Pancreatic Cancer Linked to Sodas? - <AUTHOR> http://www.webmd.com/cancer/pancreatic-cancer/news/20100208/pancreatic-cancer-linked-sodas <comment><USER2> _No link was found between juices and pancreatic cancer risk._

 _Why the link with sugary sodas? Mueller says they are not certain. "What we believe is the sugar in the soft drinks is increasing the insulin level in the body, which we think contributes to pancreatic cancer cell growth. That increase in insulin is what may be leading to the development of the cancer."_

This doesn't make sense to me. If sugar in soda leads to cancer, then why doesn't sugar in juice?

<comment><USER3> Perhaps the "sugar" in the soda is actually the much-dreaded high fructose corn syrup? I'd suspect as much, since this study was done recently, and most sodas don't use "sugar", per se, any more.

<comment><USER4> That's easy to prove, HFCS is far less prevalent in Canadian sodas and I barely even heard of it in soda when I was living in the UK and Europe.

You simply need to correlate the results to other figures to see if HFCS is the major variable sticking out.

<comment><USER5> I'm pretty sure much of the pop sold in Canada contains HFCS. They call it glucose/fructose there. In the UK it's referred to as: "glucose-fructose syrup". This sometimes leads to confusion.

source: <http://en.wikipedia.org/wiki/High-fructose_corn_syrup>

</comment></comment></comment></comment><comment><USER6> How is this surprising? It's like saying they found a link between pancreatic cancer and high levels blood sugar. (That's by the way old news, take it easy with the refined sugar.)

</comment><comment><USER7> I'm doomed.

</comment><comment><USER8> I wish they'd mentioned whether they tested diet versions or just sugared.

<comment><USER9> _...Mueller says the researchers didn't ask specifically about diet soda consumption, but that most of the soda drunk was regular or sweetened.

In Singapore at that time, Mueller says, there was very little intake of diet soda._

<comment><USER10> Wow, that seems like really poor data. How could they not be 100% sure of what sodas were drank? Especially if the likely culprit is high fructose corn syrup?</comment></comment></comment>


Webcam spying without turning on the LED - <AUTHOR> https://www.grahamcluley.com/webcam-spying-without-turning-led-researchers-prove-possible/ <comment><USER2> This is from 2013, I would bet it is not possible in 2016. Anyone find anything that proves otherwise?

<comment><USER3> Given what I've heard about the secure enclave on the iPhone in the last year or two, you'd hope Apple could get something as basic as the webcam light right.

I'd imagine it's feasible to have the LED and the webcam on the same circuit, so you can't power one without the other (disclaimer: not an electrical engineer). Honestly I'm not sure why you ever _wouldn't_ do it this way -- having to control the LED from software sounds like unnecessary complexity to me.</comment></comment>


School shooting officer charged with inaction. Should 'cowardice' be criminal? - <AUTHOR> https://www.washingtonpost.com/nation/2019/06/09/scot-peterson-charged-parkland-shooting-experts-worry-about-criminalizing-cowardice/ <comment><USER2> This is what irks me about the current setup: we put people everywhere with guns. We turn schools into what are essentially prisons. We let officers shoot unarmed people because they're afraid, with no consequences. But if there's someone actively killing kids it's acceptable for them to be too scared to do anything.

The right to be an executioner comes with the potential to be killed - that's literally there job and the reason for their elevated privilege: they are given these tools _because_ they have to put themselves in the line of fire to protect the public. If they are unwilling to do that they shouldn't have a gun. Otherwise the only time they shoot people is when they aren't in sufficient danger to be scared.

<comment><USER3> To achieve that does it require criminal charges though?

It seems we've gotten pretty far already without it - but it's an open question.

<comment><USER2> Actually I suspect this won't go anywhere - I recall a story that reached HN a few years ago from the (I think) N.Y. subway where a wanted criminal attacked (and stabbed) someone and the police literally just stayed on the other side of a door while watching and doing nothing. The attacker was eventually subdued by the _other passengers_. When they were taking to court they were found to have done nothing wrong: the opinion said something along the lines of "police are not required to intervene", eg stopping attempted murder is apparently not part of their job requirements. Yet they have tasers and guns "to stop crime"

<comment><USER2> Found it!

"Why The Cops Won't Help You When You're Getting Stabbed" [https://www.youtube.com/watch?v=jAfUI_hETy0](https://www.youtube.com/watch?v=jAfUI_hETy0)

On HN: [https://news.ycombinator.com/item?id=15590479](https://news.ycombinator.com/item?id=15590479)

</comment></comment></comment></comment><comment><USER4> "Duty to act" is a well-defined idea in most places for emergency responders.

In New York State, police and firemen have an unqualified duty to act: if you're on shift or off, and you see a crime/a fire, you are obligated to do _something_ about it or you're criminally liable. If you're an EMT, duty to act only pertains if you're on duty -- but if you initiate care, you are subsequently bound and liable if you abandon your patient.

<comment><USER5> For EMS, sure. For law enforcement officers, their only duty is to "the public at large". They are not liable if they let an individual die. (Regular civilians have this right, too, in most jurisdictions)

IANAL

<comment><USER4> in new york, anyway, it's the other way around. Here are the examples we were given in EMT training:

If you're an off duty cop at a convenience store getting a slurpee at 3 AM, and the guy in line in front of you robs the place, and all you do is stand there, you are (potentially) liable. In practice, enforcement is pretty lenient here, especially if you don't have a service weapon on you, but you're legally required to make at least a token effort.

If you're an EMT in the hypothetical 7/11 with your slurpee and not on shift (or, i believe, in uniform) and the guy in front of you keels over from a massive heart attack, you can stand there and watch him die and nobody can touch you. IF you touch him (and start chest compressions or whatever), _now_ you can't leave until you hand him off to an ambulance crew or someone more medically qualified than you. If you _are_ on shift, you must act no matter what.

There are additional complications for volunteer EMTs versus paid EMTs that don't pertain here but relate to at which points which legal statutes cover you or don't.

</comment></comment></comment><comment><USER6> "Peterson's perjury charge is clear-cut, Martin said. According to the affidavit, Peterson not only failed to go inside but then lied about how many gunshots he heard after arriving at the school."

This seems reasonable to go after him for. If they had ordered him inside and he refused, he essentially is not doing his job and should be fired/responsible for it. How much responsibility depends on whether he would have actually saved anyone if he had done his job as intended in my opinion.

For not going into a live situation without orders they should not hold him accountable for that as there is no clear cut S.O.P. when it comes to school shootings.

FTA, "According to a 2018 study of the sheriff's department in Palm Beach County, which neighbors Parkland, the Forum found there was ambiguity about how officers should act during active-shooter situations — whether they should wait for backup or rush inside."

<comment><USER7> > For not going into a live situation without orders they should not hold him > accountable for that as there is no clear cut S.O.P. when it comes to school > shootings.

FBI training, which his department had been through, teaches engaging active shooters, and is absolutely SOP.

<comment><USER6> Knowing that he had been through that specific training and he failed to follow S.O.P. then I would be much more harsh on him for acting in that manner.

</comment></comment></comment><comment><USER8> I would definitely question how prepared he was made for this situation. How many active shooter drills did his employer run him through? Everyone isn't a natural born hero. In reality, rushing in could have caused more deaths, or it could have saved lives if he was mentally and physically prepared for it.

Everyone wants someone to blame in these horrific situations, and a cowardly officer who I would imagine doesn't get paid as much as most of the people on this forum, is as good a person to blame as anyone. After a single New Zealand shooting, they vowed to take action in policy. We'll see how it plays out but it seems a more appropriate response than focusing a lot of attention on one ill-prepared officer.

</comment><comment><USER9> IANAL, but hasn't SCOTUS repeatedly ruled that police inaction is not a crime?

<comment><USER10> "Castle Rock v. Gonzales, is a United States Supreme Court case in which the Court ruled, 7–2, that a town and its police department could not be sued under 42 U.S.C. § 1983 for failing to enforce a restraining order, which had led to the murder of a woman's three children by her estranged husband."

0: [https://en.wikipedia.org/wiki/Town_of_Castle_Rock_v._Gonzale...](https://en.wikipedia.org/wiki/Town_of_Castle_Rock_v._Gonzales)

</comment></comment><comment><USER11> Avoiding negligence doesn't conventionally require you to endanger your own life. This seems a proxy for creating a "desertion" or "dereliction of duty" charge within policing.

If the expectation of assuming a policing role is to put your life on the line in situations where that can be avoided, then that should be made explicit, and enforced with a similar doctrine as with military law.

</comment><comment><USER12> I'd guess the officer is already in their own hell of regret or second- guessing, and perhaps also PTSD from the event itself.

Instead of making the officer a target for outrage over the event, why not instead focus on learning what can be learned from this event, including with the help of the officer?

If someone wants their pound of flesh, it's not like the officer hasn't likely already suffered and won't keep punishing themself. And it's not like further punishment needs to be seen for some kind of deterrent effect.

</comment><comment><USER12> Uncredited press pool photo by Wes Anderson. It's a somewhat sympathetic image.

</comment><comment><USER13> I'm torn about this. Fear can crush a person, gluing them in place. There's a difference between willful in action, and fear.

<comment><USER14> What is the difference? Willful inaction being the internal rationalizations around the crushing fear?</comment></comment>


Arrays in Postgres - <AUTHOR> http://craigkerstiens.com/2012/08/20/arrays-in-postgres/ <comment><USER2> One of the differences with postgres is that it's OK to use interesting data types. Other systems treat it as though it were somehow wrong.

See my post here: [http://thoughts.davisjeff.com/2009/09/30/choosing-data- types...](http://thoughts.davisjeff.com/2009/09/30/choosing-data-types/)

And no, using arrays is not an automatic violation of first normal form.

<comment><USER3> > And no, using arrays is not an automatic violation of first normal form.

One of the conditions of the 1NF is that each row and column contain one and only one value. While a NULL might be disputable, using multiple values as shown in the two examples (tags, items/price/quantity) are a clear violation of the 1NF. Only if the array data were truly "one value" (e.g., a vector) it would not be a violation. (I.e., I am not trying to contradict your statement, but I think it helps to add a bit of clarification.)

<comment><USER4> If you never need to query 'inside' the array, then I don't think that's a violation of 1NF at all. If you treat the entire array as an atomic value, then I would think that's still 1NF.

<comment><USER5> Even if you do need to query inside the array, how is this different from something like WHERE x like 'prefix%'? Is that a violation of 1NF too?

<comment><USER4> Arguably, yes, because you haven't really broken your data down as much as you need to; but this is a fairly contentious issue - just see <http://en.wikipedia.org/wiki/First_normal_form#Atomicity>. If you are frequently needing to query inside data, you may well gain from moving that 'prefix' into a separate column, or more drastically rethinking your data model if that's appropriate.

<comment><USER5> In this example prefix is something the user typed in. So textcolumn LIKE '%blahblah%'.

</comment></comment></comment></comment></comment></comment><comment><USER6> There are probably some useful applications for this, but I am not really a fan of databases supporting complex data types. It's not because of a commitment to any particular normal form or theoretical construct. It is because on a project that involves multiple developers over a period of time, this sort of special functionality provides "surprises" that are not terribly pleasant.

\- Nonstandard SQL is required

\- Database specific functions are used

\- Later developers can be confused by the use of a non-standard data type

\- SQL Commenting does not happen much in practice in my experience

\- Array data can be handled using existing SQL constructs, so it is never an absolute necessity

\- Other languages are better equipped for handling the data types (in my fuzzy subjective assessment)

My experience is mostly with Oracle, which has been adding various data types for years (XML, Objects, Arrays, etc). I can't think of a specific case where their use proved to be a real specific benefit to a project... though the usual argument is improved performance.

</comment><comment><USER7> Ah yes, the venerable array type. I remember trying to normalize applications written in VB6 and Access that used arrays with foreign keys instead of many to many relationships. Good times.

<comment><USER8> While I probably wouldn't store things in an array, it's useful to get data back out in array format sometimes.

        select array_agg(email_address), home_state from users group by home_state

Will give you a list of home states and all the email addresses that belong to that state.

<comment><USER9> Right. A case I've used them for is a recursive query which returns a set of rows, where each row is some end-point that matches the query criteria, the rows can include arrays representing the list of nodes traversed to reach that end-point, or some notion of the path cost by hop.

</comment></comment></comment><comment><USER10> The MADlib add-on out of UC Berkeley for Postgres and Greenplum uses arrays for inputs into its algorithms. MADlib.net is worth checking out for some in- database analytic and machine learning goodness. It's not going to replace R or python but it has potential as part of your toolbelt.

</comment><comment><USER11> Looks like the path to code/data obscurity to me, why not have properly labeled fields for all the elements and save yourself the headache of remembering the fancy trick you implemented years ago.

</comment><comment><USER12> I used Postgres arrays in a project a few years ago -- The university course catalog was so awful I had to create my own. There was a 7-element array of integers (one for each day of the week) where each element was a bitmap indicating if the class was active in that period.

To the DB driver, it was just a string -- { 0, 0, 0, 0, 0, 0, 0} -- so I split it into an array manually in client code.

</comment><comment><USER13> Excellent article on Arrays. I wish I knew about these before, there have been so many times I _should_ have used this instead of serializing / deserializing JSON myself via TextFields :(

<comment><USER8> Postgresql 9.2 supports json, btw!

You can store json, or, even better, you can write sql that returns an arbitrary json structure.

So you can have one sql query return a nested array of hashes of arrays of hashes... handy if you need a retrieve a lot of different data at once that doesn't fit into a neat set of rows.

<comment><USER14> What we need now is a function that will take an arbitrary JSON element and return a data structure associated with it. This shouldn't be too hard using plv8js.....

This could then be used as an input format for object-relational modelling.

</comment></comment></comment><comment><USER15> The more you put in the database black box, the more scalability problems you will encounter in the future. It's more economical to scale out than buy bigger databases servers.

Please just don't do it.

<comment><USER16> Happily, Postgres keeps improving performance with each release. According to benchmarks [1], the upcoming version 9.2 will scale up to 64 cores for read- heavy workloads. Unless your application is going to grow _really fast_ \-- keeping in mind that the hardware capabilities will continue to improve each year -- then it's just premature optimization to worry about horizontal scaling. Just upgrade your database server once a year and reap the benefits of Moore's law.

[1] [http://rhaas.blogspot.com/2012/04/did-i-say-32-cores-how- abo...](http://rhaas.blogspot.com/2012/04/did-i-say-32-cores-how- about-64.html)

<comment><USER15> I love your optimism. The real world doesn't work like that. The real world punishes you for every shitty feature you pick and every bad chunk of code.

Our application is 15 years old, and we're on a 64-core machine with 768Gb of RAM and 35Tb of disk.

We're running at 80% capacity.

Where do we go from here? Yes, we rewrite and scale out for the measly cost of £450k. That cost would have been avoided with the appropriate due diligence. That is not a cost anyone wants to swallow.

Then again I don't work disposable CRUD applications...</comment></comment></comment>


🧰 Developer's Toolbox: Stack Data Structure - <AUTHOR> https://medium.com/dots-and-spaces/stack-data-structure-9009b1b22f6e <comment><USER2> Nice stacks!

Personally I would have used a generic type, i.e., class Stack<T>, instead of limiting the values to string.

[https://www.typescriptlang.org/docs/handbook/generics.html#g...](https://www.typescriptlang.org/docs/handbook/generics.html#generic- classes)

\---

By the way, I think this may be the first emoji I've seen in a title on HN. It sure made it pop out of the list and catch my attention.</comment>


Netflix misses its subscriber targets again - <AUTHOR> https://abundary.com/netflix-subscriber-wars-disney-plus/ <comment><USER2> That's expected. Because 1 netflix account can just be shared between friends or relatives. Why would you pay a subscription if you can just borrow.</comment>


CNBC's Full Interview with Warren Buffett, Charlie Munger and Bill Gates - <AUTHOR> https://www.youtube.com/watch?v=2hdDE7XYr30 <comment><AUTHOR> I love listening to these guys talk. There's so much wisdom here.</comment>


Ask HN: Supporting patients with cancer - <AUTHOR>

Hi, I am exploring and working on how to support patients with cancer in a better way. I am still in an idea phase but I wanted to get a feedback from the HN community.
How do you support your close relatives/friends with cancer?
When supporting them, what did you do that make them feel better?
Thanks! :) Have a great day! <comment><USER2> I have used an 'on-call' system, where friends sign up on a shared calendar to be the backup person for a given day (when they will be in town and available). This means the patient always someone they can call for extra help, without feeling like they're dropping the request on someone who may have something else planned. Helps lower the bar for asking for help (needed in this case) and also lower the disruption to those who want to help.</comment>


Ask HN: How do I write a legal disclaimer for my startup?  - <AUTHOR> I've been building a web based app with a friend for about 3 months as a side project. We hope to go live in about another month or so.
One of the things we don't have sorted out is the 'legal disclaimer' text that you see on all websites.
Without giving too much away (!) our application allows the easy management of recipes / shopping lists. We do not sell anything but provide a tool that users can use as is.
We are not charging for the use of this tool (we may go down the freemium route later if we add new features).
What is the best way to go about sorting out this part of the site? We are based in the UK.
edit: My other question is which I forgot to ask is 'is it even worth having one?' <comment><USER2> I have a legal disclaimer. It is the least visited page on my site. Feel free to steal it and rewrite to make your own.

This strikes me as one of those stupid box-checking steps that serves no good at all. Your defense against litigation is not that you mumble magic words which have paranormal power to scare away the solicitors. Your defense against litigation is that _nobody will sue you_ because your site _tracks recipes_. If for some reason someone should get very POed at you, you will send them a conciliatory email and refund all the money they paid, and that will be the end of it.

<comment><USER3> What if there's a recipe that includes poison as an ingredient?

Or, more realistically, recipes that cause food allergies or something along those lines. I don't think it's at all likely he'll get sued, but I do think his product is riskier in this regard than say bingo cards simply because it deals with things people will be putting into their bodies.

<comment><USER2> When you go into a bookstore, do you routinely get clerks saying "Thanks for coming to our humble establishment. Prior to being allowed to actually see the books, we'll need you to sign this waiver of liability, which disclaims any responsibility on our part if you should open one of the cookbooks and cook Thai food while having a lethal allergy to peanuts."

This has not been my experience in bookstores. If you're totally unable to sleep at night because you live in fear that vampires might descend on you if you do not say the right words and make three circles clockwise prior to opening for business, then say the right words and make three circles clockwise. Otherwise, go solve a problem for people.

<comment><USER3> I don't think I was suggesting that he should require his users to sign a waiver of liability or anything like that. All I said was that something involving food should take this type of thing a bit more seriously than something that doesn't involve food. I'd imagine that the cookbooks themselves contain some type of disclaimer of this sort to help protect the authors and publishers. His site is basically a publisher where some of the authors are probably anonymous.

And I don't know where your second paragraph came from. Why does considering these things mean I'm unable to sleep at night? At some point, you made the decision to include a terms of service for your site. All I did was try to point out a couple things he should consider for his TOS that wouldn't be relevant for most sites.

<comment><USER4> He's being facetious.

</comment></comment></comment></comment></comment><comment><USER5> Wordpress.com have a pretty good Terms of Use policy which they've licensed under a Creative Commons share-alike license. I personally think this is the best starting point :)

<http://en.wordpress.com/tos/>

</comment><comment><USER6> My Google skills are failing me today, as I'm _convinced_ that I've used a privacy policy and T&Cs generator from a UK government website before.

Ah! Here we go:

[http://www.businesslink.gov.uk/bdotg/action/detail?type=RESO...](http://www.businesslink.gov.uk/bdotg/action/detail?type=RESOURCES&itemId=1076142035)

Lots of link action for creating relevant policies :)

</comment><comment><USER7> If you feel it's worth having one, it's worth getting a lawyer to handle. Having one that's not written properly could very well cause more problems than not having one at all.

</comment><comment><USER8> Can recipes be copyrighted? I'm assuming they can be, so that might be a concern if you are 'sharing' recipes with other users or to the public and someone uploads everything from _Mastering the Art of French Cooking_.

<comment><AUTHOR> Yea, this is the type of thing I'm worried about and my knowledge of law is basically nothing.

I would hope for some type of letter asking me to remove content before anything serious happened.

</comment></comment><comment><USER9> <joke unrelated to actual discussion> Did your idea just get documented on xkcd? ;) <http://xkcd.com/720/>

</comment><comment><USER10> Legal River Terms of Service Generator - <http://bit.ly/aJd1F6>

<comment><USER11> No URL shorteners please! <http://terms-of-service-generator.legalriver.com/></comment></comment>


Tink – Cryptographic APIs that are secure, easy to use correctly - <AUTHOR> https://github.com/google/tink <comment><USER2> Tink addresses things libsodium doesn't really do.

Native support for AWS Key Management System and its equivalent on other cloud platforms is a huge win; we should all be using more of these. But libsodium would have to start mandating a TLS library and an HTTP library and whatnot, interfering with people's existing setups; you can't really do that without C programmers getting angry at you.

It deals with not only key generation, but also key _serialization_. libsodium kind of strands you when it comes to the question how to actually store keys.

Deterministic nonces have also been something that libsodium appears to have rejected: [https://github.com/jedisct1/libsodium/issues/392](https://github.com/jedisct1/libsodium/issues/392)

If you're looking at it from a misuse-prevention perspective, Tink is probably a major step up that accounts for modern use cases. libsodium's kind of in a lower level niche and suffers from being held back by C and its notoriously anemic standard library.

<comment><USER3> And libsodium does things Tink doesn't do: provide a C API.

<comment><USER4> It doesn't, but it provides a first-class C++ API.

If I was starting a new project today, I'd probably go a little bit out of my way to try to use Tink instead of libsodium.

<comment><USER3> > It doesn't, but it provides a first-class C++ API.

Sure; I get that. There are C projects where that isn't acceptable, while libsodium is. It makes a lot of sense to use Tink if you're working in Go (which I know you're fond of) or Java or other high-level languages Tink supports. I tend to work with a lot of C (not C++) codebases, and I wouldn't choose or recommend C++ in a new project today.

</comment></comment></comment></comment><comment><USER5> Unless there's significant clearly defined differences - in my opinion (2018) should be added to the title.

[https://news.ycombinator.com/item?id=17877616](https://news.ycombinator.com/item?id=17877616)

<comment><USER6> Disclaimer: I'm a maintainer of Tink.

We've added tons of new features since 2018, including support for two new languages Golang and Python.

The team has grown from 4 20% contributors to 5 full-time and countless contributors.

Please checkout the following release notes for a list of changes:

[https://github.com/google/tink/releases/tag/v1.3.0](https://github.com/google/tink/releases/tag/v1.3.0)

[https://github.com/google/tink/releases/tag/v1.4.0-rc1](https://github.com/google/tink/releases/tag/v1.4.0-rc1)

<comment><USER7> First of all, thank you for your work on Tink!

Is there a chance that a Dart port might be added in the foreseeable future? I totally understand that it's a ton of work to support another language and I really appreciate all the work that has already been put in, but I just have to ask since right now there is no high level cryptographic library for Dart mature enough that I would trust it for real use.

(Tink seems perfect for usage in mobile and web apps that Dart & Flutter target, and given that Dart is the only language heavily used by Google without Tink support it would make a great addition. If no native Dart implementation is planned, maybe a wrapper could be considered, using the Java/C++ bindings on mobile/native and the upcoming Javascript bindings for Dart/Flutter web support?)

</comment></comment></comment><comment><USER8> Does anyone know how this compares to other libraries such as NaCl and libsodium? Neither the readme nor the slides seem to mention other projects in this space.

<comment><USER9> NaCl/sodium uses Bernstein-crypto by default, Tink uses NIST (e.g. AES-GCM)?

<comment><USER4> Tink does EAX, SIV, and Chapoly as well as GCM.

</comment></comment></comment><comment><USER10> There is also libhydrogen [1] which is a "small, easy-to-use, hard-to-misuse cryptographic library".

[1] [https://github.com/jedisct1/libhydrogen/blob/master/README.m...](https://github.com/jedisct1/libhydrogen/blob/master/README.md)

</comment><comment><USER4> The obvious question about Tink is how it compares to libsodium. It's great that so many people ask, because it suggests that libsodium has successfully lodged itself into our collective consciousness. Both of these projects are forces for good in the world: they replace error-prone low-level crypto libraries with high-level interfaces designed for use by generalist developers.

I've reviewed projects that used Tink but never built one myself. So, grain of Nacl (haha i kill me). I've used libsodium in anger many times. Here's roughly my comparison:

* Both libsodium and Tink will do authenticated ("seal/unseal") cryptography using GCM (the deficient but de facto standard) or Chapoly (Bernstein's primitives). Tink will also do EAX, an AES AEAD that's less fragile in some ways than GCM, and, on the C++ platform, AES-GCM-SIV, which is both fast and misuse-resistant.

* Both libsodium and Tink will do streaming authenticated encryption (efficiently sealing and unsealing files and streams that are too large to buffer entirely in memory before transforming).

* Tink will do deterministic authenticated encryption with AES-SIV; Tink provides this feature for building things like encrypted search features but I think it's more commonly used as a safety feature for scenarios where nonce reuse is likely and revealing duplicate messages is not a major threat.

* Both libsodium and Tink will do ED25519 signatures. Tink will also do P-curve signatures and RSA.

* Both libsodium and Tink will do hybrid encryption (what libsodium would call "box"). libsodium uses Curve25519 and Chapoly; Tink uses P-curves and either GCM or CTR+HMAC (both of them AEAD modes).

* Tink has direct support for a bunch of platforms, notably including Java; unlike Tink, libsodium is, and thus has direct support for, C projects, and is provided for other languages through its C bindings. Tink has first-class C++ support (and its Python support is bindings to its C++ version), but not C.

* libsodium has much better documentation and a much bigger community. Tink is a Google project (it's the evolution of Keyczar, Google's first high-level cryptography library). On the other hand, Daniel Bleichenbacher is on the Tink team. I don't love P-curve crypto, but I'll use an implementation Bleichenbacher put his name on.

* Tink has better key management features and direct support for GCP and AWS KMS. It's not hard to build that feature for libsodium, but it's there already in Tink. Tink may get support for Android Strongbox (it already has support for the Android key storage API); it's probably a really strong choice for Android applications already.

They're both valid choices. If I was making a recommendation to a stranger without much context, I'd almost always recommend libsodium, unless you're doing Android. If it was me, on a new project, I might lean towards Tink at this point.

Happy to be corrected if I got any of this wrong.

</comment><comment><USER11> Previous discussion (2018) : [https://news.ycombinator.com/item?id=17877616](https://news.ycombinator.com/item?id=17877616)

</comment><comment><AUTHOR> There is an open issue for adding Tink information into Wikipedia, if anyone who is knowledgable to take this task will be appreciated.

[https://github.com/google/tink/issues/133](https://github.com/google/tink/issues/133)

</comment><comment><AUTHOR> The following article:

[https://medium.com/asecuritysite-when-bob-met-alice/go- and-d...](https://medium.com/asecuritysite-when-bob-met-alice/go-and-do- crypto-1edd8da909ec)

<comment><USER12> Hmm it seems you haven't finished your sentence? "The following article..." what about it?

</comment></comment><comment><USER13> I hoped this one wouldn't depend on WebCrypto (in Javascript), but seems like it is dependent :( No cryptography without https, still.

I just don't get it: why can't I use `ed25519.sign` without being on secure origin.

The only reason I can think of is: don't allow people to create p2p networks without CA control and approval. I'm talking about this [https://github.com/w3c/webcrypto/issues/28](https://github.com/w3c/webcrypto/issues/28) . Because of that requirement, you can't use WebCrypto primitives on http sites.

So I can't implement my own security on network channel (in web app) without first getting approval from Big Guys, who can revoke it at their will.

<comment><USER12> If you don't trust the CAs, then getting a certificate from one of them so that https is enabled and crypto works is no worse than no encryption at all, is it?

I understand it might give people a false sense of security, or perhaps they trust the CA system and it's not false in their eyes, but if distrust of CAs is the reason to use plaintext connections instead, I'm not sure that's the best choice.

<comment><USER14> I think the issue is that your use of the crypto functions is dependent on permission from a CA. Depending on the nature of the application you're serving over HTTPS, a CA could be compelled under DMCA to revoke your certificate, and thus your permission to use the crypto APIs.

<comment><USER12> I suppose that's a valid point, even if it seems far-fetched that this would be the most effective way of killing someone's software.

</comment></comment></comment></comment><comment><USER15> It's a neat library but features across languages aren't exactly the same. Also, documentation could be improved.

I've used a single Go module for AES key wrapping (RFC-5649) and I appreciated the native Go code

</comment><comment><USER16> Not to be confused with Tinc, an open-source, self-routing, mesh networking protocol and software implementation used for compressed and encrypted virtual private networks.

</comment><comment><USER17> Would anyone happen to know why Tink isn't listed in PyPi.org?

<comment><USER18> I don't see it on npm either. Their docs recommend people use bazel.

When using a library pushes you to use their build toolchain, I start to wonder what their motive is.

<comment><USER19> Hi, I'm currently working on Tink for JavaScript. (Formerly as part of a rotation on Google's cryptography team; that rotation has ended so I'm now doing this on weekends.)

Tink for JavaScript is being used in production systems internally at Google, but the open source release isn't fully baked yet. npm compatibility is a big part of that; our internal codebase doesn't use npm, but we absolutely want open source users to be able to install and use Tink from npm without installing Bazel (though Bazel will most likely continue to be required in order to _contribute_ to Tink). This is why JavaScript is not currently listed among the production-ready languages. Right now I'm fixing it by migrating the codebase to TypeScript so that it can use the TypeScript Bazel rules, which facilitate compatibility with npm.

The biggest complicating factor here is that Tink, like many Google software projects, internally uses Protocol Buffers to serialize data (primarily keys) in a way that's compatible across all the different languages that it supports. Protocol Buffers work really nicely with Bazel and significantly less nicely with most other build systems. Again, though, Bazel won't be required in order to depend on the package, only to build it from source.

</comment></comment></comment><comment><USER20> Not to be confused with Tink, an open-banking fintech from Stockholm. [https://tink.com/](https://tink.com/)

<comment><USER21> Or tink.de a smart home store. I do not think there are any 4 letter words that do not clash with a company.

</comment></comment><comment> phoe-krk How does this compare to libsodium or Bouncy Castle?

<comment><USER9> Bouncy Castle has an "old style" API where there's lots of switches to twiddle and some combinations produce insecure ciphers. Tink, like libsodium (the two are competitors, though in a friendly way), has a smaller API which exposes basically Mac and AEAD, and no way to accidentally set ECB mode or something like that.

The big difference between Tink and sodium is that the latter uses Bernstein's primitives (chaca, salsa, 25519) whereas Tink, from the slides, goes with AES- GCM.

<comment><USER3> This comment was great up until:

> The big difference between Tink and sodium is that the latter uses > Bernstein's primitives (chaca, salsa, 25519) whereas Tink, from the slides, > goes with AES-GCM.

Tink has Bernstein's primitives as well.</comment></comment></comment>


Are New York's Free LinkNYC Internet Kiosks Tracking Your Movements? - <AUTHOR> https://theintercept.com/2018/09/08/linknyc-free-wifi-kiosks/ <comment><USER2> (repost)

NYCLU and Columbia University have a 2016 video (starts at 2:50) about the corporate origins and privacy policy of Google's LinkNYC surveillance kiosks in Manhattan: [https://livestream.com/internetsociety/hopeconf/videos/13081...](https://livestream.com/internetsociety/hopeconf/videos/130816888)

Village Voice covered the topic, [https://www.villagevoice.com/2016/07/06/google-is- transformi...](https://www.villagevoice.com/2016/07/06/google-is-transforming- nycs-payphones-into-a-personalized-propaganda-engine/)

 _> This freedom to opt out entirely is also the last argument that spokespeople for LinkNYC and the city itself fall back upon when challenged with privacy concerns: If you don't like it, you're welcome not to use it. It's a disheartening place to land, especially when discussing infrastructure that's supposed to be serving people who aren't served otherwise. To Moglen, it's simply an unacceptable conclusion. "That's what they want us to believe, that we have a choice between isolation and monitored connecting," he says. "Those are not adequate choices in a 21st-century world: We are designing the net to track you — if you don't like it, don't use it. The human race is shifting to a fully surveilled and monitored superorganism — if you don't like that, stop being human. That's a poor outcome. The United States is a society that was based around the idea that human beings can have liberty. So give us liberty! And don't tell us that otherwise we can have the death of the net."_

<comment><USER3> This is one of the best provisions in GDPR, in my opinion. If someone opts out of data collection, you still have to provide them the service unless the data collection is absolutely necessary to providing the service. It's not an all- or-nothing like most EULAs tend to be, you can opt out of non-essential parts of the agreement.

<comment><USER4> Which unfortunately many companies don't comply with. See: [http://gdprhallofshame.com/](http://gdprhallofshame.com/)

Hopefully we'll start seeing a wave of enforcement actions against these companies soon, too.

<comment><USER5> Unless EU (with the help of GDPR) starts enforcing DNS nodes with ENDS0 Client Subnet extensions (as many endpoints send the subnet of /32 for IPv4 or /128 for IPv6 enabling unprecedented amount of tracking), the whole thing is simply a selective enforcement tool that will be used to punish those the EU does not agree with.

<comment><USER6> Every law is subject to selective enforcement. Should we stop making laws at all?

<comment><USER7> ...yes?

I mean, I've certainly heard worse ideas than "stop making laws."

</comment></comment></comment></comment></comment></comment><comment><USER8> Ubiquitous WiFi kiosks with inbuilt cameras, huh? Ostensibly, they're not allowed to track individual user locations, but the combination of functions present in the devices means it would be trivial to start connecting independent databases and building profiles on users. If you were a malicious actor, how would you go about it?

The PoCs on tracking individuals with MAC addresses are old news (and, in fairness, newer iOS devices use random MAC addresses for WiFi probe requests), let alone the user fingerprinting you could do on browsers when people actually use these things. So you've got a database of devices, and then on top of that you start doing facial recognition and gait analysis to collect another set of individual data points. Then you connect devices to people, and you have a pretty nice system for tracking individuals moving through the city, even those with location services and such disabled.

Paranoia? Maybe, but it wouldn't take much for say, Amazon, to start doing this. And Bezos wouldn't be bound by city regulations on citizen privacy.

<comment><USER9> > The PoCs on tracking individuals with MAC addresses are old news (and, in > fairness, newer iOS devices use random MAC addresses for WiFi probe > requests)

MAC address tracking is obsolete. All phones (including iOS devices) broadcast a full list of SSIDs that they have previously connected to when attempting to connect to wireless networks. That alone is enough to uniquely identify most people.

<comment><USER10> I thought iOS doesn't do that anymore?

<comment><USER9> > I thought iOS doesn't do that anymore?

Last I checked, they did because it's part of the actual spec, though if anyone has definitive evidence to the contrary (either for iOS or flagship Android phones), I'd be curious to see it.

<comment><USER8> You know, I totally forgot this was a thing. I'm sure modern phones do it. Last time I was on an airplane, couple months ago, I was messing around with airmon-ng, and I was amazed at the amount of personally identifiable information that people's WiFi drivers were just spewing into the ether.

</comment></comment></comment></comment></comment><comment><USER11> As life becomes more connected, privacy that was not enforced but just existed due to technical limitations keeps eroding.

We should remember this, anticipate this, maybe sometimes legislate around this, but most of all, build explicit technical counter-measures. Also, all of this may and sometimes will fail, so we need to learn to live in an inevitably more and more transparent world.

</comment><comment><USER12> Almost certainly. And if you're driving, your EZPass tag will track you:

[https://www.youtube.com/watch?v=HQTdpFAo7eQ](https://www.youtube.com/watch?v=HQTdpFAo7eQ)

<comment><USER13> Simply stowing it away in a glove box like most people do prevents any reader from getting at it. I don't know anyone who physically displays their tag on the windshield all the time.

<comment><USER14> How about everyone who sticks it to their windshield with the velcro the ez- pass comes with?

<comment><USER13> "I don't know anyone who physically displays their tag on the windshield all the time." If you do, then stow it in your glovebox if concerned about privacy.

<comment><USER15> Houston has bluetooth trackers for traffic. If you have a phone with bluetooth you're looped in there as well. Just turn bluetooth off while driving while hiding your ez tag in your glove box right? What about the plate readers.

<comment><USER16> Doesn't stop them from tracking you by the transmitters in your tires.

<comment><USER17> ^ This is not sarcasm: [https://en.wikipedia.org/wiki/Tire- pressure_monitoring_syste...](https://en.wikipedia.org/wiki/Tire- pressure_monitoring_system#Privacy_concerns_with_direct_TPMS)

<comment><USER18> >Because each tire transmits a unique identifier

Suddenly glad my car uses the old style, tire rotational speed based system. Sure it's not as accurate and feature rich, but my tires can't be picked out of a blind lineup

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> "...code collects the user's longitude and latitude, as well as the user's browser type, operating system, device type, device identifiers, and full URL clickstreams (including date and time) and aggregates this information into a database."

Aren't all mobile phones browsers collect this data any way? If your location privacy is enabled to be shared by the browser. I am not sure what this student found beyond this which is worth raising brows.

Also, 3 cameras system in each kiosk is indeed creepy.

<comment><USER20> The difference is that rather than a telco in the case of cellular devices, the system is owned and operated by the municipal government directly.

In the context of NYC in particular, it's more immediately concerning than usual because NYPD actually has a significant, funded intelligence division with the resources to use the data.

<comment><USER21> Wait so do they need a search warrant?

<comment><USER22> You don't need a search warrant for information freely given.

</comment></comment></comment></comment><comment><USER23> As someone who leans libertarian, I tend to shy away from rigid legislative solutions to social problems and corporate overreach.

However, articles like this make me wonder if it isn't time for the government to step in and implement privacy regulations of some sort. I did not consent to have my movements tracked and ads sold to me by privately owned kiosks all over my city of residence.

OTOH, I don't know if I would trust the current government to implement such protections in a way that isn't self serving and possibly counterproductive. Shitshow all around.

<comment><USER24> I always read these like "as someone who leans libertarian, I'm starting to realise libertarianism is a bad idea"

<comment><USER25> Taleb has an interesting take on why a person might state their position this way. He states he is:

Libertarian at the global and national level. Republican at the state level. Democrat at the city level. Socialist at the club/neighborhood level. Communist at the family level.

Makes quite a bit of sense to me. And if one does not realize one has this hierarchy of beliefs, it is hard to talk about ones politics. What do you call yourself if you hold such beliefs?

<comment><USER26> That "hierarchy" of beliefs just sounds selfish, with an interest in disproportionately consolidating resources in your proximity, but then demanding permissive access to them once they're at arms length.

Of course, _policies_ must be crafted differently to create a benefit at different levels, but that doesn't mean you can't have consistent philosophies.

<comment><USER27> > that doesn't mean you can't have consistent philosophies

Social structures and politics are _not_ philosophically or logically consistent! Philosophies are, at best, a useful set of guide, but it isn't hard to find pathological examples for any philosophy.

</comment></comment></comment></comment></comment><comment><USER28> I presume that's what they're for, just like the thing Comcast routers do, where they provide public access points whether you want them to or not.

<comment><USER29> Not defending Comcast, but you can disable the public hotspot feature. You cannot however disable the hidden Comcast home security network broadcasting whether you have that service or not

</comment></comment><comment><USER30> More info: [https://cryptome.org/2016/06/linknyc-spy-kiosks- installation...](https://cryptome.org/2016/06/linknyc-spy-kiosks-installation- videos.htm)

</comment><comment><USER31> These kiosks can collect WiFi and Bluetooth MAC addresses of devices people carry. If those are Android devices, then Google probably knows their MACs and can identify users passing by.

</comment><comment><USER32> My first thought before clicking the article was 'of course - it is NYC and the government there prides itself on being paranoid authoritarians'. This is the same city which brought us stop and frisk, which has a police department that likes to wander broadly out of jurisdiction into foreign countries, and given reports about unmarked X-Ray Vans that they have gotten special pleading okays to block any information from the courts. Their government will almost certainly kill more innocent people in /New York City/ than terrorists ever will which is impressive feat given both 9-11 and earlier historic attacks.

</comment><comment><USER33> The only people I've seen use those things are hobos and near-hobos.

</comment><comment><USER34> How's the saying go? If you aren't paying for it, then you are the product? Nothing is free. You are paying one way or another.

Even if they aren't actively tracking your movements, they are collecting data on you and passively tracking your movements since they can use the data to retroactively see where you were.</comment>


Make This Amazon Charade Illegal - <AUTHOR> https://splinternews.com/make-this-amazon-charade-illegal-1822511600 <comment><USER2> Lots of emotion in that post, but to my mind it comes down to equality under the law. Governments shouldn't be able to negotiate ad-hoc taxing/regulatory rules on a per business basis. The tax and regulatory regime should be the same for all businesses in the jurisdiction. Level playing field ...

A secondary reason against these deals is that I don't think government bureaucrats are particularly good at negotiating these deals. Too easy for businesses to change their mind/plans and not suffer any real consequences.

</comment><comment><USER3> > If we did not give private corporations any free public money, they would > still build their business facilities, because doing so is a necessary part > of doing business, which is what businesses do.

Listen, I hate Big Companies as much as the next guy, but let's be honest here. There are very valid arguments on both sides of the equation. I'm going to look at a different, but related (and better-studied) phenomenon: farm subsidies.

It's not hard to see that farm subsidies have some upside: they stabilize the agriculture economy, and this policy treats food as a matter of national security[1]: it would be a _very bad thing_ if food production ceased. On the other hand, others argue that farm subsidies hurt the economy and the public more than they help[2]. There's no easy to answer to this, but it's not like FDR started subsidizing farmers out of the blue.

Similarly, there must be arguments both for and against allowing Amazon's doing. I would genuinely like to hear both -- after all, I have no horse in this race -- but this article is too slanted to form any kind of educated opinion.

[1] [http://ordinary-gentlemen.com/2012/03/13/the-importance- of-f...](http://ordinary-gentlemen.com/2012/03/13/the-importance-of-farm- subsidies/)

[2] [https://www.heritage.org/agriculture/report/how-farm- subsidi...](https://www.heritage.org/agriculture/report/how-farm-subsidies- harm-taxpayers-consumers-and-farmers-too)

</comment><comment><USER4> Dear writer,

without any sarcastic intent, Amazon is a business, and business has that "for profit" mention to is mission.

I operate my business in the U.K. I could have chosen any of the other 140-160 countries, but I didn't. It is convenient AND profitable to do so in the U.K. taking advantage of the goodies this state offers (for my case).

I am a nobody, and therefore I have no bargaining power to get more out of this setup. I follow the rules and drink my tea at 5pm.

BUT (big but here) if I could, then I would most definitely bargain with HMRC (UK's IRS) to pay 1% instead of 15%-30%, and have a couple of steers named after me. :)

<comment><USER5> Yes we know. So what? The point is not that Amazon shouldn't try and do this out of the goodness of their hearts, it's that they shouldn't be allowed to do it by federal law.

</comment></comment><comment><USER6> Lots of swearing, not a lot of logic, facts, or accuracy. It's wrong from the very start (Bezos is not, by any measure, the "richest person in history". I'm not even sure he makes the top 10 of "richest Americans in history"; he's beaten by both Gates and several gilded-age robber barons, and they're in turn dwarfed by historical figures like Alan Rufus or Mansa Musa I).

As for the actual meat of the article:

> Companies like Amazon build new headquarters and other facilities because > they have a business need to do so. If a business has a business need to > build a business facility, you do not need to pay the business money to do > so.

Right, and I purchase lunch because I have a biological need to do so. And yet! Businesses still compete for my lunch order on price, including "paying me money" to win my business (or as normal people call it, offering me a discount). It's almost like my market transaction, freely entered into by both parties, rewards _both of us_ , and _both of us_ have an incentive to find, respectively, a good vendor and good customers! And in a market transaction, those incentives will often end up causing a competition based on price or other crude metrics like size!

> The only thing that every damn city in America is bidding on here is the > right to have a business facility located in a certain place.

Which is a thing which has value, and thus is the sort of thing that people bid on, yes. What element of your time on planet earth led you to believe any other thing might possibly happen?

Now, it's totally possible that the eventual deal will prove to be a bad one for the lucky city (...or even Amazon) but 1) no such deal exists yet 2) we have no idea what the terms will be and 3) unlike the perennial boondoggle that is subidising stadiums, an Amazon headquarters could conceivably have a transformative effect.

> There's an easy way to ensure that this charade doesn't happen: a federal > law banning these kinds of state and local subsidies to private businesses.

1) I have zero faith in the ability of legislators to draft a law that actually prevents this and 2) Amazon's HQ search is the worst possible example of what needs to be stopped. How about the subsides for making films in a state? Or the hideously pointless stadium subsidies?

I hate corporate welfare as much as the next quasi-minarchist libertarian (which, spoiler alert, is a _LOT_ ), but come on. This reads like the result of a college student who just sat through their first lecture on corporate welfare, spent 60 seconds on google news, and then spat out some clickbait.

<comment><USER4> Regarding the 'richest person in history' claim, I remember reading about this a couple of year ago [1]:

(top) 1. Mansa Musa

Mansa Musa Mansa Musa Abraham Cresques—Getty Images/The Bridgeman Art Library Year: 1280–1337

Country: Mali

Wealth: Richer than anyone could describe

Mansa Musa, the king of Timbuktu, is often referred to as the wealthiest person in history. According to Ferrum College history professor Richard Smith, Musa's west African kingdom was likely the largest producer of gold in the world—at a time which gold was in especially high demand.

[1]: [http://time.com/money/3977798/the-10-richest-people-of- all-t...](http://time.com/money/3977798/the-10-richest-people-of-all-time-2/)

<comment><USER7> It's pretty hard to define wealth, since so much of it historically has been illiquid. If you can't turn all or most of your wealth into some other form of asset, should it really be counted? But you can say the same about Bezos' fortune: he can sell $1B of stock per year, but selling much more would devalue his worth considerably.

And of course is there a difference between the absolute control that absolute rulers had and ownership?

But there's little argument that Mansa Musa was the richest of all time and that Putin is currently the richest.</comment></comment></comment>


Byzantine Fault Tolerant Raft With Smart Contracts - <AUTHOR> https://github.com/buckie/juno <comment><USER2> This and related code bases (such as the programming language hopper, which is my focus) are the work of several colleagues along with myself. Happy to try to answer any tech/computer science focused questions.

NB: a lot of the stuff still has much work to be done, but we're transitioning to working in the open :)

<comment><USER3> If one of the nodes goes rogue and tries to flood the network with noise, how does the system prevent denial of service?

<comment><USER4> Author of Juno here -- surprised to see this on here at all given that I didn't tell anyone that it went open (was saving it for tomorrow). I'm losing out on all this sweet sweet karma </s>.

Anyway, to your question (carter focuses on the smart contract language, not the consensus layer): This is actually a semi-normal/expected thing in the case of a network partition. Say one node gets cut off, transitions to a candidate and achieves some high term (but potentially has an out of date log index). When it comes back online/partition ends, it will start spamming the rest of the cluster requesting votes.

What protects the rest from this or other faults is a combo of signed RPC's and extra logic (i.e. lazy votes). With sigs, chatter from someone who you don't have the key for (or invalid msgs generally) just get dropped + authorship is verified (Follower can't pretend to be some other node). With lazy votes the portion of the cluster in a good state basically chills (stays in same state, doesn't vote) until the Followers hit an election timeout (AE clears the lazy vote).

Of course you can still DoS the NIC or Haskell server, but the important thing to note is that this __isn 't __meant for a public-facing deployment. It 's designed for an internal network -or- inter-corp via leased lines/secured pipes setup. That's the whole point of Juno really... for enterprise applications bitcoin-class tech gives you more features than you need (at the cost of performance).

Tangaroa was a great first step, but we have internal fixes for a number of cases it didn't cover, issues caused by incomplete implementations and (I think) some novel ideas to give back... but I'm still finishing the paper on the enhanced/new (not sure what the line for that is) protocol and its implementation so it didn't make the cut for this release.

</comment></comment></comment><comment><USER5> This is really neat.

How does a system like Hopper compare to the Ethereum Virtual Machine?

<comment><USER2> short short answer that is deliberately terse: the hopper language, once a wee bit more mature, will be a dependently type language with linear types (to model first class ownership) and a few other facilities for modelling interaction and authorization along with logical soundness as hard goals. Imagine if agda had a linear logical baby that was designed to be easily embeddable in a host application and/or standalone, and also designed with RTS and compiler improvements from the the outset. plus a few other tbd goodies to make it nice to use.

the ethereum vm doesn't have any notion of ownership or authorization built in, those are provided whole cloth by application level authors (have fun doing that correctly for every app!). I could opine more than that, but I think thats the most i should say about the quality of the stack vm specification or its semantics :)

<comment><USER6> > I think thats the most i should say about the quality of the stack vm > specification or its semantics

As someone who spends a lot of time with Ethereum, I'd love to hear more. Honestly, I almost never deal with the stack level language (only the higher level Solidity). Isn't it possible to write whatever language you like on top of that stack based language?

<comment><USER7> There is a proposal[1] to upgrade the current EVM to a WebAssembly based VM. Since webAssembly has a llvm backend, any language with a llvm compiler (which is most of them) could be used to write contract code.

1\. [https://github.com/ethereum/EIPs/issues/48](https://github.com/ethereum/EIPs/issues/48)

<comment><USER8> This is a vast oversimplification of the problem. LLVM is a compiler IR; nothing more. It is not portable (you cannot generate IR for one target and have it work for another target) and it does not trivially map to the semantics of most languages beyond C.

A programming language is a combination of many components; assembly optimization and target code generation is just one important part of a much larger picture.

I'm only responding critically because I've seen this trope that LLVM is some sort of universal programming language target way too often now. It misleads people into underestimating the scope of the actual problem. LLVM is not a panacea.

If you really want to make your platform programmable from any programming language, invest time into a well designed C API. Your users will thank you.

<comment><USER7> This is addressed in the linked issue.[1] Your criticism is the reason why (a subset of) WebAssembly is used, not LLVM IR.

1\. [https://github.com/ethereum/EIPs/issues/48#issuecomment-1690...](https://github.com/ethereum/EIPs/issues/48#issuecomment-169019813)

</comment></comment></comment></comment></comment></comment><comment><USER9> Does this project actually escrow value, via PoW, or is it merely a message passing protocol?

<comment><USER2> the hopper language (the version used in this repo is an earlier snapshot of work from this fall that essentially a minimal scheme / lambda calculus with program level transactional memory) provides mechanisms for first class ownership. Current hopper master is under a huge amount of churn towards the full language we're building, so unless you enjoy reading compiler code bases under heavy active dev, the best i can say is this: stay tuned :)

linear logic provides a nice vehicle for modelling first class ownership. namely: holding a value in a program IS owning it. That plus a lot of ideas from languages/tools like Agda, Coq, Lean, and Idris along with some of what i've learned being an occasional contributor to GHC, plus general PL tech, are going into Hopper, though the current code base

<comment><USER10> Cool project!

Are you using dependent linear types? Or are you using dependent types some places, and non-dependent linear types for the ownership semantics?

<comment><USER2> Excellent Question. The notion of linearity were starting with for type system design corresponds with runtime linear usage, which Means linear computations that are pure can be lifted into types because they don't have any runtime usage.

One of the More surprising / interesting realizations we had recently was that the copattern matching for coinductive Data as seen in Agda is exactly what's needed to define pattern matching sanely on certain linear type operators like &

Which then let's you very succinctly model problems like having cake vs eating it. The original escrow of deliciousness vs the pretty cake</comment></comment></comment></comment>


On Having Balls, Part II: Staying Hungry - <AUTHOR> http://james.hotornot.com/2007/02/on-having-balls-part-ii-staying-hungry.html <comment><USER2> Fascinating. I'm at a startup that's an S-corp too and wonder about stuff like this for the future.</comment>


Firefox 5.0.1 and 3.6.19 compatibility updates is now available for Mac - <AUTHOR> http://www.browsomatic.com/2011/07/firefox-501-and-3619-compatibility.html <comment><USER2> Anyone got a link to a Firefox 3.6.x EOL roadmap?</comment>


Show HN: Rebump – Bump Important Emails Until They're Answered - <AUTHOR> http://rebump.cc <comment><USER2> If I ever suspected a correspondent of using something like this, they would be dead to me.

I appreciate a human-generated bump now and again, because it is a signal that they continue to care about what we were talking about. But automatically sending me message after machine-generated message to prod me into doing whatever they wanted? With no effort or intervening social judgment? Fuck that.

For people to whom this appeals, I'd suggest my approach: keep a "pending" list. If you haven't heard back and still care, you can always take the 30 seconds to say, "Hey, have you had a chance to think more about this?" or whatever the contextually appropriate thing is.

<comment><USER3> This may not work very well for out of organization contacts. But for inside organization contacts it works beautifully. They know youre spamming them but its like a reminder service for them (which they unfortunately wont do on their own).

<comment><USER4> We use Lync (msn messenger) internally and if someone hasn't responded to an email I ping them on that, ring them up, or even wander over and chat depending on our relationship.

There are plenty of folks I know with 100+ unread emails this week and a bunch of them will never get seen. So imo another email isn't the most effective way to resolve it.

</comment></comment></comment><comment><USER5> _This is probably not the site you are looking for! You attempted to reach www.rebump.cc, but instead you actually reached a server identifying itself as www.ohmspa.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of www.rebump.cc. You should not proceed, especially if you have never seen this warning before for this site._

<comment><AUTHOR> Yes! Many a heart skipped a beat during the period where this message was displayed, but we are back. All good. Thanks.

</comment></comment><comment><USER6> Dear Busy Person,

I know you get so many emails that it takes you a while to reply, so I thought I'd help you out by sending you more emails.

Regards.

Rebump.

\</comment><comment>

Jest aside, nagging does work, so this technique probably would too, but I can imagine if someone started using it on me, it'd just filter the messages to the bin.

The product does look very well executed. Best of luck.

<comment><AUTHOR> You don't reply to an email and you get a reply a few days later: "Hey, I just wanted to make sure that you saw this. If you need any more details, just let me know. Thanks again!"

If you did mean to reply to that first email, this gets the job done. You can also customize the message to whatever you want. Even: "bump!"

<comment><USER7> It's a new name for spam. Renaming things has limited potential to change how we think about them.

</comment></comment></comment><comment><USER7> Quote: "Rebump sends multiple follow-up messages to your email recipients for you. These automated emails are customized to appear as if you sent the email yourself."

Wow -- they managed not to use the word "spam" anywhere on their site.

<comment><AUTHOR> It would be silly for spammers to use this. It would just increase the likelihood of them being marked as spam by people that already ignored their first try.

This is for people who you expect an answer from but the email has fallen through the cracks. Maybe it's starred, maybe they opened it on mobile and forgot to save as new. Your concern is definitely one we are keeping an eye out for but haven't seen it yet.

<comment><USER7> > It would be silly for spammers to use this. It would just increase the > likelihood of them being marked as spam by people that already ignored their > first try.

Not if the spammers use a botnet to change the email's source for each retry. Anyone who thinks spam originates from a fixed server name and IP is living in the past. More here:

[http://www.arachnoid.com/lutusp/antispam.html](http://www.arachnoid.com/lutusp/antispam.html)

[http://www.arachnoid.com/anti_spam/pic2_crop_small_trans.gif](http://www.arachnoid.com/anti_spam/pic2_crop_small_trans.gif)

Also, an easy way for a legitimate sender to be redefined as a spammer is for them to send copies of an e-mail until they get a reply.

> Your concern is definitely one we are keeping an eye out for but haven't > seen it yet.

Like Bitcoin thefts, you won't see any sign of it until it's too late.

This idea violates the most basic civilized e-mail rule -- if you don't get a reply, don't badger the recipient. Spammers, of course, don't care about civilized behavior and will find this idea very appealing.

<comment><AUTHOR> We are not resending the original email. We are sending a new message you can customize that says some version of, "Did you see this?."

Will definitely read up on those concerns. Thank you so much for the resources and for preventing us from getting sleep at night from now on.

;-)

<comment><USER7> > We are not resending the original email. We are sending a new message ...

Yes, and that's exactly what spammers do. They know better than to send the same message more than once, but they certainly won't abandon an address they know to be valid (no bounce).

The first might say, "Our automated analysis tool has detected that your computer has been infected. Click this link for a repair."

The second might say, "We're sorry -- your bank has reported a hacking attempt and we need you to change your password. Please enter your login ID and your old and new password."

The third might say, "Is your wife no longer happy? Try our miracle ..." (use your imagination)

Spammers might be intellectually challenged people, but they're not perfectly stupid, on the ground that nothing is perfect.

<comment><AUTHOR> To clarify: if an email is spam, no number of Rebumps will rescue it from the spam folder. In fact, if it was just ignored the first time, it makes it more likely to be marked as spam with every bump.

</comment></comment></comment></comment></comment></comment><comment><USER3> I know some might accuse you of spamming but this is extremely useful. Been using boomerang but that only remind me and then I have to manually send them an email. I hope it remains free though.

<comment><AUTHOR> Thanks! Its usefulness to us is why we were motivated to spin it off and release it into the wild.

<comment><USER8> I tend to share the general HN opinion here. But I do feel obligated to point out that this is probably just about the most hostile environment you could possibly announce this into. Our hatred of it doesn't mean there's no market here.

...

Stupid honesty.

<comment><AUTHOR> The feedback has been incredibly valuable. No regrets.

</comment></comment></comment></comment><comment><USER9> The first time I see an email from this service, they will meet my permanent blacklist.

This is absolutely, brutally intolerable. It's hard enough maintaining spam- free email without this nonsense.

<comment><AUTHOR> It won't be from us. It will be an email from a loved one, asking simply if you saw the email they send you a few days ago. Be gentle.

</comment></comment><comment><AUTHOR> This is a tool we built to use internally and are spinning off. We did the same with InVision App a while back.

Rebump works with Gmail on Chrome/Firefox for now.

Feedback treasured.

<comment><USER10> It looks simple and valuable, which is good, but I feel my needs are already more than met with Boomerang for Gmail.

<comment><AUTHOR> Boomerang is awesome. And it will tell you when an email hasn't been replied to.

But it won't automatically bump until you get a response. We think Rebump saves time and workflow that way. It plays very nicely with both Boomerang and YesWare.

<comment><USER7> > Boomerang is awesome. And it will tell you when an email hasn't been replied > to. But it won't automatically bump until you get a response.

That's because Boomerang understands and meets widely accepted email standards of behavior.

> We think Rebump saves time and workflow that way.

It's spam. No blizzard of words, however blinding, can change its identity. It renames a deplorable social email practice, but without changing its identity.

Civilized people write once, then wait for a reply. Spammers "bump" over and over again until they either get a reply or are classed as spam.

<comment><AUTHOR> Civilized people remind their friends, coworkers and clients to follow-up on important emails. That's what this is for.

<comment><USER7> > Civilized people remind their friends, coworkers and clients to follow-up on > important emails.

Civilized people have inboxes and outboxes. If an e-mail isn't transferred to the the inbox, the pending-action category, then any attempt to change its status by repeat mails is at the very least disrespectful of the recipient's choice of priorities.

All I am saying is that you need to find out how people think about these things. You're well past explaining, now you're rationalizing.

</comment></comment></comment></comment></comment></comment><comment> Dorian-Marie As someone in the feedback chat told me:

If you want mutiple accounts, you will need to sign in with an account, then sign out (top right of [https://www.rebump.cc/emails/home/](https://www.rebump.cc/emails/home/)), then sign in the other account, etc.

Happy bumping

</comment><comment><USER11> Looks cool and I'd like to try it. A few questions for you:

How does it work technically? Is the same first message sent every time? What is the feedback from people who are being "rebumped"?

<comment><AUTHOR> You can adjust the message and how frequently you want the bumps to happen. The people being bumped think it's you and they respond to the original email.

<comment><USER12> Except its glaringly obvious that the original sender didn't send the new email.

Notably, your emails are HTML only.

</comment></comment></comment><comment><USER13> From the video: > You can easily monitor the status of each message you send and know if and when it gets read

Huh? How?

<comment><USER7> There are a number of reliable ways to detect a read. The most common is to sent an HTML-format message with an embedded graphic link to the sender's server.

<comment><USER14> That's not reliable enough. A lot of email clients (or users) have images off by default, at least when reading emails from new senders.

<comment><USER7> > That's not reliable enough.

It's reliable enough for a spammer. Remember spam is a numbers game -- things only have to work as hoped a small percentage of the time for the system to work.

</comment></comment></comment></comment><comment><USER15> ... the more of a chance you have for a 100% response rate.

sounds like it works 100% of the time, 50% of the time.

</comment><comment><USER16> I hope Gmail updates it spam algorithm to catch stuff like this.</comment>


Farmers Take Out Millions In Loans To Raise Chickens For Big-Box Retailers - happy-go-lucky http://www.npr.org/sections/thesalt/2017/06/22/533944458/farmers-take-out-millions-in-loans-to-raise-chickens-for-big-box-retailers <comment><AUTHOR> The most natural reading of this is "Sophisticated entrepreneurs attempt to increase revenue by diversifying into a new line of business requiring capital improvements financed by readily available debt.", unless one has the misapprehension that farmers are, as a class, stupid.

<comment><USER2> It's not binary. There's a whole range types of people, situations and forces at play. Not all are sophisticated, not all are dumb and probably are reacting to emotional forces that we aren't aware of. I frequently read stories on this site about how it's dumb to have your whole business dependent upon Facebook. Maybe depending entirely on Costco is equally a bad idea. Perhaps more so since there are massive loans involved.

EDIT: From the article:

"Bringing the boys back to the farm is huge for me," Mueller says. "I'm not a big enough farmer to where another family could farm and do corn and soybeans and survive. This way they can."

At least in this one case there are non-sophisticated financial forces at play. Patio11's comment is not apt.

<comment><USER3> > At least in this one case there are non-sophisticated financial forces at > play.

I'm not convinced that's a fair assumption. Everyone has reasons they'd like to make more money and some vague idea of what they'd do if they were more wealthy. Acknowledging that you want your business to be successful because x doesn't necessarily indicate that a decision making process is irrational or unsophisticated.

<comment><USER2> I'd say that a major part in his deciding to take $6 million in loans and signing an exclusive contract with Costco has to do with emotion and not purely financial reasons. It may be a good decision but at least part of the decision making was not for sophisticated financial reasons.

<comment><USER3> I think it's silly to assume that's the case. You could very well be right, but there's no way to make that anything more than an assumption based on the article.

<comment><USER2> Well the man in the article talked about how important it was for him to bring his boys home. That is provide an environment where he sees them at home with a future in farming. It's what he said.

Emotion is a huge part of business decisions for most people. It's rare for someone to disassociate their emotions from the transaction. This is well known.

</comment></comment></comment></comment></comment></comment><comment><USER3> Million dollar loans aren't really that strange for farmers. It is definitely a lot of money, but usually it's secured by assets that are objectively valuable themselves (land).

My father in law started out as a humble hay farmer in the middle of nowhere in Utah, but he could easily retire on the appreciation and equity he built in the land he owns alone (though he's the type that would never sell it, and he's already rich).

<comment><USER4> In this case the loan is to build barns, not buy more land. And the barns are specifically for raising chickens. If the contracts or the poultry processing in that area fall through then I don't think the underlying assets would be worth their cost-- leaving the farmers high and dry.

<comment><USER5> True, but the bank won't be giving those loans if they think the contracts will fall through. Even if the contracts fall through, chicken demand is a known quantity. The farmer has opportunity to find someone else to buy his chickens.

<comment><USER6> Yes, because banks never give loans to people who is later unable to pay back. And chicken prices can only go up, like house prices.

<comment><USER3> Well in this case the assets will be chickens and barns. Certainly there's risk, but the likelihood that either chickens or barns rapidly become worthless is quite small.

Unlike the housing crisis, they don't need the prices to continually go up. They just need them to not fall through some floor.

</comment></comment></comment></comment></comment><comment><USER7> Christopher Leonard's book 'The Meat Racket' is a good primer for anyone interested in the subject. He does an excellent job walking through the simultaneous rise of "big chicken" and the legislative steps corporations like Tyson and Cargill took to ensure their long-term domination of farmers, the law and the consumer.

[https://www.amazon.com/Meat-Racket-Takeover-Americas- Busines...](https://www.amazon.com/Meat-Racket-Takeover-Americas- Business/dp/1451645813)

<comment><USER8> Here's the NYT book review: [https://www.nytimes.com/2014/03/02/books/review/the-meat- rac...](https://www.nytimes.com/2014/03/02/books/review/the-meat-racket-and- in-meat-we-trust.html).

I think the bigger picture issue is that there is nothing special here about meat, nearly every industry is like that. Big corps are inherently more efficient at this sort of thing, and technology has helped them overcome any inefficiencies of scale they might have suffered in the past. You used to be able to walk into a Comp USA (or even local computer stores) and see aisles of CDs from all these different software companies. Today, Google/Microsoft/Apple control everything through their app stores and bundle most of the software you might want to buy with their devices.

Heck, we're watching this happen right now in several industries, and cheering it along. Amazon is putting all the smaller retailers out of business (because there is pretty much no way to compete with Amazon's economics of scale). Uber is an international mega-corp that's systematically wiping out the dozens of taxi companies (almost all small businesses) that used to exist in each city.

<comment><AUTHOR> _You used to be able to walk into a Comp USA (or even local computer stores) and see aisles of CDs from all these different software companies._

This is true. Those were terrible, terrible times to be in the software business.

If you want me to elaborate, I can elaborate at some length.

<comment><USER8> I'd certainly be curious to know what you mean.

<comment><AUTHOR> So I came up in the post-retail days of software, but I sold CDs (once upon a time) and have had a coffee or hundred with folks who came up a few years before I did, including ones who operated spiritually similar businesses with retail components. (My CD sales were over the Internet.)

Retail math is absolutely brutal. Consider software sold at a MSRP of $30, which might be squarely in the Scrappy Small Software Company Making A Go Of It range.

The retail store itself practices "keystoning" \-- it won't pay more than $15 for that SKU. It also generally won't (and certainly not if it is a Best Buy / CompUSA) pay when one expects it to pay, before receiving the product. Nope, it pays after (depending on the contract) sell-thru or sell-thru plus return window expiry.

So who got the $15? Was it the software company? No, because CompUSA has better things to do than to talk to software companies, unless your company rhymes with Microsoft or Intuit. Instead, CompUSA purchased the software from a distributor. The distributor purchased it from a publisher; the publisher from the software house.

Suppose your software company self-published, to capture the margins. Bully on you. You make about $10 per unit.

Now let's return to that CD bit. Permit me to handwave, because it has been many years, but in quantity, shipped to your distributor, assume CD plus printed insert plus jewel case costs you $4.

So, when everything works out correctly, you make $6 on a $30 sale. You eat $4 per return (returned software is unsaleable; my standing instruction to our fulfillment provider was to destroy it if mail bounced back because even an unopened envelope is useless); assume that's negligible.

Ahh, but you get the massive, massive volume of the retail channel, right? Wonderful performance for midlist in retail is, drumroll, 10k units per year. You're doing better than almost all B2C software which isn't games.

It is the best time in the history of the world to be independent in software. Selling CDs over the Internet bad, not terrible. Selling downloads over the Internet was pretty spiffy. Selling SaaS over the Internet is the best model independent software makers have ever seen.

(The mobile folks are in a parallel universe which is very, very hit driven and which I wouldn't recommend to most people. Apple/Google are actually are capable of delivering volume -- more than BestBuy could even dream of -- and charge less as a percent for it, but it is in their interests to churn-and- burn who gets that volume, so it is a rough place to be.)

see also [https://successfulsoftware.net/2008/04/21/selling-your- softw...](https://successfulsoftware.net/2008/04/21/selling-your-software-in- retail-stores-all-that-glitters-is-not-gold/) which recounts a conversation which is substantially in line with unpublished conversations I had over the years. (Andy Brice, who runs that site, runs a business spiritually similar to my sold software business, but rather larger.)

I note that you might be suffering from a peculiar sort of availability bias. You're, IIRC, a gainfully employed professional who doesn't sell software for a living. As a gainfully employed professional, walking into a CompUSA and walking past a row full of shelves exposes you to evidence that there exists a software industry, even if you have no connection to the industry. If that row of shelves goes away, you might reasonably believe "Wow, the software industry went away.", but that is not in fact what happened. The software industry makes more money than ever, by a lot, but it does so in places which are inconvenient to you to stumble upon accidentally.

</comment></comment></comment></comment></comment><comment><USER9> > "There's some things that aren't perfect, but you're never going to get a > perfect contract," Mueller says. "And there again you got to have some faith > and you've got to have some trust."

That's a bit of a straw man. You sign contracts to have a set of rules that you can fall back on if you /no longer/ can trust the other party.

</comment><comment><USER4> Interesting that they say "raise corn" and "grow chickens".

<comment><USER10> There may be two distinctions in the language.

First, chicken "production" is generally separated into "layers" and "growers". Layers are chickens you raise to lay eggs, growers are chickens you raise just to grow big enough to eat. So "grow" in the "raise vs grow" context may influenced by the "layer vs grower" context.

The second is that there is a split between people who raise livestock through their full life cycle, breeding them and raising them to a finished weight, versus people who just breed or just finish livestock; the "factory chickens" will typically be just a finishing operation, so "grow" may also be influenced by that.

The third possibility is that it's an in-joke by the farmers, on how the chickens have become more of a crop than the corn.

The fourth possibility, of course, is that it's just a transcription error by the authors, and the farmers say "grow corn and raise chickens".

</comment></comment><comment><USER11> Disclaimer - my current contract is with the Farm Credit bank system, and they're likely to be the ones to lend to these farmers. Mainly because they understand agriculture and farmers & ranchers, and the big banks don't. But also because even though we're a government-sponsored entity (the feds guarantee our loans), we are run as a co-op. If we have a good year (i.e. not many losses) we will refund patronage dividends to our customers. And this can be significant - one association alone paid out $160 million last year.

These farmers are pretty smart - yes they're taking a risk by borrowing money. But diversification can only help them in the long run. And $2-6 million for new barns isn't a lot in a business where field equipment can easily run a half-million dollars, and wears out/becomes obsolete in 10 or 15 years.

</comment><comment><USER12> The company that you're going to be working with/for is going to make a huge difference here. Costco has a reputation of being a good corporate citizen and taking care of its staff, suppliers, etc. (FWIW including a code of ethics that prioritizes: Obey the Law, Take care of Members, Take care of Employees, Respect Suppliers, Reward Shareholders.)

If I were a supplier I'd be a lot more willing to sign on with someone like Costco with a DBAD reputation than with anything owned by Walmart with a "you need to cut your margin another 5% this year or we'll drop you and leave you with no way to pay those loans" reputation.

</comment><comment><USER13> I'm really hoping that in the next 5 or 10 years that "clean meat" or meat created from animal cells becomes a viable alternative. This is the future, and with it we will drive costs down and food safety up.

</comment><comment> Paul-ish > And farmers can always lose money on a bad batch of birds.

> "A disaster flock I call them," says OCM President Mike Weaver, who raises > poultry on contract in West Virginia. "They contract a disease that stunts > their growth. And that's going to happen to (the farmers) eventually. The > feed and the chicks, they don't have control over, but their pay is going to > be based on those."

Wouldn't some sort of insurance be useful here?

</comment><comment><USER14> This is a very, very typical pattern in poultry and egg production.

Source: Grew up in rural Virginia near a bunch of big poultry processing centers and the surrounding area is filled with family farmers who are debt slaves to the poultry processors.

</comment><comment><USER15> The idea of "having faith" that a mega corporation will take pity on your business when inevitable negative variance hits the farm sends a shudder down my spine.

<comment><USER16> The hell else are they supposed to do exactly? The economic crash hit the middle states hard, and the recovery has gone almost exclusively to the coasts. The real question is why we're allowing an entire region of the country's "best option" to be being debt slaves to a handful of chicken companies.

</comment></comment><comment><USER17> Interesting to see Costco taking out the middle man. Chicken is going to get even cheaper.

<comment><USER18> Possibly, but in my opinion probably not. Costco is selling these chickens for $4.99 each. It's a loss leader, and (as far as I have heard) Costco is adamant that this price will not change. I think Costco is simply trying to reduce the amount of loss they are taking at that price.

* I know it works on me, I go in for the free samples mostly and regularly spend $50+ on a visit (maybe half the time), and just recently spent $7,000 on a massage chair.

<comment><USER19> They used to be $3.99, but even at $5 they are twice as big and 1/2 the cost of grocery store chickens.

<comment><USER20> Yes, but what is the quality? What have they been fed and injected with on their way to an assembly line that kills them at the rate of 200/minute?

<comment><USER19> The Costco chickens taste good.

<comment><USER18> They do taste good. I have to admit though, after eating a lot of them, I suspect they have some brine added. Not a big deal, and not for sure, but I don't get them as much as I used to.

</comment></comment></comment></comment></comment></comment><comment><USER21> And elsewhere on the front page, a dotcom is hiring and is in the business of facilitating yet more borrowing by poor people.

</comment><comment><USER22> In the US, 25 million chickens - sentient, feeling creatures, killed in their infancy after a short, miserable life. Genetic freaks, too.

Every day, over and over again, a cycle of suffering.

Perhaps this is a business one could choose not to get in to.

<comment><USER16> Rhinos are endangered and hunted by poachers nearly to extinction because they aren't allowed to be domesticated and "farmed" for ivory. The best way animals can ensure long term survival is to be useful to man, not only because farm animals are in much greater numbers and protected as property is in our society, but also because we are rapidly running out of "wild" area for them to exist in.

I shudder to think how many species are going to go extinct once we can grow meat directly in labs.

<comment><USER23> > I shudder to think how many species are going to go extinct once we can grow > meat directly in labs.

Cows, chickens, turkey (although they've got a wild variant), sheep and pigs. Add in a few less common meats and you're up to about a dozen?

Not even a drop in the bucket for the [https://en.wikipedia.org/wiki/Holocene_extinction](https://en.wikipedia.org/wiki/Holocene_extinction).</comment></comment></comment>