Ask HN: Would you consider polling your users for the right monetization method? - <AUTHOR>

Advertising, Subscription, Value-Added, Virtual Goods, Donation...
If you are not sure which route to go, wouldn't it make sense to just poll your users directly?  Has anyone done this?
This was inspired in-part by this thread: http://news.ycombinator.com/item?id=534766 <comment><USER2> _wouldn't it make sense to just poll your users directly?_

People are very poor judges of what they are willing to pay for things, and are _especially_ poor judges when "free to me" is one of the options on the table.

</comment><comment><USER3> I've done a lot of polling of my users and one thing I've noticed is that authenticated users provide much more useful feedback than "guests". Also, expect to get a very different response from people in poorer economic climates than others. Perhaps you could set up IP filters so you only poll users in your target countries? If so, this might be a great idea.

<comment><USER4> I agree. we have also polled our users in our startup Tonido. We have got useful feedbacks from core users than the guests.

</comment></comment><comment><USER5> Polling your users is probably a very smart thing to do, as long as it's worded right and not obtrusive. The best monetization features have some sort of utility built in for the user. ie- Google paid search ads show you items that are relevant to what you're searching for, a freemium account on dropbox gives you more storage space,etc.

</comment><comment><USER6> you think users will be honest when you ask them _how are you going to give me money?_

<comment><USER7> Give them a poll with fixed answers and an option to reply in text with comments. There are many times when I wished a site would remove the flashing banner ads and ask me for a subscription fee (this is specially true with websites that offer data; i'm forced to waste their bandwidth scraping their data when I would have paid $19.99/mo for an RSS feed)

Some regional newspapers are so bought-out by special interest and industry, it's hard to get accurate market figures from them. There is enough market for paying users who want OBJECTIVE news and market analysis, but the newspapers never offered us this option.</comment></comment>


Ask HN: Do you use different passwords on different sites? - <AUTHOR>

I have gotten quite a few 'compromised' emails from various sources over the recent years.
Saying: "Ooops, sorry we were compromised, be on the look out for phishing emails. If you use the same password on other sites, you should change them" among the other standard stuff.
I feel like I get one of these emails about once every week or two.
At this point, I feel like these emails are almost pointless to me.  They rarely say much details.  I started quite a long time ago to add variation on a per site basis to my passwords.
Do most HN users use same password, a small variant,  a truly unique password(password keeper?) on a per site basis?
Thoughts? Recommendations?  Is it all just hopeless and pointless? Is it worth the hassle of different passwords? Do you maintain a few passwords and 'update them all' whenever you get one of these emails? <comment><USER2> Yes. I use a 22 character password composed of mixed-case alphanumerics and symbols. I generate a new password for every single website I have an account with, no matter how onerous the process or insignificant the account.

Later this year I am considering transitioning every single account to its own email address on my domain as well. But I recognize that's a tad paranoid. Perhaps only the most valuable accounts.

I recommend 1Password. I don't think there has ever been a major security breach with 1Password, and when I reported a minor cryptographic flaw they were _very_ quick to respond to me and plan a fix for it, despite the threat model being relatively small.

<comment><USER3> I also favor this approach and 1Password sure makes it, if not easy, then certainly tolerable.

The only thing I'd add is that there are some websites with weird length and character rules, so sometimes you must tweak your password generator for smaller lengths (you won't be able to use 22-character passwords everywhere) and fewer "special characters" (non-alpha-numeric in this case).

</comment></comment><comment><USER4> I use mSecure with a different, randomly-generated password for each site/service I use.

</comment><comment><USER5> I use a password manager (1Password) to generate a strong, unique, password for every site.

</comment><comment><USER6> Yes.

</comment><comment><USER7> Don't track me :)

</comment><comment><USER8> I use a password manager and generate 64 random number/character combinations for each account. When applicable, I also enable 2FA.

With accounts that are a 1-off and I don't really care about, I don't go through the trouble and just use a short password I can remember.

Something interesting I have found is that some sites will allow me to use a 64 character password when I create the account, but error out and won't allow me to login. If I shorten the password, it works fine.

</comment><comment><USER9> NICE TRY!</comment>


How Lisp Became God's Own Programming Language (2018) - <AUTHOR> https://twobithistory.org/2018/10/14/lisp.html <comment><USER2> Gerald Sussman, co-inventor of Scheme and author of SICP, was my undergraduate advisor. The last several times I visited his office, he was usually with Jack Wisdom either programming or deep in thought or discussion about differential geometry and the differential geometry Scheme library they were writing. One time when he wasn't so occupied, I brought up SICP, and asked if he was aware that a lot of people think of reading the book as a sort of magical, enlightening experience. He said, "Yes, I'm aware." I asked if he had any idea why. He said, "The main reason is that it tells a good story. It also has a complete, coherent narrative."

<comment><USER3> Am I the only person that read the whole of sicp and didn't feel enlightened in the least? I felt way more enlightened when I read the whole of John Baez's this week's finds. Maybe it's a book which you need to read when you're younger.

<comment><USER4> Curious: did you complete all the exercises in the book? Not doubting you in any way, just wondering if that's a possibility. I know I've gone through books without doing the work, while on others I have done the work — and it's usually a pretty different experience.

But, not everyone is gonna connect with everything, regardless.

</comment></comment></comment><comment><USER5> I have never minded using a so-called niche language. Since 1982 I have been very fortunate enough to be paid a good fraction of my time for using Common Lisp - I consider this to be largely good luck and I am grateful for how things turned out. I also like Scheme but literally no one has ever paid me for Scheme development. In the USA, we have a saying that "you dance with the person you go to the party with." My dance partner has been Common Lisp.

I still feel like I am still a student. I started to read Let Over Lambda (a reference to closures) a few months ago which has reinforced my realization that there is so much about a programming language that I have used for 38 years that I still want to explore.

All that said, I have often totally enjoyed building systems with C/C++, Java, Python, Prolog, etc. Designing and writing code can be fun in any language.

<comment><USER6> Didn't you work at CCSO back when Prof Kaplan was just down the hall, unless you were in another building...have you read the Guy Steele original papers on Scheme? They're actually awesome.

<comment><USER5> No, that was not me. I do like Scheme (and a long time ago I wrote a Scheme book for Springer-Verlag), but I was just saying that I haven't used the language professionally.

</comment></comment></comment><comment><USER7> Reading "Lisp 1.5 Programmer's Manual" when I was a post-graduate student at Waterloo (around 1977) was a revelation to me. In particular, "Appendix B: The Lisp Interpreter" gives a version of the Lisp interpreter in just 39 lines of code! (The appendix includes notes, and is 3 pages long.) I remember using this code to figure out how Lisp evaluated recursive functions. Until this point in time I had programmed in Fortran, IBM 360 Assembler, Cobol and Pascal. They all required much more documentation, and, in many cases, experiments to figure out what would actually happen in certain cases.

I wish the idea of a definitive high-level semantic guide had become a thing. SwiftUI, for example, seems to be wonderful, but learning it, as far as I can tell, requires watching hours of talks, or working through many tutorials. What a contrast with McCarthey at. al's 1985 book.

</comment><comment><USER8> I'm surprised that this didn't bring up Paul Graham's "Blub" concept, in which non-Lisp languages are thought to be objectively less powerful than the universal language of Lisp. That's been a lot to blame for the mystical reverence of Lisp in the 21st century. While I'm a Lisp fan myself, and agree that it is more powerful than a lot of mainstream languages, the idea that it is the "most powerful" blinds a lot of hard-core Lisp devotees to things like Haskell that are worth exploring as well.

<comment><USER9> The "Blub" parable is really clever because it says that when other people doesn't use Lisp, it is simply because they are _incapable_ of understanding its power - not because of any practical or technical reason to chose another language. So any argument the "Blub" programmers might use to justify "Blub" is automatically invalid.

Of course it can be used for any non-mainstream language, and I have seen it used for Haskell, where Lisp is the "Blub" language.

<comment><USER10> I've had this recently. Was writing Python but missed the ease of concurrent functional programming. Used F# but missed type classes. Used Haskell but missed dependant types. Use Idris but miss the build environment of Python.

<comment><USER11> Yes, once you learn enough languages I feel like you just find yourself constantly wishing you had aspects of another language, pretty much regardless of what language you're using. Sometimes its directly related to the language, sometimes its something like the ecosystem surrounding it.

This is why I'm wary of "right tool for the job" when it comes to languages. In my experience usually there isn't a singular obvious right language. Maybe one is 35% right, another is 38% right, and the golden ticket language is actually just 45% right. And sometimes you won't really know until you're halfway through the project.

If you wanted a 100% singular obvious correct language, you would have to make a custom language with traits from a dozen different ones. But in the real world, the differences between languages you can actually choose from end up being not that large.

<comment><USER12> I think of languages as a multi-dimensional tree, with branches extending in different directions. I think that the trick is to figure out what the yak- shaving aspects of the project are going to be (which you can think of as a vector), and picking the language that goes the furthest in the direction of that vector (and thereby does the most to minimize the yak-shaving). This requires that you be able to fairly accurately determine what the yak-shaving will be up front (which can be problematic).

</comment></comment></comment></comment></comment><comment><USER13> I would have thought God would write binaries directly in machine code. The only purpose of a language, is to allow creatures of limited intelligence to create abstractions that hide complexity and allow complex problems to be more easily reasoned about.

Presumably God does not need to use abstractions, and can reason perfectly with an infinite number of variables, so a programming language would just prevent an Omniscient being from being able to create as perfect a program as it could otherwise (as any given programming language doesn't let you create any binary).

<comment><USER14> Machine code is an abstraction, too.

In a Judeo-Christian context, God seems to operate in very abstract terms. "Let there be light" is a highly abstract instruction.

In some other religions and mythologies, there isn't a single God giving the instructions from outside, so it seems difficult to make the comparison there.

Abstraction is like a lever, and by first-order logic there is no way to avoid using an abstraction whenever we communicate, whether internally via vocalized thoughts, via hn or by some really old books. Maybe that's why humans want to believe that abstraction is so powerful. Thankfully, we're not totally wrong.

But thank you for making me imagine a world where the "Let there be light" statement has been meticulously explained in as much detail as possible.

"Then, He realized that adding an extra electron to Hydrogen was not such a good idea; the entire universe shattered, and, after a brief moment of embarrassment, he comforted himself with the fact that no-one will ever know of his folly.

He continued calculating the correct speed-constants for a particle he made called a photon, which wasn't exactly a particle, but it was small and didn't carry a lot of weight, it was everywhere, and it was mostly directional -- so he figured it might be useful for some sort of massively parallel input apparatus, and his creations can use it to understand all sorts of things about their environment and themselves. Eventually, humans will suspect that light is a wave, too; but that wasn't quite right, either. God made is difficult to figure out for copyright protection reasons, but here's a hint, and get your notebooks out: ..."

<comment><USER15> > "Let there be light" is a highly abstract instruction.

The more I think about this, the more I realise it might be _the most_ abstract instruction. It's actually kind of beautiful.

<comment><USER16> I once worked in a company that used a similar approach. So, for example, the "chief architect" would file a _bug_ in the tracker titled, "Product X does not exist". It would then be up to the engineers to "fix" it by creating the product.

No wonder Satan rebelled. ~

</comment></comment></comment></comment><comment><USER17> I have heard for decades how Lisp is transformative, how just having learned it, even if you leave, you will never look at things the same way again. Like having served in the Armed Forces.

Every so often I get interested in Lisp, but I always run up against the same conflicts. I look for something that I can run in Windows that has a reasonable set of libraries and then immediately stumble upon the Crusades. You know, the religious wars you saw with emacs vs vi, wars that used to be fought over various Linux distros and window managers, that you will now see about different flavors of agile or whatever. I am quite sure that there are religious wars being fought in the territories of Javascript frameworks that I've never heard of. These wars so often seem to leave the territories barren, the original objectives cloudy, and the participants scarred. What _was_ this good for, again?

Anyway, every time I encounter these things I end up asking myself if I have the knowledge to pick a side in whatever war and if joining up is going to actually provide a solution to the problems I wanted to solve using programming, decide I am neither fit nor armed, and back slowly out of the room.

<comment><USER18> I'm saddened by your story. Our programming communities can be more welcoming.

That said, I think these debates are necessary. Fixing problems starts with deciding what the problems actually are. The problem isn't that the debates are happening, it's that people like you are getting dragged into them.

You aren't obligated to participate in debates. Nor do you have to use the absolute best version of Lisp to get most of the benefits.

My advice is to pick up a copy of MIT Scheme (works on Windows) and then work through Structure and Interpretation of Computer Programs (SICP), and don't read anything else about Lisp until you're done, because you don't need to.

MIT Scheme isn't the best Lisp. It's just the Lisp that's used in SICP. You won't win any debates arguing that MIT Scheme is the best Lisp. You might even hear people say MIT Scheme isn't even a Lisp. I agree with some of that, but those debates are irrelevant to your learning.

Feel free to hit me up with any questions. I certainly have opinions on all the holy wars, but I won't bring them up, I'll just help you with the task you're working on. :) I'm not a Lisp expert by any means, but I've worked through most of SICP.

<comment><USER17> I have looked over the site once a long time ago, when I had a copy of SICP in hand. I just looked now.

What I do not see is a robust set of libraries that can help me accomplish the solving of real-world problems. As mercenary as it sounds, I program to solve problems my employer has in exchange for money. I solve problems that people have, rather than problems that books abstractly propose. While Lisp or whatever dialect might be lovely, it may as well be Logo for practical tasks. I do not want to re-implement JSON. I do not want to try to write my own ODBC. I need something beyond a language that lets me solve the problems written in a book that is divorced from real-world stuff, and that has, for the past couple of decades, meant libraries.

"The Lisp Curse" is a pretty good explanation of why I won't see those libraries and the situation hasn't changed, that I can see, since I first read it.

At the end of the day, if I want to learn a language, I want to have done it for more than the sake of having said that I have climbed that particular mountain. I need something up top that is valuable. Climbing it has to have real-world applicability to me.

Can I use Lisp to interact with these GIS formats and solve real-world problems? Not without building my own libraries, and so on. This is why I have liked the war metaphor: all of these folks skirmishing when they could be building factories.

I am not asking for Lisp to be Python or Perl or whatever. But it should have a great standard library. Where is this?

<comment><USER19> "What I do not see is a robust set of libraries that can help me accomplish the solving of real-world problems."

I think the suggestion wasn't to give you the One True Answer to which Lisp to use. The purpose of suggesting working through the SICP book is to give you in concentrated, curated form the insights that Lisp is supposed to bring, whereupon you should turn around and bring those insights back to whatever normal programming world you inhabit. To the extent it is divorced from real world stuff, yeah, that's on purpose, and the entire point of the recommendation of SICP.

Fortunately, the world has changed since the SICP was written. At the time, there was a much larger barrier between Lisp and the "real computing world". While by no mean do all languages look like Lisp now, there has been a _lot_ of seepage, and now there's plenty of languages where you can bring the stuff in SICP into the language you use day-to-day.

The idea is this: You could learn a new language, a couple of frameworks, half-a-dozen libraries, fight through bugs in all of the above in some immature cutting edge library, and also fight through a lot of accidental complexity because you accidentally selected some task that the weird new language is not very good at, only to arrive after all of this with some new insights about how computation works and what languages can do after a year or two. Or, this suggestion is, learn a very small new language and read a guide book, get the concentrated insights in a few months at most, and then continue using the frameworks, libraries, and experience you already have.

(Personally, I recommend SICP as the perfect companion to any self-taught programmer. It is almost laser focused on the sorts of things that the self- taught programmer will find hardest to pick up on their own. Finish it and you really will be able to code circles around most college grads, beating them both practically _and_ theoretically.)

<comment><USER17> I did this once with Prolog and did not come away with the benefits espoused. I was told that it would really change how I thought about things and so forth. That didn't happen. I didn't get anything out of it that I could bring elsewhere. I fear the same result after a similar investment in a similar situation.

<comment><USER18> _shrug_ That's the risk you take whenever you learn _anything_ new--maybe it won't be useful.

The alternative is, of course, never trying anything new or learning anything ever again. Your call!

</comment></comment></comment></comment></comment></comment><comment><USER20> I thought HolyC was God's own programming language.

</comment><comment><USER21> I would have thought that the Lambda Calculus has a better claim to be 'God's Own Programming Language'.

Apparently McCarthy was aware of, but had not studied, the LC. One quote from the article stuck out:

"McCarthy invented an alternative, the "true" conditional expression, which returns sub-expression A if the supplied test succeeds and sub-expression B if the supplied test fails and which also only evaluates the sub-expression that actually gets returned."

this is how 'true' and 'false' are encoded in the LC, (\x \y x) and (\x \y y) respectively, and the final sentence indicates lazy evaluation.

The early (wrong) choice of dynamic vs static (lexicographical) binding, since corrected, suggest the language was far from 'handed down on stone'.

Homoiconicity is very nice, though I suspect that the macros it has enabled are often perhaps too powerful a tool.

</comment><comment><USER22> It was Einstein that said, "Everything should be made as simple as possible, but not simpler."

I think the problem with Lisp, is that it violated this principle.

It has a lot of strange little constructs. It came from a time when programmers tried to type as little as possible. In doing so, the language adopted all these little quirks. I'm not saying it's bad, but it's just different.

Whereas the human mind is a simple graphical machine, and we like to see associations. Like, the usage of an equal sign, to see that we've made a variable assignment. Maybe this reaches back to our childhood algebra days, where we associate equivalence with an equal sign. Who knows.

But Lisp did away with all that. It created its own style. It gave us parentheses to enclose our statements, which is to be honest, actually a nice feature. But it forced us into knowing the specific ordering, sequence, and symbols in order to make a legal statement.

Anyways, I like Lisp, and have always been wanting to use it for something. But not quite sure what.

It's great for writing short macros in Emacs though. You can write a multi line function, then compress it back into a single liner, because of the parentheses. This helps keep your config file short.

It doesn't really work for video game programming, as it doesn't seem to have the libraries for it. It's not as fast as C for speed critical applications.

It kinda lives in that medium realm, where internal business applications can use it for internal business processing, that can run uninterrupted for decades. But, this space is where Python excels at.

Anyways, one day, I'll finally create that programming language idea of mine, and it'll be some fusion of Lisp and Smalltalk, but can run almost as fast as C.

<comment><USER23> Some implementations (e.g. Common Lisp) have legacy oddities in them for back compatibility but newer implementations like scheme tend not to. Instead of CAR and CDR they have first and last, for example.

Emacs lisp is quite slow but adequate for purpose. You can write very high speed numeric programs in Lisp — another book by Sussman was on HN the other day and it's all about physics, all written in scheme. The fact that code is data allows lots of complex optimizations that are harder or impossible to represent in c

<comment><USER24> I think you got this backwards. Common Lisp does have `first` and `rest` as synonyms for `car` and `cdr`. As far as I know, Scheme does not. I believe you have to use `car` and `cdr` there (unless, of course, you define your own synonyms).

I could be wrong about Scheme: My Scheme knowledge is badly outdated, and was always incomplete.

<comment><USER25> Racket has `first` and `rest`. I just tried it. But I tried an online scheme interpreter and it did not have it.

<comment><USER26> first and rest are in racket, but racket has many things not in scheme (and doesn't have some things that are.) If you use the r5rs #lang (e.g. `racket -I r5rs`) you'll see that it doesn't have first and rest.

Also, first and rest in racket aren't synonyms for car and cdr. car and cdr take pairs, while first and last only take lists. Try this: (car '(1 . 2)) and (first '(1 . 2))

</comment></comment></comment></comment></comment><comment><AUTHOR> The fractal flowers and recursive roots: The most lovely hack I've seen.

<comment><USER27> "To iterate is human, to recurse is divine"

[not sure who I am quoting]

<comment><USER23> I'm pretty sure that was guy Steele and he would have written "recur" (like "to occur")

</comment></comment></comment><comment><USER28> Lisp has many parallels with Ayahuasca: Both are tough to 'swallow' and not everyone comes out on the other side 'enlightened'.

No doubt about the potency of both though ...

</comment><comment><USER29> I like the Prolog story "PROably the Language Of God"

<comment><USER30> LOGO is the Language Of God, and we are His turtles.

        L: Language
        O: Of
        G: God
        O: Only God knows what the last "O" stands for.

<comment><USER31> A tail recursive acronym!

</comment></comment></comment><comment><USER32> The responses I see to lisp seem to vary on a huge range from idolatry to dismissiveness. It's interesting that Gerald Sussman's own point of view on lisp seems to be very much more moderate - that different programming styles and philosophies suit different domains, and ultimately, you should choose the right tool for the right job. Lisp is flexible in that it does not bind you to any philosophy, and is good as a general tool insofar there isn't a specialized tool that would fit the problem better.

</comment><comment><USER33> Discussed at the time: [https://news.ycombinator.com/item?id=18225870](https://news.ycombinator.com/item?id=18225870)

</comment><comment><USER34> It is borderline blasphemous to think God can't handle a little syntax and would use barebones parse trees cum s-expressions. Do you see DNA chains cranking around without a higher layer phenotype? You do not. QED.

</comment><comment><USER35> I thought that was Perl...

<comment><USER36> Obligatory XKCD: [https://xkcd.com/312/](https://xkcd.com/312/)

<comment><USER37> Wait, isn't this the obligatory one in this context? [https://xkcd.com/224/](https://xkcd.com/224/)

<comment><USER36> Yes, in the context of the OP. But in the context of someone mentioning Perl, the one that I quoted makes sense.

Here's the Frost poem alluded to: [https://www.poetryfoundation.org/poems/44263/fire-and- ice](https://www.poetryfoundation.org/poems/44263/fire-and-ice)

</comment></comment></comment></comment><comment><USER38> Obligatory xkcd reference: [https://xkcd.com/224/](https://xkcd.com/224/)

<comment><USER39> i was wondering what took so long for this to be posted

</comment></comment><comment><USER40> This, then, is a proof of the multiplicity of gods (there must be at least as many gods as there are Lisps).

</comment><comment><USER41> Try Clojure, learn properly then we talk...

</comment><comment> phoe-krk A lot of people, including some prominent faces in the programming world in general, have been writing about Lisp as secret sauce, silver bullet, God's language, source of programming enlightenment, yadda yadda; basically a set of mystic-sounding buzzwords that, other than causing some people to indeed try Lisp, have left a lot of people confused and amused by the wording - or just plain angry and disappointed at the false marketing that I consider the above hyperboles to be.

I can see the benefits of the comments that follow the "any publicity is good publicity" rule. In addition, the more-functional-in-approach Lisp dialects certainly follow the "breaking the long-built mental model" scheme that you mention, and so does Common Lisp, since it mixes programming paradigms (including functional one) rather freely. Still, after seeing the effects of the aforementioned hyperbolization of Lisp in the long run, I'm not convinced that its execution went well at all.

Lisp is a very good language, but no, sorry, it's not the Magical Silver Bullet of Enlightenment™®© that some people like pg or esr or (to some extent) the author of this post claim it to be.

<comment><USER42> I think it _is_ a silver bullet of enlightenment of a certain understanding of what programming languages are. It is _not_ a silver bullet for all of your programming tasks or problems.

Most people I know who cast off Lisp are people who read the Wikipedia page, didn't feel enlightened, then began to complain online about how they were disappointed by their Lisp experience. Or perhaps they went a tad further, got upset by Emacs being unfriendly to setup, and proceeded accordingly.

In the Modern Age (TM), programming Lisp is unlikely to convince you to change your usual dev stack to it. But if learned properly, it will enlighten you on the structure of a language and how syntactic malleability is a powerful abstraction for solving many kinds of problems.

Enlightenment usually comes from realizing that it's not a feature bolted onto Lisp, but an exposed interplay between many otherwise ordinary aspects of programming languages: syntax, semantics, interpretation, and the runtime. At this point one typically "sees" how this interplay could (and perhaps even opaquely does) play out with other, non-Lisp languages.

These kinds of things could in principle be learned in a compiler course, but compiler courses tend to be extraordinarily opaque as to how such a course would help your day-to-day coding. Lisp provides a visceral, hands-on experience of many (though certainly not all) of the same principles.

If you happen to be the kind of programmer who likes absolute control over your environment, because that helps you work through gnarly problems more efficiently than duct taping a bunch of dependencies together, then you may actually end up switching to Lisp.

<comment><USER43> > syntactic malleability

this is the key point - not quasi/proto FP

most comments I see that are skeptical of the 'lisp as magic' claim seem to focus on the quasi-FP-ability of lisp, leave out the fact that the lisp family is pretty much unique when it comes to _symbolic programming_ , and then optionally go on to talk about how some typed functional non-symbolic language is a better functional language.

this is ignoring the 'too many parens', 'no market share', and 'doesnt work well in my editor' people.

<comment><USER44> Syntactic malleability is actually a red herring. The key insight of Lisp is: Lisp code is not text. Lisp code can be _serialized_ as text, and it can be _parsed_ from text, but it is not text, it is S-expressions, and S-expressions are not text, they are data structures, specifically, they are trees of cons cells. And because they are trees of cons cells you can construct them without ever constructing any text, i.e. without any parsing.

Syntactic malleability is a _consequence_ of this property of the language. It is not in and of itself the central idea.

<comment><USER43> good point..

though arguably if code is data we are somewhat saying the same thing :)

in any event, this unique overall property/combination of properties is often overlooked in these discussions

<comment><USER44> The "code is data" slogan also misses the point. Text is data, so all code is data, whether or not it's Lisp code. (The only code that isn't data is code that has been compiled down to hardware. In the olden days computers were programmed by plugging wires into plugboards. That code wasn't data. But any code that is rendered in the same medium as the data it processes is data, and nowadays that includes all code.)

What matters is that text is structured fundamentally differently from trees of cons cells. Text is a vector of characters. It is a fundamentally flat data structure. It is well suited for humans to read and write with pencil and paper, or chisels and stone tablets. It is not natively suited for describing hierarchies of abstractions, which, it turns out, is what you want when you're writing code.</comment></comment></comment></comment></comment></comment>


HPE goes on the warpath, attacks AWS over vendor lock-in - <AUTHOR> https://www.theregister.co.uk/2019/12/23/hpe_go_on_the_warpath_seeks_to_scalp_aws_over_vendor_lockin/ <comment><USER2> Here we have a strong move towards what is possibly the next phase in the seemingly eternal tension between concentration/core convergence of resources versus distribution/meshing.

The last swing was strongly in favor of concentration, with a new word: "datacenters" became "clouds", though the distinction seems more marketing than ontology, if we stretch it more CS (abstract) than actual specs.

Now we're seeing a move back towards "on-prems", "self-hosted", "distributed"; towards the "edge" as we call it now, away from whatever passes for a "core" (the means is always somewhere in the middle, but as any pendulum, we probably cross it too fast to stop there given the momentum; such is the way of cyclic phenomenon driven and bound by natural objects such as human beings, or computers).

This ping-pong goes back to the first Turing machine and what came immediately thereafter; we saw big incarnations of each extreme which became popular names, iconic hallmarks of their era — the "mainframe", the "micro computer", the "super computer", the "handheld". Cue IoT (the extreme form of distribution, as far as we can conceive it), or holistic notions of "noosphere" (information "biome" so to speak, the whole of computers seen as a ecosystem, which you may describe as a "species" like we would gases, biological beings or... technological things. It might seem crazy then again internet displays some very biological properties).

The unambiguous conclusion that one should make, after observing this cycle first-hand for at least 1.5-ish period's (when you realize it's a cycle), is that we need both to make a world, and probably many variations thereof; and that we will "refresh" all of it, probably upon each half-cycle (these are, what, 30 years approx? so each 15 years give or take, like it too that from "the web" and cell phones to reach the smartphone era; or from then to now, the next few years, 2023-ish, as we cross into this next stage of the pendulum story?)

Lots of things are this way in technology, cycles from one extreme to the next, ultimately impossible to fix in a "happy medium" because there's no such thing; rather there are "happy trends" which fit their time, and as many such "trends" as there are "times" — how we moved from mainframes+terminals to the almost equally capable sever-client paradigm will be a vastly different story than the move from clouds to whatever's next.

I think HPE is poised to win huge rewards by grabbing this market first, and hopefully their execution is good enough.</comment>


MiniLock – File encryption software that does more with less - <AUTHOR> http://minilock.io/ <comment><USER2> Existing research strongly suggests that deriving asymmetric keys from human- provided seeds (i.e. passphrases) and nothing else is strongly inadvisable.

This is because it is possible to attack large numbers of passphrases at once, and it is possible to harvest large numbers of targets from public databases of public keys.

Additionally, entropy estimation tools generally are not good at accounting for the fact that human behavior results in non-obvious biases and patterns in passphrase selection.

To see an example of this model failing on a large scale, look at the number of Bitcoin "brain wallets" that have been hacked, despite having apparently strong keys.

<comment><USER3> I've been working on generating memorable passphrases with provable entropy: [http://rmmh.github.io/abbrase/](http://rmmh.github.io/abbrase/)

They work well for me, but some people dislike the abbreviation aspect. I'm investigating how to make a grammar-based engine (rather than bigram-based) for smaller data files and better phrases.

<comment><USER4> Nice! I like this methodology.

I also wonder if all possible trigrams are equally likely.

Question: why wouldn't you just use the passphrase itself as the password? Just because some websites limit password length?

<comment><USER3> The algorithm is [898, 537, 321, 205, 361] -> tidlotexidaifol -> "tidy lot existence daily following". The phrase is generated deterministically from the password, so it's no more secure than the previous steps. It's just a mnemonic to help remember the password.

If by trigram you mean "3-letter word prefix", then yes, they are all equally likely. If you mean "group of 3 words", then no, they're very biased. "raccowsli" is as likely as "afrdisuti", but it will always generate the mnemonic "race cow slipped", and never "racter cowslip slithered".

<comment><USER5> Just to add to why you would or would not want to use the passphrase vs. the abbreviation - I've personally found that I find it _much_ easier to actually type a password that consists of words, names or "nonsense words" generated by Markov chains (though not usually ones generated by letter frequencies).

I am often comfortable entering in a given password on a device on which I am _not_ comfortable unlocking my password database (or entering my password database password + keyfile), but I usually have a device which _does_ have my password database on it (phone, laptop, etc), so my application is "it doesn't have to be memorable, it just has to be something I'll enter without making a typo". For whatever reason, I find that entering in "tidlotexidaifol" would be harder for me to do accurately than "tidy lot existence daily following" or "tidylotexistencedailyfollowing".

That said, I like this approach, because some sites (like Bank of America, shockingly), restrict total password length, making a "very long password with relatively low entropy per character" approach infeasible.

<comment><USER3> You could use the phrase if you liked, but each word is only 10 bits of entropy.

One nice thing about having a mnemonic for the password is that you don't have to remember the words precisely -- you can modify the mnemonic to suit your tastes as long as the prefix remains. I originally wrote it to generate passwords that I have to enter frequently (e.g. sudo), so being short was a goal.

I'm working on making actual passphrases with more entropy per word.

<comment><USER5> Yeah, I assume that you can just have a non-deterministic expansion which will add some entropy per word to increase the entropy of the passphrase over the abbreviated version, but my point was just that even if there's no increase in _security_ by using the full passphrase, counter-intuitively, using the full phrase would likely be more _convenient_ for me (and probably for many others).

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I think the hesitations about passphrase being subject to brute force, rainbow table, etc. are warranted, but I have another concern:

If my passphrase gets compromised, I have to retire the keypair.

That's true of a key file with current asymmetric systems; but, presently if the passphrase of my GPG private key is compromised (e.g. by a hardware key logger), I only have to change the passphrase and ensure the old keyfiles are destroyed.

With MiniLock, if my passphrase is compromised the entire key material is compromised and I need to revoke the public key. But how do I revoke it? Do I tweet a message with the private key saying the public key is revoked? Will there be a centralized place to publish revocation messages? Efficient key revocation will be absolutely critical to this system and that's hard if the key distribution mechanism is tweets or some other ad hoc mechanism. This is one thing that PGP key servers really help with.

<comment><USER7> I actually approached Kobeissi with this point in the meeting in Noisy Square right after the talk, suggesting he integrate a TPM into his key management system (like how you can call out to one in Firefox for SSL with libpkcs5.so or some similarly named library). He responded that the specs were open enough that anyone could add that in. As to a centralized place your guess is as good as mine. Also can MacBook users even access their TPMs?

<comment><USER8> Depending on who you're protecting against you might want to _really_ avoid trusting your TPM.

<comment><USER9> Yeah, I wouldn't trust the TPM - certainly not from a Windows machine, and not even an Apple one after the recent revelations/research, which shows Apple tries to make the device secure against "regular" hackers, but very easy to access by Apple itself or the US government.

<comment><USER7> My current one is from atmel in 2008, before atmel quit making them, so I figure at least in this case I'm safe. I would probably not use a newer one if I was worried about TLAs though. As I am currently in the market for an MBP, where do I find this information about Apple TPMs?

<comment><USER7> My bad, Apple pulled them in 2006.

</comment></comment></comment></comment></comment></comment><comment><USER10> But wait… if the entire key is derived from the passphrase, if two people both choose the passphrase "password", would they not then get the same public and private keys? Can I not brute force people's private keys by taking millions of common passwords¹ and generating public keys from them, and then seeing which ones match my friends?

Am I wrong? Doesn't this seem much easier to brute force than a RSA key? (Presuming the private key hasn't been compromised; if it has, it's likely protected by a password, and then these two are about equal.)

¹accepting that some will get rejected because of "uses the zxcvbn library in order to impose a strict limit on the amount of detected entropy present in entered passphrases. miniLock will not allow passphrases that fall below the threshold of 100 bits of entropy"

<comment><USER11> Yes, and it clearly stated in the demo[1]. The key feature that this approach is trying to accomplish is allowing the user to not have to store anything beyond a password. Keeping track of a keyfile is HARD for a lay-user, so miniLock is trying to do the best it can securing files with only a password.

[1] - [https://github.com/kaepora/miniLock/blob/master/src/index.ht...](https://github.com/kaepora/miniLock/blob/master/src/index.html#L37)

<comment><USER12> Except that since there's no salt or other measures involved, there isn't even a trivial protection against rainbow tables letting me create one table and crack all the passwords. It's using ECC as a fun buzzword but tossing all the actual realworld benefits of key-pair crypto out the window by having a single user-provided string map to a single keypair.

<comment><USER11> Alright, what do you propose? As I said, dealing with keyfiles is HARD for the lay-user.

<comment><USER13> What about making the user choose two passphrases, which are concatenated together by the tool? Cracking a single passphrase may be easy, but cracking two concatenated passphrases is significantly harder.

E.g. password 1: "the quick brown fox jumps over the lazy dog"

Password 2: "jack be nimble jack be sick"

Final result, used to derive a keyfile: "the quick brown fox jumps over the lazy dogjack be nimble jack be sick"

Notice how "quick" was switched with "sick" in the last word. Now there's no pattern that can be easily cracked. If we force a user to explicitly do something like that, then this can still work.

That example was chosen intentionally to be weak. It shows that even with two relatively weak passphrases, the result is still somewhat strong. If we add extra requirements on top of that, such as forcing the user to use numbers and capitalizations, then the result should be sufficiently unique.

<comment><USER14> There's no difference between that and just requiring the user to use a longer password.

Anyone trying to attack the system will just program their cracker to be more likely to try concatenating words together awkwardly in the password somewhere.

<comment><USER13> It's easier for humans to remember two distinct passwords with individual complexity requirements than one gigantic passphrase.

By forcing the user to choose two passphrases which are then concatenated, the result is one gigantic passphrase that a cracker can't easily crack, yet is easy for humans to remember. It seems like this solves the problem of rainbow tables.

A keylogger could still break this system. But if an adversary has planted a keylogger, they could've simply stolen your keyfile.

<comment><USER15> I mean, you could just tell users to pick two sentences, if that's what you're after.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> This is a bad cryptosystem which will result in people being fucked. Take it offline. A serious known weakness of zxcvbn is that it will grossly overestimate the entropy of things like quotes, lines from songs, lines from movies, etc.

"the quick brown fox jumps over the lazy dog" has 111 bits of entropy according to zxcvbn.

<comment><USER13> Please don't use language like "People will get fucked" when critiquing a cryptosystem. HN is better than that.

Tarsnap has no restrictions on passphrase entropy whatsoever, yet people have no problem with Tarsnap. It's interesting that people are singling out Minilock for this feature. Is this the worst thing that can be said about Minilock?

EDIT: I accidentally said Tarsnap; I meant Scrypt.

<comment><USER16> Tarsnap does not allow anyone who has your public key to attempt to crack your paraphrase. Minilock does, and in fact you can load _all_ public keys into a bloom filter and crack them simultaniously with nearly the same speed as a single key. The design of this system is simply irresponsible. Saying people will be fucked is entirely appropriate here.

<comment><USER13> Hmm, I meant Scrypt. You can use Scrypt to encrypt files using a passphrase with no entropy restrictions. It doesn't use keys. People never raised this concern about Scrypt, and certainly didn't say people would get fucked for using it. What am I missing here? Why does Minilock warrant this outrage, but not Scrypt?

[https://www.tarsnap.com/scrypt.html](https://www.tarsnap.com/scrypt.html)

<comment><USER16> That tool generates a random salt, so passphrase cracking time is O(n) where n is the number of files being cracked vs O(1) for Minilock public keys. Additionally, encrypted files are generally still not "public", whereas Minilock public keys likely would be.

<comment><USER17> Assuming that all files are encrypted with the same passphrase, and you crack the passphrase, not the key generated from kdf(salt, passphrase), complexity is O(1) for Minilock as well.

</comment></comment></comment></comment></comment></comment><comment><USER18> I am not a cryptographer, but I'll offer some advice, if I may: don't let people choose a passphrase, generate one for them. People are very bad at creating good passphrases, but decent at memorizing a good one.

I say that because I don't trust the zxcvbn library. It underestimates the entropy of "aaaaa" as 7 bits [log(26 * 5)], not the correct value of 23 bits [log(26) * 5], for example. In this instance, it's to your advantage, but it doesn't inspire confidence in its other calculations.

<comment><USER16> zxcvbn has problems but your example is backwards. "aaaaa" gets (as it should) low entropy because it is a single repeated character. It is more likely to be used than "rqntd". The major limitations are that it is worthless for estimating entropy of passphrase (which is what it's being used for here) and words not in its dictionary (non english).

<comment><USER18> My mistake, zxcvbn uses that formula only for repetitions.

</comment></comment></comment><comment><USER19> MiniLock looks like a great option to introduce encryption to my non-technical friends. The alternative to minilock right now, for these users, is to do nothing.

Even if we do not like it, right now state of the art on file sharing (for most of the non-technical world) is an unencrypted email attachment. MiniLock looks like it might be something I can install on my mothers (non-technical) computer so that I can send her a sensitive doc (copy of my tax return, for example). This crypto system is sufficient for that use case, and the alternative is to do nothing at all. The alternatives are not GPG, or RSA, or whatever, because outside of the technical community people have no idea how to use these things.

<comment><USER20> Exactly! When it comes to crypto apps, I have noticed two kinds of criticism: "This software is not built for the threat models that interest me" and "This software fails to properly address the threat model it claims to". Too often, commenters will act as though their critique belongs in the second category when it really belongs in the first.

(It's great to question the design goals of a project! But that's very different from saying that a project fails to do what it says. In this case, Minilock has very clearly accepted a threat model where, if the passphrase is compromised, that's the game. If you don't like that, don't use it!)

</comment></comment><comment><USER21> Small UX nitpick. You can't select the miniLock ID by double-clicking it. I think it was one of the reasons bitcoin used Base58 encoding.

<comment><USER22> Afaik the main reason for base58 is making it impossible to mistake an 'I' for an 'l', etc. Beeing able to always double-click is a nice added bonus, though.

</comment></comment><comment><USER23> Relying on a passphrase only is not good enough. Enter it once on a compromised system and it's game over. Since your ID is tied to your passphrase you even have an issue and you will need to revoke your public key.

Many years ago, people realised you need to rely on something more than knowledge (of a password/passphrase) alone. Pick any two out of {something you know,something you own,something you are}, the latter being implemented by biometry.

That's why you need your ATM card, and why it has a PIN code.

This is a step back into a world were security wasn't good enough. Security is more than crypto alone, it's mainly about keeping things secret. There are too many ways a passphrase could be compromised or discovered.

This approach focuses too much on the crypto aspects, and not enough on all the other things involved in building something that is secure.

<comment><USER24> > Enter it once on a compromised system and it's game over

The same is true of any heavily used system today. All systems: banks, credit cards, facebook, etc. use "something you know". "Something you own" has just recently picked up steam in the form of two factor authentication, but then again, how many people you know actually use that?

The only thing that I know of/heard of that might hold up against the type of attack that you describe is the behavioral keys: i.e. a key which is something about you that you dont necessarily know yourself, e.g. your style of chess, or your phrasing of sentences.

</comment></comment><comment><USER25> Perhaps I'm missing something obvious, but I don't understand. What's so great about not having to store the key pair on disk? After all, this is a file encryption software. Its job is to store data on disk. In fact, it already adds a bunch of headers to every encrypted file. Why not just grab 128 random bits from /dev/urandom, make it the private key, encrypt it with the passphrase as all the other programs do, and stick the encrypted key in the header? It will only add a few dozen bytes to the header, which is peanuts.

<comment><USER26> I think so you can use it from any computer anywhere with just the passphrase to derive the key and don't need to carry and secure a file.

<comment><USER12> If you're entering your passphrase on systems you don't control, it's already game over for that passphrase.

<comment><USER27> This comment is a perfect example of why encryption is mostly not used at all. (Which is far worse than any given vuln). There's kind of a perverse all-or- nothing attitude where the goal is to poke at any possible flaw in a system as proof that it is completely worthless. What's wrong with there being different tradeoffs between security and convenience? The insistence on all-or-nothing solutions has resulted in the powers that be knowing almost everything about almost everyone in our society, because almost no one wants to deal with the trouble of "completely secure" encryption.

</comment></comment></comment></comment><comment><USER28> Some times ago I created my own file encryption software using libsodium. It uses XSalsa20, hmacsha256, pbkdf. It hide password input on the terminal. It is really slow for large files (GBs)...

[https://github.com/viralpoetry/VPcrypt](https://github.com/viralpoetry/VPcrypt)

<comment><USER29> Yours uses symmetric keys while miniLock is public-key crypto (crypto_box in NaCl terms).

<comment><USER28> Thank you for checking it out. I used it just myself, hence symmetric crypto only.

</comment></comment></comment><comment><USER30> The overview literally just sounds like encrypted archive files. How is this different from putting a password on a .7z or .rar file?

<comment><USER31> They aren't sending the PASSWORD in the clear, they're sending (effectively) a public key.

Bob sends public key to Alice. Alice uses public key to encrypt file and sends to Bob. ONLY Bob can decrypt the file (using his PRIVATE key).

If you sent a password, then anyone who intercepted it AND the encrypted archive would be able to decrypt it.

<comment><USER32> seems that how they generate the keys, it's basically the same. The same password would generate the same keys. Anyone who uses the same password would be able to decrypt data sent to anyone else using the same password.

Am I understanding this correctly?

<comment><USER33> If I send you an encrypted file with minilock, you won't know my password, and I won't know yours, but you'll be the only one that can read it, and also you'll be sure I've sent it and not anyone else.

Public key crypto has more advantages and users should understand the basics. This introduction may be more clear (4:30) [https://www.youtube.com/watch?v=vMiBwMHcSn0](https://www.youtube.com/watch?v=vMiBwMHcSn0)

Also I would only use their 7-random-words feature for passwords.

</comment></comment></comment></comment><comment><USER34> dat weissman score

</comment><comment><USER35> My favourite is that the Tweet has be come some standard of measure "fit inside less than half a tweet".

Not less than 70 characters; "less than half a tweet".</comment>


Requesting Whiteboard Coding is Doing it Wrong - <AUTHOR> http://rtfeldman.com/post/36249612177/requesting-whiteboard-coding-is-doing-it-wrong

<comment><USER2> Whiteboard coding is just an inexpensive tool to verify person's claims made during face-to-face interview. When I'm interviewing people, I ask them to solve a very simple algorithmic problem just to check my gut feeling after a conversation. I could care less about any fancy framework you might use by googling, or how you put your braces on the whiteboard - it's all unimportant, you'll get you dose of instructions about our process, coding style, etc., if you hired. Same goes for time constraints: I specifically give a very simple task (granted, I didn't do interviews for Google or Palantir) to make it easier for everybody. In the end I'd expect to see that person actually knows coding, uses chosen language properly and doesn't do obviously stupid things. Resulting code simply supports or rebutts my opinion I form during my conversations with a candidate.</comment>


John Lewis fined over spam emails - <AUTHOR> http://www.thedrum.com/news/2014/06/02/john-lewis-fined-over-spam-emails <comment><USER2> This comment right below the article: "Using pre-populated opt-in boxes now means breaking the law?"

Yes. It does mean exactly that. You need my permission to send me unsollicited marketing emails. The law (at least here in the EU) is very clear about that.

I'm a marketer, and I never understand why companies do this. I'd much, much rather have a smaller list of people who actively signed up for my emails than a large list of people who you've conned into subscribing. CTR and conversion on these lists are rubbish, and annoying people is never a good tactic for a long-term business relationship. This goes the same for people who you've done business with. If they did not actively sign up for your newsletter you should't send it to them. Legal or not.

The best way to grow a high-quality list? Let people subscribe to it (opt-in, not opt-out) and if they didn't engage/open the email for the past 5-10 newsletters or so, inform them they'll be bumped off the list. In a friendly way, of course, but still.

<comment><USER3> And, err, how is a "pre-populated opt-in box" not exactly the same as opt-out? In order not to receive spam, the user has to take an action (i.e. opt out) by unticking the box.

<comment><USER4>
        >>> "Using pre-populated opt-in boxes now means breaking
        >>> the law?"

        >> Yes. It does mean exactly that. You need my permission
        >> to send me unsolicited marketing emails.

        > ... how is a "pre-populated opt-in box" not exactly
        > the same as opt-out? In order not to receive spam,
        > the user has to take an action (i.e. opt out) by
        > unticking the box.

A "pre-populated opt-in box" is exactly the same as opt-out.

EU law requires _opt-in._ Having _opt-out_ is not lawful.

Thus having a pre-populated opt-in box is breaking the law.

 _Added in edit: I didn 't down-vote you. I have little doubt that others share your confusion, and hence your question adds value. In fact, I've now up-voted you._

<comment><USER5> I don't even think that claudius misunderstood. We're getting so used to beginning a sentence with "and" as an affectation that we're losing the ability to recognize it as a continuation.

<comment><USER3> Thank you :) I was after some reason why one could possibly think this to be opt-in rather than opt-out, but it appears that there truly is none.

</comment></comment></comment></comment></comment><comment><USER6> The irony of ironies - this is exactly what you see when you try to post a comment on that article:

[http://imgur.com/4w3uZzZ](http://imgur.com/4w3uZzZ)

</comment><comment><USER7> > John Lewis argued that because I had not opted-out of receiving their > emails, I had automatically opted-in.

I phoned a company which spammed me a few years ago. I had a long conversation with an annoying man in marketing who assured me it was all perfectly legal because they had an "unsubscribe" link in the email, and it _worked_! I pointed out that he also needed my consent to email me, but he was having none of it. I'm not sure if he was genuinely confused or conveniently misinterpreting the law. I hope this ruling helps to focus his and others' attention on what's legal rather than just expedient.

<comment><USER8> I had a bit of a fun exercise that I unfortunately didn't follow through on a while back. A computer parts retailer started sending me spam, so I replied along the lines of:

\---

Thankyou for contacting the xxxxx proofreading service. Thankyou for choosing this service, providing efficient and accurate proofreading services for all users of email advertising. To use this service, simply send emails to be proofread to xxx@xxx. Proofreading services will be charged at £200 per email, and payment is due within one month of receiving an invoice. By sending emails to be checked, you agree to the charges, and you agree that the primary point of contact for yourselves is the email address from which the emails originate. Results and invoices will be sent to this address, so make sure it is valid. Please do not send emails if you do not agree to these points.

Since you are a new customer, this first email is proofread below for free:

\---

Their email didn't mention that their sending email address would not receive, and British contract law has a presumption that communication that is sent is received, so when they followed up with ten or so subsequent spams, all of which I proofread, I probably would have had a fairly strong case in court to be paid for my work. Especially given one of their emails had "[pre-send]" in the subject line. It's kind of a shame I didn't take it any further than emailing invoices.

<comment><USER9> For a legally binding contract to be in place don't you need an offer and acceptance - and silence generally isn't consider acceptance?

<comment><USER8> That's the point - they weren't silent. They continued to send emails.

<comment><USER10> I'm really interested to know if that would stand up in court

<comment><USER11> Almost assuredly not. Where did they agree?

Just because I define a series of steps that constitutes them agreeing with the contract I design, it doesn't mean that following those steps means they agree.

Absurd example: if the New York Times continues to publish, they agree to pay me $1000 a day. (This example is missing consideration[1] but you can imagine that in yourself. It's an absurd example anyway.)

[1] [http://en.wikipedia.org/wiki/Consideration](http://en.wikipedia.org/wiki/Consideration)

<comment><USER12> Sure, I agree with you, the courts would most certainly not rule in favor of a judgement of £200 per e-mail, but I'm sure that's not the point.

They "consented to be billed for proofreading services" every bit as much as this person "consented to receive their spam marketing e-mails". In other words, not at any time or in any reasonable form that could have been construed as consenting or agreement.

I have no doubt the point of the joke was lost on the spammers/marketers, even if they even ever actually saw those terms and associated invoices.

<comment><USER11> If I want to make a comment on your website, and you have a form auto-checked that lets you send me spam, I have at least a choice, and it was something that, in your absence, I wouldn't automatically have a right to do.

Now the question arises: do I have a right to send things to your inbox? You certainly have created an interface with an API that I am obeying, but I've never liked treating APIs as legal constructs (although many of my fellow nerds wish it were so) so it doesn't necessarily follow.

There is one issue with lack of notification. I could say that anyone who goes on my property owes me $500,000 for the pleasure of being on my property. I could even send registered mail to every person on the country to inform them of this rule. I don't think walking on my property indicates agreement, because even if they read and internalized my mail they have no way of remembering.

I really don't know where I'm going with this.

<comment><USER12> It's really just posturing; hypothetically, going with your example you don't send those letters because you want or expect to get $500,000 from each uninvited guest, you send them because when you find the intruders on your property unauthorized you're going to be able to fire a round into the air and tell them "this is your second warning".

The goal is to get them to leave, or to never even come. Unless you were really trolling for $500,000. To part with that example, the law in question here specifically regarding inboxes requires opt-in, so only providing an interface to opt-out is directly against the law.

There is definitely no compatible land-owner analogy: if you greeted people at the border of your property and made them sign a declaration that they would pay you $500,000 for this temporary use of your property, you might have a case. They opted in.

I have a harder time imagining a judge who would see it your way when "you spent the $200 million required to reach every person and you said very clearly, 'your presence on my property constitutes acceptance of these terms,' so by law you should get the $500,000."

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Irony is that when you try to comment The Drum will ask for your email address - and then have a pre-ticked input box for their daily newsletter.

Edit: Was already pointed out elsewhere: [https://news.ycombinator.com/item?id=7839398](https://news.ycombinator.com/item?id=7839398)

</comment><comment><USER14> Sometimes you need to do a little bit of investigation of your own to see what the real story is and, with Sky News, that is definitely highly advised.

Turns out that the producer has a track record of trying to get 'damages' for this. Here is one incident starring the same Roddy character:

[http://www.marketingweek.co.uk/disciplines/direct- marketing/...](http://www.marketingweek.co.uk/disciplines/direct- marketing/opinion/adidass-world-cup-campaign-provides-a-lesson-in- consent/4010659.article)

You might not like it but the convention is to have the newsletter sign up box checked. It has been that way for almost two decades now. It is not as if this Roddy character is some blind 83 year old woman terrified by John Lewis newsletters, he specifically created an account on the John Lewis website to specifically get the newsletter specifically so he could take them to court and get damages.

It is actually relatively hard to sign up to the John Lewis newsletter, you need to create an account as they don't have a 'subscribe' box on their homepage. Furthermore, creating an account is something you would only do if you were making a purchase or specifically wanting to subscribe to their newsletter.

I think that the Roddy character is the scam artist here and I despise his ilk, not only has he sold his soul to work for the evil Murdoch empire he is also a troll.

<comment><USER11> It sounds like using the legal system as a regulation system. Instead of the government needing to go look into everyone's business, it lets recipients become regulators by giving them the ability to extract fines.

</comment></comment><comment><USER15> Pre-ticked boxes signing you into "interesting" marketing propaganda are the pits, no argument here.

But what is even worse is when (for example) you book a flight and the airline adds some totally useless "insurance" to your booking. Bangkok Airways comes to mind. This scheme is outright dirty, if not borderline fraudulent.

With some pre-ticked box hidden deeply in the form.

While I believe this to be illegal in Europe it's apparently not around the world.

The tactic is loathsome and still the amounts are relatively small, so that it's not worth it to complain to your credit card company. Plus: hey! you agreed to the crappy, useless insurance to begin with.

<comment><USER16> Here is how RyanAir do it - one hell of an anti-pattern:

[https://imgur.com/zh95qHq](https://imgur.com/zh95qHq)

</comment></comment><comment><USER17> I think companies which use weird double negative language by these options on forms aught to be penalised.

[ / ] uncheck this box if you don't not agree.

<comment><USER18> Or the ones that have two boxes, one positive and one negative:

        [x] Send me marketing emails
        [ ] Don't pass my email on to third party spammers

<comment><USER19> or the ones that do something like:

        [ ] Accept terms and conditions and send me marketing emails*
        *required

</comment></comment></comment><comment><USER20> I'm mostly surprised that this didn't count as an existing 'business relationship', which has always been enough in the UK to send marketing emails to someone. The guy registered with the John Lewis website, and the only reason to do so is to purchase something. An odd case in my opinion.

<comment><USER21> The article says:

 _unless it can be proven that the recipient consented to them or was a customer – with John Lewis unable to satisfy either requirement_

So it sounds like in this case he didn't actually purchase anything.

I've never been a big fan of the "existing business relationship" rule. It basically means I have to click an unsubscribe link once for every company I buy from.

<comment><USER8> When does an "existing business relationship" end? If I buy a £1 widget for auntieswidgetstore.co.uk, do they have an "existing business relationship" until the day I die?

In my books, once payment has been made, the goods received, and the sales contract completed, the business relationship is over. Comments? Anyone here a (British) lawyer?

<comment><USER22> IANAL but the ICO has a readable summary. They say you should be given a simple way to opt out in every communication:

from [http://ico.org.uk/concerns/marketing/11](http://ico.org.uk/concerns/marketing/11)

The law says that marketers are allowed to send marketing messages if:

the marketer has obtained your details through a sale or negotiations for a sale (this includes asking for a quote); the messages are about similar products or services offered by the sender; and you were given an opportunity to refuse the marketing when your details were collected and, if you did not refuse, you were given a simple way to opt out in every future communication.

<comment> jack-r-abbit To me it sounds like John Lewis met all of those conditions. I can see there might be some grey area in the first one. But I would argue that when the guy signed up on their site, he was at least taking the first step in negotiations for a sale. But it seems John Lewis argued that and lost so I guess I would lose too.

Edit to add: I do think that pre-checked opt-ins are a bit sleazy.

</comment></comment></comment></comment></comment><comment><USER23> Perhaps if companies and web-marketers could capture how disinclined I am to buy stuff from companies that spam me - then this would stop.

I guess they can't AB test that type of unseen negative. But you would think they might speculate based on their own experience?

<comment><USER24> > But you would think they might speculate based on their own experience?

Yes, but they speculate based on their own experience of what happens to their bottom line, not to what happens with their inbox.

And they find that there are few people like you and a whole bunch of people that _still_ respond to advertising, no matter how sleazy, un-sollicited, un- wanted and in general insulting. As long as that doesn't change spam is here to stay. Which probably means it is here to stay forever.

</comment></comment><comment><USER25> I am sick of companies that abuse consent. For example, one online retailer - from whom I have only ever made one purchase, which was returned, due to poor quality - regularly sends 3-8 emails a month.

Further, their unsubscribe form actually resulted in _another_ spam message.

It's almost a guarantee that when you buy a single item from a retailer, ensuring you uncheck/check properly all the boxes, you will be bombarded with promotional marketing emails from them forever.

<comment><USER26> This is why you set up a email address at your own domain, and give any company asking for your email <company.domain>@<your.domain>

(And possibly complain publicly when unsubscribe links don't work)

Some email providers ignore '+' signs and periods in email addresses, but more and more companies have gotten wise to that.

<comment><USER27> I've found an increasing number of sites use validation preventing the use of '+' in email addresses (which I used extensively when on Gmail). To get around this, I use a feature of Fastmail to give me something similar - <myname>@<company>.<my.domain>. By putting the unique part in the domain, it's less likely to be stopped by a fussy validator. Combine with some of their auto-filtering and I have an easy way to track who's abusing their ability to mail me, and to take action appropriately.

</comment></comment></comment><comment><USER28> These sorts of practices are despicable to say the least, and I'm glad to see the EU is actively fighting against them (or at least more so than most).

Oddly enough however, this gets attention while the same ideas applied in real life don't. The forceful behavior of advertisers and marketers everywhere seems to get little notice, despite people like Banksy, among others, trying to speak out [1].

Similarly, a friend and I went to the movies recently and noticed that while seat prices have gone up considerably over the years, you now also get a good fifteen minutes of adverts right before the movie starts. Why should I pay twice (actively and passively)? At no point before or during the purchase process was I told that I'd have adverts shoved down my throat.

I keep hoping that advertising is a necessary evil leading to the greater benefit, but one can dream... [2]

[1] [http://www.readingfrenzy.com/ledger/2012/03/taking_the_piss](http://www.readingfrenzy.com/ledger/2012/03/taking_the_piss)

[2] [https://news.ycombinator.com/item?id=6800312](https://news.ycombinator.com/item?id=6800312)

</comment><comment><USER10> Perhaps we could use a similar law for software that says you have to opt-in for that. If you try to install Adobe Reader on a Windows PC, for instance, you have to untick to install the Ask! toolbar. I don't like that

</comment><comment><USER29> I hate spam as much as the next guy, but this is more of a case of the plaintiff not reading before he clicks and agrees to things. We all do it, but we don't then sue a company for it. I really wish a ruling like this was made on a case in which there was no opt-in, but this guy (even by his IN-action of NOT un-ticking the box) opted in.

<comment><USER30> You don't understand what Opt In means. In any case, EU law is pretty clear on this.

</comment></comment><comment><USER31> You should always use double opt-in. There's really no reason to not use it. Your open rates and click throughs will be much higher and you will get far fewer people flagging it as spam.

</comment><comment><USER32> A project manager onced asked my team for an opt-in checkbox that, once checked, would disappear and never be shown again. Thankfully, we managed to talk him out of it.

</comment><comment><USER6> The one thing that concerns me about this ruling is:

"As Mansfield was unaware that he had been opted-in the court ruled in his favour however."

How on earth does one prove they were unaware that they were opted-in?

<comment><USER33> If it were a true opt-in without a pre-checked input as suggested then it becomes a moot point surely.

</comment></comment><comment><USER34> This is great news. Particularly as John Lewis has a supposedly trustworthy brand but in reality they're an importer and shit shoveler with an insane markup and abysmal service. So many problems with them over the years that I'd rather shop in Argos.

Corporate true colours shining through here.

<comment><USER35> On the other hand, John Lewis is employee-owned and regularly pays out at least one additional monthly paycheck in profits per year. I shop mostly in Waitrose (a subsidiary), and as long as their service is excellent and their food real (e.g. they had the least problems of all UK retailers (with the possible exception of Whole Foods) in the horse-meat scandal), I will gladly pay their higher-than-normal margins (though it's not much more expensive than Tesco).

<comment><USER34> The problem I have is that in the space of a year I've had to return and get refunded:

1\. A sofa that the frame broke on (their own brand one at £2600).

2\. Two pairs of own brand children's shoes which didn't even last a day without splitting or the lining coming out.

3\. A cot that cracked down one side.

As far as returns go, I was accused on the children's shoe returns of lying about them despite returning them the very next day after being worn for only an hour. The sofa died after a month and I had to go via the credit card company because I was told that they couldnt replace it and it was end of line so they were at a stalemate with their supplier. The cot, took three letters and a small claims summons to get them to replace.

Also one fine evening, I needed an SD card for my camera. JL being the only place open, I went in there. £55 for 2x no brand 8Gb SD cards. And they wouldn't price march maplin selling them for £28 round the corner which was overpriced.

Complaints about the above resulted in "we're sorry but there's nothing we can do".

As for Waitrose I rather like to not have my meat's throat cut and hung upside down to bleed out but they don't mark that up in there. They do in Morrisons. As for horse meat, that's what you get if you buy preprocessed foods. Just don't buy them.</comment></comment></comment>


A Quarter of Americans Have Never Eaten Vegetables - <AUTHOR> https://www.studyfinds.org/stunning-survey-reveals-1-in-4-adults-has-never-eaten-vegetables/ <comment><USER2> Article states:

 _" 91.4% of respondents enjoy eating corn. Potatoes came in an extremely close second at 91.2%, while carrots and tomatoes were tied for the third- most-liked vegetable at 89%."_

Article then states:

 _" One in four respondents say they've actually never eaten a vegetable at all!"_

So which is it?</comment>


Regional drink brands in India grow at twice the rate of Pepsi, Coca-Cola - <AUTHOR> https://economictimes.indiatimes.com/industry/cons-products/fmcg/regional-drink-brands-grew-at-twice-the-rate-of-pepsi-coca-cola/articleshow/74218961.cms <comment><AUTHOR> I really hope none of these upcoming brands sell out to Coca-Cola (or Pepsi) again like Thums Up and Limca did in 1992.</comment>


OPENAPS.ORG – #WeAreNotWaiting to reduce the burden of Type 1 diabetes - <AUTHOR> https://openaps.org/ <comment><AUTHOR> First heard about OpenAPS while listening to one of my favourite podcasts ("The Changelog").

[https://changelog.com/podcast/261](https://changelog.com/podcast/261)</comment>


Britain gave Palantir access to sensitive COVID-19 patient records in £1 deal - <AUTHOR> https://www.cnbc.com/2020/06/08/palantir-nhs-covid-19-data.html <comment><USER2> Headline could use some help, dang, it's really not representative of the full story:

"The contract, known as a data-sharing agreement, was published Friday by politics website OpenDemocracy and law firm Foxglove alongside similar contracts with Google, Microsoft, and U.K. AI start-up Faculty."

"The contracts show Palantir charged only £1 ($1.27) for use of its Foundry data management software while Google offered "technical, advisory and other support" for free."

This is about a lot more than just Palantir. And the NHS has been in hot water for handing out sensitive patient data to tech firms before. :/

<comment><USER3> > And the NHS has been in hot water for handing out sensitive patient data to > tech firms before.

Without the perspective of someone who works in the NHS with Palantir's software, it's impossible to say if the NHS and the public got a good deal.

<comment><USER4> No matter how usable and helpful the software is for the front line workers, the fact remains that Palantir has extensive access to the medical and according to the article also criminal history of everyone in the UK.

Who can promise that there are no side channels to the USA or no covert exfiltration using "backups" or "integration systems"?

<comment><USER5> Why would palantir risk their EU business by breaking the trust of the contract and move information to the US?

<comment><USER6> Because the NHS is about to be sold off as part of Brexit, and they can profit hugely from a slice of that action, while pretending they followed the rules until Brexit was completed.

<comment><USER7> I haven't seen any plans to privatize NHS as part of Brexit (and it's not clear why the two would be related, anyway).

<comment><USER8> The removal of EU legislation from British law and the UK-US trade deal. With the US demanding it's healthcare and pharma unfettered access to the NHS on terms equivalent to current US not UK standards. The UK is not, technically, slapping a FOR SALE sign on the NHS they've just put themselves in a position where pretty much anyone and everyone can demand a slice. Of course this assumes that the current gonverment doesn't view the NHS as an asset to be strip mined which I'm damn sure they do.

<comment><USER9> > With the US demanding it's healthcare and pharma unfettered access to the > NHS on terms equivalent to current US not UK standards.

They already have that. Read the Lansley reforms. They mostly don't take it up because they can't afford to run healthcare for the pittance paid by UK government, but there are large bits of the NHS run by non-NHS providers. See for example Priory Group or Cygnet Health Care.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> The data for use in model training is worth far more to Palantir. They can spin it as being nice and helping with COVID-19 but in reality Palantir couldn't buy this data even if they wanted to... so they got the U.K. government to give it to them! Clever.

<comment><USER11> Just wait a year or two and you'll find that somebody with influence on the decision gets a well paid cushy job in the private sector. Perhaps one of those 200K-per-appearance type jobs as a "senior advisor" for a bank.

</comment></comment><comment><USER12> Honestly borders to me on being de-facto undemocratic because I doubt a lot of British citizens are aware of this or that there has been any sort of meaningful consent given by patients to outsource their data to a foreign intelligence firm.

When it comes to how to solve this I really think we need to fundamentally rethink data ownership both on a legal as well at a technical level. I was recently reading up on Tim Berners-Lee's SOLID and I think something like that should be the default for all our data. We store our own healthcare data in something akin to a pod, when the NHS uses that data they get access to it granted by the patient in a way that puts formal limits on what they can do with it and how long they have access to it, and I as the patient have both the right and technical ability to revoke that access. We really need to push for data ownership and strong guarantees for data rather than this through the backdoor process of shoving private health data to unaccountable firms.

Maybe this is something where all these smart contract and decentralisation technologies can play a meaningful role rather than being primarily used for speculative currencies.

<comment><USER13> > in a way that puts formal limits on what they can do with it and how long > they have access to it, and I as the patient have both the right and > technical ability to revoke that access

If that's what SOLID is, its a scam and more of his DRM promotion. There is no technical way to "revoke my access." Unless you have a memory erasing implant in my brain, if the data gets onto my screen, I can copy it and access it forever. Period. Fuck Tim Berners-Lee.

<comment><USER14> Data use agreements often specify under what terms the data is held and destroyed. While people may still remember some data, the usual use case is large databases that can't be memorized. If someone revokes that data, that data would need to be removed from the database and all associated downstream copies. Failure to comply would open the door to legal penalties, which is the real stick.

Imagine for example, if the US or UK governments took corporate misuse of personal health data ([https://www.theverge.com/2019/6/27/18760935/google- medical-d...](https://www.theverge.com/2019/6/27/18760935/google-medical-data- lawsuit-university-of-chicago-2017-inappropriate-access)) as seriously as they currently takes video copyright violations by individuals....

</comment></comment></comment><comment><USER15> In English Law (and in many other jurisdictions) it's only a legal contract if "consideration" is given by both parties; i.e. Palantir here must charge something in return for it to be an enforceable contract.

<comment><USER16> The UK is still under EU law, as they haven't fully exited yet.

The citizens would still have to agree to allowing their personal data to be processed by third-parties and consent for their data to be processed outside the EU.

Is there any evidence that this consent was given?

<comment><USER17> The UK government may try to wiggle out of it by using the GDPR exemptions related to research and/or national security [https://gdpr- info.eu/art-23-gdpr/](https://gdpr-info.eu/art-23-gdpr/)

</comment></comment></comment><comment><USER18> The article text seems to indicate that Palantir was offering data analysis software/services to the British government for a nominal fee. It doesn't seem like NHS was selling the data, they just needed some services, and paying £1 was required to bind Palantir in a contract.

This title really seems like click-bait.

<comment><USER19> So the NHS wasn't selling the data to Palantir, just giving it away?

<comment><USER20> The £1 deal is is not relevenat because I am sure people will be annoyed despite it being a free deal or one that costs thousands of pounds. The only thing that matters is whether the data privacy was ensured.

<comment><USER21> The token amount is just there in the contract to notarize on paper the NHS as the 'client' in the contract, because you anticipate this will be questioned as a dodgy deal.

</comment></comment></comment></comment><comment><USER22> From my understanding Foundry (the Palantir product in question) is just a data management platform. I don't understand why this is so nefarious: they gave software they usually charge for to a public health agency for free.

<comment><USER23> The section on controversies is a primer. It certainly seems worth questioning the intent. [https://en.m.wikipedia.org/wiki/Palantir_Technologies](https://en.m.wikipedia.org/wiki/Palantir_Technologies)

<comment><USER22> Palantir already works with a a huge number government agencies is my point. They're basically a contracting firm. If they had charged the NHS at least a few hundred thousand pounds it wouldn't have been newsworthy.

</comment></comment></comment><comment><USER24> How is this any different from Amazon offering the NHS Amazon RDS licenses for free/£1?

Is the argument against this that the NHS not be allowed to use any cloud infrastructure, and that everything ought to be on-premise?

<comment><USER25> Rather than being some ostensibly neutral cloud, Palantir was/is CIA funded. So data straight into CIA/NSA/whomevers hands.

<comment><USER24> As far as I'm aware, Palantir is basically a SaaS data analytics provider for governments all over the world.

Why would any government consent to working with Palantir if they had any suspicion that their data might be used by US government clandestine agencies?

</comment></comment></comment><comment><USER26> Funny how no one wants to talk about the reason that the NHS is doing these deals.

Of all the competent devs / data analyst in the UK, how many do you think actually want to work at the NHS?

So lots of demand / need (healthcare is a mess in part because of data management via paper) and no supply / interest of talent.

<comment><USER27> I think many people talk about it but from a different context. The NHS is being de-funded by the same politicians whose friends benefit from these deals. Hard to hire competent people when your budget keeps getting cut.

<comment><USER28> £136.7 billion seems like a lot. It also seems like it's been exponentially going up since 1950.

<comment><USER29> "Exponential" is almost certainly a good approximation, as I expect it to match the product of wage inflation and population.

</comment></comment></comment></comment><comment><USER30> Disturbing. When you cannot even trust your own health-care system and government to even have the ambition to safeguard your sensitive data. What are citizens supposed to do? It's tragic how democracy have been so deeply undermined by private interests. This is not how it was supposed to work. Truly a disgrace.

</comment><comment><USER31> The UK is trusting an American national security-related firm with patient data, one that has to secretly accept any data access requests from the Americans. The UK should stick with their own companies for this sort of work - same for other countries

</comment><comment><USER32> Has Palantir had any type of positive headline associated with it, ever?

</comment><comment><USER20> I do not see in the contract uploaded that UK govt is sharing personal contact details as the article claims. Can someone see if this has actually happened or is CNBC exaggerating?

</comment><comment><USER33> Why are some pages scanned and some plain text?

<comment><USER34> Two documents pasted together?

</comment></comment><comment><USER35> Has anyone tried to do a GDPR request yet to either see what data they actually hold, or to test the right to erasure?

<comment><USER36> Actually good question, I would like to know how these requests are handled post Brexit. Do A.13 GDPR requests still have to be honoured by the UK up to the Brexit date forever?

<comment><USER37> GDPR is still in force until the end of the transition period (I think Dec 31). What will change after then, who knows? I don't think I've seen anything coherent on any front from the government at this point.

<comment><USER38> The Data Protection Act 2018 essentially copies the gdpr into UK law, tweaks the corners where allowed under gdpr and adds afew other things.

<comment><USER39> This is the case for many EU laws - depending on the area [0], laws agreed upon in Brussels don't actually mean anything on their own, but member countries are required to write them into their own law. After Brexit happens such laws will still apply, as they have been written into UK law.

[0] [https://ec.europa.eu/info/about-european-commission/what- eur...](https://ec.europa.eu/info/about-european-commission/what-european- commission-does/law/areas-eu-action_en)

</comment></comment></comment></comment></comment><comment><USER40> Pseudo-patronage, or charity-software, it's the new model being pushed by GAFAM (and Palantir) in order to access to digital public services markets in the EU. It's quite certainly illegal though - procurement regulations, etc., but nobody seems to care, especially not in the local software industry. No wonder the EU are so much behind when it comes to digital industry. They don't even try to fight.

</comment><comment><USER41> This makes me really f*cking angry.</comment>


Smart Luggage with built-in laptop tray, usb charger and location tracking - <AUTHOR> http://barracuda.co

<comment><USER2> WANT.</comment>


Ask HN: What do you listen to while coding/designing?  - <AUTHOR> After slipping on my Sennheiser HD598's and turning on some Venetian Snares on Spotify, I started to wonder: What are other developers out there listening to while they write some code?
1. Do you wear headphones/earbuds, if so, what kind? Sennheiser HD598 Open-Air Headphones
2. Do you use speakers, if so, what kind? When I don't have headphones on I use Klipsch Pro Media 2.1 speakers.
3. What genre(s) of music do you listen to? I listen to everything indie, electronic, classic rock, hip-hop. But I generally prefer instrumental music, or music with minimal lyrics.
4. Do you have a hacking playlist on Spotify? No. But maybe we should start a collaborative Hacker News playlist?! <comment><USER2> Am I the only one who finds almost all music distracting - I like to listen to it not ignore it. If I am going to concentrate I need to use all my brain cells (I only have a few left you see), so I listen to nothing.

<comment><USER3> I'm the same. I can listen whilst doing mundane tasks but anything where I actually have to think it's a big distraction.

That said, I dislike pure silence as well due to my tinnitus and general liking of some ambient noise.

</comment></comment><comment><USER4> Listen to mostly NPR podcasts on my razor headset, in specific I will listen to Freakanomics, This American Life, Radio Lab, Illusioniod, Tell Me More, Brian Leher Show, Planet Money, Stuff You Missed In History Class, NPR Science, TED Talks, and when I go through all of that I will listen to some music (Local Natives, Mumford and Sons, Parlor Mob, The Killers, Edward Sharpe..., She and Him, Of Monsters and Men, Catch 22) There are more things I listen to but I cant think of right now. I am relatively productive with most things I listen to except for Illusioniod.

<comment><USER5> How in the world do you listen to NPR and code at the same time?

<comment><USER4> Easily, 50% of the coding I do mindless website building which really doesn't need my full attention. The rest of the time I tune it out and end up listening to it again later.

</comment></comment></comment><comment><USER6> Putting myself in a convenient environment is crucial for my productivity. I have two places, one in work, one at home that are dedicated for working purposes. Within this environment I always listen to www.trance.fm, lyrics would distract me. It's a never ending stream so I don't have to care about selecting tracks. I don't care about headphones, as long as they aren't uncomfortable to wear.

<comment><AUTHOR> Environment is huge for me too, but when I can't control it as I would like, a good pair of earbuds helps to block everything out. Lyrics distract me at times too.

</comment></comment><comment><USER7> I listen to a variety of music--from Gesualdo to Wendy Carlos to Mike Oldfield. I gained a fan for The Bobs when I was at work looking at a code generator late one night, thinking myself alone, on headphones listening to their "My Shoes" and singing the bass line along with Richard Bob full force. "What are you listening to?!" I explained, and before long poof! A new FOB!

</comment><comment><USER8> I like listening to the instrumental versions of my favorite bands. If you use spotify, just type in "Pink floyd instrumental" for example.

Singing distracts me, but the instrumental is perfect because it's like riding a bike, my mind doesn't have to concentrate on the song, it already knows it, and the music actually helps me think.

</comment><comment><USER9> 1\. Yes, I use headphones. Currently Sennheisser HD 555.

2\. I have Harman Kardon SoundSticks III 2.1 Channel Sound System. I use them when watching a movie or when I'm alone at home.

3\. All kind of metal. Mostly progressive, technical death metal, deathcore, etc. Then classical, ambient, trip and a lot of Soundtracks…

4\. I do but I rarely use Spotify.

</comment><comment><USER10> 1\. I wear my ATH-M50s. They work for my needs.

2\. No speakers for me.

3\. I like listening to glitch hop and instrumental rock.

4\. I have a collaborative one at [http://open.spotify.com/user/zachlatta/playlist/4KuyJRu62zSh...](http://open.spotify.com/user/zachlatta/playlist/4KuyJRu62zShGTaKpCos38). Feel free to contribute!

</comment><comment><USER11> I usually just put a Michael Nyman playlist on and turn my headphones up to a level where I can't hear anything over than an explosion.

Personally works for me.

But, ideally anything I can listen to for a couple of hours without feeling the urge to skip songs or sing along to. Instrumentals only.

</comment><comment><USER12> It depends on the concentration level a user story needs to get and my mood to get it done.

      Light: Beatles, Bob Marley, CB, Lemon Jelly, Rush, etc.
      Medium: Bonobo, Dave Brubeck, Ludovico Einaudi, Bach, Vivaldi, etc.
      High: rainymood.com or silence

</comment><comment><USER13> KEXP.org, OCRemix / Rainwave.cc.

When at home and working on side projects or things that don't need much concentration I put on a podcast or Netflix. I like the background noise.

</comment><comment><AUTHOR> Have any of you ever been to: <http://coding.fm/> ? I don't think I could listen to that for very long at all.

</comment><comment><AUTHOR> I've been listening to a lot of Sigur Ros lately too. Although it has lyrics, I can't understand them and the music seems more instrumental.

</comment><comment> daniel-cussen Pop, trance, electronica, club/dance music. Half of the music I listen to is garbage, but I listen to it for the beats.

</comment><comment><USER14> Songza is awesome. I listen to the 'saving the world from evil' and 'epic study music' playlists. They're really great.

<comment><AUTHOR> I've used Songza before, its pretty sweet. I think I even found a coding playlist on it?

</comment></comment><comment><USER15> I put on Netflix on the background (iPod). Play tv series. Currently watching Top Gear and The Wonder Years.

<comment><AUTHOR> I like to put on Netflix on my iPad, but only if I'm doing something that doesn't take too much thinking.

</comment></comment><comment><USER16> Normally I do not listen to music, because then it is harder to concentrate on the actual task.

</comment><comment><USER17> <http://musicforprogramming.net/>

<comment><AUTHOR> Thanks! I'm surprised I hadn't heard of that.

</comment></comment><comment><USER18> 1\. Some California Headphones (Laredos) 3\. Electronic, Hip Hop, Metal

At the moment - Macklemore's Album

</comment><comment><USER19> streamingsoundtracks.com, although it has deteriorated somewhat over the years. It used to be exclusively instrumental tracks from popular movies, but now there are more vocal and video game tracks than I care for.

</comment><comment><USER20> kat.ph has a guy called Gandalf, german composer, instrumental easy listening, really good for coding with.

</comment><comment><USER21> Apple speakers and stream trance music.

</comment><comment><USER22> Open up groveshark, play "my station"

</comment><comment><USER23> game tunes from rainwave.cc

</comment><comment><USER24> soma.fm</comment>