From a Ruby monolith to microservices in Go - <AUTHOR> https://sourcegraph.com/blog/live/gopherconindia/112656568167 <comment><USER2> Rewriting a monolithic platform as a set of microservices will almost always result in improvements from every perspective. You're replacing legacy code with new, cruft-free code; you're de-coupling parts of the system; you're building a more scalable design.

For example, if you're in the situation where you've gone from 12GB to 5MB of memory consumption, then you have a design issue and not a language one. That's not Ruby's fault.

We are also in the process of converting several monoliths into a microservice-driven system, but we are doing so with Ruby. It remains great language to use for building web apps, and I suspect some of the push back against it is caused by a dislike of the cliché giant Rails monolith that we've all come across, with hundreds of gem dependencies and so on. Rubby and Rails have a habit of encouraging such bad designs primarily through ease of use, but it's hard to see that as a problem with Ruby.

Go is a good tool for doing the same, and single-binary deployment is pretty magic. I'm sure it'll be supported for ages, so if you want to re-tool to use that then go for it! But Ruby's a viable option too, and it's important not to place blame for bad app design in the wrong place.

<comment><USER3> I feel uncomfortable when reading your post. Passive aggressive, attacking the OP's architectural decisions, assuming that he didn't have any clue building a proper Ruby system. I am not a fan of Go, not at all, but I know that Ruby has significant issues which the OP also outlined quite well and you seem to just ignore them.

But Paul Graham knows exactly why you are sticking to the past (just replace 'Blub' by 'Ruby'):

 _As long as our hypothetical Blub programmer is looking down the power continuum, he knows he 's looking down. Languages less powerful than Blub are obviously less powerful, because they're missing some feature he's used to. But when our hypothetical Blub programmer looks in the other direction, up the power continuum, he doesn't realize he's looking up. What he sees are merely weird languages. He probably considers them about equivalent in power to Blub, but with all this other hairy stuff thrown in as well. Blub is good enough for him, because he thinks in Blub.

When we switch to the point of view of a programmer using any of the languages higher up the power continuum, however, we find that he in turn looks down upon Blub. How can you get anything done in Blub? It doesn't even have y.

By induction, the only programmers in a position to see all the differences in power between the various languages are those who understand the most powerful one. (This is probably what Eric Raymond meant about Lisp making you a better programmer.) You can't trust the opinions of the others, because of the Blub paradox: they're satisfied with whatever language they happen to use, because it dictates the way they think about programs._

Source: [http://www.paulgraham.com/avg.html](http://www.paulgraham.com/avg.html)

<comment><USER2> I certainly didn't intend to be passive aggressive or attack, apologies if it came over like that.

The point remains though; it's not that the poster doesn't know how to build a 'proper' system in Ruby, but that the frequent articles we see with the theme "we rewrote our system from language X to language Y and it's much better!" are rarely helpful, because (I can't stress this enough) _architectural design is vastly more important than what language you are using to implement your system_.

This leads to a dangerous bandwagon-jumping faddism where developers start jumping on to the next big thing, because they assume it will solve their problems. We saw exactly that with Ruby, for example; developers assumed that they could escape from the verbosity and enterpriseness of Java just by changing language, ignoring the pitfalls that could be experienced.

PG's 'blub' example is a very useful allegory, but it doesn't apply here. I'm not at all suggesting that Ruby is the perfect solution to all problems, or that using Go is wrong – I use both of them! Just that saying 'Go is better than Ruby for writing web apps because we reimplemented everything and it was faster' is not helpful.

<comment><USER4> this is a very good point. and this:

 _We saw exactly that with Ruby, for example; developers assumed that they could escape from the verbosity and enterpriseness of Java just by changing language, ignoring the pitfalls that could be experienced._

this _worked_ for a lot of people until they got to the architectural stuff. but going from Java to Ruby (infinitely nicer) is distinct from going to J2EE to Rails (easier to get started, harder to keep going).

</comment></comment></comment></comment><comment><USER5> Many folks in this thread are expressing that it's the OP's fault and not Ruby's.

The OP made his post as objective as possible, politely written and nobody is loosing his face, neither Ruby as a language nor the Ruby community. But people are still resentful and fire back.

I believe it's not a discussion about Ruby anymore, its strengths, its weaknesses and wether Ruby still fits in 2015—no it's the fear of people that their core competence might be less worth in future. That all the time and energy they invested all the years into one language might be not a good investment anymore. The fear that better tech will replace their tech and that they have to start at zero again.

I know I am going to be heavily downvoted for this post. Before you downvote just think a second again why you'll downvote me.

<comment><USER2> I don't think that's a reasonable view.

The point is that articles about rebuilding entire systems in different languages conflate two things — an architecture change, and a language changes.

This often results in the sort of appraisal you see here – 'Go is better for us than Ruby, because we completely rebuilt a system and it's now better'. That's got some value, but it's frustrating to see it used as something of an absolute metric regarding the suitability of a language when it's conflated by the _far more important_ architectural changes.

So I think your view that there are a bunch of developers who are afraid of the future is a little shallow; rather I suspect there are a bunch of developers who saw exactly the same sort of thing happen when Ruby was becoming popular, and realise that extracting helpful data when there's an ongoing fad ('we're jumping from X to Go') is rather difficult.

<comment><USER6> But a change of language might bring you more tools, for example to handle thread-pools or process pools (service worker pools). Some of these things might be much easier to do in Go (or Java or C#) than in Ruby and if that part was a reason the new version works better the language change did help. I am no saying it was impossible to improve performance with Ruby but they might believe it was easier with Go. I still think a monolith app can be more performant than micro services in a lot of situations but you might have to use things like thread pools/channels.

</comment></comment></comment><comment><USER7> Ruby is the new Java everyone is bashing. Go is the new Ruby everyone is hyping.

If you replace every mention of Ruby with Java, and every mention of Go with Ruby in the comments on HN, then you've invented a time machine to go back 10 years.

And if you do this with C, welcome to 1995.

<comment><USER8> We are a fad driven industry.

They could have rewrote it in java in a similar amount of time, and with the same results. And they could hire from the large pool of expert java devs. Of course that's not "cool".

<comment><USER9> It would not have solved the deployment issue. It is very nice to only have to deal with dependencies once, when building (when using go). In java, you have to deal with both build time and run time dependencies. It's really nice not having to lug around and package up a jvm, jars, ...

Each java based microservice requires its own packaging of jvm, jars, etc. Without this it is not easy to replace individual microservices, as the cross dependencies between the microservices will take away a big advantage of going that route.

Go provides this level of deployment separation for free by default.

</comment></comment></comment><comment><USER10> So many wrongs and confounding variables that I don't even know where to begin but I'll try anyway.

1) Ruby is a complex language: Ruby is quite simple. Everything is an object, every method call is a message send that follows the exact same protocol of dispatch. Also, completely irrelevant to the main thrust of the article.

2) Memory consumption and speed: Can't really refute anything since by their own admission they were running a monolithic system.

3) Concurrency: Plenty of options. I like celluloid personally and if you switch to JRuby then you can do all sorts of other stuff as well with automatically managed thread pools.

4) Backcompat: Ruby is not an enterprise ecosystem. Some people call that speed and agility. In their case they really should have gone with Java since they are basically serving an enterprise customer. This is not a knock on Java. I think the language and its ecosystem is by design made for stuff like this.

5) PDF generation: I'm guessing the Ruby code was calling some C library to do the rendering and they swapped out all of it for Go. I don't know what library Go is using to render PDFs if it is the same library then there is something interesting happening here. If it is a different library then they are comparing apples and oranges and there's nothing to see here.

6) Alert service: Completely bound by I/O so doesn't matter what language you use. Bad design for keeping many processes around because you only need to spin them up during spikey times which can be easily handled with better engineering. Also eventmachine and celluloid for the worker internals would have been another option so again they didn't do their research.

7) Gradebook service: No idea again. Thin on details so nothing to refute really.

8) Deployment: Sure. Why not. Single binary is easier or JRuby and a single jar which is just as easy.

In conclusion, they re-wrote everything and I'm sure removed a lot of cruft in the process and called it a victory for Go. In a year or so they're going to run into similar issues and Go is not going to save them because from what I read all I saw was bad engineers blaming their tools.

<comment><USER11> This comment is more aggressive than comments should be on HN.

I would exercise a bit of humility when commenting about other people's architectural decisions: they have bled all over that codebase and infrastructure, but I have not. They see it in their dreams, and I do not. They may from time to time decide to tell the community about their adventures. That is an excellent opportunity for me to learn from another engineering team's perspective and experiences, rather than an opportunity for me to demonstrate my intellectual superiority over them. They do not, as a function of having written about their experiences, owe me responses to my off-the-cuff analysis of their engineering tradeoffs.

<comment><USER10> In that case it's excellent story telling and nothing more. We're an engineering discipline and use case studies in engineering disciplines are measured by different standards, humility and hubris aside. You can bleed and dream about your architecture all you want but as a community we should be more analytical than that and not fall into the all the usual mental traps just because we bled for some engineering decisions. Teasing apart confounding variables and showing pros and cons of the various approaches and adding a bit more detail about the actual libraries would have made this a much better post. If he had provided all those details then some of us could have double checked the numbers with some benchmarks and learned from it but that opportunity was squandered.

Once again, I'm not aggressive but I am critical. nexneo has since addressed all the issues people have brought up and if he'd done that initially then I would have been much less critical.

</comment></comment></comment><comment><USER12> Every time I read something like that, I get the feeling that "Monolith to Microservices" is the pattern and the language doesn't matter.

At the beginning, a Monolith has huge advantages: easy to deploy, all in one place, smaller operational overhead, easier to manage with unclear requirements.

Later, it's easier to find out what you can split out and you can learn how to route and manage things piece by piece.

<comment><AUTHOR> You exactly captured my sentiment, when I started doing this I don't realized all benefits. Because of Go's simplicity in deploying and maintaining, many small apps doesn't add much overhead. Now you can scale individual component.

Only risk is, you break things into many component then you should so balance is required.

<comment><USER12> As I said below, if you tread off the full-stack-track, you get a lot of the go-like things in Ruby as well.

My point being: I usually rate architectural changes as more important as a change in development details (and the programming language might be a big one there, but it still is one, IMHO).

I'll tell you why: a lot of the sentiments people bring when they now switch from Ruby to Go, I've heard before. When people started Ruby - I was already doing Ruby for ~2 years before Rails even came out at it got me into the position of saying: "just you wait until you see the bad parts". They attributed a lot of things to Ruby, while they were really changing their development model.

</comment></comment></comment><comment><USER13> _After refactoring the alert feature into a Go microservice, they've seen the following improvements

The same number of workers (that required 12 GB in Ruby) now requires just 5 MB of memory._

Not that I don't approve of pro-Go articles, but doesn't this maybe indicate that something was wrong or inefficient in the Ruby implementation?

<comment><USER12> We did some measurements with Padrino applications in the wild and found that all of them could be improved a lot in relatively simple ways. E.g. by not loading multiple JSON parsers. Padrino being a rather slim framework on top of Sinatra, that often meant getting below 80mb memory usage (on a full stack!).

Our takeway was that the (Rails) monolith model tends to put a lot of things into one process space. Controlling library loads can be a chore.

<comment><AUTHOR> Exactly, Ruby app was monolith so it was consuming much more then this single feature would require. Now there is double benefit Go already uses lot less memory and its microservice. Plus with Ruby we have to run multiple processes so whatever memory single process consume * # of workers.

I could have rebuilt in Ruby and that was my first thought but deploying and maintaining Ruby apps are lot harder then you can imagine. I didn't like idea of maintaining lots of small ruby apps. Once you deploy single Go application, you might not want to deploy another Ruby app.

<comment><USER14> _Plus with Ruby we have to run multiple processes so whatever memory single process consume times # of workers._

I don't use the Ruby stack, but if forking happens after loading libraries, this is not true, since most UNIXes (such as Linux) use COW memory pages when forking. So, it may appear that you use N times the memory of a single process, but most of their memory pages are shared.

See _fork(2)_.

<comment><USER12> Yes, but garbage-collected languages with embedded markers (which Ruby used for a long time) are not at all COW-friendly (because GC runs touch the pages).

Only in recent Ruby versions is that not a problem (and was changed for exactly that reason).

But yes, your memory report might be read wrong.

</comment></comment></comment></comment></comment><comment><USER15> Over the last few years, I've tried implementing a few things like this in Go, but the problem I keep running into is the tooling. It'd be awesome to know which modules they used for things like URL routing and application structure. There seems to be a lot of options with no clear winners.

Rails is opinionated, yes, but I'm generally pretty satisfied with their opinions, and it's nice to have a full Batteries-included package.

<comment><AUTHOR> Initially I used [https://revel.github.io](https://revel.github.io) because I wanted to use many inbuilt things and hot reload.

Later I started use just standard library with [http://www.gorillatoolkit.org](http://www.gorillatoolkit.org) and used fswatch for hot reload. Now there are lot of alternative in routers but no clear winner.(and thats good thing) I will suggest go with standard library and simple router but be ready to revert back to framework like revel if that doesn't workout.

</comment></comment><comment><USER16> From the looks of it I assume they are using HTTP/1.x as the communication protocol. I've always wondered why most use HTTP for micro-services instead of JSON-RPC (or any other encoding) over a TCP/IP socket. What are the benefits?

<comment><USER17> Simplicity.

<comment><USER18> json-rpc is pretty simple, and if the app uses json in the http bodies anyway, json-rpc eliminates separate http protocol (header) handling.

Does json-rpc have a standardized crypto wrapper, though? That seems like the most important reason to use https. Although json-rpc + nacl/sodium might be better in theory...

<comment><USER19> This makes the assumption that their bottleneck is the overhead of HTTP. This assumption is common on HN, but (in my experience) is a rare problem to have for most companies.

It looks like they do a good job of tackling performance problems as they see them, even at the architectural level. My guess is they didn't tackle this because it wasn't a problem worth prioritizing compared to the compounded shitshow of a monolithic Rails app.

</comment></comment></comment></comment><comment><USER20> So a monolith application gets ported to microservices from an interpreter based version of Ruby to a compiled version of Go and the author is surprised about the gains.

Why do people keep getting amazed about the performance they get when using native code in their applications instead of a naive interpreter?

Not bashing Go, the title could be "From a Ruby monolith to microservices in <pick your language with native compiler available>".

Hey, this could probably even be possible in Ruby, if something like RubyMotion was generally available.

<comment><AUTHOR> Exactly right any language could have worked, and we didn't replaced Ruby, just few part of our big application is rewritten.

I did in Go not because of language is better, ecosystem and culture is better but not language part. I will suggest you to do small real life project in Go.

<comment><USER20> I wasn't hitting at Go, just making the point any language that native code compilers will do.

Thanks for the suggestion, maybe you should check my history.

<comment><AUTHOR> Sure. I did :) One question: Why you mentioned RubyMotion as alternative for server application?

<comment><USER20> Sadly it is not an alternative, because they only sell it for mobile apps.

RubyMotion as an AOT compiler would bring many of the same benefits in terms of performance, while staying in Ruby.

Apparently only Lisp, Scheme and Dylan enjoy the existence of AOT compilers in their toolchains.

</comment></comment></comment></comment></comment><comment><USER21> Would someone care the elaborate on the following?: "They use nginx to route requests to either the microservices or the main Ruby app... The Go microservices treat the Ruby application as an API client or upstream proxy, which allows authentication to be simple."

What I read this to mean is that the Ruby app accesses the microservices over HTTP with some kind of token-based authentication. This would make sense if there some form of shared session store which each microservice could validate the token against. What I'm confused about is how nginx fits into this? Is it routing requests directly from the client to microservices? Or is it a proxy layer in between the Ruby app server and the microservices which allows the Ruby app to forward auth-token information? In the former scenario, would the Ruby app server be pinging the same nginx instance that forwards it requests in the first place?

<comment><AUTHOR> I agree that line bit confusing, Ruby app doesn't connect with Go service directly, every requests goes through balancer and then nginx router. Nginx routes then using simple location directive. Authentication is not shared, its either token based or Go service act as proxy and send request to Ruby app and modify response received from Ruby app before sending to client(i.e covering html to pdf)

</comment></comment><comment><USER22> I'm trying to decompose a Ruby monolith into microservices, but is it necessary to change languages? For my use case, I'm less concerned with languages than I am with libraries (AWS library, Sidekiq, Devise, deployment toolchains, etc).

<comment> grey-area Of course it's not necessary to change language, but one nice thing about microservices is they don't have to be the same language.

You might see significant advantages moving to ruby microservices if you have high traffic and a complex monolithic app which would benefit from being split up. They are not a panacea of course as they introduce significant complexity, whatever language they are implemented in - it's a matter of trade-offs and once your monolith reaches a certain size it might be worth splitting it up.

Re libraries, most of the ones you mention have analogues in go or are pretty simple to replace, save AWS, which is apparently coming soon:

AWS - [https://aws.amazon.com/blogs/aws/coming-soon-aws-sdk-for- go/](https://aws.amazon.com/blogs/aws/coming-soon-aws-sdk-for-go/)

Sidekiq - go myFunc()

Devise - bcrypt.CompareHashAndPassword + the mailer functions

Deployment - Rsync or Ansible - this is simpler in go as all you require are your executable + templates

</comment></comment><comment><USER7> As they say: "Your new boy/girlfriend is better because you are better."

</comment><comment><USER23> Going from 12GB to 5MB of memory consumption could probably have been achieved through moving the alerting components to a dedicated Ruby (non-Rails) / Linux script configured to read their queue.

Time taken: 1-2 days.

Their high memory consumption was caused by large numbers of unneeded dependencies (e.g. Rails) included in their alerting components. By refactoring so drastically into a separate Go service, they may have squandered tens of thousands of dollars of company/investor money in retooling, retraining and learning a new environment. Good for the programmers, toxic for the company.

</comment><comment><USER24> Ruby enthusiasts seem to get apoplectic at any mention of a posting where someone chooses another language over Ruby. I'm sure Ruby is just great at what it does, but aren't we always talking about the right tool for the job?

I don't think anyone disagrees that refactoring and evolving the code would have resulted in gains even if they stayed in Ruby. I'm sure most of us would even agree that if you wrote something, then immediately scrapped it and started over, you might already be able to improve on your original based on some new knowledge you've gained from the experience.

When a company does this, they not only learn new things about the language they are converting to, but they are gaining new and valuable insight into the language they already have used. Posts like this are valuable to all of us because they are sharing their experiences; whether you agree with their choices or not.

</comment><comment><USER7> If you move from Ruby to Go and this works better for you, then choosing Ruby in the first place might - if it was not about a prototype or getting VC money or only found Ruby developers - be a failure on your part.

<comment><USER25> Ruby got them customers within the bounds of their time and money budget so it did its job. Nothing in the post suggests they have regrets about it but it would be interesting to hear from them.

<comment><USER7> When Ruby can't solve your business problems -> wrong choice. If it can solve your business problems -> wrong choice to move to Go.

<comment><USER7> Yes, couldn't read find that in the article beside "monolitic baeh"

</comment></comment></comment></comment><comment><USER7> Companies that invest in rewriting everything from Ruby into Go instead of working on the business model seem to have a lot of money and a secure future and no competition.</comment>


The Man Who Became Big Bird - <AUTHOR> http://blog.longreads.com/2015/05/06/the-man-who-became-big-bird/

<comment><USER2> Mr Spinney did a Reddit AMA yesterday too: [https://www.reddit.com/r/IAmA/comments/356sal/hi_reddit_im_c...](https://www.reddit.com/r/IAmA/comments/356sal/hi_reddit_im_caroll_spinney_the_puppeteer_who_has/)

The top question/reply in that thread (I doubt it will be replaced, but it's the reply that starts "This is a very sad story, but it's real.") has made me randomly tear up every so often for the past day.

</comment><comment><USER3> Apparently [http://muppet.wikia.com/wiki/Big_Bird#Trivia](http://muppet.wikia.com/wiki/Big_Bird#Trivia) the Big Bird costume was originally going to be even harder to operate: Jim Henson's original plan was to have the actor facing the opposite direction to Big Bird, so that the legs would look more realistically birdlike.

</comment><comment><USER4> As a child I loved to see Big Bird and Snuffleupagus engaging each other over some very basic point.

<comment><USER5> [https://twitter.com/MrSnuffleupagus](https://twitter.com/MrSnuffleupagus), and check out who follows him, and vice versa.</comment></comment>


Ross Ulbricht Convicted of Running Silk Road as Dread Pirate Roberts - <AUTHOR> http://www.bloomberg.com/news/articles/2015-02-04/ross-ulbricht-convicted-of-running-silk-road-as-dread-pirate <comment><USER2> This is a good explanation of how the defense totally screwed up:

[http://arstechnica.com/tech-policy/2015/02/op-ed-ross- ulbric...](http://arstechnica.com/tech-policy/2015/02/op-ed-ross-ulbricht-got- a-fair-trial-but-not-a-fair-investigation/)

Basically, the evidence was massively damning, so their only serious hope of winning was by challenging the curiously nonspecific way the FBI found the Silk Road server; but they gave up their ability to do so for some dubious benefits.

<comment><USER3> The problem with the article is that it calls the finding of the server "blatantly illegal", when that hasn't come to trial.

The government says [https://ia600603.us.archive.org/21/items/gov.uscourts.nysd.4...](https://ia600603.us.archive.org/21/items/gov.uscourts.nysd.422824/gov.uscourts.nysd.422824.75.0.pdf)

>In any event, even if the FBI had somehow "hacked" into the SR Server in order to identify its IP address, such an investigative measure would not have run afoul of the Fourth Amendment. Because the SR Server was located outside the United States, the Fourth Amendment would not have required a warrant to search the server, whether for its IP address or otherwise. See United States v. Vilar, 729 F.3d 62, 86 (2d Cir. 2013) (Fourth Amendment warrant requirement does not apply extraterritorially); In re Terrorist Bombings of U.S. Embassies in East Africa, 552 F.3d 157, 167 (2d Cir. 2008) (same). At most, any search of the SR Server needed only to be "reasonable" – that is, justified by "legitimate governmental interests." Vilar, 729 F.3d at 86. Given that the SR Server was hosting a blatantly criminal website, it would have been reasonable for the FBI to "hack" into it in order to search it, as any such "hack" would simply have constituted a search of foreign property known to contain criminal evidence, for which a warrant was not necessary.

which seems reasonable.

<comment><USER4> I'd like to refer this back to a response I gave before - [https://news.ycombinator.com/item?id=8441139](https://news.ycombinator.com/item?id=8441139).

Basically USA claimed to be using the CoE Convention on Cybercrime in order to have the server raid performed. But that convention requires that USA's government bodies extend the same legal protections to those in other countries as if they were USA citizens within their own jurisdiction (and the other country has to provide the safeguards of their own law too). That is, if the Fourth protects Ulbricht if he was in USA then the same protections must be applied.

This is very sensible. It means that parties can't go off on hunting expeditions and treat the citizens/subjects of other countries in the [convention's] union worse than they treat their own citizens.

Now the testimony I linked to in that prior post at once claimed that the CoE Convention was being used and claimed they weren't certain. To me that strongly suggests the USA government agent(s) was attempting to deceive whilst under oath, perhaps not strictly lying but certainly not being helpfully informative - perhaps they realised after the fact that they'd failed to abide by the convention and so claimed it was maybe "comity" in order to have a get out clause when the issue of safeguards was raised?

> ">In any event, even if the FBI had somehow "hacked" into the SR Server" //

So, such an unauthorised intrusion may not have run afoul of the Fourth, perhaps, but it would either have broken the domestic law or breached obligations under international conventions depending on if they sort permissions from Sweden first or not. [and possibly neither if they established a protocol that bypassed international agreement].

From where I'm viewing it seems USA don't really care about the application of the rule of law neither in USA nor in other countries when it comes to USA government agents.

<comment><USER5> Iceland.

I think you may be reading too much into the treaty. It isn't clear to me that it demands countries extend all domestic protections (but I have not read it terribly closely). I see where it says the laws they pass to comply with the treaty should provide protections.

Beyond that, I don't think it obligates the US and Iceland to cooperate solely under that framework, what it does is create a situation where if the US comes to Iceland with a proper warrant, Iceland is obligated to comply with that warrant. If the FBI just wants to send the police in Iceland a tip and Iceland does something based on that tip, well, that's that.

<comment><USER4> [Thanks, I should have checked!]

> _I don 't think it obligates the US and Iceland to cooperate solely under > that framework_ //

Yes, agreed. But the statement by the FBI [cf previous Scribd link] claimed they used the Convention to acquire cooperation.

>"Although the Complaint and search warrants in this case refer to the request as a "Mutual Legal Assistance Treaty request," this description is not technically correct, as the United States does not have an MLAT with Iceland. The request was instead an official request to Iceland issued pursuant to the 2001 Council of Europe Convention on Cybercrime and other relevant law of Iceland, and as a matter of comity."

That statement is sketchy as anything ("we said it was MLAT but it wasn't"): it absolutely _looks_ like they concocted the rationale allowing the search after the fact and without due process.

I'm not sure if the treaty has anything about bypassing its terms either.

<comment><USER5> _The request was instead an official request to Iceland issued pursuant to the 2001 Council of Europe Convention on Cybercrime and other relevant law of Iceland, and as a matter of comity. "_ isn't sketchy. It's 3 reasons Iceland would cooperate with a request from the US.

I really have no idea if the MLAT error would matter or not, but if the lawyer writing the brief is aware of the mistakes in the previous documents, it'd be way sketchier to not mention it.

<comment><USER4> The initial claim is they used MLAT. But then the FBI claimed they didn't, because they don't have an MLAT treaty in place - doesn't that seem a little, um, unprofessional at least not to even know the legal status of their own request. When they documented the phone call to the officials in Iceland what did they write down, what did they say was the legal basis for the investigation? It sure looks like they didn't have a basis at that point beyond need for the investigation.

It doesn't look like a mistake beyond the "we got caught in a lie" type of mistake.

For avoidance of doubt I don't personally think that this should invalidate the evidence gained. To me the truth is important. However, the officials involved if proven to be acting without legal rationale and without attention to due process and the rule of law should be heavily punished. Indeed if my reading of the CoE Convention is correct then an official apology would be due to Iceland for breaching the terms of the Convention as well.

<comment><USER5> _When they documented the phone call to the officials in Iceland what did they write down, what did they say was the legal basis for the investigation? It sure looks like they didn 't have a basis at that point beyond need for the investigation._

I'm not sure what you are getting at here. I imagine the call went something like:

US: "We think we've found [blah blah blah]. We'd like you to seize the server."

Iceland: "Eh, OK, sounds good."

Then, if the statements that RMP followed Icelandic law are not a fabrication, they would have continued on until the RMP felt they had sufficient information to get their warrant or whatever.

I don't think the Icelandic government or police would have treated the FBI as an adversary.

<comment><USER4> You don't think Iceland wants to know why, or ensure that the action is lawful? Ordinarily speaking a democratic state doesn't have blanket powers to do as it pleases - the Icelandic authorities are bound by their own and EU laws, and other treaties.

I'm not suggesting they'd treat a request adversarially, I'm suggesting that they'd need to get evidence to apply to a court for a warrant (or whatever the local procedures are) under local laws or they'd need to ensure the operation met the requirements if the request was under CoE Convention say.

Perhaps I have too high an opinion of law enforcement agencies and the idea[l] of rule of law is just a charade?

Iceland are signatories to the ECHR for example which extends property and privacy rights.

<comment><USER5> It doesn't make sense to assume that the RMP (police in Iceland) failed to follow Icelandic law. Especially when the memorandum you linked says they followed local law and applied for a warrant (or so).

 _Subsequently, after obtaining the legal process required under Icelandic law to search the server, and after consulting with U.S. authorities concerning the timing of the search, the RMP covertly imaged the server and shared the results with the FBI on or about July 29, 2013._

It's certainly possible that the memo is full of misrepresentations or that the FBI mislead the RMP, but I don't think it is so likely that it should be assumed to be the case.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Hardly surprising, his defense was in tatters after having his experts denied and his line of inquiry into mark karples blocked. The prosecution tracing bitcoins directly from silk rd to his personal wallet was just icing on their cake. This is a warning to everyone involved in these enterprises, OPSEC OPSEC OPSEC!!!

<comment><USER7> "don't try and have people killed" is probably also a fairly good warning to people involved in these enterprises.

<comment><USER8> He didn't. These were lies - straight up lies - designed to impugn his credibility during jury selection and the bail proceeding.

Ask yourself: Why wasn't he charged with these crimes?

<comment><USER9> Because no one was murdered. He _tried_ to hire a hitman but the hitman ended up being an undercover FBI agent.

Don't defend this man, he is manipulative human garbage.

<comment><USER10> Which would still be a crime, if he committed it. But he wasn't tried for it.

<comment><USER11> Put him away for the things that are an easy conviction, rather than the more nebulous details of that attempt. Why cloud things?

<comment><USER11> Not sure why this is being down voted.

Of the two sets of charges, one was a much more easy conviction - the drug dealing.

It's not the prosecutor's job to introduce clouds of doubt into a prosecution. And this is not a case of "better ten guilty men go free than one innocent man be found guilty". He was, apparently quite overwhelmingly guilty of the charges related to running Silk Road. Why risk a conviction by charging him with something that might not stick (yes, I realize you can be found guilty of some charges and not others, but a whole world of doubt is introduced)?

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Anti-forensics seem like a good idea if you're running a transnational drug empire. A simple electronic leash would have gone a long way; some level of compartmented logins, such that when you're sitting in a cafe you're not always logged in with all of your credentials (probably separated by VMs), would be the next step after that.

Using online tools correctly to becoming a subject of in-person investigation would have been of course great, too, but there should be strong backstops before "convicted" as well.

(Or you could just not do the crime.)

<comment><USER13> What's an electronic leash? Like running TailsOS on a flash drive that's tethered to a bracelet?

<comment><USER14> A low tech solution is to use a laptop that doesn't have a battery and keep it plugged in all the time. When they grab the laptop the cord invariably comes unplugged and the thing turns off. Bonus points if you have a fake battery so the weight doesn't give the game away.

</comment></comment></comment><comment><USER15> So is life in prison a possibility?

<comment><USER16> I have trouble wrapping my mind around the concept of being imprisoned for the remainder of your life. Why do they even do it, instead of just execution? Might as well, right?

Especially for something like this. I haven't been following it closely at all, but presumably he hasn't stabbed/shot anyone, right? So why isn't it "prison for N years then we keep an eye on you for the rest of your life"? That'd be a whoooole lot cheaper than locking him up until he dies, and a much more reasonable punishment, IMO, for anyone who hasn't proved themselves some kind of psycho-killer.

<comment><USER17> It's counter-intuitive, but execution seems to be a much more expensive option than life in prison.

e.g. (semi-randomly picked links on the topic)

[http://www.hg.org/article.asp?id=31614](http://www.hg.org/article.asp?id=31614)

[http://www.forbes.com/sites/kellyphillipserb/2014/05/01/cons...](http://www.forbes.com/sites/kellyphillipserb/2014/05/01/considering- the-death-penalty-your-tax-dollars-at-work/)

hmm maybe I'm misconstruing your comment though...

<comment><USER18> That and "governments make mistakes" are the two arguments you can use pretty effectively against the death penalty on people who are not morally opposed to it.

<comment> mark-r The number of inmates being found innocent by new DNA tests is really frightening.

<comment><USER18> Yes, it is.

Personally, I have no problem with the state putting a bullet in the head of a murder, but the thought of a wrong verdict and some of the batsh_t crazy things courts have done leaves me fearful of any capital punishment.

I am particularly unamused by some of the things prosecutors have done that have lead to false convictions and how few remedies and punishments for corrupt prosecutors.

Plus, in the sad cold-blooded way of limited budgets, I can find no justification for spending the extra money.

In a perfect world there would be no capital crimes committed. In a near perfect world courts would be 100% right. We live in neither and should act like it.

</comment></comment></comment></comment></comment></comment><comment><USER19> Ross actually lived above me in college. Very surreal to see this all going down.

</comment><comment><USER20> I want to feel bad for the guy, almost, but I don't.

I just wish he got away with it, I wish he were smarter about it.

<comment><USER21> It's interesting that a lot of people sort of sympathise with him seemingly because of the context in which he carried out the crimes.

ie. If he'd been using a landline and peso's instead of BTC and the internet we'd probably attach a completely different emotional response.

<comment><USER22> I think a lot of people here sympathise with him because geeks have a libertarian bent. We believe that we know what's best for ourselves, and assume that other people do as well.

</comment></comment></comment><comment><USER23> Obviously he broke the law and was not the most morally pure individual.

But, what about 100 years from now? Do you think the people of the future will think we are being silly to put him in prison for 25+ years for running an unregulated online marketplace?

<comment><USER24> This is just a technologically advanced incident in the "drug war". Aside from the tech aspect, the business could be compared to a formal crack house where dealers meet customers and the owner takes a cut. That is to say, there's a vast unregulated market for drugs and the SR is a drop in the bucket.

While notable, I imagine people 100 years ago will pay more attention to the 30+ years we have of imprisoning, killing, fining and assaulting people and their families for selling and using highly common and sought after substances than the unregulated marketplace aspect of this case.

<comment><USER24> Uh, hundred years from now, I mean.

</comment></comment></comment><comment><USER25> The story of Silk Road and Ross Ulbricht will make for a great movie.

<comment><USER26> I see a story about a protagonist who was not only supremely arrogant, he was supremely incompetent at opsec (pretty boring and tough to make a sympathetic protagonist out of that).

A movie framing the cops as the protagonists would be just as boring, as it would include a scene with someone googling something and finding the crumb they need to nail Ulbricht, followed by a scene of the arrest where they don't even need to crack the encryption on his laptop to get every single thing they needed to convict him.

A video of his arrest at the public library might have made an entertaining/viral youtube video, though.

<comment><USER27> "I see a story about a protagonist who was not only supremely arrogant, he was supremely incompetent at opsec"

Ever seen Catch Me If You Can?

Also, I agree a true to life story would be pretty boring. Thankfully, truth isn't exactly a requirement in hollywood storytelling.

<comment><USER26> Haha, fair enough. A creative retelling of this story could be pretty entertaining. If you sweep all of Ulbrichts terrible opsec under the rug (and retell it as excellent opsec), you could make a pretty compelling man vs The Man story.

Consider my criticism withdrawn - fiction, "based on a true story" does usually manage to be pretty entertaining.

[Edit: I do still think that a youtube video of him getting arrested would really have taken off.]

</comment></comment></comment></comment><comment><USER28> He seems like a smart guy and a good guy overall...(yes, I know he allegedly attempted to hire a hit-man and we can't tolerate crime etc. etc.).

It's a shame to see his entire life wasted for an (admittedly rather large) youthful indiscretion. I keep thinking there has to be a more efficient, a more just way of discouraging criminal activity.

As an aside... Sometimes it apparently doesn't pay to be overly smart. Or rather, smart enough to get into trouble, but not smart enough to avoid the dangers.

<comment><USER29> _He seems like a smart guy and a good guy overall...(yes, I know he allegedly attempted to hire a hit-man and we can 't tolerate crime etc. etc.)_

This is one of the all-time great HN quotes.

<comment><USER30> You see he's ok because he writes code and drug laws are bad, man.

I'm disgusted by people trying to claim he is anything but a horrible person while trying to brush away the fact that he paid for people to be murdered. Sure, no one was killed, but that's only by the grace of his stupidity, and massive ego.

HN might hate the war on drugs and love people that write code and live in the valley but its embarrassing that self described smart people could fall so low as to latch on to that while ignoring the undeniable horrible things he did. He wasn't a smart guy, he wasn't a good guy, its like people didn't read the transcripts where they went through his journal detailing everything he did.

<comment><USER31> > while trying to brush away the fact that he paid for people to be murdered

Allegedly, there's not actual evidence this actually happened... nor did the prosecution attempt to go after those charges... nor has anyone traced the actual people who were supposedly murdered (their identities don't exist -- they aren't real people), nor has anyone validated the bitcoin transactions that supposedly transferred $750,000

<comment><USER30> The evidence that he paid for murders is as damning as the rest of it, he kept the chatlogs and made diary entries about _paying to have someone murdered_, Please.

The fact that he was scammed and no one was murdered is irrelevant, completely and utterly, and only goes to show he's not as smart as he thought he was. He's still just as evil for trying and it more importantly celebrating when he was told it was successful.

Agreeing with tptacek, again, pretty sure your last statement is false.

</comment></comment></comment></comment></comment><comment><USER32> I Dont this Mr Ulbricht stood a chance. That case was decided before it began.

</comment><comment><USER33> Ross made the decision, now Ross pays the price.

Lots of people could have done this, and lots of people were smart enough not to.

</comment><comment><USER8> It's hard for me to have anything but contempt for this entire proceeding. None of these actions are a crime in a free society. And if they were, there'd be no need to dictate what can and can't be introduced as a defense. No "politics?" What garbage. Every line of code that DPR wrote was political.

Free Ross.

<comment><USER34> This right here is the thing that kind of bugs me.

Once upon a time, the notion of civil disobedience was intimately connected to accepting and even welcoming the punishment that came with breaking the unjust law -- after all, if people just walked away untouched from it, how unjust could it be? Only by suffering actual grievous harm at the hands of the law could someone demonstrate that the law was unjust.

Now, though, the attitude seems to be "Nope, was just protesting this law I don't like, that means you shouldn't do anything to me".

As the saying goes: that's not how this works. That's not how any of this works.

<comment><USER8> I guess I don't understand what people who object to this outcome are supposed to do then. It's inappropriate to object to someone facing decades in prison for facilitating consensual transactions between adults?

That's all I'm doing.

<comment><USER35> People who object to a law should use a martyr as a rallying cry to show people the extent which laws are unjust and convince other people and politicians that the laws should be changed.

By making your demand the freeing of someone who may be a martyr but did little to effect actual change in the laws(is not a pivotal leader in the political portion of the movement) you consider unjust, you are not progressing the ideas you believe in. Only trying to undo a single action.

If and when the laws are changed to make the bulk of their actions legal, they will likely be freed then either for legal or political reasons.

<comment><USER8> > is not a pivotal leader in the political portion of the movement

I don't agree that this matters, but if it did, then certainly DPR is a pivotal leader in the "political portion" of the movement. I'm not sure how you can say he's not?

<comment><USER35> Because he does not seem to lead any people, or actively promote changes in laws (as evidenced by his choice of defense if nothing else). Instead he seems to be a regular business man, trying to make money. For pivotal leader I am talking a Martin Luther King, not a Reverend Jesse Jackson.

</comment></comment></comment></comment></comment></comment><comment><USER36> Could have seen that coming long long ago.

</comment><comment><USER37> Looks like he's going to have to learn how to break out of jail...

<comment><USER38> [http://en.wikipedia.org/wiki/Escape_Plan_%28film%29](http://en.wikipedia.org/wiki/Escape_Plan_%28film%29)

</comment></comment><comment><USER39> RIP in pieces, Dread Pirate Roberts, the Blackbeard of our era. May we meet again in 5 or so years on the silver screen.

</comment><comment><USER40> > and even tried to arrange the murder of five people who threatened the > anonymity of buyers and sellers.

1) No one was murdered

2) If drug trade was somehow regulated legally and decriminalized like in Portugal instead of being outright illegal, there would be no perverse incentive to murder to begin with... and there would probably also be no incentive for a Silk Road

When is US law going to realize that overly strict punishments (come on, does this guy really deserve _life in prison_?) simply create a perverse incentive to harm in order to ensure people stay quiet, and that creating black markets results in negative externalities? If the punishments were less severe (or even simply allowed but highly taxed/regulated) then there would be less murder of witnesses, period.

I can't find a tremendous amount of evidence around this, except for this: [https://www.econ.berkeley.edu/sites/default/files/yablon_dan...](https://www.econ.berkeley.edu/sites/default/files/yablon_daniel.pdf)

(I think I'm becoming libertarian?)</comment>


Ask a mod – how did this post die so quickly? - <AUTHOR>

This post is [dead] within a few seconds of me posting it https://news.ycombinator.com/item?id=7307607<p>I don't understand, I think it's very interesting and relevant content to hacker news. If someone flagged it, could they please explain? <comment><USER2> I also posted today to Ask HN about LaunchRock type services. It was killed almost immediately.

</comment><comment><USER3> Youtube links are autokilled, I believe

<comment><USER4> I'm not sure if YouTube is autokilled, or it's marked as "easier to kill". There are a lot of off topic YouTube post.

I searched and I think that the submitted video is [http://www.youtube.com/watch?v=n5LEEoskiaM](http://www.youtube.com/watch?v=n5LEEoskiaM) . I think it's on topic and I hope the moderators revive the submission.

<comment><AUTHOR> Yep, that's the video I submitted.

Well, at least now 1 person got to watch it

<comment><USER4> I found the post of author of the video: [http://blogs.yahoo.co.jp/yukukawano9/9722351.html](http://blogs.yahoo.co.jp/yukukawano9/9722351.html)

Autotranlation: [http://translate.google.com/translate?hl=en&sl=auto&tl=en&u=...](http://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fblogs.yahoo.co.jp%2Fyukukawano9%2F9722351.html)

Perhaps you can try to submit the autotranslation.</comment></comment></comment></comment>


Tcl Static Prime: Tcl compiler that outputs C or Java (2015) - <AUTHOR> https://github.com/tpoindex/tsp <comment><USER3> Interesting but doesn't look like it's going anywhere. The TclQuadcode project looks more likely to actually deliver serious speedups for Tcl code - <USER2> [http://wiki.tcl.tk/40985](http://wiki.tcl.tk/40985) and [https://www.tcl.tk/community/tcl2015/assets/talk14/TheTclQua...](https://www.tcl.tk/community/tcl2015/assets/talk14/TheTclQuadcodeCompiler.pdf)

<comment><USER4> Author here. Yeah, I haven't had the time to work on it lately. Other projects, work, life, et. al. I did ask for others who might be interested to collaborate, but no takers so far. That offer still stands, btw.

</comment></comment><comment><USER5> Last update was 2 years ago..

Maybe add 2015 tag ?

</comment><comment><USER6> Someone should build a compiler that compiles latex into C.

<comment><USER7> There's limitations because often latex doesn't give everything something like C needs to find the correct output... But compitex [0] is a LATEX->C compiler.

[0] [https://github.com/mtarek/compitex](https://github.com/mtarek/compitex)</comment></comment>


77% will not download a Retail app rated lower than 3 stars - <AUTHOR> http://blog.testmunk.com/77-will-not-download-a-retail-app-rated-lower-than-3-stars/ <comment><USER2> I think we'd be better off if we had people who curated apps, then rate the curators.

The App Store has such a limited interface, that's it like walking into a minefield. You can't tell if something is crap or not until you've blown your money.

Apple doesn't even try to prevent you from buying crapware because they've already made their money.

<comment><USER3> Android used to have an hour-long window after you purchased an app to get a full refund with the tap of your screen. Then they knocked it down to 15 minutes, which, depending on the app, may not be long enough to install and test out the app. Then as you suggested, Apple has nothing like that in place at all. It's kind of frustrating as a customer.

<comment><USER4> It is changed to 2 hours now.

</comment></comment></comment><comment><USER5> I don't really trust high star rating but I'm inclined to trust lower star ratings. What I mean by that is if an app has 4-5 stars I don't assume it's good (unless it's an indie title) I assume they paid for the ratings. If an app has 1-3 stars I will read the reviews to see if my device or my use-case are mentioned (ie. Doesn't work on iPhone X OR Works great except feature X seems broken) but if the reviews are all "This sucks!!!!" or "Don't Buy" then I will take them into consideration but it won't stop be from downloading necessarily.

<comment><USER6> I'm with you on this. Five-star ratings don't pass my astroturf gut check these days. One-star [1] or two-star or three-star ratings are usually there because there is some glaring flaw that everyone is upset about, and it's usually worth reading the reviews to see if it's a problem I'll also encounter.

Fifty percent of the time, that "flaw" is a bunch of complaints about price or IAP [2]. The other 50% is crashing on certain devices. Vanishingly few people with thoughtful, in-depth grievances about an app will actually take the time to review it. They'll just delete the app and move on. So there is a bit of a selection bias at play in the ratings set.

[1] I do feel there's a big gulf between one star and two stars. At least in my anecdotal experience, a one-star rating often means the app is so buggy as to be borderline unusable, or else fundamentally flawed in some way. A two- star rating is a very different animal; it often means the app itself shows promise, but it is priced poorly, or else it has stability issues on certain OS versions or devices. Three stars is where you start to enter the territory of legitimately mixed opinion about an app's quality in and of itself. (Assuming, of course, that the number of reviews is large enough.)

[2] Incidentally, these complaints are often valid, albeit expressed in very peremptory ways. I'm not dismissing them, especially when they concern pay-to- play IAP mechanisms. But I do take them with a grain of salt.

<comment><USER5> I'd be interested to see a grouping of all the apps I have installed by current app store rating (Or a broader study of multiple people's devices and their "Average star rating"). Of course this data probably wouldn't mean much until it was weighted by usage, but even that is hard to quantify "use" there are apps I used that more or less "have" to use and apps that I don't need to and/or rarely use that might skew the results.

Edit:

Hmm, I'm jailbroken, I wonder how hard it would be to get a list of installed apps by SSH'ing in and then combine that list with this endpoint (No affliation with app, found link on stack overflow) [https://itunes.apple.com/lookup?id=422876559](https://itunes.apple.com/lookup?id=422876559) to get the ratings....

</comment></comment></comment><comment><USER7> Title should be "77% of users surveyed...".

User surveys seem like a really poor metric here.

Also, being posted by the article creator, 12 upvotes and only 1 comment seems to suggest gaming the system.

<comment><USER8> OP has a 100% success rate getting a bunch of upvotes which can be a sign of foul play: [https://news.ycombinator.com/submitted?id=martin_tipgain](https://news.ycombinator.com/submitted?id=martin_tipgain)

And at least one account helping out with comments exclusively on his submissions: [https://news.ycombinator.com/threads?id=Kaibert123](https://news.ycombinator.com/threads?id=Kaibert123)

</comment></comment><comment><USER9> We know people pay to have fake 5 star ratings, I wonder how many pay to have their competitors given fake 1 star ratings.

Even though I know people game the system, I still glance at the number of stars when downloading an app.

</comment><comment><USER10> I wouldn't download a Retail app of any sort anyway. I may be a geek here but I think approach is likely to catch on rather than die away.

Even with all the hype, an "app" is supposed to be something more than a website or a brochure. I can't see much of a future in particular retailer or state agencies or whatever turning their websites into apps - it only really has the force of novelty on its side. Consumers will learn the uselessness of such things in the way that they previously learned the uselessness of free pens and other novelty material items.

</comment><comment><USER11> A survey involving 115 people, mentioning percentages with fractional places with no mention of statistical error...

Myself working in the field of statistics this really makes me cringe...

</comment><comment><AUTHOR> It will be interesting to know to what extend this research is transferable to other app categories?</comment>


A Letter To Every Developer - <AUTHOR> http://www.attendly.com/a-letter-to-every-developer/

<comment><USER2> You're welcome.</comment>


NYC VC gives tips for startups looking for funding - <AUTHOR> http://www.centernetworks.com/startups-venture-capital-advice

<comment><USER2> i love how the guy pimps his portfolio companies for about 5 minutes of the 20 minute talk - otherwise the info is good</comment>


T2Z – generate a 2D animation then turn it into a 3D printable sculpture - <AUTHOR> http://www.realtimerendering.com/blog/freezing-time-at-siggraph/

<comment><USER2> Cool! After I mulled it over, I realized it was simply printing a cross- section over time. I see this in the CAD I work with each day when I pull a section plane through my 3D geometry. The novelty is that it is printed instead of just viewed on the screen. So I guess working backwards, you could design your 3D model, then choose a suitable plane and save each slice as a frame to produce the 2D animation this starts with...

</comment><comment><USER3> Nice!!!</comment>


3-D Printing Startup MakerBot Acquired for $403 Million - <AUTHOR> http://www.entrepreneur.com/article/227121

<comment><USER2> Stratasys just bought Makerbot?

Well competition is out the window but at least I know which stock to buy now</comment>


Can a company innovate without working its employees to death? - <AUTHOR> http://www.washingtonpost.com/news/innovations/wp/2015/08/28/can-a-company-innovate-without-working-its-employees-to-death/

<comment><USER2> If it doesn't, frustrated workers might compete with it with their side projects.

<comment><USER3> Not if they don't have time and/or energy for side projects.

[http://www.issendai.com/psychology/sick- systems.html](http://www.issendai.com/psychology/sick-systems.html)</comment></comment>


Apple's new Fingerprint Sensor - <AUTHOR> http://rothy.tumblr.com/post/60365940577/apples-new-fingerprint-sensor

<comment><USER3> _But on my iphone? 1password has had to integrate it's own browser on it's iOS app that i need to use if I want a simple way to login to all my sites._

Please edit the post, this is just ghastly.

I would love something like this. I hate signing into apps (mobile banking, in particular, is a pain). It'll end up being up to app developers to integrate the new fingerprint APIs though, and I bet you my bank still decides that their stupid username, password, 3 random letters from a 'memorable word' scheme is more secure.

<comment><AUTHOR> Sorry - I wrote this up a bit haphazardly and set it to post. Fixed it up a bit, sorry.

<comment><USER3> Thanks for fixing. It was a good post otherwise!

</comment></comment></comment><comment><USER4> If Apple's hardware implementation is as good as my two year old Motorola Atrix, their customers will love the fingerprint reader. But I, for one, would never entrust all my passwords to Apple's closed source software, especially given their record in the area of software quality control.

<comment><USER5> I currently do trust a good portion of my passwords to OS X's Keychain app, because based on my knowledge I'm fine with their record of software QC. What am I missing?

<comment><USER4> [http://news.ycombinator.com/item?id=4916627](http://news.ycombinator.com/item?id=4916627)

<comment><USER5> Thank you for a thorough reply. IMHO, these bugs do not differ in severity or frequency when compared other closed source software vendors or from open source projects.

The iCloud aspect does bother me quite a bit though, particularly when combined with likely NSA backdoors.

<comment><USER4> The Finder bug I linked to actually deleted the source file before checking that it was moved successfully to the destination. The unix "mv" command predates the Finder by 30 years or so, and gets it right, of course. This is an elementary, student-level blunder that made it in to the Finder, the center of the user's interaction with the system. A lot of people lost a lot of data as this bug remained uncorrected for months. There were similar bugs in Mail, getting IMAP semantics wrong and deleting messages. Anyone who offers an assessment of Apple's software quality control at least needs to take this history into account.

I'm sure that there are open source projects out there that are just as bad. I don't use those. The ones I do use, like mutt, don't contain this level of blunder. It's not that we should expect software to be free of bugs. It's just that the nature of these Apple bugs suggest a cavalier attitude to software quality and a severe lack of testing. Combine this with closed source and a critical security function, and you have an explosive mixture.

</comment></comment></comment></comment></comment><comment><USER6> Almost ten years ago I bought a Logitech keyboard with a fingerprint reader. People were saying that fingerprint readers would be the end of passwords. The keyboard came with a nice piece of software that automatically entered passwords on websites upon a verified fingerprint.

It didn't happen. I would attribute it to two main frustrations: the readers only worked inconsistently due to particulate build up, and would occasionally have false positives. I think false positives are an inherent risk with fingerprint readers and in any case are not suitable for security as lifting a fingerprint from someone unwittingly is easy.

See the Mythbusters episode on stealing a thumbprint: [http://www.youtube.com/watch?v=3Hji3kp_i9k](http://www.youtube.com/watch?v=3Hji3kp_i9k)

<comment><USER7> What's worse: if someone can get to the software fingerprint image stored in the computer, they can create fake fingers that work in conventional fingerprint scanners. [http://youtu.be/K1Sx_BmfZ8I](http://youtu.be/K1Sx_BmfZ8I)

Having a stolen fingerprint is worse than a stolen password. For one, people tend to trust fingers more; for the other, it's impossible to change your fingerprint, unlike your password.

I really can't trust these kinds of consumer technologies until their designers use revocable biometric systems to protect the fingerprint template. That area of the literature is quite well studied, but everyone seems to ignore it.

<comment><USER8> Just use a different finger.

You get ten revocations before you have to take off your shoe.

<comment><USER7> Some governments etc. force you to submit to giving fingerprints of all ten fingers. If an adversary steals just that biometric database, you're done. That's it. No more fingers to use.

Any civil worker who takes fingerprints isn't going to let you put your foot on the fingerprint scanner to verify your identity, and the next customers certainly don't want to touch the device after you've had your way with it.

<comment><USER8> Well sure, great points! Nonetheless, for those not living in dystopia a cell phone fingerprint login may be handy.

</comment></comment></comment></comment></comment><comment><USER9> Fingerprints are great as a security token, but they should not replace passwords completely. Together with a PIN they will be useful.

"Led by Stephanie Schuckers, an associate professor of electrical and computer engineering at Potsdam, N.Y.-based Clarkson University, the researchers tested 66 Play-Doh copies of real fingerprints of 11 different people. The fake fingerprints were verified as the real deal 90 percent of the time."

[http://www.informationweek.com/biometric-readers-fooled- with...](http://www.informationweek.com/biometric-readers-fooled-with-fake- finge/175001741)

<comment><USER10> Almost 8 years ago. Fingerprint readers could have improved since then (the article even points out that they have software in the lab to do so). Anybody know how good the current crop of HW/SW combinations is?

<comment><USER7> Sure, the high-end fingerprint scanners are reasonably good at this sort of liveness detection (eg. by detecting the pulse of blood flow or by inferring something about the 3D structure of the fingerprint so you can't just hold up a picture), but the cheap $20 scanners that many businesses use aren't going to be able to distinguish a real from a fake.

<comment><USER11> My girlfriend uses an app that lets her detect her heartrate by putting her finger in front of her camera while the light on the phone shines. I don't really see why whatever they're putting into the phone couldn't do something similar.

<comment><USER12> So hold your finger behind a gel with the fake fingerprint.

Mythbusters tested a bunch of fingerprint readers and they could break even a few of the ones with "life" detection.

</comment></comment></comment></comment></comment><comment><USER13> I think prior to release lots of people will lean towards dreaming about fingerprint recognition being built into the glass touchscreen, but I do not think the tech is miniaturized enough yet. I looked into this a while ago and all I could find were a handful of Polish researchers using ultrasound technology which required ultrasound guns around the edges of the glass which reflect the beams off the fingerprint:

[http://www.optel.pl/article/english/article.htm](http://www.optel.pl/article/english/article.htm)

</comment><comment><USER14> In 1997 I got my first job at the local Safeway.

To sign on and off, I would enter my 6 digit employee number into a pin pad, then scan my right index finger.

It worked about 99% of the time, and mostly only failed because I worked in the meat dept. and often my hands would be extremely hot and wet from soap & hot water, or frozen and numb from handling meat all day. Then I would just use my left index finger.

It worked great in 1997, I see no reason it can't in 2013.

<comment><USER15> Not so convinced, sometimes use a Bloomberg finger login and even after they changed it to the high sensitivity setting I can only manage 50% so I won't go for any fingerprint solution.

<comment><USER13> It also depends which sensor version you have -- my older unit was terrible after a number of years of constant use but as soon as I upgraded to one of the newer ones, it was snappy and worked much better.

</comment></comment></comment><comment><USER16> I don't think it's a good idea to use fingerprint as a way to authenticate. Fingerprint is not private data. By "private", I mean as private as a private GPG key. Any fingerprint is able to read a fingerprint as long as you put your finger on it. When there're more fingerprint powered applications, it's gonna be really easy to steal credentials.

You may use a passphrase. But that would be as secure as using a passphrase alone.

Fingerprint is the public key. The private key would be your hand + your physical presence. However, since fingerprint itself is public, you can't rely on fingerprint to identify physical presence.

Unless, you make fingerprint private enough. For example, permanently attach something on to your finger. Instead of providing your fingerprint to third- party application, it generates a key pair based on your fingerprint, and use these keys for authentication.

</comment><comment><USER17> I wonder if Apple's data shows that most people don't use passcode locks?

</comment><comment><USER18> While fingerprints might work as a proof of identity, they should not be a replacement for passwords. Identity is who you are, passwords are authentication, and they are better when kept separate. Besides I cannot look at this issue without being paranoid: Apple is one of the companies that comply with the PRISM program. By putting your fingerprints in their products, you are just giving away more data for survelliance and creating a security "issue" rather than solution. Do we really need this?

<comment><USER19> but authentication is identity. a password does nothing more than identify you by something supposedly only you would know.

and yes, we need this. convenience is the antithesis of security, so anything that builds a bridge for more users is welcome.

<comment><USER18> Identity is something that can be seen public. Authentication is a way of proving that you are "the" person who is supposed to get the access to the system. When your identity is stolen in a system where identity is equated with authentication, you are the one who is responsible for "thefts" actions. Users can be held responsible for their actions only when identity and authentication are kept separate. An article that explains this point in more detail: [http://technet.microsoft.com/en- us/library/cc512578.aspx](http://technet.microsoft.com/en- us/library/cc512578.aspx)

</comment></comment></comment><comment><USER20> I genuinely wonder if with the increase in fingerprint biometrics we will see an increase in crimes resulting in missing fingers?

</comment><comment><USER21> The more layers of security, the better. A while back, I expressed delight at the potential scenario of using NFC as a layer of security using proximity as a parameter.

I'm sure Apple are aware that storing the "plaintext" equivalent of a finger print would defeat the entire purpose.

<comment><USER22> I'm using lastpass with Yubikey 2nd Factor.

What's great is there is an NFC Yubikey that I just put close to my phone to get the phone version of LastPass to auth.

</comment></comment><comment><USER8> There seems to be a lot of focus on replacement of keylock. The wonderful thing about the fingerprint reader is that it effectively enables both the username and password and makes for a much simpler path to supporting multiple users in future iOS releases/devices.

</comment><comment><USER23> The thing about biometric security that always makes me uneasy: when your "password" is compromised, you can't reset your fingerprints.

<comment><USER7> That's exactly why "revocable biometrics" are so important. There are ways of combining a fingerprint and a password to combine the security of using both with the revocability of an ordinary password: [http://www.wjscheirer.com/papers/wjs_icb2009_bipartite.pdf](http://www.wjscheirer.com/papers/wjs_icb2009_bipartite.pdf)

<comment><USER24> Thanks for sharing the PDF. This isn't a subject I know much about but curious to learn more.

Bipartite biotokens do seem significantly more secure than naked biometrics, but I'm not sure I understand the benefit if security still boils down to user passwords, especially if one assumes that any static security component will eventually be compromised.

Using the password to salt the original biometric improves privacy and security, but there are a lot of other ways to compromise biometrics - <USER2> look at a lot of cameras and leave a lot of fingerprints, and existing biometric systems (while improving) are fooled by photocopies.

<comment><USER7> That's true. It all boils down to whether you have more information than the adversary. By default, you have both a password and a biometric; with the biotoken strategy, authentication requires both. If you lose your password (eg. password database being compromised, doesn't require local access), only your biometric can protect you. With biotokens, the idea is that if the biotoken fingerprint database is compromised, the adversary can't get any useful representation of your fingerprint, even if they have your password. Sure, as you say, you can lose your fingerprint if your attacker tails you at the coffee shop to lift it from the glass table or your discarded coffee mug ("local access"). But now the adversary has _all the information_ that you do -- your password and your biometric -- so you're doomed no matter what.

Boult and Scheirer, the author of the above paper, gave a great tutorial about these kinds of privacy/security issues at 2011's International Joint Conference on Biometrics (IJCB), if you're interested about learning more. Both happen to be my former advisors too ;)

Tutorial: [http://www.securics.com/~walter/IJCB2011/](http://www.securics.com/~walter/IJCB2011/)

Slides, "Part I: An Overview of Issues Related to Biometric Privacy and Security" [http://www.securics.com/~walter/IJCB2011/IJCB11-tutorial- par...](http://www.securics.com/~walter/IJCB2011/IJCB11-tutorial-part1.pdf) "Part II: A Survey of Template Protection Technologies" [http://www.securics.com/~walter/IJCB2011/ijcb-survey- templat...](http://www.securics.com/~walter/IJCB2011/ijcb-survey- templates.pdf)

</comment></comment></comment></comment><comment><USER25> But but iPhone is not he only device I access many sites from. What if I need to sign into the website from my PC and need to use firefox or IE for that?

<comment><USER26> The fingerprint sensor auth will just fill in the form fields with your username and password. You can sync these over to your desktop machine and use them like you usually would there.

<comment><USER27> Also, as the post alludes, if they can figure out how to integrate the fingerprint sensor into the touch screen itself then they could, in theory, do the same with your touchpad on the Mac. So authenticating on your desktop would be the same as the phone assuming you were using a Magic Mouse or Magic Trackpad.

<comment><USER28> That would be _amazing_ , having a password+fingerprint option built into my laptop.</comment></comment></comment></comment>


Little Wars - <AUTHOR> http://www.gutenberg.org/files/3691/3691-h/3691-h.htm

<comment><USER2> H.G. Wells, Original Wargamer :)

This reminds me of a similar game called Lego Wars that my friends and I used to play in middle school (I downloaded the rules off of GEnie):

<http://mama.indstate.edu/users/sean/legowars/wars.htm>

<comment><USER3> See also BrikWars: <http://www.brikwars.com/rules/2005/cover.htm>

</comment></comment><comment><USER4> So glad to see this here. I live in the boston area, and have been attempting to acquire appropriate cannons with which to play. If you're in the area and wish to join me in my mad quest (in either finding the cannons, or playing), message me (@vonkow on twitter works too).

</comment><comment><USER5> Wow this is cool. I had never heard of this and Wells is my favorite author.

<comment><USER6> You may also like the Kriegsspiel (<http://en.wikipedia.org/wiki/Kriegsspiel_(wargame)>).

</comment></comment><comment><USER7> "A Game for Boys from twelve years of age to one hundred and fifty and for that more intelligent sort of girl who likes boys' games and books"

\-- Hmm... old-school chauvinism, or am I just imagining?

<comment><USER8> …Or feminism. It really depends how you read it and in which context you choose to place it.

<comment><USER9> There's also: _"It can be played by boys of every age from twelve to one hundred and fifty—and even later if the limbs remain sufficiently supple—by girls of the better sort, and by a few rare and gifted women."_

The condition on which boys can play it is that their limbs are supple. Girls can only play it if they are of the better sort, not to mention women - only a few rare and gifted can play it.

It looks like there are some underlying assumptions about the abilities of boys and women. Hm... nope, they do not look much like feminism to me but what do I know.

<comment><USER8> As I said, if you put the comment in context, the fact that they are even suggesting that some girls might like it is a little bit of emancipation.

Full women's suffrage was still 15 years away, the feminism movement over forty years away. The suffragette movement was at its most active at this time: this book was published the same year that Emily Davison died trying to throw a suffragette banner over the King's horse.

HG Wells was probably a feminist: he certainly had affairs (and fathered children) with a number of prominent feminists of the time. He was certainly a socialist and a member of The Fabian Society: his books tackle many of the political problems of the time.

Once you factor this in, the meaning of "the better sort" of girl and "rare gifted women" becomes far more interesting.

</comment></comment></comment></comment><comment><USER3> Wells also wrote Floor Games: A Companion Volume to 'Little Wars': <http://www.gutenberg.org/files/3690/3690-h/3690-h.htm>

</comment><comment><USER10> [http://www.archive.org/stream/littlewarsgamefo00welluoft#pag...](http://www.archive.org/stream/littlewarsgamefo00welluoft#page/n7/mode/2up)

</comment><comment><USER11> BRB, using this as the basis for an iOS/Android game .. ;)</comment>


Kenosha Militia FB Event Asking Attendees to Bring Weapons Reported 455 Times - <AUTHOR> https://www.buzzfeednews.com/article/ryanmac/kenosha-militia-facebook-reported-455-times-moderators <comment><USER2> The media spin going on regarding Kenosha is crazy. If I hadn't seen the videos of what happened, I would have assumed it was a white supremacist shooting peaceful protesters, not someone who was being attacked and only shot when he couldn't get away.

<comment><USER3> The first person was killed because he threw a plastic bag.

"The complaint claims that cell phone video showed Rosenbaum, who appeared to be unarmed, trailing behind Rittenhouse before throwing a plastic bag at him. As the pair approached a car, a loud bang is heard, followed by an unidentified male yelling an obscenity. When Rosenbaum gets close to Rittenhouse, another four bangs are heard."

The widely circulated video is of people trying to disarm.him after he killed the first person.

[https://www.cbsnews.com/news/kyle-rittenhouse-kenosha- shooti...](https://www.cbsnews.com/news/kyle-rittenhouse-kenosha-shooting- homicide-charges-jacob-blake-protests/)

<comment><USER4> Stabilized video (gif) of the first shooting: [https://i.maga.host/rc9wxWa.gif](https://i.maga.host/rc9wxWa.gif)

Note that this is after the bag was thrown - the person who threw it continued to chase the shooter and was within contact distance.

Apologies for the domain. This is a heavily politicized event, and YouTube seems to be taking down the videos.

</comment></comment></comment><comment><USER5> I think the reason why it wasn't removed is probably because it wasn't clear it violated facebook policy. I guess after the fact because of media pressure facebook has decided that it did.

There is a cached url available at: [https://webcache.googleusercontent.com/search?q=cache%3AaKHZ...](https://webcache.googleusercontent.com/search?q=cache%3AaKHZ3m9Q1UcJ%3Ahttps%3A%2F%2Fwww.facebook.com%2Fevents%2Fs%2Farmed- citizens-to-protect- our-%2F1480306495505252%2F%3Fti%3Das%20&cd=5&hl=en&ct=clnk&gl=uk)

It looks like in the event itself there was no direct call for violence unless the event description has been lost with the caching.

The title just said: "Armed Citizens to Protect our Lives and Property" and it was hosted by "Konosha Guard".

</comment><comment><USER6> The rioting (distinct from the protests) in cities have resulted in a dozen or more dead. Can they be traced back to social media organizing as well? Should all comms that can potentially end up with death and destruction of property be censored?

<comment><USER7> Whataboutism. And a terrible effort. There has been no confirmed violence traced back to left-wing groups. Criminality has mostly been opportunistic by local criminal gangs, spontaneous personal conflict or organized by law enforcement against civilians and journalists. Only right-wing groups are organizing terrorism. And the comparison is pointless. We should decry this behavior whenever we see it.

<comment><USER8> I don't see the poster claiming this was left, right, whatever? Just trace the source.

<comment><USER7> OP was asking if riots were organized on social media as if that was some counter argument to why we should not permit the kind of organized violence from the BuzzFeed story. This struck me as an attempt to weaken the argument that we should be upset about right-wing terrorism on social media. It has also been widely asserted by the president (among others) that left-wing groups are the bigger terror threat. OP didn't say it but I'm reading between the lines.

Short answer is that it is all still irrelevant. Any attempt to organize violent confrontations on social media should be subject to removal. Incitement is explicitly excluded from first amendment protection. Planned rioting should absolutely be shut down as well but there's been no reports of that. Banning any organizing that could possibly lead to violence is definitely not the same thing.

<comment><USER9> > as if that was some counter argument

Not exactly, no he was not.

</comment></comment></comment></comment></comment><comment><USER10> > Facebook has maintained that the suspect [...] had no direct connection with > the Kenosha Guard page or event.

He might not have directly interacted with it - doesn't mean he didn't see it? Shared by a friend?

Or are their analytics so detailed that they can guarantee he never saw it?

</comment><comment><USER11> I'm sorry but some guy going with his gun to a protest for no reason is as bad or probably worst than rioters and looters. I don't understand how some people can blame looters but defend this guy. Don't mix things together. He literally killed some humans. Are you out of your mind or your biases blinded you so badly that you can't judge anymore and you don't see anything?

They should investigate and see how a "17" years old is so brain washed to take a gun and go there. I hate rioters and looters, but I can't imagine how can I convince myself to go there with a gun. That isn't normal.

</comment><comment><USER12> _the complaints had been sent to content moderation contractors_

Don't outsource a core competency. Facebook has reached a point where moderation is at least as important as engineering.

</comment><comment><USER13> The kid was chased by multiple felony offenders, one with a gun, and was attacked and knocked to the ground by another with a skateboard. The video evidence clearly shows he acted in self defense

<comment><USER14> ... after he already had killed a protestor. After realizing what he did, instead of calling for help or staying to justify his actions, he ran away and shot two more people in the process.

Then the police let him walk away.

Please contrast this with the same police shooting an unarmed black man seven times in the back at close range while getting into his car. Imagine if he had 2' long rifle on him too.

I don't relish political discussion in this forum, and I'm sorry to dang et all if I'm furthering that. It just feels like the world is on fire and it's hard to bite your tongue when ostensibly reasonable people fundamentally disagree with things covered on video.

<comment><USER13> First, calling them protestors is dishonest. At that point it had devolved into a violent riot. He ran away because an armed man was chasing him, and another with a skateboard. Also, he was taken into custody, not allowed to walk away. The three men who attacked Kyle were all convicted criminals as well. [https://mobile.twitter.com/MichaelCoudrey/status/12988734361...](https://mobile.twitter.com/MichaelCoudrey/status/1298873436102565888?s=20)

The black man was not unarmed, he had a knife in his hand and a gun in his car. The police fired when he reached into the car. He already had the knife in his hand and told the police he was going to grab the other

<comment><USER15> I believe you have multiple factual errors here; in particular, Rittenhouse shot and killed a person first, _then_ tried to run away and killed 1 more person.

Also, Jacob Blake did not have a gun. It's stil unclear whether he was holding a knife or sunglasses.</comment></comment></comment></comment>


Cloud gaming servers for $ 9.99 / month - <AUTHOR> https://www.leapcomputing.com/#pricings

<comment><USER2> This is interesting, even if they oversubscribe I'm going to assume that there will be rather large peeks and valleys in utilization of this equipment.

I wonder if they will "rent in the valleys" for a discount? I can think of lots of offline processes that don't need to be as timely that could leverage cheep infrastructure.</comment>


Secure Ajax from Non-Secure Pages - <AUTHOR> http://www.viget.com/extend/secure-ajax-from-non-secure-pages/

<comment> mike-cardwell If a form is going to submit data over a secure channel, the page containing the form should be retrieved over a secure channel also. Otherwise what's to stop somebody intercepting and modifying the pages HTML so that the form submits the data in plain text elsewhere?</comment>


Microsofts version of Googles Project Glass - <AUTHOR> http://todaystopthing.com/?p=245

<comment><USER2> Funniest thing ever. It's always fun to poke at Microsoft. Reminds me of: <http://www.computerjokes.net/172.asp>

<comment><AUTHOR> Sure is! However in all seriousness, they'll probably make a windows phone version that will be pretty slick.</comment></comment>


Nokia unveils first "Universal" font  - <AUTHOR> http://www.psfk.com/2012/08/nokia-universal-font.html#

<comment><USER2> I think Code 2000 came first.</comment>


Do these guys really help? (helping to raise capital) - <AUTHOR>

Here at Pikluk (http://pikluk.com) We are in the process of finalizing our business plan and trying to get funded.
I was wondering if any of you guys had any experience dealing with sites like http://www.fundingpost.com and http://www.gobignetwork.com
They all want you to pay to submit a  "company profile", not much - hundreds (at least not thousands) of dollars.
But I am wondering - are they for real? I have never heard of any company that got funded this way.

<comment><USER2> I have never heard of a successful startup that got funded this way either.

VCs tend to get deals through referrals from people they know, like angels, lawyers, professors, and other founders.

<comment><USER3> It's almost a prerequisite to getting funding that you are smart enough to figure out how to get a referral into a VC firm.

</comment></comment><comment><USER4> I doubt it. go big network is 90% bullshit.

However, in Silicon Valley, there are a number of guys who are well connected in the venture community and can help you find funding. We had such a guy help us out for a year and I'm pretty sure we wouldn't have found our great funding deal without his help.

<comment><AUTHOR> Well... lucky you, SValley residents. :-) We're based in Austin, TX and so far has not developed any connections with valley people.

<comment><USER5> An asymmetric attack you may wish to consider is to talk to the larger law firms who represent VC/PE firms. Fulbright & Jaworski L.L.P. on Congress (downtown Austin) is very well connected and could point you in the right direction. Alternatively, go to a <http://www.bootstrapaustin.org/> event and see what other entrepreneurs suggest.

Austin is an amazing city.

<comment><AUTHOR> Woow. Yet another local resource I had no clue about. Thanks a lot.

<comment><USER5> There are lots of 'niche' resources in Austin and you have to do a lot of legwork to get to them. Additionally, if you (or any of your founders) are alumni of the University of Texas, the networking events at the MBA school are valuable.

</comment></comment></comment></comment></comment><comment><USER6> The middleman approach to funding doesn't appear to work too well--none of the successful companies I know went that route, but many of the trainwrecks did. It's probably not impossible, though.

You would do well to remember that investors need you much more than you need them. If you've got a good idea, market, and team, raising money won't be your problem. Lawyers, professors, other companies, even networking events--it's a very solvable problem.

</comment><comment><USER7> Call them and ask for references. Please be sure to come back and tell us what you found out :)

I don't know anyone that has used them, but I do read Wil's blog often.

</comment><comment><USER8> "But I am wondering - are they for real?" They will really take your money.

If you've exhausted all of your social capital and none of your friends, folks you have prior shared success with (e.g old bosess, co-workers, team members, customers, suppliers), family/relatives, and current advisors (e.g. lawyer, CPA, banker, others) are willing to help you then you can pay these guys to broadcast your business plan or profile.

You might ask them for three references who actually raised money as their testimonials seem to revolve around arranging meetings where founders can touch the hem of a VC's cloak--but no money seems to have changed hands.

Alternatively you might reconsider your business model, as a parent I would be willing to pay pikluk so when I see "The PikLuk Service is FREE and it provides a safe Internet experience for your children." I wonder how you are going to make money in a way that doesn't conflict with your primary brand promise.

</comment><comment><USER9> Try to meet potential funders in person. Or try to meet people that will recommend you to a funder. That is the way (I'm told) that the vast majority of deals happen. It's all about networking, which is best accomplished in person.

<comment><USER10> Agree with ivan here. We received our first VC introduction from a cold e-mail we gave to another entrepreneur. She's been instrumental in our development and is a great person to have on board.

</comment></comment><comment><USER11> I expected you guys to get into YC... maybe next time. If I had a bunch of money I would fund you.</comment>


The Philosophy of Color Perception - <AUTHOR> http://www.newrepublic.com/article/121843/philosophy-color-perception <comment><USER2> I think that this article drastically over-complicates color. Color can be defined in two separate and distinct ways.

First, color is light in varying wavelengths and intensities.

Second, color is a perception in the mind of a creature with light receptors.

A tree falling in a forest without an observer is not black and white, because the lack of an observer does not change the wavelengths of light absorbed by the tree. The perception of color, however is dependent on the receiver. A creature with dichromatic vision has a different perception of colors than a trichomat or a tetrachromat.

This article makes color sound very confusing by not setting a clear scope at the beginning. The resulting ambiguity is the source of "philosophical discussion".

<comment><USER3> The scope is the qualia of color and what it is to behold color in your mind. With all due respect, you sound like Mary in the Mary's Room thought experiment. [1]

[1] [https://en.wikipedia.org/wiki/Knowledge_argument](https://en.wikipedia.org/wiki/Knowledge_argument)

<comment><USER2> That is a very interesting thought experiment. Thank you for introducing me to it!

</comment></comment></comment><comment><USER4> > _" The human perception system sees a checkerboard with a cylinder, while a > basic SSR measurement shows squares A and B read the same. "Illusion" > implies that our system is fooled, but as far as useful information goes, > the checkerboard interpretation is probably better. Try as they might, > mathematicians can't make the computers see the checkerboard. Rather than a > demonstration of how easily fooled we are, optical illusions like this one > are examples of the brain's mysterious and irreplicable abilities. It > interprets its environment with a sophistication that exceeds our ability to > measure and reconstruct physical phenomena."_

I am certainly no expert on this matter, but it seems intuitively obvious to me that the reason they haven't had much luck is because they are trying to solve a much harder problem than the brain actually solves.

The brain almost certainly is using input from other "functions", particularly edge detection and large-scale pattern detection to determine that there is a repeating grid there, not just raw color information and inferred scene lighting. I bet a computer can detect those edges with relative ease, but that's not how the researchers are trying to solve this. They probably know that they could do it that way, but consider it cheating because that's not what they wanted to study.

<comment><USER5> > _I bet a computer can detect those edges with relative ease_

It's not so simple. What edges? The computers sees no edges there -- only where they actually exist.

If it was made to "extend" the actually existing edges, where would it stop?

</comment></comment><comment><USER6> "[...] but since the color spectrum fits on a single line [...]"

There's a lot I want to respond to that statement with (purple!), but I'll just mention that photons have more than a single frequency parameter [1]. Contrary to popular belief, this is relevant for human color perception, as the cone photoreceptor cells are sensitive enough to polarization that it can be perceived under certain circumstances [2] (not to mention the impact it has on light intensity in for example gemstones through fresnel effects.

I'll just leave this here: [http://makeartbutton.com/dmp/lusion.png](http://makeartbutton.com/dmp/lusion.png)

[1] [https://en.wikipedia.org/wiki/Stokes_parameters](https://en.wikipedia.org/wiki/Stokes_parameters)

[2] [https://en.wikipedia.org/wiki/Haidinger%27s_brush](https://en.wikipedia.org/wiki/Haidinger%27s_brush)

</comment><comment><USER7> Missing in action: Goethe's Farbenlehre [http://en.wikipedia.org/wiki/Theory_of_Colours](http://en.wikipedia.org/wiki/Theory_of_Colours) and Schopenhaeur's physiological approach [http://en.wikipedia.org/wiki/On_Vision_and_Colors](http://en.wikipedia.org/wiki/On_Vision_and_Colors)

</comment><comment><USER8> If a tree grows in the middle of a forest and there's no one around to see it, does it make a color?

<comment><USER2> As mentioned in my comment, yes and no.

It still absorbs certain wavelengths of light to varying degrees, so yes for that definition of color.

It is not received by any light receptors and no creature holds a color perception of the tree. So no, for the second definition of color.

<comment><USER5> If it's a totally dark forest (no lightsource, no photons at all), does the tree still make (or "have") a color?

</comment></comment></comment><comment><USER9> _Noto bene_ , auto-playing audio ads on mobile.</comment>