The Best VPN Is The One You Use - <AUTHOR> http://blog.justinsb.com/blog/2013/10/21/the-best-vpn-is-the-one-you-use/

<comment><USER3> My issue with this solution and sshuttle was performance is good for web browsing and other basic tasks, but good luck with more complicated higher- bandwidth stuff.

That being said I did not use it more than a few days and maybe people have better anecdotes than me. I personally would stick with a properly configuring OpenVPN, or FreeSWAN if the whole HTTP/SSL tunneling VPN systems aren't your bag.

<comment><AUTHOR> I agree that IPSEC should be the fastest & best, because it avoids the tun/tap device and works at the packet level. Anything that uses tun/tap and/or a TCP transport is not going to be as good; it needs tricks like sshuttle's very interesting ones. So I would guess that, of OpenVPN, sshuttle and OpenSSH, that OpenSSH/my script would be the worst because it uses tun/tap, TCP and has few if any tricks. But it is also the only one that "works for me", and I am very comfortable running SSH on my machines, and also with SSH security, and I find the key-trust model very simple to work with.

As to more demanding uses, I haven't tried e.g. accessing a video site like the BBC iPlayer, though maybe I should do so "in the name of science".

<comment><USER4> It's not the TUN/TAP device that gets you; it's tunneling TCP over TCP, which wrecks havoc with TCP's retransmission algorithm[1]. I've personally done measurements and the bandwidth of a TCP connection over a UDP OpenVPN tunnel is just as good as the bandwidth without using a tunnel. In contrast, the bandwidth of a TCP connection over a TCP OpenVPN tunnel is significantly worse.

You may theoretically have worse performance with a TUN/TAP tunnel compared to an IPSEC tunnel because the packets have to travel into and out of userspace whereas IPSEC stays in the kernel, but I've never noticed this in practice. In contrast, the TCP performance degradation is very noticeable in practice.

[1] [http://sites.inka.de/sites/bigred/devel/tcp- tcp.html](http://sites.inka.de/sites/bigred/devel/tcp-tcp.html)

</comment></comment></comment><comment><USER5> ssh -D24424 email@example.com worked great for me. Personally I use Proxifier for all my proxy needs, I have few of them - like a tor prosy, my vps proxy, my work proxy.

Cheap VPS with a prepaid (gift) card = poor's man VPN.

<comment><AUTHOR> Good point - thanks for bringing it up. This option gives you a SOCKS tunnel (only), which is great for web-browsing and other apps, but won't just automatically do "all traffic".

It does seem that SSH has a lot of ways to do a "VPN", some of which are better for different things. I think it is very underutilized!

</comment></comment><comment><USER6> "OpenSSH for Mac: An amazing 'VPN' that requires almost no configuration."

How is running a custom script every time you need connect 'almost no configuration'? It's all relative, I suppose, but having to procure/run a Python script just to make a VPN connection is too much hassle for me.

What Justin ought to do is wrap his script into a menubar item, and submit it to the App Store. That would truly require "almost no configuration" because:

a) downloading/installing the script would be easier, even when using a strange Mac in a cafe or lab environment

b) making a VPN connection would be no less convenient than Apple's VPN menubar item.

<comment><AUTHOR> It's not a bad idea! I'm comparing the configuration to setting up an IPSEC or OpenVPN server&client, not just the client - that involves a lot of configuration. Certainly now that the server setup is almost eliminated (you need sudo + PermitTunnel), the client script is now the "tallest nail".

I do like the fact that a script exposes its inner workings and is easy to modify. It also sounds like TCP over TCP might be sufficiently problematic (in the general use case) that this option may be unsuitable for others.

But it's definitely an interesting idea... :-)

<comment><USER6> Oh hey! Yes, configuring OpenVPN is sucky. I tried used Tunnelblik some time ago, but it was pretty flaky and I went back to using L2TP. Re: editing your script, you could always add a 'settings' option that launches your config script in a text editor (hrm, unless that's verboten now because of sandboxing).

</comment></comment></comment><comment><USER7> If you're fortunate enough to be part of a newer Windows domain, you may already be using one of the more practical VPN clients in history; DirectAccess.

As frustrating and expensive as Microsoft tech may be, it sure works wonders sometimes!

</comment><comment><USER8> You mention sshuttle .. and aside from ipv6, what does your script offer over what sshuttle does?

sshuttle crashes OSX (grey screen of death) about once a day, does your script avoid that?

<comment><AUTHOR> IPv6 was my primary motivation. The interesting thing here is that - once the tunnel is set up - we're really not running any extra software other than SSH (on the client or on the server). My script just finds unused tunnels and IPs, calls SSH and sets up networking. So it is as unlikely to crash your machine as OpenSSH is :-)

However, I would guess that a grey screen of death bug is due to a kernel- space issue, i.e. the Tun/Tap drivers. They are not built into OS X, which seems a real shame (as they're used with every user-space VPN: OpenVPN, sshuttle etc).

It is possible that sshuttle is doing something wrong causing the tun/tap drive to crash. I would guess that my script would crash as often as OpenVPN does, as I bet/hope ssh is as solid as OpenVPN. If OpenVPN crashes as often as sshuttle, then the problem is likely the tun/tap driver.

I hope to be trying this on a Mac in the next few days... just need to buy one first!

<comment><USER9> As of Mac OS X 10.6 (xnu 1456.1.26), Darwin has native user tunnels. utun devices are sockets rather than character devices and are created through a special control socket.

They behave the same as the Free/OpenBSD tunnels, in that they prepend the IP version as a 32-bit word.

See:

[http://www.opensource.apple.com/source/xnu/xnu-2050.18.24/bs...](http://www.opensource.apple.com/source/xnu/xnu-2050.18.24/bsd/net/if_utun.c)

Also: [https://github.com/bbits/openvpn- utun](https://github.com/bbits/openvpn-utun)

<comment><AUTHOR> Thank you so much for that (genuinely!). This is the reason I love HN: in this discussion we have someone that pointed out the probably-good-enough-for- the-99% SOCKS proxy (let them eat SOCKS!), and you've now pointed me to the "right" tun/tap device for Mac OS X, saving me from hours of fixing something that is obsolete.

Now I really need to get a Mac and get this working there!

<comment><USER9> Its just OS X now. Apple dropped the "Mac" part.

</comment></comment></comment></comment></comment><comment><USER10> Australian (and many other) mobile providers seem to break most OpenVPN based VPNs - there's no public IPv4 address provided anymore and the OpenVPN server doesn't seem to know how to route traffic back to the client.

<comment><USER11> Can you elaborate on this at all? I connect to an OpenVPN server while behind NAT all the time and it has worked behind almost every possible network configuration I've tried (no NAT, "home" NAT, carrier-grade NAT, cellular data, etc.).

If you want the best possible reliability, run the server on port 443 with TCP (even though UDP is almost always better for performance since TCP over TCP is icky). You have a much better chance at not being blocked by firewalls, and it actually works on a lot of the less-sophisticated captive portals without first logging in.

(Granted, the article is talking about using OpenSSH and not OpenVPN—but I suspect that should work fine behind NAT as well).

<comment><USER10> Sorry, I saw tun and tap and confused it for a configuration I've used in the past.

I'll test the 3G connection within the next few hours, however I suspect the providers have moved to block some kinds of tethering.

</comment></comment></comment><comment><USER12> Maybe you should have removed your IP from the source code before placing it on github

<comment><AUTHOR> Thanks for the heads up. But the only IP I see in there is 172.31.254.1, which is the address we assign to the host in the VPN private network - part of the 172.16... range.

Have you found a real IP I've missed?

<comment><USER12> Nope, I didn't recognize it. Please ignore my post :)

</comment></comment></comment><comment><USER13> OpenSSH is blocked by the Great Firewall in China. Thus useless for that key use case.

<comment><USER14> Tips: Do not choose the cheapest one. The PPTP service I subscribed works most of the time.

<comment><USER15> In case you don't know: Don't rely on the integrity or security of PPTP. [https://en.wikipedia.org/wiki/PPTP#Security](https://en.wikipedia.org/wiki/PPTP#Security)

<comment><USER14> In case that you want to fend off eavesdropping by NSA, you shouldn't. But I simply just want to watch youtube, browse blogspot/wordpress pages and get around of the Great Fire Wall, so I do not care.

<comment><USER15> I'm not worried about NSA here: they can track my packets even if I use secure VPN software. I'm worried about the coffee-shop-WiFi variety of attacks.

You're right that PPTP is fine for your purpose.

</comment></comment></comment></comment></comment><comment><USER16> I feel this is misleading because it's actually just an advertisement for the author's software. But keep in mind that the entire point of using a VPN is plausible deniability. You aren't anonymous because any sufficiently sophisticated adversary can monitor your traffic and the VPN's traffic and correlate the two. Your defense comes from being able to claim that another user was controlling the VPN at that time. So rolling your own VPN isn't a good idea unless it also generates false traffic.

<comment><AUTHOR> Well, my script is free + open source, so I think "advertisement" has some connotations that aren't quite fair :-) It's not really "my" software - <USER2> the real work is done by OpenSSH, which is heavily reviewed, supports NAT traversal, and you probably already have it installed. All credit to OpenSSH, all faults are my own. I would love it if this prompted a discussion of this "VPN" strategy, and my script's functionality found its way into core SSH.

It's definitely not appropriate for doing something illegal or where you want plausible deniability for other reasons. I point that out fairly clearly in the README, though I should have made it clearer in the blog.

I would wager though that many VPNs don't actually offer much more security than this. The good ones (LavaBit, CryptoSeal) did. How do you verify that your VPN provider isn't handing over this information just as readily as this approach does?

Generating false traffic is a good idea, but I don't think you should rely on that if you want to use this for illegal purposes.

<comment><USER16> Sorry, perhaps linkbait was a better term. I can't comment on the software itself, but the title is unrelated to the content.

<comment><USER17> Nah, I didn't read it that way. It seems to me it says "hey, OpenSSH can already do tunnels very effectively, but it's not very easy, so here's a quick script I wrote to make it easier".

The author gain to reader gain is really, really low in this case, so I don't think it's content-free linkbait.</comment></comment></comment></comment>


Ask HN: How can I profit off Korean peninsula peace? - <AUTHOR> Leaving morality aside:<p>I'm happy to hear that a decades long war is coming to an end, but also curious, how can one profit from it? <comment><USER2> * Translation services, not only English-Korean but I suppose that for most North Korean people, modern South Korean looks a bit foreign.

* You can look at China, now that they have less military pressure on their frontier with North Korea, they will need logistics to inundate North Korean markets. They will also need middle-men.

* You can invest in resources (books/media) that would help North Korea to convince South Korea on many difficult/political topics.

</comment><comment><USER3> Purchase land in the DMZ when it becomes available.</comment>


The profitable business of taking money from startups - <AUTHOR> http://markmaunder.com/2009/the-profitable-business-of-taking-money-from-startups/ "...You don't create something new by getting a history lesson in a crowded room." <comment><USER2> Spamming is wrong, but ultimately the market will take care of crappy conferences. If it's not worth it, people won't show up and they'll cease to exist.

<comment><USER3> The key way the market works is by information traveling around, for something like this the reputation is what matters. There are two ways for someone to find the reputation experience and reading what others have written. To that end, it is extremely important for individuals to share their experiences/perspectives so others don't have to waste their time learning about it directly.</comment></comment>


Ask HN: Who works in the VFX/CG industry? - <AUTHOR>

I'm trying to find a place like hackernews but for VFX/CG developers/research folks. Where do you guys usually hang out online?<p>My list (all focused on the art side instead of the technical side): 3d total cg channel evermotion cg society fxguide it's art <comment><USER2> I used to, but then the crunch hit the london VFX scene, and I was made redundant. I'd love to get back to a VFX company.

StudioSysadmins is a good place for VFX ops guys.

</comment><comment><USER3> reddit.com/r/vfx

<comment><AUTHOR> Nice; hadn't thought of that but looking for the more technical side of things (discussing physics engines, MCMC path tracers, etc)</comment></comment>


Show HN: faces.io – ridiculously simple video chat - <AUTHOR>

This is something fun I've been hacking on recently: ridiculously simple group chat.
Go to http://faces.io and then get your friends to do the same. That's it! :-D
Currently works best in Chrome. It's definitely beta status at best. Audio can get weird—be ready to mute. ;-)
Let me know what you think! <comment><AUTHOR> Screenshot: [http://24.media.tumblr.com/07de3da18d8a5587d9480f42e87da8c4/...](http://24.media.tumblr.com/07de3da18d8a5587d9480f42e87da8c4/tumblr_n0rz6fkSBG1qz7eo6o1_500.png)

Bonus pro tip, add a hash target in the url to have a more private conversation.

eg [http://faces.io/#hn](http://faces.io/#hn)

</comment><comment><USER2> Sweet layout - love it. Also while there was no hope of any client being able to decode that amount of video at one time I think it does show that the overheads of a RTCPeerConnection (without media) aren't extreme. My browser here has currently got about 60 peer connection objects open (not sure how many actually connected), but CPU and memory aren't going too crazy...

</comment><comment><USER2> Oh, and if you want to get a picture of what chrome (assuming you are using chrome) is doing in the background use this url:

chrome://webrtc-internals/

<comment><AUTHOR> Hey cool, I didn't know about this. Thank you!

</comment></comment><comment><USER3> This is really cool, instant video-conferencing:

        sha1=$(head -c 1024 /dev/urandom | shasum | cut -d ' ' -f 1)
        open http://faces.io/#$sha1

send the URL to whoever you want to video-conference with.

</comment><comment><USER4> This weekend I made text chat with video and no voice for hackathon. Demo is here: [http://ss14-team-176.divshot.io](http://ss14-team-176.divshot.io) Also used webRTC like in faces.io

</comment><comment><USER5> Whats the limit on concurrent callers? We have had to stop using google hangouts for our morning standup due to more than 9 of us being on at times.

</comment><comment><USER6> "This is the hackiest code I've ever written. Most of it is copy pasted from elsewhere. ;-)"

I see...

<comment><AUTHOR> Isn't there a rule about if you're not embarassed about your 1.0 then you're not shipping fast enough? ;-)

Basically I just wanted to try out some ideas using WebRTC peer-to-peer video with some clever layout algorithms.

When I started this I was looking into libraries like Packery that are good at arranging rectangles in the smallest possible space. But I found what I really wanted was something to expand to fill all available space.

I ended up using D3's treemaps to arrange videos. Normally they're used for visualising things like diskspace, but I'm using it to fill the screen with videos.

[https://github.com/mbostock/d3/wiki/Treemap- Layout](https://github.com/mbostock/d3/wiki/Treemap-Layout)

</comment></comment><comment><USER7> "Could not connect stream" ?

<comment><USER7> Nevermind, its because I was using the webcam on a different window (Google Hangout).

</comment></comment><comment><USER8> it's chatroulette right now

</comment><comment><USER9> Very cool! Upvoted.

</comment><comment><USER10> Very, cool

</comment><comment><USER11> good work!</comment>


Show HN: Diwata – a user-friendly database interface for PostgreSQL - <AUTHOR> https://github.com/ivanceras/diwata <comment><USER2> This looks awesome. Does it work with CockroachDB?

Because I was imagining something like Knex when I read "interface for" I'll mention that this is a Graphical User Interface.

<comment><AUTHOR> CockroachDB claims to have compatibility with Postgres, but I wasn't able to make a cockroach db sample database using the postgresql dump files(cockroachdb doesn't seem to support schemas). I'll have to revisit it again to make the project work with cockroach db.</comment></comment>


Build a viral project. Don't build a project hoping it will go viral. - <AUTHOR> http://gurukhalsa.me/2011/build-a-viral-project-dont-build-a-project-hoping-it-will-go-viral/

<comment><USER2> I think we can make better recommendations than that.

Build something people want and you have yourself not only a viral project but a customer.

<comment><AUTHOR> I don't disagree, but a little of both goes a long way. Having something people want is unhelpful if people don't know about it.</comment></comment>


Excessive Specification of Test Doubles - <AUTHOR> I wrote a blog post about excessive specification of test doubles and the issues that it creates.<p>https://principal-it.eu/2020/05/excessive-specification-of-test-doubles/ <comment><USER2> Submit the title and URL. A further explaination can be added as first comment (though in this case it adds no new information).</comment>


Spam has fallen to a 10-year low and is unlikely to make a comeback - <AUTHOR> http://qz.com/468694/spam-has-fallen-to-a-10-year-low-and-is-unlikely-to-make-a-comeback/

<comment><USER2> Don't jinx it!</comment>


Jeffrey Epstein's Death Was on 4Chan Before Officials Announced It - <AUTHOR> https://www.buzzfeednews.com/article/janelytvynenko/fdny-review-jeffrey-epstein-4chan-post <comment> 52-6F-62 A lot of people are stepping out to defend 4chan, but the article isn't about 4chan. It's a detail in the story.

The story is that someone close to the situation leaked details in violation of HIPAA on an internet message board.

And from a correctional facility, no less. The whole thing is a mess.

 _edit: spelling_

<comment><USER2> _in violation of HIPPA_

HIPAA would cover healthcare in prison. It wouldn't cover, say, what prison guards can talk about.

They may have other rules that indicate this is inappropriate, but HIPAA covers specific institutions, such as hospitals, medical personnel generally and health insurance. It doesn't actually cover anyone who ever learned anything about your health for some reason.

<comment> 52-6F-62 I wasn't speculating on the content of the article so much as just speaking to what it's actually about when many commenters were focusing on the fact that 4chan was in the headline.

I generally had otherwise considered correctional facilities to be rather mum—but it's a little different here in Canada.

<comment><USER2> Your general point is accurate. It's generally not acceptable to leak such info.

But this is only a HIPAA violation if it was leaked by medical personnel (or some other covered entity). At this time, we don't know who leaked it, so we don't know that HIPAA applies.

The article suggests it probably doesn't. It was apparently reviewed and found to be some third party, not EMS personnel.

<comment> 52-6F-62 This is a side question to your points—and completely hypothetical for my own curiosity:

In this case would a guard leaning into the cell, watching and listening to the revival or treatment attempts by EMT personnel and leaking that information approach these laws in anyway?

For instance if Epstein was living and being treated but on the verge of death and the EMT staff didn't make any attempts to prevent spectators who proceeded to leak the information—

who would be at fault in such a case? Or does that also fall outside of HIPAA in the US?

<comment><USER2> HIPAA has a _minimum necessary_ standard of disclosure. Ideally, EMS staff should try to put a stop to lurid interest of that sort (keeping in mind that their first focus will be emergency medical care, not policing who happens to be nearby, possibly for legitimate reasons) and could be held liable if what was leaked was due to things _they actually said to a third party._

But I think you would probably have to pass a test of _reasonableness._ If you are getting medical treatment in a public space, there's only so much EMS can do to protect your privacy.

In practice, it's really hard to strictly comply with HIPAA and many institutions routinely violate it in small ways.

From what I gather, law enforcement, such as prison guards, have their own rules covering confidentiality. But I don't think a prison guard would be covered by HIPAA. A leak by a prison guard would have to be dealt with via other channels.

<comment> 52-6F-62 Thanks for the insights and humouring my curiosity!

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> This really shows the value of anonymity on the internet. Buzzfeed may try to label 4chan a "haven for far-right trolls and white nationalists" but it's exactly the type of platform we need right now. It's at the very least a check on mainstream media, which has proven itself very untrustworthy.

<comment><USER4> How does this show any of that? That reported by the channer wasn't materially different than what was reported by the mainstream, they just broke the story earlier and, as mentioned, possibly by doing something illegal.

To be clear, I'm not saying there's anything wrong with anonymity on the internet. But anonymity on the internet, this story showing the value of that anonymity, and this relating the the mainstream media aren't at all related, at least in my mind. Mind clarifying?

As I see it, one can be anonymous on, say, twitter, which is still moderated, and therefore has (less) open organization of "far-right trolls and white nationalists". So its not clear to me what unique anonymity 4chan provides.

<comment><USER3> It's valuable because you can compare what the media reports to what was posted on 4chan and look for discrepancies. It _may_ also keep the media reporting more honest as they know the story broke on 4chan and deviations will be noticed.

Twitter is an ultra short form platform that has already demonstrated political censorship. It also requires account verification through email and sometimes phone number. I don't think it compares to 4chan for something like this.

<comment><USER4> > It's valuable because you can compare what the media reports to what was > posted on 4chan and look for discrepancies.

This only works if you hold 4chan to be _more_ reliable than the media. Given its history (think, like, QAnon) and love of trolling, this doesn't really work. This story was notable mostly because 4chan is notoriously unreliable.

> Twitter is an ultra short form platform that has already demonstrated > political censorship.

Right, but you said that anonymity was important, not censorship. Is anonymity important, or is lack of censorship what matters? They're not the same thing.

<comment><USER5> > > It's valuable because you can compare what the media reports to what was > posted on 4chan and look for discrepancies.

> This only works if you hold 4chan to be more reliable than the media. Given > its history (think, like, QAnon) and love of trolling, this doesn't really > work. This story was notable mostly because 4chan is notoriously unreliable.

IMO, it also works if you view them both as unreliable but in different ways. Them agreeing is a stronger signal of truth than either independently.

<comment><USER6> I agree.

I keep up with current events mostly through a couple of very popular niche forums, each with a few hundred thousand members. The news posted there is biased, of course, but mostly it's a selection bias. I use it because my interests (if not necessarily my perspective) overlap with those forums' topics. When I find something that piques my interest, then I'll seek out other sources for that particular story.

I spend the majority of my "what's going on in the world?" time on ar15.com - but I don't assume that the stories posted there are accurate. I judge the reputation of the source from which it came, and if it's contentious, I'll purposefully look for alternative reporting.

The bottom line is that _no_ news outlet, "mainstream" or not, is without bias. There are decisions made on what constitutes news and stories are editorialized both explicitly and implicitly.

There was a time when I spent a decent amount of time on 4chan, but the SNR is so low these days and the format is so hard to keep up with that I haven't bothered in years. Instead, I watch secondary sources who are watching the chans.

<comment><USER7> I haven't read ar15.com but at first glance my thought was: "Why would you hurt yourself by filling your head with such nonsense instead of just reading all or part of some reputable news service?"

People don't acknowledge the long-term costs (social or otherwise) of not making the right choice in this area. Spend too much time playing Sam Harris and now your wife is embarrassed to bring you to parties for fear of an outburst about Muslims. Read some other forum and now you're fixated on weird parts of the news and an oddball narrative. Read an even worse forum and you're dragged into political radicalization. These things happen everyday and we're all at risk.

<comment><USER8> Cut the alarmist nonsense. Anyone like me who has critical thinking skills isn't at risk of political radicalization. And I don't care to be told what the "right" choice is.

<comment><USER7> Dislike

<comment><USER9> You don't have to like something for it to be correct.

<comment><USER7> Getting your news from ar15.com is not correct in any meaningful interpretation

<comment><USER6> Who said they "get their news from ar15.com"? I said I keep up with current events through that forum (and others). It serves as an aggregator for political topics for me in much the same way that this site serves as an aggregator for tech topics.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> It was predicted by almost everyone that he would die somehow before revealing whatever information he may have had, so it was not surprising in the least. Further, 4chan is not a secret club -- you go to the site and you can create however many threads you wish, and reply to whoever, however, and however many times you want, no registration or signup process exists, so it's not surprising that Epstein's death, conspiracies of which run rampant on 4chan, would be leaked randomly by someone involved in dealing with the situation, it happens all the time actually.

<comment><USER11> Read beyond the headline. Specifics about attempts to revive him (including drugs used) were also shared before they were public information.

<comment><USER12> But also, generic information, as the expert reviewing the post remarked. On the other hand, the apparent correct use of jargon does seem to indicate that the poster could be an EMT themselves.

</comment></comment></comment><comment><USER13> For those that don't read the article, someone posted about the medical response to Epstein's suicide on 4Chan before the news picked it up. A lot of people had access to that information at the time.

<comment><USER14> So some 4channer was presumably listening to police/EMS scanners for the area of the prison Epstein was in and "got the scoop" that way?

<comment> matt-attack Or the 4chan user _was_ one of the medical staff, EMT, prison guard, prison employee, ambulance driver, anything.

All this is about is a HIPPA violation but I'm not sure why HIPPA would apply when the person is dead. How can you wrong a dead person? Are the dead still guaranteed privacy rights? Seems a bit odd to me.

<comment><USER15> "The HIPAA Privacy Rule protects the individually identifiable health information about a decedent for 50 years following the date of death of the individual."

[https://www.hhs.gov/hipaa/for- professionals/privacy/guidance...](https://www.hhs.gov/hipaa/for- professionals/privacy/guidance/health-information-of-deceased- individuals/index.html)

</comment></comment></comment></comment><comment><USER16> And that was on reddit before buzzfeed found out :P

</comment><comment><USER17> > We looked at the information provided by [a BuzzFeed News] reporter

Buzzfeed is worried about HIPAA violations. Good thing to worry about in general, but perhaps this is not the best case to champion that cause...

They could look into the type of plea deal he got previously and why he got it. Or, say, comb through all the recently unsealed evidence and compile a spreadsheet of who flew to his island and how often. Now, that would make some good investigative reporting.

<comment><USER18> Buzzfeed is not bound by HIPAA, because they are not medical personnel nor a medical institution.

<comment><USER17> Sure, but they made sure to investigate this worrying case of HIPAA violation by asking department heads for comments and seeing if they are looking to find the leaker. In other words, amongst all the things to investigate around Epstein that particular one seems like an odd choice.

<comment><USER19> The media is generally regarded the same when publishing both medical history information and classified materials. If they obtain the information during their regular course of business and report on that obtained material, then they are protected as reporting on a story that is beneficial to the public. If they coerce others or help to obtain protected information, whether classified materials or PHI/PII, then they can be held liable for the release against the existing laws regulating disclosure.

</comment></comment></comment></comment><comment><USER20> Unclear to me why people seem to think that a major station announcing something that they got (very generally) from some official release makes the same info (obtained some other way) nefarious in nature. Could be as simple as someone at the prison who saw what happened (employee or guard) and relaying it to someone by cell phone. I would find it hard to believe that doing so would break a law that would involve a significant penalty or risk. For that matter even the ME office driver (or whatever was used) might have had early wind of what was going on and relayed it to a third party. Who cares? I am sure they don't sign NDA's for this type of thing.

</comment><comment><USER21> This was posted on HN yesterday, but was flagged for some reason. Does anyone know why? [https://news.ycombinator.com/item?id=20687284](https://news.ycombinator.com/item?id=20687284)

<comment><USER22> Probably because it's too mainstream, which is actually against the rules (◔_◔)

> Most stories about politics, or crime, or sports, unless they're evidence of > some interesting new phenomenon. Videos of pratfalls or disasters, or cute > animal pictures. If they'd cover it on TV news, it's probably off-topic.

Also because anybody can flag something for any arbitrary reason, regardless of what the rules say.

<comment><USER23> Off topic, but on phone the « flag » link is super tiny and close to date (permalink). I have accidentally tapped it while scrolling more often than I realise.

</comment></comment></comment><comment><USER24> who cares? Why is this at all surprising or interesting?

</comment><comment><USER25> so one of the 1st responders has a 4chan account. what exactly is the big deal here (besides the fact he/she probably broke the law)

<comment><USER12> Not sure if you're aware, but we all "have" a 4chan account. Meaning, you don't need an account to post there. It's kind of the point of chan-like boards.

<comment><USER25> i was not aware of that. honestly - i have tried to check out the site multiple times but the layout of the conversation is so confusing to me i give up every time.

</comment></comment></comment><comment><USER26> And this fact was pointed out on 4chan several days ago

</comment><comment><USER27> I absolutely love that hn doesn't buy this bs

<comment><USER28> I can't tell if you're referring to the suicide report it or the idea it was actually a murder.

</comment></comment><comment><USER29> So is unregulated news the real reason they want the rest of the chans shut down? It seems 4chan at least, already capitulates to all LE demands.

<comment><USER10> Improbable. Liveleak, Abovetopsecret, WorldStarHipHop, and Twitter (to some extent) all have unregulated news feeds, are pretty popular, and have "in- groups". They all have content moderation to stay on LE's good side and despite hosting violent content, actively try to prune content that violates laws. This includes 4Chan. 8Chan was a different story though, there was almost 0 effort to moderate content. Few people seem to remember a couple of the largest boards on 8Chan for some time were pro-pedophilia boards, and they stayed up for quite some time. Of course, the actual underbelly of those boards were composed of creating and sharing material through other sites and applications, and announcing this through 8chan. They could not take down the board without defeating the purpose of the site, and could not keep it up without voluntarily allowing for a breeding ground for illegal material, so many of their vendors wanted them off their platform for a while because they could not be moderated effectively.

I think it boils down to - can you reasonably catch illegal content being routed through your platform? 4chan, LiveLeak, WorldStar, ATS, and Twitter all have ways of doing this, 4chan's may be more crude because there are certain things you cannot do on 4chan because of the way the site is designed (for instance, webm's with sound are isolated to a few boards, so you lose a channel of communication when posting them outside of those boards, and you cannot upload documents directly except through labyrinthine methods, many users don't want to click a link and be taken to a different site so you lose that population, etc.), but it does the job to LE's standards. Many people hate it, but there is no benefit in taking it down because the culture would simply migrate elsewhere.

</comment></comment><comment><USER30> Jeffrey Epstein's death was predicted by 50% of the population before officials announced it.

<comment><USER31> This wasn't a prediction, it was someone saying what happened when it happened before it was reported in the media.

<comment><USER32> With details of medical treatment that would be administered in the case of a heart attack. Interesting that we have no details of what induced said heart attack.

</comment></comment></comment><comment><USER33> 4chan is basically a million monkeys on typewriters, so it's unsurprising they've managed to predict the death of Epstein. Let's not forget that every man and his dog on reddit and elsewhere immediately predicted this guy would get suicided. It was as predictable as the tide going in and out.

<comment> matt-attack Why is is hard to believe that any of the probably 20 or 30 people involved in managing his death went it 4chan to post about it? There were many people who knew of his death beforehand from jail personnel, prison guards, EMT, hospital nurses, Doctors, other hospital staff.

Why wouldn't one of them have just broken the news? Frankly I don't see how it's worse for them to break the news to 4chan than for the prison to break it to ABC news. He was dead and they announced it. Why does everything have to be "official"?

<comment><USER34> Because mainstream corporate media has trained us to believe "journalism" consists of a media conglomerate regurgitating official press releases, access journalism, and every now and then some intrepid reporter backed by a multimillion dollar company discovering some scoop.

The idea that regular folks can disseminate true information on their own is very disturbing to a lot of people.</comment></comment></comment>


Google's New Open Source Privacy Effort Looks Back to the 60s - <AUTHOR> http://blogs.wsj.com/digits/2014/11/07/googles-new-open-source-privacy-effort-looks-back-to-the-60s/

<comment> chestnut-tree This is encouraging news.

Google amasses absolutely gargantuan volumes of data about people's online behaviour. Yet, their privacy policy remains very poor [1].

If you have a Google account, Google has your name, date-of-birth, gender, and (possibly) mobile phone number. Couple that with the searches and sites you visit and that is incredibly personal information about you.

Yet, in their privacy policy, Google fails to mention:

\- whether the data they collect about you is anonymised (and what they anonymise)

\- how long they keep your data for

\- whether the data they collect about you is disasscociated from your identity

\- who sees your data at Google. GMail automates scanning of your emails. Does this hold true for all the other data they hold about you? After all, your activity across the web is arguably just as personal and private.

Google also states that you can delete your web history but fails to confirm if that data is wiped from Google's servers or merely from your dashboard.

It's depressing how easily Google gets a free pass on matters of privacy.

I challenge anyone to explain why you would purposely omit the information listed above. It is exactly what you would expect to find in a privacy policy, especially from a company that arguably tracks online behaviour more than anyone else.

[1] [https://www.google.co.uk/intl/en/policies/privacy/](https://www.google.co.uk/intl/en/policies/privacy/)</comment>


Visualizing Neural Nets as Images - <AUTHOR> http://mikesollami.squarespace.com/code/2016/7/13/visualizing-neural-networks <comment><AUTHOR> Viewing neural nets as mappings of 2D space gives us a nifty way of seeing see what deeper architectures can do.

<comment><USER2> Did you try other architectures? What frameworks are you using?</comment></comment>


Huawei Open Source Platform and the HarmonyOS OpenArkCompiler Project - <AUTHOR> https://code.opensource.huaweicloud.com/HarmonyOS/OpenArkCompiler/home <comment><USER2> They promised to release source in August and they seem to have worked hard to make the deadline. But they're following the "throw code over the wall" open source model, with important parts yet to be released. The compiler toolchain so far only supports compiling some Java samples, full support for Java and JavaScript will only be coming later.

From the readme: [https://code.opensource.huaweicloud.com/HarmonyOS/OpenArkCom...](https://code.opensource.huaweicloud.com/HarmonyOS/OpenArkCompiler/file?ref=master&path=Readme.md)

 _开源计划

编译器框架代码开源

时间:2019年8月

开源范围:编译器IR+中端语言实现

开放能力:

框架开源供参考学习,了解方舟编译器架构及框架代码

开发者可构建出完整编译器工具链,支持Java Sample程序编译(非应用)

后续开源范围

陆续开源编译器前端、后端、编译优化;完整支持Java程序编译、JavaScript语言应用的编译等。

计划持续更新..._

EDIT: since most readers on HN probably can't read Chinese, you might be interested in the documentation for the intermediate representation, which is in English: [https://code.opensource.huaweicloud.com/HarmonyOS/OpenArkCom...](https://code.opensource.huaweicloud.com/HarmonyOS/OpenArkCompiler/file?ref=master&path=doc%2FMapleIRDesign.md)

</comment><comment><USER3> The website wouldn't load for me on Firefox (android and linux) but did load on chrome on linux...</comment>


Is Apple Poised To Take Social Seriously With Media Stream And Find My Friends? - <AUTHOR> http://techcrunch.com/2011/01/19/apple-ios-social/ <comment><USER2> I guess they've got to have something planned for that shiny new data center in North Carolina. You don't build that kind of facility on a whim.</comment>


Google India gets Income-Tax Dept notice for not revealing correct revenues - <AUTHOR> http://economictimes.indiatimes.com/tech/internet/google-india-gets-i-t-notice-google-has-not-revealed-correct-revenues-as-per-tax-assessment-order/articleshow/11025572.cms

<comment><USER2> From the below link: [http://economictimes.indiatimes.com/tech/internet/govt- wante...](http://economictimes.indiatimes.com/tech/internet/govt- wanted-358-items-removed-from-googles-services-including-youtube-orkut-in-jan- jun-period/articleshow/11020860.cms)

"In addition, we received a request from a local law enforcement agency to remove 236 communities and profiles from Orkut (Google's social networking site) that were critical of a local politician. We did not comply with this request, since the content did not violate our community standards or local law," it said.

And then the tax notice happens.

</comment><comment><USER3> Interesting how this came days after demanding Google (and the others) pre- screen and censor user content. In a country filled with corruption it's very easy to bust businesses on _anything_.

<comment><USER4> For reference, the 2011 Transparency International "Corruption Perceptions Index" infographic again: [http://www.gizmag.com/transparency-international- corruption-...](http://www.gizmag.com/transparency-international-corruption- perceptions-index/20730/picture/149952/)

India is _squarely_ in the Red Zone.

Notice also how well the corruption index correlates with national prosperity. All the rich Western countries + Japan are yellow/orange... well, Italy and Greece are red, but everyone knows their economy is in the toilet, and I mean even more so than is usual these days...

<comment><USER5> Incometax department in India is a harlot working for the Congress party government which itself is ruled by an Italian lady suspected to have Nazi and KGB connections in past. Any business, person standing against government receives income tax notice. A people driven movement Indian Against Corruption was also targeted in similar fashion so was Yoga Guru Ramdev baba. This is India. One of the most corrupt country in the world.

<comment><USER2> There is proof of the Government's corruption, and some pointers to indicate it misuses the Income Tax department. But what proof can you present of the 'Italian lady's Nazi and KGB connections'? Let us keep discussions on this forum free of innuendo.

</comment></comment></comment></comment><comment><USER6> Google does deserve to get rapped for pulling the shenanigans that it does with the Irish taxation hole.

The timing of this notice is a bit suspicious however. The Income Tax department is one of the favourtie ways that the those in Power decide to get their Vendetta and pressurize those that speak out.

Check out this Income Tax Notice that a popular Anti-Corruption crusader (Arvind Kejriwal) got just days after launching an agitation [http://www.deccanchronicle.com/channels/nation/north/annas-a...](http://www.deccanchronicle.com/channels/nation/north/annas- aide-arvind-kejriwal-attempts-fight-income-tax-notice-907) This govt. really has no compunctions using any and all means to get its way. It fully expects that Google will now become more pliant the next time they request something. OR ELSE...

Mafioso Tactics at their best.

</comment><comment><USER7> This is Govt Of India's pavlovian response to whenever they feel threatened by any entity. Their first response is to slap an Income Tax notice on them. They did the same thing to some of the anti corruption league members when their movement became too popular for govt's comfort. But for some strange reasons they are very protective of people who have stored trillions of ill-gotten assets overseas even though the foreign governments are ready to provide the information.

<comment><USER8> Happens in China too. For example, with the artist Ai Wei Wei

</comment></comment><comment><USER9> I haven't read the article but reading the title, something comes to mind instantly - how Google saves billions of dollars by using a complicated structure to send most of its overseas profits to tax havens, keeping its overseas rate at a super-low 2.4 percent.

Ah! Found the article - The Tax Haven That's Saving Google Billions - [http://www.businessweek.com/magazine/content/10_44/b42010431...](http://www.businessweek.com/magazine/content/10_44/b4201043146825.htm)

So, the government assumes Google India ought to be filing more tax instead of the meagre that goes into the Indian Treasury?

<comment><USER10> Speaking from experience, this kind of thing might - just - also be a clerical error. Not so long ago, a place I used to work for got one of these notices because the Tax Department didn't agree with how we had calculated tax. Accounts did manage to sort it out, in the end.

</comment></comment><comment><USER11> India hurts itself more than it can hurt Google with this idiotic stunt. The high speed Internet availability in India is pathetic and so the revenues for Google in India should be relatively very small. But the perception that the government is fucking with Google is very bad for India.

This coming from politicians who are the most corrupt is sad. India is not in as powerful a position as China is to make these kinds of demands. They are stupid enough to try to saw off the branch they are sitting on.

<comment><USER12> If google is breaking the law then the government ought to act against them.

<comment><USER4> See, that's how they get you. Byzantine laws, so everyone is a criminal (citizen or corporation), and then they can crush you whenever you don't kowtow to their demands.

It's not exactly something to celebrate.

I mean, maybe, just possibly, maybe, perhaps, who knows, Google is doing something deliberately shady and evil here and the government _just happened_ to notice just _days_ after they told some censorship people to sod off. And if you believe that, I also have this lovely bridge which I would like to sell you.

You're an enabler.

<comment><USER13> You do realize that they use a similar loophole in the US too to avoid paying taxes, right? India is calling them on their bullshit, whereas the US Congress etc have been bought off. Time to buy the Indian politicians also.

</comment></comment></comment></comment><comment><USER14> People might related this issue with recent indecent of content supervisory, but I think because of nature of business of google or any other online company who do business over the world there might be some real issue with tax. I am not saying google is doing something wrong but they might have to do things differently.

<comment><USER5> Income tax department in India in not known to be diligent in any sense. They havent been after A. Raja., Kalmadi, Sheila Dixit , Chidamberam, Robert Vadra etc. But the moment someone refuses to bend before the mafia government of India they suddenly get active. Very fishy.

</comment></comment><comment><USER15> On related note Income-Tax Dept is lead by talented officers, you may read subtitles on this 4 minute video interview of former Income-Tax Commissioner <http://www.youtube.com/watch?v=ApQlMm39xr0>

</comment><comment><USER16> Finally, Google becomes a real "LOCAL" company in India.

<comment><USER4> The difference is that Google, if they feel like it, can easily afford to drop a few million on a legal battle like this one. Would that "LOCAL" indian businesses were so lucky.

</comment></comment><comment><USER17> Someone must have forgot to send out the weekly bribes. India - Only the 87th least corrupt nation!</comment>


Picplum (YC S11) aims to make photo printing effortless - <AUTHOR> http://www.xconomy.com/san-francisco/2012/08/16/point-shoot-print-picplum-aims-to-make-photo-printing-effortless/

<comment><USER2> I sent my family some photos from Picplum recently. I was very satisfied with the quality of the photos, but the experience wasn't as nice as this article, and it cost about five times more than their competition. At a 5x price premium for 4x6 (and 5x5 Instagram prints are double the 4x6 price), I'm not sure there could possibly be enough ease of use to turn me into a regular customer.

And I didn't see all this fantastic ease of use - the uploader got stuck and did not display the result a few times, and the browse has no good clear-to-me way to view large images before selecting and uploading them, so if you have 2 shots of the same thing you have to tab out to an external photo viewer to pick the better one. I ended up doing all my picture selection in picasa then hunting for filenames in picplum.

I liked the quality but I just wasn't impressed enough to justify using it regularly. Apparently they have some good ideas like you can set it up where you e-mail pictures in and they batch them up and mail them out to your family, but that just seems to me like a way to rack up another cell phone sized bill each month.

</comment><comment><USER3> I'm a happy Picplum user, and have been since launch. Here's why I'm a customer: when I take a photo of my daughter on my iPhone, sending it to Picplum means automatically delivering prints to my parents and grandparents without any additional thought or effort on my part. Snap, send, done.

My wife and I both run businesses, so the probability of us going to Costco, printing five sets of photos, packaging them, applying the right amount of postage, and dropping them off at the post office every single month is 0%.

Picplum is the difference between my family receiving many photos every month vs. none at all.

</comment><comment><USER4> So, he's comparing importing photos from Flickr to drag and dropping pictures onto Picplum? Wouldn't a more fair comparison be to go directly to Snapfish and upload the photos to it?

</comment><comment><USER5> Or, if you have a Mac, you can just order your prints from within iPhoto.

It's at least as convenient and 2 to 4 times cheaper.

<http://www.apple.com/ilife/print-products.html#prints>

</comment><comment><USER6> Photo printing for me at home is already effortless, its just costly. I prefer a method for far cheaper prints.

<comment><USER7> I don't often print photos but when I do I usually use walmart or walgreens online service (though I've found walmart easier to get through). And this is because they offer the size of pictures I want like larger frames and stuff. I looked at picplum and just don't see the point because of the limitation of cheap (quality) 4x6 prints.

Edit: I guess they have added larger photos but walmart is still cheaper and offers good quality in the mail.

<comment><USER6> I've also used target's printing however the quality is pretty grainy.

</comment></comment></comment><comment><USER8> isnt <http://www.picwing.com/> on the front page of ycombinator? Doesn't that do this?

<comment><USER9> Picplum acquired the assets of picwing and essentially relaunched the product, but with the same business model.

</comment></comment><comment><USER10> it may be marginally easier to drag/drop photos to picplum, but its 3-4x more expensive than using Costco's photo web service. And some of those extra steps with Flickr or other sites are necessary, for example selecting the paper finish and border style.

This is optimizing something that isn't broken. It may not be as slick, but I'm loosing features and paying three to four times as much for the privilege by using PicPlum.</comment>


Fifty states with equal population - <AUTHOR> http://fakeisthenewreal.org/reform/

<comment><USER2> To be honest, I'm actually most interested in the origins of all of the proposed state names. Some are obvious, others less so.

<comment><USER3> Ogallala is the name of the Aquifer under the area and it is a horribly misspelled version of a Lakota tribe.

</comment></comment><comment><USER2> I understand that this is an art project, not a real proposal, and think it is incredibly interesting. But the idea of states being redistributed after a census seems crazy to me. How would you reorganize state governments?</comment>


Ask HN: Advice for Multiplayer Back End - <AUTHOR> Lately I've been yearning to make simple multiplayer Javascript games with as much ease as simple single player games, for the sake of prototyping with friends. I have a sneaking suspicion that for discrete (turns or timers) match-based games, you could have a Firebasey store synchronized between clients and an authoritative server built on top of web sockets, such that the programmer doesn't have to design a new protocol for every game. The reason I don't reach for Firebase immediately is partly due to lock-in/pricing concerns, and because I imagine there would be a simpler tool with the above constraints in mind.
I've stumbled across https://colyseus.io/, but it doesn't look like it quite fits my needs.
Does anyone know of a library out there with the mission of Colyseus, the behavior of Firebase, and simpler than both? Alternatively, has anyone had a pleasant experience building a discrete game with Firebase? <comment><USER2> >>> doesn't have to design a new protocol for every game

There may not exist any level of abstraction sufficient to encapsulate ALL turn based strategy mutliplayer internet games ;)

I kind of think you want to design a new engine specific to each game. First I don't think you will save much effort via code re-use. Second you need that flexibility when changing game parameters, rules, board size, player mechanics etc

The other possibility is to design bottom up. Observe what's possible at current public cloud latency and cost. And then design the game around those constraints.

For private hosted game rooms with limited numbers of players, any in-memory cache will do on the host vm. Use any realtime API gateway to sync. Or host static HTML5 assets on S3 and Cloudflare KV for "live" game state, dumping finished game data to plain disk files.

Best of Luck!

</comment><comment><USER3> I just open sourced my multiplayer game engine. Give it a look: [https://github.com/moddio/taro](https://github.com/moddio/taro)

<comment><USER4> nice work!

</comment></comment><comment><USER5> I went with Colyseus for my multiplayer bananagrams prototype. It's not quite the use case, but it did make life easier after figuring out how to model the game with Colyseus's state mechanics.

Basically you apply game logic on the server to mutate game state, which is automatically synchronized to each client. It's been a few months and I don't have the code in front of me, but can give more details later if you'd like.

</comment><comment><USER6> I dont have answers to your questions but you might want to prefix the post with "Ask HN: ". It will drive better reach.

</comment><comment><USER7> You might find [https://boardgame.io/](https://boardgame.io/) helpful

<comment><USER8> Boardgame.io is good but it doesn't have timers, iirc

</comment></comment><comment><USER9> Playfab offers multiplayer servers as a selling point, but does not solve your vendorlock concern.

The combination of Playfab's player data + multiplayer server functionality sound like what you're looking for though.

</comment><comment><USER10> Check out Nakama by Heroic Labs.

[https://heroiclabs.com/nakama-opensource/](https://heroiclabs.com/nakama- opensource/)

</comment><comment><USER11> I'd build it with meteor, mostly because I'm used to it. It's excellent for prototypes and real time by default

<comment><USER11> There's some lock in in terms of framework specific code but no lock in of your data,it's just a mongo dB. The reliance on mongo means it's always a bit tricky to make join-like calculations, but otherwise I'd really recommend the meteor stack. For hosting as a side project I'd recommend a shared digital Ocean droplet, you'll get much better performance than heroku. Use "meteor up" to deploy. It will be 5usd per month but you can host many small apps on one droplet</comment></comment>


Google patents generation of output sequence from input using Neural Net - <AUTHOR> http://www.freepatentsonline.com/10402719.html <comment><USER2> Claim 1:

A method comprising: obtaining an input array; using an encoder recurrent neural network to generate a hidden state for each input; and generating output by: generating an attention vector for the position in the output order; using the attention vector to generate a sorting weight; using the sorting weight to get, a pointer to a particular position in the input order;

So basically, sort an array by neural network. How is this novel?</comment>


Sketch Lab - User interface / website sketching tool - <AUTHOR>

An awesome user interface / website sketching tool was just released a few days ago. You can try it out at http://www.sketchlabhq.com <comment><USER2> It may be an awesome tool, but the site needs a serious design overhaul!

The ALL-IMPORTANT 'sign-in/sign-up' link is tucked away, unobtrusively, in the top right corner.

The 'Public Sketches' aren't very attractive, and the demo video just shows the creation of an arbitrary, uninteresting design. Some solid, beautiful examples are essential.

Plus a succession of other design disasters...

These links may be helpful: <http://news.ycombinator.com/item?id=1604693> [http://visualwebsiteoptimizer.com/split-testing- blog/landing...](http://visualwebsiteoptimizer.com/split-testing-blog/landing- page-best-practices/) [http://visualwebsiteoptimizer.com/split-testing- blog/landing...](http://visualwebsiteoptimizer.com/split-testing-blog/landing- page-optimization-tips-increases-sales-conversions/) [http://www.formstack.com/the-anatomy-of-a-perfect-landing- pa...](http://www.formstack.com/the-anatomy-of-a-perfect-landing-page) [http://designinstruct.com/visual-inspiration/visual- inspirat...](http://designinstruct.com/visual-inspiration/visual- inspiration-30-beautiful-web-app-site-designs/)

In terms of competition, there's Balsamiq mockups, a slick, established operation. What tangible advantages does SketchLab offer...?

<comment><AUTHOR> Balsamiq Mockups it too complicated. Sketch Lab is simple and easy to use. It is much easier to make sketches with it. The website design is a work in progress. Be patient. It was just released a few days ago. There is a lot of potential here.

<comment><AUTHOR> Oh, and also, Sketch Lab is a web app, so you can access your sketches from anywhere in the world, and you can share them with the world. As for the current public sketches, it was just released, so not so many users made their sketches public yet. Give it some time.

<comment><USER2> Good to hear! ;-)</comment></comment></comment></comment>


Initial Pricing Will Never Be Right, But Try Anyway - <AUTHOR> https://thebootstrappedfounder.com/your-initial-pricing-will-never-be-right/ <comment><USER2> The word you want in your headline isn't "So" but "But".

<comment><AUTHOR> Thanks! Good point.</comment></comment>


Websites are becoming intelligent, so are website hackers - <AUTHOR> https://medium.com/@Shikhil/websites-are-becoming-intelligent-so-are-website-hackers-63e38d43911c#.ixdcouxwz <comment><USER2> FYI: This reads like an antivirus advertisement for nontechnical users.</comment>


Why no Easter Eggs? (2005) - <AUTHOR> https://blogs.msdn.microsoft.com/larryosterman/2005/10/21/why-no-easter-eggs/ <comment><USER2> There was an article some time ago (also on HN) about a Linux command line tool which had an easter egg on a particular date/time - it's output was slightly different, and this broke some build scripts in another project, and as you can imagine, it was hard to pin down.

Then the easter egg was removed and people were complaining that "it's takes the fun, the human out" (as you can also see here)

But what if every command line tool had an easter egg at a particular date/time? Then on every day of the year one of your tools would misbehave. Is this really what we want? What if a safety critical process gets broken because of this.

A recent example:

> We've noticed that some of our automatic tests fail when they run at 00:30 > but work fine the rest of the day. They fail with the message "gimme gimme > gimme" in stderr, which wasn't expected. Why are we getting this output?

[https://unix.stackexchange.com/questions/405783/why-does- man...](https://unix.stackexchange.com/questions/405783/why-does-man-print- gimme-gimme-gimme-at-0030)

<comment><USER3> The obvious response to this is that there are two kinds of easter eggs.

The good kind doesn't do something one way a million times and then suddenly produce a different result given the same input for no good reason like your example date/time shenanigans.

Unpredictable behavior is called not being dependable. Not being dependable is called untrustworthy. Software should always strive to be predictable, dependable, and trustworthy.

But there have also been plenty of fun easter eggs in computing history that didn't needlessly make the software less predictable. We don't need to also throw out the baby.

<comment><USER4> I think it depends on the context. In video games, easter eggs are mostly fine. In utilities and tools, easter eggs are a potential source of harmful behavior and security issues.

<comment><USER5> Also you can do it in a non-destructive, non-random way. Take `apt` as an example.

The easter egg is running it with an undocumented flag. The "error case" is the same as mistyping a command. Sure, you could argue the return code is 0 when it should be != 0 but I'd argue a) if you're using the wrong flags it's your fault and b) if you'd hit --help by chance it would also return 0.

</comment></comment></comment></comment><comment><USER6> > One of the aspects of Trustworthy Computing is that you can trust what's on > your computer. Part of that means that there's absolutely NOTHING on your > computer that isn't planned.

HA! That's incredibly amusing, considering, you know, Windows 10.

<comment><USER7> Got any Easter eggs to show?

<comment><USER8> Does OneDrive count?

<comment><USER9> Candy Crush showing up on a business laptop running Windows Pro or what it is called?

Same with login backgrounds for a game a newer wanted, again on my business laptop running Windows Pro?

I often defend MS recently because some of the criticism is really over the top.

Stupidity like that however should be publicized and questioned IMO.

</comment></comment></comment></comment><comment><USER10> > Once you've lost the trust of your customers, they're gone - they're going > to find somewhere else to take their business.

Unless there is nowhere else.

One of the reasons I don't trust Microsoft is because they know perfectly well that the above aphorism isn't true. They have an effective monopoly, even more so in 2005 when this was written than now. They put a lot of effort into developing and maintaining that monopoly, arguably more effort than they put into building quality software. The idea that we're supposed to trust them because market mechanisms will force them to be trustworthy, after they have worked so hard to destroy those very mechanisms, is Kafkaesque.

<comment><USER11> Trustworthiness isn't the same thing as honesty. The goal of Microsoft is not to be honest, it's to be trusted. The article is exactly what it claims to be.

<comment><USER10> > Trustworthiness isn't the same thing as honesty.

It's also not the same thing as being trusted. There are many entities in the world that are trusted despite being neither honest nor trustworthy. (IMHO Microsoft is one of them, but they are far from alone.)

> The goal of Microsoft is not to be honest, it's to be trusted.

Yes, I get that that is their goal. My point is that they are trying to achieve that goal by being disingenuous and deceptive. (And they succeeded spectacularly.)

</comment></comment></comment><comment><USER12> Yeah, the explanation sounds all good and professional but it deeply contrasts with my Windows experiences.

While I can believe there are serious people working on this OS, I often seriously get upset by all the crap Microsoft is putting in Windows. (There was this time where it downloaded 'Candy Crush' on its own!?). I would prefer a few easter-eggs instead.

Seriously Microsoft, please be coherent.

<comment><USER13> > Seriously Microsoft, please be coherent.

This post is 13 years old. They may have been totally coherent in 2005 but lost their way by 2018.

<comment><USER12> You're right, I haven't seen it and thought it was more recent.

<comment><USER12> In fact, the title got corrected from 2015 to 2005.

</comment></comment></comment></comment><comment><USER14> I think it's important to note that this is explicitly about "the OS division". Microsoft may have a company wide policy about this, I have no idea. But I think there's a huge distinction between an OS having hidden code and some higher level application or script having hidden code. The effects are much different and much more dangerous at the OS level.

</comment><comment><USER15> 7+ years ago at a different company I had a tiny picture of my face encoded and hidden deep within the bowels of our search system in a component you should basically never have any reason to touch, along with kinda nasty and obfuscated logic touching the global state of the application such that when you went to `/easteregg` you got my face.

Someone must have found it because it suddenly disappeared from all the sites that had it.

</comment><comment><USER16> I'm responsible for the Asteroids easter egg in the Sun x86 lights-out- management. It is true that we sneaked it in using a rather unprofessional manner (the build system would incorporate it iff the build happened on the CIS build server). I'm older now, more experienced and probably wouldn't do that again.

I also stuck an easter egg in the Cobalt NASRaQ, back in 1999. It was taken out pretty fast (I had marked it in the code, "THERE IS AN EASTER EGG HERE," then checked it in). It did ship in the first version, though.

<comment><USER8> Much of that was also back before viruses and trojans were an every day occurrence, before an unpatched computer on a network wasn't going to be owned within an hour or so.

It was more fun back then, and we weren't the ones who ruined it.

</comment></comment><comment><USER17> There are two recent MS easter eggs I can think of:

1\. Clippy is hiding in the "school supplies" Office theme.

2\. The default user photo in Office 2010 was a silhouette of Bill Gates' mugshot photo. This one is gone in the recent versions.

Both are just images though. No code was harmed in the making of these easter eggs.

</comment><comment><AUTHOR> I can understand the reasoning behind Microsoft's decision, and somewhat agree, but ultimately I think something is lost when developers are kept from leaving their mark on projects they spend a lot of time working with.

<comment><USER18> I think a lot of developers leave their mark with documentation. I have myself stumbled upon many easter-egg comments that have put a smile on my face.

<comment><USER19> I remember reading the manual of a handheld PC many years ago. It was very professionally written and detailed. In the "updating" part though, there was something like "At this point, the update has started and pressing the back button continuously will only make you more angry". It had made my day.

</comment></comment></comment><comment><USER20> I was under the impression that the military and maybe other branches of the US government have "no East Egg" rules for software they use, and I expected that to be the justification. Is this true? I found one document from a .mil domain that specifies no Easter eggs [1] but I frankly don't know enough context to know if this is actual policy that would apply to Windows.

[1] [http://www.dtic.mil/dtic/tr/fulltext/u2/a495389.pdf](http://www.dtic.mil/dtic/tr/fulltext/u2/a495389.pdf)

<comment><USER21> would you mind pointing on which of the 133 pages is the rule?

I could not find it after a quick glance.

<comment><USER22> I don't know if it is what tgb was referring to, but in section F-15, it says

c) No Malicious Code. Developer warrants that the software shall not contain any code that does not support a software requirement and weakens the security of the application, including computer viruses, worms, time bombs, back doors, Trojan horses, Easter eggs, and all other forms of malicious code

<comment><USER21> It's interesting they classify eastereggs with malicious code!

I'm glad I avoid doing business with the government.

</comment></comment></comment></comment><comment><USER23> Well, Windows 3.1 back in 1993 definitely had easter eggs. I still after all those years remember some of them (the perils of being a kid back then; these things are just stuck in my memory):

\- Start minesweep and press enter; then write "xyzzy" (remember the magic word from Zork) and press alt+enter. The top left pixel of the screen will change color if there's a mine under your coursor.

\- For solitare, you could press ctrl+alt+shift when clicking on your stack of cards to get them one by one instead of three by three.

\- Also for any program, if you click on the about Window you'd see the windows flag ([http://logo-timeline.wikia.com/wiki/Windows](http://logo- timeline.wikia.com/wiki/Windows)) and then if you clicked a couple of times at a specific color (I don't remember exactly this) then you'd see some credits along with a sketch of Bill Gates!

Those were great! So, "why so serious"?

</comment><comment><USER24> In older versions of our client, you could click on a portion of our logo five times to get a small pop up image of our programming staff. It was an easter egg, and cost next to nothing to implement.

I hope they change their minds someday.

<comment><USER25> With Microsoft's track record on security and bug issues, I really hope they don't change their minds. They should write exactly as much code as required and not one line more.

<comment><USER26> > They should write exactly as much code as required and not one line more.

They already clearly don't do that.

</comment></comment></comment><comment><USER27> I worked with the creator of the first easter egg, David Ramsey. In the early 80's he added a "Zebra Lady" to Mac Paint. It made a lot of press when it was discovered.

</comment><comment><USER28> Eh, MS is so damn big that they can get a pass on no Easter Eggs in operating systems. But I fully expect them to be games, etc. Have some fun, and respect your roots.

</comment><comment><USER29> It makes me think about the Linage OS April fools joke. Very annoying and difficult to remove the notification that came with it.

<comment><USER30> I was unaware of it, but actually stumbled upon their apology[0] today.

[0] [https://lineageos.org/An-April-Apology/](https://lineageos.org/An-April- Apology/)

</comment></comment><comment><USER31> I remember this debacle: [https://core.trac.wordpress.org/ticket/12816](https://core.trac.wordpress.org/ticket/12816) Notice the mention that "this was put in with great effort (to the extent of stopping Trac notifications) by Matt himself".

<comment><USER32> Which shows the maturity of WordPress developers as a whole. I'm still pretty bent out of shape that this had basically a decade...

Source: Have been a WP developer for a long time (shoot me) and I've received a FRANTIC call over this idiocy from a client in my early 20s. The user didn't know how they produced it in the first place, was having troubles communicating it to me because welcome to agency work, and I dropped everything because I assumed that the site was potentially compromised (or that the client was lying to me about "the computer virus on their website").

</comment></comment><comment><USER33> > we filed a bug in the database ("Exchange POP3 server doesn't have an Easter > Egg"), we had the PM write up a spec for it, the test lead developed test > cases for it.

I'm not sure you fully grasped the concept here...

</comment><comment><USER34> The way I read it: we are taking your money (oh so much), we can't risk losing your trust if you happen to have no sense of humor AND we want to preserve the illusion that this is serious business.

</comment><comment><USER35> It's funny how Microsoft talks about "TrustWorthy Computing" and thinks implementing Easter eggs could be malicious but a closed source os isn't ^^

</comment><comment> daniel-levin What I'm most curious about is which business and governments had access to which Microsoft source code, circa 2005. Anyone care to enlighten me?

</comment><comment><USER36> I wonder how many "easter eggs" were planted by people on the NSA's payroll pre-2005?

One of the lesser talked about things that was touched on in the Snowden docs is that the NSA sometimes has agents within companies similar to how we traditionally think of the CIA having "assets"

</comment><comment><USER37> They have a point, but count me nostalgic for the early days of early technology. At a certain point things move from being homegrown and individualized to industrial, dehumanized, and commodified. No one really likes this process, but it's a choice our society has made. Of course, as a socialist, I believe we can make different choices, but I digress.

</comment><comment><USER38> Fun will be forbidden.

<comment><USER21> It is sad. I disagree with that. Products needs to appeal to the end user. Easter eggs have that gut appeal.

They are like google chnage of the main logo, but in a sneakier way: you will not find them unless you look for them.

</comment></comment><comment><USER39> This is 2005, not 2015.

<comment><USER40> The '1' instead of a '0' is an easter egg.

</comment></comment><comment><USER41> Wonder how many "NSA eggs" have been planted in MS products over the years? All it takes is one NSL.</comment>


Guide to the London Startup Ecosystem - Ozzie-D https://startupsoflondon.com/london-startup-ecosystem-ultimate-report-2020/ <comment><AUTHOR> I can't imagine why anyone would bother starting a new company in UK.

Brexit is looming and it is an almost certainty that a no-deal will happen. (UK wants it and EU won't be able to get unanimous agreement from all member states' and their parliaments).

And in a no-deal Brexit companies will have to ensure EU data sovereignty which means duplicating infrastructure in the EU anyway. Not to mention all of the complexity around tariffs and digital/internet taxes. Being in the UK you get all of the negatives of the EU without any of the benefits.

<comment><USER2> UK will get a deal from Trump and will compete with Silicon Valley. Not to mention it can expand within the old colonies(i.e India, Africa, HK) maybe even get a great deal from China. EU is obsolete just like NATO!

PS: I don't really believe this stuff but this seems to be the plan.

<comment><USER3> The UK is negotiating from a weak position since it's about to lose a lot in a no-deal brexit. The UK politicians at the same time need to show some kind of post-brexit win. That's pretty much a guaranteed way to get a horrible deal with someone that can be just barely spun to make enough voters not notice how bad it is (ie: like brexit itself).

edit: Although China is plausible, as in China spending 10 years draining the UK of any worth it can before discarding the husk that remains.

<comment><USER4> Also because rather than negotiating with a single entity it's really still mostly a club of 27 countries, any of which can raise objections.

</comment></comment></comment></comment><comment><USER5> Having some experience in the London startup ecosystem, I think London is a great place for founders and investors, but I really doubt the value proposition for startup employees.

London I think is one of those cities that crystallises how bad the general economic state of the world is, and this has been dramatically more pronounced in recent years due to extremely loose monetary policy and quantitative easing among global central banks which funnels money directly into the financial, insurance, and indeed technology (through VC) industries. Broadly speaking, I think there are three categories of hidden, but segregated nonetheless, socioeconomic groups in London, and this has a dramatic effect on quality-of- life and also general conditions within startups.

\- The wealthy owners and marshallers of capital: these are your VCs and investors, as well as everyone else that isn't in tech but are closely related including foreign oligarchs. Some startup founders could probably be categorised in the lower-end of this group, as well as staff at financial service firms (investment banks, private equity funds, hedge funds etc.) including investment bankers and others. Quality-of-life is stellar due to very high compensation and/or acquired wealth.

\- Support staff to the above: software engineers including many CTOs fall under this category, as well as people on the lower-rungs of the financial and insurance industries. Quality-of-life is generally good, but you are basically detained under golden handcuffs, and you will never earn the same kind of compensation as the marshallers of capital. Software engineer salaries are generally capped at around £150k if you're a lucky, with very few exceptions (HFT firms etc.). Entry-level salaries start at £30-40k, which is atrocious for a _very_ expensive city like London and you will probably have to flatshare with others to make ends meet.

\- Everyone else.

What is important to note here is that there is a very implicit status-ranking in these groups, and software engineers particularly are not respected any where close to the level they are in the United States as they are not considered members of the first group. This, as you can imagine, has very severe effects on the level of compensation and the general working conditions that you can expect as an engineer as you are not deemed deserving of more compensation since you are after all "just an engineer". This is also why stock options and other equity compensation schemes are not as popular in London as they are in the Bay Area. Software engineers are considered support staff rather than integral contributors to the success of a technology business.

This social segregation, as you can imagine, also has effects on the social cohesion of the city, and I think the recent increase of crime in London is a direct consequence of the alienation of the third category of people due to the flood of liquidity from the first category, which drives up salaries for the second group of people (and thereby cost of living in London), and prices everyone else out.

Most of Europe suffers under this kind of segregation, and I presume it is partly a consequence of antiquated social structures that were more prevalent during the 20th century but haven't really modernised to align with the interconnected and meritocratic reality of today. I believe this is the primary reason why compensation for software professionals is so low in Europe compared to the meritocracy of America (but even this is changing with implicit filters such as Ivy League degrees etc.).

Most global cities have elements of this as well, but I feel the divide and indeed social inequality is very pronounced in London and is becoming worse by the year, which is among the reasons as to why I left the city for greener pastures.

<comment><USER6> Great comment. Only thing I'd add is a bit of clarity on "Software engineer salaries are generally capped at around £150k if you're a lucky" \-- in 20 years I've never met a software engineer on that figure. They exist, but I'd call that extremely lucky, and suggest a more realistic cap is not even half that. I welcome stats.

<comment><USER7> Definitely higher than half that. SWEs at FB, Google etc will get >100k. Even aside from that I regularly see higher than half that - e.g random example from a quick Google at 85k [https://www.glassdoor.co.uk/Salary/Travelex- Backend-Engineer...](https://www.glassdoor.co.uk/Salary/Travelex-Backend- Engineer-Salaries-E23898_D_KO9,25.htm) \- 90th percentile of Java roles are over 100k - [https://www.itjobswatch.co.uk/jobs/uk/java.do](https://www.itjobswatch.co.uk/jobs/uk/java.do).

Secondly a pretty average contractor day rate is 500pd, which is over 100k, and there are a lot of contractors. I think it makes eng salaries in the UK seem lower than they are. Many of my friends went contract and would never go back. The senior market is therefore hard to hire for, outside trendy/exciting companies, unless you pay for contractors.

That said, we should all be asking for raises <3! By all I mean everyone apart from the C suites of public companies

<comment><USER6> That itjobswatch java London: London median annual salary £75,000

I'm not sure big tech and finance are representative of London.

<comment><USER7> Sure, but since that's a median not a cap, doesn't that point to 'a more realistic cap is not even half that' (75k) being a bit pessimistic?

There are a lot of people in finance in London, also a lot of big tech (seen the current, and new, Google buildings at KGX?), quite aside from a lot of contractors :)

<comment><USER8> Please. 75k is the package good people can get 1-2 years after moving to London, basically when leaving their first company -whatever job they could get really- to move to an actual company that doesn't screw them over.

It's true that there are startups that try to get away with hiring people out of school for peanuts, from all across Europe. They often have a turnover of half the staff leaving within a year and it's no coincidence.

<comment><USER9> That hasn't been my experience. 75k is not earth-shaking, but also not something that i would expect someone with 2 years of experience to get in London. What companies do you think would pay that to such a person?

<comment><USER8> How about every single company? The better ones give 10% or 20% bonus annually, so really easy to get there, even while unaware of it.

I worked in startups. I've seen first hands employees being abused and leaving in drove after 1-2 years to get significantly more, literally anywhere else. Name any company in London, probably have some ex colleagues there.

That being said, I am talking about developers who can handle a HackerRank test and a coding interview on the whiteboard. It's not a high bar by any means but it is something.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Random aside but this seems like a decent place to ask it...

Does anyone know what's going on with the Startup and Innovator Visas? Most of the endorsing bodies don't even have a process set up yet and the ones that do only endorse their incubatees or make you subscribe to their accounting services.

Anyone have any insight? Are any endorsing bodies actively approving Startup and Innovator visas? If I'm an entrepreneur with £50,000+ to invest in my internet startup and I want to locate it in London and I don't want to go through Techstars, what is supposed to happen? Because as far as I can tell, the process of bringing a startup to London is currently very broken. /endrant

But seriously? Anyone have any success or advice?

<comment><USER11> yes. here's an overview: [https://www.gov.uk/start-up- visa](https://www.gov.uk/start-up-visa)

you can go through the steps and find out more.

here are the bodies that are endorsed for this type of visa: [https://www.gov.uk/government/publications/endorsing- bodies-...](https://www.gov.uk/government/publications/endorsing-bodies-start- up/start-up)

this might change after leaving the EU, but the requirements will most likely be reduced if anything.

</comment></comment><comment><USER9> Has anyone heard of any of those "good / reliable consultants, experts, mentors"?

<comment><USER12> One of the founders listed elsewhere on that page was a mentor on an accelerator I took part in. We went over our business in depth, he eventually became a supplier to us, then we became his largest customer. One day he abruptly stopped providing the service, and then relaunched his business trying to copy us instead.

We out executed, but I'd advise caution with mentors. Some were great help, this one was malicious.

<comment> Ozzie-D Would you be comfortable sharing the name?

</comment></comment></comment><comment><USER13> > Last updated on 16 July 2019. Startups of London is currently in beta and > all details are subject to change. © 2019 Startups of London

No changes in the past 6 months, must be a sign of being a very mature ecosystem ;-)

<comment> Ozzie-D Hey, thanks for pointing that out. The post was actually published today. I had to Google search to find where that was written. It was updated later but must have been put there manually when first written. Fixed. Thanks.</comment></comment>


Ask HN: Will adblockers kill "js widget" products/startups? - <AUTHOR> with the booming growth of adblocker adoption more and more 3rd party js products are getting blocked (mixpanel, qualaroo/webengage, storemapper, etc).<p>when more than half of the browsers will have adblockers, do you think these type of products will become obsolete? <comment><USER2> If you're talking about widgets that track things like CDN performance and errors, like NewRelic's[1], then... maybe. I love that people are blocking tracking widgets, but there are some companies that provide useful gadgets that don't compromise privacy and I'd hate for them to be blocked as well. That said, I can't wait for Facebook tracking widgets to go away.

1) [https://blog.newrelic.com/2014/03/13/javascript-error- report...](https://blog.newrelic.com/2014/03/13/javascript-error-reporting- ajax-timing-new-relic/)

</comment><comment><USER3> Probably, but if your business model is selling Javascript widgets (of which _anyone_ can easily view the source), then you're already in bad shape.

<comment><USER4> I don't think OP is talking about products which consist entirely of front-end code, but rather analytics or tracking services which rely on front-end JS to collect user data, which is then used by the main product.

For cases like MixPanel, I don't see why the traffic wouldn't be proxied through the original domain. Unless MixPanel needs to (i) ensure that the property is not faking their stats/events, or (ii) track visitors across sites, the fact that the JS etc. is served from MixPanel directly is more of a convenience than a necessity.

The same would not apply if MixPanel were providing a verification service to third parties, who were advertising on or wanting to buy MixPanel's customer's site.

<comment><AUTHOR> with the advent of community driven filtering, how long until the self hosted tracking scripts get blocked also? and who would notice?</comment></comment></comment>