Auto submission bots on Hacker News - <AUTHOR> http://jacquesmattheij.com/auto+submission+bots+on+Hacker+News <comment><USER4> Why does HN give karma points for submitting articles?

That's never made any sense to me. All it does is encourage this kind of behavior, where you submit everything you can find in the hopes of gaining points. You haven't really contributed anything valuable, since good articles tend to find their way here on their own.

Karma for comments makes sense. You can look at somebody's average and it gives you a sense of what sort of things they're posting. It actually measures something.

If somebody posts a cheap attack on one of your comments, you can click their username, notice that they have a 1.9 average, and go about your day knowing that they're probably just angry with the world in general. On the other hand if they have an average score of 8.6, you might want to read what they said again and see if they were actually right.

Karma from article submissions, on the other hand, tells you nothing useful about the submitter. Any chance we can disassociate upvotes on articles from user karma?

<comment><USER5> I seldom comment on HN, and when I do I typically do so in threads that are somewhat dormant, with little activity. I don't really care about karma/votes at all, I just say something when I think I have something of value to add. My comment average is 1.7, but I would still like to believe that I have yet to exhibit any behavior that I'm just angry at the world. I hope that I could still get yours or others attention, even though I'm not such a high-ranking commenter.

<comment><USER4> First, I hope my upvote just gave your average a bit of a boost.

Second, you'll need to produce a bit more anger and irrationality before anybody starts labeling you as a troll :)

Frankly, the only time I ever check anybody's profile is when they say something really valuable or really obnoxious. So by the time I get there I've pretty much made up my mind about the character of the individual in question. I can't imagine forming an opinion of somebody based solely on their karma score on some website.

<comment><USER5> Thanks. That comment was my biggest hitting one ever, so my average will probably jump quite a bit. Funny that it should be in a meta-karma thread.

I do see what you mean, I didn't think you were discarding comments from low karma commenters. I mostly wanted to bring up a point that is often missed in these discussions, that karma points might be very dependent on not only participation and quality, but on timing.

Given that using average karma as a filter is so blunt, an alternative way to express your method would be "I might see a high average karma as a reason to re-evaluate a comment that I initially discarded". Then it would be even harder to misconstrue into something sinister and karma elitist as I did :)

 __* Edit: from the comment below by mrduncan that shows how average calculation is done, my previous comment will not affect my average a lot. The max comment is sensibly ignored as a potential outlier.

<comment><USER6> You started me thinking about ways to normalize average karma, but I haven't come up with one that makes me happy yet:

\- adjusting to other comments on the same post doesn't account for timing

\- adjusting for time after the post is gameable by necromancers

\- adjusting by the total karma of the post commented on is incomplete; it also needs some relation to the time lapse from posting to comment

\- penalizing short comments might help discourage snarky one-liners

Are there browser plugins to give an adjusted average karma score this way, yet?

</comment></comment></comment></comment></comment><comment><USER7> FWIW, I was one of the people running a bot to auto-submit. I've always been a big-iron algorithms programmer, and I've never done much web programming, and certainly never programmed an auto-submitter before. Since I figured most of Jacques' idle thoughts were worth more than half the things making it to the Front Page, I figured it was an ideal time to learn a little about the back-n- forth of a form submission system with cookies, and to see (a) what I could learn, (b) how quickly I could learn it, and (c) how little code it took.

So it was an interesting experiment, I'm glad I did it, I'm pleased I learned something from it, and I'm sorry it seems to have caused Jacques some grief.

For that I apologise unreservedly. We have had a chat off-line and I believe there's no on-going problem. I have, of course, disabled the bot.

But the questions raised are interesting. I suggest that the "first submitter gets all the karma" situation means that people submit without thinking, worried that unless they do so they will miss out on that one item that earns gobs of karma, that they saw first, but didn't submit quickly enough.

Just sharing the karma between submitters won't work, because then if someone sees something gaining traction they just submit it themselves and share in the imaginary profits. Simple, clean, clear solution that's wrong.

No solutions, just problems.

<comment><USER8> I came here to this thread only to say this:

When reading Jacques' post on his blog, I immediately thought RiderOfGiraffes must be up to one of his social experiments with the community.

FWIW, I find your 'work' interesting and the chilled out approach to it, doubly so.

<comment><AUTHOR> Agreed. The only downside was that I wasn't in on the joke and that quite a bit of the backlash was directed at me, not at the people running the bots.

I also think that it would be prudent for anybody that intends to run any kind of bot on HN to ask PG for permission.

</comment></comment></comment><comment><USER9> I had somebody recently launch into me with a vitriolic attack on HN (they deleted the comment almost immediately) which started with something like "I know you probably think you're special, what with 18K karma and all, but..."

People take this karma thing waaaay too seriously.

I know I find the site dangerously distracting, and a large part of that is watching the up or downvotes on my comments -- it's kind of a realtime indicator of whether I have my finger on the pulse of the community. So I'm as much to blame as others.

I've said a few times that somebody should monetize this karma nonsense. Set up an auction clearing house where karma can be auctioned off for cash.

It probably wouldn't amount to much, but it's just the kind of out-of-the-box thing that HN should be messing around with. I'm just trying to guess a number, but I think you could pull 5 percent off each trade and make a nice bit of chump change, without changing the look and feel of HN at all. (If it bothers purists or interferes with the running of the board, then simply keep a separate list of "natural" karma hidden from everybody and use that for the system stuff)

<comment><USER10> The karma matters precisely because it can't be bought (not in any ordinary way, at least). It represents peer acclaim (or conformity to groupthink). If it was bought and sold, the basis for its value would evaporate.

<comment><USER11> It's also valuable because it eventually grants the ability to downvote.

(It's annoying to see obvious trolls and spam sitting at 1 and not be able to do anything about it. I'm still a few hundred points away, unless the threshold has gone up again.)

<comment><USER12> How do you find out the threshold anyway? It seems like it's a mystery for some reason (unlike, SO for example, where it's all spelled out)

<comment><USER11> It was 500 last time I looked; pg raised it during a "HN is going to the dogs" discussion a while back:

<http://news.ycombinator.com/item?id=1853529>

</comment></comment></comment></comment></comment><comment><USER13> The bots are doing nothing 'wrong' as such. There are certain feeds from where >90% of the material ends up on HN. If somebody writes a bot to auto-submit items from that feed, it's helping HN be faster in accessing new and (mostly) relevant posts. What is not relevant should (in principle) not reach the home page.

The problem is that submission is winner takes all, i.e. first submitter reaps all the upvotes. Also, HN does not reward finding new sources of material more than posting from the predictable sources.

The logical endpoint of these two facts is auto-submission bots rising to the top of the Karma tables. If Karma is used as a way of anti-gaming (need karma threshold to downvote, etc.) then this is a way to circumvent that for a sufficiently motivated manipulator. They can make a bot that auto-submits from the known sources, and use it to build up an arbitrary number of accounts, from which they can then boost the articles they want (or bury the comments they don't like). For all we know, this could already be the case.

I have two suggestions that can sidestep this problem to a certain extent:

1\. Reward articles from predictable sources less than articles from rare sources.

2\. Split the karma benefit between the first submitter and the people who upvoted the article early (of course, this needs to take into account how selectively and successfully the user upvotes to avoid blanket upvoting 'just in case').

This all is still gameable, but probably not as easily.

<comment><USER14> _The bots are doing nothing 'wrong' as such._

Not really... because they just add to the noise on the new page when it isn't something for HN. HN is curated by hand (with votes) for that reason.

</comment></comment><comment><USER15> Proposal:

1\. When a link is submitted, it doesn't actually appear on HN until a certain (fixed?) time T has elapsed after its first submission.

2\. Everyone who submits it within that time is noted.

3\. Karma from article upvotes is shared equally between all those users. (Or perhaps unequally in a way that weights earlier submitters slightly more highly -- but not winner-takes-all as at present.)

4\. If the same link has been submitted N times before time T elapses, the delay is truncated at that point.

Effects:

1\. There's very little incentive to submit something super-quickly. Therefore, there's more incentive to read it carefully first. (Good.)

2\. Super-quick submitters don't hurt slower submitters' karma so much. (Good.)

3\. Submissions no longer have hugely higher potential karma gain than comments, as they do at present. (Good.)

4\. "Obvious" submissions probably no longer give anyone very much karma. (Good.)

5\. Breaking news doesn't appear on HN as quickly as it does now; but if lots of people are submitting it, it still gets in pretty fast. (Maybe good, maybe bad.)

I think that with suitable choices of T and N -- perhaps 1 hour and 20, or thereabouts -- this would be a considerable improvement on what we have now.

<comment><USER16> I like this suggestion. Slowing down HN wouldn't be a bad outcome as well; PG has mentioned he doesn't want it to be too addictive.

On the other hand, I'm not clear if would slow things down that much, so much as delay. In any event, this isn't a breaking tech news source for many obvious reasons.

</comment></comment><comment><USER17> I used to encounter what I thought might be bots auto-submitting my old raganwald blog to reddit. The only person losing karma was me, since I no longer got to submit my articles at a time when they were interesting to reddit's readership. Big whoop!

My thinking is that if I write and give my work away, it is no longer up to me to decide how it is to be used. That's because my words are free as in speech, not just free as in beer. Of course, copyright violations are a different matter, but I can't tell people whether to submit a post to HN, I can't tell people whether to bookmark it, or tweet it, or whether to use it as part of a corpus on guessing the sex of the author.

If there's a race for meaningless karma by bot authors, that is irrelevant to me as an author. IF it is a problem--and I do not grant that it is a problem-- THEN it is HN's problem, not my problem as an author.

I give my words away. That inevitably means someone will use it in a way I didn't intend. That's the point.

<comment><USER18> I got the impression that jacquesm wasn't so concerned with how his work was being treated, but with how HN was being treated.

<comment><USER17> Good point, thanks!

FWIW, I think there is a problem if multiple bots attempting to autosubmit end up inadvertently creating a voting ring. But that can and should be fixed by changing the way HN treats submitting an article that has already been submitted.

Other than that, I only think bots are a problem for HN when submitting spam rather than ham. I am in favour of bots provided they don't play fast and loose with accounts. I would be ok with each bot having its own account, or all bots using their creator's accounts. I would consider it fraudulent to create bots that periodically give themselves new accounts to evade filtering.

If bots all used a stable account, pg could throttle or ban those that submit too much spam. But if a bot is constantly submitting articles that are upvoted by humans.... I'm happy to see it seed the new page.

JM2C, I don't make the rules, I just play by them.

</comment></comment></comment><comment><USER19> Maybe the problem is people _upvoting_ uninteresting articles.

Without wanting to be mean, it's kind of crazy that this meta-discussion about someone's inability to remain off the HN scoreboard is number one right now.

Sycophantism and idle self-promotion are boring pursuits.

EDIT: I think we should be able to down-vote uninteresting articles.

<comment><AUTHOR> Multiple submissions of the same link have the same effect as upvoting and once a thread is on the homepage it will gain a lot more views instantly, if only a small number of people on the homepage then gives it another upvote it is likely to hang around for a long time.

These are artifacts of the way the 'new' and the 'news' page work, the cumulative effect of those is larger than the actual quality of the submissions.

<comment><USER19> But these articles generally have many more votes than just a couple - <USER2> article has 149 at current count.

</comment></comment></comment><comment><USER20> It might be interesting to hide total karma score from users. I guess that if we don't know our total karma score the karma harvesting will stop but keep the points for submissions and comments so there's still the incentive to contribute good material (the pride of seeing your comment/submission being upvoted).

What do you think?

edit: the first version didn't make much sense, I got interrupted in the middle of the message

<comment><USER21> This is a lesson that was learned on Slashdot in 1999 already I think. A 'karma cap' makes perfect sense and the total karma wouldn't even have to be displayed to the user himself, to avoid karma whoring. What does it matter if someone has 1500 or 15000 karma? They've both proven to be contribute; maybe the one with the higher score just has more time, or a more popular opinion, or has been here longer.

In the same vain, it's not easy enough to lose karma. By being active here, you will in the end always have good karma, even if your contributions are bad; it's very rare to see comments with lower than -5 karma, but it's easy to get a +10 comment, even if it's nothing special (I mean I know I've had a lot of those...)

<comment><USER21> A small comment since people are upvoting and I did a rather meaningful edit: I wrote 'it's too easy to lose karma', but I meant (as was elaborated on in the rest of the sentence) that it's too hard to lose karma.

</comment></comment></comment><comment><USER22> Jacques, perhaps you could configure your blog so you can choose to submit your own posts automatically to HN when you post them? That might reduce the tendency of people to try to rush and post them first, assuming the majority of posts are actually suitable for posting here.

I don't think you should worry too much about it either. Your posts seem to keep gathering a high number of votes whenever they appear on HN, so this is a sign that they _are_ useful and relevant to the community. If an irrelevant link gets posted and it only gathers a few votes on the new page, then what have you lost? What has the community lost?

<comment><AUTHOR> I understand your intentions but I don't think that's a good solution because it will still submit items to the 'news' page that are not always 'up to standards', giving them at least one upvote. That's roughly 25% of what's needed to get an item to the homepage, so only 3 more (bot)votes and it's done, once an article hits the homepage it is likely to stay there for a while. All this would do is add one more bot to the race and thus increase the problem.

Not having those items on the 'news' page would seem to be the best solution.

Really, people should at least read the articles they submit and judge them for content before submitting them to HN, especially when they're associated with the better known (ex)HN'ers.

Probably Sivers, Patio11, Tptacek or any one of the people that seem to be featured a lot here could write an article about 'Condé Nast acquiring HN' (in a desperate move to re-acquire Reddits' audience that has left for HN, thereby realizing the fears of all true Hackers, the proof that this would make 'HN more like Reddit' is left for the reader) (there goes my April 1 post ;)) and it would get upvoted without much consideration.

One possible (technical) solution would be to let the karma boost be dependent on the average of all posts from a domain, submit a 'below average' link and your karma will drop!

<comment><USER23> I've discovered an elegant proof that HN is like Reddit, but ... oh, darn, that doesn't work online.

Maybe submission upvotes in a short time shouldn't front-page an item. I don't see why not putting these links on the news page should make a difference - <USER3> anything it would make it impossible to get _non_ -bot upvotes, if I understand what you mean.

</comment></comment></comment><comment><USER24> Maybe its about time HN had a CAPTCHA on their submit form.

<comment><USER7> A CAPTCHA? In a forum for Hackers?

Hmm ... interesting ...

ADDED IN EDIT: HN voting makes me laugh sometimes - I have no idea why this got a downvote. Thank you - made my day.

This is _not,_ let me hasten to add, a request for more. Some things are funny just the once. More than that and I'll really start to question my understanding of the world, let alone just the HN community.

<comment><USER25> If there's CAPTCHA, then submit an app that collects these images and sends them to your phone. Send back the answer to help the bot.

<comment><USER26> That would at least slow down the bots based on how attentive the maintainers are. There are of course captcha solving services but this just trades maintainer time for money - trying to run a successful karma hoarding bot would still be death by a thousand papercuts.

</comment></comment></comment></comment><comment><USER17> Building a bot to win karma is a little like hiring a model to pretend to be your date. No, scratch that. We're hackers! Building a bot to win karma is a little like building your own replicant and taking it to the party as your date.

<comment><USER27> No. Building a replicant would be awesome.

Even more so if more of this audience were old enough to remember when Daryl Hannah was hot.

VVV ahh indeed! Why then we're in violent agreement!

<comment><USER17> _Building a replicant would be awesome_

That was the intent of my post. Building a bot that earns 10,000+ karma ought to be an achievement. If for any reason it isn't particularly difficult, then it ought to be taken that earning 10,000+ karma as a human isn't an achievement either.

</comment></comment></comment><comment><USER28> To me, the technical solution is to incorporate the relationship of the upvoter* to the poster in the "hotness" algorithm. If I upvote every single item from jacquesmatteij.com then my "this is awesome" signal isn't as strong as someone who only upvotes 10%, or who has never upvoted him before.

* When multiple bots submit the same link, "submission" is basically the same thing as "upvoting".

</comment><comment><USER29> It kind if seems like a false alarm if one of the botters was just RiderOfGiraffes (whose motives I don't suspect), and there was only one other person, possibly equally innocent.

One would hope nobody here is irrational enough to seek 'easy/automatic' karma ... I mean the nice thing about karma for submissions is it's basically a whole lot of smart people saying 'well done for finding this, it's definitely valuable.' If there's no real finding involved then what's the point? You're the only person your karma matters to.

<comment><USER7>
      > the nice thing about karma for submissions is it's
      > basically a whole lot of smart people saying 'well
      > done for finding this, it's definitely valuable.'

That doesn't really seem to be the case any more. There's a lot of stuff coming up on the Front Page now that I, personally, think is not valuable at all. It's not spam, so I feel disinclined to flag it, but I can't downvote it either. I think there are a lot of older hands who are starting to despair that so much trivial material makes it to the Front Page, and there seems to be no way of stopping it.

There is no doubt in my mind that the community has been diluted in its intent, purpose and interest. Often the new people have insightful and interesting things to say, but the focus is largely gone _as compared to what attracted people in the first place._

One can no longer assume that just because an item has a high score, it must be of value. The interesting thing is that this is true of the Classic page as well.

And I've checked my snapshots from 2 years ago, and it really does seem to have changed.

People are upvoting things not because they are valuable, but because they are entertaining.

<comment><USER29> From a top-down perspective the karma vote are less meaningful, as certain topics and sources get up voted ad nauseum. But from the bottom-up perspective, it's still great when you pluck an academic article or technical blog from obscurity and thousands of people read it, sending the karma from 1 to hundreds. And there are other people trying to do the same thing. You can usually avoid the chaff just by reading the title or domain (personally i skip the 'motivational' type blogs and try to resist the 'hot topic' ones and contentious debates, but there's still so much good technical content that crops up, and fairy high maturity among commenters).

</comment></comment></comment><comment><USER30> What happens if blogging tools become their own HN post bots?

The last few Dave Winer posts I've seen here have been submitted by davewiner. Since he's a dude who rolls his own blogging tools, I'd be not at all surprised to find that he wired up the ability to simultaneously publish and post a link to HN.

I can see good reasons for doing this for one's own blog, but if this practice were widespread or built into normal people's blogging tools then it would (among other things) cause the "new" page here to be useless.

</comment><comment><USER31> I am a long time lurker on hn, and like mzl, dont care about karma at all.

reading the ~160 comments on the topic, however, sounds weird to me because being indian, karma is not just a number against your online profile, but a fact of life - a word that you hear from people several times during a normal day - and they've probably never even been online.

i get that its about measuring the overall place of a person in a community, and that "karma" is as good a tag as any to condense that concept into one word, but it just seems very weird when there's so much debate around it. true karma is not exactly the "double-entry book keeping of life", nor does it have a leaderboard (which, btw, i realized existed on hn only recently).

on hn, the linked content's mostly great and its always useful to check the comments before loading up the link itself. that should be enough, imo.

ps: yes, i feel the same way watching "my name is earl", although i do enjoy the show itself.

</comment><comment><USER32> Would have been extremely ironic if this post had been submitted by a bot!

My vote/suggestion is to hide Karma from all users once it reaches a fairly low cap. I know I am in a minority here but to me personally Karma beyond the level needed to downvote and basic functionality is hardly an issue.

</comment><comment><USER33> Karma harvesting bots. I thought of it a while back and I was sure it already existed.

Thanks for proving it! I do like the term of "harvesting karma".

In reel life, that would be a good deed automatically actioned based on a set of inputs? Such as grabbing the mail of the neighbour on the way in?

</comment><comment><USER34> Always surprised me how advanced humans pretend to be and how simple-minded they actually appear en masse, with this race to "get my integer number higher" which is a basis of most social algorithms.

Really people? That is the only way to stand out from the crowd? An integer? :)

</comment><comment><USER35> There are also user accounts that have been created just to spam HN, eg:

<http://news.ycombinator.com/submitted?id=subhbwn>

</comment><comment><USER36> There's gotta be quite a few auto submission bots going on here...

 _cough_ TechCrunch _cough_

...not that I have any problem with it. I'm just amazed at how quickly TechCrunch (and similar) articles find their way onto HN.

</comment><comment><USER37> Is HN karma worth anything? Don't get me wrong. I love HN and I think it is unique in its way but I never thought that I could earn a medal because of a lot karma on HN.

I can understand this "function" on StackOverflow (even though I don't have much karma there either) cause karma at StackOverflow can bring in new chances.

My question: Do anyone use HN karma as measurement to see if this guy is worth to hire or worth for something else?

<comment><USER38> I would certainly hope not.

</comment></comment><comment><USER39> A related idea I've been toying with is "karmic arbitrage": auto-submitting posts that have been upvoted at proggit and vice versa.

<comment><AUTHOR> please don't.

<comment><USER39> As a fellow Jacques, I will cut you a break.

edit: I didn't realise having a name common in Francophonic nations was a downvotable offence.

</comment></comment></comment><comment><USER40> Jacques is such a nice fellow. If it were me, I'd just make a post with pics of cats and watch it being submitted to HN.

</comment><comment><AUTHOR> Maybe a simple rule could be that if you run an undeclared bot on HN to auto submit stuff that you forfeit your account when you're detected, no matter who you are or what you've done.

That way we only get really clever bots that are indistinguishable from really good submitters.

<comment><USER17> Why? I haven't read a good argument _against_ bots. Your article doesn't present an argument that HN is harmed. I haven't read a good argument that anyone is harmed.

If a bot had its own novelty account, say "ragnawald_speaks" that submitted everything I wrote, what would be the harm to HN?

People keep talking about "spam." How is it spam if a bot submits an article that has an excellent chance of making it to the top ten? That's the opposite of spam, it's all signal and very little noise. If people think that a bot auto-submitting a feed with excellent signal is spam, then I have something very serious to tell them: humans are pattern-matching machines too.

<comment><USER41> The argument against bots would be that it makes it more difficult to go through the 'new' section and find quality posts to up vote if everyone did this.

In fact, I seem to recall Digg is going to/already has pulled back it's feature where you can register an RSS feed to post all your content for this very reason.

<comment><USER17> _The argument against bots would be that it makes it more difficult to go through the 'new' section and find quality posts to up vote if everyone did this._

If everyone wrote bots that auto-submitted feeds from authors who consistently get upvotes from HN readers? How is that a problem?

If the problem is submitting articles that HN readers don't find interesting-- spam, not ham--banning bots is unlikely to help. How do you stop me from submitting every article I write?

There is a huge amount of content out there loosely relevant to HN readers. Bits overwhelming the new page are a symptom, not a disease. The disease is that the new page doesn't scale well to handle a large volume of submissions. As HN grows, the number of submission si going to grow as well, with or without bots.

Behind the scenes, there must be some changes to accomodate this, such as algorithmically showing users new stories they are most likely to find interesting, or showing users a random selection fo new stories from the last hour.

Bots merely accelerate the decline of the new page's usefulness. Banning bots that auto-submit high quality feeds isn't going to work if we allow HN to grow at its current rate.

</comment></comment></comment></comment><comment><USER42> Turn off karma for users, keep it for new posts, problem solved.

(posts get the karma, not people)

</comment><comment><USER41> Are there indications that this is a wider spread problem beyond jacquesmattheij.com or the two individuals that have already been caught doing it with his site?

One is an anomaly, two independent occurrences is a trend?

<comment><AUTHOR> Yes, but I can't actually prove those.

</comment></comment><comment><USER43> I never knew this, thanks for highlighting it and writing a nice post about it. That's why I read hackernews, to find out things I don't know from people who know them.

</comment><comment><USER44> Didn't pg admit that he uses karma as a criteria in evaluating yc applications? If so that was just an invitation to a bunch of smart hackers to try to game the system.

<comment><USER45> No, he said that karma as nothing to do with YC application, but that if he sees an application from a user that he knows from HN to be a smart guy, he will look at it more specifically.

In other words, interesting, on-topic, and frequent comments are important, not your absolute karma number, even though of course you're likely to have a high karma if you're a frequent poster of good comments.

That's also why the average is more important than the absolute karma.

<comment><USER46> > interesting, on-topic, and frequent comments

submitted early during a discussion's lifecycle _

</comment></comment></comment><comment><USER47> <http://xkcd.com/810/>

</comment><comment><USER48> 1) Use Wordpress 2) Make posts "Private" until you are finished with them 3) $$$

</comment><comment><USER49> Ironic. I always assumed jacquesmattheij.com would be such a bot submission. Every day a new post from that blog in the tops :)</comment>


Workflowy for iPhone and iPad Works Offline (YC S10) - <AUTHOR> http://lifehacker.com/5983821/workflowy-for-iphone-and-ipad-works-offline-syncs-your-changes-when-you-reconnect

<comment><USER2> I don't see a pricing page. If I'm going to add a new tool to my workflow, it better be around for a long time. How is Workflowy planning on staying in business?

As an aside, Lifehacker seems to be eating my back button on Chrome. Even selecting HN from the history would just keep reloading the page and wouldn't bring me back to where I wanted to go.

<comment><USER3> It looks like they're maybe not marketing it heavily right now, but in the web app under settings there's an upgrade to pro option - its $4.99 a month or $49 a year and gets you dropbox sync, themes, extra fonts and unlimited lists / items.

</comment></comment><comment><USER4> I was excited about this project when it first came out. But I needed offline access, sharing, and mobile for it to be useful to me. I'll admit I assumed the project died, but glad to hear it's alive and kicking! (And that all my initial complaints are addressed.) I'll definitely be checking this out.

</comment><comment><USER5> So, do i understand this right that they had a web app which they turned into an iOS app to support offline operation? If so, why? I've done offline web apps before, and they're not easy but still easier than porting to a whole different platform.

I wish more developers would stick to a pure web approach instead of going the app route. Quite often i find the lack of integration with the web of a native app to be a dealbreaker.

<comment><USER6> This is pretty much the web app bundled in an app. Works almost the same except has some conveniences to assist with the lack of keyboard & mouse.</comment></comment>


Facebook making its Ads more valuable by tapping on by big advertisers data? - <AUTHOR>

Some ad targeting features are getting really specific. Like Facebook's "Planning a trip > to Rio de Janeiro".
Everyone can see how Facebook could be figuring who this people are by itself. But I am wondering if third party cookies in advertiser sites are not involved (which surely have a ton of potential for Facebook).
If this is true big companies are surely helping out smaller players (advertently or not) and Facebook, Google and the like, are selling the advertisers' information to others. Brokering the data provided by the companies running this ads.
Say I go to Tripadvisor and search for hotels in Rio. Surely enough I go to Facebook and the ads for this hotels keep coming up... But now Facebok knows that I am planning a trip to Rio, which enables any other advertiser to target the same people.
I obviously can imaging that some of the big ad players have already thought of this; and it may be the case that the information provided by means of third party cookies is restricted for use of the advertiser only,... or not? <comment><USER2> Very interesting, identifying users activity using one advertisers data and than giving other advertiser the option to use that data to target the same user. Chain reaction!. What option do advertisers have to save their data?

<comment><AUTHOR> I am guessing that Facebook and Google can strong arm advertisers due to their strong position in the market. Maybe very large accounts have something to say when they negotiate one on one.</comment></comment>


Blockbattle.net - multiplayer tetris / TetriNET using JavaScript and Tornado - <AUTHOR> http://blog.blockbattle.net/2011/02/introducing-blockbattlenet.html

<comment><USER2> Just played for a bit. It's awesome! Very smooth gameplay on chrome and a nice retro ui.

My only criticism is the op is really hard to beat :P

<comment><AUTHOR> I believe that's a side effect from testing ;)

<comment><USER3> Should have used a functional language.

</comment></comment></comment><comment><USER4> Big Tetrinet fan here, I used to play the modified version Tetrifast a lot(no new block delay) which is the same as this, you can lay blocks with speeds of 120+ ppm(pieces per min) depending on the keyboard repeat and initial delay settings(usually needs to be reduced). One flaw I see is there is only a key to turn the pieces one direction, and not he other, this should be implemented to increase speed of laying. Also, it would be cool to have customizable keys for those of us who don't use standard, I tend to use(may not be optimal):

down: drop, e/r : turn piece left/right, up: faster descent

Unfortunately very very few people play Tetrinet anymore, I wish you the best to revive what was a great game!

<comment><USER4> Bugs/changes from original:

Sometimes at the edges if you turn a piece full circle, the position changes(this shouldn't happen).

More powerful special blocks from original removed, when you clear 4 lines with a special block in it you only get 1 as opposed to 4 special blocks in the original. Both these changes will favor those with faster laying speed.

Keyboard repeat/delay is too long, would be great if these were customizable.

Suggestions: Match people with similar ppm Show the winner(wasn't obvious to me)

</comment></comment><comment><USER5> This is awesome.

Sadly, I've become too used to www.tetrisfriends.com

</comment><comment><USER6> I'm not a huge fan of the Tetris implementation - I need my hold pieces and the little shadow at the bottom (child of the 90s, sorry to all you purists ;]) - and items are kinda difficult to use in this one, but it's still /totally awesome/ as a technical project! I love that there's no sign up and you just share the URL; that seems so obvious but I don't see many other games doing it.

<comment><USER7> Hi,

I'm one of the three people who helped work on this project. It was a fun exercise to learn about real-time browser-based communications.

For the next release we are planning on running a vote to find out which features are the most requested. Many people are already asking for hold piece. We have a lot of ideas about what new items could be implemented.

</comment></comment><comment><USER8> Very well done! I'm going to have lots of fun with this. There's one problem though, I played, and suddenly everything just stopped. I'm on <http://blockbattle.net/f/BeJegHPARhCc4uteNaVuPg==/1/> and my user is called TOBIE.

Could be my connection but have other connections alive and well right now.

</comment><comment><USER9> Playing it right now. Very addicting.

When my brother was around 17 or 18 he wrote a game called Tetrix for the Commodore that was very creative at the time, including head-to-head and different obstacles. So this is a big nostalgic for me.

Very well done.

</comment><comment><USER10> You might want to be careful about using the Tetris name or doing something smilar. Tetris owns the copyright. There is reason why only one tetris game on AppStore. Also remember OMGPOP? They used to have tetris..

<comment><USER11> Where is it called tetris? All I see blockbattle and tetriNET

<comment><USER10> doesn't matter. The Tetris company can also sue you for the gameplay.

</comment></comment></comment><comment><USER12> Really addictive! Any plans on writing a blog post on how it was built?

</comment><comment><USER13> My latest flash game was a variation on the theme: <http://www.kongregate.com/games/Xiaoma/block-merchant>

</comment><comment><USER14> I play this ALL the time at work.

</comment><comment><USER15> Awesome.

</comment><comment><USER15> What is this built in?

</comment><comment><USER16> Fun!

Ratings?

</comment><comment><USER17> I like the fact that you don't need to login to play... The only issue was i couldn't find any opponents to play :( Tetris Battle on Facebook is pretty addictive...they always seem to have someone to play against (though sometimes I think I'm playing against AI opponents).

<comment><USER18> Actually, tetris battle pitts you against replays of other people's games, unless you actually challenge another player. Even then it's not 100%... A friend of mine once challenged me and ended up playing a replay. (Actually, he let me play myself. I lost. )= )

I'm not sure how they handle bombs, since certain moves only make sense given bomb timing and positioning. Also not sure how they handle moves that become impossible at the very top of the screen -- if line timings are different, the replay ends up trying move to a place that a real player actually can't get to.

Edit/Note: If you're playing someone live, it'll say so under your names -- one of you will have 'host' and the other 'live.'

</comment></comment><comment><USER19> Nice site!

All of this attention means you're going to get a nice C&D letter from the lawyers of Henk Roger's Tetris Co. LLC real soon, though.</comment>


Facebook showed me my data is everywhere and I have absolute no control over it - <AUTHOR> https://www.buzzfeednews.com/article/katienotopoulos/facebook-advertisers-data-brokers-car-dealerships <comment><USER2> > These advertisers are running ads using a contact list they or their partner > uploaded that includes info about you. This info was collected by the > advertiser or their partner. Typically this information is your email > address or phone number.

Newsflash, BuzzFeed's ad networks onboard and sync information about their readers in exactly the same way. Do people think that BF loads Quantcast, Scorecard Research etc onto their site for the good of their health?

That's not to mention the viral quizzes and other data gathering exercises that BuzzFeed invented and sold as a product.

I have no idea why people don't call BS on news orgs that run 'exposes' on Facebook's ad targeting, when they target, track and follow their readers in exactly the same way.

<comment><USER3> _I have no idea why people don 't call BS on news orgs that run 'exposes' on Facebook's ad targeting, when they target, track and follow their readers in exactly the same way._

Three reasons:

1\. In most responsible news organizations, there is a significant firewall between advertising and news. In two places I worked, the sales people weren't even allowed to go into the newsroom.

2\. News organizations are not IT departments. A reporter is not involved in how a web site is built, or what goes on behind the scenes. There are different people in different departments for that.

3\. Just because a newspaper does something bad with its web site does not make what happens at Facebook/Google/etc... any less bad. SV needs to get over the whole "But Bobby jumped off the bridge, too!" mentality.

<comment><USER4> yes it does. you don't get to criticize someone for an action while performing the exact same action and expect your argument to have a shred of credibility

<comment><USER5> No it doesn't. The argument speaks for itself. If I murder someone in cold blood, then get up the next morning and call a press conference saying "Murder is wrong! We need to put a stop to murder!" no one would chime in and say "No way, murder is perfectly fine, you just did it last night!"

Call the news orgs out for doing the same reprehensible activity, yes. But let's judge the arguments about which activities are reprehensible on their own merits.

<comment><USER6> Your analogy only makes sense if Buzzfeed stopped using the same practices. If you continue to murder people while shouting "murder is bad" then you might be correct but you're still a hypocrite.

<comment><USER7> Yes, but the more important thing is that murder is wrong, not that someone's a hypocrite. Hypocrisy is the most minor of malfeasances.

A smoker who writes a column that smoking is bad is still doing good writing.

<comment><USER8> This argument is very common against people with fringe political beliefs. "If you don't believe in property rights, why do you have a car?"

<comment><USER9> That's different. If you don't believe in property rights, you think that the law is fundamentally broken, not that any individual who owns property is evil. This article is basically doing the latter, which is why it's difficult to take seriously.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> FWIW, I wrote a little script back in Feb that you can use in the console on that Facebook advertisers page to auto click "remove" on them all for you.

Here is the github gist: [https://gist.github.com/bluetidepro/bfa60c1d63925180daf3dd53...](https://gist.github.com/bluetidepro/bfa60c1d63925180daf3dd53e5ff48ea)

I run it about every month, and it's crazy how many get added in that time span. There is literally thousands and thousands from brands/companies/etc. that I've never heard of it. It's insane.

<comment> john-radio Nice job. It looks like Facebook Purity has this built in also.

</comment></comment><comment><USER11> The author keeps saying 'my data' when the data isn't theirs. The fact that they interacted with a party, that interaction, and who you are, is thier data.

This isn't a theoretical nit pick, this is the law. And it makes sense. If you and i have a conversation, i am free to tell someone else about that conversation, because i was part of it. That is my data, as it is also theirs.

In casual use, if we agree not to tell anyone, that is different, but the default is both parties own it.

This the simple minded use of 'my data' really wrecks what could be a rather interesting ( but not surprising ) piece.

<comment><USER12> > This isn't a theoretical nit pick, this is the law.

Of course, the law is changing... and in fact, under a lot of laws, it really _is_ "my data".

Much like intellectual property, these laws were established for a particular context, and we've long since moved past that context, raising reasonable questions as to whether those laws are really a good idea.

> And it makes sense. If you and i have a conversation, i am free to tell > someone else about that conversation, because i was part of it. That is my > data, as it is also theirs.

Are you entitled to a DNA sample from some skin cells that floated in the air while you were having said conversation? Does that conversation entitle you to know of every other place that person goes that day? Are you entitled to share a full recording of that conversation with anyone you'd like?

The lowered price of collecting, aggregating & exchanging information changes the context under which the existing laws were made, raising questions about whether we wish to alter those laws.

<comment><USER13> > Are you entitled to a DNA sample from some skin cells that floated in the > air while you were having said conversation?

Yes. Why wouldn't I be. Those DNA are in my body. They might be infecting me in some way. Why would I not be able to inspect them however I want?

> Does that conversation entitle you to know of every other place that person > goes that day?

If I'm with them the entire time then yes. If other mutual friends were with them I'm fully entitled to ask them and they are fully entitled to answer.

I went to Disneyland with my sister yesterday. I just shared with you that my sister was at Disneyland yesterday. My mom told me she and my sister went to dinner at McDonalds on the east exit of Disneyland after they got out. I just shared with you something my mother told me about my sister. I have broken no laws nor done anything considered wrong AFAIK in any country in the history of the world up to this point.

> Are you entitled to share a full recording of that conversation with anyone > you'd like?

Personally I believe the answer is effectively yes and should be yes though I understand it might legally be no in certain places at the moment I believe those laws will eventually be overturned. Why do I hold this position? Because my brain recorded the conversation. So, first off if I have good memory I can dictate the conversation. Second, if I can make a machine to pull that data out of my brain it doesn't feel like the law can tell me I can't. It's my brain and my memory. Further, it's arguably we will enhance brains digitally at some point. First for people with brain disability. At that time it will be trivial for them to digitally extract their memories and being their memories again the law should have no say. In other words, tech will eventually make this question moot. Conversations will be recorded and just like I can tell you that while at Disneyland yesterday my sister said she was going to Hawaii in June (I just shared a lo-fi recording of that conversation with you) eventually I'll be able to do that with hi-fidelity.

Let me add I'm a little scared of such a world but I personally see it as inevitable. I believe digitally augmenting brains is inevitable and I believe telling people what they can do with their personal memories and who they can share them with is impossible/untenable so that world will come eventually.

Let me add though that I'm not against laws that say such data can not be collected in mass quantities. I have no idea how to word those laws so as it's possible for me to share all the data mentioned above with whoever I choose and yet not allow FB to do the same and also still allow services to help me share that data with who I choose to share it just like HN just facilitated me sharing info about my sister with you above.

<comment><USER14> Regarding "records of conversation": The difference is that when you tell a memory, it is not proof of it actually happening. If I claim "Hubert said he stole a car", it is far less relevant to anyone interested than an audio recording of him saying "I stole a car".

</comment></comment></comment></comment><comment><USER15> _These advertisers are running ads using a contact list they or their partner uploaded that includes info about you. This info was collected by the advertiser or their partner. Typically this information is your email address or phone number._

I like how they purposely give a couple examples, omitting the targeting factors that are more likely to freak people out, such as targeting by lists of names and dates of birth

<comment><USER16> On top of that, it's absurd that someone can add my phone number to their advertising platform to get my name. Unlike email addresses, phone numbers are rather finite, and the number itself is tied to a particular geographical area (for the most part).

On a related note, Facebook makes it so difficult to unlike things, unfriend people, and opt-out of information from individual advertisers. It's obviously hostile design aimed at making it as hard as possible to reduce your advertising value to them.

What Facebook is doing might not be illegal, but I think what they are doing is more unethical than many felonies. The people in charge of these decisions are getting wealthy from them, and they are never going to face consequences for their actions, which is a real shame.

<comment><USER17> Do they get your name? Still I hate it when all sites ask for phone to confirm my account and then use it to target me.

I use different e-mail for FB and everyday use, yet still there are a lot of companies that target me

<comment><USER18> This works as contact matching: they provide list of contacts and FB show to those people ads, so advertiser will not gain access to your personal data.

</comment></comment></comment></comment><comment><USER19> It's always interesting to me the number of people who come out on HN to advocate vociferously for ownership of their private data, given that HN doesn't even let you delete your account ;)

[https://jacquesmattheij.com/the-unofficial-hn- faq/#deleteacc...](https://jacquesmattheij.com/the-unofficial-hn- faq/#deleteaccount)

<comment><USER20> I can't speak for anyone else, but when I signed up to HN I made the naive mistake of assuming that of course a pure tech website would be implemented correctly.

I was surprised and disappointing when I found out it didn't support deletion, but I'm kind of stuck now. Maybe one day I'll scramble my password and never come back, that's about the closest I can get to a deletion I guess. I check all new websites more carefully these days.

<comment><USER21> True account deletion was one of the first features I implemented into my web service. I don't think any non-government site that doesn't offer it has a valid excuse. For example with npmjs.com you have to contact their customer support to delete your account, that's just bad UX.

</comment></comment></comment><comment><USER22> The Cambridge Analytica scandal was super interesting to me because it reflected an entirely standard and unremarkable data-collection process that I'd seen several times. And yet it filled international headlines. Congress was interested.

It's easy to do. You create some app that has "login with Facebook". That's great for users, right? One less password for them to remember. Then as soon as they log in you make a quick call to the Facebook API, get all their friends, and dump it in some database table.

Even if only a few people log in to your app, you can get a database of thousands of real people.

I don't work for that type of company anymore, but I've been many places where that was bog standard, the very first code you write for a new product.

Does anyone know if the Facebook API has changed now?

<comment><USER23> Tangent: This is a side-effect to how Facebook exposes Facebook ids. They expose system-wide identifiers. LinkedIn's API exposes user ids that are transformed based on whoever is interacting with the API. My network graph could overlap with your network graph, but the overlapping people would have different ids.

<comment><USER24> this has been changed for facebook to use app-specific IDs for many years now

</comment></comment></comment><comment><USER25> Absolutely no control?

Don't use social media and lock down your browser to limit fingerprinting. Your remaining big threats are phone apps and traditional data brokers profiling your credit card usage. Cut out all unnecessary apps, block everything else with a firewall and pay cash. You will then be far more opaque to the private surveillance apparatus than most first-worlders.

<comment><USER26> I'm rarely using Facebook. I have an account, even some photos, but that's it. I may scroll the wall from time to time, usually readings arists posts and stuff, as my friends are just like me - not posting anything about them anyway.

I'm a heavy user of privacy extensions. Currently using uBlock Origin + uMatrix. Most sites I run can't store anything (like cookies) or has access to scripting. I'm having an unique e-mail address for every service I register to (thanks to catch-all on own domain).

The above are available to everyone.

Additionally, I'm manually fixing broken websites, that can work without JS but refuses to - this however requires some skills.

When I really want to see the website that refuses to work with all these protections - I'm opening it in incognito session.

Result: On my accounts (both fake and real) these Facebook advertisers lists are empty. The only list that's not empty is advertisers I decided I don't want to see ads from.

Of course I know this doesn't mean I'm anonymous and nobody knows anything about me. A lot of services know. These protections listed above aren't the silver bullet. They can still track me, they just won't tell me everything. Most of my data are stored with Google. I let them store my location history (they probably would do it anyway). They know all my searches. They know my entertaiment interests (Youtube history, likes, dislikes).

Well... You can track me too. I'm not using unique nicknames usually. You can find my contact info on the internet, on my website and other places. You can find my home address. You can know where I work.

But these were my choice. But I still have to remember I can't take that back, "Internet won't forget".

So yeah. You have the control. Just stop giving yourself away, protect yourself from automation. Share yourself with people offline. That's all.

</comment></comment><comment><USER27> One thing I don't quite understand is why Facebook's data about me is my data? In my opinion, it's not. I've never put a single thing on Facebook with the expectation that I'd own it or control it.

<comment><USER28> You know that Facebook still collects information about you, even though you may not even have an account, right?

[1] [http://fortune.com/2018/04/11/mark-zuckerberg-facebook- data-...](http://fortune.com/2018/04/11/mark-zuckerberg-facebook-data- testimony/)

[2] [https://newsroom.fb.com/news/2018/04/data-off- facebook/](https://newsroom.fb.com/news/2018/04/data-off-facebook/)

[3] [https://www.wsj.com/articles/you-give-apps-sensitive- persona...](https://www.wsj.com/articles/you-give-apps-sensitive-personal- information-then-they-tell-facebook-11550851636)

<comment><USER27> I understand what you're saying, and you're not wrong. I just find the concept of data about me being "my data" to be strange. If someone takes a picture of me, it's their picture. If I use your website, and you collect information about me, it's your information. Maybe I just don't care what you know about me. I know the REALLY good stuff about me, and I ain't sharin' that with anyone!

<comment><USER29> It's not your data, but it's data about you and it better be under your control. Your data might be used to target your with information in order to change your political views, to increase your insurance pricing, to decline a loan, etc...

<comment><USER30> Why should it be "under my control?" This is not how I understand the world to work.

If I get caught, say, drinking and driving then I don't get to control if newspapers, courts, police, etc, share it with others. If I go to a party and take a shit on the floor I don't get to dictate what the other party attendants do with that information. I don't get to demand they don't take that information into account when deciding to invite me to another party.

Also, insurance companies and loan companies don't use Facebook data (nor are they legally allowed to).

</comment></comment></comment></comment></comment><comment><USER31> Acxiom opt-out: [https://isapps.acxiom.com/optout/optout.aspx](https://isapps.acxiom.com/optout/optout.aspx)

Oracle opt-out: [https://datacloudoptout.oracle.com/optout/](https://datacloudoptout.oracle.com/optout/)

</comment><comment><USER32> I find it amazing that although my list of advertisers is super long, not a single company on there provides a service that's remotely relevant to me or sells something that I would ever buy.

In fact, I've _never_ clicked on an ad on Facebook. Not because I hate ads (I'm ambivalent about them) but because I've never seen anything relevant.

For all of the hype around how persuasive Facebook advertising is supposed to be, to me their ads and personalization are no better than random noise.

<comment><USER33> I found some interesting points in the list. Bear in mind these are advertisers who got your info outside of Facebook. So while car dealerships are fairly prevalent across the board, I found most of them in my list were dealerships from the brand of car I own. Clearly somewhere along the line of purchasing my car, my email address got associated with "people who buy that kind of car", though I found it odd so many dealerships not in my local area were on the list.

</comment></comment><comment><USER34> The usage of Facebook is free. You uploaded your data voluntarily.

How do people think Facebook pays for running its service?!? Of course you are the product.

<comment><USER35> But Facebook also tracks people who do not have accounts, and people who pay for services. No way out.

<comment><USER36> This isn't entirely true. There is a way out. Media outlets who publish things like "Facebook Showed Me My Data Is Everywhere And I Have Absolutely No Control Over It" could also remove the Facebook scripts and widgets from their sites and write articles to the effect that it's a good decision. The way out of it is to stop with trying to shock people with the fact that they're being tracked and start taking proactive measures to prevent it in the future.

There's some logical fallacy at play when people truly believe that Facebook is the sole perpetrator of this issue.

<comment><USER37> The logical fallacy is your own, nobody in the article, or the comments believes Facebook is the only party doing this.

<comment><USER36> No you misread.

> that Facebook is the sole perpetrator of this issue

Perpetrator. I'm saying we should hold the organizations publishing articles about this kind of stuff accountable as well. They use Facebook tools (like buttons, share buttons, login integration, etc) and encourage use of Facebook to interact with their articles. This is how Facebook sips up and tracks a good portion of the web. The orgs publishing these articles are also perpetrators.

> The logical fallacy is your own, nobody in the article, or the comments > believes Facebook is the only party doing this.

I'm not proposing there's a narrative convincing society that Facebook is the ONLY organization tracking us, that's just silly. I'm saying there's a narrative that is similar to "tracking people is so shocking we just don't know what to do!"

Today it's Facebook, tomorrow the article will be about Google, Microsoft, or maybe Amazon. Can you believe no one's going to budge a muscle about it?

</comment></comment></comment></comment></comment><comment><USER38> I'm curious if I delete (I mean real delete, not disabling) my FB account, do they keep it as a ghost profile of me i.e. Facebook still knows that I exist as a person in the world? I've been thinking about just getting rid of it, not that I use it a lot, but still... One less thing to worry about and less clutter in my life.

The downside to this is that FB is my only channel of communication with some people, but then again if they truly want to contact me they can find a way to do so, although that's going to increase their inconvenience and they might decide against contacting me at all haha.

<comment><USER39> They probably don't delete your profile, but keep it with a "deleted" flag. I'd still recommend getting rid of it. It reduces the noise in your life, and while you will lose touch with a few people, most of the ones who matter will email you.

<comment><USER40> > They probably don't delete your profile, but keep it with a "deleted" flag.

I don't like Facebook, but I'm not so sure about that. I read one article a month or so back where someone paid attention to the targeted ads they were shown after they'd deleted their facebook account. After a few weeks, the targeting got _much_ worse.

</comment></comment></comment><comment><USER41> Mildly ironic since this site uses tracking ads that were blinking in and out of existence all over the page as I was scrolling down the article. I had to stop reading because it was so annoying.

</comment><comment><USER42> Does anyone know if there is equivalent transparency for my Google account?

<comment><USER35> There's a section where you can download all the data Google has on you.

<comment><USER43> Specifically: [https://takeout.google.com/settings/takeout/](https://takeout.google.com/settings/takeout/)

</comment></comment></comment><comment><USER44> On that Advertisers settings page, it is really lame you cannot click through the list of advertisers in one fell swoop, disabling ads from all of them at once. There is no "select all."

No, you have to click the X in the corner of each one, then click View More after every 12 you have disabled. I got through about 140 before giving up.

I think this was intentional.

</comment><comment><USER45> I wonder how it would be technically feasible to instead of copying data to other parties to just grant them access for a limited time and being able to revoke that access. This would be perfect for a lot of data sharing but I guess there is no way to prevent copying of digital data once somebody can read it.

</comment><comment><USER46> If your data (or at least data about you) is everywhere, there's only one thing left to do. You'll have to engage in a misinformation campaign about yourself. Send advertisers so much conflicting information about yourself that they can't distinguish the signal from the noise. That way they won't be able to target you.

This may sound ludicrous, but there actually is a browser plugin out there (I don't have a link handy, unfortunately) that confounds meaningful tracking efforts by clicking on each and every ad on every page you view. The pages the ads link to aren't actually displayed to you.

Like I said, it's a crazy tactic but it makes perfect sense. Overwhelm them with data.

Google strongly opposes it, by the way. So it must be on the right track.

<comment><USER47> I think it can be gone quite a lot more simply: Register on each service with a different first and last name and birthdate, linked to a throwaway email address with its own different name and birthdate. Then register on another service with another, and so on. I'm a white American guy, yet because I've watched some Spanish pop videos and used Google Translate for Spanish translations (and done other things, not as part of a concerted mis/disinformation campaign), my Android phone believes I'm a Latin woman, and I even get a mixture of Spanish and English ads and pre-roll commercials on YouTube videos, and some of the ads are for women's clothing and makeup.

</comment></comment><comment><USER48> Because it's not your data. Just because something describes you, doesn't make it yours.

<comment><USER49> "Yours" and "not yours" is a really primitive way to look at the problem. Every camera that you have passed in front of has your image, and we more or less accept that if it's in a public place that's OK. But that doesn't mean someone can take that image and put it in a national television campaign for their product. There are shades of ownership.

<comment><USER48> I agree, ownership is a poor way to look at it. In fact, there is a rich body of property and tort law that address this whole subject in vast detail and has identified a large set of principles and criteria that can and is applied.

</comment></comment></comment><comment><USER50> What I never understood, when I still used FB, they knew everything about me and yet I have not once been presented by ads I was even mildly interested in while on Google it is always spot on... Not sure how they can be so bad to get 0 clicks from me while having all that info. It is like this person: getting car and mortgage ads while fb knows i could not care less about either. Getting rich quick packages, again I do not care about as far as they can see from comments etc. Flights to Thailand for next week while they know I am currently _in_ Thailand. It is the worst targetting I have seen: not unlike the ads of the late 90s.

</comment><comment><USER19> If that headline accurately describes the situation, in what sense of the words is it "my data" instead of "data about me?"

</comment><comment><USER51> Data retention and sharing should be illegal because it's like a dam bursting when any actor, anywhere, lets your data out.

You could literally do everything right for _decades_ as far as safeguarding your data, and then _one_ slip-up could leak it ALL and let services connect you to ALL the other information about you.

</comment><comment><USER52> Then leave Facebook?

</comment><comment><USER53> Just like your credit report and score, and that's probably more meaningful.

</comment><comment><USER54> At what point does the end user feel accountability for giving a free service all of their information? I get that they employ various unsavory tactics (especially on mobile), but remember that this _is_ the Internet after all.

</comment><comment><USER55> reminds me of this fascinating video about how buzzfeed is playing the system perfectly:

Capitalism, Cultural Disintegration, and Buzzfeed [https://www.youtube.com/watch?v=9srhgHzUFd4](https://www.youtube.com/watch?v=9srhgHzUFd4)

</comment><comment><USER56> The garbage site this content is on is made by idiots. First I get one pop-up, and as I'm about to cross it out another pop-up appears on top of it with the accept button at the same position so that I accidentally press accept.

Stop with the fucking pop-ups if you don't know how to do it!

<comment><USER57> This is why many of us use ad blockers.

</comment></comment><comment><USER58> You work for an online magazine and you weren't aware of this? If you're not the customer you are the product.</comment>


Non-obvious winners and losers in Microsoft Yahoo Deal - <AUTHOR> http://www.tnl.net/blog/2008/02/01/non-obvious-winners-and-losers-in-microsoft-yahoo-deal/ <comment><USER2> Totally disagree on AOL being a potential winner. They don't have much going for them now that they've started becoming more of an advertising agency.</comment>


A Data/AI Marketplace that Lets the Little Guy Compete Against Google, Amazon - <AUTHOR> https://repux.io/?src=HN-Jan-28-2018 <comment><USER2> If I'm not google how do I afford the tokens to buy the machine learning data?

<comment><AUTHOR> You buy a lot of the tokens now when they are cheap. Just a couple of cents. You then hold on for a long time.

</comment></comment><comment><USER3> stop with the new tokens</comment>


I don't want the notice of insecure password/log-in on my website - <AUTHOR> https://bugzilla.mozilla.org/show_bug.cgi?id=1348902 <comment><USER2> > Your notice of insecure password and/or log-in automatically appearing on > the log-in for my website, Oil and Gas International, is not wanted and was > put there without our permission

Just wait until he finds out that firefox is blitting pixels to the display buffer! Who invited them anyways?

</comment><comment><USER3> Quick question regarding this security pop-up. I don't have much experience with the security side of things apart from HTTPS certs/etc, but isn't Dell's NZ website a bit iffy?

i.e. dell.com/nz/ -> 'My Account' looks like it's done over plain HTTP. Is my assumption correct?

</comment><comment><USER4> Oh no.. they've locked it to authorised users only. Anyone get a screengrab?

<comment><USER5> [http://archive.is/53Cbd](http://archive.is/53Cbd)

<comment><USER6> >> Your notice of insecure password and/or log-in automatically appearing on the log-in for my website, Oil and Gas International is not wanted and was put there without our permission. Please remove it immediately. We have our own security system and it has never been breached in more than 15 years. Your notice is causing concern by our subscribers and is detrimental to our business.

Oh my... HTTPS was already well established 15 years ago... are people like this in charge of nuclear facilities, too?

</comment></comment></comment><comment><USER7> It's unfortunate the IT had to find out the hard way just how broken their site security was. It's worse that this isn't the only site out there that is _that_ broken. It's common, they just happened to publicize their lack of knowledge of security and then users went poking around. "Oh hey, SQLi works." and that's that...

Here's hoping they manage to give proper disclosure to their customers/users (hah...doubtful).

</comment><comment><USER8> Oh man, that site is a blast from the past in terms of web development.

</comment><comment><USER9> Users or all tables were dropped, site is entirely a 500 now. I seriously doubt they have any backups either...

</comment><comment><USER10> You have to login to view this bug. No thanks.

<comment><AUTHOR> Yeah it was locked due to the attention it got. You can view it here: [http://archive.is/53Cbd](http://archive.is/53Cbd)</comment></comment>


Human Curated App Store Lists: Big News or Bad News for Game Devs? - <AUTHOR> http://arc.applause.com/2015/06/02/apple-app-store-game-and-app-discovery/

<comment><AUTHOR> The tyranny of the list may finally be over for iOS game devs. But will it be replaced by the tyranny of the Apple editor?</comment>


Try C++17 with Docker - <AUTHOR> http://www.jandeinhard.de/2017/09/15/cpp-and-docker.html <comment><USER2> IMHO Docker is overkill for trying out a new version of gcc. Multiple versions of gcc can exist in separate directories just fine.

<comment><USER3> Not to mention chroots.

<comment><USER2> There is absolutely no need to even involve chroots or anything that needs special privilege just to run a compiler. Typically, a compiler will just read and write files. This is how it ought to work.

      1. Download gcc-8.x.y.tar.xz
      2. Untar anywhere.  I like to do this within my home directory.
      3. Run ~/stuff/gcc-8.x.y/bin/gcc

If this simplest possible thing does not work and drives you to Docker or chroots or similar things, then something fundamental is broken.</comment></comment></comment>


How Safe Browsing Works in Firefox - <AUTHOR> http://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ <comment><USER2>
        Cookies set by the Safe Browsing servers to
        protect the service from abuse are stored in
        a separate cookie jar so that they are not
        mixed with regular browsing/session cookies.

And how are these cookies cleared? Seems like as soon as some sort of ID appears in one of these cookies, XKeyScore will track your every (physical) move with it even if you take care to delete all your regular cookies and don't browse the same sites on different networks. Why does this protocol even allow for cookies to be set at all in the first place?

<comment><USER3> Since Firefox 41 [1] Safe Browsing traffic all uses https, so it should not be vulnerable to passive collection techniques like XKeyScore.

[1] [https://bugzilla.mozilla.org/show_bug.cgi?id=1109475](https://bugzilla.mozilla.org/show_bug.cgi?id=1109475)

</comment></comment><comment><USER4> By default, doesn't firefox query OCSP responder for every TLS connection (unless the server offers OCSP stapling [1]) ? The privacy implications are pretty similar to Safe Browsing.

[1] [https://blog.mozilla.org/security/2013/07/29/ocsp- stapling-i...](https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in- firefox/)

<comment><USER5> Not quite. In the case of OCSP, in the absence of OCSP stapling, all TLS connections are verified with an external server(s).

In that case of SafeBrowsing however, as noted in the article, for those URLs whose hash prefix doesn't match one of the hashes on one of the blacklists, the browser doesn't contact any other server. Only when there's a partial match does the browser ask for a full hash from the SafeBrowsing server.

Source: I'm a Chrome SafeBrowsing engineer.

</comment></comment><comment><USER6> How does it compare to other browsers? Does Chrome, Opera or IE/Edge use similar (or better) techniques?

<comment><USER5> Chrome SafeBrowsing engineer here.

Google has published the protocol that clients need to follow to fetch updates from the SafeBrowsing servers here: [https://developers.google.com/safe- browsing/developers_guide...](https://developers.google.com/safe- browsing/developers_guide_v3#ProtocolBasics)

Both Chrome and Firefox implement that protocol. I believe Edge uses Microsoft's own service. Not sure about Opera.

</comment></comment><comment><USER7> Why doesn't this use a bloom filter? It seems like an ideal application for that data structure.

<comment><USER8> A Quora answer to this question linked to this Google Chrome commit: [https://bugs.chromium.org/p/chromium/issues/detail?id=71832](https://bugs.chromium.org/p/chromium/issues/detail?id=71832)

In short, it says that the prefix set uses less memory than a bloom filter.

<comment><USER9> It seems to be saying that they first used bloom then switched to save space.

</comment></comment></comment><comment><USER10> "Safe browsing" is one of the first things I turn off when installing a new profile in a browser. I personally dislike any commercial service turned on by default in my software that continually and without my consent pings back to some place on the net - using my real IP address and leaking anything remotely related to destination addresses. And cookies?

I think there should be better ways of protection than trusting such a service anyway.</comment>


Windows 8 Spells Trouble for Linux, Hackintosh Users and Malware Victims - <AUTHOR> http://www.readwriteweb.com/enterprise/2011/09/windows-8-spells-trouble-for-l.php <comment><USER2> > Microsoft is requiring (PowerPoint) that OEMs ship client systems with the > secure boot enabled to get the Windows 8 logo.

Okay, so by default this is on. Am I missing something or is there a big reason why you couldn't just Hit [DEL] when booting and change this to [disabled]? After all, major mainboard manufacturers currently make it rather easy to overclock your system (even unlocking disabled cores), which I can't imagine making Intel or AMD very happy.

Yes, some Dell/HP computers might be truly locked, which would make this Winmodem 2.0 on a bigger scale. But as long as you can build your own, most Linuxers and Hackintosh builders should be okay. Well, at least for desktops. If e.g. all Dell laptops would be permanently locked…

But right now this is a lot of coulds and mights over a potential feature. I'm still saying FUD.

<comment><USER3> Probably because that would defeat the point so disabling it from BIOS may not be an available option.

<comment><USER2> It would still be on for most users, so unless malware can affect BIOS options, you'd have complete protection against that.

I'm not certain about the implementation details, but I assume that the OS can somehow figure out if it's booting in safe mode. And I guess Windows 8 just won't boot if you disable it in the BIOS. This would be a bit annoying if you dual-boot and switch frequently, but no big deal. Nobody would loose anything, unless we assume that keeping other OSs from the system is what it's all about.

If it's a hard lock-out, we'll get cracked BIOS images pretty soon. Maybe even from the manufacturers ("Not supported, you loose Windows 8 logo compatibility" etc.)… Never mind that it won't be long until the first crack for this protection scheme is out, disabling it in windows – just like every other annoying activation / security thing MS came up with.

Again, assuming that this it will _really_ be this restrictive and mandatory.

</comment></comment></comment><comment><USER4> Something I didn't get from the articles is can Windows 8 work on non UEFI systems? What if I buy a machine today and wanted (probably won't but hypothetical here) to run Windows 8 on it is that still possible? Because then pirated copies will just use that to get around the requirement.

Also, if this pans out, I hope the EU and potentially the US antitrust authorities look into it.

<comment><USER5> 1.) It's not about piracy, it's about attack surface.

2.) What are the antitrust issues? They're doing this to help preserve the security and integrity, very similar to what Apple does with iOS devices, and almost every single Android vendor does with its devices.

Edit: The downvoters have spoken. But why is Microsoft being singled out when every other platform does, or is looking to do the same exact thing? Android, iOS, and soon likely Mac OS X.

<comment><USER6> 1\. The predictable outcome has not to be the same as the stated goals.

2\. The antitrust issue is that every OEM that wants to distribute Windows could be forced to ship computers that prevents other systems to work. This could be seen as Microsoft abusing his dominant position to block competitors.

<comment><USER5> So does the same line of reasoning in #2 apply to Apple iOS and Android devices? Why aren't people in an uproar about that? (I take that back, they are in an uproar in the Android world).

If you've hung out at a WWDC in the past couple years, it's apparent Apple is looking into the same such security scheme(s) for Mac OS X.

OEMs ship these computers as Windows computers. OEMs generally don't support alternative OSes on their hardware, because there hasn't been enough demand to make it worthwhile.

Linux on the desktop isn't even on Microsoft's radar. That war was lost by Linux (although ironically, they may win or at least fair very well in the "post-pc" era).

I'm still confused as to why Linux diehards don't just create their own (ARM- based?) desktop platform where nothing is locked down or closed source.

<comment><USER7> > the same line of reasoning in #2 apply to Apple iOS and Android devices?

They are not PCs and are not sold under the expectation they are able to run something other than what was built in. What Microsoft is trying to do is to force OEMs into creating Windows-only PCs.

<comment><USER5> There's no expectation that PCs will run anything other than Windows for the vast, vast majority of consumers, either.

</comment></comment></comment></comment></comment></comment><comment><USER8> Wouldn't pirates be able to make Windows copies that have a valid BootManager? Wouldn't OEM's be able to ship chips that allow original Windows to be booted as well as Linux?

This is yet another futile attempt to prevent piracy. Besides, piracy is probably a good thing for Microsoft. The more Windows users the better in the long run.

<comment><USER4> The issue on the linux side is the need to have a valid key to sign your bootloader and from what I understand the kernel too as it's part of the bootloader or something like that. Which means, no self compiled kernel and only from Linux vendors that were able to get a key in there.

Obviously if anyone has a key it's no longer secure.

</comment></comment><comment><USER9> Extensive discussion here from a day ago: <http://news.ycombinator.com/item?id=3020459>

</comment><comment><USER10> "Of course, all major OEMs are going to want the Windows 8 logo."

In a sentence, this is how broken the current OEM landscape is.

<comment><USER11> How does that statement show that the OEM landscape is broken?

<comment><USER12> Who really cares if his PC has a Windows logo on it, as long as it works?

<comment><USER13> How is a regular person supposed to determine if a PC will work well with Windows? The logo program is supposed to give some assurance of quality, especially when dealing with low priced systems.

(Although, Microsoft screwed this up in the past, certifying crappy video cards in order to help partners out.)

<comment><USER7> > How is a regular person supposed to determine if a PC will work well with > Windows?

You can't be serious. Unless you are over 40, chances are you only saw computers that couldn't run some version Windows in museums.

<comment><USER14> The logos are version specific. So a Windows 8 logo would imply things that a Windows Vista logo wouldn't. Especially in this Win8 era with touch and min size for side-by-side, having a logo would be a huge help to many people.

</comment></comment></comment></comment></comment></comment><comment><USER15> Not sure if it's EFI as well, but Chrome OS implements this as "verified boot"[1]. If the OS doesn't check out, it falls back on a backup copy on the SSD (and if that one's bad too, it asks for a recovery SD card). Google mandates a "devmode" switch to bypass it, enabling it wipes all data and adds a warning screen at boot (to avoid malicious rooting), but you have full control after hitting the switch.

[1][http://dev.chromium.org/chromium-os/chromiumos-design- docs/v...](http://dev.chromium.org/chromium-os/chromiumos-design- docs/verified-boot)

<comment><USER16> Yeah, it's EFI. But you can't boot Linux on it because the EFI is "stripped down" and is missing some functions that Linux needs to boot.

<comment><USER17> That's not entirely true, at least on the cr-48. Here is the install guide to get ubuntu on a cr-48[1]. The docs do say, however, that the cr-48 lacks initrd, so you have to modify the ubuntu kernel to get it to boot.

[1] [http://www.chromium.org/chromium-os/developer-information- fo...](http://www.chromium.org/chromium-os/developer-information-for-chrome- os-devices/cr-48-chrome-notebook-developer-information/how-to-boot-ubuntu-on- a-cr-48)

<comment><USER16> Interesting, that seems like a lot of work :) I've seen a simpler hack that rewrites the EFI firmware to emulate a normal BIOS and then installs vanilla Ubuntu or even Windows on it. [http://corey.degrandchamp.com/2011/04/10/flash- google-cr-48-...](http://corey.degrandchamp.com/2011/04/10/flash-google- cr-48-bios-without-luigi-or-ubuntu/)

<comment><USER15> I'd like to point out that your counter to doing "a lot of work" involves totally disassembling the Cr-48.

<comment><USER16> Well, you just have to take the bottom off but it is a lot of screws. Still, I bet it's faster and less hassle.

</comment></comment></comment></comment></comment></comment><comment><USER18> They reference mobile devices that do the same thing...but I can't think of many mobile devices that have been able to do this successfully, they all get hacked eventually. I mean, come on, if you put this up there, people are just going to see it as a challenge and hack it. Every time an OS comes out, they always boast about its new-fangled security features, and every time, within 24 hours of its release, someone in China or Russia has hacked it. There has to be a better way around this.

</comment><comment><USER19> It's going to be one of those "every other version is good".

Windows 95 (crap)

Windows 98 (good)

Windows ME (crap)

Windows XP (good)

Windows Vista (crap)

Windows 7 (good)

Windows 8 (crap)

Let's just wait and see what the EU commission has to say about this. I call another multi billion euro fine :)

<comment><USER20> ... and you conveniently left out Windows 2000 and NT4 which both were rather good and would have screwed up your list and thus destroyed your argument.

I agree though that the EU might be interested in something like this, but it wouldn't be Microsoft they go after but the OEMs to force them to allow users to install their own keys or at least turn off the signature validation.

<comment><USER21> I thought the same thing (about 2000 & NT) but then it occurred to me that those versions were (I believe) considered part of the business-oriented (rather than consumer-oriented) NT line, so maybe the list above is reasonable.

</comment></comment></comment><comment><USER22> You have to wonder if Microsoft is doing this out of malice or just because they haven't thought it all the way through.

I'm going to go with option 2 -- I don't think they are clever enough to nerf linux like this. They are probably just thinking, "how do we prevent viruses?"

<comment><USER23> In my limited experience on and around the Redmond campus, I have to say I was startled by the level of ill-will some MS employees have towards Linux. Ranging from dismissal, "UNIX is nothing but a toy" to outright hatred, "Linux is evil". This seemed to only increase the closer you got to the top...

Although that doesn't necessarily mean they're doing this out of malice, I don't think it went entirely unconsidered. MS definitely likes to be aggressive when possible.

<comment><USER24> MicroSoft is famous for developing a siege mentality intentionally as it helps them get a huge amount of labor out of their employees.

<http://en.wikipedia.org/wiki/Siege_mentality>

What the Wikipedia article leaves out is that employes that are in this state will have a sort of 'fight or flight' response and will usually work their tails off.

<comment><USER25> I'm an employee of Microsoft in the Valley. when I leave work at 6:15, there are maybe 15 people left at their desks in the section of the floor I work on (which has about 150 desks in it.) I know multiple people who show up around 11 and leave by 6.

Microsoft is hardly the worst offender in this metropolitan area, much less the industry.

</comment></comment></comment></comment><comment><USER26> I thought we were past this stage? Honestly, I think Linux is established enough that this won't be an issue. See the CR-48 from google.

</comment><comment><USER27> I'm only running Windows on my VMware machine.</comment>


Ask HN: Has anyone created a bitcoin mining env. in MS Azure - <AUTHOR>

<comment><USER2> I'm doing this. Not Bitcoins, but Litecoins because mining bitcoins wouldn't be profitable at all.

I'm running 7 XS (single core) Windows Virtual Machines that run CPUMiner (or minerd). They produce around 3.6 KHash/s per server, which is very low, but Azure servers don't have a GPU so we can't run GPU-based miners like cgminer. Here's a picture of the running servers: [https://fbcdn-sphotos- a-a.akamaihd.net/hphotos-ak-frc3/14155...](https://fbcdn-sphotos- a-a.akamaihd.net/hphotos-ak-frc3/1415530_763464910345604_1829192798_o.jpg)

Doing this is not profitable at all, unless you have free credits. I have a free MSDN Ultimate subscription that has $150 worth of Azure credits every month. Since I'm only running a very small and simple website, I have spare resources that I could spend on litecoin mining. This can hopefully produce around 1 LTC per month.

Yesterday I stopped running minerd on 2 of my servers and dedicated them to BOINC (cancer mapping). Ripple Labs will give you free Ripples (XRP) for donated computing power: [https://www.computingforgood.org/](https://www.computingforgood.org/)

If you have any questions, please feel free to contact me.

<comment><USER3> Look like if you build some web app and have it run for one or more customers, it'd be more profitable; that's what I'm doing with my free msdn ultimate. (passively pocketing at least $300 per month) and another customer is just around the corner which may tripple it.

Though, finding such ideas/customers is exponentially harder than installing mining software.

<comment><USER2> Yea of course, but I'm already busy with 3 different projects and none of them will use Azure any time soon (actually 1 will, but I'll get a new bizspark for that). Al my credits were just wasted on idling servers...

</comment></comment></comment><comment><USER4> CPU-Based BitCoin mining hasn't been profitable for a long time. After the introduction of ASIC-miners, difficulty has shot up and only made CPU mining more useless.

</comment><comment><USER5> IIRC that would all be CPU-based which is considered obsolete in the BTC mining world. GPU's are on their way out as well I think with ASIC's taking their place.

<comment><USER6> I don't think most ASICs can break even at this point, the difficulty has shot up dramatically over the last 3 or 4 months.

</comment></comment><comment><AUTHOR> Really, no one?

<comment><USER7> ...Read the previous answers. It is simply not profitable. CPU mining is not profitable at all, GPU mining is almost if not already unprofitable. Even most ASICs can't break even like trafficlight said.</comment></comment>


Where Vi Hart's Money from Patreon All Goes, a Breakdown - <AUTHOR> https://www.patreon.com/posts/vi-hart-tau-17539475 <comment><AUTHOR> 29% to taxes

5% to Patreon fees

Cool to see where the money actually all goes. Not just to her savings account!

"...$89 a month for everything else in my life, things like food and clothing and toothpaste and medical bills."

2018 is so strange. Stuff that used to be 50% of a person's budget are now almost negligible. I thought medical expenses were high in the USA. Maybe there is a story here that she isn't sharing? I hope she will be okay if a big medical bill comes up. Her health is the foundation of everything else she does.

P.S. What the heck is a "dogget"?

</comment><comment><AUTHOR> Dammit, I'm increasing my monthly pledge. Vi Hart's work is too important for her to live like that.</comment>