Sergey Aleynikov Sues FBI Agents Who Arrested Him - <AUTHOR> http://www.bloomberg.com/news/articles/2015-02-12/goldman-sachs-ex-programmer-sues-fbi-agents-who-arrested-him <comment><USER2> I read Michael Lewis's article in Vanity Fair about this case back in 2013, and I remember being struck by this excerpt in particular:

 _[Goldman] called the F.B.I. in haste, just two days before, and then put their agent through what amounted to a crash course on high-frequency trading and computer programming. McSwain later conceded that he didn't seek out independent expert advice to study the code Serge Aleynikov had taken. ("I relied on statements from Goldman employees.") He himself had no idea of the value of the stolen code ("Representatives of Goldman told me it was worth a lot of money") or if any of it was actually all that special (he based his belief that the code contained trade secrets on "representations made by members of Goldman Sachs")...The F.B.I.'s investigation before the arrest consisted of trusting Goldman's explanation of some extremely complicated stuff, and 48 hours after Goldman called the F.B.I., Serge was arrested._

That, as the complaint highlights, the FBI instinctively acted as Goldman's punitive arm rather than conducting an independent investigation into the facts of the case is disturbing, regardless of the merit of the allegations.

[http://www.vanityfair.com/news/2013/09/michael-lewis- goldman...](http://www.vanityfair.com/news/2013/09/michael-lewis-goldman- sachs-programmer)

<comment><USER3> The opinion vacating Aleynikov's convictions is here: [http://www.ca2.uscourts.gov/decisions/isysquery/4ad04a2b-c61...](http://www.ca2.uscourts.gov/decisions/isysquery/4ad04a2b-c61e-4e5f-afec-5cd56fd0d0cb/1/doc/11-1126_complete_opn.pdf).

"Aleynikov's last day at Goldman was June 5, 2009. At approximately 5:20 p.m., just before his going-away party, Aleynikov encrypted and uploaded to a server in Germany more than 500,000 lines of source code for Goldman's HFT system, including code for a substantial part of the infrastructure, and some of the algorithms and market data connectivity programs." [Page 5].

"Aleynikov also transferred some open source software licensed for use by the public that was mixed in with Goldman's proprietary code. However, a substantially greater number of the uploaded files contained proprietary code than had open source software." [Page 5, Footnote 1].

He was convicted for violating the NSPA (National Stolen Property Act) and the EEA (Economic Espionage Act). The conviction for the former was vacated because the Second Circuit construed the NSPA not to extend to intangible property. [Page 18-19]. And the EEA conviction was vacated because the statute requires the product to be "produced for" or "placed in" interstate commerce, while Goldman never intended to sell or license the software. [Page 27].

The Court concluded that he had in fact tried to take 500,000 lines of valuable and mostly proprietary source code, but that his conduct didn't fall within the reach of the two laws charged in the indictment. Solid legal analysis, but an ordinary person would say that he got off on a technicality. Which is fine--if you can lawyer your way out of a conviction, you deserve to.

But help me understand what the FBI did wrong, or Goldman for that matter. The legal questions that were resolved in Aleynikov's favor were subtle ones. How would additional investigation on the part of the FBI have helped? And what exactly did Goldman do wrong in reporting him?

<comment><USER4> I think the most troubling part was that a huge, powerful company can get a government agency on the phone and have someone locked up based pretty much exclusively on them saying "You won't understand why, but he did _really bad stuff._ Trust us."

<comment><USER5> Most arrests are X telling government that you did Y, which the government didn't directly see.

You don't have to understand the source code to know it is a trade secret with enough certainty for probable cause. Goldman could be lying, but so could the shop owner who claims you drove off without paying for your gasoline.

If someone walked out of Intel with the design docs and recipe for the latest intel chipset, would you expect the FBI to understand it all before arresting the person?

<comment><USER6> Yes.

The FBI has technical specialists on staff that could very quickly say, "Yes, this complaint checks out." The problem here is that the agent apparently just took Goldman at their word, and didn't conduct an independent investigation of Goldman's claims, which is kind of their entire job. This is especially relevant because the value of stolen property can seriously affect charging and sentencing.

If you or I called the FBI and said "An employee stole proprietary code worth millions," there's no way the FBI would take that at face value, if you could even get their attention.

When the Federal government treats powerful corporations differently, to the point of effectively outsourcing its investigation, that severely undermines the principle of equality before the law.

<comment><USER5> They confirmed that the guy took a ton of source code right? Taking Goldman at their word that it was their IP isn't a huge stretch.

Taking the time to confirm that the code itself is a trade secret is a monumental task, one that isn't needed to determine if there was probable cause.

<comment><USER6> His argument was that most of it was open source, or modified open source with licenses that required contributing back the source code. Basically, it sounds like he grabbed his stuff because he wanted to get his utility functions and open source modifications.

Here's the piece in Vanity Fair where the general consensus was that what his actions indicate his intent was defintely not to steal valuable IP. [http://www.vanityfair.com/news/2013/09/michael-lewis- goldman...](http://www.vanityfair.com/news/2013/09/michael-lewis-goldman- sachs-programmer)

Witness this exchange:

 _"Did you take the strats?" asked one (meaning Goldman's trading strategies).

"No," said Serge. That was one thing the prosecutors hadn't accused him of.

"But that's the secret sauce, if there is one," said the juror. "If you're going to take something, take the strats."

"I wasn't interested in the strats," said Serge.

"But that's like stealing the jewelry box without the jewels," said another juror.

"You had super-user status!" said the first. "You could easily have taken the strats. Why didn't you?"

"To me, the technology really is not interesting," said Serge.

"You weren't interested in how they made hundreds of millions of dollars?" asked someone else.

"Not really," said Serge. "It's all one big gamble, one way or another."_

So if the essence of the crime is theft of a trade secret, then you absolutely have to conduct an independent investigation that a trade secret was involved, and that it was stolen to have probable cause.

The precedent here is a large corporation can use the government as an enforcement arm, and will be taken completely at face value. Simple allegations by individuals are subject to investigation prior to arrest, as should be all allegations.

This boiled down to Goldman calling the FBI, and less than forty-eight hours later arresting the person Goldman told them to arrest. They didn't interview any witnesses or consult with any experts other than Goldman employees.

That's terrifying.

<comment><USER3> > His argument was that most of it was open source, or modified open source > with licenses that required contributing back the source code. Basically, it > sounds like he grabbed his stuff because he wanted to get his utility > functions and open source modifications.

That was his defense. But the jury found that he had in fact grabbed valuable proprietary software, and the Second Circuit agreed that the _500,000_ lines that he uploaded were mostly proprietary, valuable code.

> So if the essence of the crime is theft of a trade secret, then you > absolutely have to conduct an independent investigation that a trade secret > was involved, and that it was stolen to have probable cause.

> The precedent here is a large corporation can use the government as an > enforcement arm, and will be taken completely at face value. Simple > allegations by individuals are subject to investigation prior to arrest, as > should be all allegations.

Probable cause does not require a mini-trial before an arrest. Goldman didn't make "simple allegations." They backed up those allegations with evidence of Aleynikov having sent himself 500,000 lines of code, under suspicious circumstances (not just erasing his bash history, but doing so on his last day, doing so contrary to company policy, and doing so right before going to work at a competitor). The FBI didn't take any allegations at face value, and when Aleynikov was acquitted, it wasn't because the software he copied wasn't actually proprietary and valuable.

<comment><USER7> >under suspicious circumstances (not just erasing his bash history, but doing so on his last day,

According to Michael Lewis, Aleynikov was in the habit of exporting his svn repo weekly. So, not really suspicious at all.

>>He sent the files the same way he had sent himself files nearly every week, since his first month on the job at Goldman.

source: [http://blogs.marketwatch.com/thetell/2013/08/01/michael- lewi...](http://blogs.marketwatch.com/thetell/2013/08/01/michael-lewis- retries-former-goldman-sachs-programmer-sergey-aleynikov/)

<comment><USER8> I'm confused, fnordfnordfnord; what is it you (and others in this thread) think you're arguing about?

You and rayiner and Aleynikov all agree that it's fine and reasonable that Aleynikov was pardoned. There's no argument to be had about that.

Aleynikov thinks that the FBI agents who arrested him did so improperly. rayiner is doubtful, and would like to hear if anyone can convince him.

Your arguments for why the FBI agents acted improperly amount to "yeah, but it turns out that ....". This arguments are not a good reason to not arrest someone. They're a good reason to find someone innocent after trying them.

Sometimes circumstances are such that an innocent person looks highly suspicious to reasonable people with a reasonable amount of evidence. In those cases, it's reasonable, though unfortunate, that law enforcement arrest and charge that innocent person. Isn't it?

As far as I can tell, rayiner is right.... we have no evidence that Aleynikov was arrested improperly.

<comment><USER7> > rayiner is doubtful, and would like to hear if anyone can convince him.

I doubt I could convince rayiner of anything, but I'll at least refute some of the more ridiculous things he says.

>Your arguments for why the FBI agents acted improperly amount to "yeah, but it turns out that ...."

No, I've responded to rayiner's suppositions that because some activity might be sketchy, it must be.

[rayiner says]([https://news.ycombinator.com/item?id=9047068](https://news.ycombinator.com/item?id=9047068)) encrypting and exporting files to a repository in a foreign land is sketchy.

I say, ssh, gzip, and svn are pretty normal tools that programmers use frequently. So are hosted servers in foreign countries.

rayiner says that deleting .bash_history is sketchy, I say it's a reasonable, nay a responsible thing to do if failing to do so would leave sensitive information (such as a password) available for others to peruse.

>This arguments are not a good reason to not arrest someone. They're a good reason to find someone innocent after trying them.

IMO if the government is going to arrest a person, attempt to hold them without bond, settle for mere $700,000 bond, (arguably depriving the person of counsel); then the government's burden of "probable cause" ought to be a bit more substantial than "some bros down at Goldman Sachs said...", and this guy uses "subversion" software. We can't have the police running around arresting everyone who might have possibly committed a crime. There needs to be actual, you know, probable cause.

>Sometimes circumstances are such that an innocent person looks highly suspicious to reasonable people with a reasonable amount of evidence. In those cases, it's reasonable, though unfortunate, that law enforcement arrest and charge that innocent person. Isn't it?

What do you make of the fact that:

>> _" In the New York state case, a judge ruled the 2009 arrest was illegal. He threw out seized physical evidence, including computer hardware carrying the source code."_

and

>> _" New York State Supreme Court Justice Ronald Zweibel also barred prosecutors from using statements Aleynikov made to the FBI after his arrest at Newark Liberty International Airport."_

Are these judges unreasonable? Sure, mistakes happen, everyone deserves a Mulligan once in a while. That's not what we have here though. The FBI had plenty of opportunities to check their work, which was shabby. Instead of doing that, they forged ahead doing the bidding of Goldman Sachs, uncritically. And, now that the federal case has failed, GS has their hand up the back of a Manhattan DA. We can quibble about these little details more if you want but this whole affair has got a stench about it.

>As far as I can tell, rayiner is right.... we have no evidence that Aleynikov was arrested improperly.

No evidence? What's Zweibel's problem then?:

> _In a 71-page opinion, Justice Ronald A. Zweibel of State Supreme Court in > Manhattan ruled that the F.B.I. "did not have probable cause to arrest > defendant, let alone search him or his home." The arrest was "illegal," > Justice Zweibel wrote, and Mr. Aleynikov's "Fourth Amendment rights were > violated as a result of a mistake of law."_

<comment><USER9> I have a passing understanding of the policies and procedures binding on developers at trading firms.

I dispute the idea that any senior developer could work at Goldman Sachs on an HFT infrastructure and believe that they were authorized to --- or, indeed, that they would not be immeditely fired for --- uploading the code to a proprietary automated trading system to a random SVN host in a different country. This is the code we, as security testers, were never allowed to see, even after owning up the machines hosting it. These firms are not kidding around about this stuff. It is a huge smoking gun to have uploaded any of it to some off-brand foreign svn host.

These are firms where you can be fired for plugging a thumb drive into your computer, or for using the company network to access Dropbox. I have worked for more than one financial firm that spent literally millions of dollars merely on the problem of detecting their network users trying to reach Google Mail.

I also dispute the idea that because developers commonly use ssh, gzip, and svn, that it is common practice to (1) gzip a tarball of source code, (2) encrypt that source code, (3) commit that compressed encrypted blob to svn, (4) remove all traces of the encryption key from their work computer. That's something happens zero times on normal dev machines.

The conviction was overturned because the technical details of exactly what Aleynikov took from GS didn't fit the ambitious charge the DOJ filed against him. But the appeal doesn't refute the finding of facts from the original trial, which include:

 _There was more than sufficient evidence presented at trial, however, for a rational juror to conclude that Aleynikov intended to steal Goldman Sachs ' proprietary source code. First, it was undisputed at trial that Aleynikov actually did take proprietary source code from Goldman Sachs. As Aleynikov concedes in his motion papers, the code he took from Goldman Sachs included a "purposefully designed" portion of the Goldman Sachs "proprietary, custom- built trading system." Indeed, the evidence showed that Aleynikov took a significant percentage of the proprietary source code for that system. While Aleynikov attempted to show that there was open source code embedded within the proprietary code and to identify the files in which that might be true, his expert witness was only able to identify one file among those taken by Aleynikov that both bore a Goldman Sachs copyright banner and appeared to contain open source code._

I'm just fine with Aleynikov's conviction being overturned. Again, the charges against him seemed ambitious.

But this is a forum full of software developers. Rayiner is a lawyer and a compiler developer. It's somewhat insulting to everyone's intelligence to pretend that people here are unfamiliar with ssh and svn. We understand how software development works. What happened here was extremely sketchy. You can't play the "well in the world of software development, this is totally normal" card on HN.

<comment><USER10> _I 'm just fine with Aleynikov's conviction being overturned. Again, the charges against him seemed ambitious._

"Ambitious" is a bit charitable, in this context.

"Patently vacuous" \-- to an extent that suggested, at the very least, a breakdown in the internal controls and safeguards (on the part of both the FBI and the prosecutor's office) designed to present precisely this kind of a fiasco from happening -- might be a better description.

<comment><USER5> You are being ridiculous. Aleynikov definitely violated New York trade secret law. He got off the federal charge because the trading software wasn't a product for sale, it was a product for internal use. The law was poorly drafted and once that came to light it was immediately fixed.

Like Rayiner said, in layman's terms, he got off on a technicality.

The FBI and DOJ being on the wrong side of a close call in statutory interpretation isn't "patently vacuous."

<comment><USER10> _Aleynikov definitely violated New York trade secret law._

That's not what the court found. Otherwise the charges wouldn't have been dropped.

It sounds like you're conflating the issue of whether he violated the "spirit" of the law (or whether he was, in your view, just plain morally culpable somehow) -- versus what the law actually had to say about his actions.

 _Like Rayiner said, in layman 's terms, he got off on a technicality._

If you want to minimize any sense of exoneration or vindication the accused might want to derive from the court's decision, by saying he "got off on a technicality", that's fine.

But to claim that he "definitely violated" the law when the courts found that he definitely did not -- I'm just not sure I see the point in that.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> While the article gives some background, here is a bit more from the wikipedia article about Sergey Aleynikov [1]:

>Sergey Aleynikov is a former Goldman Sachs computer programmer. In December 2010 he was wrongfully convicted of two counts of theft of trade secrets and sentenced to 97 months in prison. In February 2012 his conviction was overturned by the United States Court of Appeals for the Second Circuit that entered a judgement of acquittal, reversing the decision of the District court.

The main reason why he is suing the FBI is beacause:

>On June 20, 2014, upon reviewing the evidence, Justice Ronald Zweibel published a 71-page opinion in which the court ruled that F.B.I. "did not have probable cause to arrest defendant, let alone search him or his home." The arrest was "illegal," and Mr. Aleynikov's "Fourth Amendment rights were violated as a result of a mistake of law."[2] Besides finding that he was arrested illegally without probable cause, the court blocked the majority of evidence passed by the F.B.I. to prosecutors at the NY State DA's office, as that property was supposed to be returned to Mr. Aleynikov upon his acquittal.

[1] [http://en.wikipedia.org/wiki/Sergey_Aleynikov](http://en.wikipedia.org/wiki/Sergey_Aleynikov) [2] [http://dealbook.nytimes.com//2014/06/20/judge-throws-out- evi...](http://dealbook.nytimes.com//2014/06/20/judge-throws-out-evidence-in- sergey-aleynikovs-code-theft-case/)

<comment><USER12> While I agree it was egregious I think people may be missing the point. The FBI is getting a huge black eye here, Goldman is already losing out. This is how our system works.

Goldman over reached and through their efforts got this guy arrested. That they could do that, is a problem, but now everyone involved has been thoroughly spanked (with some bonus civil case spanking as well it seems). So the next time Goldman call's the FBI, they are going to be treated much more skeptically and the agents in charge are going to be unwilling to do anything based on Goldman's "word". Because the agents will remember this and they do not want to be the butt of interagency jokes, or up on civil liability.

<comment><USER13> [http://www.mondaq.com/unitedstates/x/215714/employee+rights+...](http://www.mondaq.com/unitedstates/x/215714/employee+rights+labour+relations/Understanding+The+New+Theft+Of+Trade+Secrets+Clarification+Act+Of+2012)

They've already "clarified" and "closed" that loophole. Next time, the programmer actually would go to jail.

<comment><USER12> In a meta sense I'm curious why you had to create a new account just to post this, although I know the position that the system we have in place actually does work [1] is unpopular.

The system is messy, it doesn't travel in a straight line from broken to fixed, and it takes a lot of time and energy to get right. Consider Prohibition for a moment, it was freaking _unconstitutional_ to drink for a while there. Yes it was broken, yes it got fixed. Just like Marijuana use is getting fixed, slowly, inexorably, fixed.

Martin Luther King was jailed by a broken system, and slowly, over time, it has been getting fixed.

You cannot see a tree grow, but it does. And many people cannot see that our system of governing is working, but it does. As long as you take the long view, it will. Believe that you are a helpless pawn and all is lost, and it won't.

[1] Rights for same sex marriage anyone? Used strong encryption in email?

<comment><USER13> > In a meta sense I'm curious why you had to create a new account just to post > this

Events led me to conclude that using the same account consistently was a bad idea from an employment standpoint. It has nothing to do with this. It is just what I do now. Hell, the password for this account should be easy to guess if you start with the letter a and work your way to the right.

> You cannot see a tree grow, but it does. And many people cannot see that our > system of governing is working, but it does. As long as you take the long > view, it will. Believe that you are a helpless pawn and all is lost, and it > won't.

It is my belief that wealthy people can (usually) get away with passing whatever crap they want through Congress.

The only tool I have at my disposal is point out when this happens and hope people get outraged enough to do something. I'm confused why you view that with a belief that I'm helpless?

P.s. Given that I basically gave away the password, this is the last time I'll use the account.

<comment><USER13> Upon further reflection, maybe I should just keep using it.

Demonstrating that multiple people could have access to the account makes an excellent case for plausible deniability. In the right circumstances a court could compel HN to distinguish between these users (or at least, prove that the "multiple" aspect is a fiction), but the existence of doubt minimalizes the professional risk. This feels like about the right level of security for unpopular political meta-comments of this sort.

<comment><USER13> Ah, but are we paranoid or in possession of multiple personalities?

Then again, the risk of a court is never really a risk. This is perfectly legal. :P

<comment><USER13> >Ah, but are we paranoid or in possession of multiple personalities?

Maybe for the former, the latter is true without a doubt.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> It is worth remembering that part of the case against Mr. Aleynikov involves his use of "subversion" software, which sounds, well, subversive.

From the Vanity Fair article[1]:

"The Web site Serge had used (which has the word 'subversion' in its name) as well as the location of its server (Germany) McSwain clearly found highly suspicious."

[1][http://www.vanityfair.com/news/2013/09/michael-lewis- goldman...](http://www.vanityfair.com/news/2013/09/michael-lewis-goldman- sachs-programmer)

<comment><USER15> Yep, that's about par for the course reporting. If it sounds ominous, it must be. I remember a small town newspaper that was all mad 10+ years ago about the master / slave IDE toggle and how it was racist. It was not an Onion article, sadly.

<comment><USER16> This quote was not about the reporter or the news outlet. Michael McSwain was the FBI agent in charge of the case, and the reporting seems to suggest that having 'subversion' in Sergey's Web history was a component of building probable cause.

<comment><USER15> Remind me to write a a source code control system called "Patriot". I really don't want to know what they think of "git".

On a serious note, I guess the modern lesson is names are used by idiots to attack us so pick your project names carefully.

<comment><USER17> "Patriot is binary-compatible with Git ..."

      sudo cp /usr/bin/git /usr/bin/patriot

... of course that is likely not enough, as all the porcelain still says "git". ;)

</comment></comment></comment></comment></comment><comment><USER18> I hope he can, sooner or later, put these legal battles behind him and return to programming. He's a pretty good Erlang coder: [https://github.com/saleyn](https://github.com/saleyn)

This, in particular, is extremely useful for anyone using Erlang to interact with external processes: [https://github.com/saleyn/erlexec](https://github.com/saleyn/erlexec)

</comment><comment><USER19> Interest that after reading the wikipedia article the NY state prosectors messed up by trying to arrest him a second time. In that second arrest the judge ruled that the arrest by the FBI was illegal. Thereby giving him this opportunity for the civil case.

However the law is changed for future source code thefts. Here is an industry perspective

[http://www.mondaq.com/unitedstates/x/215714/employee+rights+...](http://www.mondaq.com/unitedstates/x/215714/employee+rights+labour+relations/Understanding+The+New+Theft+Of+Trade+Secrets+Clarification+Act+Of+2012)

The only technicality that freed Aleynikov was that the source code was not sold as a product itself.

<comment><USER20> Wow, that Mondaq article is really the opposite of objective. Author Dylan W. Wiseman is really letting us know which side he's on with gems like "To correct the obvious injustice of the Aleynikov ruling..."

<comment><USER21> Ignoring the obvious FBI blunders and them being far too buddy-buddy with corporations, doesn't he have a point?

Aleynikov intended to monetize code which was technically Goldman's property, even if he wrote most of it. It would be a different story if he simply wanted to keep the code for archival and review purposes; he actually tried to help a startup by using it.

It sounds like he did violate the spirit of the law, if not the letter.

<comment><USER22> After reading more into this, I agree.

However I would also like to add that 8 years (+3 under supervision) is bonkers and completely disproportionate with the crime.

Just to put that into perspective, someone could commit rape twice and be out of jail first (3 years piece approximately, or 6-7 years total).

It seems like as soon as a computer is involved in a crime, the sentence gets quadrupled. Instead of breaking into someone's computer, you should just run them down with your car, you'll likely get off easier in the latter case...

<comment><USER21> Funnily enough, after reading more into this myself I'm actually going to partially retract some of my statements above.

I don't know if it was definitively proven that he copied the code with the intent of helping the new startup. The evidence the FBI found was that he had the code on a laptop when meeting some of their founders, but I don't believe they had proof of what his intent was or proof that he shared it with them or that they were even aware of it.

He claims he did not intend to do any such thing:

>When he left, Sergey Aleynikov took a segment of code with him that was based on open source, but had some alterations that technically made it proprietary Goldman Sachs software.

>According to Sergey Aleynikov, the software was of no consequence to his job at Teza Technologies, but once they realized he had taken a segment of code from their servers Goldman Sachs contacted the FBI and within 48 hours Aleynikov was in custody.

So I would say the sentence should be based on the proven intent. If he really did intend to use most or all of the codebase while at the startup to gain them an edge, then I think a jail sentence is fair (though I agree 8 years is way too long). Otherwise, probably not, at least depending on how accurate his story is of what % of the codebase was open source originally.

</comment></comment></comment></comment></comment><comment><USER23> I think Goldman Sachs was more worried that he was taking his brain with him to a competitor. The banking cartel certainly has to be high on Silicon Valley's list of "industries that need to be disrupted". The sad thing is he's probably being prosecuted for things he created within the walls of Goldman Sachs and could probably easily re-create from scratch without them.

</comment><comment><USER24> Except of Flash Boys book from from the Vanity Fair article: [http://www.vanityfair.com/news/2013/09/michael-lewis- goldman...](http://www.vanityfair.com/news/2013/09/michael-lewis-goldman- sachs-programmer)

 _" He agreed to hang around for six weeks and teach other Goldman people everything he knew, so they could continue to find and fix the broken bands in their gigantic rubber ball. Four times in the course of those last weeks he mailed himself source code he was working on. (He'd later be accused of sending himself 32 megabytes of code, but what he sent was essentially the same 8 megabytes of code four times over.) The files contained a lot of open- source code he had worked with, and modified, over the past two years, mingled together with code that wasn't open source but proprietary to Goldman Sachs. As he would later try and fail to explain to an F.B.I. agent, he hoped to disentangle the one from the other, in case he needed to remind himself how he had done what he had done with the open-source code, in the event he might need to do it again. He sent these files the same way he had sent himself files nearly every week, since his first month on the job at Goldman. "No one had ever said a word to me about it," he says. He pulled up his browser and typed into it the words: Free Subversion Repository. Up popped a list of places that stored code, for free, and in a convenient fashion. He clicked the first link on the list. The entire process took about eight seconds. And then he did what he had always done since he first started programming computers: he deleted his bash history. To access the computer he was required to type his password. If he didn't delete his bash history, his password would be there to see, for anyone who had access to the system."_

</comment><comment><USER25> Can I just make sure that someone mentions the most powerful motive that a shop like GS _would_ _likely_ have?

HFT barrier to entry is expertise. Any firm has as their biggest competitive risk their employees setting up with that expertise in competition. It happens all the time. To counter that the optimal strategy of an HFT shop where an expert resigns is to sue them as far and deep into the ground as they can why?

 _As_ _a_ _lesson_ _to_ _all_ _remaining_ _staff_

This gets an HFT shop additional barrier to entry from competition from existing experts, their own.

Did GS deliberately follow this optimal tactic? I don't know, I have no evidence. Maybe the fact it is optimal for other reasons is unrelated and possibly even unknown to them. Form your own opinion on the balance of probabilities there.

<comment><USER26> Couple points:

1\. They didn't sue him. They complained to the FBI and the government criminally prosecuted him for violation of the Economic Espionage Act.

2\. The basis of the prosecution was that he exfiltrated 500,000+ lines of source code.

Doubtful this particular "tactic" could be more generally applied unless staff are engaging in similar activities now clearly prohibited under the EEA.

</comment></comment><comment><USER26> I'm new to this but after reading up on the background I think this case is being somewhat mischaracterized in the comments here. I know we are all anti- authoritarian hackers at heart but HN also stands for accuracy and fairness.

I would say the general tone here is "jack-booted FBI thugs falsely arrest hacker because their pal at Goldman Sachs pulled some strings". The implication being that this has all unravelled and he is now suing the government for corrupt trampling his constitutional rights.

After reading up, I would say a fairer characterization is "guy who got caught stealing proprietary code got off on a technicality because the law doesn't actually cover HFT code due to shortsighted phrasing".

Before you hit that downvote button, here's my support: _the judge who overturned it called this out_ and Congress passed a law in 2012 to close the loophole through which he got his conviction overturned.

From the Congressional Record[1]:

Quoting the appeals court, _" just before his going-away party, Aleynikov encrypted and uploaded to a server in Germany more than 500,000 lines of source code for Goldman's HFT system ..... On June 2, 2009, Aleynikov flew ..... to Chicago to attend meetings at Teza. He brought with him a flash drive and a laptop containing portions of the Goldman source code. When Aleynikov flew back the following day, he was arrested by the FBI .....''"_

 _In his concurring opinion, Judge Calabresi [Cal-abress-E] directly called upon Congress to clarify the scope of the EEA [Electronic Espionage Act] as he wrote:_

 _[I]t is hard for me to conclude that Congress, in [the EEA], actually meant to exempt the kind of behavior in which Aleynikov engaged ..... [n]evertheless, while concurring [in the opinion], I wish to express the hope that Congress will return to the issue and state, in appropriate language, what I believe it meant to make criminal in the EEA._

Specifically the EEA used to say "included in a product that is produced for or placed in" interstate commerce, which the court thought didn't technically cover HFT code, and now reads "a product or service used in or intended for use in". That's it. That's the loophole.

If there ever was a case of violating the spirit, but not the letter of the law, this is it.

[1] [http://thomas.loc.gov/cgi- bin/query/z?r112:H18DE2-0051](http://thomas.loc.gov/cgi- bin/query/z?r112:H18DE2-0051):

<comment><USER27> I really recommend you read the vanity fair article posted earlier.

[http://www.vanityfair.com/news/2013/09/michael-lewis- goldman...](http://www.vanityfair.com/news/2013/09/michael-lewis-goldman- sachs-programmer)

It is quite clear that he did not violate the spirit of the law. There was no clear intent to steal any "trade secrets" from Goldman Sachs, and the analogy brought up in the last part of the article that compares it to taking home a notebook you've used for scribbling down thoughts after you've quit your job, is apt

<comment><USER26> _" It is quite clear that he did not violate the spirit of the law."_

Very, _very_ clearly, everyone from the legislature to the judiciary is in agreement that he violated the spirit of the law.

Even the judge who overturned the conviction said it was hard for him to believe that Congress didn't mean for the law to make his actions criminal. And then Congress immediately updated the letter of the law, unanimously, all the while explaining how it's unfortunate the previous letter of the law didn't capture the spirit of what they intended, specifically mentioning this case.

Also, the "it's just a notebook with scribbled down thoughts" analogy is poor. That implies that it's just his own thoughts he took. He uploaded 500,000+ lines of source code, then tried to cover up his tracks. That is exfiltrating extensive, proprietary trade secrets and was repeatedly cited by Congress as just the sort of activity they wished to criminalize in the Economic Espionage Act.

By the way, I don't think he should serve any more time. The sentence was too harsh IMO. But there is _no question_ it is (now) illegal activity, because Congress specifically updated the law to make his exact actions illegal, _naming him personally_.

(Of course, they weren't technically illegal at the time he did them, according to the appellate court, which is why he was set free.)

<comment><USER27> He did not "try to cover up his tracks", he did what he'd do basically every day as a normal software developer doing his job. The "encrypted it and uploaded it to a server in Germany" is a red herring that shows exactly how inept the judiciary was in interpreting his actions. Why does it matter that the server was in Germany? Isn't it common sense that he would encrypt any data he uploads?

And it's nonsensical to not try and interpret exactly what it is he copied and why he did so. As the vanity fair article points out, he did not in fact copy any of the vast amounts of valuable data he had access to. (He had access to everything!). But he chose tedious infrastructure code instead, to get a sense of what non-proprietary libraries that were used

<comment><USER26> _> he chose tedious infrastructure code instead, to get a sense of what non- proprietary libraries that were used_

That is a generous speculation regarding his motives. As GS notes in their response to Vanity Fair, "While some of those files included open source software, the Court determined that 'a substantially _greater_ number of the uploaded files contained proprietary code.'" (emphasis mine)

But as far as whether what he did violated the spirit, and now letter of the law we have a conclusive answer direct from _Congress_ : Yes, he did.

</comment></comment></comment></comment></comment><comment><USER28> Whoever loses, we win?

<comment><USER29> We already lost.

Stupid shit like this done by the FBI is causing tax payer money. If Sergey Aleynikov wins then guess where the money will come from...

I always thought people should be financially accountable for their actions. The only thing that really work, is touching the wallet.

<comment><USER30> This.

We tend to cheer for social justice against government abuse of power, but we're always the ones footing the bill.

Settlement and damage costs should come out of the agent's salaries across the entire organization.

Maybe police officers will stop shooting black teenagers if everyone on the force is docked $5000 for each application of lethal force.

<comment><USER7> No, then decent cops would leave, and we'd be left with jerks who have low job-mobility (no other skills), but are adept liars who can cover their asses when they get near trouble.

<comment><USER30> Most police officers already are jerks with low job-mobility - but I do think a framework where the department suffers for an individuals actions (and not the taxpayer footing the bill) would have a positive feedback effect.

If another officer's indiscretion or negligence were to reflect on _your pay check_ , you would be _less likely_ to help cover it up or ignore it.

<comment><USER7> I think I'd prefer the idea (I forget where I first saw it) that officers have to buy a bond/insurance. That way the worst ones would price themselves out of the market. Having group rates for officers/departments might have the effect you're looking for. I don't mind it terribly that local taxpayers have to foot at least some of the bill for this kind of thing. Hopefully they will be reminded come election time if a sheriff or a mayor has allowed deputies to run rough shod over peoples' rights.

</comment></comment></comment></comment></comment></comment><comment><USER31> Blergh, almost half of my screen real estate is taken up by the top bar. I bet somebody got a bonus for that, as Raymond would say.

</comment><comment><USER32> Would you employ Sergey ?</comment>


Google may not have canceled its censored, spying Chinese search tool - <AUTHOR> https://boingboing.net/2019/03/04/black-budgets-are-us.html <comment><USER2> Discussion of original source (Intercept article): [https://news.ycombinator.com/item?id=19303948](https://news.ycombinator.com/item?id=19303948)

HN Guidelines: "Please submit the original source. If a post reports on something found on another site, submit the latter." ([https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html))

<comment><USER3> > Discussion of original source (Intercept article): > [https://news.ycombinator.com/item?id=19303948](https://news.ycombinator.com/item?id=19303948)

Three comments isn't much of a discussion. Per [https://hckrnews.com/](https://hckrnews.com/), that submission never even made it to the front page, while this one did.

<comment><USER4> OK, we've moved the comments there and boosted the earlier article up to the front page.

</comment></comment></comment><comment><USER5> Google's actions here aren't going to make a sliver of difference in terms of what information is accessible from mainland China.

 _In a world where a censored, Chinese Google exists:_ If you have a VPN, uncensored search with Google! If not, censored search with Google or Baidu.

 _In a world where a censored, Chinese Google does not exist:_ If you have a VPN, uncensored search with Google! If not, censored search with Baidu.

It ultimately won't matter if it's Baidu, Google, or anyone else. The censored/uncensored equation remains essentially identical in all scenarios. Personally, I'd prefer censored Google over no Google at all.</comment>


Apoorva Mehta had 20 failed startups before Instacart - <AUTHOR> http://www.latimes.com/business/technology/la-fi-himi-apoorva-mehta-20170105-story.html <comment><USER2> Tracey Lien completely missed the punch line: Mehta got into YC 2 months late by ordering a 6 pack and having it delivered to Garry Tan at YC Offices [0]. I thought this was legend.

[0] [https://techcrunch.com/2012/08/18/how-instacart-hacked- yc/](https://techcrunch.com/2012/08/18/how-instacart-hacked-yc/)</comment>


Knicks Star Carmelo Anthony Launches Venture Firm - <AUTHOR> http://techcrunch.com/2014/07/21/knicks-star-carmelo-anthony-launches-venture-firm

<comment><AUTHOR> I am not sure what's more nuts. Melo doing tech investments or the TechCrunch readers cheering this on.

Not a bubble, obviously...</comment>


Review: Motorola Xoom – The Android Tablet Redefined - <AUTHOR> http://www.crunchgear.com/2011/02/23/review-motorola-xoom-the-android-tablet-redefined/ <comment><USER2> "Battery life is about 18-20 hours on one charge"</comment>


The Trie: A Neglected Data Structure - <AUTHOR> http://www.toptal.com/java/the-trie-a-neglected-data-structure <comment><USER3> The original article uses Java, which makes it harder to see how simple it can be to make and use prefix trees. For comparison, here's the Python code to create a prefix tree from a set of words:

        def prefix_tree(words):
            d = dict()
            for word in words:
                root = d
                for c in word:
                    root = root.setdefault(c, {})
                root['$$'] = {}  # mark end of word with '$$' token
            return d

For example:

        >>> prefix_tree('foo bar baz'.split())
        {'b': {'a': {'r': {'$$': {}},
                     'z': {'$$': {}}}},
         'f': {'o': {'o': {'$$': {}}}}}

To query whether a word is present in a tree you basically compute

        reduce(dict.__getitem__, word, tree)

and test whether the result (a forest) has an end-of-word '$$' tree.

</comment><comment><USER4> Tries (actually pronounced "trees" or "Patricia trees") are very memory efficient compared to most alternatives, but really only shine in membership query workloads. If you actually need to return the stored element, you have to rebuild it for every query, which is probably too expensive if you have lots of queries, it would be better to store the whole object continuously somewhere in the data structure so you could return a reference to it.

Even then, tries only win if the distribution is suitable to give you the memory efficiency you are hoping for. If you don't have many common prefixes, you're better off with just a hashtable.

<comment><USER5> Thanks, while I think the pronunciation is lame and confusing, I grow tired of explaining to people that it is actually correct, they aren't called "trys" or "treys".

<comment><USER6> Pronunciation can be a very individual or regional thing when it comes to technical abbreviations. I just finished watching the Channel9 GoingNative talks (C++), and was surprised to find a couple of the most respected C++ guys pronounce 'ptr' as 'put-er' (not 'putter') instead of 'pointer'.

Personally I'll continue to pronounce it as 'try'. It has, at least, fewer conflicting interpretations in a programming context. When I say 'tree', people will probably assume I mean a binary tree, not a radix tree. So, if I'm not going at 30% light speed, I'll just say that.

<comment><USER4> Mispronouncing variables is great fun. We have lots of "txn_XXX" which we pronounce "texan_XXX", and "le_XXX" (short for "leafentry XXX", as in "le_key"), which always make us sound like we're mocking French people.

<comment><USER6> Now you're getting it. I also pronounce 'char' from C as if it's short for charred, rather than character. Principally because I find it easier easier to say 'char star' with that vocalisation. I know one guy who, if speaking quickly, would pronounce 'char* sugar' as 'caster sugar'... come to think of it, I'm not sure how Americans pronounce 'caster', but in the UK it's car-stir sugar. Not 'Casper', as in the friendly ghost, but with a 't'.

I've never had a problem with people using different pronunciations. It certainly keeps talking about code fresh.

<comment><USER7> cache is a fun one (cash or kay-sh?). Most Australians I know (and possibly people from the UK too) say it as "cash"

<comment><USER8> Under what rules of pronunciation would it be Kay-sh?

I recognize pronunciation is more about exceptions than rules, but even so...

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> A trie is a poor data structure in practice. There is no locality of reference that can be exploited: to lookup a single key, almost the entire length of the memory blocks occupied by the trie needs to be accessed, and almost at random (depending on the insertion technique). For keys inserted later on, the number of different blocks of memory accesses needed for a single key is proportional to the length of the key.

A B-Tree is better due to better exploitation of locality of reference in memory.

<comment><USER10> It depends on the kind of trie that you build - it's worth taking a look at Hash Array Mapped Tries [http://lampwww.epfl.ch/papers/idealhashtrees.pdf](http://lampwww.epfl.ch/papers/idealhashtrees.pdf)

The Clojure programming language is completely designed around several immutable variants.

</comment></comment><comment><USER11> Should mention that tries can be heavily compressed into DAWGs (Directed Acyclic Word Graphs) by eliminating common subtrees. I've used this in word games on iOS where I want a small memory footprint.

P.S. I love tries!

<comment><USER12> "How to Squeeze a Lexicon" by Ciura and Deorowicz [1] is a good and practical introduction to DAWGs.

[1]: [http://sun.aei.polsl.pl/~mciura/publikacje/lexicon.pdf](http://sun.aei.polsl.pl/~mciura/publikacje/lexicon.pdf)

</comment></comment><comment><USER13> I think the article was well written. This is the standard example to use for a Trie. But I never run into any scenarios except for this that make me think, "A Trie is a good fit for this!" What are some other examples where Tries come in handy?

<comment><USER3> I've used prefix trees to represent matching rules for network-routing rulesets. They're also handy when you need to compute intersections because you can perform a parallel depth-first search over two prefix trees and prune from the search any nodes that don't have a corresponding node in the other tree.

For a fun example of this last application, there was a recent Google Code Jam problem called "Alien Languages" [1]. My solution [2] basically counts the leaf nodes in the intersection of two prefix trees. (Note that we can compute the count on the fly during the search and need not actually construct the intersection.)

[1] [http://code.google.com/codejam/contest/90101/dashboard#s=p0](http://code.google.com/codejam/contest/90101/dashboard#s=p0)

[2] [https://github.com/tmoertel/practice/blob/master/google- code...](https://github.com/tmoertel/practice/blob/master/google-code- jam/2009/qual-A-alien-language/alien_language.py)

</comment></comment><comment><USER14> With a basic Trie, you always have this problem of how to keep the pointers at each node. Naively, you can:

1) Keep an array of size equal to the alphabet size, indexed by the characters, holding pointers to successive nodes.

\- but this blows the memory to O(N * alphabet_size) where N is the input size

2) Keep a linked list of pairs (character, pointer).

\- but this blows the lookup time to O(word_length * alphabet_size)

3) Keep something like an STL map<character, pointer>.

\- still suboptimal complexity of O(word_length * log alphabet_size) + it complicates the code + it dramatically increases the constant time per operation

Or you research a bit more and actually learn a way to properly implement a trie, called a Ternary Search Tree: [http://en.wikipedia.org/wiki/Ternary_search_tree](http://en.wikipedia.org/wiki/Ternary_search_tree)

<comment><USER15> Or you decide that your problem is small enough that the poor memory complexity doesn't matter much.

<comment><USER14> Sure, but it can blow up faster than you think. Say you have 100k URL strings, up to 128 chars each, with 64 allowed characters in alphabet.

\- storing this at byte per char = 12.8MB

\- storing this in a basic trie = 12.8 * 64 = 820MB

\- storing this in the TST = 12.8 * 3 = 38MB

<comment><USER15> Sure, I was thinking on the order of <100 strings around 5-10 characters each at most. I agree that the TST is much better suited for large sets of strings. Also I think more developers should actually do the calculations even if they only have an estimate of how large the inputs will be.

<comment><USER14> Ah, in that case it goes straight to set<string> for me :-) I think that in practice you want to do that but then drop in a few asserts to check whether things are not getting out of control once you forgot about this decision.

</comment></comment></comment></comment></comment><comment><USER16> John Resig did a really cool series[1][2][3] of deep-dive posts into optimization in JS for mobile, which covered tries (among others) -- it was the first I'd heard of them. Fascinating read.

1\. [http://ejohn.org/blog/dictionary-lookups-in- javascript/](http://ejohn.org/blog/dictionary-lookups-in-javascript/)

2\. [http://ejohn.org/blog/javascript-trie-performance- analysis/](http://ejohn.org/blog/javascript-trie-performance-analysis/)

3\. [http://ejohn.org/blog/revised-javascript-dictionary- search/](http://ejohn.org/blog/revised-javascript-dictionary-search/)

</comment><comment><USER17> If you like tries, take a look at the double-array trie: it's a pretty nifty (though somewhat complicated) way to greatly reduce the space usage of tries by interleaving nodes in the same block of memory. It also makes it easier to serialize a trie, so you can quickly load a pre-built one instead of re-doing all the inserts, which is useful for static dictionaries.

[http://linux.thai.net/~thep/datrie/](http://linux.thai.net/~thep/datrie/)

<comment><USER18> Thanks for the link! I wish I'd known about this implementation.

</comment></comment><comment><USER19> Tries haven't been entirely neglected. Quadtrees and octrees are their 2- and 3D analogues, and those are very common in games, renderers and other spatial simulations.

<comment><USER20> Quadtrees and octrees are far more related to binary space partitioning than tries.

</comment></comment><comment><USER21> [DAWGs]([http://en.wikipedia.org/wiki/Directed_acyclic_word_graph](http://en.wikipedia.org/wiki/Directed_acyclic_word_graph)) are a special kind of Trie where similar child trees are compressed into single parents. I extended modified DAWGs and came up with a nifty data structure called ASSDAWG (Anagram Search Sorted DAWG). The way this works is whenever a string is inserted into the DAWG, it is bucket-sorted first and then inserted and the leaf nodes hold an additional number indicating which permutations are valid if we reach that leaf node from root. This has 2 nifty advantages:

Since I sort the strings before insertion and since DAWGs naturally collapse similar sub trees, I get high level of compression (e.g. "eat", "ate", "tea" all become 1 path a-e-t with a list of numbers at the leaf node indicating which permutations of a-e-t are valid). Searching for anagrams of a given string is super fast and trivial now as a path from root to leaf holds all the valid anagrams of that path at the leaf node using permutation-numbers.

</comment><comment><USER15> I just used a Trie yesterday to implement some string matching that I needed to do in a tokenizer :) It's quite useful if you want to do string matching and you know ahead of time the exact list of strings you need to match with. My only issue with this article is that it explains them using Java, which I think just obscures the explanation too much, but I guess it's a Java blog.

<comment><USER22> Some people say to use a perfect hash function in that case, IMO it's more trouble than it's worth.

</comment></comment><comment><USER23> The _Dasher_ input method (aimed at people with disabilities who are able to enter data only by manipulating a pointer) uses a visualized trie with vertex areas proportional to linguistic probability:

[http://www.inference.phy.cam.ac.uk/dasher/DasherSummary2.htm...](http://www.inference.phy.cam.ac.uk/dasher/DasherSummary2.html)

(Prof. Mackay, its author, uses it to teach information theory and compression, among other things.)

</comment><comment><USER24> Implementing the Trie (on paper, in C) was about 50% of my final exam on my intro to CS undergrad class at Stanford. We had never seen Tries befor that point, but we had done a variety of trees, so we had the necessary prior experience. It was a fun exam and a very memorable experience.

<comment><USER14> You went to Stanford and have never seen a Trie in highschool? There are a few highschools in Bratislava, Slovakia that teach basic data structures in their Intro to programming courses.

<comment><USER25> North American high-school programming classes were not known for quality. Programming was not generally a high priority item for the school boards so teachers were often completely left on their own for curriculum, and often were amateur programmers at best (if programmers at all).

The end result is that university CS programs are run with the assumption that highschool students had zero prior experience with programming.

There's a reason that so many software geeks are hardcore libertarians and Bill Gates was fighting to reform teaching into a meritocracy - <USER2> educational system basically ignored their core skill-set and so the students were often self-taught. Obviously schools are playing catch-up now, but you can't change the past experiences of two generations of programmers.

<comment><USER26> The computer science AP classes at my high school were taught by the typing teacher, after she took a summer course. The instruction consisted entirely of the slides from that course, followed by time to work independently on pretty much whatever, in Pascal.

</comment></comment></comment></comment><comment><USER27> Tries have hardly been neglected. "Path-compressed" tries were very recently added to FreeBSD[0] for use in the vm subsystem.

[0]: [http://fxr.watson.org/fxr/source/sys/pctrie.h](http://fxr.watson.org/fxr/source/sys/pctrie.h)

</comment><comment><USER28> Tries are great for caching URLs & other path-like data. I've found them to be faster (and smaller) than hashes for these purposes in the past.

However, this was back in the days of tiny caches. I suspect they may have lost the edge they had in 2003.

<comment><USER29> This contradicts chatman's comment at the top, who claims a trie has poor locality. Since you have some experience with tries, do you have an explanation on how to implement tries with good locality properties?

<comment><USER28> I'd take his word for it as my tests are 10 years old!

And my apologies - looking back it was Patricia trees I was using as you can take a pointer to a mid-point in the path: useful for disk caches etc.

I was using them for small dictionaries (mainly symbol table-size structures) comparing them against an early super-fast hash (and I recall for really small dictionaries linear search as I naively assumed that a linear search would win for tiny dictionaries - it didn't). In all my tests then (as I say, 2003, on a 3 year old IBM Thinkpad) the tries won.

</comment></comment></comment><comment><USER30> > ~O(1) access time

What's the difference between O(1) and ~O(1)?

<comment><USER31> I've always seen ~ as used for about, so ~1h is somewhere around one hour.

I would read it as close to, but maybe not quite O(1).

<comment><USER32> I think the point may be that the fuzziness is already built into big-O notation. That is O(n) + C = O(n), where C is a constant.

<comment><USER30> If only set notation was more common with big-O notation. 'O(n) + C = O(n)' can be confusing, whereas 'f(x) ∈ O(n) ∧ f(x) ∈ O(n) + C' makes sense.

<comment><USER33> The set notation you gave is redundant. There's always an implied "+C" in any O(...), so why waste space writing it out multiple times?

Furthermore, using precise set notation would, IMO, make it more difficult to use. A big blob of set notation would not be easy to read for most people.

<comment><USER30> >The set notation you gave is redundant. There's always an implied "+C" in any O(...),

No. O(n) and O(n)+C and different sets. However, if an algorithm belongs to the first set, it also belongs to the latter. The confusion comes from using the equality sign instead of the "element of" operator.

>Furthermore, using precise set notation would, IMO, make it more difficult to use. A big blob of set notation would not be easy to read for most people.

No, the only difference is that f(x) = O(n) becomes f(x) ∈ O(n).

<comment><USER33> All big-O has an implied "+C", so O(n) is equivalent to O(n)+C by definition. Where is the confusion?

<comment><USER30> >All big-O has an implied "+C"

Can you state this in a mathematically precise notation?

>Where is the confusion?

The confusion comes from stateents like 'O(n)+C = O(n)', which are actually false. O(n)+C and O(n) are _different_ sets. If a function belongs to the latter set, it also belongs to the former, but that doesn't mean they're equal.

Using the equal sign here is "abuse of notation". 'O(n)+C = O(n)' would seem to implicate that C=0, but that's untrue. C is a constant which can be non- zero. Therefore the whole statement doesn't really make sense unless we assign a new definition to the equal sign.

Using set notation solves all the confusion.

'Implied +C' is pretty much nonsense. There are an infinite number of different sets that a single function belongs to. Just because f(x) belongs to O(n) and therefore to O(n)+C doesn't mean that 'big-O implies +C'. 'big-O' doesn't imply anything like that. '+C' is just a special case, and there's an infinite number of extra 'implies'.

<comment><USER34> [http://en.wikipedia.org/wiki/Big_O_notation#Formal_definitio...](http://en.wikipedia.org/wiki/Big_O_notation#Formal_definition)

A function f(x) is a member of the set O(n) iff there is some M,x0 such that for all x>x0, |f(x)|<=Mn. This means functions like lg n, n+30, n+1e999, 1e999n + sqrt(n), sin(n), and 7 are all members of the set O(n).

It is difficult to give a formal proof that O(n) + C = O(n) because there isn't really a formal notion of what is meant by O(n) + C. To me, that looks like the result of adding a real constant to a set of functions. It is common to see people do algorithmic analysis and replace terms in a runtime with a set they belong to, in which case an expression like O(n) + C might appear, but what this means is just "some function that is in O(n) plus some constant," and it is simple to prove that the set of all functions that can be described in this way is equal to the set O(n). O(n) is closed under the operation of adding constants, and the "adding constants" operation is its own inverse.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER35> This blog post appears to be to get the author's resume looked at. Seems to be working.

<comment><USER36> 17 years of both Java and JavaScript, now ain't that something...</comment></comment>


Do Not Track is not respected on mozilla.org - <AUTHOR> https://bugzilla.mozilla.org/show_bug.cgi?id=858839 <comment><USER2> Mozilla uses Google Analytics _Premium Service_ ($150k/year) which includes a contractual option to prevent secondary use of the visitor data. Therefore, they see it as legally in the spirit of Do-Not-Track -- Google is a contractor collecting the visitation data solely for the pleasure of Mozilla.

[https://bugzilla.mozilla.org/show_bug.cgi?id=858839#c21](https://bugzilla.mozilla.org/show_bug.cgi?id=858839#c21) [https://groups.google.com/forum/?hl=en&fromgroups=#!search/m...](https://groups.google.com/forum/?hl=en&fromgroups=#!search/mozilla$20governance$20google$20analytics/mozilla.governance/9IQvIubDOXU/0tWVVlrUJ)

From the latter thread, Stacy Martin at Mozilla represents "Google Analytics will not correlate or report on any customer data with any other data, they will use Mozilla data only to provide and maintain the service for Mozilla, and they will not share or use it for any other purpose."

EDIT: The contractual arrangement is relevant. Section 9.3 item 2 of the IETF do-not-track draft draws has an exception for this very situation, "data obtained by a third party exclusively on behalf of and for the use of a first party".

[http://tools.ietf.org/html/draft-mayer-do-not- track-00#secti...](http://tools.ietf.org/html/draft-mayer-do-not- track-00#section-9.3)

<comment><USER3> See comment 16.

The bug report is not about the legal contractual agreement between Google and Mozilla, but rather about user expectation from a _" do not track me"_ option. Some users, maybe faulty or silly, consider a "do not track me" option to simply mean, do not track me.

It doesn't mater if Google sign a service contract that Mozilla pays $150k/year. "Do not track me" means, do not track me. It doesn't matter if Google promise to not be evil. Do not track me still means, do not send tracking data to Google. It doesn't even matter how extremely useful or good intention Mozilla or Google has with the tracking data. "Do not track me" really do mean, do not track me.

<comment><USER4> Something to consider. In Firefox, the DNT options have a Learn More link that answers the question:

"Do Not Track is a feature in Firefox that allows you to let a website know you would like to opt-out of third-party tracking for purposes including behavioral advertising. It does this by transmitting a Do Not Track HTTP header every time your data is requested from the Web."

While you can debate whether that's the appropriate place for that information, it's not as if Mozilla is hiding this information. It's easily reached, and not at all intentionally hidden away. Nothing devious. Just a question of how to appropriately display the information.

<comment><USER5> Then rather than call it "Do not track," it should be called something like "Do not allow third party tracking."

When in doubt about naming something, name it what it is.

<comment><USER4> The problem is, DNT isn't just a Firefox thing, but something that the industry is attempting to adopt. So, DNT as a whole means something specific. It's a shame that there is that disconnect, but it's not a Mozilla specific problem.

Safari says even less about DNT (Ask websites not to track me) and the help isn't much better, though they have a separate section for blocking 3rd party cookies. But that's different from DNT.

This is a case where DNT as an industry standard means one thing to the industry, and one thing to the uneducated public. Damned if they do, damned if they don't.

</comment></comment></comment></comment></comment><comment><USER6> Do Not Track is silly.

For example: You come on to my site, I want to know how you're using it, I don't want your personal details, I just want to see how you're interacting with the site I've made for you. Why do I want to know? Well it depends on the purpose of the site, but for the most part it is so that I can optimise and improve what my site offers to you and others.

But you've politely requested that I don't track you. For starters this should only ever be a polite request, not a forced rejection of any tracking scripts. I have a right to track how people use my site. You have a right to privacy, but that's got bugger all to do with you coming on to my site, once you've made that choice you are within my domain, under my roof, living by my rules. Until you leave of course.

Some sites may respect that request, but they're the kind of site who have no need to track behaviour anyhow, and are likely not tracking to begin with. kind of makes the request moot.

People get way too offended by analytics tracking when it's there for their benefit. The internet would be one ugly place if webmasters and designers had no clue how people were interacting with it. If you want to go back to the dark ages then feel free to try. But you won't benefit from the advances we've made or are yet to make because of large scale, anonymous tracking across the web.

I've no respect for Do Not Track. It is a silly, backwards, progress- endangering concept that should be burnt on a pyre.

Think of a scenario where a site is maliciously tracking you, where a forced browser level request could to not track be sent, and maybe we'll talk. But then again I'll probably just retort that any malicious tracking will have a way around such a forced request, and so it's pointless.

Do Not Track is snake oil for the conscientious objector.

<comment><USER7> >> _I have a right to track how people use my site._

But you don't have a right to say what runs on my computer, or make it tell you what I'm doing. This is where our perceived rights collide.

>> _once you 've made that choice you are within my domain, under my roof, living by my rules._

No, my computer, my browser, my roof, my rules.

>> _People get way too offended by analytics tracking when it 's there for their benefit._

No, people get offended when you try to turn their computer into a device that spies on them. And we get more offended that this sort of stuff happens without most people even being aware its going on. They may or may not object to it, but right now they don't even know.

And it's so lovely of you to have made the decision for me that it's to my benefit, so I don't have to worry about pesky things like privacy concerns, or having control over my own computing.

>> _Do Not Track is snake oil for the conscientious objector._

This is about the only thing we agree on. It's pointless and it was never going to achieve anything.

<comment><USER8> > _No, my computer, my browser, my roof, my rules_

His website.

Seriously, people should be warned that they are tracked, the purpose for which they are tracked and what exactly is tracked. Google Search for example is giving warnings lately, that you have to manually dismiss (probably because of EU laws) and I view that as being progress.

On the other hand demanding of publishers to not track you while you're on their property is unreasonable. Of course, you can complain about it, you can stop using such services or websites and so on. Voting with your wallet (or eyeballs) still works, even on the web.

I also view the "Do Not Track" header as a good thing, because it's an automated way for publishers to respect your wishes, should they choose to do that. But customers must also understand that this header represents a kind request, nothing else and we shouldn't make it something else, as that's a slippery slope.

<comment><USER9> Actually, I can use your site and benefit from it, while simultaneously blocking your ability to track me. It's called Ghostery (and similar browser extensions).

I use Ad-Block Plus and Ghostery for all my web browsing, and have both Ad- Block Plus set to block _all_ ads and Ghostery set to block _all_ tracking scripts.

These extensions do not make 'polite requests'; they directly control the browsing experience to my benefit.

I (and my extensions) control my browsing experience, not you.

(You can argue that this is unfair, but in the long run I believe the outcome will be a better business model for sites to make money.)

<comment><USER10> You do know that sites will track you without javascript or ads? As well, do you browse without cookies and images, as those extensions will not help you there? And without session IDs in URIs, since you seem to want the web to return to byzantine times?

> I believe the outcome will be a better business model for sites to make > money

Sites will make less money without use of cookies, images, and support of encoding sessions into URIs. You ARE welcome to use the web without these things, but it is going to mean you are not a customer of many entities, because your kind are vanishingly small in number.

You might be interested in the Firefox section of [http://crunchbang.org/forums/viewtopic.php?id=24722](http://crunchbang.org/forums/viewtopic.php?id=24722), if your serious about your privacy and security.

<comment><USER9> I think a number of different issues are being conflated here.

Secondly, in my ordinary web browsing, I'm not trying to avoid all tracking whatsoever - I'm much more interested in blocking the 99.9% low-hanging fruit of commercial 3rd-party tracking. If I really was paranoid / needed to prevent tracking completely, I'd use a much more sophisticated setup.

Given that context, the fact that some people may be trying to embed image web bugs on a bunch of pages isn't nearly as important or interesting; AFAIK most commercial 3rd-party trackers are javascript-based these days. Same applies for straight cookies - blocking the 3rd-party javascript usually prevents these begin set in the first place.

> since you seem to want the web to return to byzantine times? > without use > of cookies, images, and support of encoding sessions into URIs

I'm not advocating for that at all - there is a continuum between only viewing raw HTML and running every bit of 3rd-party javascript someone decided to throw into the page.

My comment was bascially arguing that there _is_ a continuum, and that it is possible to block the vast majority of 3rd-party trackers, _without_ having to turn of JS completely, do anything really paranoid.

My whole comment, essentially, was about _avoiding_ turning off JS etc., and still maintaining a level of control over my browsing experience. I actually develop web applications for a living, so it would be a bit silly of me to say that we shouldn't have sessions support!

> > I believe the outcome will be a better business model for sites to make > money

What I was referring to here, is that if ads and 3rd-party tracking are blocked, then sites will have to create new revenue streams to operate with - and if that means paying directly for good content, then I look forward to supporting that business model.

I think your annoyance is misplaced. I develop rails apps for a living, so I am aware of the importance of js, sessions etc. - I'm merely stating that I can have my cake (blocking 3rd-party trackers) and eat it (still use the next) too.

<comment><USER10> But the post I responded to is wrong. Blocking third party trackers does not block my hosting of the JS file; this is only discouraged for most trackers. Most trackers also have a gif-pixel option and by default (eg. quantcast) or a server-to-server option (eg. kissmetrics). I was merely pointing out your conclusions are wrong about Firefox, extensions, or HTTP headers preventing the capabilities of trackers. And again, you are very welcome to not be tracked online; that is very much within your right; you are just spreading falsehoods. Have a look at evercookie, for example.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> There's a large effective difference between "do not track" as it is outlined in the bug, and how many people see it (see, for example, comment 16 in the report, and then comment 25)

Specifically, it's to do with _third party_ cookies, not any particular site.

If I visit someone's website, I'm usually perfectly happy for them to record my visit and my actions. If, on the other hand, I visit their website and some invisible actor (say, an advertiser) also tracks me, then it becomes insidious, especially if that other invisible actor is active on multiple sites.

This gets a bit blurred when you've got large vendors with multiple presences. For example, years ago when you logged into Hotmail, you'd be briefly redirected via passport.com (then live.com), and then directed back to Hotmail. Similarly, going to Microsoft's web page, or MSN's, or Technet, or any other site in the Microsoft stable, would redirect via the same site. This gave them single-sign-on, but also allowed them to "track" your activity across the entire network. That behaviour is used by many other large organisations such as Google.

However, it's also made its way into other large sites like Facebook and Twitter, because sites like that have "social media buttons" appearning on sites that aren't served by those sites but are served by Facebook and Twitter, so becoming third-party objects, and doing the same sort of pervasive insidious tracking across multiple domains and web properties.

The thing is, Google Analytics (as mentioned in the article) is such a pervasive ubiquitous invisible actor, but it's damn useful, so lots of people want to use it. The problem is that it's a third party object, and it's of massive benefit to Google too, not just the site owner.

So, where "do not track" fails is in distinguishing between "tracking" that's acceptable to many people, and "tracking" that's somewhat more invisible and pervasive. Switching it all off is harmful to the internet, but until it's sold correctly, it won't be acceptable otherwise.

<comment><USER12> _The thing is, Google Analytics (as mentioned in the article) is such a pervasive ubiquitous invisible actor, but it 's damn useful, so lots of people want to use it. The problem is that it's a third party object, and it's of massive benefit to Google too, not just the site owner._

Several web font services now fall into that category as well. The problem from a user's point of view is that you can block Google Analytics or Facebook Like buttons without any loss of functionality you probably wanted, but blocking Typekit or Google Web Fonts will often mess up the rendering of a page.

This changes the rules fundamentally. Before, with free services where you weren't the customer but the product, you could opt out by simply not using the service. Now, even with services where you really are the customer and maybe you really are paying for it, you can't opt out of the potentially intrusive third party service without opting out of or significantly degrading the main service you wanted to use as well.

This is a tricky area. Those third party services are pervasive precisely because they are useful to people who build the web sites that users enjoy, and if they're being given away for free, they have to fund themselves somehow. I also don't have much sympathy for people who don't load up someone's web site as it was presented to them but then complain that it doesn't look right or work properly (see also: not running JS, complaining that you can't want Flash content on your iPad, etc). In some respects, these third party services are almost certainly beneficial to users, too, because they act as CDNs that probably improve performance and lower bandwidth requirements compared to having every site self-host the same common material.

On the other hand, privacy matters. We have drifted into a situation where this kind of ubiquitous monitoring is widely used by site owners, but many of them probably don't even realise the implications for their users' privacy, or just don't care. We have rules about data protection and spamming and the like to deal with similar situations in slightly different contexts, and maybe it's time we had some rules about tracking by services that are incorporated indirectly on other people's web sites and possibly without a visitor's knowledge.

<comment><USER13> Would it satisfy the bug reporter if we show a HTTP 401 _unauthorized_ for anyone who has DNT turned on?

<comment><USER14> I'm not the reporter, but I'd be fine with that.

</comment></comment></comment></comment><comment><USER15> "Do not track" in its present (non-)state is a farce. It should be implemented at the browser level.

My ideas on DNT:

If a user specifies "do not track" in their browser-global or site-specific settings then ALL requests to third party domains should simply be blocked.

This could be backed up by a site-provided manifest (potentially containing a comment for each ones justification, or a flag to say if its required or optional) to 'whitelist' 3rd party domains that they require it. There should be a browser feature to view this whitelist and 'uncheck' any sites you disagree with.

In fact, IMHO, thats the way modern browsers should work anyway - it would certainly solve a huge number of other issues (XSS, etc).

<comment><USER16> > ALL requests to third party domains should simply be blocked.

It's too late to do that. There's lots of websites relying on 3rd party CDNs for non-tracking purposes (CloudFront, Google-hosted jQuery, etc.)

Filtering on domain name alone won't prevent traffic from going through 3rd parties — tracking companies can ask websites to set up DNS CNAME for them or they'll use top-level HTTP redirects (like google.com uses to track SERP clicks).

And "my mom" isn't going to be able to vet list of domains. She'll call me and ask me to "fix" the computer so that "Log in with Facebook" works and there are no scary technical questions.

<comment><USER15> > It's too late to do that. There's lots of websites relying on 3rd party CDNs > for non-tracking purposes (CloudFront, Google-hosted jQuery, etc.)

Undoubtedly - hence the site-defined manifests for third parties.

</comment></comment></comment><comment><USER17> It's another case of bad naming. The feature should be called something less absolute like "do not track me across websites" or "track me less".

</comment><comment><USER18> I'm with the bug author on this: "do not track" should mean _do not track_. And it explicitly mentions _analytics_ on the DNT site.

 _Do Not Track is a technology and policy proposal that enables users to opt out of tracking by websites they do not visit, including analytics services, advertising networks, and social platforms_

[http://donottrack.us/](http://donottrack.us/)

However, Wikipedia says that the exact definition of what constitutes tracking is not yet clear.

 _The Do Not Track (DNT) header is the proposed HTTP header field DNT that requests that a web application disable either its tracking or cross-site user tracking (the ambiguity remains unresolved) of an individual user._

[https://en.wikipedia.org/wiki/Do_Not_Track](https://en.wikipedia.org/wiki/Do_Not_Track)

</comment><comment><USER13> This is an interesting topic. Should I deliver different experiences depending on DNT header?

<comment><USER19> Yes.

If you choose to send an e-mail newsletter to your users, you should (at least) be obliged to provide an unsubscribe option - providing two different experiences.

If you choose to track your users, you should (at least) be obliged to assume that DNT users have opted-out of this tracking and be responsible for not tracking them.

<comment><USER20> That does not seem apples to apples. Should I provide an "opt-out" of all advertising for people who just don't like looking at ads?

<comment><USER19> In the EU, the two situations I described are both legal obligations (regarding collection of personal data, the legal obligation is probably stronger than I described).

[I have understood that this is not the same in the US and the situation is therefore murky and EU law is not respected on the internet as a whole.]

What you described is not a legal obligation, although I personally think you should provide the option to opt-out of ads - I know of several sites that do and this makes a positive difference to me as a user.

<comment><USER12> _In the EU, the two situations I described are both legal obligations_

What EU law requires a web site to check for and act on DNT?

<comment><USER19> None: the website requires explicit opt-in permission to collect personal data in the first place, making opt-out DNT largely irrelevant.

e.g. from [http://www.theregister.co.uk/2012/01/27/time_running_out_for...](http://www.theregister.co.uk/2012/01/27/time_running_out_for_do_not_track_system/) [Peter Hustinx, the European Data Protection Supervisor] said that the DNT system "although valuable" seemed to "fall short of the" of the requirements for obtaining lawful consent set out in the EU's Privacy and Electronic Communications Directive.

<comment><USER12> _None: the website requires explicit opt-in permission to collect personal data in the first place, making opt-out DNT largely irrelevant._

It's nowhere near as simple as that, either in theory or in practice.

<comment><USER19> Can you be more specific?

In practice, I agree there are several problems: it is common industry practice to ignore data protection concerns (led by example of large US corporations) and EU member states have neither the intent nor the means to enforce the law. What's more, the recent cookie directive debacle makes the EU seem confused and toothless.

In theory, however, data protection seems pretty clear to me: [http://europa.eu/legislation_summaries/information_society/d...](http://europa.eu/legislation_summaries/information_society/data_protection/l14012_en.htm)

Intended reform makes the situation even more clear: [http://ec.europa.eu/justice/newsroom/data- protection/news/12...](http://ec.europa.eu/justice/newsroom/data- protection/news/120125_en.htm) I particularly recommend "How will the data protection reform affect social networks?", which discusses the requirements of 'privacy by default' and 'privacy by design'.

<comment><USER12> Businesses collect personal data without explicit consent all the time. Think of records when you buy something by card, for example. Not only is the subject of the data not required to give explicit consent for keeping a record of this transaction, but they also have no right in law to have such data deleted, and indeed businesses may not be able to delete it within the law given their obligations to maintain adequate tax records. If you pay for something by card, it's implicit that you agree to this.

For something closer to the tracking we're talking about, it is normal to maintain server logs that show visits to your site, and to record various information that is voluntarily sent by browsers as part of HTTP requests. There's obviously some debate about how much IP addresses represent personal identification, but clearly in practice they can identify individuals under some circumstances. That doesn't mean someone has to ask you for permission to see your IP address when you visit their site, because obviously that would make no sense technically.

Obviously there are implications to keeping some of this data or using it for other purposes, but as I said, this is where things aren't always clear even in theory. Some issues really are black and white, but you quickly get into what is fair or reasonable or implicitly permitted by data subjects and what is crossing that line and should require explicit consent.

In practice, it's even worse, because we have silly things like the infamous EU cookie rules that are almost universally disliked by users (they make the experience of using web sites worse), almost universally ignored by business (who don't want the overheads of implementation and don't want their users' experience to be worse), and as far as I know universally unenforced by regulators (who would in many cases have to start by going after their own governments for flagrant violation). While possibly well-intentioned, such poorly conceived rules just bring data protection law into disrepute while alienating almost everyone. They also demonstrate that realistically there are few risks to flagrantly ignoring the rules as a business, which is hardly going to help with promoting good practice.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> Instead of the useless EU cookie legislation, we should have had legislation that enshrined explicit privacy preferences in to data protection law.

When I signup to a website I'm expected to agree to their Privacy Policy. Both site owner and visitor expect that policy, provided that it's legal, to be somewhat enforceable in court. When I'm just visiting, why is there no such equivalent?

The problem with DNT isn't that it can be ignored, it's that it can be ignored without penalty. People who think purely technical solutions (including Ghostery, NoScript, Adblock etc.) are the answer are ignoring the reality of how easy it is to fingerprint and track users on the web.

</comment><comment><USER22> The discussion is good and also a great example for Mozilla caring (especially that it is discussed in the open for all to see).

</comment><comment><USER23> That discussion is full of the usual run-arounds.

The man scored a major point, and Mozilla has chosen to run away from it. The DNT flag, so far, looks just like the worthless piece of promotional fluff and 3-card Monte it is. ESPECIALLY if Mozilla chooses to run away from it.

We're going to need _laws_ to protect us from the continual government AND corporate riot of people-tracking. The People don't like it, and once they get done with NSA in Congress, they might as well get busy on making tracking OPT- IN. Including cookies, browser finger-printing, stashing stuff in browser cache (disk AND memory), and the hundreds of other ways these geniuses have evolved to invade the social communication space to promote their bottom line. We badly need to have this discussion as a nation. Because its starting to run over our boot-tops.

Tracking could be limited to dot-coms. Then let the People decide whether to keep dot-coms in their bookmarks, or leave the rats to go down with their ship of fools.

</comment><comment><USER24> So maybe the text in the UI jut needs to be changed to be more accurate. Instead of "Do Not Track", something along the lines of "Request No Tracking Across Sites" or "Request No Cross-Site Tracking". This clarifies that it isn't the browser stopping tracking, it is the browser asking the sites not to, which they may or may not implement. It also clarifies that what is being requested not to happen is using the same identifier across sites and between different parties.

On an unrelated note, I'm really impressed with the Persona login on that site. When I first saw it I thought, oh no, not another username and password. Why can't they just use social login where I already have accounts? But all I had to enter was my gmail address, approve the usage, and I was done. No extra username and password even though I've never used Persona before. No need to confirm an email. It worked out really well.

</comment><comment><USER25> I don't get it. Why is this different from inspecting your web logs? Sure you lose the first-party cookie aspect, but I bet you can get awful close just looking at the request IPs. There's "tracking" inherent in how everything works, so why does it matter if collection is contracted to a 3rd Party?

Does the poster expect the web server to not write a log line because he sent a DNT header too?

<comment><USER26> IP logs aren't sufficiently unique: my IP changes as I move my laptop around, it is shared with several other persons at work and home, and my IP at each of these locations changes.

Most DNT is concerned with Javascript, which has the ability to be very intrusive than mere web logs. Analytics services started with web logs, but quickly transitioned to Javascript, because I can track a cookie much better than an IP address, and get more information besides.

It's inherently different when contracted to a 3rd Party.

Third-party vendors are opposed because it would be the equivalent of giving _all_ of the IP logs from a majority of the Internet to a single user (in this case, Google Analytics). The ability to discover trends on particular users than becomes massively possible in a way that simply doesn't exist with 1st Party tracking. The siren's call to monetize this data is ever present, so we seek to not allow the collection in the first place.

<comment><USER25> I'll say here what I said in the other reply, but briefly.

There's a difference between a 3rd party doing the analytics and a 3rd party cookie. GA can (and should) use a 1st party cookie for this, which would make it impossible for them to correlate between sites. As a bonus, turning off 3rd party cookies also breaks ad retargeting, which makes everything better.

At that point, it's the same as Mozilla doing it themselves, but your concerns about JS being more potentially intrusive is valid.

note: i may be wrong about GA using 1st party cookies. if so, that's really not cool.

<comment><USER26> GA does use 1st party cookies. There is still concern that with sufficient statistical analysis, Google can still track users across multiple sites. "Anonymous" data frequently turns out to be very personally identifying.

In particular, comparing behaviors and IP addresses used in Google products and captured in Google Analytics would be very easy.

Likewise, Google knows a super-majority of site entrances from their search engine, and a correlation is trivial given that most users are logged in for search. To wit: if I perform a search with a unique referrer, and that unique referrer is then captured with my Google Analytics user cookie, then I can be readily identified as a person. Doubleclick and other Google services share this issue.

Others do use Third Party Cookies. Mozilla is threatening to turn off 3rd Party cookies entirely, which has caused no small amount of concern from ad companies. See this post, one in a series of hilariously over the top diatribes from the Interactive Advertising Bureau: [http://www.iab.net/iablog/2013/06/mozilla-kangaroo-cookie- co...](http://www.iab.net/iablog/2013/06/mozilla-kangaroo-cookie-court.html)

<comment><USER25> Yeah, I saw the bit about turning off all 3rd party cookies, which made me happy as I already do that myself.

As for the ubiquity and potential for data sharing among Google services, I suppose I hadn't though that entirely through. I know there was one analytics company claiming it could track individuals between devices using some fancy statistics, but I assumed it was snake oil (it was not GA claiming that).

Anyway, I hear ya, and thanks. I can see a case against GA specifically, though I have a hard time swallowing it against _all_ analytics. I suppose it's a question of trade-offs that people are willing to make.

</comment></comment></comment></comment></comment><comment><USER27> Thanks for the link i just installed a "do not track plugin". Fuck Google

Plugin: ([https://addons.mozilla.org/en- us/firefox/addon/donottrackplu...](https://addons.mozilla.org/en- us/firefox/addon/donottrackplus/))

</comment><comment><USER28> I genuinely don't understand all the hatred out there for advert companies tracking user purchase trends. Can someone explain to me why I should care about this?

<comment><USER29> I think it's more a hatred of (perceived or real) trickery, deception, and weasel words, in this case. From an organization that should be a model for others to follow.

</comment></comment><comment><USER30> The very fact that the website must support DNT is its only and fatal flaw. Why should we trust websites to honor DNT when we keep sharing information with them?

<comment><USER31> I agree entirely. IF I send a request, I expect that request to be stored. If I don't want to make the request, I won't make the request (noscript, ghostery, and AdBlock+ go a long way to that).

DNT is a pointless 8 bytes that has no real, enforceable meaning.

<comment><USER26> We can have our cake and eat it too.

Send the DNT header flag, but purposefully edit analytics requests. Thus, providers must honor DNT requests or risk a poisoned well of data.

This is not theoretical, I have a Chrome plugin which does this to Google Analytics requests, and am increasingly tempted to release it to the world.

</comment></comment></comment><comment><USER32> I don't think they can do this though. They can however disable javascript.</comment>


Vancouver VC wants an Entrepreneur-in-Residence for 2010 - <AUTHOR> http://www.techvibes.com/blog/vancouver-vc-wants-an-entrepreneur-in-residence-for-2010

<comment><USER2> I would kill to do something like this. VCs need someone in the firm that's a product/engineering guy to really connect with entrepreneurs for that first chat. Something akin to the EIR role is probably the best place for them to be. Kevin Hale describes how that role might work after a constant flow of crappy VC interns who don't understand their product calling them about Wufoo:

"I've yet to wait for a VC to come and talk to me and have an idea, at the table and say, 'Look. I've looked at your business. I've looked at what you guys've done. Have you thought about these?' Right? I don't hear that at all. I don't understand. That's not how I would approach having someone be excited about wanting to be a partner in business."

</comment><comment><USER3> What exactly does an EIR do?

Can anyone on HN who has been one, or known one really well tell us what a typical day in the life of an EIR is and what is exciting about the job?

As I understand it, it is a temporary position before you become the growth- stage CEO of a company that the VC has previously funded? Or to become the CEO of a CEO-less company that the VC is funding? Is that about right? What else do EIRs do?

<comment><USER4> Here's a good explanation that I found:

"What does an EIR do?" - [http://framethink.wordpress.com/2009/08/08/what- does-an-eir-...](http://framethink.wordpress.com/2009/08/08/what-does-an-eir- do/)

<comment><USER3> Ah, nice post. Also, worthwhile: [http://framethink.wordpress.com/2009/08/08/many-benefits- and...](http://framethink.wordpress.com/2009/08/08/many-benefits-and-a-giant- risk-for-eirs/)

Slightly comparable risk to Chris Dixon's why you don't want to raise seed money from a VC firm: [http://cdixon.org/2009/08/14/the-problem-with-taking- seed-mo...](http://cdixon.org/2009/08/14/the-problem-with-taking-seed-money- from-big-vcs/)

</comment></comment></comment><comment><USER5> Here is a bit more info from the actual posting:

"If you are an individual with an outstanding entrepreneurial spirit and mind, who is looking to create the next best thing in consumer internet, would like to assist in the evaluation of potential investments and provide functional expertise to existing portfiolio companies, we would love to hear from you. You need to have a successful track record as entrepreneur or CEO / CTO in a start-up environment, ideally in the Consumer Internet area."</comment>


Set Up Product Analytics with Google Data Studio - <AUTHOR> https://www.agrigoryan.me/post/set-up-product-analytics-with-google-data-studio <comment><AUTHOR> Have you had a chance to use Google data studio?</comment>


Google kind of, sort of, addresses Android Malware - <AUTHOR> http://www.zdnet.com/blog/open-source/google-kind-of-sort-of-addresses-android-malware/8409 <comment><USER2> I think the author missed the point a little bit:

"If you're going to do that though, why should I need an update to keep the malware from doing anymore harm? Since Google is going to rip out the rotten programs anyway, wouldn't it better to just get it over with rather than just block its functionality?"

I suspect that the 'software' being applied is a patch to prevent this sort of behavior from happening again. In short, it is the right move. It didn't read, to me at least, that they were blocking the one particular 'doHarmfulActivities()' API, rather, patching the bug that allowed harmful activities to be executed.

As for the fear of Google being able to remotely uninstall, I get that. I sort of share the notion, but the flip side, of course, is that I didn't know they had the feature, which means this is probably the first time it was executed. This is a good time for the feature to be executed.

Considering the high-profile invocations of the same method by Apple, I can definitely understand the worry that it COULD be abused, but so can anything. What matters more is that at least thus far, it hasn't been.</comment>