California law banning bots from pretending to be real people without disclosure - <AUTHOR> https://www.newyorker.com/tech/annals-of-technology/will-californias-new-bot-law-strengthen-democracy <comment><USER2> I am reminded of Thoreau's quote: "There are a thousand hacking at the branches of evil to one who is striking at the root."

The root of the problem is not that we have bots, but that we have normalised lying and deception as part of everyday business. We allow companies to pretend that bots are human beings, and allow call-center employees in third- world countries to pretend (even sometimes though elaborate lying) that they are located in the same country as you. We allow companies to tell outrageous untruths in their advertising - see the Samsung ad which they're currently being hauled over the coals for in Australia.

That's the real problem here, and the one we need to fix on a general level, not by band-aid regulations over whichever dishonesty has managed to irritate enough state representatives.

<comment><USER3> > allow call-center employees in third-world countries to pretend

I agree companies should be forced to tell the truth to their customers, but in all cases where they're asking for details about the customer service rep? That could go weird places.

If a caller demanded to know the rep's HIV status, we wouldn't insist the company disclose it. We'd probably demand they didn't. Honesty is important, ok, but the customer has no reasonable need to know that. So, ok, it's not as simple as "tell the customer everything." There are some judgment calls the company has to make about what's important to disclose and what is irrelevant. The service rep's race, religion, medical history, or sexual orientation are probably not up for discussion. Why not national origin?

This isn't just about fairness to the rep, but the majority of customers need the company to hold this line too. If some portion of the population strongly believes that foreign call centers are lower quality, are you going to get the best possible answers on a survey if you say, "this was a foreign call center, how was the quality?"

Disclosing irrelevant details can sabotage collection of unbiased information on call quality.

If customers as a whole want improved service quality, they'll want the company to be able to collect unbiased post-call survey results.

If call centers in country X are all terrible, unbiased surveys will reveal that. If it's really about training, and there are good and bad call centers in several different countries, unbiased surveys will reveal that too.

I know passions run deep on this one, and it's a hard case, but this one seems a little more complicated than the others.

<comment><USER4> Declining to tell someone something is not the same as lying to them. And declining to tell the customer "I am HIV positive" is not the same as declining to tell them impersonal information.

You may or may not be aware but there are companies that actively instruct their international call center personnel to tell customers "My name is Sally and I live in Fort Worth Texas, right near you" when none of that is true.

<comment><USER5> I think this is an important distinction that the parent comment failed to address and which destroys the premise of their entire argument.

</comment></comment></comment></comment><comment><USER6> I felt stupid, but I have fallen victim to this on dpd.com while tracking a package. A helpful chat popup has appeared where I could request assistance from a support agent, but it was not disclosed that the agent is a bot.

Needless to say I have spent a couple of minutes repeatedly asking a question, and even rephrasing it while being frustrated that this person does not seem to grasp my issue.

<comment><USER7> I've been assuming that it's a pre-determined initial message, but that a real human in a low-cost country would immediately be involved if I bothered to respond.

What portion of the chat pop up windows do you think are purely bot? Might any of them be purely human?

<comment><USER8> It depends build to build. The standard approach is one of 4:

1) The bot initiates the conversation and your initial message gets sent directly to an agent. This is the older model that's in most common use today.

2) The bot initiates contact and based on your responses does some simple keyword matching and delivers help article links where possible or asks for more information IVR style, then when it hits an "I don't know" point or if the agent option is selected, offloads to an agent.

3) This is my favorite style, honestly: The bot initiates the interaction, and does some machine learning backed AI chat, all the while the interaction is monitored by an agent who can take over at any time. Similar to #2, if the bot hits a sticking point, it'll just queue to an agent. This unfortunately is the least common of the implementations.

4) This is the most modern and is becoming the industry leader: Fully AI bot trained against a veritable Everest of chat conversations for that entity/industry, only offloads to a human when you shout "HUMAN" at it enough times or if it gets really stuck and confidence intervals start falling rapidly.

 __ _NOTE /DISCLAIMER: ___I design and implement these systems for a living, and we don 't often get much say in the customer-side UX, so I'm sorry if you've gotten stuck with an arguably bad build!

(Edit: formatting)

<comment><USER9> [https://xkcd.com/806/](https://xkcd.com/806/)

Nobody will notice, you know you want to add it ;).

<comment><USER8> You have NO IDEA how tempted I've been to add that! I've literally had printed this out and pinned to the wall of my cubicle for years!

</comment></comment></comment></comment></comment><comment><USER10> California is setting a dangerous precident.

If individual states each enact individual laws governing the internet, then only large companies will have the resources to follow them.

We'll see a balkanization of the web wherein it's no longer very world wide. Small internet businesses will become harder and harder to start. Big monopolies will become entrenched.

It's not pretty.

<comment><USER11> Or companies start acting like a sane person would. Not outsourcing communication to a bot without disclosure for example. And do so globally.

Or taking the European GDPR regulations as an example actually caring a little bit more about the user' data and enabling informed consent.

<comment><USER12> Agreed, when are you enforcing Article 11/13 in the US? /s

<comment><USER11> Actually Article 11 is in effect in Germany. Article 13 also.

</comment></comment></comment></comment><comment><USER13> That will be a fun one to interpret. So if I use autocorrect, am I a bot? What if the device makes next word suggestions and I use them? What if the device suggests the entire post, but I manually approve it? What if it suggests five separate posts and I approve them all at once?

<comment><USER14> I'm not sure why you're being so facetious. In fact, I wonder why HN always has comments like these.

Lawmakers are purposefully vague because judges can decipher what the spirit of the law is and fine corporations or condone specific use cases when they are brought up in court. You can't go into court to challenge a law with hypothetical cases for a good reason. Do you want lawmakers to arbitrarily impose constraints like only 10% of non article words can be suggested per message composition or only 2 posts per minute are allowed?

It is a fact in life that technology changes and improves things beyond what we could have foreseen in just a few years. The degree of flexibility built into these laws is a huge plus. Not a flaw.

<comment><USER15> >I wonder why HN always has comments like these

It's a work related disease. A coder must consider all corner cases in advance. There is no judge to decipher the spirit of a program.

<comment><USER16> slight-OT: Yes, it is. Which is frustrating in itself. In general, I've developed a strategy:

Me: "So, what should the program do when XYZ occurs?"

Marketing: "Uhm... Dunno, haven't thought about it. I'd decide by, you know, gut instinct. We haven't thought about that yet."

Me: _implements a virtual coin-flip using Random.Next()_

Once you've done that, it's easier.

<comment><USER17> Or, file a bug for each corner case, mark it release-blocking, and assign to whoever is responsible for the requirements.

<comment><USER18> If you're interested in actually shipping, a more helpful approach is to choose the simplest behavior to implement, notify the requirements person that you've done that, and offer to create a release-blocking bug for the issue if that is unacceptable.

Chances are, if the requirements person doesn't have an opinion on what the copy for the dialog should be if the customer is 65+ and it's a Tuesday in a month with 31 days, then it's because that choice doesn't really matter all that much.

</comment></comment></comment></comment></comment></comment><comment><USER19> Bots are going to be the way we interact with the web (and really all systems) heading forward, this 'real people' at just 'browsers' is quite a misunderstanding of what a 'user-agent' really means in this day and age.

If I launch a new tab in the background and tell it go establish some set of factors for me, or locate price points and details for me, or buy something for me (and right now as me)... or just have it let me browser and interactively direct it but have it block ads as I go.

I know the law, and lawmakers, are looking at this from a fraudulent content perspective, but they are going to be hard pressed to do anything in long run to quell this.

</comment><comment><USER20> > Violators could face fines under state statutes related to unfair > competition.

I doubt that anyone running bots, and who is technically competent, will be identifiable or findable. I mean, I could do it, and I'm just a random anonymous coward.

<comment><USER21> I think part of the goal of this law is to make this be true:

> I doubt that anyone running bots, and who is technically competent, will be > identifiable or findable.

Telemarketing, for example, was done a great deal by perfectly legal, traceable businesses. Once it was made illegal, it was forced underground, and volume dropped immensely.

> I could do it, and I'm just a random anonymous coward.

Could you? Hiding the flow of significant amounts of money is actually quite hard. Robot salesmen masquerading as humans would be a plague, and I think this law should keep that from becoming a legitimate business technique.

<comment><USER20> I'd do it using Bitcoin. And I know how to use Bitcoin ~anonymously. Or some other cryptocurrency that's actually anonymous.

It's true that getting assets from cryptocurrencies is hard. I don't do it. I just spend my ~anonymous income on ~anonymous servers to play with.

But if you're moving enough assets, you can pay people, who know what they're doing, to move it. As we've seen in real estate markets in many cities.

<comment><USER22> Meanwhile, back in the real world, companies that were quite happy to pay for robocalls and social media bots to promote their product are not interested in paying anonymous people anonymously in Bitcoins for campaigns that might get them into trouble, no matter how proficient the bot developers might be at laundering their crypto earnings. That'll be the law working as intended

<comment><USER20> True. But there's lots more deniability for political campaigns. Free speech and all.

</comment></comment></comment></comment></comment><comment><USER23> Of course, this all raises the question of whether there are only unethical use cases for bots pretending to be human, or whether a law like this could hit benign uses for bots as well.

For instance, ARGs could have bot accounts for fictional characters on social media sites. These accounts could give pre recorded messages that then hint that the user should visit some third party site for more clues or information. Is that legally dubious? I can see it being so under this law, but I don't think it's comparable to a business running say an automated chat support system and pretending its bots are human.

Same goes with roleplaying bots on online community sites. These aren't a huge thing right now, but they could be in future, with accounts that act like NPCs do in video games or interact with the players account in side quests or what not. These don't seem like they'd be morally 'wrong' things to have on a site, but they'd probably get hit by this law regardless.

Point is, these types of bots don't necessarily only have dodgy use cases.

<comment><USER24> In these gaming use cases the bots can be appropriately disclosed without getting in the way of the game. A couple decades ago there was an ARG about government conspiracies which called your house to give you clues from in-game characters and it started with a 4th wall breaking preamble so that if someone not playing answered the phone they wouldn't get worried. The game was still fun. IIRC you could go into the settings and disable the preamble, which would be a fine place in the UX to disclose the bots and capture the user's agreement.

Unfortunately for the game (and the world), 9/11 happened a few months after launch and due to the theme of the game it was shut down. Now it's just an interesting bit of gaming history!

[https://en.m.wikipedia.org/wiki/Majestic_(video_game)](https://en.m.wikipedia.org/wiki/Majestic_\(video_game\))

</comment></comment><comment><USER25> I can say that people like humans way better than bots. We have an app that looks like a bot but is a real person, and we say it at the beginning, but people don't believe. Once they figure it out, they go crazy. It's always local people by the way. So I think at some point, bots should be at least explain what they are without pretending they are humans.

</comment><comment><USER26> Welcome to the Fifth Annual Californian Turing Test Chatbot Hackathon!

This time we've had to introduce some changes to abide by new state legislature.

Messages entered into the chat console must be followed immediately by the string " [I am a bot]", whether you are a bot or a human, but especially if you are a human.

Good luck and have fun!

<comment><USER27> New addition to every EULA: "XYZ Corp is a member of the Rand-Turing coalition, an industry cooperative dedicated to the philosophical belief that all human beings are robots. Based on this, every interaction you have with us will be an interaction with a robot. By signing this license agreement you agree that all members of our corporation from the lowest janitor up to the CEO, are all robots."

</comment></comment><comment><USER28> You can read the text of the law here: [https://leginfo.legislature.ca.gov/faces/billCompareClient.x...](https://leginfo.legislature.ca.gov/faces/billCompareClient.xhtml?bill_id=201720180SB1001)

</comment><comment><USER29> What about customer support or sales agents who are operating solely off a script? I was contacted by a sales agent of a "lead generation" company, who was being impersonated by her off-shore workers. Eventually during our email exchange the real person jumped in (but did not announce that the prior correspondence was with someone in an offshore sales center. They use these agents to pretend to be their clients, and based on the not-great experience I had when I was initially contacted (email was not well written, said things about my company that wasn't quite right), I would not use them.

These folks are essentially like bots, insofar as they are "programmed" to respond and significantly constrained in their latitude. They're like human bots, no?

</comment><comment><USER30> "Bots are not people" - ok, but if they're written by people for a specific intent meant as speech, is that no longer protected speech? If I program a bot to chant slogans on Twitter, isn't that something I'd have the right to do?

I'd argue yes, but where they may have an argument is where I respond "no I am human" if people ask me about being a bot - intentionally misleading.

They may have more luck here in the commercial space where they can better regulate and enforce these ruleS like advertising and other sales practices. Not sure where this goes in politics or other domains at all in terms of enforeceability.

</comment><comment><USER31> I'm confident it will be as effective as the do not call registry.

</comment><comment><USER32> This is a horrible idea, California doesn't have the ability to enforce such a law, and hackers would simple operate from outside California

Bad idea

<comment><USER33> If the company or person is doing any business in California then California does have the ability to enforce the law.

</comment></comment><comment><USER34> Political ads on tv require disclosure. I see no reason disclosure rules shouldn't apply on internet campaigns of all forms.

</comment><comment><USER35> Does anyone have any insight if this would affect market trading algorithms and bots? The article says the law is "requiring that they reveal their "artificial identity" when they are used to sell a product", but I'm not sure how broad of a definition they want for the word "selling".

</comment><comment><USER36> This will bring the end of Twitter. A website where 75% of the content is bots.

<comment><USER37> No, Twitter just needs a switch that will display 'posted by a bot' in place of 'posted via Twitter for iPhone'.

</comment></comment><comment><USER38> Bots are communications tools configured and deployed by human beings, at least until they can pass the Turing Test.

Human beings have human rights to express themselves however they wish.

<comment><USER39> > Human beings have human rights to express themselves however they wish.

No. Commercial speech usually has disclosure requirements, even in the US (see the Zauderer case), which humans have to follow. This is just another case of compelled commercial speech.

</comment></comment><comment><USER33> I get the feeling that the commercial part of this law might hold up, but the election part is highly questionable based on Supreme Court rulings.

</comment><comment><USER40> Doesn't this effectively outlaw services that scrape your bank accounts (but don't have an official API to work with)?

</comment><comment><USER41> Sounds unworkable, but is likely a pretext for some other effort (like undermining anonymity).

</comment><comment><USER42> Some companies use bots for their support twitters. Samsung for example had a twitter bot that replies everyone

[https://twitter.com/SamsungSupport/status/114041514667572838...](https://twitter.com/SamsungSupport/status/1140415146675728384)

And it even uses a human name. Really dishonest.

</comment><comment><USER43> As if millions of Facebook accounts cried out in terror, and were suddenly silenced.

<comment><USER44> As if millions of Facebook accounts kept right on going because none of the people running them are in California and Facebook has no incentive to actively police them.

</comment></comment><comment><USER45> Does this have to do with the Google AI booking salon appointments over the phone?

</comment><comment><USER46> So much for Dr. Eliza.

[http://www.drdobbs.com/chatboteliza/199101503](http://www.drdobbs.com/chatboteliza/199101503)

[https://www.cyberpsych.org/eliza/](https://www.cyberpsych.org/eliza/)

<comment><USER47> I don't think this spells an end to Dr. Eliza. From what I understand, it only has to be made known that it is a bot. The fact that Dr. Eliza is very clearly a bot from the get go makes it completely legit. I do however wonder about Ashley Madison as it was made evident that a lot of the woman on the site were just bots. Yes the bots are just there to talk to the men but they are there from the company to entice the men to upgrade their membership and pay so it seems to me this would make them fall under this law.

</comment></comment><comment><USER48> Cool, hopefully the spammers on Tinder will respect California law /s

</comment><comment><USER49> So this disclosure will now be required with all robocall spam calls?

<comment><USER50> Aren't those already illegal, but just a nightmare to track down for enforcement?

</comment></comment><comment><USER51> Well, at least the Turing test is solved.

<comment><USER52> Haha, that was my first thought too...

Unless companies start asking all human employees to start claiming that they're bots so as to subvert the new rule... there's not a law against that yet.

</comment></comment><comment><USER53> It's a start, it should cover Facebook and Google.

</comment><comment><USER54> what about people pretending to be bots?

</comment><comment><USER55> But what about humans posing as bots?

</comment><comment><USER56> If I make a generated face that speaks my stuff with a generated voice, is it a bot?

<comment><USER56> Well, amusing that people thought this was wholly irrelevant. Here's what I was thinking of when I said that: [https://www.youtube.com/watch?v=ksb3KD6DfSI](https://www.youtube.com/watch?v=ksb3KD6DfSI)

Also amusing that there are two confident opposite opinions in response.

<comment><USER57> What does this video montage you linked have to do with computer-generated faces speaking computer-generated voices?

<comment><USER56> It's the same content. Different people with different voices. You could have it sound like you have your local folks giving you info when instead it's from some centralized location.

I could control a message without it being a single guy saying it all.

</comment></comment></comment></comment><comment><USER58> What are the implications of this on the Turing Test?

<comment><USER59> IANAL, but AFAIK no machine living in or interacting with someone in California can complete the Turing Test without breaking the law.

A simple question like 'Who should I vote for?' would cause the machine to either answer with the compliant 'Please note, I am not a human being...' or with some illegal comment about the democratic process.

Maybe that law requires an additional paragraph, stating that humans participating in a Turing Test should also identify themselves as bots ;-)

</comment></comment><comment><USER60> I really hate this stuff. The article starts out with a paragraph of complete nonsense:

 _" When you ask experts how bots influence politics—that is, what specifically these bits of computer code that purport to be human can accomplish during an election—they will give you a list: bots can smear the opposition through personal attacks; they can exaggerate voters' fears and anger by repeating short simple slogans; they can overstate popularity; they can derail conversations and draw attention to symbolic and ultimately meaningless ideas; they can spread false narratives."_

Since when can bots "smear the opposition through personal attacks"? Bots that post the same stuff written by humans over and over have existed for years and are easily filtered out by spam filters - bulk spam doesn't change people's politics anyway so in practice such bots are always advertising commercial products. Bots that constantly invent _new_ ways to smear the opposition don't yet exist, not even in the lab.

This whole story is asserting that there are programs routinely running around the internet indistinguishable from humans, making points so excellent they successfully persuade people to switch their political affiliation, which is simply false.

In the article the word "experts" is a hyperlink. I was very curious what kind of bot expert might believe these fantasies. To my total lack of surprise the link goes to a single "expert" who in fact knows nothing about AI, bots or technology in general - they're a political flak who worked for the Obama campaign and studied a PhD in "communication".

This sort of manipulative deception is exactly why so many people no longer trust the media. The New Yorker runs an article that starts by asserting a fantasy as expert-supported fact, and then cites a member of the Obama campaign who went into social science academia (i.e. a field that systematically 'discovers' things that are false), and who has no tech background or indeed any evidence of their thesis whatsoever.

My experience has been that actual experts in bots are never approached for this sort of story.

<comment><USER61> _This whole story is asserting that there are programs routinely running around the internet indistinguishable from humans, making points so excellent they successfully persuade people to switch their political affiliation, which is simply false._

The theory isn't that bots are artificial general intelligences trying to convince individuals with clever intellectual debate. The theory is bots try to move the Overton Window [1] - to change _what the average person thinks the average person thinks_ \- by making certain opinions/arguments appear more prominent by repetition.

A bot doesn't need to be an AGI - or even capable of responding to replies to its own posts. All it needs to do is keep 100 accounts in good standing with reposts and low-effort comments, then every hundred posts or so a human operator jumps on to make a driveby comment like "LOL give it up Mickey Mouse is never going out of copyright" or "LOL we get it you vape" or "LOL it's the government, what did you expect?" or "LOL like America hasn't done the same thing but much worse" in an appropriate thread.

[1] [https://en.wikipedia.org/wiki/Overton_window](https://en.wikipedia.org/wiki/Overton_window)

<comment><USER60> Firstly, the theory in question is so vague it's hard to say what they are really claiming.

But secondly and more importantly, even if what you say is true, the theory is still total nonsense!

Where is the evidence for _any_ of this? Where are the networks of bots that were caught spamming low-intelligence identically worded political comments, yet somehow can't be caught by normal spam filters? Where is the testimony of millions of people who decide how to vote by counting duplicate tweets?

This entire theory is literally a conspiracy theory. Like all conspiracy theories, when basic questions are asked it suddenly shapeshifts and starts to claim something different but still wrong.

I don't believe any such bots exist: can anyone show me the evidence that they do? I mean _real_ , first-hand evidence, not assertions of dubious self- proclaimed experts with an agenda.

I can for sure tell you that real humans are routinely labelled as "bots" by people who believe in this conspiracy theory, and can cite evidence:

1\. It's happened to me.

2\. It's happened to other people:

[https://sputniknews.com/europe/201804211063771932-Smeared- Ru...](https://sputniknews.com/europe/201804211063771932-Smeared-Russian-Bot- UK-Man-Demolishes-Sky-News/)

 _That may have been the end of it, but then Ian took an invitation to appear on Sky News. The news anchors began by asking the man, who appeared on video remotely, whether he was truly a "Russian bot." "That is 100 percent a total lie and complete fabrication by the UK government," Ian said, with a British accent._

Here's a related case. In fairness, this time it's about "Russian trolls" not "Russian bots", although I've noticed people tend to use the terms interchangeably:

[https://order-order.com/2017/11/15/byline-outs-russian- troll...](https://order-order.com/2017/11/15/byline-outs-russian-troll-turns- glasgow-security-guard/)

The Twitter account in question turned out to be a Scottish car park security guard.

Here's a third case of real people being accused of being political bots:

[https://www.wired.com/story/how-americans-wound-up-on- twitte...](https://www.wired.com/story/how-americans-wound-up-on-twitters- list-of-russian-bots/)

3\. Any time any detail or basic question about this theory is raised, this is exactly what happens - someone pops up saying nobody is claiming the bots are _genuinely_ artificially intelligent, or the claims are changed in other subtle ways. But yes, that's exactly what this very article is claiming:

"The first bots, short for chatbots, couldn't hide their artificiality. When they were invented, back in the nineteen-sixties, they weren't capable of manipulating their users. Most bot creators worked in university labs and didn't conjure these programs to exploit the public. _Today's bots have been designed to achieve specific goals by appearing human_ and blending into the cacophony of online voices"

The justification for this law is literally that people think AGI has been achieved and is "manipulating" voters by spreading "false narratives". But it's not true, is it?

<comment><USER62> The US public consultation on net neutrality was famously skewed by bots (posting identical messages, sometimes on behalf of dead people). On Reddit some topics attract bot like behavior as well (groups of users from a non-US ip block voting and posting in concert). Making it illegal won't stop this entirely but will stifle it.</comment></comment></comment></comment>


What is 'common sense'? - <AUTHOR> http://thelongandshort.org/issues/season-four/what-is-common-sense-.html <comment><USER2> Common sense should not be defined as common knowledge. It is not describing a type of knowledge which one simply know or ignorant. Rather it describes a most general type of critical thinking process where common people will reach the similar conclusion when they are asked to engage in the critical thinking.

For example, cutting vegetables. I would say it is a common sense to always put your holding figures on top (rather than under the vegetables or on the side). It is not a common knowledge -- for one, not all or quite a portion of our population never cut vegetables before so it can't be a common knowledge; and for two, many who try to cut vegetables will make mistakes of injuring their fingers due to lack this common sense.

However, it is a good example of common sense, if we imagine, that we ask any common people to think about the situation and devise or choose from a couple vegetable holding position, most of will reach the common conclusions.

Therefore, common sense is a common critical thinking process shared by us.

The problem with common sense is that most people -- or many of us most of the time -- do not engage in critical thinking, as a result, fail to benefit from common sense.

<comment><USER3> > For example, cutting vegetables. I would say it is a common sense to always > put your holding figures on top

That's not actually what most experts advocate. Chefs are trained to hold from the side, but with their finger tips curled underneath their knuckles for protection.

[https://youtu.be/cV0c7qiNjuI?t=1m56s](https://youtu.be/cV0c7qiNjuI?t=1m56s)

<comment><USER4> If I had to pick a direction that that chef is holding the carrot from, it's "top".

</comment></comment></comment><comment><USER5> The term "common sense" is a pet hate of mine. Considered objectively, it's the opposite of empiricism. It's what happens when you jump to the most obvious conclusion, regardless of whether or not it's the right one. It's the intellectual equivalent of vigilante justice.

<comment><USER6> > Considered objectively, it's the opposite of empiricism.

It's not. Because we call it a sense, it might have nothing to do empirical senses. It has to do with what we believe about the world, including right and wrong. Common sense can be very well justified (the justification being outhere, although not all are aware of it), or it might be something seen on TV or read on HN. Perhaps it's fair to say that it's the core of a culture, defining it at <x, y, t>. Of course, cultures are all mixed up since 1969, thus everyone is all high about their objectivity. Back in the day, long before I was born, it was better.

<comment><USER7> Am I reading this wrong, or is cristianpascu basically saying he miss the good old days before minorities had rights?

<comment><USER8> You're framing this from a western perspective, yet people in Papua new guinea also have something called common sense, irrespective of colonization, etc.

Don't always look at things thru a western point of view or experience. Lots of themes which exist in western culture actually also exist elsewhere.

</comment></comment></comment></comment><comment><USER9> The phrase common sense is awful, as @robert_tweed says, it is the opposite of a considered opinion.

In politics, however, this idea is particularly egregious, as the article elucidates.

If you're wrong about a scientific theory or a computer program, you can tell well enough by testing the things. If you're wrong in politics, it is extremely difficult to obtain empirical evidence that this is the case.

That is not to say that it's impossible: there is plenty of research out there, and like all human-centric scientific research some of it is flawed, and most is statistically weak. As far as I can tell, "common sense" as used by UKIP, Gove, etc means assuming that any results which are contrary to your brain's initial guess are either wrong, or actually malicious[1].

The Lib Dems (who I stood for in the election) have actually tried to do the probably-impossible here and build a platform on evidence-based policy[2]. Much good it did us in the poll, of course.

[1] [http://www.dailymail.co.uk/debate/article-2298146/I-refuse-s...](http://www.dailymail.co.uk/debate/article-2298146/I-refuse- surrender-Marxist-teachers-hell-bent-destroying-schools-Education-Secretary- berates-new-enemies-promise-opposing-plans.html)

[2] not that it stopped some of our candidates trotting out the awful line, as the article points out.

<comment><USER10> Common sense can best be thought of as the collection of small facts that people have acquired through thousands of years of observing humans and the results. eg, Folk Wisdom.

It's much more useful than you seem to think it is.

Look at priming. It was a recent academic fad, Malcolm Gladwell included a big section on it in "Blink". The idea that you could influence people to walk more slowly by making them read a list of words associated with old age defied common sense. Surely someone would have noticed this effect before.

And the result was that the common sensers were right. Key priming studies turned out to be outright fraud. The rest weren't repeatable.

<comment><USER11> Priming is a broad topic. Only certain kinds were debunked.

Wikipedia summarizes "Although semantic, associative, and form priming are well established, some longer-term priming effects were not replicated in further studies, casting doubt on their effectiveness or even existence"

</comment></comment></comment><comment><USER12> Common sense is optimization of decision making with heuristics and data compression. It comes at a cost-- cognitive biases, illusions, etc.-- but imagine trying to function in the world if you had to reason through and empirically test each decision.

"Will that lion eat me? How should I construct a study to AAAAAhhhh!!!"

In common use the term is also used to refer to intuition, which is something else. Intuition is also a bit of a sloppy term but mostly reveals to massively parallel so-called "right brain" modes of cognition that rely heavily on huge scale pattern recognition instead of linear paths of logic.

</comment><comment><USER13> Important question, weak article.

"Common sense" used to be a term used often in AI research, although seldom implemented. Collecting large numbers of factoids has been done (see Cyc and ConceptNet). That didn't lead to common sense, although it helps some quesion- answering systems.

A useful working definition is that common sense is the predictive capability needed to get through the next seconds to a minute of life. This is what you need to not fall down, get hit by moving objects, and avoid predators. If you can't manage that, life will be short. It's a basic function of animal behavior.

Not enough has been done in that area. It's essential for robots. Google's self-driving cars have something like that, trying to predict what other cars are going to do in the immediate future.

One way to work on this problem is to have a system that looks at movie clips, and is asked to predict what happens next. It can, of course, be trained by looking at what does happen next. Image analysis is now far enough along to attempt this. Anyone doing that in recent years?

<comment><USER14> Interesting take on a vague and, IMHO, insoluble question due to its intrinsic subjectivity based on an agent's previous exposure to its observable world.

Continuing along an AI theme, wouldn't "common sense" be closer to the choices selected from the belief network developed by an agent's percepts over time?

</comment></comment><comment><USER15> There are some things that there is no reliable scientific data on. Almost any argument is going to rely on these things in some way. E.g. Black people commit much more crime per capita than White people. Some people might consider it common sense that no amount of discrimination by the justice system could account for such a gap. Other people might say the opposite: there is so much specific evidence of discrimination that we should expect the overall system to be extremely biased.

Sure, specific studies might fill the gap, but more questions will be raised about the details of those studies, and the cycle continues.

While we should use all available evidence, at the end of the day we need more information than object evidence can provide, in order to form opinions about important topics.

</comment><comment><USER16> "Common sense is the collection of prejudices acquired by age eighteen." \- Albert Einstein

</comment><comment><USER17> Nazi Germany used the term "gesundes Volksempfinden", not only as a part of its internal propaganda, but even as a legal principle.

[https://de.wikipedia.org/wiki/Gesundes_Volksempfinden](https://de.wikipedia.org/wiki/Gesundes_Volksempfinden)

(Sorry, I couldn't find a relevant wikipedia article about it in English.)

<comment><USER14> Pretty quick on that Godwin's Law[1] trigger man...

1 - [http://knowyourmeme.com/memes/godwins- law](http://knowyourmeme.com/memes/godwins-law)

</comment></comment><comment><USER18> Not sure about the UK, but in my neck of the woods here in the US, "common sense" refers to not being physically reckless, especially toward others. I understand that politicians like to co-opt terminology for themselves. Let's blame the politicians, not 'proper' vocabulary.

<comment> vezzy-fnord I think that's the "Golden Rule". Either way, your definition of "common sense" isn't particularly common, and whether it even makes sense has long been the subject of debates in ethics.

<comment><USER18> Human language is ambiguous. As it has been since it was invented. And people abuse this ambiguity to further their interests.

Ultimately, that's my point. Are there any colloquialisms that everyone would agree can have only a single definition?

</comment></comment></comment><comment><USER19> I really loved to read "Everything is Obvious" (once you know the answer) book. [http://everythingisobvious.com/the- book/](http://everythingisobvious.com/the-book/)

</comment><comment><USER20> This is a pet hate of mine too. When I hear this phrase I'm automatically inclined to disagree. I mentally hear it as "I'm not prepared to think enough".

</comment><comment><USER21> As someone who worked on Open Mind Common Sense as a freshman, I should warn y'all that it accepted submissions from random people on the Internet and so contains many statements that are patently ridiculous.

</comment><comment><USER22> What on Earth does this website do to scrolling, and how can I stop it?

</comment><comment><USER23> It is common sense to think that the "common sense" of 2000 years ago was wrong. It should be common sense to think that common sense today is also likely wrong. :)

Oops.

</comment><comment><USER24> Common sense is the unsolicited opinion offered by a bystander, usually in hindsight and starting with the phrase "It's common sense that ..."

</comment><comment><USER14> What is common sense?

Recognizing that inane insoluble questions such as these surface again, and again, and again...

</comment><comment><USER25> It is the most uncommon thing of all.

</comment><comment><USER13> This is why web developers shouldn't be given control over scrolling.

<comment><USER6> Specially to create carousels. :)</comment></comment>


My Year in "Social Exile" - <AUTHOR> http://www.erickarjaluoto.com/blog/my-year-in-social-exile/ <comment><USER2> fwiw - if you like telephones - check the back pages of 2600 :)</comment>


Build your own bare-metal ARM cluster - <AUTHOR> https://blog.alexellis.io/build-your-own-bare-metal-arm-cluster/ <comment><USER2> One caveat when deciding on an ARM platform to adopt is the fact that someone needs to maintain a custom Linux branch for each individual SoC configuration.

That means you'll want to choose a platform that's very well supported by its parent company if you don't want to get stuck on an obsolete kernel in a year.

Hardkernel, who design and produce popular ARM SoCs, chose to produce x86 based platforms in the future for this reason.

<comment><USER3> While the article talks about not being able to run x86 binaries on Arm, this is the real drawback to the platform.

I really wish we would see a standard Arm kernel instruction set come along and get adopted by every manufacturer who isn't doing something unusual enough to justify a custom architecture.

<comment><USER4> The ARMv8 server platforms follow a common standard, SBSA. Which is essentially taking the most-hated parts of the x86 platform, ACPI and UEFI, but once you suppress the gag reflex it does get the job done, and you have a mostly x86-like experience that you just boot a generic armv8 distro and it all autodetects stuff on the fly and it all just works.

Haven't heard of any of the single-board platforms adopting it, though.

</comment></comment></comment><comment><USER5> This is going to be a stupid question...but what does clustering do? Does it increase the amount of "cores" in a system? What about the RAM? Or is the clustering software a task manager that allocates different boards as needed depending on the the task load?

<comment><USER6> There are no stupid questions. Clustering allows you to do more jobs at once than you could do with a single machine of the same power. It allows for redundancy if you set things up in such a way that if one hardware components fails another takes over. It can allow for better isolation between processes for security reasons than what a process isolated from another process on the same machine can give you. And many other reasons besides, so clustering is a technique that can give you many different benefits.

But...

There is a price to pay. Clustering isn't easy, convenient or without overhead. As soon as you cross the boundaries of what a single machine can give everything suddenly has a price, either in terms of latency, throughput, complexity or loss of control. Clustering software tries to hide some of this but under the hood these will always be there.

Here are some good hints about what limitations you are operating under no matter how good your distributed environment:

[https://en.wikipedia.org/wiki/Fallacies_of_distributed_compu...](https://en.wikipedia.org/wiki/Fallacies_of_distributed_computing)

[https://en.wikipedia.org/wiki/Amdahl%27s_law](https://en.wikipedia.org/wiki/Amdahl%27s_law)

<comment><USER5> Thank you for the explanation!

</comment></comment></comment><comment><USER7> We took "Show HN" out of the title above. Please read the rules: [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html).

</comment><comment><USER8> > You can't run binaries designed for a normal PC on an ARM board

...doesn't Debian ship some multiarch/QEMU/binfmt plumbing to make this work? Binfmt to taste the binary, see that it's i386/amd64, and then launch QEMU (and associated ARM multiarch libs) with user-mode emulation?

Slow as dirt I'm sure but it'll work.

<comment><USER9> Surely that does not qualify as "running the binaries" if you emulate another arch! I mean if you want to be nitpicky, yes, you're running them, but that is not what most people think when saying that.

<comment><USER10> ...but don't people/users speak of "running Java apps" all the time?

</comment></comment></comment><comment><USER11> Only practical reason I can recommend this would be either you'd like to experiment with cluster tools or connection outages (e.g. seeing how system tolerates when you unplug an ethernet cable).

Also, while OpenStack/K8 could seem to be a reason having something like this, I discovered it is a bit overkill for home needs. For that part, I'd go for a small server instead and manage it manually (no shame).

</comment><comment> noir-york I was looking for something similar earlier this year and ended up with SOPINE's cluster board. It only supports 7 ARM modules at a time but you can always stack multiple boards. Its also inexpensive. The SOPINE board I have has worked very well and recommend it.

[https://www.pine64.org/?product_cat=clusterboard](https://www.pine64.org/?product_cat=clusterboard)

</comment><comment><USER12> Also check out Rancher. Lite weight K8 for distributed IoT. Scaling to 1000s of ARM nodes, clusters morph into incredibly smart supercomputing grids ;)

[https://thenewstack.io/how-low-can-kubernetes-go-rancher- arm...](https://thenewstack.io/how-low-can-kubernetes-go-rancher-arm-team-to- find-out/)

<comment><USER13> (Disclaimer: I'm from Rancher Labs)

Unfortunately, none of the tech referenced in this articled is available yet and should be released end of February. There is a more interesting part that isn't referenced in this article and the is that we'll have two variants of k8s for ARM. One is RKE which is our CNCF certified k8s distribution. The other will be based off k3s (github.com/ibuildthecloud/k3s) which is an optimized k8s distribution for small clusters (smaller memory, easier setup, etc). I expected the second will be far more suited for something like this project.

</comment></comment><comment><USER14> It's too bad that OpenMosix withered on the vine. Back when it was a thing, I found it really handy to fire up clusterKNOPPIX on a bunch of idle PCs for large compile jobs.

I guess with today's multi-core CPUs, it wasn't thought to be worthwhile, but it could still come in handy for resource-constrained systems like the Pi.

<comment><USER15> I share your sentiment regarding Mosix. I don't think however, that clustering SBCs is of any value beyond the learning experience. Even a moderately powerful laptop is much faster than a *Pi, e.g. a 2013 Chromebook Pixel is about 16 times faster than a Banana Pi, when measured using `openssl speed`.

<comment><USER16> It depends when you're trying to do with them, but the network speed of the Pi is definitely a bottleneck for me. If it weren't for that, the throughput could definitely be used for some cool stuff even with modest CPU/RAM.

My cluster: [https://www.youtube.com/watch?v=lZDUe- _mzHc](https://www.youtube.com/watch?v=lZDUe-_mzHc)

<comment><USER17> Neat video. What cool stuff would you use it for?

</comment></comment></comment></comment><comment><USER18> Note that the Raspberry Pi can boot over PXE without an SD card these days, which should make for a much more reliable setup.

<comment><USER19> I found that to be extremely unreliable, I had to reset the Pi a few times before it actually made TFTP requests.

A tiny SDcard with just U-Boot on it, configured to netboot, has been actually reliable.

<comment><USER20> Unless you are running 3B+ pis, the firmware code for pxe booting has several bugs. Also, Pis have issues with retransmission of DHCP requests on low end network hardware that doesn't set link up fast enough to hear the Pis intial dhcp request. Almost all of these bugs are fixed one way or another at this point though, the github issue tracker for raspberrypi/piserver and friends has lots of info.

<comment><USER19> Yeah, (a while ago) I also tried just having the firmware update on the SD card, it was a bit more reliable but still far from 100%…

</comment></comment></comment></comment><comment><USER6> Neat! I built something like this long ago ([https://clustercompute.com/](https://clustercompute.com/)) to digitize a very large number of CDs for a Dutch broadcasting corporation. If I were to tackle that project today this is probably how I would do it.

</comment><comment><USER21> Wouldn't doing something like this with FPGAs be ultimately cheaper and more efficient. Sure, it will have a big overhead to learn, build and set up your FPGAs specifically for your problem, but that seems like a constant time overhead?

<comment><USER3> That assumes that the nature of the work load doesn't change over time.

</comment></comment><comment><USER22> "In my experience the 64-bit OSes all run much slower on the RPi3/\+ than Raspbian."

This should be backed up by some numbers. I have seen plenty of benchmarks now that pretty much show that many workloads on ARM64 are a lot faster.

</comment><comment><USER23> Given what the article says about k8s not working so well in the RPi's 1GB of RAM, is there another cheap ARM SOC that has more RAM available that could work similarly?

<comment><USER19> RK3328: Pine64's ROCK64 comes in 2GB and 4GB of RAM

(also the RK3399 based ROCKPro64 is even more awesome, bigger form factor, but two A72 cores for actually good performance! Oh and some other manufacturers even made RK3399 based RPi-sized boards!)

<comment><USER24> ROCK Pi 4, rk3399 based, comes in 1G/2G/4G ram, starting from 39usd.

[http://rockpi.org](http://rockpi.org)

</comment></comment></comment><comment><USER25> Definitely will look at K8s for my [http://parallac.org](http://parallac.org) clusters.

</comment><comment><USER26> I'm really grateful to Alex Ellis for his gist[0] to install kubernetes on RPis. I built my own 4 nodes cluster following this gist. It's been great to get my hands dirty with kubernetes

That being said, I had to buy an Asus Tinkerboard with 2GB RAM to serve as the cluster master because 1GB RAM was a bit short. My master node went below 100MB of free RAM and pod evictions (of kube-system pods) started to happen. If I were to do it again, I think I would use only Tinkerboards just for the convenience of having the same OS/hardware on each node.

[0] [https://gist.github.com/alexellis/fdbc90de7691a1b9edb545c17d...](https://gist.github.com/alexellis/fdbc90de7691a1b9edb545c17da2d975)</comment>


Sociopaths more likely to not wear masks - <AUTHOR> https://www.cnbc.com/2020/09/02/study-refusal-to-wear-face-mask-associated-with-psychopathy-traits.html <comment><USER2> Oh yeah this again. If anyone took the time to look at the original study, it's a matter of correlation being reported as causation.

[https://www.sciencedirect.com/science/article/pii/S019188692...](https://www.sciencedirect.com/science/article/pii/S0191886920305377)

~1500 people were given both a questionnaire about their opinions on covid containment measures as well as....to use a quote from the study

>answered facets from the PID-5, the Affective resonance factor of the ACME

They then took those that scored lower on certain traits, matched them with their answers on the covid questionnaire and drew the conclusion that those who disagree with lockdown measures are sociopathic.

This study is bad science, its conclusions are flawed and the news keeps spreading this utter bullshit as fact.

</comment><comment><USER3> This is akin to reporting water is wet...

</comment><comment> just-juan-post If everyone around you is an asshole then maybe you're the asshole.

If everyone around you is a "sociopath", then perhaps you are the sociopath. A sociopath who wants to control the actions of millions of others based on whatever news story scared you that day.

If your aim is truly about public safety then you need to crusade against alcohol instead.

</comment><comment><USER4> Science: psychology cannot be reproduced or validated, only observed and opined on

Media: pscyhology matters more than physics, it can predict everything, let's find correlations

</comment><comment><USER5> The actual article title: "Sociopathic traits linked to not wearing a mask or social distancing during pandemic: study"

Unfortunately for those with disabilities precluding them from wearing a mask --or who know that they do not have COVID or had it previously and have recovered, etc.--they now get a new insult lobbed at them by mask shamers: "sociopath". As if being called a "Karen", "anti-masker", etc. were not already dismissive enough.

<comment><USER6> What disabilities preclude wearing masks?

How does one know that they don't have Covid?

Do we know for sure that someone who previously had Covid cannot become a spreader again?

<comment><USER5> What disabilities preclude wearing masks?

\- PTSD (combat veterans, survivors of abuse, rape, kidnapping, etc.) or other mental health issues, facial injuries/deformities, lung conditions.

How does one know that they don't have Covid?

\- Testing; recovering from the virus and passing a test.

Do we know for sure that someone who previously had Covid cannot become a spreader again?

\- Not much data here that I've found, of course, since it is rare and new. One could be overly cautious because it is "novel" and assume that a healthy immune system could allow reinfection fairly quickly as there have been a few documented reinfections, or look at other coronaviruses (MERS/SARS) and assume that is more likely to take months to years to become infectious, after being infected again.

</comment></comment></comment><comment><USER7> Orange man bad</comment>


The Myth of Cloud Agnosticism - <AUTHOR> http://blog.reactiveops.com/the-myth-of-cloud-agnosticism <comment><USER2> I wrote this in a bit of a frenzy. I'm very curious as to the parts that folks collectively feel I got wrong!</comment>


188.8.131.52: The Story Behind a DNS Legend - <AUTHOR> http://www.tummy.com/articles/famous-dns-server/ <comment><USER2> Previous discussion: [https://news.ycombinator.com/item?id=1282213](https://news.ycombinator.com/item?id=1282213) (94 points, 1250 days ago, 39 comments)

</comment><comment><USER3> I noticed very strange but consistent performance behavior from Google Public DNS. Even though a DNS record was cached, the response time was in the range of 20-30ms, which is absolutely horrible. When I switched over to OpenDNS, cached response times dived down to 1ms. Needless to say just made the switch on all the servers to OpenDNS. Can anybody explain this behavior?

Here is the GitHub gist showing the output:

[https://gist.github.com/nodesocket/786e3b879f74c7787ca6](https://gist.github.com/nodesocket/786e3b879f74c7787ca6)

<comment><USER4> Where in the world are you? Do you have a traceroute to 188.8.131.52?

<comment><USER3> I am in DigitalOcean (San Francisco). The answer is simply distance/routing. I am guessing OpenDNS has an anycast node in DigialOcean (SF), where Google Public DNS does not. A ping tells the story.

ping 126.96.36.199 => 24ms

ping 126.96.36.199 => 1ms

<comment><USER5> A traceroute would tell the story better.

</comment></comment></comment></comment><comment> micro-ram There are different reasons to use the various dns servers:

Both Google (220.127.116.11 / 188.8.131.52) and OpenDNS (220.127.116.11 / 188.8.131.52) can be troublesome on small networks when trying to reach local LAN devices because they resolve failures to their own search pages. My fallback here is to always try one of the L3 servers (184.108.40.206 - .6)

OpenDNS is my goto when I need filtering. OpenDNS is also great when changing ip addresses on domains because you can clear their public cache and make sure everything is updated and is working immediately. [http://www.opendns.com/support/cache/](http://www.opendns.com/support/cache/)

Google DNS tends to make youtube streaming work much better for me.

Even Comcast has even recently changed their dns to memorable numbers 18.104.22.168 / 188.8.131.52

<comment><USER6> I have neither heard of Google`s DNS servers resolving failures to their own search pages, nor experienced it myself after using it since it`s release.

OpenDNS on the other hand...

<comment> micro-ram I stand corrected. Google does not respond to incorrect domains. I mistook the auto search from the address bar in firefox as similar behavior to OpenDNS.

<comment><USER7> I hope this comes across in the constructive manner I intend it: when I am curious about a network issue, especially DNS related, a browser is never the tool I use for asking such questions. If you're on a modern OS then "dig" is an amazing tool, and on that other OS "nslookup" will do in a pinch.

<comment> micro-ram There is a cache flush tool for Google DNS too!

[https://developers.google.com/speed/public- dns/cache](https://developers.google.com/speed/public-dns/cache)

<comment><USER8> I am reminded of the Apple slogan "Redmond, start your photocopiers!"

</comment></comment></comment></comment></comment></comment><comment><USER9> I've been using 188.8.131.52 on almost daily basis since 2003 - every time I want to see if I'm connected to the Internet, anywhere in the world - that's my canary.

It had never occurred to me to wonder _why_ I was using 18.104.22.168. Just something I learned from one our network engineers, who learned it from someone else...

</comment><comment><USER10> I started using 220.127.116.11 in early 1999. A friend of mine was a sysadmin at Genuity (then the new owners of that block) and they used it a lot internally. I went on to show it to a lot of my fellow sysadmins and I guess a lot of other folks did the same.

<comment><USER11> Not that anyone cares who wasn't there... BBN was purchased by GTE in 1997. GTE merged with Bell Atlantic to become Verizon. Genuity was spun off, and after it foundered ("Black Rocket") it was purchased by Level 3.

Prior to that, parts of BBN were sold off, and still exist as a subdivision of Raytheon.

Source: I was there for too much of it.

What we told people outside the company about 4.2.2.x: it's there, you can use it for testing or bringing up new systems, please don't use it long-term or heavily. It works by Anycast: let me tell you about that...

</comment></comment><comment><USER12> I did not understand why we shouldn't use 184.108.40.206. If they did not wan people to use it, why is it open? Too bad none of the reports the authors has read about that were linked.

<comment><USER13> The idea is that they can cut off access to non-Level3 customers any day if they wanted to, and they'd be within their rights to do so.

The proper choice would be to use Google DNS or OpenDNS which are provided as a service to the public.

</comment></comment><comment><USER14> Just imagine how much traffic they get.

If they really didn't want people to use it, I am sure it would be easy for them to block whole swaths of the net from using it.

<comment><USER15> They mean not to use it as your primary DNS server. Pinging it and using it for temporary DNS is likely fine, I wouldn't suggest statically assigning it for permanent use though.

</comment></comment><comment><USER16> Why 220.127.116.11 in particular for testing web service? Does MIT provide that IP as a public service?

<comment><USER17> _Google thanks MIT for granting permission to use this URL for the purposes of testing web connectivity._

That's from Google's help page† on using their public DNS servers, at 184.108.40.206 / 220.127.116.11.

†[https://developers.google.com/speed/public- dns/docs/using#te...](https://developers.google.com/speed/public- dns/docs/using#testing)

<comment><USER16> Thanks. The link from the original article that is probably supposed to go to that page is broken.

</comment></comment></comment><comment><USER18> Been using 220.127.116.11 (and 188.8.131.52) for almost a decade now.

In recent years I stopped using them though because of privacy and reliablility causes; I usually setup a caching server on the local host or network.

</comment><comment><USER19> Google should be tracking all the queries on their DNS server.

</comment><comment><USER20> Is there a tool for automatically benchmarking various public DNS servers (along with your ISP's) to determine the best choice?

<comment><USER21> Google has one of their own: [https://code.google.com/p/namebench/](https://code.google.com/p/namebench/)

</comment></comment><comment><USER22> I've been blocked by 18.104.22.168 before for (I assume) over-use. It took a year or two but they eventually noticed my traffic..

</comment><comment><USER23> I am curious if google is using the data from its dns service to improve the search index.

</comment><comment><USER24> I use 188.8.131.52 which is Google's public DNS</comment>


All Those New Dinosaurs May Not Be New Or Dinosaurs - <AUTHOR> http://fivethirtyeight.com/features/all-those-new-dinosaurs-may-not-be-new-or-dinosaurs/ <comment><USER2> > Scientists typically use the term "genera" as the plural of genus. We're > using "genuses" to make the connection between the singular and plural > clearer to folks who don't spend a lot of time reading up on taxonomy. > Please direct all complaints to Merriam-Webster.

That's a terrible cop-out. It's easy enough to type 'genera' (and it's shorter by one letter than 'genuses'!), and it's the proper word to use. It's obvious enough from context clews what it means. My goodness, what _do_ they teach in the schools these days?

<comment><USER3> They teach English in most English speaking countries. It's nice to know that the plural of "octopus" is "octopodes" if we happen to know all the correct etymology for all the languages that we don't learn but still loan words from as well as all the pluralization rules for all of those languages.

However, in English, the plural of something can be formed from the singular form by adding an 's' or an 'es' to the end and thus "octopuses" is completely fine _and_ has the benefit of being correct for English.

If you don't agree, and that pluralization in English should be etymologically dependent, quick, what's the correct pluralization for the following words?

\- Kimono \- Kimchee \- Dingo \- Brolga \- Dollar \- Polka \- Hula \- Clock \- Cosmonaut

should I go on?

<comment><USER4> You're right, but in the fields of biology, paleontology, etc., "genera" is the commonly used and technically correct pluralization of "genus." (For what it's worth, I'd make the same argument in strong support of "matrices" over "matrixes.")

Since this is a term of art, I'd argue it deserves less leniency than, say, words like "octopus" or "cyclops," for which "octopodes" and "cyclopes" are necessary only to score smartypants points among likeminded friends, and for which "octopuses" (but not "octopi!") and "cyclopses" are perfectly correct and acceptable in English.

<comment><USER3> So they definitely acknowledge that, but also are targeting an audience that probably isn't familiar with the jargon^H^H^H^H^H terms of art of this specific field.

Audience matters and when writing for a general English speaking audience, terms of art need to be either explained (boring) or translated. This author chose translation.

If fivethirtyeight.com was a life sciences blog, then this is definitely wrong.

I definitely am not on the side of proscribing one perfect kind of English, there are lots of beautiful variations of the language. But this use (and the footnote) are completely appropriate given the audience.

<comment><USER4> _" Audience matters and when writing for a general English speaking audience, terms of art need to be either explained (boring) or translated. This author chose translation."_

I agree that audience matters, but I'm not sure how using the proper term and footnoting an explanation would be onerously "boring." Different strokes for different folks, I suppose.

At the end of the day, I'm not overly bothered by it, one way or the other. These sorts of things always come down to prescriptivism vs. descriptivism, and that battle can become a holy war in certain circles. Not so much for me. Just chiming into an existing thread about the subject.

</comment></comment></comment></comment></comment><comment><USER5> I'm always amazed that we find even a single second example of a dinosaur.

It seems absurd mathematically. The dinosaurs were around for millions of years, evolving all that time. Unless there's a good reason to think the biosphere was less populous or diverse, we have to assume that there were billions of individual animals alive at any one time, split over millions of species. The number of species over the whole period has got to be up into the tens of millions at least.

We discover tens-of-thousands of sizable fossils, total, from that whole period. It's like a one-in-a-thousand chance that any new fossil discovery will match an existing species, yet it appears that most do.

I don't get it... anyone want to enlighten me?

<comment><USER6> If I had to guess, the types of conditions that collect and preserve fossils well enough for us to discover them are transient in nature (as in, it became suddenly covered by something like a landslide/water) or very geographically specific. This means there would be a bias towards whole-skeleton fossils during very specific time periods or very specific locations, rather than bits and pieces from thousands of different types all over the place.

Could be totally wrong though.

<comment><USER5> That makes sense. So we're not seeing a cross-section of the entire dinosaur era, we're just seeing a cross-section of the dinosaurs caught in the Burgess Shale, or whatever other specific circumstances caught the other examples.

This would make sense if all the examples of any given species came from the same site. Is that true?

</comment></comment></comment><comment><USER7> Haven't they been able to get some dna from dinosaur bones recently? That would really help. When genotyping first appeared many genus/species had to be recategorized.

<comment><USER8> DNA would be completely destroyed after less than 7 million years, sadly Jurassic Park will never happen

<comment><USER7> I went back and found the article from a few weeks ago. It was less convincing than I remembered. They found a pregnant dinosaur and they think there is new hope for finding DNA. They haven't actually found any.

[http://news.discovery.com/animals/dinosaurs/pregnant-t- rex-f...](http://news.discovery.com/animals/dinosaurs/pregnant-t-rex-found- may-contain-dna-160316.htm)</comment></comment></comment>


New Wordpress Default Theme for 2010 In Development - <AUTHOR> http://crenk.com/exclusive-new-wordpress-default-theme-for-2010-in-development/

<comment><USER2> For some reason it reminds me of the Thesis theme. Maybe the choice in fonts?</comment>


Enfield: a programming language designed for pedagogy - <AUTHOR> http://blog.fogus.me/2013/01/21/enfield-a-programming-language-designed-for-pedagogy/#body <comment><USER2> I started the article thinking it would be based on the ideas of LOGO, Etoys, or Scratch, with their heritage as programming for children, or ABC (precursor to Python) with its emphasis on developing a language which non- programmers/non-CS majors can more easily learn.

This essay even started nicely, saying "Imagine a programming language designed specifically for teaching young computer science students a solid foundation in sound computer science topics." My first CS class was in 9th grade, as I recall, so I thought the target audience was secondary/high school students.

But it quickly lead to statements without empirical justification, like:

> To start, I'm strong believer that when learning new, and at times complex > topics it's outright detrimental to overload students with frivolous syntax > rules. Therefore, Enfield is designed with minimal syntax rules and what's > more minimal than a Lisp like syntax.

Is that opinion backed by any of the decades of research on the topic? Additionally, FORTH is a more minimal syntax than Lisp, so why a Lisp-like syntax instead of a FORTH-like syntax?

It then went into things which made no sense for a high-school CS student, like bignums and tail recursion.

Only then it say "Key to any college programming course .."

Which means this is designed for an early undergraduate course for CS majors, and not what I was looking for.

(I work with programmers with no formal CS education. These are computational scientists. I chose first Tcl then Python in part because they are languages that non-CS majors could pick up without the "untyped lambda calculus." I'm interested in knowing if there's more research along these lines. Perhaps it could replace Python in the future.)

Perhaps for a CS major it is 'ideal' that "an introductory course would require students to not only learn a language, but to also create an interpreter for a subset of the language using the language itself." My first and only BASIC interpreter was written in BASIC. But I think it's reasonable to say that this is an opinion piece and not the direct of empirical research or based on a research review.</comment>


Ask HN: Would our world be better with wage ceiling? - <AUTHOR> <comment><USER2> Research tends to show that people are happiest (and most innovative) when the consequences of failure are low and the rewards of success are high.

You could see this in the US for a long time: if you truly failed, you were protected by bankruptcy and welfare. If you truly succeeded, you could make enough money that none of your descendants would ever have to work again. (Bankruptcy is one of the most important reasons for the success of the US, by the way.)

<comment><USER3> What about a very aggressive inheritance tax?

<comment><USER2> I don't know what effect that would have. I do know that some countries have very, very high capital gains taxes (30% or more) and no income tax.

The goal is that people who work and provide value are not taxed, and the wealthy are taxed while their money is doing the work for them (rent-seeking).

That's a great solution to the problem in theory, but it doesn't work very well in a modern economy. If capital gains taxes are too high, the wealthy will find ways to shelter their income from them.

<comment><USER3> Yes it's hard to tell what will work in practice.

I'd setup Seasteads with different taxation systems if I had the money, which of course nobody does.

Still an experimental approach is what's warranted. We wouldn't run a pharma trail without a control group on millions of people simultaneously.

</comment></comment></comment></comment><comment><USER3> No. Next question please.

Would the world be better off without taxation?

Yes. Yes it would.

If we could produce all the products/services the government needs to produce using Seniorage our economy would take off like a rocket forever.

Now fight me.

But I'm convinced that that's how you get from the world of Snow Crash to the Diamond Age. If it's not this, it's something like it.</comment>


Beyond Pandas: Spark, Dask, Vaex and other big data technologies - <AUTHOR> https://email@example.com/great-article-dd1b26e12530 <comment><USER2> Very thorough analysis, and very impressive perf by vaex, with simple (i.e. pandas-like) API.

</comment><comment><AUTHOR> API and performance comparison on a billion rows dataset. What should you use?</comment>


Ministry of Defence tested plague on public chemical weapons on soldiers - <AUTHOR> http://metro.co.uk/2015/08/09/ministry-of-defence-tested-the-plague-on-the-public-no-big-deal-5334056/ <comment><AUTHOR> More detail: [https://www.newscientist.com/article/mg22730301-300-secret-s...](https://www.newscientist.com/article/mg22730301-300-secret- science-deadly-experiments-done-for-the-greater-good/)</comment>


Why We Created Unidoc with Golang - <AUTHOR> https://foxyutils.com/blog/2016/11/11/unidoc-golang-pdf-open-source-library/ <comment><USER2> For the last few months, I've been using this in a few personal scripts. One example would be to enter a specific folder, get page 1-2 of each PDF within folder, combine all these pages into a new PDF.

Just wanted to say thank you for developing this.

<comment><AUTHOR> You are welcome. Absolutely thrilled to hear that you are using it :).</comment></comment>


Ask HN: What does tropo or twilio use for transcription? - <AUTHOR>

I assumed a custom CMU Sphinx setup, but it doesnt seem that there is a library large enough to support the accuracy they give out. Any ideas? <comment><USER2> Tropo uses Phonetag.com and Simulscribe to provide the actual transcription, and we've built a custom engine to handle the delivery and management of the transcriptions on the back-end.

</comment><comment><USER3> I'm wondering about this too. CMU Sphinx seems like the obvious solution. Maybe they bought a commercial Sphinx dictionary?</comment>


Shouldnot Facebook come out openly and apologize to the users? - <AUTHOR>

When you have a serious flaw like exposing private chats shouldn't you say i am sorry? Even Google did it.
Facebook Reaction: "For a limited period of time, a bug permitted some users' chat messages and pending friend requests to be made visible to their friends by manipulating the "preview my profile" feature of Facebook privacy settings. When we received reports of the problem, our engineers promptly diagnosed it and temporarily disabled the chat function. We also pushed out a fix to take care of the visible friend requests which is now complete. Chat will be turned back on across the site shortly. We worked quickly to resolve this matter, ensuring that once the bug was reported to us, a solution was quickly found and implemented."
Where is the apology here? <comment><USER2> Absolutely, but the corporate climate (for big web companies) is changing rapidly and such 'niceties' can now be dispensed with, after all, where are you going to go?

Even small companies seem to have lost the art of the apology, big ones rarely if ever did it in a meaningful way to begin with.

They're mostly sorry about the damage to their image, not so much that people's private data got exposed.

Wonder how long this was in the wild.</comment>


The 48 Laws of Power - <AUTHOR> http://www2.tech.purdue.edu/cgt/courses/cgt411/covey/48_laws_of_power.htm

<comment><USER2> Duplicate of <http://news.ycombinator.com/item?id=555691>

</comment><comment> chris-top Jeff Greene thinks so anyways.</comment>


Ask HN: Most important KPIs for first 100 customers - <AUTHOR> For several past projects I've struggled a bit to determine what should be the most important things to focus on. Should it be (new) visitors, conversion rate, app/website usage, retention, user satisfaction, all of those..
I'm guessing that on the one hand it would be best to keep tabs on everything, but at the same time that causes you the lose focus. At least I've notived that I'm most productive when I focus on one thing at a time.
An alternative would be to regularly switch between the different KPIs (Key Performance Indicators, I'm using the term loosely here).
So, what do you consider the most important KPIs for the first 100 users (and which tools do you use to track them)? <comment><USER2> Tools add value but don't be too obsessed with them including KPIs. You need to ensure that as a business, you are getting the type of clients you want. Then, you need to ensure that those clients are happy with your product/service. Listen to them and enhance your product/service accordingly.

Also learn from your mistakes. If you had that one really bad client, look at why there were bad to you. Avoid those mistakes next time. Document it, tell your team whatever. If releasing a critical feature broke things in production, again learn from it. Why did that happen and what can you do to minimize the risk of that happening again ?

If a client leaves, ask them why they left and what could have been done to keep them with you ? Sometimes, the answer is just "I don't need this anymore" but a lot of times you will hear things like "You guys don't have this thing that I really need" or "I need better support", "too expensive for me" etc. Anecdote: I have been successful in retaining a few clients by offering reduced pricing but with reduced features as well because they didn't really need all that fluff.

</comment><comment><USER3> At 100 users, I'm most concerned with how quickly/easily I can get them on the phone, then how much they talk when they're on the phone.

At that stage, I'm still proving out an idea so having focused users who not only like the app enough to talk to me but who have ideas on how the make the app better is a sign I'm on the right path.

If getting in touch with my first 100 wasn't an option, I'd look for signs they were actively using the app. I would want to find out if the app was indispensable for my users. Sadly, I can't think of a better way to collect that than by picking up the phone.

PS - If you find talking to users tough, reach out and I'd be glad to help you write a script. It sounds phoney, but a good script will help you get through your first three calls. You'll be rolling after that!!

</comment><comment><USER4> It totally depends on your business model. Is your expected ARPU 10, 100 or maybe 1M?

I'd personally focus on a KPI that tells you something about how much your customers like your product, and can't live without it. Aim for turning even a few of them into evangelists. Retention is the main force driving that.

But once you get that deep, it's just as easy to implement a full AARRR funnel that will give you much more insight.

</comment><comment><USER5> It really depends on your app. I would say the most important metric is the number of customers willing to pay for your product happily.</comment>


SVGnest: Efficient packing of irregular shapes with JavaScript - <AUTHOR> https://github.com/Jack000/SVGnest <comment><USER2> OP here. I'm a pretty big CNC enthusiast and part nesting is a problem I face regularly. The software that does this is all pretty expensive and I couldn't find an open source implementation, so I decided to write it myself.

Try it out and let me know if you have any feedback

<comment><USER3> I was just about to ask what practical applications does this have, CNC milling totally makes sense :) Are there any others?

<comment><USER2> laser/waterjet/plasma/knife cutters, though technically they are CNC machines as well. It's useful whenever you need to cut a large number of parts (eg. laser cutting a paragraph of text from a piece of acrylic for an led display)

The biggest value-add is in industrial applications, where efficiency is much more important. I guess that's one of the reasons that the existing software is typically very expensive or "call us for the price" type deals.

</comment></comment></comment><comment><USER4> I'd think you'd get a better result from simulated annealing over GA here.

</comment><comment><USER5> This is an impressively cool thing that I've never even thought about. Really neat that a hobbyist result is comparable (better in the example!) than the commercial product.

</comment><comment><USER6> This is awesome, thanks for sharing!

I'll dive into the implementation a little more shortly, but just wondering how easy it is to add additional constraints (for example, that pieces need particular orientations)?

Edit: Oh, I see there's a "Part Rotations" parameter. Excellent!

</comment><comment><USER7> Finally a github repo with a decent description of the algorithms used!

Very nice work. Thanks for sharing!

</comment><comment><USER8> Love it, great job! How long did it take you to get it up and running?

<comment><USER2> I started in November and worked on it off and on. I guess about a month of work. The NFP generation algo is fairly complicated, that took most of my time.

</comment></comment><comment><USER9> would this include Letters? this might be a great tool for making word clouds

<comment><USER2> Tagxedo [http://www.tagxedo.com](http://www.tagxedo.com) seems to do a pretty good job with word clouds. SVGnest could in theory make word clouds, but the placement rules would need to be changed to optimize for perceptual qualities rather than packing compactness.</comment></comment>


TextCaptcha: Simple Textual Captcha Challenges - <AUTHOR> http://textcaptcha.com/ <comment><USER2> My only contention with text captcha apart from those of bots is that these require you to be able to read, understand and know the answer of the question, and that too in the language that captcha is being served.

This might sound like a nonexistant issue, but lets take the example of a country like India with a huge number of internet users. There are many who use the Internet without being completely literate in English or even their mother tongue. Use cases like checking exam results, train tickets etc require captchas to be filled and the normal deformed letter ones do well. I doubt text captchas will be accessible to them.

But then again, user base matters a lot too and that should be taken into account always!

<comment><USER3> I was looking through the examples, and for a large percent of the users I deal with in the US, these questions would be too difficult.

I had a user struggle to find the exclamation symbol on the keyboard.

</comment></comment><comment><USER4> There certainly is some benefit of this, but the barrier for bots is low. All it needs is a custom bot that can be written in minutes.

Because it seems to use a fixed set of question types. All of which a simple script can solve.

Example:

        What is Mark's name?

Writing a script that extracts the name from this string is trivial. And the other question types are similarely easy.

The next step would be to allow the site owner to put in domain specific questions. For example a chemistry website might ask "What is the formula of $moleclue?". And then provide ['Water'=>'H2O','Salt'=>'NaCl'...] as questions. Then the site would be protected from a general textcaptcha solver and bots would have to be customized for each domain.

<comment><USER5> I like the idea of domain specific questions, but I also think that questions are the biggest added value of this API. If you have your own list, then you can implement your own "captcha" pretty easily.

</comment></comment><comment><USER6> The value here is not that they are easily solvable, with enough effort your could probably write something that solves these too. Thing is, are you willing to go through that effort for something that only a few sites use?

This is in contrast to ReCaptcha, which is used my millions of sites, so using crowdsourcing and systems to make them easy to use is worth it there.

For a long time I used the fixed captcha, "What is 1+1?", but written in my local language, and managed to filter out all the spam...

<comment><USER7> Custom captcha is not very hard to implement. But for some reason very few sites actually use it, is it that we don't believe in the ability to write a few questions with honey pots or just overconfident that the Google service is the only one that people could use?

</comment></comment><comment> nils-m-holm I like the idea because, according to ReCaptcha, I am officially a bot! And it works! Whenever I see one of those, I just close the tab and go away.

</comment><comment><USER8> I found the Adafruit "what size is this resistor" captcha pretty clever: [https://blog.adafruit.com/2010/04/21/resisty-resistor- captch...](https://blog.adafruit.com/2010/04/21/resisty-resistor-captcha- solve-the-resistor-values-to-post-a-comment/)

Not suggesting it's broadly useful, but cool nonetheless.

<comment><USER9> I'm personally a fan of Lichess's "mate in 1" captchas.

<comment><USER8> I'm crap at chess, but there's this: [http://tetration.xyz/ChessboardFenTensorflowJs/](http://tetration.xyz/ChessboardFenTensorflowJs/)

</comment></comment></comment><comment><USER10> > The answers are provided as MD5 checksums of the lower-cased answers which > allows you to compare a users response with the answers without explicitally > [sic] knowing the answer yourself.

Why bother? All the hashes I tried were able to be instantly cracked online by CrackStation.

If the hashes are kept server-side, then why not use plaintext?

<comment><USER11> Not only, it suggests the false impression that people can do it all client side... If you're sending the answers over the wire, they can simply be sent back to you without any real computational effort. No clever text processing required.

Keeping it in plaintext would have made doing this being dumb more obvious. Heck, two separate files would have even been better. Also you can do something like damaru levenshtein [1] on plaintext so you wouldn't have to be a stickler for exact matches

[1] [https://en.m.wikipedia.org/wiki/Damerau%E2%80%93Levenshtein_...](https://en.m.wikipedia.org/wiki/Damerau%E2%80%93Levenshtein_distance)

</comment></comment><comment><USER12> Are new questions being continually added to the database of challenges? If not, one can quite simply request many challenges, have a human solve them, and remember the answers.

If you generate the questions based on fixed rules, it is only a matter of time before an algorithm or a human figures out all the necessary patterns.

I personally feel like these text puzzles aren't as energy-draining to solve as reCAPTCHA, so a human could reasonably solve many hundreds in an hour of free time or so. That doesn't even include having a TTS engine dictate the question to Google Assistant.

<comment><USER13> You leave this implication that modern "hard-to-crack" Captchas are somehow different when in reality when reCaptcha and co are cracked to death and you can literally buy 5000 captcha solves for less than 5 USD.

Captchas in general are a bit of an illusion really. The best Captcha you can have is a home-made one as the attacker has to go through actual manual effort rather than enabling --solve-recaptcha flag on the bot script.

<comment><USER14> I feel like there are orders of magnitude differences in cost and effort between "completely free because you downloaded a library" and "$5 per 5k and there's a few HTTP requests in there too"

<comment><USER13> Is there though? Whom are you protecting yourself from? People who write curl scripts or serious attackers? Surely if someone wants to commit to an attack $5 is completely neglectible amount of money, right?

All you "protect" yourself from is casual script users and script kiddies which really can be solved by IP rate limit. If someone has access to thousands of IPs they can probably afford to drop $5 to solve the captchas too, right?

<comment><USER15> Having written code to bypass captchas, up to and including Google ReCaptcha: yes, there is a difference. A large difference.

$5 _per request_ is not a negligible amount of money. In practice it doesn't cost anywhere near that amount to call a MechanicalTurk API which will solve ReCaptcha for you. But it's still significant for any nontrivial number of requests, such as in the use case of scraping.

You should adjust your priors here. You're focused on the narrow case where a win condition is achieved by spending _n_ dollars to solve a single instance of ReCaptcha. People who use ReCaptcha are (in my professional experience) overwhelmingly more focused on requiring ReCaptcha to be solved for every individual request of a given type.

I have been in the position you speak of, where I had a revolving set of IP addresses, requesting servers and user agents, and $5 per request would have immediately shut my operation down. As it was, the actual ~$0.15 per request to solve ReCaptcha was sufficiently significant that I couldn't curate enough data for what I needed, despite having all the other resources you mention.

<comment><USER16> The cost mentioned upthread was $5 for 5000 requests, or 0.1 cent per request. Would that have allowed you to collect the data you wanted?

<comment><USER15> Possibly, I no longer do that work. But that was never the price I saw for the service. Cheapest I ever saw was still 10 times that, and requests frequently had to be resent due to spotty completion.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> A neat way to improve on this would be to get a series of 3-5 challenges, especially if it's something like math and logic puzzles that build on each other, so it's a multi-dimensional problem, so it's difficult to cache or precompute.

The hash of the answer is just a string that concatenates the answers, and the challenges always mixes them in different orders. One possible example:

1\. Does Red combine with Yellow to make Green or Orange? 2\. If the answer to the last question was reversed, what letter would it start with? 3\. If you added that latter to the end of these words, which word would be most edible? Mac, Nam, Pi, Snak

answers: orange,e,pi

Of course, you'd want to design the interface to support multiple choice selection.

I would also recommend against using MD5, since, even if the hash weren't known to the end user, which should be sufficient even in this case, the attack MD5 is most known for is the fact that it's trivial to generate text that could match any given hash, regardless of what was used to originally make it. It seems like a potential attack vector somehow, depending on the case, and it's not terribly harder to just use one of the many tried-and-true, known-not-broken cryptographic hashing algorithms. SHA-256 would be adequate.

I'm not 100% certain of all the logic behind this, there's always cases I'm not rigorous to consider, but I'd be interested in seeing how others might improve this approach in similar ways.

<comment><USER18> > it's trivial to generate text that could match any given hash

Source on this?

Wikipedia states what I have heard before which is that MD5 collision attacks are pretty trivial now, but carrying out a preimage attack as you describe remains theoretical at this time.

[https://en.wikipedia.org/wiki/MD5](https://en.wikipedia.org/wiki/MD5)

<comment><USER19> There is a way to defate this that is much simpler, in the examples on the page 5 out of 7 examples has the answer in the question. Just do MD5 sum of every word/combination of words in the question and you would find the answer to many of the questions. This together with a targeted dictionary would propbably give you a very high success rate for little cost. MD5/SHA-familly hashes are inexpensive to compute, you can do billions of the in a second. If you cant find the answer, then just request a new challenge untill you find one you can answer.

</comment></comment></comment><comment><AUTHOR> Some interesting "behind the stage" insights about this post.

I've posted this a couple months ago. Just before christmas, I've received an email from the mods asking me to repost, as they thought the story was interesting. Initially after reposting, it didn't get much traction, but, when I look at it now, it actually has upvotes. However, the number of upvotes it has is much bigger than the amound of Karma i received. I wonder how correlated this facts are.

</comment><comment><USER20> As recognized, captchas are not effective in keeping determined people out. Nowadays the method to put some price tag for access seems to be to use SMS verification.

However not everybody is very determined. There are for example bots that are using the comment forms to send spam. The expected payout for each posted message must be really, really low.

This could be useful for example in the comment form plugins created for various content management systems.

</comment><comment><USER21> TextCaptcha can be a viable alternative to reCAPTCHA depending on the type of service you're protecting, and it doesn't come with the privacy drawbacks of Google's catch-all privacy policy. The personal data collected by the reCAPTCHA service is not clearly distinguished in their privacy policy [1], and there are no tools to exercise control over the data gathered by reCAPTCHA.

W3C has put together a comprehensive document about captcha types and their application: [https://www.w3.org/TR/turingtest/](https://www.w3.org/TR/turingtest/)

[1] [https://policies.google.com/privacy?hl=en](https://policies.google.com/privacy?hl=en)

</comment><comment><USER22> This seems like exactly the sort of questions a big language model a la GPT-2 would be able to answer.

I'm curious how TextCaptcha would fare in terms of complexity compared to the other language understanding benchmarks.

<comment><USER23> Honestly, someone willing to spend effort & time & resources on a big language model will have enough resources to find other ways to access whatever they are hoping for, similarly how they can buy ReCaptcha solve services. So, in a sense if that is your threat model, you need multiple traps, neither of these will suffice alone. :)

</comment></comment><comment><USER5> This will work well as long as it's a niche captcha and creating automated solver it's worth the effort. Hardcoding something in JavaScript what will be injected to all form submits is even simpler and doesn't require anything from your users. It will work as long as bots don't execute JS or someone is willing to spent some time on modifying the bot.

</comment><comment><USER24> How many of these logic questions are there? After refreshing [http://firstname.lastname@example.com](http://firstname.lastname@example.com) about a hundred times, I'd estimate there are about 50 questions. Someone could write a script that solves each particular question manually.

</comment><comment><USER25> I created something similar for my personal website. I don't get spam comments, but I think that's only because I'm too small to be worth the effort for spammers. It would be pretty easy to pattern-match the few different question types and find the right answer using a dictionary.

</comment><comment><USER5> I just did some statistic and "four" is correct answer to 8% of questions.

</comment><comment><USER26> > The answers are the MD5 hashes of correct lower cased answers: you should be > able to check responses from real users you challenge with the question > against these checksums.

That's a somewhat concerning choice of hash function. MD5's collision resistance is broken. It is well known to be broken, for more than a decade.

There's references to PHP on the page. 10 years ago [0] this message appeared in PHP's manual:

> The well known hash functions MD5 and SHA1 should be avoided in new > applications. Collission attacks against MD5 are well documented in the > cryptographics literature and have already been demonstrated in practice. > Therefore, MD5 is no longer secure for certain applications.

[0] [https://www.php.net/manual/en/function.hash.php#94104](https://www.php.net/manual/en/function.hash.php#94104)

<comment><USER27> Collision resistance is irrelevant if there's already a hash value specified. What matters here is being able to find preimages for a given output, and even if MD5 had a practical preimage attack, it would be too expensive to use just for cracking captchas. :-)

PHP is a red herring; this would apply for any language.

<comment><USER26> > PHP is a red herring; this would apply for any language.

I used the warning from the PHP manual, because the site creator should be familiar with it.

You'll find similar warnings against MD5 everywhere.

</comment></comment></comment><comment><USER28> I like the use of MD5 hashes to make it stateless, you could also test on the client side before sending the form, its so annoying for the full form to be rejected because I couldn't guess the captcha.

<comment><USER29> This is also an attack vector that the article mentions. If you have logic on the client-side that can tell if the captcha is correct it lets an attacker brute-force it. (Basically as far as I see you can't send the hashes to the client without opening up this vector.)

<comment><USER28> True, I thought about scrypt and salts to slow down a brute force but for a 5 letter captcha I guess the search space would be too small no matter what you did.

</comment></comment></comment><comment><USER30> How about keeping the same idea of a different question every time but mixing in some images? Like:

"How much is one + (image depicting a 6)?

<comment><USER31> It wouldn't be a text captcha, then.

It would certainly lose utility for visually-impaired users.

OCR is pretty well advanced by now; the image captchas that used to rely on it now use extremely distorted images.

<comment><USER32> Try solve using OCR next:

> _How much is one > +[https://i.imgur.com/VbyiURo.png](https://i.imgur.com/VbyiURo.png) _

<comment><USER31> Apparently I'm a robot. I can't add one + owl + owl and type in an answer I expect to have recognized.

</comment></comment></comment></comment><comment><USER33> Isn't there any kind of problems that can be automatically generated but can't be solved reliably by machines?

<comment><USER34> Winnograd Schema Challenges would be a step further for these text captchas. They are asking you to identify an ambiguous pronoun in a statement.

Examples:

\- The man couldn't lift his son because he was so weak. Who was weak?

\- The firemen arrived after the police because they were coming from so far away. Who came from far away?

\- The drain is clogged with hair. It has to be [cleaned/removed]. What has to be [cleaned/removed]?

They are crafted in such a way that there are two variants of the challenge every time. Ex: The man couldn't lift his son because he was so heavy. Who was heavy?

I don't know if they are hard to generate automatically. They do require common sense to solve and it's still an open problem.

[https://en.wikipedia.org/wiki/Winograd_Schema_Challenge](https://en.wikipedia.org/wiki/Winograd_Schema_Challenge)

</comment></comment><comment><USER35> interesting idea. the fact that I have never encountered one of these in use suggests that they don't work well enough.

<comment><USER36> This is true for any new product

<comment><USER37> I've seen stuff like this in use for domain specific knowledge for forums for years - either there is a near infinite question pool or you're reduced down to something that's broken easily given a site-specific bot.

<comment><USER38> Over 10 years ago, off the shelf forum spam software, Xrumer, would build a database of these questions for you when it detected the field on a /register page. Since basically every website has a small, finite pool of questions (usually just one), you'd just sit down, answer them all, and then click "resume".</comment></comment></comment></comment>