Mozilla's page talking about privacy has Google analytics enabled - <AUTHOR> https://shapeoftheweb.mozilla.org/trust/governmentSurveillance <comment><USER2> Mozilla have a Google Analytics Premium account and they try to minimize the information they share [1].

        Our Google Analytics premium account is set to opt-out on all of 3rd party
        uses of the data and the only people who have access to the anonymous
        aggregated data is Mozilla Employees. This is not the normal Google
        Analytics setup that most people use on other websites.

        Also, to increase privacy we flipped the anonymize flag in the Google
        Analytics request...

[1] [https://bugzilla.mozilla.org/show_bug.cgi?id=1122305#c8](https://bugzilla.mozilla.org/show_bug.cgi?id=1122305#c8)

<comment><USER3> Why don't they simply analyze the log files on their own, without sharing that data with other companies?

For example, running some log files offline through AWstats is not that hard, and the AWstats output is quite good for most purposes.

<comment><USER4> >AWstats is not that hard, and the AWstats output is quite good for most purposes.

You haven't done any serious web analytics at scale, have you?

<comment><USER5> You're missing the point so comprehensively I have to conclude it's deliberate.

<comment><USER4> Huh, am I? Has anyone offended by this "transgression" of privacy by Mozilla thought this through to its logical conclusion? Let's see.

1\. Mozilla is one of the good, independent orgs that don't have profit as their main goal. They do fight for the interests of the community at large.

2\. If they remove third-party analytics from their web properties, Mozilla instantly loses valuable actionable insights that significantly increase their efficiency as an organization. Creating a viable alternative to Google Analytics is practically impossible for Mozilla due to lack of resources.

3\. If Mozilla loses operational efficiency, Google/Microsoft becomes more powerful and are able to obtain more users for Chrome/IE. They use all analytics they need. Less users for Mozilla means less income from search engine deals and less influence.

4\. No meaningful privacy increase for users is achieved, Google Analytics is now installed on (billions - 1) websites.

So. You want a non-profit with proven track record of shipping great software and protecting the interests of individuals to take a significant hit in the name of hard-line ideological principle that won't really benefit the users.

I guess I am missing the point.

<comment><USER6> I mean this is an honest way, but what actionable insights?

Mozilla aren't selling anything on that page. They won't be making key engineering decisions off of the page.

Could you detail the gains that they could make that makes the world a better place? That justify _any_ sort of tracking over '300, 000 people viewed this page today' that you can get from your own logs?

There is some data that might be _occasionally_ useful, like screen sizes, but only _occasionally_.

<comment><USER7> Off the top of my head, based off things we normally look for in our analytics:

\- See how people get to the privacy page from where they enter the site. Useful to see if some categories are getting more traffic than others, so that we can re-balance if, for example, we think that Privacy is not getting the attention we want it to.

\- See how long people are staying on this page. What if the writing or infographic don't make sense to users? We can try and improve them so that users come away with a better understanding of privacy.

\- How are users interacting with those circles? If they're not hovering over any of the circles, maybe we should make it auto-switch between them to draw the user's eye over. Or maybe if they're only hovering over the first three, we should make those first three the most important aspects of privacy to make sure they're seen.

The goal of Shape of the Web is (in my eyes) to educate users about the issues that the open internet faces today, and to help give them a framework for thinking about what the web is (it's hard to think about a thing if you don't know how it's "shaped"). All of these metrics help us improve the page's ability to convey information so we can better educate users.

<comment><USER8> > \- See how people get to the privacy page from where they enter the site.

You don't need a 3rd party to learn the order of pages you served to any given client. That one is so simple you only need 'grep' and the server log. (aggregation into whatever statistics you want to learn is a trivial exercise left for the reader)

> \- See how long people are staying on this page.

The entire point is that you _do not_ have a right to that information, other than what you can infer from the client later loading another page. Applying technical methods to gain access to private information like this simply makes you the the spy invading people's privacy. Worse, as most people do _not_ understand these technical details, you are a eavesdropper who is preying on ignorance.

> so that users come away with a better understanding of privacy.

...while you simultaneously violate the same user's privacy. Do you seriously not understand that you're making the "We had to destroy the village in order to save it" style of ends-justify-the means argument that ignores how you've started to act like that which you are supposedly fighting against.

> hovering over

Again, the _entire point_ is that you don't get to know that information. That is a perfect example of the type of data the privacy-focused people are trying to protect. We really don't give a _damn_ if that information is _useful_ ; if you're recording anything beyond the HTTP requests you receive (the explicit request from the client), then you are the spy and therefore the enemy. If you want to understand how effective your pages are, _find another way_ to deduce that information. This is why traditional businesses pay people to participate in focus groups, to name one example.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> And they also include JavaScript from [https://ethn.io/](https://ethn.io/), the relative privacy value of which you can judge for yourself, and whose parent company, I note in the footer, was bought by Facebook...

<comment><USER10> These people have a Del tha Funkee Homosapien reference right on their landing page. I therefore can't muster any hate onto them.

</comment></comment><comment><USER11> When you open a freshly installed Firefox on Ubuntu or Windows (that is where I checked) you will have a google cookie set right before the first usage, without any chance of opting out or being asked before.

Yes, anybody can change the startpage, delete all cookies and restart the browser. How many users will do this? And does forcing every user into google surveillance comply with this privacy marketing of mozilla, or is it just a zynical fake campaign?

There should be a startpage explaining what cookies are, describing the difference between temporary and permanent cookies and how these help to track your web usage, and provide one single, visible button to delete all cookies.

After this I should be asked if I would like to help mozilla funding by redirecting me to a google web search which will set a permanent cookie.

<comment><USER12> Is this due to the Safe Browsing database? [http://blogs.wsj.com/digits/2012/02/28/the-google-cookie- tha...](http://blogs.wsj.com/digits/2012/02/28/the-google-cookie-that-seems- to-come-out-of-nowhere/)

If so then it shouldn't be present in current versions. Did you accidentally import cookies from another browser? Probably worth filing a bug if not.

<comment><USER13> > it shouldn't be present in current versions

This is what I see at launch[1]:

        http://clients1.google.com/ocsp
        https://safebrowsing.google.com/safebrowsing/download?...

[1] [https://cloud.githubusercontent.com/assets/585534/7666597/5f...](https://cloud.githubusercontent.com/assets/585534/7666597/5f287288-fbb9-11e4-877d-83d0fbc1c777.png)

<comment><USER14> The safe browsing cookie is in its own networking sandbox.

[https://dxr.mozilla.org/mozilla- central/source/netwerk/base/...](https://dxr.mozilla.org/mozilla- central/source/netwerk/base/nsNetUtil.h#1730)

[https://dxr.mozilla.org/mozilla- central/source/toolkit/compo...](https://dxr.mozilla.org/mozilla- central/source/toolkit/components/downloads/ApplicationReputation.cpp#958)

[https://dxr.mozilla.org/mozilla- central/source/toolkit/compo...](https://dxr.mozilla.org/mozilla- central/source/toolkit/components/url- classifier/nsUrlClassifierStreamUpdater.cpp#130)

</comment></comment></comment></comment><comment><USER15> I've had GA's domains redirected to 0.0.0.0 in HOSTS ever since I knew of them.

It's also another one of these single-page-apps that require JavaScript to display any content at all.

I think with such a design they're clearly not targeting the sort of privacy levels that more users on HN than the Internet in general expect.

<comment><USER16> Check out RequestPolicy sometime if you're concerned about GA and other tracking and went through the trouble to bit bucket it in hosts; it's really nice to be able to set which other sites any given site can contact, and I trust it more than the other curated options like Ghostery etc. since I can see for myself where each site is allowed to go.

<comment><USER17> Unfortunately the Firefox 38 update broke RequestPolicy.

There are other extensions that do a similar job, including a volunteer effort to continue the original extension, but right now none of them seems quite as neat and reliable as the original.

<comment><USER18> uMatrix has been recently released for FF. Basically, it's a better RP

[https://github.com/gorhill/uMatrix](https://github.com/gorhill/uMatrix)

<comment><USER17> That looks similar to existing plug-ins like Policeman. These are great for technically-minded power users who understand the implications, but IMHO they far too complicated for "normal" users who just want a bit of added privacy and security without spending half their lives tweaking configurations.

<comment><USER13> If you stick to clicking only the hostnames, it's no different than RequestPolicy. Otherwise there is uBlock's dynamic filtering which does essentially the same thing as RequestPolicy:

[https://github.com/gorhill/uBlock/wiki/Dynamic- filtering:-de...](https://github.com/gorhill/uBlock/wiki/Dynamic- filtering:-default-deny)

</comment></comment></comment></comment></comment></comment><comment><USER19> Mozilla tried to launch a site to help educate people while tracking engagement?

This seems like a much bigger issue than the NSA copying entire datastreams from American internet hubs.

<comment><USER20> I don't get your comment (even sarcastically). It's not that big, but it's still a problem. People who are trying to avoid being tracked would probably prefer not being tracked. The page is self-defeating.

<comment><USER21> Well I do! Complaining about a moz site having google analytics is 100% bike shedding, everyone has an opinion because they have no idea how to fix or address the bigger issues, so lets complain about a website, we all know how to do that!

If we cannot pick our battles, then we will just lose because of the dissipation of all of our efforts across everything "that is still a problem".

When I weigh out the benefits vs the costs, I dont see why moz would pick any other option, everything else is more work, and google already tracks you across most of the internet.

Whether or not you showed up on a mozilla page is not going to change their understanding of your habits by much.

<comment><USER20> Mozilla isn't some bystander, they're a major player in the fight against mass surveillance. That's why it gets such a big reaction when they seem to be enabling it. People start doubting their whole commitment to the cause.

</comment></comment></comment></comment><comment><USER22> The website is totally broken for me: [http://i.imgur.com/y01g1NG.png](http://i.imgur.com/y01g1NG.png)

<comment><USER23> You should mention which platform/browser/version you're running so they can fix it.

</comment></comment><comment><USER24> This is completely inacceptable.

Preaching water and drinking wine, eh?

If they'd really want some kind of tracking, they could have used a locally installed system like piwik, as the largest issue with tracking comes when the data from many sites is combined.

<comment><USER25> Sure. They could've done that. But that would cost how much to install, manage and configure remembering that (a) Mozilla gets quite a bit of traffic and (b) that is money that could be better spent on their products.

</comment></comment><comment><USER26> Not only enabled, but in breach of the Google Analytics' Terms which state very clearly: _" You must post a Privacy Policy and that Privacy Policy must provide notice of Your use of cookies that are used to collect data. You must disclose the use of Google Analytics, and how it collects and processes data. "_

See section 7 "Privacy" here for the full text. [http://www.google.com/analytics/terms/us.html](http://www.google.com/analytics/terms/us.html)

<comment><USER15> They do mention it here, so I don't think they violate GA ToS:

[https://www.mozilla.org/en-US/privacy/websites/](https://www.mozilla.org/en- US/privacy/websites/)

 _Third party Services We use third party services such as Google Analytics and Optimizely. They use cookies, IP addresses, and online data tools._

<comment><USER26> I see no privacy policy on the shapeoftheweb.mozilla.org site though you are correct that they do post that privacy policy on the completely different website www.mozilla.org.

I suppose they would argue that's the same but I don't think it is good enough (especially for a site preaching privacy values). It should be down in the footer, or even better they should be using Piwik and skipping GA completely.

To me, this feels like a website built by a pro-privacy team who had some marketing or PR person slap the GA code in there with no comprehension of irony at all.

EDIT: Also to note that mozilla.org uses UA-36116321-1 tracking and shapeoftheweb.mozilla.org uses UA-49796218-22, which indicates to me that they are aware that these are two distinctly different sites.

<comment><USER27> >I see no privacy policy on the shapeoftheweb.mozilla.org site though you are correct that they do post that privacy policy on the completely different website www.mozilla.org.

It's on the same subdomain, and it includes link to mozilla.org which has link to privacy policy which also applies to shapeoftheweb.mozilla.org:

>This privacy notice applies to Mozilla operated websites, which include the domains mozillians.org, mozilla.org, firefox.com, openbadges.org and webmaker.org. This includes, for example, bugzilla.mozilla.org, reps.mozilla.org, careers.mozilla.org, developers.mozilla.org, support.mozilla.org, addons.mozilla.org, and wiki.mozilla.org.

</comment></comment></comment></comment><comment><USER28> one of the prime reasons gnu forked firefox for icecat was google safebrowsing , besides that i dont think firefox really doesnt give a shit about your privacy and shit like that . their primary concern is to ship software , not code quality or issues of relevance to users .if the illusion can be maintained that it does care about your privacy then it works fine for them , it works fine for their major "donors".

</comment><comment><USER29> Next time you go to a movie theatre and there's someone standing there keeping count of how many people are going in - because it's there job or something - make sure to complain they're infringing on your right to privacy.

<comment><USER30> That same person is also standing at the entrance of almost every other building. To make his job easier he's also given you a unique identifier, so that he can notice when you enter a building he watches. I'm sure you've never noticed him, most people don't.

<comment><USER31> And at the end of the day, he goes over hist list of what buildings you went into, to analyze what sort of things you like so he can show up at your door as a door salesman to sell you some product he believes you will be interested in.</comment></comment></comment>


Gary Vaynerchuk Joins DULO as Head of Marketing - <AUTHOR> https://weardulo.com/blogs/news/the-marketing-mastermind-behind-our-communication-strategy <comment><AUTHOR> Excited to welcome GaryVee as our Head of Marketing.

We look forward to working together in building DULO into the first two trillion dollar company. Apple/Amazon might beat us to the first.

</comment><comment><USER2> Who cares?

<comment><AUTHOR> Apparently, no one.</comment></comment>


Electoral College Members Can Defy Voters' Wishes, Court Rules - <AUTHOR> https://www.nytimes.com/2019/08/22/us/politics/electoral-college-faithless-elector.html <comment><USER2> Whats the point of having actual human electors if they can't be faithless? Couldn't the Founding Fathers just say tally up the electoral votes if a mechanical transition from popular to electoral votes was desired?

<comment><USER3> That was the precise idea - and in an age when riding from the states to DC could take a month or more, the mechanism for that tally was electors who physically travelled to DC, and were sworn to vote as they were directed by the populace.

<comment><USER4> Proof?

We do have records of the arguments that were made for the elector system mandated by the Constitution, and they demonstrate that your "precise idea" is a fabrication.

Here is some reading for you: [https://en.wikipedia.org/wiki/Federalist_No._68](https://en.wikipedia.org/wiki/Federalist_No._68)

It had almost nothing to do with the practicality (or lack thereof) of the popular vote. The debates focused upon balancing the right of the people with the right of the states, i.e., the ability of states with large populations to make the votes of smaller states irrelevant. Hamilton also focused on the need for trusted electors so that the people both had a say, and trusted individuals could avoid rash populism. I.e., the value of a representative form of election. The transient nature of the college was also important. The electors would have one task, and then be dismissed. They could not be people with a vested interest, such as members of congress, governors, etc. This also made them less likely to be influenced by foreign powers, as they would not be electors long enough to be so influenced.

<comment><USER5> There is nothing in 68 about states rights or relative populations. Central to 68 is the connection between regular citizen voters choosing Electors, directly, amongst themselves. They were to be deliberative, self-evidently independent from partisan party politics, chosen from the general population

Federalist 68 proposes a mechanism we have not used since before the Civil War. The ballot would have been write-in only, and the name you were writing in was a person who lived in your own state, not a presidential candidate.

 _but to men chosen by the people for the special purpose_

 _The choice of SEVERAL, to form an intermediate body of electors, will be much less apt to convulse the community with any extraordinary or violent movements, than the choice of ONE_

Unfortunately, the Founders appear to not have anticipated the wholesale corruption the party system would employ to sabotage both common sense and deliberate design, by making laws at state level to explicitly make Electors not from the general population but exclusively party loyalists: people who have sworn money and allegiance to their respective party. Who and what you are really voting for when you tick a box for a candidate, is not the candidate, but the candidate's party and that party system, and the state laws say the popular vote result is to cause that party's pre-selected loyalists to become Electors.

What we have isn't anything like Federalist 68.

<comment><USER6> That is what bugs me. There is no realistic information shared about electors. It seems to me these people's character should be of the utmost importance from what I've read on the subject. Their neutrality from partisan politik was supposed to be a feature to guard against dropping chief executive authority on a candidate of ill nature.

It's a pattern that happens all over the government. The masses are the first filter, a second pass is done by a smaller (generally more recognized) few, and then reconcile until everyone is satisfied.

</comment></comment></comment></comment></comment><comment><USER7> It's the 10th Circuit Court of Appeals, so it's not binding on the rest of the country. It would be good if this went to the Supreme Court and was ruled on while it's just one elector, and isn't going to actually change an election. (Lawrence Lessig is on the side that won this ruling. He's trying for a Supreme Court decision, one way or the other. But the only way to get that is if the other side appeals this ruling, and the Supreme Court agrees to hear the case.)

</comment><comment><USER8> Faithless electors are hardly a new phenomenon.

[https://en.wikipedia.org/wiki/Faithless_elector](https://en.wikipedia.org/wiki/Faithless_elector)

<comment><USER9> Exactly. This is how it has basically been for the past 230 years. The ruling in no way "kicks at the foundation of how America chooses presidents".

A few states recently enacted an unconstitutional law to attempt to void the faithless electors vote, and all this ruling does is clarify that those state laws were indeed unconstitutional.

<comment><USER10> I agree that the 12th amendment doesn't allow states to void the faithless elector's vote, but it would be constitutionally permissible for them to criminalize faithless voting, would it not?

<comment><USER11> > _it would be constitutionally permissible for them to criminalize faithless > voting, would it not?_

No, according to the court's opinion ("slip opinion"), starting at p.73 of the PDF [0]. I've posted excerpts in a top-level comment.

[0] [https://www.ca10.uscourts.gov/opinions/18/18-1173.pdf](https://www.ca10.uscourts.gov/opinions/18/18-1173.pdf)

</comment></comment></comment></comment><comment><USER12> The problem with the system is that it's not one person one vote. If you're in New York, your vote is basically worthless. And it shows. You barely ever see presidential election ads on TV, or get any robocalls. Meanwhile, people in swing states are inundated.

</comment><comment><USER5> The party system has completely perverted the intent of the Electoral College, most centrally by populating it with party loyalists, the worst possible people on earth for this task.

Federalist 68 says Electors were to be deliberative people, people chosen for this task, and not to any preestablished body. Electors chosen from the general mass by their fellow citizens will best be able to carry out "complicated investigations". There is no complication or investigation in the current process! It's 180 degrees from Federalist 68.

 _Nothing was more to be desired than that every practicable obstacle should be opposed to cabal, intrigue, and corruption. These most deadly adversaries of republican government might naturally have been expected to make their approaches from more than one querter, but chiefly from the desire in foreign powers to gain an improper ascendant in our councils._

The present system lends itself directly to blackmail because those with all the money both choose Electors, and are Electors. They are not chosen from the general mass, they are not chosen by the people. And further:

 _They have not made the appointment of the President to depend on any preexisting bodies of men, who might be tampered with beforehand to prostitute their votes;_

What persons could possibly be more of a prostitute than party loyalists? We would be better off if the Electors were randomly selected from the general population, minus the expressly listed people in Federalist 68: politicians or _other person holding a place of trust or profit_.

[https://avalon.law.yale.edu/18th_century/fed68.asp](https://avalon.law.yale.edu/18th_century/fed68.asp)

<comment><USER13> Party loyalists are the opposite of prostitutes. Prostitutes can be bought. Party loyalists are True Believers. They don't make a lot of money, and they spend years refining their messages with each other. They have a sincere belief in what they're doing, and believe it to be the best way to run a country.

They may well be wrong, stupid, or even malignant. They certainly have some strange bedfellows: winning elections or votes means crossing that 50% level, which requires making friends with people whose interests are only partially aligned with yours (as opposed to the people whose interests are diametrically opposed to yours). Their loyalty is at least partly sunk-cost fallacy: it takes a long time to be a party insider and they can't just hop over to any other party without losing those years of trust built up.

But what they aren't, is prostitutes. For better or worse, they believe.

</comment></comment><comment><USER14> Wasn't that part of the original intent?

<comment><USER15> Divining original intent is weird because it's from an era where not even adult white males had universal suffrage. Prior to the mid 19th century, nearly all states required you to be a land-owner to vote. I've always viewed the electoral college as an enlightenment-era hack to work around a scenario where one state would "liberalize" suffrage to garner outsized influence during a national election. If this was 1790, non-land owners deciding an election would be the feared "tyranny of the majority" the founders sought to prevent; and that's not even counting suffrage for women and non-whites.

At least _in theory_ (putting aside any voter suppression efforts), the US today has near universal suffrage for all adults, with the only remaining restrictions being placed on felons (of which we have many). So it really doesn't make sense: We functionally have the popular vote, but we have this weird legacy layer on top that, in 2000 and 2016, selected someone who lost the popular vote.

<comment><USER16> We don't have to divine the original intent. There are historical documents that lay out what the founders were thinking, not least of which is The Federalist Papers #68.

[1]: [https://www.historycentral.com/elections/Federalist.html](https://www.historycentral.com/elections/Federalist.html)

[2]: [https://en.wikipedia.org/wiki/Federalist_No._68](https://en.wikipedia.org/wiki/Federalist_No._68)

<comment><USER17> Using the federalist papers as an example of a straight forward reading of intent is pretty bold.

I for one won't pay any tribute to them than exceeds their merit.

<comment><USER18> The federalist papers were intended to convince Americans to support the new constitution so it would get ratified, so I feel that Alexander Hamilton deliberately going out of his way to discuss how it was supposed to work captures something about the intent of those who ratified it based on that sales pitch.

<comment><USER17> There is approximately 200 years of the federalist papers being used in court decisions and it's been controversial the whole time.

The Wikipedia article on them has a surprisingly good discussion on their use in the courts.

</comment></comment></comment></comment></comment></comment><comment><USER11> It's worth noting that the decision — by a three-judge panel of the appellate court — is only an interim decision.

In essence, the _trial_ court took a shortcut — in software terms, an early return or -exit: The trial judge concluded that, when Colorado's secretary of state removed a member of the Colorado delegation to the Electoral College (for having voted for Kasich instead of Clinton), the removed "elector" had no legal right to sue for nominal damages because the Colorado secretary of state had the legal authority to remove the elector. The trial judge therefore summarily tossed out the removed elector's lawsuit.

The appellate court panel concluded that the trial judge got the law wrong, and therefore the removed elector _did_ have the right to sue for nominal damages. The panel sent the case back to the trial court so that the lawsuit could (in theory) proceed normally.

The state has the right to appeal further, to the entire appellate court sitting "en banc" and/or to the Supreme Court.

Here are some excerpts from the three-judge appellate panel's opinion (which I find compelling, incidentally):

"[T]he Supremacy Clause is broader than preemption; it immunizes all federal functions from limitations or control by the states." Slip op. at 75 (citation omitted).

"Unlike the President appointing subordinates in the executive department, states appointing presidential electors are not selecting inferior state officials to assist in carrying out a function for which the state is ultimately responsible. Presidential electors exercise a federal function—not a state function—when casting their ballots. Burroughs, 290 U.S. at 545. When undertaking that federal function, presidential electors are not executing their appointing power's function but their own." _Id._ at 82-83.

"As the text and structure show, the Twelfth Amendment allows no room for the states to interfere with the electors' exercise of their federal functions." _Id._ at 86.

"Dictionaries from the relevant period support Mr. Baca's contention that the drafters of the Twelfth Amendment intended electors to exercise discretion in casting their votes for President and Vice President." _Id._ at 88.

"As these sources reflect, the definitions of elector, vote, and ballot have a common theme: they all imply the right to make a choice or voice an individual opinion. We therefore agree with Mr. Baca that the use of these terms supports a determination that the electors, once appointed, are free to vote as they choose." _Id._ at 90 (footnote omitted).

"In summary, the text of the Constitution makes clear that states do not have the constitutional authority to interfere with presidential electors who exercise their constitutional right to vote for the President and Vice President candidates of their choice." _Id._ at 93.

"Although we concur with _[Colorado 's]_ review of historical practice _[of elector pledges],_ we cannot agree that these practices dictate the result the Department seeks. First, and most importantly, the practices employed—even over a long period—cannot overcome the allocation of power in the Constitution. McPherson, 146 U.S. at 35–36. Second, there is an opposing historical practice at play: a history of anomalous votes, all of which have been counted by Congress." _Id._ at 99. "This uninterrupted history of Congress counting every anomalous vote cast by an elector weighs against a conclusion that historical practices allow states to enforce elector pledges by removing faithless electors from office and nullifying their votes." _Id._ at 101.

[0] [https://www.ca10.uscourts.gov/opinions/18/18-1173.pdf](https://www.ca10.uscourts.gov/opinions/18/18-1173.pdf)

</comment><comment><USER19> I really find it amusing that it was Democrats accusing _Trump_ of not accepting the outcome of an election....

<comment><USER20> I still don't understand why they call Trump a populist president when [HRC] had the bigger populist vote count.

<comment><USER21> I think you may be confusing the words populist and popular.</comment></comment></comment>


Equation: How Much Money Do Spammers Rake In? - <AUTHOR> http://www.wired.com/magazine/2011/02/st_equation_spamprofits/

<comment><USER2> > _G = E x M x D x F x V x B x P_

It's the Drake equation for spam! $7000/day is not too shabby, either...

</comment><comment><USER3> Hi guys, I worked with Julie in writing this article. I'd be happy to answer any questions you have about the work. I was indeed inspired by the Drake equation in coming up with this interpretation of our results :)

If you'd like to learn more about this experiment, the Wired article is based off of: <http://cseweb.ucsd.edu/~savage/papers/CACMSpam09.pdf>

<comment><USER4> Was this a technically difficult operation to undertake? How long did it take to plan and execute? i'm assuming that it's not that tedious of a task to scale and automate.

In going through this exercise were you able to come up with ideas to combat spam more effectively?

<comment><USER3> I wouldn't say it was incredibly technically difficult, the worst parts were probably reverse engineering the somewhat funky custom encoding that the botmaster was using for the C&C communication, and then writing the custom router software to allow us to rewrite live tcp flows (we used click: <http://read.cs.ucla.edu/click/click>).

We first started experimenting with the storm botnet about six months before doing this experiment. Once we realized what their architecture allowed us to do (MITM on the botnet's C&C), it probably only took a month or two to put together the infrastructure needed to conduct the experiment. Scaling to more nodes would have been relatively trivial, as the VMs running the Storm nodes were completely unmodified and we could have easily brought more online behind our flow-modifying router if necessary.

A colleague of mine did come up with one idea called "botnet judo" (paper here: <http://www.cs.ucsd.edu/~voelker/pubs/judo-ndss10.pdf>) whereby we run spamming bots within a contained environment that "seems" to have SMTP connectivity but actually just sinkholes all the spam, and then we developed highly effective and specific regular expressions from each bot's spam corpus.

<comment><USER4> Wow, that's really great. Thanks for the insight!

Was this project done as a thesis paper or was there an alternative purpose for undertaking such a long project? I'm pretty impressed with the execution of your team.

<comment><USER3> I wouldn't consider it "a thesis paper," but this project will eventually be part of my PhD thesis. Overall I would just say that we just seized the opportunity and wrote a decent paper. I, too, am impressed with our team and certainly would be nowhere without it. Glad you've enjoyed our work!

</comment></comment></comment></comment></comment><comment><USER5> I never understood why email servers never adopted something like the 3-way- handshake, which ultimately would increase the bandwidth and processing power required per email. It would theoretically make bot-nets easier to find and protect against. However, I admittedly don't know much about the industry, so there's probably a simple answer.

<comment><USER6> I dont really follow what you're saying. Why do you think a 3 way handshake would make any difference here? Why would it make bot-nets easier to find?

<comment><USER5> Spam is a numbers game. If you make it harder for spam messages to be sent out, spammers 1. send less spam by default 2. increase hardware. (realize 2 can also include increase cost if not using a "free" bot-net)

If all SMTP servers were required to receive and send back a token/packet before their original message was delivered, the bandwidth/cpu etc... required to send the message will have increased.

Send original to recipient server, receive from recipient server, send to recipient server. Then the mail is delivered.

Example: A single spammer can send out 50 million emails / month on current system. Introduce a 3-way & that number drops.

If the spammer wants to get back to sending 50 million / month, a significant increase in hardware will be required.

<comment><USER7> In my experience, spamd (<http://www.openbsd.org/cgi-bin/man.cgi?query=spamd>) is remarkably effective, and its greylisting works by requiring a request/response before the first valid transmission.

</comment></comment></comment></comment><comment><USER8> "Then the researchers calculated an estimate of how much money the spammer grossed per day: about $7,000."

That's great, but gives me absolutely no context to answer the actual question, "How much do spammers rake in." Is 7K high, low or average for a spammer? What's the total revenue of all spammers? How many spammers are there? What is a spammer- an organization of 10, 20, 100 people, or is it one guy?

</comment><comment><USER9> I'm more interested in ad-spam than this kind of botnet fraud spam.

For instance, if I built a twitter bot replying to anyone saying "iPad" with a link, then the page at the end of that link was absolutely filled with ads. How much money would I make?

It seems to be a somewhat viable method of getting some cash because you see a lot of those bots around.

</comment><comment><USER10> 0.238 * 0.000127 * 100 * 1700000 * 550 * 0.093 * 0.266 = 7000

So they assume 90.7% of messages get caught by spam filters.

Apparently they send out around 1 billion emails, 23.8% of which gets delivered. Around 2600 people read the emails, and a quarter of them will an average of $100.

</comment><comment><USER11> I hate how the article doesn't mention any numbers / metrics except for the final dollar value.

<comment><USER12> Check the graphic below the article. It's got most of the numbers.</comment></comment>


ANSI Z535 Compliant Safety Sign Generator - <AUTHOR> https://observatory.db.erau.edu/generators/signs/ <comment><USER3> Danger! Not only will this kill you, it will hurt the entire time you are dying:

[https://observatory.db.erau.edu/generators/signs/output/2020...](https://observatory.db.erau.edu/generators/signs/output/20200818203655.png)

My partner's coworker had this up in his office. They're in health and safety.

</comment><comment><USER4> The best part of this is the Random button.

"It is against federal regulations to invent beyond this point."

Sounds like my old boss: "Think outside the box, but think within my box."

</comment><comment><USER5> Think there's a race condition here, I get other people's signs... Danger of using the date and time as a file path, I guess.

<comment><USER6> makes it easier to browse all the hilarious signs people are making - <USER2> should implement a gallery. I'm having more fun with this than I should be.

<comment><USER7> Reading through all of those signs makes it clear that most people who come to HN for civilized discussion also enjoy the opposite end of the spectrum in a different context.

</comment></comment></comment><comment><USER8> Very nice - [https://observatory.db.erau.edu/generators/signs/output/2020...](https://observatory.db.erau.edu/generators/signs/output/20200818195608.png)

</comment><comment><USER9> [https://observatory.db.erau.edu/generators/signs/output/2020...](https://observatory.db.erau.edu/generators/signs/output/20200818191055.png)

</comment><comment><USER10> I always need a label to understand how icons are supposed to be used the first time. e.g., my best understanding of one of them: [https://observatory.db.erau.edu/generators/signs/output/2020...](https://observatory.db.erau.edu/generators/signs/output/20200818165729.png)

<comment><USER11> [https://observatory.db.erau.edu/generators/signs/output/2020...](https://observatory.db.erau.edu/generators/signs/output/20200818171611.png)

<comment><USER12> Dammit.

</comment></comment></comment><comment><USER13> [https://observatory.db.erau.edu/generators/signs/output/2020...](https://observatory.db.erau.edu/generators/signs/output/20200819074446.png)

</comment><comment><USER14> I get a 404 error when "Generate" is selected (although "Random" mostly works, but sometimes the picture is truncated).

Is there any source code available for such a program to use locally?

</comment><comment><USER15> [https://observatory.db.erau.edu/generators/signs/output/2020...](https://observatory.db.erau.edu/generators/signs/output/20200819080647.png)

</comment><comment><USER16> [https://observatory.db.erau.edu/generators/signs/output/2020...](https://observatory.db.erau.edu/generators/signs/output/20200819043646.png)

</comment><comment><USER17> Great tool for both safety and entertainment. I foresee printing many stickers for my garage/shop and general hijinks.

</comment><comment><USER18> This thing is a total meme generator...

</comment><comment><USER19> !Caution

This is the best!</comment>


Facebook for Android has a bug that lets you send messages without Messenger app - <AUTHOR> http://venturebeat.com/2015/06/26/facebook-for-android-has-an-odd-quirk-that-lets-you-send-messages-without-installing-the-messenger-app/

<comment><AUTHOR> This is weird. Anyone have any idea why this happens?</comment>


Japanese startup could be worth $200M – here's why the founder won't sell - <AUTHOR> http://www.techinasia.com/japanese-big-data-startup-worth-200m-heres-founder-selling/

<comment><USER2> This reminds me of when I used to work at Q-go[0] here in Amsterdam. We were doing very similar things, NLP search engines to improve user interaction in various applications, mainly websites and customer support systems.

During my time there we did pretty much only latin script languages, as for some reason we kept having troubles with unicode.

Would be nice to see how Preferred Infrastructure analyses their input, but I couldn't find any specs on their website really. On the other hand, I can't find any public information on how Q-go did that either. I guess these things are a bit of trade secrets..

[0]. [https://en.wikipedia.org/wiki/Q-go](https://en.wikipedia.org/wiki/Q-go)</comment>


Hiring an engineer over telnet - <AUTHOR>

$ telnet sonsuzdongu.com 1337
(Turkish) <comment><USER2> It's awesome. I like it.

Watching Sonsuzdongu's (infinite loop in Turkish) progress since it's founding, I find it an exciting new company which I hope they are able to influence and improve the work environments of programmers in Turkish companies by being an example.

</comment><comment><USER3> If you could translate that to English, that would be great.

<comment><USER4> Google translate does a decent job

</comment></comment><comment><USER5> amazing. a gimmick, certainly, but a good one.

</comment><comment><USER6> Very interesting!

It remembers me of when I used telnet to play MUD and MUSH games :) (how I miss those! Specially coding for MUSHes that use a variant of LISP! Functional Programming is very fun!)</comment>


Lost My Doggie - Service Helps Find Lost Pets - <AUTHOR> http://www.lostmydoggie.com/

<comment><AUTHOR> I got a call from this service on behalf of one of my neighbors who lost his dog. I went to look at the service and though that this was a great idea. It appears to be a fully automated service that combines a request form, a GEO database, a telephone number database, and an automatic calling service. I think this is a great example of startup that a one or two person team could build by combining several existing web services to satisfy an existing need.

</comment><comment><USER2> This service seems in line with Magic Jack and WebKinz. Software designed for lower tech experiences people who value utility, but not a pure pixel based experience.

This class of startup is really interesting. From what I've read MagicJack could do $100MM in revenue and WebKinz is a cash factory throwing off $750MM per year. Both utilize software, but it isn't the lead aspect of the service.

These companies really fly under the radar relative to the other hot startups of the day. ReadWriteWeb covers them to some degree, but it is an area that deserves a LOT more coverage.

</comment><comment><USER3> This is a great example of a business where the revenue opportunity when sold as an insurance policy may be much higher than when sold as a per- incident/per-claim service.

Reposition as lost pet insurance, with differing rates based on type of pet, age of pet, whether or not pet has a homeagain RFID implant, etc. Perhaps also offer a standard response or a premium response, where the standard includes robocalls, craigslist posting, notification to local pet shelters/SPCA/dog catcher; premium level includes posting 'lost dog' flyers in local area using craigslist-recruited 'street teams.'

Sell it through vets, a PetCo partnership, dogster.com, etc. $29/year or something affordable like that. Get a special tag and everything "this pet protected by Pet Guardian" or whatever. See also AAA, TowBoat/US, Lifelock for insurance programs that target unlikely bad things like broken down car, grounded boat, or stolen identity.

"Do you care enough about your doggie to protect him with Pet Guardian?"

Market size is big: 60% of American households own pets. If just 0.50% of these pet-owning households bought lost pet insurance @ $29/year, that's an $8mm/yr business. If you got 3% of the market, it's $50 mm/yr.

<comment><USER4> I don't think many people want to buy insurance whose maximum possible payout comes down to a couple of hundred bucks. People generally only insure against risks which they can't afford.

<comment><USER5> Except for health insurance, where people insure against the risk that they're going to go to the doctor for a routine annual checkup this year. (Other people have said it better than me: its like submitting a claim against your car insurance to pay for an oil change.)

</comment></comment></comment><comment><USER6> A custom mouse cursor on a website! Haven't seen that in a while.

</comment><comment><USER7> What about the new law about robo-calling? Will they be affected by that?

<comment><USER8> Well something perhaps relevant from the FAQ:

LostMyDoggie.com, LLC is classified and registered as an exempt organization by the DNC, thus we can phone your neighbors who are on the Do Not Call List.

</comment></comment><comment><USER9> Looks like an amazing opportunity for spammers to hammer a specific neighborhood ... or for teens to crank call the whole neighborhood.

<comment><USER8> The cost would prohibit teenagers.

How effective would: "Your neighbour "Buy lots of Acme products" has lost their dog." be?

<comment><USER9> Once I had a job in high school I can say that a fair bit of my friends' collective budget was directed into the prank fund. $125 to spread unscrupulous rumors regarding our school principal to 750 homes would not have deterred us.

</comment></comment></comment><comment><USER10> I've been wondering, couldn't missing pets be tracked with dogs? Like they could find them via their smell?

<comment><USER11> search and rescue dogs (and bomb/drug sniffing dogs) have to have a lot of training, and i'm sure they are quite pricey to hire out.

also, since a lost pet is probably roaming around quite a bit vs. a missing person that is lying in a ditch, they are probably quite hard for another dog to track reliably.</comment></comment>


The Internet Is Being Protected By Two Guys Named Steve - <AUTHOR> http://www.buzzfeed.com/chrisstokelwalker/the-internet-is-being-protected-by-two-guys-named-st <comment><USER2> "a quirk of the U.S. legal system meant that cryptography was, until the late 1990s, placed on the U.S. Munitions List, alongside semi-automatic firearms and tanks."

This was no quirk. The US government made deliberate efforts to limit the availability of encryption software, even adding it to international export control lists where it previously did not exist:

[http://cryptome.org/jya/wass-suks.htm](http://cryptome.org/jya/wass-suks.htm)

<comment><USER3> I may be outspoken on this, but I think that it was an appropriate move to keep cryptography (or some kinds of cryptography) on such munitions lists.

<comment><USER4> The kind of cryptography that lets people communicate securely? Belongs on the same list as physical objects that intended to pierce walls and flesh?

I'd also like a more in-depth explanation.

<comment><USER5> Historically secure communication has been a weapon of war.

[http://en.wikipedia.org/wiki/Dual- use_technology](http://en.wikipedia.org/wiki/Dual-use_technology)

<comment><USER6> Cryptography is a defensive weapon. Zero-days on the other hand, are an offensive weapon. There are distinctions between helmets and clubs, you know, and the law should recognize these.

<comment><USER5> (Assuming it works) is ballistic missile defense not a war technology?

<comment><USER7> The intended use might be defensive, but ballistic missile can be used for offense.

<comment><USER8> I think danielweber is referring to systems designed to intercept and destroy ballistic missiles, not to ballistic missiles used for defensive purposes

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Does "ultimatum" and "raft of complicated last-minute changes" not raise anyone else's tinfoil paranoia alarms?

Those commits should get significant scrutiny, because it sounds like US/CA govt were given an indirect opportunity to push whatever changes it wanted AND rushed code isn't necessarily the best either.

(Also I'm glad FIPS mode is dead in LibreSSL.)

<comment><USER10> Hmmm... Never ascribe to conspiracy what can be adequately explained by bureaucracy. The feds love them some standards.

<comment><USER11> Once upon a time I used to believe this. Post Snowden, I tend to believe the reverse.

</comment></comment></comment><comment><USER12> I find it a great shame that literally a handful of independent individuals take on responsibility compensated at a minuscule fraction those that directly benefit from it: ISPs, Certificate Providers (particularly certificate providers, absolving themselves of accountability for potential loss) and Hosting Providers.

<comment><USER13> That's a consequence of being open source. All the main open source licenses mean that anyone would be able to use OpenSSL without paying a cent to the creators.

Advocates of open source often claim that creators of open source software can make money by selling services to users, like consulting services. As this article (and others) describe, this approach also didn't work that well for the OpenSSL team.

<comment><USER12> Open source > indeed, I agree.

My perspective is principally the harmony or conflict of the open source -ness of OpenSSL, and the Tragedy of the Commons [https://en.wikipedia.org/wiki/Tragedy_of_the_commons](https://en.wikipedia.org/wiki/Tragedy_of_the_commons) of all using a resource while few feeling the need to compensate.

It is interesting that open source has often found solutions around this 'tragedy' \- ownership (contributing or forking) vs access (using) - but I feel a shame that those that work hard towards creating a public good (OpenSSL) only receive recognition when things go wrong, while those that have criticised (the possibly competing consultancies, perhaps) have themselves not forked or recreated a better solution, as it seems having the ability, confidence or willingness to carry the risk to credibility (for a better solution), or knowingly taken advantage of an exploit, is more profitable than giving back.

tl;dr I admire these Steves and other contributors very much, and wish they get what they deserve. I guess the world of Star Trek is still somewhat way off.

</comment></comment></comment><comment><USER14> You would've thought that after getting bitten by it, the Zucks, Brins, etc. of the would would've been happy to kick in a few million a piece to ensure part of the critical underpinning of their services is a bit more bulletproof.

Without having any idea of the numbers otherwise, could this not be a reasonably cost-effective approach to security? Making sure the OSS projects you draw on are properly funded so they can shoulder some of the security responsibility must be easier than employing your own army of security savants to do the same thing internally? I'd love to hear more info on whether this is or isn't a good approach.

<comment><USER15> That happened already, like 4 days ago:

[http://arstechnica.com/information- technology/2014/04/tech-g...](http://arstechnica.com/information- technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund- openssl/)

<comment><USER16> Right but the amount 3.9 million to support not only OpenSSL but multiple other projects is so miniscule relatively speaking it is astounding. This "civilization"s priorities are so ludicrous. 3.9 million is probably a tiny fraction of the amount Google earned through ads selling blowjob videos last year.

</comment></comment></comment><comment> vezzy-fnord Damn. Never thought I'd see a BuzzFeed article here. About as low as the web gets.

This is surprisingly good from them, however.

<comment><USER17> Buzzfeed seem to be partly rebranding themselves with high-quality long articles. I thought this was excellent: [http://www.buzzfeed.com/bensmith/tom- lehrer](http://www.buzzfeed.com/bensmith/tom-lehrer) (and posted it to HN to no avail). So yes, we've upgraded Buzzfeed from banned (stories get auto- killed) to lightweight (stories get a penalty, which moderators can override). A moderator saw the OP and marked it as solid.

Lightweight sites are an uncanny valley for HN. We can't un-penalize them without the site being overrun with fluff. But we don't want to miss any solid articles, either. It requires human intervention to tell the two apart, and we neither see everything nor necessarily see things in time.

I have some ideas for writing software to help with this conundrum, but won't be able to get to that (or the dozens of other things on our list) until my ongoing moderation-comment blitz subsides.

<comment><USER18> Buzzfeed have done themselves very considerable harm with their earlier tactics. Enough that I look on the URL with extreme prejudice.

I've got a custom CSS I apply to the site (I refer to it as "unbuzzed") which strips all the viral crap from it. And checking quickly w/o my CSS applied, I see that while _some_ of the site's content may be quality, much of it still matches my recollection of it.

Given that, I feel that supporting the site in any way condones a behavior which is, IMO, very highly toxic.

I'd prefer "banned unless moderator overrides" be in place, and I think actually, keeping the ban in place would be even better. It's weaponized clickbait.

More: [http://www.reddit.com/r/dredmorbius/comments/23twec/weaponiz...](http://www.reddit.com/r/dredmorbius/comments/23twec/weaponized_clickbaits_days_numbered_dont_tease_us/)

As for lightweight stories: they're, net net, toxic.

If there's lightweight coverage of a topic, there's almost certainly a heavyweight coverage somewhere. Almost always upstream (source study, report, release, comments), occasionally in a detailed analysis commentary.

My focus for much of the past year and some has been "big issues": population, resources, sustainability. Of which a significant component is energy. The good news is that there's huge amount of research going into advanced energy technology: new methods of capturing, converting, storing, or using it. And virtually _ALL_ of it is absolute, total, complete, 2000% bullshit in terms of actual informational value.

In one case (the Haberno enhanced geothermal well project in Australia), I found that reading the company in question's own financial filings with the Australian securities regulator was far more informative than the ... whitewashed is putting too pretty a face on it ... completely useless press "progress" report. If attaining 2% of your initial generation goal in 5x the time and 10x the budget is "success", well, I don't know what to say.

The problem is when the crap reporting of useless bullshit makes it difficult to see through crap reporting of the _good_ stuff out there. The US Navy Research Lab's recently (past month) publicized research on electricity-to- fuel synthesis from seawater was _abysmal_. But the underlying technology and story are actually among the better prospects out there in terms of not only providing moderate-scale liquid fuel sources for the future, but very large (national or global) potential, with high-but-tractable costs, and with applications to utilizing surplus intermittent generating capacity for fuel synthesis and long-term storage (diesel fuel stores well). But the 1) profusion of crap elsewhere and 2) abysmal quality of the reporting on this technology made this almost impossible to see.

I still think my own write-up (which could use some improving) is among the best there is on the topic:

[http://www.reddit.com/r/dredmorbius/comments/22k71x/us_navy_...](http://www.reddit.com/r/dredmorbius/comments/22k71x/us_navy_electricitytofuel_synthesis_papers_and/)

So: my war on Buzzfeed remains.

<comment><USER19> > _Enough that I look on the URL with extreme prejudice._ //

Which is fair enough, but do you think HN should be pandering to your prejudices? Isn't it better to ignore all prejudices and judge the story on the text, information, presentation it carries?

You can flag stories, you can link a better source within the thread, but ultimately you have to trust the community to regulate itself or seek a differently structured community.

Personally I'm finding the more I learn about the editorial policies of HN the more worried I am - I thought it was meritocratic, without grudges and prejudices but instead I find that there are secret editorial policies and over-bearing moderations.

Fine if HN is to be curated then let that be clear, post a list of banned sites for example; don't pretend it's user moderated when the postings are being heavily censored. [I'm not saying curation is wrong, just that it makes it a different beast and that secretly moderating the content and having ban- lists and such is wrong IMO].

<comment><USER20> The site has _always_ been curated, from day one. What's changed is not that there are new secret policies, but that the moderators are now sharing them with you; HN is more transparent today than it has ever been.

If you want a pure user-generated user-moderated experience, that's fine and totally reasonable. Go to Reddit. That's what they're about. HN is not Reddit.

<comment><USER19> Which is the point, it's never been explicit IMO that shadowbanning and URL black lists are part of the site. Finding out that's the case is unnerving, what other manipulations are going on under the hood that normal users aren't aware of. That's why I say IMO, to be forthright, one should make these things publicly known - there should be a page giving the list of moderators, what powers they have, what URLs are banned, what procedures (like shadowbanning) are used, ...

The FAQ says there are editors, and indeed it tells us now that there are 30 of them. It says they can edit, ban users; but it doesn't say that they block entire sites or anything of that sort. It doesn't mention hellbanning/shadowbanning and such.

The little inklings of the secret undercurrents strongly suggest that there would be, for example, manipulation of story rankings and such. I'm not saying that happens but with such an opaque system it seems most likely. The feeling starts rising then that one is in a "Disney for adults" where you're being manipulated to the extreme but you're not really conscious of it.

<comment><USER17> "Little inklings of secret undercurrents" strikes me as pretty silly (though delightfully written!) since I've done nothing for the last month but plaster the site with transparency and feedback. I have a list of dozens of things we can do to make HN better, and haven't been able to get to any of them since becoming public as moderator—I've been doing nothing but answering questions, explaining things, and worrying about answering questions and explaining things.

If, after massive effort, some people still accuse us of every insidious practice in the book, I'm doubtful that the lesson to draw is "try harder". It might be, if (a) there were a hope of convincing everybody, (b) it weren't very costly, and (c) it didn't prevent us from doing other important things. But (b) and (c) are definitely not true, and it's looking sadly like (a) isn't either.

<comment><USER19> Yes, since you joined you've been vocal and overt in your editing practices so far as I've noticed, and that's appreciated.

I'm reacting - I thought this site centred around values where merit rose above appearance. The implementation of a block list for certain domains seems to move sharply against that. Perhaps I missed the memo where it was mentioned that certain sites are banned from submission to HN. If a domain is getting spammed to the submission page then I can understand it being blocked but interesting stories/commentaries can centre around rubbish and abusive domains; I thought we [HN] rode above all that, that's all.

Blocking low quality domains is a good thing to some extent, it's just not being aware that's how the site runs that makes it surprising/unnerving. Steering the site to maintain focus requires controlling the submissions accepted, of course; just I thought this was being done using flagging and upvotes [alone] in the open. Ergo, my reaction. Maybe like finding your straight-laced lawyer has nipple-rings.

<comment><USER17> All the stuff you're talking about has been the case not only for years, but since the beginning of HN. I'll venture, also, that what you'd actually get if HN worked the way you imagined it did is a much, much lower-quality site. Indeed, HN would never have been HN. You're free not to believe that, of course.

There certainly are some drawbacks to transparency!

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> We changed the title to be less linkbaity. If anyone can suggest a better one, please do.

<comment><USER21> IMHO, the original title reflects the tone and content of the article. I didn't feel cheated when I clicked on it, so I don't really consider it linkbait.

<comment><AUTHOR> I actually liked the original title better, as it communicated the main point of the article -- that a ton of critical infrastructure is riding on the shoulders of a very small number of people -- better. Changing it to "Steve Marquess and Stephen Henson of OpenSSL" doesn't really get that point across, since it doesn't make clear that Marquess and Henson essentially _are_ OpenSSL.

EDIT: It is definitely refreshing to see editorial decisions like this being explained clearly, though, and the community being asked to provide feedback. So my thanks to dang for that, even if we disagree about the title :-D

<comment><USER17> Ok, I changed it back. Cheers.

</comment></comment></comment></comment><comment><USER22> Honestly, I don't get why super talented people work for free.

I haven't worked on any open source projects, so maybe that's why I don't get it, but it just seems that developers often devalue themselves too much.

You see it all the time. Business "idea" types come in and supply the "idea", while developers do all the work and don't get paid enough.

I just wish as an industry, developers would stand up for themselves more. I see good, smart and talented people getting walked over too much.

<comment><USER23> There are a lot of really interesting problems and projects in the world that nobody is interested in paying for. If you want to do these interesting things, you have to do it outside of the marketplace.

Alternatively, there is a trade-off in selling your labour in the marketplace: you are no longer in a position to dictate the terms of your labour, and you potentially lose control over the product of your labour.

</comment></comment><comment><USER24> > In fact, a quirk of the U.S. legal system meant that cryptography was, until > the late 1990s, placed on the U.S. Munitions List, alongside semi-automatic > firearms and tanks.

Should this be in the past tense? I thought crypto exports from the US were still restricted.

<comment><USER25> it's still restricted, but not on the munitions list anymore:

      Legal challenges by Peter Junger and other civil libertarians and privacy advocates, the widespread availability of encryption software outside the U.S., and the perception by many companies that adverse publicity about weak encryption was limiting their sales and the growth of e-commerce, led to a series of relaxations in US export controls, culminating in 1996 in President Bill Clinton signing the Executive order 13026 transferring the commercial encryption from the Munition List to the Commerce Control List. Furthermore, the order stated that, "the software shall not be considered or treated as 'technology'" in the sense of Export Administration Regulations. This order permitted the United States Department of Commerce to implement rules that greatly simplified the export of commercial and open source software containing cryptography, which they did in 2000.

[http://en.wikipedia.org/wiki/Export_of_cryptography_from_the...](http://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States#PC_era)

<comment><USER24> It looks like most of the OpenSSL team[1] is outside the US, except Marquess, the businessman. It looks like OpenBSD is developed and released from Canada.[2]

I tried reading the Wikipedia article you linked, and something from the Bureau of Industry and Security[3], and my eyes glazed over. I _think_ the upshot is developing an open source crypto library in the US just won't work.

[1] [https://www.openssl.org/about/](https://www.openssl.org/about/)

[2] [http://www.openbsd.org/goals.html](http://www.openbsd.org/goals.html)

[3] [http://www.bis.doc.gov/index.php/policy- guidance/encryption/...](http://www.bis.doc.gov/index.php/policy- guidance/encryption/encryption-faqs)

<comment><USER26> It is possible: open-source code can be exported freely. See [http://www.bis.doc.gov/index.php/forms- documents/doc_view/32...](http://www.bis.doc.gov/index.php/forms- documents/doc_view/328-flowchart-2) for details. You just need to tell them where it is.

</comment></comment></comment></comment><comment><USER27> Have you ever tried inventorying the free software you use and paying a fair price for it?

I looked into it for a small IT business. For one thing, the list was very long, longer than I expected; just consider browser extensions. For another, inventorying the free software and especially making all those small payments is very time-consuming. Finally, the costs add up. Given the money and especially time involved in paying, I wouldn't be using a lot of these programs (again, think of browser extensions).

I know micro-transactions aren't a new idea, but our payment system is a debilitating bottleneck; transactions are far too slow for the speed at which I can obtain new products. What happened to micro-transactions?

</comment><comment><USER28> "Marquess, a consultant for the Department of Defense"

Maybe I haven't been following this close enough but has anyone questioned whether or not it is perhaps a conflict of interest to be a consultant for the "Department of Defense" while also being a principal contributor to a project like OpenSSL?

<comment><USER29> I think it's about the only way to do so. Navigating a complex bureaucracy like the DoD requires an insider's knowledge. Not everyone who works for complex bureaucracies is evil; many are trying to help them be better (or at least direct its energies at things that are productive to the public).

The bigger problem that seemed to surface through this article is the sense of the "ubercoder" who singlehandedly runs a major project because they can't work with anyone else. I don't know if it was sensationalized by the author of the article, but it does strike me as a major problem in a lot of open source software. IMO, something like OpenSSL is important enough that it should be run by a non-profit.

</comment></comment><comment><USER30> No mention of Steve Jobs?

Disappointed.

Everybody knows that Apple's OS X is the most advanced and secure OS.

If Steve Jobs isn't one of the people who are responsible for protecting the Internet I don't know who else is.</comment>


Everything in your life is just a list - <AUTHOR> http://www.slate.com/articles/technology/technology/2012/08/workflowy_the_note_taking_app_that_changed_the_way_i_organize_my_life_.single.html <comment><USER2> How do I say this without incurring the wrath of people here on HN... Is this not what pg was talking about in this article? <http://www.paulgraham.com/submarine.html>

This entire thing appears to be just a paid advertisement.

<comment><AUTHOR> Haha. I'm a WorkFlowy founder. A few people have thought this because it is so positive, but it really isn't. The author just contacted me on Twitter saying, "I'm gonna write a story about you, cause I love your product" and then called and did an interview. I guess he really just likes it.

<comment><USER3> As a pro WorkFlowy user, I understand where he is coming from. I've often wondered what you could do improve the product but I haven't been able to think of anything (yet).

<comment><AUTHOR> Ha, thanks (I work on it). Both for the comment and for upgrading to pro. There's still like a bajillion things we can do to improve it. A few big features, but a bajillion smaller usability improvements that add up to a really big deal.

<comment><USER4> My first development job was on MORE, shortly after Dave Winer sold it to Symantec, and your product comes as close as anything I've seen to the feel of that product. As I'm sure you know, it had a fanatical following.

Even though I probably won't be able to use it for my day job, I'll buy a license and toast your future development!

<comment><AUTHOR> :) Thanks so much. Yeah, it's really interesting that after the golden era of outliners, none of them still exist in a big way.

</comment></comment></comment></comment></comment></comment><comment><USER5> All Glory to the Church of Org.

Kidding aside, they did a great job with workflowy. I still only use org mode, but I've suggested it to several people who wouldn't be comfortable with emacs, and they've all loved it.

org-mode + mobileorg + git = my entire life.

<comment><USER6> So can mobileorg synchronise via git now?

<comment><USER5> No, but the android mobileorg does do ssh/scp, so you can have a "dumb" version of git support.

I have a post-receive hook that updates the working copy with git checkout. `git push` is all I have to run, so to me it _feels_ like git support :)

</comment></comment></comment><comment><USER7> Self-plug: I've been working on a similar outline app for about 3 years now: <https://zetabee.com/text/>

I made it because I was doing something very similar in my text editor all the time, especially with collapsing/expanding sub-lists. It has pretty decent keyboard support and very few unnecessary features. I was going to build a 'check' completed feature but I've realized I just don't care about things I've already done. I only care about what's next. So Control+Del to delete a line is enough. It is a slightly opinionated app but being mostly plain-text with indents, you can use it however you want.

I don't plan on making money with it and it has near zero operating cost. So it's free/secure/unlimited and will remain so forever.

<comment><USER8> Emacs' org-mode is pretty much the same philosophy. Not quite as simple, though.

</comment></comment><comment><USER9> _"... The biggest problem with all of them is that they don't support flexible data structures—they don't let you define things how you want,..."_

Just halved the audience.

When I read this I think of Hawking, _"A Brief History of Time"_ & the advice his editor to remove equations. Does the same hold for Comp Science references? (Must resist the urge to talk CS in main-street press. Must resist the urge to talk CS in main-street press...)

</comment><comment><USER10> Discovered WorkFlowy last year, wrapped the page in an Android WebView and put it free in the market. Seeing a huge boost in downloads today. It's already tripled my best day yet, almost a 10% increase in active installs.

[https://play.google.com/store/apps/details?id=com.codysand.f...](https://play.google.com/store/apps/details?id=com.codysand.flowydroid&hl=en)

<comment><USER11> And WorkFlowy is ok with that?

<comment><USER10> It's been in the Android Market for 10 months now. They've almost certainly seen it. I'm obviously not taking credit for what they've created. Just wanted an app that would allow me to use it full-screen. Thousands of others did, too. It's free, no ads. Was just becoming familiar with the Android SDK at the time, and whipped it up in an hour.

<comment><AUTHOR> Yeah, we're aware of it. Basically, we plan on doing an Android app but haven't had time yet. No reason to squash something that's helpful to people.

<comment><USER10> I appreciate that. Please contact me should it ever become a problem.

</comment></comment></comment></comment></comment><comment><USER12> I thought this was about Lisp.

<comment><USER13> I thought it would provide a sound reason to learn Lisp.

<comment><USER14> (cadaddadadddar life)

Nutella

</comment></comment></comment><comment><USER15> Workflowy people: Please please please provide an API. I like your tool, but 99% of the time I'm doing something I need to make a todo, I need to do it somewhere other than looking at your web page. For example, from within vim. Or at the command line. Or while checking email. A nice API would allow me to whip up tools that make it super easy to access from wherever.

Other than that, very nice tool :)

<comment><AUTHOR> We do want to make an API, but we think it would be irresponsible based on our current organizational status. We're still in scrappy-two-person-startup mode, and we don't want to do the poorly supported, unstable API thing.

But yeah, it's clearly important.

</comment></comment><comment><USER16> Sounds like Emacs org-mode for non-geeks.

</comment><comment><USER17> I absolutely love Workflowy. It has replaced every piece of software I have used in the past for todos.

I actively recommend it to my coworkers. Is just fantastic.

Thank you. Really, thank you.

</comment><comment><USER18> Hah, mine is a directed acyclic graph!

<comment><USER19> What do you use?

<comment><USER20> An outline is technically a tree. Each node can have zero or more children. Since children cannot link to any node other than their own children, there are no cycles. Since each children cannot refer to their parent, the graph is directed. (Technically, all acyclic graphs must be directed, as a bidirectional link would result in a two-node cycle. But if you don't count those...)

A list would either be a zero or more equal-rank siblings, or a tree where each node had exactly one child. Since that's not how most people take notes, technically they are using a directed acyclic graph rather than a list.

In conclusion, words differ in meaning depending on context :)

<comment><USER21> for full generality a dag would require that a node be able to have multiple parents :)

</comment></comment></comment></comment><comment><USER22> I offload my brain to Workflowy once a day. It's awesome, but it would be better if they had to mobile app I could use to reload my brain on the move ;)

</comment><comment><USER23> Is there anything more to Workflowy than an outliner with search capability? Outliners have been around for decades.

<comment><USER7> You could say the same about absolutely anything. You have to try it to appreciate how much of a positive impact it can have on your life/plans/schedule. I cannot function without a detailed outline. Every single thing I do - personal, work, long-term projects, social obligations, house chores - is part of an outline. It's nice to be able to offload your brain to an app that will remember it forever so that you can concentrate on better things. I even take minutes in real-time during all meetings in the form of nested outlines.

Plus, Matt Cutts uses Workflowy. So you have to wonder how much of an impact a good outline can have on the world!

<comment><USER23> Yeah, I like outliners. I've used them since the DOS days. I just wanted to know how this one is better/different than what's currently out there. The fact that it's web-based isn't new.

i.e. <http://thenextweb.com/2008/10/22/online-outliners/> (2008)

The article starts with "For as long as I've been using computers, I've been searching for the perfect way to take digital notes" and then the author went through a list of popular tools previously evaluated and this made me think the author was going to talk about a new kind of tool.

Anyways, it's good that this article will expose people to outliners (and awesome Matt Cutts is using one).

</comment></comment></comment><comment><USER24> Tried it out, it's pretty smooth and 'flowy' (due to the little slick animations). Nicely done :)

I like how you kept it simple, clean and straight forward. Hope you don't over complicate it in future versions by bombarding it with due dates, try to implement bill payment features, calendars, etc etc. I just want a _list_!

</comment><comment><USER25> David Allen commenting on productivity tools says that, in essence, all you need is the ability to create and maintain lists.

In Evernote I have a bunch of notes. One is called 'Projects', one is called 'someday maybe' one is called 'stuff' and then there are a batch of context notes, office, home, etc all the usual GTD notes.

Each of these notes is a list. So when I open evernote, what I see is a list of lists. I find this depth of nesting optimal.

It works great. I mainly use it on my phone but, of course, it's available on my PC.

I use evernote only because it means I have an online backup and if I change my phone there's no messy data transfer to arrange.

Used in conjunction with Google calendar it supports GTD perfectly.

I have tried a lot of GTD apps and none beats the simplicity of this when it comes to supporting GTD methodology

</comment><comment><USER26> I use <http://www.checkvist.com/>, fully keyboard-driven interface with all sorts of perks. Haven't compared it directly to Workflowy, just putting it out there. No affiliation.

<comment><USER27> Thanks for the link. I'd never heard of CheckVist or WorkFlowy. Having just tried them both, CheckVist is certainly more feature rich (due dates, formatting, multiple lists etc) whilst still being simple and keyboard driven.

</comment></comment><comment><USER28> Something similar that comes to mind is TaskPaper (<http://www.hogbaysoftware.com/products/taskpaper/>) [Mac Only] that does things very similar to Workflowly. Minimal, short-cut driven, supports tags with powerful search capabilities.

That, along with Dropbox to save the .taskpaper files, and you are good to go. It even has a iPhone app (Haven't used that yet).

</comment><comment><USER29> I'm a paid user of WorkFlowy, love it. The hash tags and @person references are really useful for working on shared workflowys. What we really need next though, is a way to transform the nested "mind map" (which is useful for getting stuff out of your head) to a flat time-series of tasks. Two different steps in the process: dumping your thoughts and then executing the tasks.

</comment><comment><USER30> I'm building a discussions platform that works in a similar fashion to workflowy. I guess you could say it's a collaborative workflowy. for Check it out: <http://ec2-50-16-106-77.compute-1.amazonaws.com/>

I think the idea of infinitely nested lists are useful for many things. The tree structure is quite powerful.

<comment><USER31> I really like what you did there. Looking forward to see what comes out of it.

</comment></comment><comment><USER32> Not in Emacs Org mode?

</comment><comment><USER33> I found workflowy a few months ago. Used it for a while, and realized how useful it is for me. More-so than any todo list or mindmap ever was.

I went pro 2 weeks ago. Worth every penny. Hope they keep up the good work.

Only wish it worked better on WP7's browser, but thats probably MS' fault more than Workflowy's

</comment><comment><USER34> needs 2 way syncing with org-mode.

<comment><USER35> Do they have a REST API? It should be pretty easy to write clients if they do.

</comment></comment><comment><USER36> One big problem: a picture is worth a thousand words, and there is no photo capabilities.

</comment><comment><USER37> If you're looking for a REALLY non-complicated list app, check out <http://minimalist.ngokevin.com> which makes use of local storage and app cache to work offline.

</comment><comment><USER38> Reminds me of a list version of a mindmap -- which is great. I am addicted to mindmaps to organize my thoughts but navigating the elements by panning around a giant map can get cumbersome. Looks like a good alternative.

</comment><comment><USER39> I simply refuse to look at websites that slap a giant-ass ad thing across my screen before letting me access their content. (on iPad/Chrome)

</comment><comment><USER40> More > <http://www.omnigroup.com/omnioutliner>

</comment><comment><USER41> Wow! Congrats to the Workflowy people!

</comment><comment><USER42> I'm a paid user of WorkFlowy and love it...now if it only worked in the browser on Windows Phone!

</comment><comment><USER43> Go Workflowy! Love this thing.

</comment><comment><USER44> It is good.

</comment><comment><USER45> how do you do due dates or start dates on your todos?

<comment><USER46> i usually add a tag #Date</comment></comment>


Google deletes anti-oil videos from YouTube - <AUTHOR> http://priceofoil.org/2013/08/28/youtube-sides-big-oil/

<comment><USER2> As much as I'd love to see Shell and many other oil companies get a huge downsizing, this is some pretty onerous lying.

Google didn't "censor" anything, they complied with a DMCA request to take down the videos. It isn't because it's anti-oil, it's because it's copyrighted material.

There's a fair argument to be made about how idiotic the DMCA is, but shits the law in Google's world.

<comment> loup-vaillant Still, it does points to a fundamental flaw of centralized services such as YouTube.

If people had symmetric bandwidth to begin with, had their own web site, and distributed their bigger files (such as videos) through a a peer-to-peer publication protocol (such as bit-torrent), then things such as DMCA would cause no problem.

Now, we would still need aggregators and search engines. But those only point the way, which is even harder to prevent.

<comment><USER3> Distributed systems aren't immune to DMCA takedowns: [http://www.chillingeffects.org](http://www.chillingeffects.org)

<comment> loup-vaillant Of course not. But they're still much more _resilient_.

</comment></comment></comment></comment><comment><USER4> Sigh.. while I actually support what Greenpeace did here, were the clips from the official broadcast (which makes it understandable that they got pulled) or was it someone's original footage (which would be less ok).

<comment><USER5> It does look like a massive bait, I can't imagine why google would have pulled these videos if it were not for licensing issues or similar. I don't buy the massive pro-oil conspiracy TFA hints at.

</comment></comment><comment><USER6> > The fact that the video has been taken down only makes more people want to > watch it.

</comment><comment><USER7> I was disappointed this wasn't a Newsmax link.

</comment><comment><USER8> blah blah blah. YouTube gives the channel owner a reason when videos are removed. What was the reason here?

<comment><USER9> Probably something completely rational, and thus not facilitative of attention-grabbing headlines.

</comment></comment><comment><USER10> Haha, the fact that there was a second banner and they were put up in this manner makes this 100x better than a single one would have.

Here[1] is the link directly to the video/gp page

[1][http://www.greenpeace.org.uk/blog/climate/banned-video- our-s...](http://www.greenpeace.org.uk/blog/climate/banned-video-our-shell- belgian-grand-prix-protest-20130827)</comment>