http://en.wikipedia.org/wiki/Regulation_of_Investigatory_Powers_Act_2000)

</comment></comment></comment></comment></comment><comment><USER20> Their main defense is that they operate within the boundaries of the law, which the Obama administration also claims. If they ever face a court order telling them to hand over everything, as long as it follows law at face value then their statement is true.

</comment><comment><USER21> SCOTUS says Fourth Amendment does not apply to third parties. Smith v. Maryland - 442 U.S. 735 (1979). Third party doctrine.

<comment><USER22> Someone trots this horse out of the barn every time privacy issues come up.

I don't give a fuck what SCOTUS said in 1979. They could have gotten it wrong. Their interpretation could disagree with a plain reading of the Constitution, or they could have based their decision on inaccurate or incomplete data. Even if neither of those things are true, times have changed; issues at hand are wildly different than would ever have been conceivable in 1979.

Going "SHUT UP, SCOTUS DECIDED THIS ALREADY" does nothing for the discussion, and it comes out every single time there's an ECPA or 4th Amendment thread.

<comment><USER21> Whoa!

I responded to one point in the Rackspace response I thought was a bit off- base, specifically that their general counsel thinks the fourth amendment applies to them ... "Based on our interpretation of the Fourth Amendment ". It does not.

You may not give a * about what the SCOTUS decided in 1979 but the SCOTUS does, it is called legal precedent.

Times may have changed, but Smith v Maryland is still controlling law.

Please try to be more civil.

<comment><USER23> But it is still controlling law in the area of pen registers applied to single individuals, right? Knotts raises some uncertainty as to whether dragnet surveillance should be under the same rules, and at least 5 justices in Jones v. United States clearly articulated that it was different for long-term, widespread surveillance of this sort.

So I am questioning as to whether Smith controls _the Verizon order as it is._ I am not sure a simple "yes" is possible.

</comment></comment></comment></comment><comment><USER24> Rackspace? Look up the history regarding Indymedia in 2004.

<comment><USER25> That was a weird situation. Italian government asks US government for "help" with servers (well, logs) in a UK datacenter run by US-based Rackspace.

They'd still do it today, IMO:

> _we are of the view that Rackspace is prohibited from accessing and turning > over customer data stored on a customer's server or other storage device in > a U.S. data center without a properly issued, lawful request ( e.g. search > warrants, court orders, Foreign Intelligence Surveillance Orders)_

> _without a properly issued, lawful request_

> _lawful request_

When you write the laws, anything is lawful.

</comment></comment><comment><USER26> Are the intel services (DIA, CIA, NSA, NRO, etc...) considered actual LEAs? Part of the issue here afaik is the collection of data for _intel_ , not actual LEA. Or else the FBI would be getting all this juicy NSA data to o after actual criminals.

<comment><USER27> Many USG agencies (Pentagon, NSA, Department of Energy/Justice/Labour/Education, et al) have their own police services[1].

Their training and expertise ranges from glorified security guards to para- military.

[1] [http://en.wikipedia.org/wiki/Federal_law_enforcement_in_the_...](http://en.wikipedia.org/wiki/Federal_law_enforcement_in_the_United_States)

</comment></comment><comment><USER28> "We did not have an unconstitutional relationship with that authority."

</comment><comment><USER29> I would very much like to have the same question answered by Amazon in regards to AWS (maybe it has been already).

<comment><USER29> So I've opened support cases with both Amazon and Linode, the former will probably get back to me in several days, but as usual Linode has already replied.

\---

vertis 29 minutes ago I am an Australian (i.e. Non-US-Resident Non-US- Citizen). While I have nothing of particular interest on my servers, the revelations of the last week have concerned me for multiple reasons.

The Guardian story about the PRISM program suggests there is extensive surveillance and interception of foreign citizens' data without a court order. Do I need to move my servers to a provider that is based in a country that respects my rights to not be surveilled?

lmatos 18 minutes ago Hello,

As an American citizen, I completely understand. With that said, we have to comply with all US law as we are a US based company.

If there is anything else that we can do to help, please do not hesitate to ask.

Regards, Lee M

</comment></comment><comment><USER3> 95/5 splitters.

Rackspace buys service from somewhere. Those fibers are suspect.

</comment><comment><USER30> The thing most bothering me right now is the lack of meaningful response from the companies that really matter: Google, Microsoft, Apple, and others. The responses we do have seem to be downright lies.

<comment><USER7> These sorts of things are gag-ordered. It may be that the top brass doesn't even know, for plausible deniability's sake, or that they've been told and now immediately face federal felony charges if they tell anyone (spouses and PR flacks included).

There was a fight (which was won) to get the gag-order provisions of PATRIOT NSLs lifted, at least for speaking to one's own lawyer, which is a protected right (spouses and coworkers are still out, tho). Who knows if those rights extend to FISA orders, though we've seen how they interpret other constitutionally protected rights.

It's not their fault that they don't want jail time. Blame your government. Support courageous people like Snowden. Tell your friends.

</comment></comment><comment><USER31> So, they don't do it like google etc. don't do it? Encrypt your disks. Only allow https. Don't let their support anywhere near your kit.

Although then again they could stick a physical intercept in a box.</comment>


Ask HN: Is CPAN all that good? - <AUTHOR>

I keep looking into the language wars and I believe perl is a crappy language for many reasons and anytime anyone says  that all the perl fanboys reply is "CPAN", is it really THAT impressive? <comment><USER2> Yes.

CPAN contains modules for "everything", which is an enormous time-saver. CPAN also hooks in with automated test-suites, and build-reports for different environments so while the quality of various modules may be variable it is usually obvious very quickly if you're looking at a "supported" module or not. (A poor author will ignore the facilities available to them.)

I enjoy perl, and tend to believe most languages are "crappy". But it is the users who make that a real thing - good code is good code, bad code is bad code, and while a language obviously influences users they tend to be "OK" by default.</comment>