What does HN think about OccupyWallStreet? - <AUTHOR>

A. Down with the bankers, up with main street! B. Cool protest...but half of my friends work at GS so... C. If I get this startup done, I'll automate an entire industry! Wait, did someone said protest? D. All of the protesters should enroll in C++ or Haskell class right now. Or join the enemy: VBA. <comment><USER2> e. I think some of these people have valid reasons to be upset with how the bailouts were handled, and at least they are trying to take some action and care about their future. But what are they trying to accomplish with their protests. I'm the 99% doesn't give the 1% who you are trying to affect the opportunity to understand what you want them to do.

the gov't gave you $4 trillion when you screwed up, and we're paying for that with our lack of jobs, income, and loosing our houses. We want you (banks) to x,y,z and we will do a,b,c...

I just want to see one place where a coherent message of demands is, so I can pick a side. I think the way the bailouts was handled was shameful, and I'd like to see main st. Get back on it's feet, but it is difficult to do that because I don't know what they are really asking for.

in contrast to Vietnam war protesters, they got it. They knew what they wanted, nobody questioned what the protesters really stood for. Same with anti-nuke, immigration protests, civil rights, etc etc.

I'm assuming that they are possed about the bailouts and the financial issues only because they are trying to disrupt wall st. They could be the 99% who can't afford healthcare, 99% who thinks there are too many Starbucks outlets, 99% who have to watch their weight and exercises to stay thin while the 1% can eat whatever they want and never gain a oz.

how they haven't realized that they don't have a single cause yet is very surprising, or maybe I'm just missing it.

<comment><USER3> It's only their third week. The Vietnam War protests went on for how long? Give them some time and maybe they'll get the message figured out. The solutions to economic depression and socioeconomic disparity are a bit more complicated than "pull out of the war." You don't fix a mediocre Gini coefficient overnight.

They seem to be at the "I'm pissed, are you pissed too?" stage. I expect they'll either fizzle out eventually, or they'll refine their message and pivot.

</comment></comment><comment><USER4> It is good that this is getting some publicity but the whole protest is misdirected without a clear message or demands. I would love to see more of the '99%' take a relatively smaller step forward and participate in elections. With so many close races, even a few unified percent, of the '99%', can hold a lot of political clout thereby making a stronger statement. As a bonus, you can take work off to vote and you don't have to get arrested!

</comment><comment><USER5> It's a movement desperately in need of leadership.

The financial system is incredibly complex. It makes protesting it extremely difficult because there are so many aspects that are broken. Anyone who ends up leading it will inevitably have to be pretty closely connected to the so- called 1%, because frankly that's who runs the show right now and those are the people who understand the system and how to change it.

I'd love to help but I'm afraid I'm on the wrong side of the country. If you want to help me with PlainSite (<http://www.plainsite.org>), though, I think it could help articulate the movement's message.</comment>


The Double Robotics Office Robot - <AUTHOR> http://www.colbertnation.com/the-colbert-report-videos/430940/december-03-2013/the-double-robotics-office-robot

<comment><USER2> Link for the non-US: [https://showyou.com/v/h-rYcJg2xNKK3Qb30j/the-double- robotics...](https://showyou.com/v/h-rYcJg2xNKK3Qb30j/the-double-robotics- office-robot)

</comment><comment><USER3> The Double does NOT keel over that easily. I've crash tested it many, many times.

<comment><USER4> maybe it was hitting the inclined surface of the podium? I can see it staying upright after smacking into a wall, but then the tall lever-arm has something to push against.

</comment></comment><comment><USER5> How much does it cost to get placement like this? Is it done through a PR firm?

<comment><USER6> Nothing - they asked for a loaner unit and we sent it, knowing they'd have some fun with it. I believe we'll even get it back next week.</comment></comment>


MoviePass exposed thousands of unencrypted customer card numbers - <AUTHOR> https://techcrunch.com/2019/08/20/moviepass-thousands-data-exposed-leak/ <comment><USER2> > because a critical server was not protected with a password

Sometimes I have a feeling that such omissions should be punishable. High fines or something. Time's changed, law should change as well.

<comment><USER3> Do you punish the sys admin or the creators of Mongo for making the default configuration insecure?

<comment><USER2> Would you punish a knife maker because someone used it to hurt others? I am not really sure how else I could answer that question. Assuming you're not pulling my leg, are you?</comment></comment></comment>


I have tried to be happy with django, I really have. - <AUTHOR> http://www.reddit.com/r/django/comments/d1gjk/i_have_tried_to_be_happy_with_django_i_really_have/ <comment><USER2> The OP makes a few points, most of which I disagree with (they're mostly a matter of opinion).

One valid point he makes is: "Confusion on where to put code, and too much flexibility". Can't say how it is in other frameworks, having never used them, but The Django Book had far too many cases of saying "you can do it here or there, it's a personal preference". I don't want to make a choice when I'm new to a framework, I want to be told what's correct and what isn't!

<comment><USER3> I think it's a matter of what kind of framework you want to be. Rails is very opinionated: Fat model, skinny controller, and use helpers or you're a fool. Django is less so: Put it here, or there... whatever you like. It really comes down to the philosophy of the underlying language I think. Ruby in general is kind of opinionated, and python less so.

<comment><USER2> One of Python's doctrines is "There is only one correct way to do things", which suits my philosophy perfectly: I don't like having to make decisions, I like it being obvious what the correct way of doing things is.

That's why Django's "flexible" approach seems odd to me.

<comment><USER4> Another one of Python's doctrines is that practicality beats purity. Given the differences between a lot of websites, I can see a one-size-fits-all model going out of the window pretty quickly. Especially so given all of the wa-wa-I don't like the auth/admin/predefined data fields that seems to be going on here...

</comment></comment></comment></comment><comment><USER5> The real issue I have with Django - and extensions such as comments - is that in some ways it feels like a CMS masquerading as a framework.

Take for example contrib.auth - it defines User, Group and Permission models for you. Frequently this is an issue - what if I don't want a username of 30 characters ? What if I want OpenID authentication instead ?

Sure, you can override this but then you find that a whole lot of 3rd party apps - comments, admin etc - rely on these models, which in turn depend on lower-level functionality such as the ORM or templates. The very fact that you have a framework telling you what your data model should look like just feels "wrong".

Does this mean that you shouldn't use Django ? Absolutely not, there are many projects suited to Django - especially content sites where you are putting together large building blocks with some homemade glue. But I've found it more trouble than worth for smaller projects, or where you have very specific requirements - in these cases (assuming you want to stay in Python) - I'd recommend Flask or Pylons.

Unfortunately Django has become the new Blub framework for Python web development, which means it's used by companies by default, rather than being a useful but limited tool in the toolbox.

<comment><USER6> Alternate login backends are supported and documented. OpenID is as easy as a package install and adding a few settings. <https://launchpad.net/django- openid-auth> works well and it integrates into auth.

<comment><USER5> You completely missed my points:

1\. The framework should not define your data model.

2\. Many 3rd party apps depend on the existing User and other auth models.

<comment><USER6> I still must be missing your point... What would you prefer? If there was no contrib.auth then at best you'd have to do it all yourself which still means customizing third-party apps.

<comment><USER5> Authentication is something in my experience that is specific to an individual project. I don't want to be told what database schema I must use to store my user data - that's a specific project requirement (unless I'm building a cookie-cutter site, which Django is good at, as I've stated).

So what do I want ? For authentication there are some common requirements:

\- session/cookie management to store a user ID (or other info)

\- hooks/middleware/whatever to allow me to check user credentials on each request

\- safe hashing/encryption of passwords

\- form processing/validation

\- integration with OpenID, oAuth, LDAP etc

If a framework, or libraries, provide these then that saves a lot of time and effort, and allows me to create a tailor-made solution.

<comment><USER6> You can do all of these with Django, but not unexpectedly it won't magically work with other people's code. I don't know how it could, if there's another framework that does this I'm interested.

contrib.auth can be made to do most of these if you still want the ability to play nice with other people's code who expect you to use auth. You'll have to create and manage User objects which it sounds like you're unwilling to do, but you can't have it both ways.

I think having it there is better than not. In most circumstances it saves me a lot of time. If I come across a circumstance that I can't use it then I'm just back to where I would be anyways and will have to write a lot more code and modify 3rd party apps.

<comment><USER5> Exactly, it saves a lot of time when you want a cookie-cutter site using lots of 3rd party apps. Not knocking that - there are lots of cases where that's exactly what you need. But this is what reminds me more of a CMS like Drupal than a framework - blocks of content managed by a single admin and authentication system.

When I want to do something more original and specific where I don't need all those apps, Django just gets in the way - and that's when I turn to a more lightweight and flexible framework.

Use the best tool for the job. Sometimes Django is that tool. The problem I have is with companies and individuals who think it's the _only_ tool.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Here's the problem: "I have spent 2 years trying to learn django, why should I waste it? I'm 19 years old now..."

A) 2 years of programming experience in any language is not a waste of time even if you never touch that language again, B) Sunk costs, if the previous 2 years were a mistake, then don't repeat that mistake by sticking to a language and framework you don't like. C) 2 years is nothing.

<comment><USER8> D) You're fricken' 19. You're supposed to be "wasting time". You can't find the right path for you until you determine some of them are dead ends.

<comment><USER7> Absolutely. He needs to be spending time reading literature and visiting art museums and hiking in the woods and fooling around with girls. There's plenty of time to work when you're old.

<comment><USER9> As I sit at my desk at age 20 with a cup of coffee. :(

<comment><USER8> At 20 I was running around playing GI Joe in the forest. It wasn't until 23 that I realized that shit was real.

At 35 now I certainly don't consider any of that time wasted. I would suggest if you are "frowning" now - as you put in your comment - to get out and do something that doesn't make you frown... the cup of coffee will still be there, I guarantee it.

</comment></comment></comment></comment></comment><comment><USER10> -1 On the community - StackOverflow alone is enough to find / get you answers to 99% of your questions in seconds.

+1 On the extensions - They almost never work out of the box and require extensive changes (or usually rewrites). Seems like Django people never figured out how to create portable apps for Django. (And the comment app is Horrible !)

<comment><USER11> I feel the main problem with extensions is that the "application" level of abstraction doesn't work very well in practice. It was an ambitious idea, but there are too many dependencies for that to be feasible.

That said, I still like Django for quickly banging out moderately complex apps.

</comment></comment><comment><USER12> It's okay to not like frameworks. My opinion is that frameworks, in general, make easy things a little bit easier, and make hard things even harder.

</comment><comment><USER13> Completely offtopic, but I replied to the OP (on reddit) and remembered a problem of my own that I'm having, and I can't quite figure out how to solve.

Nginx + Django -- I have wildcard DNS on mydomain.com, and want to support customers such that customer1.mydomain.com gets its own database. I thought I'd be able to use fastcgi_param to inject a variable to fcgi, and then read it with os.environ.get('fastcgi_param'), and then 'IF' the settings.py to import customer1.settings.py (to override the database), but I can't seem to make it work.

Any thoughts?

<comment><USER14> There are several options here. First, you could use the Django "sites" framework, which has the advantage of being idiomatic and familiar to other Django developers:

<http://docs.djangoproject.com/en/dev/ref/contrib/sites/>

Second, you could define a database backend per customer (using the Django 1.2 multi-DB support) and write a custom database router that is aware of your custom FastCGI environment variables:

<http://docs.djangoproject.com/en/dev/topics/db/multi-db/>

Third (and best, IMHO) would be to run separate FastCGI processes for each customer, and route appropriately from Nginx. This approach is obviously the most complex setup, but it has the major advantage of letting you run every customer's FCGI backend under a different user id, offering yet another level of protection against data leakage and other security issues.

<comment><USER4> The other advantage of the third option is that you don't have to write a whole bunch of auth/filtering code to only show customers their own data. Row- level permissions are relatively straightforward in Django, but it's still easier not to have to deal with them.

</comment></comment></comment><comment><USER15> Is it really that bad? I get the impression that most are happy with Django (or maybe that is other python frameworks.....).

<comment><USER16> It's not really that bad. I'm baffled how he could spend 2 years with Django and not understand how to do the things he's complaining about (not to mention python).

I think it was just a bitching session.

</comment></comment><comment><USER17> Model package management: It's a dirty kludge. Not documented (last time I've checked), I had to search hard to get it right.

You must edit models/__init__.py such that:

        import X from Y

...and then each model must have

        class Meta:
            app_label = 'foobar'

Without the meta information Django cannot load the models inside the package, it imports only models.py.

May be it should be automated (model loader)? For instance, the model loader could parse the directory tree and import all necessary info it needs(meta information, optional), all is needed is a function for it :-/

edit: Format, gramer :)

edit2: Phah! OK. I'm gonna do it. Automatic model loader function, Django extension :) (May be next week...)

<comment><USER17> Ok HN :-/

However, for those interested in model package loading automation, I started a section on reddit: [http://www.reddit.com/r/django/comments/d1ulg/automatic_mode...](http://www.reddit.com/r/django/comments/d1ulg/automatic_models_package_loader_django_extension_d/), may be I'm wrong...

Sorry for bothering you...</comment></comment>


How the GDPR Will Disrupt Google and Facebook - <AUTHOR> https://pagefair.com/blog/2017/gdpr_risk_to_the_duopoly/ <comment><USER2> And if you think GDPR is a toothless joke, let's take a look at the defined fine stucture.

It is pretty simple, only 3 levels (strikes for the fellow Americans):

Strike 1 - Stern warning letter

Strike 2 - 2% of your TOTAL GLOBAL REVENUE

Strike 3 - 4% of your TOTAL GLOBAL REVENUE (or 20mil EUR, whichever is higher)

And now you know why GDPR is a board level topic. Keep in mind that the EU/US Safe Harbor agreement got axed due to a lawsuit of a single student from Vienna against Facebook. So all you need is a single pissed off German customer you ignored when asking for their data report card and you're _fucked_.

For startups - GDPR is like Y2K at the time, a GOLDMINE. So much opportunity to sell solutions, from real to snake oil. GDPR compliance is already and will continue to trigger a massive wave of investment.

Enjoy :)

<comment><USER3> Throwaway account.

I have national sales responsibilities for one of the majors. Think IBM/Microsoft/Oracle/etc leading a sales team of 74 reps.

You'd be surprised at how LITTLE sales we've generated from GDPR. We've been providing free GDPR assessments for the past 1.5 years for over 200 accounts as lead gen opportunity and very little sales have resulted.

It all boils down to companies simply don't believe the fines will be enforced given just how expensive the fines are.

And since GDPR doesn't go into affect until May 2018, companies are just waiting and seeing what happens.

It's really hard to sell GDPR because it's essentially an insurance policy. Why spend $5m on software and another $5m in services ($10m combined) if your total fine is only $20m. Do you as a company have a 50% chance of getting fined? If not, then roll the dice and not buy a solution.

<comment><USER4> The fine doesn't absolve you of responsibility for complying. If you're fined you have to pay up AND you have to comply. Otherwise they'll just fine you again, as they did to Google.

<comment><USER5> Nevertheless, a 4% fine is very low, given the low frequency of fining. Tech firm margins are much larger than this; so while it's clearly unethical to do so, it may be more profitable to simply accept the fines as a kind of tax for as long as possible, and to continue to profit from all that data until things get really dire. In actuality; a firm wouldn't need to choose quite so starkly to flaunt the law; simply failing to invest and dragging your feet looking for impossible have-it-all solutions might well be enough to get away with a few fines until you really try to get your act together.

If you will; it's the difference between the VW approach and those of (as it appears anyhow) all the other carmakers. They're all cheating; most simply were wise enough to avoid doing so explicitly.

Data protection is also harder to enforce than emissions; and just look at how laughably incompetent emissions enforcement is to get an idea of how seriously you're likely to get caught if you happen to collect too much private information.

I expect the same here as in emissions: no real compliance for years (if not decades), and when enforcement comes, it won't be the regulator that actually catches even egregious wrong-doing. I mean; the high-profile players will play lip-service of course, but that's it.

<comment><USER6> I really doubt that these companies would lose more than 4% revenue by complying. Worse ad-targeting in the EU is not worth that much.

<comment><USER5> I'm not so sure. And it's not just ad-targetting - all kinds of personalized stuff and simply general purpose data mining suffer too. And don't forget that they wouldn't get the full 4% immediately; and would likely be fined much less than once per year based on current trends anyhow. So that 4% is going to be further diluted.

<comment><USER4> That's not what has happened so far. The search Engine Results fine of €2.4bn was based on the length and severity of past infringement and they were threatened with a $10m per day fine, equivalent to 5% of global revenue, on an ongoing basis if they didn't comply within 90 days. So they absolutely have been hit with a heavy lump sum fine from day one.

There's no need to theorise about how the EU might enforce such laws, we've got actual examples of them enforcing laws like this already and they do not mess around.

<comment><USER5> Google's revenue is _all about_ data collection. If they can't collect lots of data, the whole business model is a lot more questionable. In the face of that, 2.4bn _once_ is a trivial fine; consider that that's something like what... 3% of their revenue in one year?

Of course they'll try to avoid that in the future, but the fine is mild enough that it's not going to cause firms to err on the side of caution. They're going to look for the absolute edge of the law.

Frankly, if google had not leveraged their search "monopoly" (not quite a monopoly), I suspect their market cap would have been more than 2.4bn lower; so this was a pure win - especially since conviction and detection aren't a slam dunk.

<comment><USER4> Did you even read my post? It wasn't €2.4bn once, it was that PLUS €10m PER DAY of persistent non compliance. That would have come to €3.6bn per year.

The lump sum was just for backdated non compliance.

<comment><USER5> I read that: the point is that 2.4bn just isn't all that much given what it does to the value of the company. It's probably a risk worth taking as long as you can get away with it. And yes; that means you'll need to eventually adapt - not because 10m a day is necessarily enough to actually enforce that, but also because this kind of stuff is gamable; complying with the ruling without much risk of competition at this point is pretty easy. And you'd need to make the calculation that even if 10m a day were acceptable for the gain, simply ignoring high-profile judgments against you may have worse ramifications down the line.

I'm not saying it's nothing: it's that it's a risk worth taking given the gains. If you're building a trillion dollar company (i.e. google), then eliminating competition or accepting some judicial friction as a way to establish dominance in your (data-mining) field is perhaps acceptable or even wise.

In that, these fines simply aren't punitive enough, especially since they come so late. And again - it's not black and white. The existence of such rules will alter behavior; it's just a question of whether the reaction will be legal mitigation tactics, a company-wide change in approach, or something in between.

Put it this way: if you can corner a market worth trillions, risking how much loss is acceptable to reduce or eliminate competition? I'd venture that these fines are at _least_ one order of magnitude too small to be really frightening (which isn't to say that the behavior google was convicted for deserves that amount, simply that anything less than that means that law can't really be enforced)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> While I see some of the concerns about the _technicality_ of the law as completely legitimate, it still bothers me that so many people reject the whole spirit of this law, and cannot put the negative of "tax on startups" against the much greater good of personal privacy.

I've just started a business myself, and this regulation affects my company too. It makes development costlier; it'll take from the precious little time we have to spend on compliance paperwork rather than work on our core business. In the short run, it does hurt our chances of success.

Yet, none of the trouble is even comparable to what's to be gained here. And it bothers me (though doesn't surprise me) that some people don't see that.

It also bothers me that such vocal opposition barely comes up when the discussion is just about bigger companies such as Google and Facebook. How can we expect "un-evilness" from bigger companies when we're barely willing to do anything in that regard ourselves?

<comment><USER8> Possibly because personal privacy as a "much greater good" is open to debate. People place wildly differing values on that property.

Google's current ecosystem of data-sharing means that Assistant can make educated context guesses on what I mean when I talk to it based on my browser history and map navigation history. If the new privacy constraints damage that passive interconnection, that's not a net good for me.

<comment><USER7> > ... privacy as a "much greater good" is open to debate

I agree, but that's a different topic, really. The comments here aren't about the (un)/importance of privacy. The main debate seems to be either about the technicality of the law and its possible unintended consequences, which are legitimate concerns, or they're about how "this is gonna make my job much harder," which is not really a legitimate concern in this context, and those comments were the ones I was talking about.

> Google's current ecosystem of data-sharing means that Assistant can make > educated context guesses on what I mean when I talk to it based on my > browser history and map navigation history. If the new privacy constraints > damage that passive interconnection, that's not a net good for me.

I think we're overestimating a technical difficulty here, and downplaying a moral principle.

Providing a personalised service without storing large amounts of personal information in a central location is not impossible. It's just technically harder to do.

And even if it was impossible, then still, we need to sort out the moral consequences first. Not by banning technological progress of course, but perhaps by bringing more oversight to corporations. Or by making sure that people of lower socioeconomic background aren't hit harder than the wealthy.

</comment></comment></comment><comment><USER9> I encourage a little more thought before cheering this on as a win. While GDPR isn't as ridiculous as the Cookie Law, it still shows that the EU/EC don't understand the technology they are trying to regulate, and it comes at a huge cost to tech companies.

Take the _right to be forgotten_. First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't like the content, but that is what the EU has ruled should happen.

I get the desire to have a company forget about you, and remove all the personal information they have. It makes sense from a personal standpoint. But how do you do it technically?

If you follow GDPR strictly you would need to be able to purge the data from your _backups_. Now most backups are considered immutable, so you aren't going to do that, meaning you need a way to ensure that "forgotten" users never get restored.

But how do you even delete the live data? Does the tech company you work for have the ability to delete all traces of a user from their system, cleaning severing all relationships with other objects in your system? Do you have the ability to retrieve _everything_ you know about a specific user, and provide it to them? You will need to write the code to do this.

There is a good chance your little startup that isn't cash flow positive will have to spend $1 million of its VC money on becoming GDPR compliant.

Do you sell a SaaS service to businesses, and those businesses send you their customer's data? Then you are the processor and they are the controller. Cool, less for you to do, sort of. Except that controller must agree to _every_ sub- processor you use. Want to switch from AWS to GCP? You can only do it if all your customers agree. Want to use try out a new metrics or logging service? If it will have any PII you can't do it without customer (controller) permission.

You will basically need to hire full-time compliance officers to deal with this. The big tech companies already have compliance officers, but GDPR is so massively invasive to businesses that even small companies now need compliance officers.

<comment><USER10> > First of all, it should be common sense that no one has the right to force > legitimate news articles to disappear because they don't like the content, > but that is what the EU has ruled should happen.

No, it is about deleting personal data attached to your user account, not "news articles". This thing intends to make the "delete my account" button to actually, you know, "delete my account", instead of fake-deleting it by setting a "deleted" flag and telling me that everything is gone now while still keeping gigabytes of data associated with me in your database.

> [...] meaning you need a way to ensure that "forgotten" users never get > restored.

If this is considered to be a hard problem, then I assume storing some list of deleted users in a separate place and immediately purge those users from the backup after restore must be some kind of rocket science.

> There is a good chance your little startup that isn't cash flow positive > will have to spend $1 million of its VC money on becoming GDPR compliant.

I wouldn't call it "to become GDPR compliant", I would call it "to build a sound database structure". Because if you are unable to purge all data associated to one of your users' accounts from your system without destroying the integrity of the rest of your data, then you obviously have a half-baked system at your hands that lacks a core feature - to actually delete accounts. And you surely should spend some of your money to refactor this crap into a long-term viable solution while you are still small and agile enough to do that. Because it's only going to be way more expensive later on...

<comment><USER11> You missed the point: if I take an image backup of a disk and store it, even in encrypted format, and it contains John Doe's account, and he comes along and asks for his account deleted, I would have to purge not just my database record, but the backups images from the past as well. That invalidates ALL of my backups. It's not often practical to backup INDIVIDUAL users..

<comment><USER12> This is very easy to work around. Associate each user with an encryption key and store in a separate database which backed up with some retention time. It shouldn't be huge so that's not a big problem. Encrypt all data related to the user with this key. When you make a backup, this data is stored in the same encrypted form. When you delete user, just delete his record together with this key. After this the user's data is virtually irretrievable and for all practical purposes is deleted.

<comment><USER13> Unless I'm misreading you, you've just created a more complicated version of things. How do you delete the immutably backed up keys?

You've gone from: backup.bak to backup-encrypted.bak and backup-keys.bak

<comment><USER14> Obviously, you can't keep insisting on immutable backups. Instead, you'll have to modify a single key in the backup file to become invalid.

This does make your backups slightly less reliable, because it's one more thing that touches them, but if you do a sane implementation and exhaustively test it, the risk is manageable.

I'm also not sure you really need to keep that many backups of this file. Replicate it and make sure you can roll back when your replication is borked, but if you _really_ need to restore your database from months ago, using a newer list of encryption keys shouldn't be a problem.

</comment></comment></comment></comment></comment></comment><comment><USER15> This has nothing to do with the size of your company/startup and it has nothing to do with regulatory compliance. It is a pretty simple at its core: if your company/startup gets breached and as a result PII data leaked, then you are liable for the penalty according to the general rules. I don't think anybody will argue this is a bad thing. If anything, it will help companies to be a little bit more careful with what sort of data they collect because frankly, at the moment almost every company is perhaps guilty of collecting far too much personal data under the assumption that one day it may become useful. If you collect PII data then you are liable for damages if you happen to mishandle it.

So here is how to avoid the GDPR penalties.

1\. Get compliant - it is pretty much ISO27001 and it will cost you money 2\. Don't collect excessive PII data and if you do, store it securely - after all it is a very basic ask 3\. Avoid collecting PII data at all cost - think of it as another form of PCI

Frankly, there is no need to panic.

</comment><comment><USER16> > The critical question for both businesses is whether users will click "yes", > when asked to consent.

Yes, users will click yes on basically anything. Facebook could put up a message that says "In order to proceed, click yes to give us half the money in your checking account" and the majority of Facebook users will still click through. Look at EU cookie warnings. Did any of those warnings noticeably impact anybody's traffic after the first week?

<comment><USER17> Cookie warnings is a bad example as it was widely acknowledged by anyone vaguely techy that they'd got it completely wrong from the start.

<comment><USER18> Eh, couldn't you make the argument that the Cookie warnings showed that a government body could meaningfully change the experience of the internet? As small as the warnings are, had anything like it been done before?

<comment><USER19> Sure, now we get annoying warnings on every website we visit....

<comment><USER20> Because the UK intentionally built a loophole into their version of the law.

The actual original cookie law, that was decided on EU level, requires users actually to be able to opt out.

But it was a directive, and so countries could interpret it for local implementations.

The GDPR is a regulation, which means its text is directly law, and it also means it can be a lot stricter.

<comment><USER21> Not so much a loophole but the UK Information Commissioner certainly adopted a more relaxed approach to enforcement of the requirements of the cookie law compared to other countries.

And the law required prior informed consent to cookies with opt-out not generally being considered to be valid consent.

</comment></comment></comment></comment></comment></comment><comment><USER22> I see this as yet another tax on (European) startups who have to invest even more resources into regulatory compliance.

This prohibition of freely using all available data will create great arbitrage opportunity for the shadow economy, and will have a net negative effect on innovation.

I think prohibition has very bad side effects, and that MORE transparency is the way forward in politics, economy, and also society. This includes allowing businesses to use all the data they can get their hands on. People can produce infinitely more data than any google can realistically process.

I cannot understand why people who are otherwise for transparency and against prohibition are celebrating this as a big win against FB/AMZ/GOOG, as those players can easily shell out another $10M here and there to be compliant with this regulatory monster.

<comment><USER23> > I see this as yet another tax on (European) startups who have to invest even > more resources into regulatory compliance.

This also affects American companies and the degree it affects you primarily depends on how much of your business model was depending on you doing nefarious things with customer data.

<comment><USER22> Of course this affects american companies, as the whole thing is primarily designed as a weapon for the EU against US dominance in the consumer space.

The big problem for the EU is that consumers actually choose the best product in a free market (the internet of free services), and they overwhelmingly decided to use the US-based options.

All the framing as "nefarious" is propaganda, consumers choose freely the option they value the most. If someone else comes along providing more value than google or facebook everyone would switch in an instant.

<comment><USER23> I suppose we fundamentally disagree on a few things here so I won't go into a discussion about the motivation of this law (which I as a EU citizen support). I do however want to leave a note on this quote here:

> All the framing as "nefarious" is propaganda, consumers choose freely the > option they value the most.

Customers cannot choose freely. I'm a customer and I cannot chose certain products because they do not exist. Companies I never engage with are tracking my activities through tracking pixels and other things and because I never establish a business relationship with them, I cannot avoid that. This bill now forces a company I might do business with not do business with companies that do not permit me to get rid of my data.

I think this a good development because it finally makes certain backroom deals visible.

<comment><USER22> > Companies I never engage with are tracking my activities through tracking > pixels and other things and because I never establish a business > relationship with them, I cannot avoid that.

You can easily avoid being tracked by using an adblocker. Other websites only track you because they are business partners of the tracking companies, which provide a lot of value in terms of analytics for the business - free of charge.

> I think this a good development because it finally makes certain backroom > deals visible.

As a German, I'd like to have more transparency into the backroom deals that are done in Berlin and Brussels.

But this won't happen unfortunately, and they'll try to regulate IT to death to the benefit of local corporations who failed again and again providing the consumer with as valuable producs as their US counterparts.

<comment><USER23> > You can easily avoid being tracked by using an adblocker.

Except not really. Plenty if tracking happens regardless based on fingerprinting. And even ignoring ads there are plenty of free services that after a while turn iut to be so shoddy that they lose the data i left on their services and provide no way for me to demand deletion.

I get a mail every other month that my email address and password where found in a data leak.

This regulation is a good first step of forcing companies to think about the consequences of having data.

> As a German, I'd like to have more transparency into the backroom deals that > are done in Berlin and Brussels

Same. I want a lot of transparency including from my own government. I'm however going to accept any positive development and won't demand them to be in a certain order :P

There are a lot of people who are trying to shape the EU into a better institution. It's not perfect but it's a pretty good start.

</comment></comment></comment></comment></comment></comment><comment><USER24> > Nor can they deny access to their services to users who refuse to opt-in to > tracking.[1]

Taken literally this means it's illegal to provide a service in exchange for tracking. Can someone elaborate on whether this is true and what else it applies to or what else other business models are made outright illegal?

<comment><USER25> I guess that sentence is referencing article 43. IANAL.

See [http://data.consilium.europa.eu/doc/document/ST-5419-2016-IN...](http://data.consilium.europa.eu/doc/document/ST-5419-2016-INIT/en/pdf)

<comment><USER24> Article 43:

> In order to ensure that consent is freely given, consent should not provide > a valid legal ground for the processing of personal data in a specific case > where there is a clear imbalance between the data subject and the > controller, in particular where the controller is a public authority and it > is therefore unlikely that consent was freely given in all the circumstances > of that specific situation. _Consent is presumed not to be freely given if_ > it does not allow separate consent to be given to different personal data > processing operations despite it being appropriate in the individual case, > or _if the performance of a contract, including the provision of a service, > is dependent on the consent despite such consent not being necessary for > such performance._

(My italics.) The second sentence seems clear: "consent is presumed not to be freely given" if the service could be provided without the consent. Which means consent cannot be traded in exchange for an unrelated service, like e.g. webmail.

I'm not sure what the relation between the two sentences is. Does the second one ("consent is presumed...") apply only to the cases addressed by the first, i.e. "where there is a clear imbalance"? Or are they independent?

<comment><USER25> Again IANAL and not english native speaker, but my understanding is that they are not independent.

Consent is presumed not to be freely given IF it does not allow..., OR IF the performance...

<comment><USER24> I was asking about the relation to the first sentence, the one starting with "In order to ensure that". That first sentence talks about "a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority". Is the second sentence ("Consent is presumed not to be freely given...") limited to cases with such imbalance?

<comment><USER25> Oh sorry. In that case, my understanding is that they are independent.

</comment></comment></comment></comment></comment></comment><comment><USER26> The author believes that users have little incentive to allow Google to provide personalized Google Search results.

I don't think any technical-oriented people in this thread would agree that they have "little incentive" to allow Google Search personalization. When I turn off Google Search personalization, I get inferior search results that are less likely to be what I was searching for.

If you don't want your results personalized, there is an option in the search results to turn personalization off.

The problem I have with this law is that Google will need to default to non- personalized results and then prompt users if they want personalization. Google probably doesn't want to increase UI friction, so they will most likely just disable personalization and not prompt to enable. This will result in less-engaged users and inferior search results for the average EU citizen.

<comment><USER27> > I don't think any technical-oriented people in this thread would agree that > they have "little incentive" to allow Google Search personalization.

I disagree. I turned off Search personalization a long time ago, and haven't looked back.

<comment><USER28> Same here. I do most of my browsing in an incognito mode-like environment (so no persistent cookies or sign in to my Google account), and even when I am signed in I turned off the search history a long time ago.

</comment></comment></comment><comment><USER29> I'm going to read thoroughly through the terms and conditions and get a case going in European Courts when this comes into play, because you know for a FACT Google and Facebook will put in some vague term to let them collect data for "future" improvement of the service. Watch and see.

<comment><USER30> I believe that's what EU is trying to achieve:

> "A purpose that is vague or general, such as for instance 'Improving users' > experience', 'marketing purposes', or 'future research' will – without > further detail – usually not meet the criteria of being 'specific'"

</comment></comment><comment><USER31> In case you are puzzled the same way as me, GDPR stands for General Data Protection Regulation.

</comment><comment><USER32> Sweet. How to I inform google that I moved to europe (even though I didn't)? VPN tunnel?

<comment><USER33> If you want to opt out of data collection, it's not that hard, just go to google.com/privacy

<comment><USER34> What does this definition of "opt-out" mean?

<comment><USER35> The code in their tracker stub (always inlined as a <script> tag) is rendered inoperable.

</comment></comment></comment></comment><comment><USER36> We [technology dept at a non-computer business in the UK] got the lecture about this at work. Turns out geeks are fans of this approach!

I've been using "GDPR hazard" as a useful way to kill bad ideas at work. "Sure you can do that! We just need you to confirm that your business unit accepts responsibility for this user-identifying data and ... oh, we can delete it? I'll do that now then."

We have _lots_ of user-identified data, going back years. I can't see it as a bad thing for us to behave properly with regard to it, and to be required to do so.

</comment><comment><USER37> Google and Facebook will find a way. Problem are small/young startups

<comment><USER38> What problems? So you can't collect all the data on your costumers and do with it as you see fit? And when it gets leaked just say: "Oops, sorry"? If for some startups taking private data seriously is a "problem", I want to see them burn in fire.

</comment></comment><comment><USER8> So, how long until this one also also gets neutered when European governments realize they can't even bring their own websites into compliance with the new law? ;)

<comment><USER39> > So, how long until this one also also gets neutered when European > governments realize they can't even bring their own websites into compliance > with the new law? ;)

I have worked for 2 big tech companies in Europe. And in both, there is a big effort to make sure that they are compliant with the legislation. I see everyone taking it seriously. Why do you think that it is going to fail?

Even the stupid, really really stupid, cookie warning was implemented everywhere. What does this different? (A part of being actually a good law that protects citizens from indiscriminate tracking).

<comment><USER8> Regarding the cookie warning, I was mostly thinking about this infographic humorously describing the delta between what was originally intended and what was eventually implemented [[https://silktide.com/app/uploads/2013/01/Cookie- Law-infograp...](https://silktide.com/app/uploads/2013/01/Cookie-Law- infographic-reduced-size.png)]. As well as the ICO back-pedaling from explicit consent to implied consent ([https://www.out- law.com/articles/2013/january/ico-to-change-...](https://www.out- law.com/articles/2013/january/ico-to-change-cookie-policy-to-recognise- implied-consent/)).

I take it the actual implementation went a bit more smoothly than the infographic suggests?

</comment></comment></comment><comment><USER40> What does the first footnote mean?

> "Nor can they deny access to their services to users who refuse to opt-in to > tracking.[1]"

> "[1] Regulation (EU) 2016/679 of the European Parliament and of the Council > of 27 April 2016 on the protection of natural persons with regard to the > processing of personal data and on the free movement of such data, and > repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ > L119/1\. See Recital 42's reference to "without detriment", Recital 43's > discussion of "freely given" consent, and Article 7(2) prohibition of > conditionality. See also the UK Information Commissioner's Office's draft > guidance on consent, 31 March 2017, p. 21, which clearly prohibits so-called > "tracking walls"."

What, in this regulation, prevents the company from denying users (who opt out) access to a service they provide free of charge or a downgraded experience? And how would a court measure the level of service?

<comment><USER41> Im guessing they would force the company to make tracking not on by default but rather opt-in (lol)? But what's confusing is - if you clearly state how the data will be used upfront, do you need to offer an opt-out? What if your service simply doesn't work unless the data is used in a particular way?

<comment><USER21> Under the GDPR one way to use data for purposes unrelated to the underlying service provision is to look to obtain consent. That is not opt-out consent but clear informed consent through opt-in.

If your service won't work functionally without certain data then consent is not right ground of processing to rely on. There is a specific ground relating to processing necessary to provide a service.

If your service isn't financially viable because you can't use data to obtain revenue to support the underlying service provision then consent may not be a viable ground because of the above reasons.

The debate continues however on how to support free service provision outside of the confines of consent.

<comment><USER41> Interesting but complex. I could imagine there are a lot of issues on how to express your intent with the data.

Some uses of data might be ancillary to the direct goal of the user but still unexpectedly useful.

Interesting from the article: "purpose that is vague or general, such as for instance 'Improving users' experience', 'marketing purposes', or 'future research' will – without further detail – usually not meet the criteria of being 'specific'".[3]"

</comment></comment></comment></comment><comment><USER42> Would one way "around" this be, "Welcome to ABC Service, it costs X€/month to use, or if you allow us to use your data to sell to our advertisers we will waive this fee."?

</comment><comment><USER43> How might one make sure their accounts get classified those that fall under the scope of the GDPR regulation? Would it be sufficient to set your location to an EU country?

</comment><comment><USER44> I have been thinking that the ad bubble is a problem for a while now. Ads are basically to encourage consumption, and the US economy has been debt based for decades now.

</comment><comment><USER45> Throwaway since I don't want to involve my employer.

I actually work for a platform that is squarely in the GDPR crosshairs (digital marketing). There are a lot of things where our lawyers' perspective is different from what most people say here (I didn't talk directly to lawyers, but I presume product managers did).

\- You don't have to comply in 2018, you have to show that you started seriously working on a solution, even if you're not fully prepared. \- You don't have to have automated processes for everything (e.g. delete from backups), it's actually perfectly reasonable to say "we'll process your request" and do it manually (ref: startups spending inordinate amounts of effort for GDPR compliance). \- Opt-in is not as "game changer" as suggested here, my understanding is that you can do implicit consent (notify the user about what you do, give them a link to take action; crucially, that link might even be the link to your privacy policy which contains the link to the opt-out interface... if I got this right - and I think that I did - this may not amount to much more than a slightly modified "this site uses cookies" thingy). \- Delete requests may be handled by "de-identification" (don't delete the data, delete the association with you). \- Related to that, while I don't have a definitive answer, I strongly suspect that GDPR only applies to information that can be positively associated with you (e.g. authenticated activity). I'm not obliged to show you anonymous browser activity/information that I've probabilistically associated with you, for the simple reason that I might be wrong and I might disclose sensitive information (think about girlfriend looking up "what does Amazon know about me" and finding up that "she is interested in an engagement ring" because you anonymously browsed from her computer, thus spoiling your surprise even though you were careful to delete your browser history/ browse anonymously. Yes, incognito mode doesn't necessarily help you - we do efforts to identify server-side the incognito sessions and de-link them from the probabilistic marketing profiles, because we don't want to negatively-surprise the customers; but I suspect not all players are that careful).

Overall... despite what many people think, I think big players are actually fairly careful/sensitive about your privacy (well, if we exclude Facebook here :D ). It's the startups that would concern me more... they have very little incentive to guard your data well, because there are so many OTHER reasons why they might fail, that "privacy disaster" is very low on their list of concerns.

</comment><comment><USER46> Are all companies beholden to this or those with legal entities in Europe.

For instance, can a Chinese company with ZERO legal presence in the EU completely ignore these requirements? The internet has no real borders, after- all.

<comment><USER47> Yes.

If you process the personal data people in the EU then you have to comply:

Article 3

Territorial scope

1\. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.

2\. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or

(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.

3\. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

</comment></comment><comment><USER48> Just wondering, would an European residing in the US be able to request EU compliance for their data?

</comment><comment><USER49> So, are ad clicks "personal data" ? That would basically destroy all adtech startups.

<comment><USER50> I'd imagine the host website needs to ask for the permission to share specific data with a third party named XYZ Startup, that will use that data for language/country segmentation or whatever is they do, and if the user denies that right then random ads are shown instead.

</comment></comment><comment><USER51> My first instinct was to be pretty happy about these laws, which surprised me quite a bit. I generally identify on the libertarian/pro-capitalist side of things and "as a general rule" subscribe to the belief that government regulations are often more problematic than problem solving[0]. So I had to take a moment to analyse why I felt this way.

Here's the problem as I see it: I _know_ all of the things that are collected, how they're collected, what shady practices are used[1] and I'm completely aware that there _is_ no anonymity left on the internet. The old "when the product is free, you're the product" isn't lost on me. In reading this, though, I was still finding myself a little outraged[2]. I look at it this way: if _yesterday_ , we had an web with plain old "dumb advertising" techniques limited in sophistication in the manner of television advertising in the 90s, and today we ended up with _this_ , there would be rioting (in the USA, anyway[3]). This didn't necessarily happen _slowly_ but it happened gradually and _quietly_. I remember when Facebook announced that it was adding the ability to track you on other sites that you visited while you were logged out -- that was announced and it was met with criticism (briefly, though I quit the platform about a month later in a quiet, personal, revolt).

Here's the thing - if you ask an average non-technical individual if they understand that they're being tracked on the internet, they'll shrug and say "yes". If you dig a little deeper, you'll discover that they haven't the faintest idea how deeply they're being tracked and that they don't even have an analogy in their own lives to equate that tracking to. I couldn't come up with anything to describe the extent of tracking short of extremely lengthy explanations of what's being done and used[4].

And then there's me - I understand I'm being tracked and have basically chosen the head-in-the-sand approach. I use adblock, and a few extensions that supposedly "limit tracking" (doubtful) but I know they're worthless. Here's the thing, though, what choice do we have? And that's where I concluded how I was able to land in favor of some form of regulation on this behavior[5]. It is becoming increasingly impossible to avoid interacting with companies like Google and Facebook[6]. I look at it this way -- a company that becomes a monopoly in such an important industry can exert as much, if not more, control over the citizenry than their own government[7] but without the limitations imposed by democracy.

What should be done? I'm not sure. Self-regulation isn't working. I have zero faith in government crafting any kind of law related to technology that won't be some combination of horribly ineffective, worse than what we have today, utterly _breaks_ something _really important_ , or is used as a means to insert something _horrible_ (watch them try to pop in a line-item around key- escrow). I'm kind of surprised to find myself thinking that approach that looks the best, out of the options, is probably forced-competition through breaking up the companies involved and I _hate_ that idea in principal and in practice -- it's worked just-about as well in the past.

[0] I don't want this to devolve into a flame-war of whether regulating is "good or not", though I fear I may have just stoked that flame, I'm simply providing background for contextual purposes.

[1] I half- _admire_ the creative uses of WebRTC with STUN on what are otherwise regarded as _highly reputable_ major news sites. It's difficult for me to _not_ see that practice as poking a hole in my firewall and I feel no less outrage when I see that happening than I do when a piece of malware does the same thing.

[2] Part of me had forgotten the idea that when GMail was "scanning e-mails for advertising purposes", they were scanning e-mails that were coming _inbound_ from non-GMail users who couldn't have possibly consented to that. I'm sure there's a really good counter argument, but I'd have a hard time not feeling a little violated by that practice if I weren't a GMail user, already.

[3] Probably elsewhere, but my experience is that some European countries' citizens (particularly the UK, where I have the most experience outside of the US) are more tolerant to this sort of thing whereas when I was a child, you'd have seen people gathering in militias the moment the government tried to propose something like Real ID.

[4] I can only speak anecdotally since I had this conversation with family members who are non-technical and after about _two hours_ , had them quite disgusted -- asking _how is that legal_ ... and these are some of the most government-skeptical conservative people you'd ever meet.

[5] And I have _zero_ faith in the US government being able to craft a law that works. Minimally the "they must still offer the service if the user opts out" will be removed, entirely, turning the "agree to be tracked" button into the moral equivalent of the "Cookie Warning" \-- something you click because you _have to_. And philosophically, if we weren't talking about monopolies or near-monopolies here, I'd agree with that approach.

[6] Yes, DuckDuckGo is my default search engine, everywhere. And I've now trained myself to use the shortcut to get to google for the 60-70% of searches that DDG returns unworkable results. I think it's my search patterns, which tend to be very narrow in results, causing Bing/DDG to "broaden" and ignore terms (or when used with parameters, simply yield nothing). My parents (both retired) use DDG and _rarely_ anything else since I switched all of their browsers around (they didn't even realize I had changed it -- they don't think of Google as a company, they think of search as something "the internet just _has_ ..."). They are perfectly happy with it.

[7] Or can work in concert with it. Requirements to hand over Facebook credentials at the border are becoming common. I'm waiting for the day when I say "yeah, I don't use that" and end up back in a little room with an angry looking man asking me a bunch of (the same; slightly rephrased) questions and responding to them with the assumption that I'm lying (personal experience on that one; not fun). I mean, after all, I'm a programmer/live on the internet/et. al., surely I _must_ use Facebook and I'm trying to _hide_ something! /s

<comment><USER52> Just want to say that any emails I receive are my property. And I can grant consent to Google allowing them to mine these emails. Once you send an email, you are ceding control to the recipient.

<comment><USER51> While it's nice to think that's actually the case, the legal situation is almost certainly more nuanced. The thing that comes to mind for me is the implicit copyright protection.

I'm not sure if that would apply to a message I sent to you, but it may, and if that's the case, it's "my property", not yours. I'd be interested to know if any case law exists on this. Considering how often the DMCA is abused, I wouldn't be surprised if someone tried a DMCA takedown claiming copyright ownership on an embarrassing e-mail sent to someone and then subsequently posted online.

</comment></comment></comment><comment><USER53> Cool. 88 more pages of functional specs on every project.

</comment><comment><USER54> Will GDPR allow me to delete my Apple-ID? Thanks

<comment><USER55> yes

</comment></comment><comment><USER56> I need to move to europe.

</comment><comment><USER57> Site will not render properly with Google Analytics blocked. Web site renders with text on top of text. Grey on black text. Is this some fake site by a Google front intended to give this idea a bad reputation?

<comment><USER58> I use uMatrix on Chrome and have every non-pagefair.com script blocked, including google analytics. Not seeing any site rendering issues here. Perhaps it's your browser?

<comment><USER32> My adblocker blocks the base url of the page. Maybe there is some common adblock regexp that matches stuff on this site.

<comment><USER59> That would make sense, as PageFair is an ad network: [https://pagefair.com/about-us/](https://pagefair.com/about-us/)

</comment></comment></comment></comment><comment><USER60> Might be easier for small niche companies with no offices in the EU but willing EU customers to ask for payment via a cryptocurrency.

It just seems to me in the long run, more and more laws like this will pop up, and using cryptocurrencies will get easier/ more familiar.

<comment><USER61> Nobody is going to look for SaaS on the black market, unless the service they're looking for was illegal to start with.

<comment><USER60> > _unless the service they 're looking for was illegal to start with._

Luckily, we will always know of everything that was/is legal now will be illegal in the future, and that people/companies throughout history will always submit to the costs of regulatory compliance of all governments in the world, no matter how burdensome they may be in specific instances.</comment></comment></comment>


Literate Programming Matters - <AUTHOR> https://github.com/raganwald/homoiconic/blob/master/2012/02/Literate-Programming-Matters.md

<comment><USER2> Direct link to the discussed Cafe au Life, for those that haven't already seen it: <http://raganwald.github.com/cafeaulife/docs/cafeaulife.html>

And in terms of the gist of Reg's essay, I think the single line that best cuts to the heart of it is: "[...] while David presents the concepts of literate programming and elegant programming as a dichotomy, I think they're orthogonal." Bingo.

@raganwald: I'd be curious to hear more about what sort of "literate programming tool that transforms the source directly" you were hankering for. Not CWEB style?

<comment><USER3> I didn't actually quite present them as a dichotomy. My point was a bit subtler than that in my opinion. In fact it was less about the practice of literate programming than problems of context in many programming languages.

An aspect I didn't discuss is that when we write in English the usefulness of the text is then subject to the ability of the author to write clear, logical, concise (hopefully beautiful & elegant) English. So it's not surprising, to me at least, that the best literate programs I've read are not online but in books.

</comment></comment><comment><USER4> Literate programming can be done in any language. Here is an example in HTML: <http://axiom-developer.org/axiom-website/litprog.html>

In addition to the benefits mentioned there are at least 3 others I can site.

First, since you spend time explaining why you are writing the code and your thoughts on the design and implementation you naturally discover edge cases, missing cases, and bugs. As a result, the quality of the code is higher.

Second, if you program in a team that does code reviews, the team can see your approach to the solution and the reasons. They can critique your work at a more profound level. If the code review happens before accepting the change commit, the quality of the code is higher.

Third, code lives. Sourceforge is a gravesite of hundreds of thousands of programs that have died because the authors are no longer maintaining the code. New users are confronted with a source tree of tiny files which they are unable to understand and therefore unable to modify and maintain.

I have the "hawaii test" criteria. If you can hire a new developer, give them your program, send them on a 2 week, all expense paid vacation to hawaii, and when they return they can modify and maintain the program as well as the original authors, then you have a fully literate program.

As for the question of debugging, I find that it is no different. Generally the source of bugs are the same (e.g. using copy/paste and failing to properly fix the copy).

Literate development, for me, takes on two different styles depending on the language.

In a language that allows a read-eval-print loop, like lisp, it is trivial to work in emacs with a command line in one buffer and the literate sources in another buffer. You just point at the changed code and evaluate it immediately in the other buffer. It is very productive.

In a language like Java that is a pure compile environment I create a makefile that extracts the code from the literate document into the proper com.foo.baz.... source tree, compiles the code, and runs the test regression suite. This generally takes less than a minute or two for most reasonably sized Java programs. So I make a small set of changes, save the buffer, run 'make', and see if the tests pass. For TDD programming I find this works very well.

My last large program was 60000 lines of Lisp in a latex literate file. Tex'ing the file with all of the literate documentation generated 6000 pages. The technology scales quite well.

Learning literate programming is like learning lisp. You keep wondering why anyone would program this way until you suddenly "get it". Once that happens you wonder why anyone could program any other way.

Tim Daly

</comment><comment><USER5> One thing I really like about literate programming even beyond the extensive "write about what you code" aspect is the availability of sub-procedural refinements. Quite often you write code where everything in a "paragraph" pertains to a specific matter, often preceded by a comment line saying so (e.g. "// Initializing database"). With literate tools I can just move that to a separate block and have a better overview. As this is mostly out of a poor need for visual organization, factoring everything out into small sub-routines and then taking care of scoping and passing needed parameters often seems like a crutch to me (especially in procedural code). Folding editors provide another option for this, of course. (Well, you also could use gotos. But no one ever did that. Especially not me. No, officer, never.)

If I remember correctly, I once had two C preprocessors that did just that, without the rest of the literate programming features. (Found a paper for one of these: <http://page.mi.fu-berlin.de/prechelt/Biblio/refinement.pdf>)

</comment><comment><USER6> Rant: Github and Google Plus are not blog platforms!

Here, even when I have the userscript[0] to show the full domain names so I know when something is being posted by a user of a company instead of the company itself, it still just shows "github.com" leading me to think it's Github and crew talking about literate programming.

(I'll admit, I saw it was raganwald and that gave it away, but still).

[0] <https://github.com/johngibb/Hacker-News--Show-Subdomains>

</comment><comment><USER7> i am always thinking how to make my code readable, if not fun as novel, at least it should read like a prose telling stories. For those lit programming solutions on the web, nothing feels right. For me, it is ugly to see the comments when you are working with the code daily, especially when debugging. at last, i decide to keep a file for document everything, arch, bugs, decisions, stories,... The document grows over time, and then i will try my best to keep the code shorter. of course there are inlines comments, but most just little sweet ones. if you are going to print the code on paper, mass comments is not going to help.

</comment><comment><USER8> I do wonder how hard it is to debug literate programs

<comment><USER9> Why would it be harder?

<comment><AUTHOR> (Revised):

As presented in the essay, an organization of code for the purpose of explaining the code to a new programmer might differ from an organization for the purpose of maintaining the program by people familiar with its design.

The premise of the original Literate Programming was to use meta-annotations to write documentation that showed the code organized for explanations, while leaving the original in a form suitable for the machine and/or for experienced programmers.

Lacking this tool, if we use techniques like AOP to reorganize the program for explanation, we might be making things more difficult for the experienced programmer, who does not find all of the methods for a square in one place in the Square class' definition.

<comment><USER10> One approach is to structure your program in reasonably-sized modules, as usual, but to write _parts_ of your program in a literate programming style. If a particular module is algorithmically tricky, for example, I've found that it often helps to write down very narrative-style comments, and try to organize both English narrative and code for easy reading. This helps make the code better, and for some reason seems to make difficult algorithms easier to keep track of while I'm writing them. I've written some of my best code this way.

Literate programming doesn't need to be all-or-nothing!

<comment><USER11> [edit: Not sure why the downvote, since I was just trying to clarify concepts. "Literate programming" was invented and clearly defined by Don Knuth, and it muddies the water to suggest that merely doing good comments is a "literate programming style". Good commenting should be part of every programming "style", and literate programming does not primarily focus on "good commenting", focus is on two concepts described in Wikipedia article below, (1) tangling" of a primary source into machine-compilable form and (2) "weaving" of a primary source into print-formatted form suitable for human understanding.]

Merely having "English narrative" does not get you to literate programming. You can call it a "literate programming style", which is fine, but it's important to understand what true "literate programming" actually requires:

'Literate programming tools are used to obtain two representations from a literate source file: one suitable for further compilation or execution by a computer, the "tangled" code, and another for viewing as formatted documentation, which is said to be "woven" from the literate source.' <http://en.wikipedia.org/wiki/Literate_programming>

Tools like Javadoc are related to the second part of literate programming above, and allow for creating some formatted documentation from source code. ( <http://en.wikipedia.org/wiki/Javadoc> ) They don't get you all of the second part of a literate "woven" program, though, which includes text with all of the source of a program in a format suitable to be read like a book or literary essay.

Tools like Javadoc also have absolutely nothing to do with the first idea in literate programming (above), which is to have an ultimate source document where code is organized and presented in manner best suitable for human understanding, not in manner that's tailored for machine compilation (e.g., for machine-compilation the code may need to be separated into different units or files, whereas in literate source that would not be done unless it were an aid to understanding).

All that is not to say that trying to be a little more "literate" with comments in regular source code is not a good thing. But it's important to understand that "literate programming" is a clearly defined practice that requires much more than good-quality commenting.

<comment><AUTHOR> I tried to achieve this, only lacking a true LP tool, I used meta-programming to 'retangle' the code I'd teased apart.

</comment></comment></comment></comment></comment></comment><comment><USER12> This is one of the better examples of "literate" programming I have seen. I do have a couple of criticisms though.

The first criticism is perhaps more of literate programming, the concept, than this example. I personally find it difficult to read when each line of code is disjointed by comments. I guess I prefer the chunk size to be larger; a coarser granularity.

Some of these comments really seem unnecessary. for example:

      # Export `Cell`
      _.defaults exports, {Cell}

I think that is obvious enough that the code is "exporting" 'Cell'. I couldn't tell you why though.

My second criticism is that it seems comments are all too often of the "what" variety. Simply translating the code to english. That's not really very helpful. Once someone has some grasp of the programming language being used, the "what" is right there in the programming language. No need to restate it in another language.

What _is_ helpful is the "why" of a chunk of code. I can read plain as day what it is doing. But _why_ is the code doing that? Why was it written? Why is it necessary to do this particular thing? To me, at least, that seems much more helpful.

I feel my commenting has gotten much better since I started paying attention to when I was writing a "what" comment, caught myself, and wrote a "why" comment instead.

<comment><USER13> I've noticed a lot of people do the exact same thing with Powerpoint presentations. Each slide tells the audience exactly what you are going to say and so there is really no point for you to be there. Good presenters put things on their slides that are in addition to what they say so that the slides tend not to make sense without the presenter.

<comment><USER14> But what if you are trying to reach a larger audience that is not going to see your presentation (either because it's not online or they don't have the time to watch a video) but might flip through your deck? It needs to be possible to get a worthwhile takeaway just from viewing the slides.

<comment><USER15> I was wondering recently if it is possible to create an annotated version of a pdf presentation. Two purposes -- the presenter uses it as notes while they talk, and when the slides get put up, people who read them get to read the annotations too. But in the presentation itself, you only see the slides, not the annotations.</comment></comment></comment></comment>


Don't use class names to find HTML elements with JS - <AUTHOR> http://roytomeij.com/2012/dont-use-class-names-to-find-HTML-elements-with-JS.html

<comment><USER2> The title of this article should have been "Don't use class names to store data." Finding elements by class name is fine. This is about misusing the class attribute.

<comment><AUTHOR> Good one, thanks!

</comment></comment><comment><USER3> I am actually working on some CMS templating for a flat HTML templating engine and making heavy use of the data attribute for it. I think it is one of the greatest additions to the HTML standard. I like that I did not have to use a cutom built templateing variable / languadge to indicate that a template should go into a node. It is my hope that a CMS standard will evolve out of data attributes so that we can get rid of the 1000's of different variations of a simple thing like put the content here.

</comment><comment><USER4> The title is wrong, it basically says: don't store your data in class names and separate your styling from your code logic.

</comment><comment><USER5> I guess this will be terribly slow in Internet Explorer.

<comment><AUTHOR> It is, with IE9 handling just over 7,000 operations per second (based on the jsPerf test: <http://jsperf.com/long-selectors-vs-data/2>) vs. 25,000 in Chrome. Don't go all out I'd say, but in most scenario's even that number of operations will be acceptable.</comment></comment>


Xen exploitation part 3: XSA-182, Qubes escape - <AUTHOR> http://blog.quarkslab.com/xen-exploitation-part-3-xsa-182-qubes-escape.html <comment><USER2> If you're a security newb like me but you are using Qubes, update your dom0 software and this vulnerability is fixed. run:

sudo qubes-dom0-update

The exploit itself allows an attacker who gains control of one domain (like your untrusted cat video domain) to execute scripts in any domain.

</comment><comment><USER3> Style points for running xcalc to demonstrate arbitrary code execution on a UNIX desktop. calc.exe is pretty common for this sort of thing on Windows, but I think I'd forgotten xcalc even existed until seeing the screenshot. :)

<comment><USER4> XCalc is all about doing arbitrary calculations.

</comment></comment><comment><USER5> While Qubes is probably the most secure desktop OS available, reading through this code shows the extreme conflict between high performance code. Especially highly optimized C code, and security. When I look at that code, I cannot use intuition, I have to think really hard to understand what it is doing and even in doing so, I might well be wrong in my understanding.

</comment><comment><USER6> at what point do we all say "maybe Xen isn't the best hypervisor to work with for this sort of goal"?</comment>


Furious investors warn troubled Dubai it will 'never raise a penny again' - <AUTHOR> http://www.guardian.co.uk/world/2009/nov/29/investor-fury-dubai-crisis <comment><USER2> Any investor who decides furiously will not remain an investor for long.

OTOH, I can't imagine what sane person would invest there. Can't they tell a bubble when they see it?

<comment><USER3> Investors can tell a bubble when they see it, but we must consider that hindsight is 20/20 in these situations. And perhaps investing in a bubble is okay, just as long as you get out at the right time?

A lot of the press makes this look like the end of the world. I don't want to make a hasty comparison, but let's contrast it to the $700bn dollar bailout that we saw earlier in the States .. $60bn exposure isn't quite as bad as it seems.

The question is in underlying value. Aside from the world's speculation and the good word of the ruling family, there isn't so much backing Dubai. AFAIK, nobody owns a huge share of the markets, just the royal family.

At the same time, it doesn't take much to apply some startup thinking to Dubai -- put a couple people together with some good ideas on how to shape the markets there, and Dubai could look drastically different 24-36 months from now. Islamic Finance could be an interesting starting point.

Dubai will be very interesting as soon as all of this smoke clears up.

<comment><USER4> It seems like the real shock to the world markets was that Abu Dhabi stood quiet instead of immediately stepping in to guarantee at least some of the money.

It happened before <http://online.wsj.com/article/SB123532630416442781.html> so why not again?

<comment><USER3> Dubai and Abu Dhabi haven't always had the best relations - they're both Emirates but that doesn't mean that they agree on everything. Fiscal policy could very well be in this set of things.

<http://news.bbc.co.uk/2/hi/middle_east/8382275.stm> \- have a look through the section titled "Competition".

Also, oil is relatively inexpensive right now. Abu Dhabi exports a lot of oil. I don't want to risk making a false correlation, but that could have something to do with it.

<comment><USER5> There is definitely the fiscal policy aspects (Abu Dhabi has good reason to let Dubai and its backers know that it will not necessarily bail them out) and there are also socio-cultural aspects as well. Abu Dhabi is much more conservative than Dubai and there is some friction there that is getting magnified by the financial aspects.

</comment></comment></comment></comment></comment><comment><USER6> I read The Ascent of Money, by Niall Ferguson over the summer and I am reminded of a passage discussing Argentina:

"So successful did Argentina's default prove (economic growth has since surged while bond spreads are back in the 300-500 basis point range) that many economists were left to ponder _why any sovereign debtor ever honours its commitments to foreign bondholders_ "

[http://books.google.com/books?id=JA_IYJ0P4ZkC&lpg=PA4...](http://books.google.com/books?id=JA_IYJ0P4ZkC&lpg=PA4&dq=niall%20ferguson%20safest%20default&pg=PA115#v=onepage&q=&f=false)</comment>


Acquia CEO outs community member and asks them to leave - <AUTHOR> http://buytaert.net/tag/living-our-values <comment><USER2> Larry's side of the story: [https://www.garfieldtech.com/blog/tmi- outing](https://www.garfieldtech.com/blog/tmi-outing)

</comment><comment><USER3> I have no stake in this fight but it seems odd to ban someone from participating in a FOSS project because of his beliefs if those beliefs are not affecting the work or the project itself.

</comment><comment><USER4> there was a link to this discussion on twitter (not by me) that is now gone.

why was it removed? Is linking to twitter against the HN TOS or something?</comment>


A Natural History of Beer - <AUTHOR> https://inference-review.com/article/divine-medicine#When:09:30:00Z <comment><USER2> This, and the recent megathread about children, made me think of Tom Robbins' B Is For Beer book, it's the natural history of beer, kids version. Rereading it now with the third kid-something a little different than the usual kids fare.</comment>


Open source software for developing world hospitals - <AUTHOR> http://hospitalrun.io/ <comment><USER2> FYI, we're trying to manage towards a 1.0 release by July 2016. We need help. Many skilled hands make lite work. @tangollama or admin at hospitalrun.io

</comment><comment><USER3> Absolutely brilliant idea!! Anyone know the people doing this? Would love to have a convo with them...

<comment><USER2> Happy to talk. I'm on Twitter @tangollama or Joel at cure dot org.</comment></comment>