That Whining Sound You Hear Is The Death Wheeze Of Newspapers - <AUTHOR> http://www.techcrunch.com/2009/04/07/that-whining-sound-you-hear-is-the-death-wheeze-of-newspapers/ <comment><USER2> I'm kind of curious how many people would pay a monthly or annual subscription fee for a "newspaper" that came out in electronic and/or premium print format only to subscribers, published an edition whenever the hell it had enough to publish it and contained hardcore journalism geared towards ending waste, fraud and abuse and informing the public of bad actors.

It would be pirated, but the pirates would always get it a little bit later and the print copy would be ad free. Some kind of premium channel blog service would let subscribers follow the work of the journalist, side notes, follow-up ideas, etc. up to the point where it's not compromising the integrity of the work.

Something like that. I'm eager for any ideas people have that will get the civic activism back in newspapers and kick the cruft out. I don't think they actually need to come out on a fixed schedule and I really don't think they need to cover lifestyle, sports and other things the way they do now. They need to focus on stuff that's not easily duplicated and they need to take their time really kicking some ass. The Internet can pick stuff up from there and expand the impact.

</comment><comment><USER3> People don't like their labor going to someone else's profit.

</comment><comment><USER4> Startup Ideas We'd Like to Fund - Paul Graham - July 2008

<http://ycombinator.com/ideas.html>

"#3: New news. As Marc Andreessen points out, newspapers are in trouble. The problem is not merely that they've been slow to adapt to the web. It's more serious than that: their problems are due to deep structural flaws that are exposed now that they have competitors. When the only sources of news were the wire services and a few big papers, it was enough to keep writing stories about how the president met with someone and they each said conventional things written in advance by their staffs. Readers were never that interested, but they were willing to consider this news when there were no alternatives. "

<comment><USER5> I wonder how many news related startups applied.</comment></comment>


Yelp Prison Review Faxbot - <AUTHOR> http://lav.io/2014/11/yelp-prison-review-faxbot/ <comment><USER2> But what of possible negative repercussions? I imagine that prison administrators that get poor reviews on Yelp are more likely than average to respond negatively to reviews received, and more likely than average to expend a lot of energy figuring out (even if they are wrong) who wrote the review, and exact revenge upon them.

It would be less snarky, but maybe it would be better to send these faxes to state/federal elected representatives that could act to change things for the better, and that would (generally) have less motivation to seek revenge?

<comment><USER3> Off the top of my head I imagine that most prison administrators are political appointees and probably know far less about the actual conditions of the prison and are less removed from the day-to-day running than one might expect. They have the ability to enact top-down changes in operations, but generally have no motivation to do so. I would think feedback like this would be quite valuable to them, so they could gain a perspective on what's going on that isn't coming from their direct reports.

<comment><USER4> that's quite an imagination you have.

<comment><USER3> Thanks. I don't particularly care about the topic, otherwise I'd go about fleshing out my musings with actual information. In this case I might use Quora to validate the basics and then spend some time on Google to answer particulars as I think about them.

But I'd say a good imagination is a necessary tool if one wants to understand the world. Without it, I wouldn't know where to start a search. Here I made my work available for others who might want to build on it, since I'm not all that interested in it.

<comment><USER4> Hey, don't let your absence of caring about the topic, or lack of "actual information" stop you from sharing on HN the things you imagine based on no actual information or experience! You might not care to spend the time to learn anything about what you're talking about, but you can still spend time sharing your uninformed 'musings' on things you "aren't all that interested in" with HN! Keep on rocking!

<comment><USER3> Read the thread again, I think you'd find that my contribution to this topic has been more constructive than yours.

</comment></comment></comment></comment></comment></comment><comment><USER5> Pretty sure this violates the Yelp TOS. Certain it violates good taste.

Friend works as a psychiatric counselor in a max security facility for 20 years. Commutes 2 hours to and from work for safety reasons. Amazingly decent fellow. Really cares. Really tries to do the right thing.

I showed him this and his reply? "Fuck those guys."

From a job description: "Specific safety and security duties for wardens include approving security policies, assessing safety and security systems, managing internal investigations, managing prison intelligence operations, ensuring facility compliance with applicable standards and overseeing inmate classification systems. Human resource and budget duties include interviewing applicants, conducting staff development, promoting career advancement, compile budget requests, maintain staffing within financial constraints and set budget priorities, according to ACA. Correctional employees, including administrators, operate in a dangerous environment where inmate assaults and more dangerous incidents, such as riots, are a threat. Managing critical incidents is a significant part of a warden's job. Duties include drafting and reviewing emergency plans, ensuring the readiness of response teams and implementing emergency plans when an incident arises."

The last thing these people need is automated FAXes scraping one of the least reliable services on the web. It's shameful.

<comment><USER6> Your comment is spot-on imho.

I have done time in 6 state prisons, 2 federal prisons, two federal detention centers, and several county jails. As long as the inmates aren't killing each other, the warden/superintendent/sheriff doesn't care overmuch what goes on inside regarding the inmate experience.

That is, unless it makes him look good.

</comment></comment><comment><AUTHOR> I'm assuming this is a half-facetious joke from the creators, but its core intent is sound: valid feedback doesn't always get to the desk on which the buck stops. Not necessarily out of a pursuit of "see no evil, hear no evil..." but just because there's too much noise in the overall dataset of complaints/opinions, and not enough tools or efforts to filter and sift for possible leads. The recent GM recall debacle comes to mind, in which 260 complaints purportedly related to ignition problems were submitted to the NHTSA yet apparently not acted on [1]. The NHTSA's defense is that 260 complaint records is not statistically significant...but...by their criteria, it seems that a lot of complaint trends would fall in that category. The bigger issue is that not enough information is gathered about the complaints to make an informed decision about recalls. Sure, but can the regulators (or carmakers) honestly say that the people who would prioritize such fact-finding are fully aware of what the complaints data (all which can be downloaded by anyone from the NHTSA website [2]) contains at any given point? It's not about taking action when the truth is encapsulated perfectly in a database, but making the effort to sift that database efficiently for leads.

tldr: there's a lot of room for improvement and innovation in filtering feedback for further investigation and action, not just in prisons but much of the public sector.

(for simplicity's sake, I'm ignoring the obvious factor of companies/regulators deliberately and maliciously not giving a shit/covering- things up...which is of course, always something to be aware of)

[1] [http://www.nytimes.com/2014/03/09/business/auto- regulators-d...](http://www.nytimes.com/2014/03/09/business/auto-regulators- dismissed-defect-tied-to-13-deaths.html)

[2] [http://www-odi.nhtsa.dot.gov/downloads/](http://www- odi.nhtsa.dot.gov/downloads/)

</comment><comment><USER7> I thought there were some rules passed years ago regarding unsolicited faxes, due to the costs in paper and ink they incurred. I remember the topic coming up in the late 80's or early 90's I think.

I wonder if this use falls under those rules?

[https://www.fcc.gov/consumers/guides/junk- faxes](https://www.fcc.gov/consumers/guides/junk-faxes)

<comment><USER8> Of course not. It's not in any way an advertisement.

<comment><USER9> It's an advertisement for Yelp, would it matter that Yelp's not sending it?

</comment></comment></comment><comment><USER10> Cute, but I'd be concerned that automated unsolicited faxes are not necessarily something that people want to receive.

<comment><USER11> I'm pretty sure that every company with a fax machine whose number isn't private is accustomed to receiving "automated unsolicited faxes". At $work, we receive just as many (if not more) spam faxes as we do legitimate ones. People just toss 'em in the trash and don't think twice about it.

<comment><USER12> I worked for a few months in a research facility in the UK, and had a fax machine on a desk next to me. Once a day, it would turn itself on and print out an ad for a car, or insurance, or something. I was shocked to discover that spam is a thing on fax machines.

<comment><USER13> Spam has been a thing on fax machines since long before Canter and Siegel's infamous green card spam on Usenet (1994; it wasn't the first, but it was the first truly major spam)..

</comment></comment></comment></comment><comment><USER14> I think this is really great. How often do we as a society take the voices of prisoners seriously? It's kind of interesting to see a "view from below." Very cool work.

<comment><USER15> Do you expect people should like prison? Prison would not be much of a deterrent if it didn't get 1 star from just about everyone in terms of the experience. In terms of dealing with actual abuse of prisoners, the courts are a far more robust system for dealing with complaints.

<comment><USER16> The US has a brutal prison system where prison rape and sexual assault is routine.

The US also has a huge prison population and recidivism is high, so the brutality of the system doesn't seem to work much as a deterrent.

<comment><USER15> How do yelp reviews address this problem?

</comment></comment></comment></comment><comment><USER17> I teach computer science at a prison on a volunteer basis, and occasionally I've had to use Google Maps to get directions. Always amusing to see some one- star reviews of it as I find the address.

</comment><comment><USER18> "Would not recommend to a friend..."

</comment><comment><USER19> This is so cool. Wish we saw more stuff like this on HN. Also liked the other projects you have listed on your site.

</comment><comment><USER20> Authors here - if anyone has any questions or critiques please let us know.

</comment><comment><USER21> i think this is rad.

</comment><comment><USER4> this is good art.</comment>


The Incredible Growth of Python - <AUTHOR> https://stackoverflow.blog/2017/09/06/incredible-growth-python/ <comment><USER2> Extensive past discussion: [https://news.ycombinator.com/item?id=15186025](https://news.ycombinator.com/item?id=15186025)</comment>


Men should avoid rock music when playing board games, say scientists - <AUTHOR> http://medicalxpress.com/news/2016-12-men-music-board-games-scientists.html <comment><USER2> How is Operation in any way representative of "board games" as a whole?</comment>


New improvements to Twitter for Mac - <AUTHOR> http://blog.twitter.com/2013/04/new-improvements-to-twitter-for-mac.html <comment><USER2> I was a great fan of Twitter for Mac, but their stewardship of it was terrible. It was left in a prolonged state of abandonware, not even supporting Twitter's new picture hosting service for over a year after it was available.

So no matter how cool or good it may be, they have some credibility to earn back before I let myself get attached.

Meanwhile, I have cheerfully paid $20 for TweetBot, which has enjoyed ongoing development since its introduction. It's a terrifically designed app with a solid, easy-to-use UI and powerful multi-account features. I understand TapBots incentives better than Twitter's, so I'll be sticking with TweetBot for now.

<comment><USER3> I would have to agree. TweetBot is worth far more than $20 in terms of quality and usability. I just hope they don't turn out like Tweetie. The iOS app is phenomenal as well.

</comment></comment><comment><USER4> So, call me cynical (I have been called much worse), but my immediate reaction is to wonder whether I should upgrade--what Twitter has done to make it a worse experience for me to use. That seems to be the overarching MO for stuff like this. I mean, I'm using Twitteriffic right now anyway, but still, I'm sure I'm not the only one wondering if they've hosed yet another of their first-party apps, and that can't be a good thing.

(EDIT: All that said, I just downloaded the Twitter update just out of curiosity, and it's actually pretty nice! I haven't yet seen any regressions from the previous version. And I haven't seen any sponsored tweet crap, but it's only been a few minutes.)

<comment><USER5> I haven't used the official Twitter app in a long time, so my memory could be failing me, but I'm pretty sure I remember seeing sponsored tweets even on the old version. I thought that was the reason I stopped using it.

</comment></comment><comment><USER6> Whoa, I thought they'd killed future development of this.

Edit: [http://9to5mac.com/2012/09/06/twitter-makes-the-decision- to-...](http://9to5mac.com/2012/09/06/twitter-makes-the-decision-to-stop- development-and-future-updates-for-twitter-for-mac/)

<comment><USER7> Same here - I was quite surprised to see this update.

</comment></comment><comment><USER8> As a Windows and a Linux user, it's really weird to see people here complaining about how long it took for Twitter to release this app. At least Mac has a proper app (and a lot of awesome alternatives). Consider yourselves lucky. I'm not saying you people have no right to complain, but at least you have something to complain about.

And yes, I'm aware of Twitter for Windows 8, Tweetdeck and Metrotwit. They all suck and I've complained about them long enough.

</comment><comment><USER9> New Twitter for Mac doesn't allow you to change accounts while composing a tweet, making my job providing user support over Twitter harder.

Also odd that Twitter for Mac is retina but Twitter for Web is not.

EDIT: @couch mentions that you can use ⌘⇧] and ⌘⇧[, which is less than ideal but makes it possible to switch between accounts. But I still miss the old drop-down which just required one mousedown and a corresponding mouseup on the selected account.

</comment><comment><USER10> If you want a really nice OS X twitter client with tons of features, check Yory Fukurou <https://sites.google.com/site/yorufukurou/home-en>

My favorite thing about this client is the "mute" feature. You can mute by users, keywords, RegExp and applications.

<comment><USER11> Yoru Fukurou.

Yep, it's my go to client although the developer isn't big on responding to user requests and it's a bit funky for OS X UI.

</comment></comment><comment><USER12> What about ads (sponsored posts)? Are those in there now?

<comment><USER13> Haven't seen any yet and I've been using it all morning.

</comment></comment><comment><USER14> That's weird. They didn't publish any update since 2 years. Anyone thought it was really dead and Twitter made this in order let the user switch to twitter.com.

<comment><USER15> I did, it wasn't even retina capable last I looked at it.

<comment><USER16> Not surprising, since today's update is the one that introduces retina support.

</comment></comment></comment><comment><USER17> Still can't see the option to take a photo with my built-in camera. I wonder if a bridge with Photo Booth is possible for mac apps.

</comment><comment><USER18> Still needs some sort of syncing of read positions.

</comment><comment><USER19> For over a year, I couldn't log into the Twitter for Mac client. Hope this fixes it!

</comment><comment><USER20> Error: "unauthorized"

Welp, so much for that. :(

</comment><comment> k-mcgrady Might be related to them killing off desktop support for Tweetdeck.

<comment><USER21> They're only killing support for the android, iPhone and Adobe Air versions. The native desktop versions of both Windows and OS X will continue to work. [http://www.tuaw.com/2013/04/20/tweetdeck-air-and- tweetdeck-f...](http://www.tuaw.com/2013/04/20/tweetdeck-air-and-tweetdeck- for-iphone-will-be-discontinued-on-m/)

<comment> k-mcgrady I haven't used it in a long time so I thought the AIR version was their desktop version. I didn't realise they'd gone native.

</comment></comment></comment><comment> k-mcgrady Actual title is: New improvements to Twitter for Mac

</comment><comment><USER22> I'm not falling for it this time.

</comment><comment><USER23> Only took them 2 years...

</comment><comment><USER24> Sounds pretty cool. I'm interested to see how buggy it is, cause some of their other features really are.</comment>


Ask HN: Are there any good resources to practice SQL? - <AUTHOR>

I need to prepare for an analytics interview. Does anyone know of a good resource to practice SQL querying/database design stuff online? <comment><USER2> Jackdb.com - I recently used it to play with their sample db and teach basic SQL to my MIS class. Worked out rather well.

<comment><AUTHOR> Thanks! This is pretty cool, but I was looking for something with guided exercises more than just a sandbox. Any other ideas?</comment></comment>


_why's best twitter posts - <AUTHOR> http://favstar.fm/users/_why

<comment><USER3> _"you seem to think i'm random, but i'm only psuedorandom. you would be exactly this way, were you seeded at the very same time and place."_

If _why were to eulogize himself, I think this is what he'd say.

</comment><comment><USER4> I have this one engraved on the back of my iPod touch:

 _turtles and goats, turtles and goats, turtles and goats are filling up boats._

(It was free so might as well.)

<comment><USER5> Yeah, might as well ruin your iPod with that fucking _nonsense_.

Why the fuck is this bullshit being upvoted. This is how modern art gets popular, you know? People "upvoting" IRL because they're tricked into thinking it's good. Peer pressure. Social "proof". Sheep mentality. When if they saw it in isolation, they'd realise it's just rubbish.

You know what? I can toss this shit out all day. Here we go, I feel an epiphany coming on:

 _bitches and hoes, bitches and hoes, bitches and hoes are tickling my toes_

WOOOAH! That is, like, SO deep. Am I a genius yet?

update: Wait! More is coming! I am channeling the good shit!

check it out:

 _chickens and frogs, chickens and frogs, chickens and frogs are climbing the logs_

That would look perfect on the back of any iPod IMO.

<comment><USER6> You're going to want to chill the fuck out, Sho. Want to know what's really fucking nonsense? You telling somebody else that they're bullshit because you don't agree with what they decided they liked. Also, you telling a bunch of modern artists who've spent years doing their thing that their work is valueless.

I've got news for you. Do you know what makes things valuable? The people who decide to spend their money on things. That's it. It doesn't make things necessarily _good_ , but what _is_ good? Some people genuinely think Damien Hirst's dangling shark is good art. I don't. I think the concept's vague and it's not worth the money it takes to produce. Ditto his diamond-studded skull. But there's a gap from not liking something personally and deciding to devalue other people because they like it.

Newsflash: It's a large world. If you don't like people who like lines like that, avoid them. Don't waste your time bitching them out and snarking around. It takes a pretty fucked-up person to decide it's worth making people feel bad about themselves.

-

I used to feel the same way as you, back when I was the tender age of eighteen. (My birthday was last week and I've decided to excuse any bursts of maturity I've had on it; you and I know that's bullshit but it amuses me so let me continue.) I was totally caught up in the Ayn Rand swing, you know? Where people with worse taste than me were destroying the human race, I had to preserve standards, etc., etc. The idea that everything is objective gives me the moral right to insult other people if it means improving the human race a little bit. Problem is, things _aren't_ all objective. You can monitor some things about art, you can come to a consensus with people on how well-crafted something is or how unique it is, but eventually you're just assigning arbitrary values to complex things, and you're forced to let people decide what they like on their own.

My big sticking point was _Twilight_. Shittiest book ever. I couldn't write that bad if I tried. So I used to tell myself that I disliked people because they were brainwashed by the modern culture that told them it was okay to like Twilight. Kind of like your "sheep mentality" thing. Then I realized two things:

A) The sort of person who judges somebody by what they read when that person's not a reader is a douche.

B) There's a difference between judging somebody in their face, and making private judgments that don't hurt anybody.

If somebody likes something, then let 'em. All power to them. Maybe one day they'll change their mind. Maybe you can show them something you like better, and that'll influence them along a new course. I was a counselor at Princeton for the last month, watching over 13-year-olds who were into stuff like Two and a Half Men, and I brought in Arrested Development for them to watch. Gentle nudges.

In the end, society's an illusion. That's the big realization I made. I could spend my life ranting against Twilight fans. Maybe if I'm good I could reach a hundred thousand fans and make them feel bad about themselves, and I could try and tell myself that I've made a difference. Problem is, I don't know those people. I don't care about those people. They aren't a part of my life. So why bother with them? It's a huge world filled with people who I'll like, and if the human race doesn't implode (it won't) there'll be people I'd like in the future, and it doesn't matter if they never take over the world because their existence is enough.

Incidentally, I will offer the way my friends and I converse as a model to you, since I think you need it. When we have disagreements about things, we ask the people we disagree with to explain themselves. The awesome thing is that by trying to rationalize the way your mind works, you both discover things about yourself and about the things you liked but take for granted. It's awesome dining conversation and nobody gets hurt.

-

I need to quote Tao Lin's article about the Virginia Tech killings, which was a huge influence on me. The essay can be found at [http://heheheheheheheeheheheehehe.com/2007/04/crippling- lone...](http://heheheheheheheeheheheehehe.com/2007/04/crippling-loneliness- and-killing.html).

 _If you think someone else's writing is 'shitty,' 'terrible,' or 'bad' and you think this seriously, as if the writing were objectively 'shitty' or 'terrible' (which means you believe if anyone likes the writing they themselves are 'shitty' and 'terrible'), your existence is a distortion of the universe that causes more pain and suffering. Many people like Gary Lutz. Many people like Stephen King. If you type, "I dislike Stephen King," that is a fact. If you type, "Stephen King is horrible," that is not a fact, it isn't anything; it's you saying either, "I am the only person who exists and my opinions are actually facts," or "I am the entire universe and the universe is not indifferent but actually makes value judgments on specific things within itself without defining a context and a goal."_

 _A person's writing comes from their brain. It is who they are. Some people have very sad facial expressions and when they talk their voices tremble and maybe they have a deep voice or respond mostly with one-syllable answers or maybe they don't speak and don't make eye contact. That is who they are, most people would say. If you met that person you wouldn't say, "Your facial expression and voice are horrible, you have no talent. You have no talent for the pitch of your voice. You are talentless and horrible and unoriginal. Your voice and facial expression are very bad. You should stop doing those things and releasing your terrible shit onto the world. Maybe you should try something else, instead of existing. Maybe you would be good at something else, like not existing." Most of you would not say that about a person's idiosyncrasies, a person's 'personality,' etc. But most of you would say those things about a person's writing, if you didn't like it._

 _A person's effect on the world is their 'art,' that is who they are. How they move, release noises, arrange their room, write their sentences, give their poems line breaks, etc._

 _People laughed at Cho Seung-Hui's voice and other people (and people currently, on the internet) said (are saying) his writing was 'horrible,' 'talentless,' 'embarrassing,' etc._

 _"You have no talent," means "I am the only perspective that exists and I judge you and you are not good," which is a meaningless statement if a context and a goal is not defined._

-

But now let's throw all that peace and tolerance bullshit aside, right? You don't care about that stuff. You care about being the Voice of Reason, telling that motherfucker Jeremysr just how valueless his decisions are. Well, here I come, experienced practitioner of art, to tell you that _your_ lines were bullshit and that _why's was a gorgeous bit of nonsensical prose.

First, we'll establish the existence and artistic defense of nonsense poetry. I submit that Green Eggs & Ham, despite being absurd and rather redundant, is in fact a piece of art, given the context of Seuss's stories. On its own it is still a defensible piece, but in context it is something great by my standards.

In order to determine the context here, we have to take a look at _why. Luckily, HN has provided buckets of context for us. He was a brilliant programmer, and at the very least an enjoyable writer, artist, and musician. His stuff is appreciable even for those of us that don't like the absurd - <USER2> Chunky Bacon foxes are quite funny, his writing style in the (Poignant) Guide is probably the best I've come across in programming guides, and his music, while bizarre, is nuanced and fun. So we have to assume that _if_ _why wanted to be clever in a less absurd sense, he could have been, and that he is an experienced enough person to be able to decide for himself which styles he prefers.

Now look at the context of these other Twitter posts.

"trying to reading dhh's articles on himself, but his website is so drenched in axe body spray that it has more of a tear gas effect."

"my lady, this poorly rendered page marks you as the whore of internet explorer. i mean that in a way that is both graceful and degrading."

"until programmers stop acting like obfuscation is morally hazardous, they're not artists, just kids who don't want their food to touch."

So he's proven himself to have a certain command over words. We'll assume, then, that he's not a hack trying to trick people into liking him, that people like him for perfectly good reasons.

Therefore, the line in question:

"turtles and goats, turtles and goats, turtles and goats are filling up boats"

is a piece of nonsense lyricism, no more, no less, but appreciable as such. While I wouldn't put it on my iPod - mainly because I don't like engraving things - Jeremysr's putting it on his is not the downfall of society.

Now, let's look at your two attempts at mockery. We'll ignore that you lack the context of being a genius artist and that the only credit to your name is that you like being an asshole online who bullies other people.

"bitches and hoes, bitches and hoes, bitches and hoes are tickling my toes"

We'll ignore that your entire form is derivative of _why's form, without any innovation whatsoever. Your line is broken and messy, primarily because of your use of the word "bitches", which slows down everything, and "tickling", which is hideously unflowing. (See, these are objective criticisms based on the form of the words themselves. I wouldn't call people fucking nonsense if they liked your line, but I wouldn't be surprised if they preferred _why's.)

Your second one:

"chickens and frogs, chickens and frogs, chickens and frogs are climbing the logs"

Here you have a not-completely-awful flow, but it's not the same as _why's. Whereas his words all sound from the same part of the tongue (tərt, fəll, and the long o of goats), yours come from three different sources (chəck, frãg, clim), breaking up the pacing when sounded aloud.

Meanwhile, conceptually _why's got something and you don't. While chickens and frogs are animals I don't have a hard time seeing lumped together, turtles and goats - beyond sounding nice, and triggering something that feels purple in my mind, likely because of the echo in the word "turtle" - are a more bizarre coupling, linked together only because of how they feel sonically. By ending with "filling up boats", he implies something on a grander scale than "climbing _the_ logs". In fact, I can't see instantly how you could correct your own attempt, because while "filling up boats" implies necessarily that there are _many_ goats and turtles _completely filling_ these many boats, yours doesn't have an end in sight. _why's statement is terminated at the completion of the boats' fillings. There is a logical conclusion inherent in his wording. Your statement, meanwhile, has no termination, and no meaning. Where are these logs? We know the boats are on a body of water, and that they will likely sail off. Logs I imagine at once a farm, a mountainous trail, and my next-door neighbor's cleared-out back yard. That's dissonance in my mind. It doesn't work.

It takes a lot of work to break down something simple that's created by reflex, but it's possible, and when people look at lines like _why's, their minds go through a similar process trying to create a mental response. Nonsense is harder than you'd think. There are rules to it like there are in anything. Having actually put some thought into _why's line, I like it more than I did before I decided to defend it. There're a few things going on there that I appreciate more now.

-

tl;dr: Hacker News is not the place for you to be an asshole. No place ought to be the place for you to be an asshole, but if you're going to try and be a cunt on Hacker News, you've got to deal with people who're a lot more experienced than you who have kindness in their best interests.

<comment><USER4> Thankyou. :P

I don't even have the whole line on my iPod, to be candid. I had to whittle it down to "turtles and goats\nfilling up boats" to make it fit. It's really just a reminder of _why and his words, although I have always liked that particular line. I've found it running through my head on occasion, like a song stuck in my head. (This happens to me with many words and phrases, most recently "alabaster M&Ms")

Now why don't we discuss my iPod wallpaper? <http://viewsourcecode.org/forum/why-wallpaper.png>

(Next up: I take you all downstairs to my basement where I spin you some old Thirsty Cups records of mine.)

<comment><USER6> This is a detour from the current ongoing conversation, but what are the Plastic Cups?

<comment><USER7> I think he meant the Thirsty Cups, _why's band:

<http://www.last.fm/music/The+Thirsty+Cups>

</comment></comment></comment></comment></comment></comment><comment><USER8> _when you don't create things, you become defined by your tastes rather than ability. your tastes only narrow & exclude people. so create._

Inspiring. And antithetical to his recent actions, which are surely more destructive than creative. Yet who among us is not a contradiction? Like Walt Whitman, _why contained multitudes.

</comment><comment><USER9> _what makes me such a lousy programmer is that i can excuse anything by saying this isn't so bad— i myself am a much bigger hack than this._

</comment><comment><USER10> Awesome posts.

You know, the entire internet is abuzz with _why news right now, but... why? Sure, he deleted his internet presence. It's probably a healthy thing to do once in a while. Like spring cleaning!

He's still alive people! He's probably happily riding a unicorn into a misty valley full of friends. Or, he could be camping.

<comment><USER11> i couldn't help but think of this exchange when i saw all of the _why things

 _\- Nobody died. How can you kill an idea? How can you kill the personification of an action?

\- Then what died? Who are you mourning?

\- A point of view.

Cain, Elbis O'Shaughnessy, and Abel, in Sandman: The Wake_

<comment><USER10> That's a great exchange. Thanks for sharing that!

</comment></comment></comment><comment><USER12> His top post is one of my all time favourite tweets. Often quoted.

</comment><comment><USER13> Also interesting, posts faved by _why:

<http://favstar.fm/users/_why/faved_by>

<comment><USER14> This one cracked me up "It's all coming to a head. A sharp, pointy head. With tiny little eyes." <http://twitter.com/chrisrhoden/status/1574388823>

</comment></comment><comment><USER15> A video is online for the talk he delivered at the Art+Code conference at CMU earlier in the year: <http://www.vimeo.com/5047563>

</comment><comment><USER16> To all of you caring so, so much:

Man, you're really waaaay to virtual already...

Go get some life contact!!

P.S. This english computer culture really is able to fool us too badly, making us aliens _on_ _our_ _very_ _own_ _planet_...</comment>


Expandpass – expands passwords from simply defined syntax - <AUTHOR> https://github.com/Phildo/expandpass <comment><AUTHOR> "Ok, so I think my password is something like ILoveBananas123, but I can't remember if it was like or love, or if the numbers came first or second, or where the capitalizations were... oh dang I'm screwed"-

Not anymore!

("123" <{"I""i"}("Love""Like"){"B""b"}"ananas">[-m1])</comment>


Lifelogging is dead for now - <AUTHOR> http://www.computerworld.com/article/3048497/personal-technology/lifelogging-is-dead-for-now.html <comment><USER2> There's a life log built into Google Maps. It's called Timeline and it's pretty neat. It annotates your raw location history with the names of places you've been and the photos you took while you were there. It's a nice benefit for those of us who don't mind letting Google store our location history.

[https://www.google.com/maps/timeline](https://www.google.com/maps/timeline)

<comment><USER3> Yeah, I shut that trash off years ago. I love keeping records of my own. I don't love the government having a permanent record of everywhere I've ever been over the last ten years.

<comment><USER4> Won't they have your phone mast history as a good second go ?

<comment><USER3> Cell phone location history won't tell you nearly as much. They can generally say which town I'm in, what part of town even. But I could at any point be in hundreds of different buildings at any point from the history of what towers I'm connected to.

Meanwhile, Google location history pinpoints you to an exact address give or take every five minutes.

<comment><USER4> They'll have much better accuracy than you think.

You're connected to one at a time but frequently checking for more appropriate towers in case of signal outages.

Using this they could triangulate you quite precisely.

<comment><USER3> The question there is your use of "could". Is this something they can do if they want to know about you specifically, or something they're already doing (and storing) for all users?

The ability to decide to track down one person right now for criminal justice purposes is not nearly as concerning as just being able to request anyone's precise location history going back a decade.

</comment></comment></comment></comment></comment></comment><comment><USER5> I absolutely would like to record everything but I'm not prepared for all that data to live in the cloud and belong to some untrustworthy tech giant.

<comment><USER6> What about a questionably trustworthy tech startup?

<comment><USER5> Theoretically yes. Practically I'd be very surprised if such a tech startup would have terms I would trust. Things I'd be looking at:

* data ownership - including in the event the startup is bought

* data access revocation - I want to be able to revoke access to my data in a meaningful way

* business plan - I want to be the customer not the product for something like this

* portability - I don't want to feel that I'm stuck using any one solution for my life.

I really don't know if such a service can be made economically viable given such a set of requirements.

<comment><USER7> Take a look Su Sandstorm.

<comment><USER8> What is that? I can't (easily) tell what it is that you are trying to suggest looking at.

<comment><USER9> I think they mean Sandstorm.io

Sandstorm pretty much meets those requirements:

* Your data is exportable

* They focus on security and have a non-privacy-invading business plan

* You can decide exactly who to share data with, and revoke it.

It's like a private hosted cloud - you have to pay for it yourself (once it's out of beta), but you could host it yourself, and it's open source.

[https://sandstorm.io](https://sandstorm.io)

</comment></comment></comment></comment></comment></comment><comment><USER10> I'm genuinely surprised that so many people are interested in logging every detail of their lives. It seems like the obsession with collecting memories on your hard drive is a great way to never collect any of them in your head

<comment><USER11> If you are more concerned with taking pictures than being in the moment and absorbing the gestalt of the experience, then yes. That being said, a photographic log of particularly salient experiences can provide retrieval cues down the line to help you re-live and re-enjoy them.

</comment></comment><comment><USER12> My best Life Log is my pictures and videos taken with my phone, available both in chronological order and somewhat organized into topic collections (Google Photos only). I set my phone to wait until I am on wifi and then send copies to Google Photos, Microsoft Onedrive, and Dropbox. (I delete a lot of pictures soon after I take them if I don't want them in my permanent collection). I have the same time ordered collection on one of my laptops and back everything up occasionally to DVRs.

I use this time ordered photo stream a lot. When I am traveling, sitting in an airport and don't feel like working at the moment, I like to jump back to some point in time and look through the pictures for a few month interval. Refreshes my memory and I enjoy remembering time with family and friends, travel, etc.

</comment><comment><USER13> Every 2m a snapshot of my desktop gets taken through cron for personal review later. Would be nice if I had a similar minimally socially invasive tool away from my computer. Perhaps I can just use my memory for that.

<comment><USER14> what possible use could that have?

<comment><USER15> Could be a contractor billing by the hour. Plenty of people track their time this way.

</comment></comment></comment><comment><USER16> This is actually the area of research for my honours thesis. Many of the points made here are very valid - there is simply so much personal data being generated and there is no way to access it in a meaningful way.

</comment><comment><USER17> One great thing about the current state of technology is you'll have a picture of your kid virtually every week of their life.

When I was a kid, the camera would get lugged out for occasions like birthdays.

Now I have more pictures of my kids than days in their lives.

I think it's great. There's even metadata to tell you where and when the pic was taken.

<comment><USER18> I think this increase of frequency is interesting too. But sometimes it does dilute the meaning of the pictures, and no one have time to sort out 1000+ pictures from the last year to make into one coherent album telling a story. They resort to 'auto-curate' that's based on their network's reaction to the post (e.g. those 5 top posts of the year on instagram), not the moment or their story itself.

<comment><USER17> Surely a job for machine learning? There's enough metadata to spin a short narrative:

\- We went to Legoland when you turned 4, here's the pics of the day...

vs

\- Here's a toad we came across on the way home from school one day...

<comment><USER18> sure it's probably easier for vacation/location based narrative (picks ones that are far away from home). But maybe it can learn to pick more interesting data too (first picture of your child standing up/first video of them walking). Or last pictures of someone with you.. After thinking about it, yeah it might be a job for machine learning.

</comment></comment></comment></comment><comment><USER19> Lifelogging reminds me of this episode of Black Mirror: [https://en.wikipedia.org/wiki/The_Entire_History_of_You](https://en.wikipedia.org/wiki/The_Entire_History_of_You)

Now I don't know how much it was based on Gordon Bell's/Vannevar Bush's idea or if it's simply a big coincidence.

<comment><USER20> Thought about this as well. I agree that the concept of using electronics to create a sort of "prosthetic" photographic memory is interesting but going with the theme of the series, it did an interesting job of dramatizing the potential pitfalls of being able to rewind and review everything you say or do. I liked that wasn't even about conspiracies or surveillance but rather the way that sort of access to the past can allow you to dwell on it and constantly second-guess yourself and past actions.

</comment></comment><comment><USER21> I always wondered what would happen to violent crime if everyone logged what happens? (If there is no obvious camera, it would be enough if 10-15% logged, for the risk to increase.)

A button sends the last minute of everything that happened to the police, along with GPS coordinates (preferably with a face recognition service)?

If your voice is needed to turn off logging, it will be obvious what happened, when knock out drugs are used in bars.

And so on.

<comment><USER22> Selective enforcement goes through the ceiling, as there's suddenly far more "crime" than anyone knows what to do with.

<comment><USER21> Yes, but add face recognition and it will be easy court cases...

I see new services for the future:

\+ Upload services that gets video checksums every second (and maybe a picture every 30 seconds), so you can prove that this video was not tampered with.

\+ Jamming equipment, so criminals can stop information from leaving the victim (then destroy the logging hardware.)

\+ Cheap, fast flying drones that can leave a person being robbed, to send video/audio/alarm to the police outside the previously mentioned jamming radius.

</comment></comment></comment><comment><USER12> I think it is important to focus on Bell's motives: he wanted to augment his physical memory with a digital record of his life.

There are other strategies that are manual and thus miss a lot of information, but does it really matter? I use org-mode type shared files for notes, and sometimes use of Google Keep and Evernote for research notes. I also toss all PDF files for interesting conference papers, monthly ACM issues, eBooks I have bought into a folder that is searchable on my laptop and I keep a copy on Google Drive so I can find stuff if I don't have my own laptop with me.

It is a tradeoff: how much time to spend archiving potentially useful stuff vs. the long term benefit of having this stuff available.

</comment><comment><USER23> Hard drives are so cheap why not DIY? The article implies TB of data but I find that dubious.

<comment><USER13> Every 30s would amount to 2880 times * x Mbyte per day. Which would mean 2 Gbyte per day. If you have a movie at 12 FPS you could get it down to 12 Gbyte per day.

<comment><USER23> I have a feeling 8 hours of pitch black video compresses to even less. So at the lowest resolutions and framerates maybe you have 1gb of video per day. That's around 2 and a half years per tb. You can buy 5 tb drives for under 300 dollars. That means you can do video for 14 years. With backups and all the hardware, this entire project could cost less than 1000usd.

</comment></comment></comment><comment><USER24> I don't know. [http://getnarrative.com/](http://getnarrative.com/) seems pretty popular!

<comment><USER25> They went through some rough times this summer (bankruptcy/re-org) [1] and have secured some new funding [2].

Also interesting, because they are based in Sweden, you can get a look into some of their financials as well[3].

Anyone from @narrative care to comment on this?

[1] - [http://blog.getnarrative.com/2016/07/narrative-initiates- a-c...](http://blog.getnarrative.com/2016/07/narrative-initiates-a-company- reorganization/)

[2] - [http://blog.getnarrative.com/2016/07/first-round-of- funding-...](http://blog.getnarrative.com/2016/07/first-round-of-funding- secured-for-narratives-company-reorganization/)

[3] - [http://www.allabolag.se/5568709520/Narrative_AB](http://www.allabolag.se/5568709520/Narrative_AB)

</comment></comment><comment><USER26> Depends on your definition of lifelogging I guess, I would argue that most lifelogging happens on Facebook now. Most people don't want to automatically share every detail about their lives, they want to present a filtered, sanitized version that serves as a personal narrative.

<comment><USER20> Yeah, definitely depends on definition. If you mean publishing/broadcasting, then sure. That can and should be something you curate and choose what things you want to share about yourself rather than an all-or-nothing situation.

But there's the possibility of using it as a sort of glorified journal as well. As someone already mentioned that Black Mirror episode where this is explored along with the pitfalls of living in the past or constant second- guessing I'll skip that angle.

Still, in a more positive light, using tech to automatically journal some things (places you've been, time spent doing various activities, things you've seen, etc) at least has the potential to benefit. Maybe it's something as simple as trying to remember a place your visited or maybe it's a real eye- opener when you see just how much time you spend sitting in traffic. Either way, there are definitely some potential uses that go beyond the "liveblog/broadcast every second of your life" thing.

</comment></comment><comment><USER27> A few people in the early days of Justin.tv (now just known as Twitch) would "LifeCast", one of the more popular broadcasters ended up working for Twitch.

</comment><comment><USER28> It's not dead; NSA have simply taken over the responsibility

</comment><comment><USER29> Computer World still exists?</comment>


2011 WWDC Live Blog Streaming Options - <AUTHOR> http://www.bradstewart.com/2011/06/06/2011-wwdc-live-streaming-options/

<comment><USER2> German liveticker: <http://www.heise.de/mac-and-i/liveticker>

<comment><AUTHOR> Thanks, I added it as well.

</comment></comment><comment><USER3> Just to clarify, apple doesn't allow anyone to video stream the event live.

<comment><AUTHOR> Good point, clarified the title.</comment></comment>


Software Developer Careers Considered Harmful - <AUTHOR> http://www.methodsandtools.com/archive/zenprogrammer.php

<comment><USER2> [http://www.plainpunditry.com/2009/07/27/life-is-the- number-o...](http://www.plainpunditry.com/2009/07/27/life-is-the-number-one- cause-of-death/)

</comment><comment><USER3> The article's nearly impossible to read on mobile.

<comment><USER4> Consider using a service like Pocket ([https://getpocket.com/](https://getpocket.com/)) for reading. I've never tried it on articles with embedded code snippets (gists, etc.) but it works fine with most plain-text articles posted on HN.</comment></comment>


PoisonTap – Exploits locked computers over USB - <AUTHOR> https://github.com/samyk/poisontap <comment><USER2> Another fine exploit by Samy [1]. At the risk of sounding like a killjoy, once the attacker has physical access to a machine, let alone plugs in their own device, you can usually abandon all security hope [2]. But that entirely notwithstanding, the techniques presented in this exploit are actually quite clever, and they conspire to make for a nasty set of scenarios. Kudos to him for raising awareness once again!

[1] [https://en.wikipedia.org/wiki/Samy_Kamkar](https://en.wikipedia.org/wiki/Samy_Kamkar) [2] [https://hn.algolia.com/?query=tptacek%20"physical%20access"&...](https://hn.algolia.com/?query=tptacek%20"physical%20access"&type=comment)

<comment><USER3> A powered-down machine with full disk encryption is reasonably safe against physical access, I still hope?

<comment><USER4> Unless USB keylogger is present which will log the disk encryption password when user is unaware of it...

<comment><USER5> I've already seen lockable boxes around computer ports on some older model workstations. Combine that with some tamper proofing on the keyboard, and you've probably bought yourself a little more security against any intruder who has limited time with physical access.

</comment></comment></comment></comment><comment><USER6> You have a few mitigations that aren't listed here, but it's really moot because physical access is still game over.

First, the GRSecurity patchset contains a kernel-level USB whitelist, so you can whitelist only known USB devices. A targeted attacker could attempt to spoof an existing/whitelisted USB device, but it does significantly harden the USB attack surface:

1\. [https://wiki.gentoo.org/wiki/Allow_only_known_usb_devices](https://wiki.gentoo.org/wiki/Allow_only_known_usb_devices)

Clearly this only helps Linux people. For those using Linux/BSD/macOS, There's also _usbkill_ , a Python-based antiforensic tool that just kills the computer if a device is inserted/removed that isn't on its whitelist: [https://github.com/hephaest0s/usbkill](https://github.com/hephaest0s/usbkill)

While this won't stop Samy's box from starting to do its thing, it will at least shut the computer off and mitigate some of the potential damage. _usbkill_ is in the Homebrew repositories for macOS as well. If you have fully encrypted disks and strong passphrases, this is still going to ruin somebody's day trying to use this device.

<comment><USER7> > First, the GRSecurity patchset contains a kernel-level USB whitelist, so you > can whitelist only known USB devices. A targeted attacker could attempt to > spoof an existing/whitelisted USB device, but it does significantly harden > the USB attack surface:

Actually, the GRSecurity patchset includes a toggle to disable _all_ new usb devices after boot. The whitelist mechanism you're referring to relies only on udev (no kernel patching needed). You can even whitelist by driver to, e.g., allow all usb storage devices by default.

</comment></comment><comment><USER8> The takeaway for me is that you can program a Raspberry Pi Zero to be a USB device (not just host). I wonder if it can do both at the same time...

I sometimes think about building a "USB Condom". There already exist devices that only pass through the power lines, if you want to charge a phone from a dubious plug. However, I would go a step further and try to support data. For example, I would emulate a USB pen drive (with a FAT32 file system), and then mirror the contents of an attached drive. If the attached drive is malicious, it cannot easily attack the host.

<comment><USER9> Hm, this sounds like a software-based solution right? But if you have software only letting certain data pass, couldn't the same software just be run by the main device instead of an intermediate one?

<comment><USER10> Two reasons speak for a separate hardware for that purpose:

1: conventional computers have no mechanism to indicate what you expect from a USB device, and you can't ask for confirmation that the user wanted to plug in a keyboard, because the user might need that keyboard to confirm hits intention

2: the USB software stack can be attacked at many layers, including firmware, generic OS code and the OS-chosen driver. That software stack varies depending on OS, motherboard, BIOS version, installed drivers etc. A hardware device can provide protection invariant from those factors

</comment></comment></comment><comment><USER11> I wonder if a viable method for securing USB devices would be a pairing step, similar to how bluetooth keyboards work. Most input devices are USB-based, which means we can't require confirmation for _every_ device, but we could require OS confirmation for most of them, and do a pairing step for input devices. Like click these visual targets / type in this key sequence.

This wouldn't fully solve this problem, but it _might_ just help protect me from people plugging devices into my machine while it's locked, and could even alert me that the device I thought was just charging has reported itself as a keyboard, despite looking nothing like one.

</comment><comment><USER12> It seems like another mitigation missing from their list is "modify your DHCP client to reject over-broad subnet masks" where the cutoff is probably something like /20.

Additionally you could reject any DHCP lease for a subnet that purports to overlap with the address range of any other directly connected network.

<comment><USER13> Couldn't the USB device identify itself as multiple devices over the same port? Similar to a hub. It could then give a /20 to each device.

<comment><USER12> It could, there's a limit of 127 USB devices though so it couldn't cover a large percentage of the address space that way. It might be enough to still cover some major sites of interest.

</comment></comment></comment><comment><USER14> I don't have a Pi to test with but I imagine keeping the associated kernel module(s) (assuming I have the right ones) unloaded would mitigate this entirely:

kextunload /System/Library/Extensions/AppleUSBEthernet.kext

and maybe this one. I don't know if this would impact using your phone as a usb hotspot but it might so keep that in mind:

kextunload /System/Library/Extensions/AppleUSBNetworking.kext

and this one but I'm pretty sure it is in fact required for usb tethering so keep that in mind if you use that:

kextunload /System/Library/Extensions/AppleUSBEthernetHost.kext

I don't remember if they reload on reboot or not but if needed you can reload them with kextload.

Edit: This is for OS X/macOS by the way. And I wish I had a Pi to test with because this is very cool. We owe people that release stuff like this a big thanks because they took it from an idea to implementation and then the big step of creating a usable, shareable project which goes a long way toward increasing awareness.

</comment><comment><USER15> It's long past time that USB security is taken seriously.

By default anything stuck into a USB port should be sandboxed and various integrity checks need to be performed before access is allowed.

<comment><USER16> > It's long past time that USB security is taken seriously.

You mean, before we started using USB for charging...?

It wouldn't be hard at all to make a convincing looking power adapter with something like PoisonTap baked in.

<comment><USER2> You can protect both devices from each other with a USB condom [1] which only connects the power pins. This should be the solution for trying to charge from untrusted slots, or for when an untrusted device wants to charge from you.

[1] [http://syncstop.com/#faq-original](http://syncstop.com/#faq-original)

<comment><USER17> Know of any USB condoms that can filter for device types? Given BAD USB type of exploits there really no easy way for me to know that when I stuck my USB stick in the printer at the library it wasn't reprogrammed to be a keyboard or something else and when I then go plug it into my computer it now powns my computer

</comment></comment></comment></comment><comment><USER18> I remember the "good ol' days" when you could reasonably build a monolithic Linux kernel with support for loadable modules disabled. Just compile in whatever you needed for your hardware and leave out the other 90% that you didn't need.

It was a decent (but not very popular) defense against rootkits and attackers being able to dynamically load kernel modules and would also prevent something like this (unless you had the necessary drivers compiled in).

<comment><USER19> This could be done: we need a common git repo with a config for each kernel version per laptop; eg. config-4.4.30 for ThinkPad X200, which only includes the required drivers for the laptop itself.

<comment><USER20> That sounds great but I remember installing Linux on a Mac and even then it wasn't consistent exactly which drivers should have been used as there were variations depending on the date of purchase. Macs are probably a lot more consistent than the majority of laptops.

</comment></comment></comment><comment><USER21> That is impressive. And scary.

But if your box's physical security has been compromised, you're already screwed in any case.

<comment><USER22> > But if your box's physical security has been compromised, you're already > screwed in any case.

There's a gradient to the screwage, however.

For example, I've encrypted my disk, so someone would need to steal my computer and then try bruteforcing it with some new-fangled graphics card.

With this insanity, I risk someone stealing my unencrypted traffic with a plug-and-play device any time I get up from my desk to pee. Then again, they can already do that with Wireshark.

<comment><USER23> not just unencrypted - traffic for any website that doesn't use HSTS. All they need to do is intercept a single HTTP page and then they can modify it to contain iframes to their favorite sites over http, and any site without HSTS can then be owned.

<comment><USER23> Hopefully though everyone sets the secure flag on important cookies... I wouldn't bet on it, but I suspect it may be more common than HSTS.

</comment></comment></comment></comment><comment><USER18> I wonder if this could be combined with some of the (relatively) recent issues w/ LastPass and/or 1Password, where the application and password credentials were accessible via 127.0.0.1 (which is apparently required for the browser extensions to work)?

If so -- assuming the user is logged in to {1Password|LastPass} -- just plug this in to their PC after they walked away from their desk and wait for all of their saved credentials to be stolen!

</comment><comment><USER24> This attack can be mitigated in Windows using group policy: [https://technet.microsoft.com/en- us/library/cc731387(WS.10)....](https://technet.microsoft.com/en- us/library/cc731387\(WS.10\).aspx)

</comment><comment><USER25> A hardware-oriented attack vector that completely unravels the carefully conceived schemes of the application layer's software-oriented security that sits on top of it.

And USB at the heart of it. My old friend, USB.

Why am I not surprised?

</comment><comment><USER26> Previously:

"PoisonTap, a $5 tool that invades password-protected computers"

[https://news.ycombinator.com/item?id=12966673](https://news.ycombinator.com/item?id=12966673)

</comment><comment><USER27> Almost everything said on that page is already feasible with basic network spoofing. Sure, the hardware hack is cool and allows a bit more but nothing extraordinary.

</comment><comment><USER26> So is clearing your browser cache sufficient to be sure that any possible PoisonTap infection has been removed?

<comment><USER23> sounds like it, but given usb plug-n-play I'm sure you could make a more persistent version.

And also clearing your cache won't invalidate all your web sessions that they could have stolen. You'll want to find every site you were logged into, and explicitly log out. Otherwise those stolen cookies will still be valid, unless the website does some sort of channel-id thing to bind cookies to the particular computer (which I'm not sure is possible beyond experimental browser features, and certainly is not common practice)

</comment></comment><comment><USER28> It's not often you see exploits that reference RuPaul's Drag Race. I, for one, am all for it.

</comment><comment><USER29> Does using SRI ([https://developer.mozilla.org/en- US/docs/Web/Security/Subres...](https://developer.mozilla.org/en- US/docs/Web/Security/Subresource_Integrity)) defeat a portion of this attack?

<comment><USER30> A small portion. (It's listed in the mitigations.) Use HTTPS anyway, though.

</comment></comment><comment><USER23> so thinking about the attack: would it be feasible for OSes to only allow USB input devices to be attached while the computer is locked? It seems like it should be unnecessary to install usb network devices while the computer is locked.

</comment><comment><USER31> FileVault plus running 'pmset destroyfvkeyonstandby' in Terminal should prevent this. Destroying the FileVault key should encrypt the disk, likely stopping things from running while asleep. I haven't tested this though.

</comment><comment> X-Istence On OS X when I plug in a new USB based Ethernet device, the first thing it does is pop up a dialog asking me if I want to enable/configure the device... is the device already configured at that time?

<comment><USER17> Does it ask for a password to enable it? If not the device and also emulate a keyboard to press enter to confirm the dialog.

Any idea where is the list of approved devices is. I'd like to clear my list and then plugin some devices and see if it asks.

<comment> X-Istence I run as a non-administrator account, so this may be different if the user has administrator privileges.

But here is what happens:

1\. I plug in the new device

2\. Dialog box pops up letting me know a new network interface was detected (and to open network preferences to configure the device). The device does show up as en6, it is disabled and there is no network activity.

3\. I can click Cancel or open Network Preferences

4\. Click to open Network Preferences

5\. I have to click the lock, and authenticate as an administrative user

6\. I have to click the +

7\. I have to select the new network interface by name from the drop-down

8\. I have to click OK

9\. I have to click Apply

At that point the network interface is brought "up", and it does a DHCP request, and I can use it.

So there are 8 steps to take AFTER plugging in the device before it can start siphoning off any and all of my data. It's not as plug and go as it is made out to be.

\----

After adding a device, you can remove it from the list of devices in Network Preferences, and that resets that dialog box letting you know there is a new device.

</comment></comment></comment><comment><USER32> shouldn't the OS pause the running of programs when you've locked your computer, and when you log in say something like "hey you've plugged a new device in while you were locked out, are you sure you want to resume all you programs"</comment>


Video shows electronic voting machine changing ballot in Mississippi - <AUTHOR> https://www.washingtonpost.com/nation/2019/08/28/mississippi-election-machine-changes-votes-video/ <comment><AUTHOR> > Over and over again, the man touches a box on an electronic voting machine > to cast his ballot for Mississippi gubernatorial candidate Bill Waller Jr. > And over and over again, the machine instead checks off a vote for Waller's > opponent in Tuesday's GOP runoff, Mississippi Lt. Gov. Tate Reeves.

> "How would that happen?" a woman exclaims in the background.

> "It is not letting me vote for who I want to vote for," the man says.

<comment> java-man You do realize this works as designed?

A cheap, secure, verifiable method (paper ballot) has been replaced by something that can easily and (often) untraceably change the results of the vote (electronic machines) for a reason.

The reason is to keep those currently in power - in power. This must be obvious to everybody by now.</comment></comment>


Ask HN: Hunch gave me an idea, a troubleshooting website - <AUTHOR>

I just had an invitation from Hunch www.hunch.com, it's ok but too simplistic in my opinion.
Nevertheless it just gave me an idea : I'm having troubles with my old car, electrical stuff. I browse the web to find answers to my questions (what's the alternator supposed to output etc...) since I find myself quite able to repair on my own. However, I often lack knowledge on technical things, I miss questions I should have asked myself or just can't find any answer to them.
So I thought it would be nice to have a web app, in the same spirit as Hunch but based on actual technical facts, helping you to get out of a problem on your own. Troubleshooting checklists.
Let's say I want to solve a problem, it would ask me a series of questions (witch may already contain the answer of my problem) leading me to a series of others topics if I need to go further. The users could contribute, add questions and answers, as well as ways they solved their problem if they did.
It could apply to any logical stuff, repairing your car, your computer ...
I know forums are supposed to help, but the human factor always seems to bias the answer you get, one person telling you the opposite of another.
I'm sure someone had this idea already, I couldn't find any website.
Do you know any ? <comment><USER2> That's a really great idea as troubleshooting and checklists are much more deterministic than "what city you should live in" type of questions

</comment><comment><USER3> I'm building it as we speak. Working on the demo today to submit to Capital Factory (<http://www.capitalfactory.com/>)

The code is basically working and I'm tweaking the UI as we speak.

I'll of course post to HN once it's ready.

<comment><AUTHOR> When is the first release ?

</comment></comment><comment><USER4> I have four road vehicles and a Honda 4-wheeler. All of them have needed a repair at some time and the online forums geared to each type of vehicle are excellent. I think you'd be hard pressed to improve on the expertise of people who have solved the same problem asking you questions that you can respond to, warning of potential mistakes and 'gotchas' etc.

Checklists are nice, but people who recognize the problem immediately and can give you the solution and save you hours of time and hundreds of dollars are much nicer.

<comment><USER3> I've had similar experience with the Subaru forum I visit. However, if you spend any amount of time on the site, you'll go crazy with people asking the same damned questions every day. These kinds of sites have no "long term memory". Having a troubleshooting site that learns from previous experience could be pretty powerful.

That's the idea anyways. :-)

<comment><USER5> I've seen some forums that have a special first post that acts sort of like a wiki, but stuff still gets lost in the deluge of topics.

I have a vehicle which is the first model year of a re-design. In mid-year, Ford apparently decided to change the design on the door lock actuator. So, I blindly found a part that was supposed to be for my model year, and it turned out to be wrong. I'd love to have a "forum topic" in the vein of what you're proposing. I'm imagining a decision tree with places for people to comment, add photos, links, etc. It ought to have Wikipedia-like community categorization. There should be a topic for "My Ford Explorer's door lock doesn't work" which would walk through diagnostic steps along with part identification/repair procedures. People post stuff like this to automotive forums all the time, so it's no stretch to think that they would add their knowledge to the tree as well (with attribution to encourage ownership).

I like the idea a lot. Forums are a sloppy hammer used to attack community problems that are sort of like nails.

From a monetization standpoint, you can't do much better than a "how to fix X" forum since most repairs involve the purchase of parts/tools. And, you'll know exactly which parts people likely need depending on where they are in the decision tree. So, you ought to get really good click-thru rates for advertising.

</comment></comment></comment><comment><USER6> I think this is a good idea. I've thought about creating a computer troubleshooting site where the solution is downloadable (as say a bat file on windows, shell script on linux) and will fix the problem for those not as experienced with computers.

Of course, this doesn't translate well to real life, but could be a source of revenue.

Just throwing the idea out there, haven't given it much thought.</comment>


Readium – Skip Click and Paywalls on Medium, NYT, Business Insider - <AUTHOR> https://www.producthunt.com/posts/readium <comment><AUTHOR> A Bookmarklet that let's you skip click and paywalls on Medium, NYT, Business Insider and Bloomberg. * Im the creator</comment>


11 Web Startups to Watch in 2012 - <AUTHOR> http://devstand.com/money/top-web-startups-2012/

<comment><USER2> Really.. Dropbox.. Pinterest.. Instagram... are startups to watch in 2012...

How about changing the title into: "Startups we have watched make it big in 2011"</comment>


The most intellectual creature to ever walk Earth is destroying its only home' - <AUTHOR> https://www.theguardian.com/environment/2018/nov/03/the-most-intellectual-creature-to-ever-walk-earth-is-destroying-its-only-home <comment><USER2> I honestly don't see any hope of us slowing down. The vast majority of people in developing countries would love it if their grandchildren could have similar lifestyles to Americans. I think we should focus on technology for us to sustain human populations while reducing our dependence on the biome. Think of it as practice for colonizing other planets in the future.

</comment><comment><USER3> And yet, I would much rather live in 2018 (and 2038, and 2058) than 1960. How does that work?

<comment><USER4> You're assuming that 2038 would be same or "better" than 2018. I'd argue it's possible that 2038 could be more closer to 1960 than 2018.

Our current lifestyle is definitely not helping.

<comment><USER3> Of course it's possible, but all the charts I'm looking at very confidently predict otherwise.</comment></comment></comment>


Facebook ad CTR and intelligence are inversely correlated - <AUTHOR> http://searchquant.blogspot.com/2012/03/facebooks-revenues-fools-game.html

<comment><USER2> That is a weak looking trend and doesn't isolate intelligence very well.

In a better statistical model it would adjust for things like age, or number of people with computers by percentage etc.

Even if there was a statistical model which was reasonable it could be entirely due to the type of ad. I know I don't click on most ads because they are for things like get rich quick or or online MBA programs or other dumb stuff

</comment><comment><USER3> I think this was a given however, it is nice to see it documented and backed by data. I assume this is why 'predatory' (by my definition) advertising for useless tech products such as Carbonite does so well on conservative talk radio. Conservative talk shows like Limbaugh have well documented racism and prejudice which have all been linked to a Low IQ.[1]

Interesting.

[1][http://pss.sagepub.com/content/early/2012/01/04/095679761142...](http://pss.sagepub.com/content/early/2012/01/04/0956797611421206.abstract)

<comment><USER4> I am a bit put off by the totally incomplete discussion of the methodology in the paper. A majority of what is actually being measured is not stated. It is difficult to do anything useful with the result when someone says to you "I found that the responses to some questions were correlated with some other data, but I will not tell you what the questions were."

<comment><USER3> Good point. I have not read the paper in its entirety. I think all of these variables are very hard to control for which is why I take all studies like this with a grain of salt, especially if I don't read the entire text.

</comment></comment></comment><comment><USER5> grouping intelligence by state is way too broad a category to get significant results. intuitively we agree with the conclusion, but it isnt that simple [not all ads are the same] and the data doesnt back up the point

</comment><comment><USER6> I heard Yahoo searchers CTR on ads are higher than Google's as well, anyone confirm?

<comment><USER3> I could only find older (~2yr) anecdotal evidence. I could not find anything I would quote without a disclaimer. :)

(Ordered by higest CTR) #1: Bing, Yahoo, Google [1] #2: Bing, Google, Yahoo [2]

[1] [http://www.thepicky.com/internet/chitika-ctr-bing-vs- google-...](http://www.thepicky.com/internet/chitika-ctr-bing-vs-google-vs- yahoo/)

[2] [http://i.marketingprofs.com/assets/images/daily-data- point/s...](http://i.marketingprofs.com/assets/images/daily-data-point/search- ad-ctr-webvisibile-Q3-2010.jpg)</comment></comment>


Scr.im » Share your email in a safe way. Get less spam. - <AUTHOR> http://scr.im/ <comment> mike-cardwell Yet another completely ineffectual captcha that completely misses the point.

<http://scr.im/test>

Are you joking? There is a 1 in 9 chance of getting the captcha right if you pick _completely randomly_. If I was writing a program to scrape these addresses your entire captcha system might add 2 minutes of programming time to the job.

<comment><USER2> Quoting their FAQ:

" The Captcha (humanity check) is way too simple, I can bruteforce it with a script!

It's exactly how it should be. It's not an unbreakable locker. We prefer simple captchas, ease of use and convenience over undecypherable and cumbersome enigmas. "

Not convinced...

<comment><USER3> Sorry, the CAPTCHA is completely pointless. Here's why:

1\. Go to <http://scr.im/test>

2\. Click the upper right box

3\. If you receive an error page, click "Try Again" and go to step 1.

4\. You should arrive at this step in approximately 9 tries (on average) taking less than 15 seconds.

What the heck is the point of a "human test" if it can be automatically attacked by a bot with literally no effort at all. The funny thing is that there is a more traditional CAPTCHA at <http://scr.im/test?failsafe=1> that is much more secure.

Why is the default CAPTCHA pointless? Because it attempts to test for "human- ness" without requiring any human action what so ever. Click a link, the same link, over and over until it is correct is what a bot will do. On the flip side, using your eyes to interpret slightly out of skew characters is decidedly much harder for anything other than a "human" to do.

</comment></comment></comment><comment><USER4> Maybe give reCAPTCHA Mailhide a try if you want to use a system with a _more sophisticated_ Captcha system for this kind of thing: <http://www.google.com/recaptcha/mailhide/>

<comment><USER5> Could this instead be turned into a challenge response system.

mailhide+ would give you a disposable email, the person sending would use that, get back a captcha link, solve the captcha and your email is forwarded on. Optionally the sender is then whitelisted for sending to your address, further options would reply with your direct email address once the challenge had been completed.

This would mean that you'd have an email address to give people when asked for an email address (rather than a website).

<comment> mike-cardwell Challenge/response emails have largely been dropped. If you implement such a system you end up on blacklists for generating backscatter. If SPF/DKIM ever become ubiquitous then we'll be able to look at using those sorts of systems again.

</comment></comment></comment><comment><USER6> The FAQ doesn't explain why sharing your e-mail address on that site is safe.

</comment><comment><USER7> After I started using gmail, 99.9% of my spam started getting filtered out. Now I can post my email wherever I like. It sure beats making customers jump through an extra hoop to contact me.

</comment><comment><USER8> I think an effective system would be using html5/flash that grabs an image and requires a user to do some movement with their mouse. i.e. select a house with a broken window, followed by a house with red windows and followed by a house with smoke coming out of it.

since it's flash/html5, I figure its going to be a lot harder to automate a way to break it.

</comment><comment><USER9> This is a clever idea. The 1 in 9 captcha test was a poor decision, but if he forced everyone to type in a reCAPTCHA instead I think it would be a good service. Simple and effective enough. I wish I had thought of it.

<comment> mike-cardwell As giu said. This already exists:

<http://www.google.com/recaptcha/mailhide/>

scr.im is just a much worse version of mailhide

</comment></comment><comment><USER10> It apparently treats '+' as invalid in an email, too.

</comment><comment><USER11> Waste of a great domain name. :/</comment>


Show HN: Expired domain search engine based on patterns updated daily - <AUTHOR> https://rescue.domains <comment><USER2> Can't view the website content with JS disabled or with strict uMatrix browser extension. Would be nice to view it without having to change that

<comment><AUTHOR> Thanks for the feedback, I'll have a look to see if I can do something about that.

<comment><USER3> Even default uBlock Origin breaks the site on desktop.

<comment><AUTHOR> Thanks, I'll have a look</comment></comment></comment></comment>


How to gift wrap a cat. - <AUTHOR> http://www.youtube.com/watch?v=B-31F9_SxIg

<comment><USER2> This is very cute! What a nice cat.</comment>


Tell HN: I have a bunch of Google Wave invites - <AUTHOR>

If you want one, send an email to adam -at- snappsoftware dot com with your google email.<p>Cheers <comment><USER2> These things went from the hottest online commodity (selling on eBay, etc) to something that can't be given away. I think there's a conundrum — nobody is using Google Wave because there weren't enough people on it to begin with, but now people aren't interested in the invites because they hear nobody is finding a use for it.

This wasn't an issue with Gmail because it worked with all other email systems, whereas Wave is having to build its user base from the ground up.

I'm sure it's been discussed in numerous other threads, but is anyone genuinely using Wave for anything productive?

</comment><comment><USER3> I also have a ton of Google Wave invites (36 to be exact). Everyone that wants one already seems to already have one, but if you'd still like one send me an email to firstname.lastname@example.com.</comment>


Show HN: Free Company Logo API - <AUTHOR> http://blog.clearbit.com/logo <comment><USER2> I honestly thought this was going to generate a free logo and got really excited for some unknown reason? I guess I was wondering how it all worked, then I clicked through and it made way more sense. That was a wild ride!

<comment><USER3> Not quite free, but this does exist at a pretty low price point: [https://www.tailorbrands.com/](https://www.tailorbrands.com/)

<comment><USER4> Very interesting indeed. Is there any portfolio, even for fake brands, so I can see the range of styles their logos may have?

<comment><USER5> Hey there. I work for Tailor. We don't have currently have a portfolio, but we are working on something akin to this. For anyone interested, you can email me at email@example.com, and I'll send a coupon code your way so you can give it a try.

</comment></comment></comment></comment><comment><USER6> Killer work Alex! It's crazy you just rolled this out. We have been in development on something very similar but have yet to make a public push on the product. The main difference is we host the vector source file and build rasters from it. This helps maintain top quality at any size, and allows us to output to additional formats (i.e. PDF).

The product is still in alpha, but it's amazing how many similarities we came to with the URL scheme design. For example, image embedding:

[https://img.ogol.io/<domain.com>](https://img.ogol.io/<domain.com>) example: [https://img.ogol.io/ogol.io](https://img.ogol.io/ogol.io)

we also support downloading

[https://dl.ogol.io/<domain.com>](https://dl.ogol.io/<domain.com>) example: [https://dl.ogol.io/ogol.io](https://dl.ogol.io/ogol.io)

Each logo also has it's own page to make working with the asset outside of an API easy.

[https://ogol.io/ogol.io/nn0ymd](https://ogol.io/ogol.io/nn0ymd)

Our approach requires companies to confirm their domains and associate a vector logo with the domain. Your strategy obviously provides a lot of logos right out of the gates. Logos are such a pain to deal with, it's great to see the problem being attacked from a few different angles.

<comment><USER7> I'm curious about the claim "pixel perfect every time" seen on your home page. Do you employ some special algorithm to scale images, or do you just use the standard tools? As far as I know, scaling vector graphics isn't enough to guarantee pixel perfection (especially not at low resolutions), and low-res logos are usually hand-crafted by designers. Maybe you should also allow companies to upload raster logos?

</comment></comment><comment><USER8> Instead of relying on FB, Twitter, Company's site for the logo, wouldn't it be better to create a "Company Logo Service" with an API, with the below features -

0\. Change at one place, make it work everywhere. (consistent branding across the wild web).

1\. Upload your company logo here with us.

2\. Multiple versions.

3\. Multiple sizes.

4\. Control and Connect various sizes, versions with your various social accounts, newsletters, anything.

5\. IFTTT support.

6\. Get it printed on swag and merchandise.

7\. More...?

<comment><USER9> Seems like a good way to waste money on a service that will very seldom provide value (logo redesigns) and will not work across all platforms thereby introducing an additional thing you have to worry about instead of solving it.

Better idea:

1\. Take sheet of paper

2\. Write down where you use your logo

<comment><USER8> Biggest fan of working on paper, to the extent of carrying a clipboard in my laptop bag all the time. Along with other gadgets.

I wouldn't pay for something like that either. I was suggesting it be offered for free, like gravtaar.

</comment></comment></comment><comment><USER10> And when you use it, they get to collect all of the data about your visitors.

<comment><USER11> In what way?

Nothing about this API requires handing over more than the bare minimum of information (which domains you want logos for). How could they be expected to implement it without that information?

<comment><USER12> There's also the referrer header that gets sent out, which includes the URL of the page that is embedding the image. Not really "all data on your visitors" but depending on how you use it, may leak sensitive information if you're unwise enough to put it in the page urls (depressingly common), or allow them to track every visit throughout your site (on pages that embed the image)

<comment><USER11> There's no reason you have to directly embed the images.

If you want to preserve user privacy, you should definitely proxy this API.

</comment></comment></comment></comment><comment><USER13> Had to do it: [https://logo.clearbit.com/piedpiper.com](https://logo.clearbit.com/piedpiper.com)

<comment><USER14> It's outdated. They need a version or date parameter.

</comment></comment><comment><USER15> This has been done before (and posted to HN), and it had the same problem. Way too many false positives, especially with older sites.

[https://logo.clearbit.com/starfoods.com](https://logo.clearbit.com/starfoods.com)

<comment><USER16> This isn't trying to scrape the page and find something vaguely logo-like. Rather, it seems to be using iOS, OpenGraph and Twitter icons. In this case, the site has a strange OpenGraph image specified in its meta tags. If it produces a weird image it's because the site owner has specified an image which isn't their logo. It's not because the API picked a random image.

For this service, if it can find an image, it's at least an image the site owner wanted to be used to represent it.

<comment><USER17> I wouldn't have thought that the open graph image is a logo. Seems like that wouldn't be a reliable source for logos

<comment><USER16> Fair point. It's at least something they've chosen to represent themselves, however.

</comment></comment></comment></comment><comment><USER18> Hey Alex,

This is pretty sweet. Nice job! Is there a post where you talk about the tech behind this API? I've been working on a simple API that finds domain names from company names that I use on projects where I use business intelligence APIs like Clearbit and FullContact.

<comment><USER19> Fetch the domain at /, look for favicon/apple-touch-icon/OpenGraph image, fetch the image, store and serve.

<comment><USER20> Looks like it has twitter as a secondary source, eg.

[https://logo.clearbit.com/spacex.com](https://logo.clearbit.com/spacex.com) [https://twitter.com/spacex](https://twitter.com/spacex)

Maybe other fallbacks, too?

<comment><USER21> Also seems like some fairly primitive analysis would identify this as a suspect item, at least enough to be shunted off to some sort of triage. Logos, by and large, will have distinctly different data than images.

That, and it also doesn't match their favicon.

</comment></comment></comment></comment><comment><USER22> There has to be some level of fair use or copyright involved, no? You are taking corporate images, modifying them, and then distributing their modified brand/logo potentially without their consent. If they don't like the results, they could sue you.

Or at least, I feel that would be the case.

<comment><USER23> I tested a few examples, and it looks to just be parsing the page and returning the apple-touch-icon.

<comment><USER24> That doesn't explain where [https://logo.clearbit.com/debian.org](https://logo.clearbit.com/debian.org) comes from....

<comment><USER19> [https://www.debian.org/favicon.ico](https://www.debian.org/favicon.ico) can't be the source.

<comment><USER25> It looks like that's the Debian icon on Twitter.

<comment><USER16> [https://pbs.twimg.com/profile_images/1311499343/debian- squar...](https://pbs.twimg.com/profile_images/1311499343/debian-square.png)

Looks like it.

</comment></comment></comment></comment></comment></comment><comment><USER26> As a developer of a URL shortening service, this is incredibly useful. Social platforms scrape the contents of all shared URLs to offer a preview in a feed. With this service I can incorporate the logo of a site's destination URL into the scraped content.

</comment><comment><USER27> Yet another (hilarious?) false match: [https://logo.clearbit.com/exxon.com](https://logo.clearbit.com/exxon.com)

<comment><USER28> That's because Exxon specified that image. Check the HTML on exxon.com:

      <meta property="og:image" content="http://www.exxon.com/assets/imgs/en-us/energy-live-here-facebook.jpg">

<comment><USER29> That doesn't change the fact that it's a false positive…

</comment></comment></comment><comment><USER30> I'd be cool if they would provide some insight on how to make an existing website to work with their API. I always wanted to know what's the "standard" way to put a logo in the webpage. Some people uses just an IMG tag, other uses an H1 with an image replacement technique.

<comment><USER23> Looks like they're just returning the apple-touch-icon if it's available.

<comment><USER31> In my case they're returning an old version of the icon.

<comment><USER19> Same here. Any way to trigger a refresh?

</comment></comment></comment></comment><comment><USER32> Worked on something similar on a local open data hackathon before, but instead I used a scraper to parse the logos.

[https://github.com/c0dr/LogoParser](https://github.com/c0dr/LogoParser)

It worked okay for like 40% of the sites, and for the rest of the sites we used Python and scikit-learn to detect the logo from the page (threw all images of the page in the script and it returned if it was a logo or not). And this actually worked quite good, irrc over 90% of the test cases worked.

[https://github.com/tomsrocket/image- classification](https://github.com/tomsrocket/image-classification)

But yeah, using Twitter as a source might also be a good idea.

</comment><comment><USER16> Pretty cool! I think the API docs could possibly be a bit more precise, though. Perhaps something like this:

      You can also pass us the following optional query parameters.
      Parameter 	Default 	Description
      size 		128 	 	integer	Image size: Length of longest side, in pixels
      format 	"png"	 	string	File format, either "png" or "jpg"
      greyscale 	(not passed) 	boolean	If this parameter is passed, image will be desaturated

<comment><AUTHOR> Good idea - we'll make this change.

</comment></comment><comment><USER33> Thinking perhaps we have something set up odd in our HTML that's tripping up the API, but a bit confused why this seems to be returning nothing [https://logo.clearbit.com/korkapp.com](https://logo.clearbit.com/korkapp.com)

Any thoughts anyone?

</comment><comment><USER34> This is an excellent piece of marketing.

</comment><comment><USER35> I know Glassdoor is using Facebook as a source of their company logos

<comment><USER36> I'd like to see that open sourced. A lot of the projects I'm involved in could use it.

</comment></comment><comment><USER37> How would a logo image file have to be named to be found by this?

</comment><comment><USER38> This vaguely reminds me of Picons, which was the '90s solution to this problem (Gravatar for domains, but also for newsgroups and people):

[http://www.cs.indiana.edu/pub/faces/picons/](http://www.cs.indiana.edu/pub/faces/picons/)

If you've ever noticed the little logos on Gmane posts, they come from Picons and favicons.

</comment><comment><USER39> Works great! But I do wonder where it came from... parsed the HTML, grabbed the SVG and converted it to PNG... or simply got it from Twitter?

[https://logo.clearbit.com/h5mag.com](https://logo.clearbit.com/h5mag.com) from... <img class="logo" src="/img/h5mag-logo.svg" alt="logo H5mag">

</comment><comment><USER40> If you're using Twitter as a source for company logos, you might be serving a lot of rainbow icons this week!

</comment><comment><USER41> Late to the party, but this looks interesting.

Google does something similar for extracting favicons for any domain, such as [https://plus.google.com/_/favicon?domain=github.com](https://plus.google.com/_/favicon?domain=github.com)

</comment><comment><USER42> I noticed that you are returning the company name in the title. [https://logo.clearbit.com/fb.com](https://logo.clearbit.com/fb.com) .Is that intentional? Asking this because you provide a Company API too which is paid.

<comment><USER43> This API call is just returning a PNG image with almost no EXIF data. In that case, the title is set by browsers to the filename, which is equal to the domain name itself. Are you seeing something else in the title? (I see fb.com)

<comment><USER42> Saw this in response headers.

Content-Disposition:"inline; filename="Facebook.png""

I am using firefox which apparently uses this header to set the title. Chrome OTOH won't do it

<comment><USER43> Interesting. I did look at headers, but missed the Content-Disposition for some reason.

</comment></comment></comment></comment><comment><USER44> You need a better upscaling algorithm.

[https://logo.clearbit.com/alexa.com?size=512](https://logo.clearbit.com/alexa.com?size=512)

Ideally all your logos should be in vector and rendered to any size (or at least powers of 2 for easier caching).

</comment><comment><USER45> Maccman, Logaster offers own API which will generate logos. If you interested read more here [https://www.logaster.com/about- logaster/api/](https://www.logaster.com/about-logaster/api/)

</comment><comment><USER46> Hi. Nice idea. Images seem to be scaled not optimally though in same cases seeing jagged edges like here: [https://logo.clearbit.com/medigo.com](https://logo.clearbit.com/medigo.com)

</comment><comment><USER40> Wish there was an equivalent service but with masked images of wine bottles. Always wanted to create something like Delicious Monster but for wine cellars. All the sites/apps doing it are pretty ugly or largely text based.

</comment><comment><USER47> Are there terms of service associated with this API? I can't seem to find any.

</comment><comment><USER48> Great API, thank you!

I made a little hubot script for this: [https://www.npmjs.com/package/hubot- logo](https://www.npmjs.com/package/hubot-logo)

Use it like this: hubot logo stripe.com

</comment><comment><USER49> [https://logo.clearbit.com/armadilloaerospace.com](https://logo.clearbit.com/armadilloaerospace.com) Where is the armadillo? I want my armadillo.

</comment><comment><USER50> [https://logo.clearbit.com/news.ycombinator.com](https://logo.clearbit.com/news.ycombinator.com)

<comment><USER51> Doesn't work, though [https://logo.clearbit.com/ycombinator.com](https://logo.clearbit.com/ycombinator.com) does.

</comment></comment><comment><USER52> That's pretty dang cool. Might cause issues if clearbit ever looses the data and a bunch of websites link to it, but that's pretty standard.

</comment><comment><USER53> This is neat - it could use a background color option along with the ability to fill the logo with white.

</comment><comment><USER54> Doesn't work for my domain: zk.gd

</comment><comment><USER55> Nice job. It would also be great if there is option to get image data that can be used in data-uri.

</comment><comment><USER56> The trend is to have a different logo for apps and websites. another parameter might be helpful.

</comment><comment><USER57> Where do companies like clearbit and full contact get their user data?

</comment><comment><USER58> Isn't that what the favicon.ico in the root of your site for?

</comment><comment><USER59> Works great! Minor nitpick: Returns the old logo for Oculus.com

</comment><comment><USER60> Brilliant, this is helpful for building MVP products as well!

<comment><USER19> How so?

</comment></comment><comment><USER61> uhh... [https://logo.clearbit.com/amazon.com](https://logo.clearbit.com/amazon.com)

</comment><comment><USER62> Internal error for [https://logo.clearbit.com/taodyne](https://logo.clearbit.com/taodyne) :-( We recently chàged server, that might be why.

<comment><USER63> Seems to work fine if you put in a domain instead of just a name:

[https://logo.clearbit.com/taodyne.com](https://logo.clearbit.com/taodyne.com)

</comment></comment><comment><USER64> This is great I will have to remember it.

</comment><comment><USER65> Great work! Very useful :)

</comment><comment><USER66> Nice, seems super helpful.

</comment><comment><USER67> seems a simple change to gravatar to allow registration and use of simply the domain name to host the Corp Logo would be a 10 minute change.

</comment><comment><USER68> great!!!! really really great!

</comment><comment><USER69> Awesome! Have wanted this for so long!

</comment><comment><USER70> Brilliant!

</comment><comment><USER71> Well done!

</comment><comment><USER72> Just curious.. what do you guys use for API management to handle authentications, logging, rate-limiting, etc..

1\. Open-source solutions like KONG ([https://github.com/mashape/kong](https://github.com/mashape/kong)) or similar?

2\. Built in house?

3\. Commercial services such as Apigee, Mashery?

</comment><comment><USER73> Surely there's a trademark protection concern here.

<comment><USER74> Nope, trademarks are used to distinguish brands and ensure their authenticity, and that's exactly what is happening here. If people used this to impersonate another company (e.g. to pretend they had gotten their endorsement) then that's a problem. But as long as this is used as part of a directory (or similar) service there is no copyright or trademark problem.

</comment></comment><comment><USER75> arent there legal requirements about colors, sizes, and placement for logos? for instance you offer gray scale as a setting, i seem to recall all placement of MS logos requires approval and no altering of colors(i could be completely wrong)... are you protecting your users by disallowing them to use logos in ways that might upset the owner?

</comment><comment><USER76> Great idea, but something tells me the companies whose logos are available won't like it. It will be interesting to see how they react. Some will probably embrace it, but I can see some of the larger corps acting territorial.

<comment><USER77> I would argue opt-in for having your logo with the service, rather than opt- out, but it might be difficult to come up with a benefit that's enticing enough.

There's maybe some value in the logo owner being able to get information on who's using their logo (service not yet provided).

From the logo-consumer standpoint, it's pretty cool, though, it would be difficult to know if the logo is current enough.

</comment></comment><comment><USER78> Be careful with copyright issues. How do you make it work? Do you scrape them automatically or gather them from the brands marketing materials?

I tried different logos, and I find a few issues:

[https://logo.clearbit.com/mcdonalds.com?size=256](https://logo.clearbit.com/mcdonalds.com?size=256)

Mcdonalds US logo background should be red ([http://www.aboutmcdonalds.com/mcd/newsroom/image_and_video_l...](http://www.aboutmcdonalds.com/mcd/newsroom/image_and_video_library/logos.html) )

[https://logo.clearbit.com/bk.com?size=256](https://logo.clearbit.com/bk.com?size=256)

The quality of that one is bad. Wikipedia's one is a .svg : [https://en.wikipedia.org/wiki/File:Burger_King_Logo.svg](https://en.wikipedia.org/wiki/File:Burger_King_Logo.svg)

<comment><USER16> I don't think they'll have copyright issues, it'd probably be considered fair use.

As for the McDonalds logo, I suspect the turquoise is because that's the current background colour of mcdonalds.com

<comment><USER20> Or because it's from here: [https://twitter.com/mcdonalds](https://twitter.com/mcdonalds)

<comment><USER16> Ah, that makes more sense. It was mentioned below that it seems to be using Twitter.</comment></comment></comment></comment>