Goldman Sachs model to predict World Cup game results didn't come close - <AUTHOR> https://www.bloomberg.com/view/articles/2018-07-14/world-cup-goldman-sachs-gs-model-got-it-all-wrong <comment><USER2> > And in any case, the model only generated probabilities of winning a game > and advancing, and no team was given more than an 18.5 percent chance of > winning the World Cup.

> [...]

> But Goldman Sach's misfire is perhaps the most curious.

The model said, that there is a lot of uncertainty, and as it happens, it was entirely correct. A World Cup chance of 18.5 percent means, that 4 out of 5 times the team will not win, and that that is the highest chance does not say much about the model.

And in general this is one instance of the well practiced journalistic technique to wait for results first and then define a bar afterwards to criticize the results according to standards that did not exist when the performance happened. (I guess in this case it is even worse, we could construct a reasonable test of the model performed, I have the suspicion that that was in the original paper and that the journalist either did not understand it, or, more likely, choose to ignore it in favor of writing a better story.)

<comment><USER3> But Goldman Sachs are the kings of predicting uncertainty! This is their whole business! They make billions predicting certainty through the murky, uncertain waters of the global economy. Would you argue that the global economy is more uncertain that soccer? I'd say so. How is it that they can find success in the market but not in soccer?

I think this is a smoke signal. Soccer is corrupt; you can't predict the winner unless you know what's being passed around under the table. Goldman Sachs does these predictions so people read between the lines to see how corrupt it is.

My argument is: "Goldman is amazing at statistical analysis and they routinely practice it on much tougher models (the global economy), so they should have no problem predicting a simpler model (soccer). But since they drastically failed at predicting soccer, then there must be an equally drastic variable missing from their predictions. Since we can trust Goldman to use all available public information in their analysis, there must be critical information that is hidden from the public which affects the outcomes". I make some assumptions, but it's fairly sound, no?

<comment><USER4> Unclear if your comment is tongue in cheek, but assuming that you're serious, I'd encourage you to give a listen to a podcast episode like this: [https://soundcloud.com/bettheprocess/episode-35-ted- knutson](https://soundcloud.com/bettheprocess/episode-35-ted-knutson).

In the world of sports betting/analytics, you have baseball and basketball at the forefront, and then American football, soccer, and hockey (roughly in that order).

Off the top of my head, there are several reasons why the latter three sports have all lagged behind:

-Lack of data

It wasn't until the last 4-5 years that widely available, affordable, and accurate data for soccer matches was available. Companies like Opta have accomplished this by outsourcing the watching of games and the manual tagging of events, which was made possible by the advent of cheap cloud computing.

It should be self-evident why tracking the position and actions of 22 players is more complicated than something like baseball, where for the most part you are looking at one pitcher vs. one batter, much of which can be automated with computer vision that tracks pitch position, speed, and spin.

-Complexity

It's no accident that baseball was the first sport to be revolutionized by analytics. Most of the time, it's a static game, with a clearly defined action set. I.e. do I swing at the pitch or not. Do I throw a fastball or not. Do I attempt to steal a base or not.

In games like American football, soccer, and hockey, you have anywhere from 12-22 players on the field at a time. Tracking what the players without the ball or the puck are doing is a difficult task technically, as is quantifying their impact. Concepts like expected goals and expected goals added are recent ones.

-Sample size

Typical elite soccer leagues see each team play each other twice. In England and Spain, this means you have 38 games per season.

Baseball has a 162 game season and playoff games, basketball has an 82 game season and playoff games, etc. Coupled with the fact that quality data has been only collected for a few years, and you get other problems.

In basketball and baseball, the effects of aging on player performance and statistics is fairly well understood now. We can generally calculate the 5-year market value of a player etc. In the other sports I mentioned, we don't yet have that kind of time series data to be able to make those judgements.

\--

Specific to the World Cup, there are other reasons why you may find it hard to predict results.

-Team chemistry and style

Even though the World Cup is the most high-profile soccer event in the world, most players are spending 1-3 months a year with their national teams. Their "day jobs" with their clubs teams take up most of their playing time and attention.

As anyone who has played the game Football Manager will know, managing a national team is a tough job. You have no say over how the players are practicing when they're away from you, and no control over the physical condition in which they arrive at the World Cup. This year, there was barely a month between the end of the regular European seasons and the start of the World Cup.

In that month's time, you have to get at least 11 players who have not played with each other, to learn your style of play. Do you want to play a pressing style? Are you attempting a slow buildup, or trying long balls? Etc. etc.

-Home field advantage

In baseball and basketball, most modern statistical models account for home field advantage. Having 60,000 Russian fans chanting and heckling likely played a role in the team's ability to upset Spain, particularly during penalty kicks.

This goes back to the sample issue. How many times before have Spain played Russia IN Russia in front of a large crowd? Probably never.

\---

All this is to say, cut Goldman some slack. There are a number of non- nefarious reasons why you may expect a soccer model to produce some spectacular miscues.

<comment><USER3> Ok, I understand this - that soccer has many variables and it is difficult to create a model with all of these variables. But my point is, the global economy has _way_ more variables than soccer. Way way way _way_ more variables. At least 7.5 billion of them.

So would you argue that creating a statistical model of soccer is harder than creating one for global economies? I think it's harder to model economies.

I'm not even trying to give Goldman a hard time! I'm saying that Goldman probably put together a very accurate model of "soccer", but we aren't watching an accurate model of soccer; we're watching the corrupted one where the players and skills don't matter.

<comment><USER4> I think we have to be very clear on what economic "models" Goldman uses.

If you're talking about GDP growth forecasting, or forecasting unemployment numbers, these are ultimately questions of aggregation. Yes, there are 7.5 billion people, but at the end of the day each individual agent's actions don't make a tremendous difference for an aggregate measure like GDP. During periods of low volatility, as we are currently experiencing, it's really not all that impressive to forecast the unemployment rate +/\- 0.25%, or GDP growth within 0.5%.

If you're taking about their market-making and trading businesses, they've had some horrendous quarters recently as well ([http://www.businessinsider.com/goldman-sachs-just-had-a- hist...](http://www.businessinsider.com/goldman-sachs-just-had-a-historically- bad-quarter-in-trading-2018-1)). A very small portion of Goldman's business is taking an opinionated stance, most of their income comes through relatively low-risk market making activities.

And let's not forget that during the 2008 financial crisis, certain departments within the company correctly wagered against credit default swaps, while others had exposure to subprime mortgages. The company still needed an injection of capital from Warren Buffett and the US Treasury to weather the crisis. Point being, they aren't clairvoyant oracles.

\---

Regarding your last point, which was also made in your original comment, you seem to be claiming some form of what economists call "omitted variable bias", and seem to be hypothesizing that the "omitted variable" is corruption or cheating.

From the purely technical standpoint of building models, the tiny samples ([https://www.theringer.com/soccer/2018/7/11/17557720/world- cu...](https://www.theringer.com/soccer/2018/7/11/17557720/world-cup-lessons- talent-sample-size-france-england-croatia)) and the nature of the "data" being collected means that there are plenty of other explanations, like incorrectly estimated parameters or measurement error.

If you're trying to suggest that there is corruption or cheating in soccer, please point to a concrete example of a team in a critical game receiving a disproportionate number of calls. Unsure if you're aware, but this was the first World Cup with instant video replays for the referees to use. Had this replay been in use more widely in international soccer, the US might've qualified for this World Cup ([https://deadspin.com/u-s-a-out-of-world-cup-on- phantom-goal-...](https://deadspin.com/u-s-a-out-of-world-cup-on-phantom- goal-1819343176)), England might've won/tied that pivotal 2010 World Cup game ([https://en.wikipedia.org/wiki/Ghost_goal#England_v_Germany_a...](https://en.wikipedia.org/wiki/Ghost_goal#England_v_Germany_at_the_2010_World_Cup)), etc.

Soccer may have had a sordid past with the picking of host countries, but the trends in the actual game itself point to technology reducing the ability of referees to make blatantly terrible calls.

<comment><USER3> Thanks for the replies and the detailed sources, it's interesting to read!

> Point being, they aren't clairvoyant oracles.

Yeah, my argument was weak in that regard. They aren't anywhere close to perfect or accurate, I'll admit.

> you seem to be claiming some form of what economists call "omitted variable > bias"

Yes! Is that what it's called?

> please point to a concrete example of a team in a critical game receiving a > disproportionate number of calls

Corruption doesn't have to be that explicit. Maybe key players or coaches are paid to perform poorly? It doesn't always come down to the ref. But I admit I have no examples.

</comment></comment></comment></comment></comment></comment><comment><USER5> Leonid Bershidsky and a lot of other journalists laughing at Goldman Sachs' incorrect predictions seem to miss the point.

The World Cup predictions from Goldman Sachs (and also UBS) are a form of _recreation and entertainment_ with machine learning. It's an expression of quant nerd humor.

Analogous intellectual games would be engineers devising ridiculous Rube Goldberg contraptions[1] or programmers building "enterprise" FizzBuzz[2].

(I think it would add to the fun if GS uploaded their raw data and models to Github for others to play with.)

 _> It certainly didn't predict the final opposing France and Croatia on Sunday._

True, but it did predict France having better chance winning overall but was handicapped by a tougher draw. It also predicted France beating Croatia in round 16 instead of the final. The pdf says:

 _> While Germany is more likely to get to the final, France has a marginally higher overall chance of winning the tournament, _

[1] [https://en.wikipedia.org/wiki/Rube_Goldberg_Machine_Contest#...](https://en.wikipedia.org/wiki/Rube_Goldberg_Machine_Contest#Past_tasks)

[2] [https://github.com/EnterpriseQualityCoding/FizzBuzzEnterpris...](https://github.com/EnterpriseQualityCoding/FizzBuzzEnterpriseEdition)

<comment><USER6> On the other hand, this is a predictive task that has defined outcomes and clear historical data - by my understanding, it is easier than commercial uses of machine learning [at least, easier to measure the effectiveness].

It's also Goldman Sachs and UBS choosing to attach their names to these and stake some reputation on these predictions. If they had hit the bullseye, they would be lauding these results.

<comment><USER7> It may be easier to measure the effectiveness (give a confidence level for the prediction), but just because there is clear historical data and defined outcomes, that does not mean you will be able to predict a particular outcome with any high level of certainty.

For example, imagine a tournament with a large number of participants, where the winner is picked simply by fairly choosing a single random participant.

If I then gave you all the perfect historical data going back decades, you could do statistical analysis and determine that the winner is completely random and therefore the probability of success, for any particular participant, is p~=(1/n), where n is the number of participants. Your confidence in correctly predicting any particular outcome will drop as n rises.

Not everything can be easily predicted just because you have enough data.

</comment></comment></comment><comment><USER8> People conflate statistics with actual results more often than not and I think those reporting on such stories and maybe even the original authors might fall for this.

It was not wrong to say Hillary had a 95% chance of winning the presidential election, but the confidence was low and that value _still allowed for the opposite result to happen_.

Also football has a lot of variance concerning team capability and end results. The better team might (and does) lose often, especially when going to penalty shoots.

With basketball, the stronger team will be easily scoring more in most cases.

<comment><USER9> > had a 95% chance [...] but the confidence was low

So she had 95% chance of winning with 50% probability or what?

<comment><USER10> So this is something that people don't seem to grok quite well, and it really depends on the type of statistical analysis used.

Say you make the assumption that the quantity being estimated is truly fixed: that there's some true value for the force of gravity or some true value for the number of people that vote for X or Y.

The second assumption that comes along is that the stochasticity observed comes from your perspective of observation, and not from the ground truth. To be more blunt, you know that of all the observations you make 95% of them have the probability of yielding the result observed... but the ground truth is still fixed. Gravity has a fixed quantity, despite your experimental error, and you may have been lucky enough to observe it in your sample.

Predicting elections with frequentist methods has this same characteristic, except the observed quantity itself shapeshifts and even lies... so then there are other complications that need to be dealt with.

This is where that 50% feeling comes from. There are two outcomes, one will be true. You're data analysis just tells you that if you repeat your procedure, you'd expect 95% of those result to give you the outcome you observed.

<comment><USER9> If you expect to get it right (in this particular prediction, Clinton to win) with 95% probability, what does it mean to say that this 95% is with low confidence or with high confidence?

<comment><USER11> Not OP, but that opens a whole different can of worms. "Confidence" has a specific meaning in the context of statistical theory, and specifically in a particular flavor of statistics called "frequentism". I won't get into what is involved in frequentism, and how it differentiates itself from the alternative, Bayesianism, but essentially "confidence" refers to a measure that really says more about the statistical methodology used to arrive at the estimated value (in this case, that Hillary had a 95% chance of winning) than the value itself. This makes is a bit esoteric and something that people misinterpret all the time.

Basically, confidence refers to a hypothetical scenario in which a the data gathering process were to be repeated and the same analysis done, X% of the confidence intervals (essentially, the +/\- bounds around your estimate) will contain the true value for what you are trying to estimate.

So in this hypothetical scenario, we say we have the power to go back in time and recollect the polling data in 2016 and run the same analysis used to arrive at that 95% number. And let's say we use this power over and over again, a very large number of times. Then 95% of the error bounds we construct should contain the true value of the probability Hillary wins, whatever that is.

The thing is that those error bounds can be huge. You can have 95% confidence that the probability that Hillary wins is between 3% and 98%, for example. You can also have 10% confidence that the probability of a Hillary win is between 94% and 96%. Without the confidence intervals, a "confidence level" doesn't say much. It's also predicated on the assumption you haven't screwed up your data collection process or analysis methodology. And if you are predicting something will occur with a probability of 95%, and it doesn't, that doesn't automatically mean you are wrong, but the likelihood of you having screwed something up is definitely higher.

<comment><USER9> I agree that this is a different can of (nasty) worms.

The message I replied to said that > It was not wrong to say Hillary had a 95% chance of winning the presidential election,

Frequentist inference cannot be interpreted as a probability unless one goes through some (often misunderstood, as you pointed out) contortions. In your scenario where you have 95% confidence of something it would be wrong to say that Clinton had a 95% chance of winning.

</comment></comment></comment></comment></comment></comment><comment><USER12> The World Cup is about the worst sporting event for data led predictions like this, far too much can rely on a few events that are basically a coin flip. It would be interesting to see how the predictions went for something like the Premiere League tables.

<comment><USER13> > far too much can rely on a few events that are basically a coin flip

Can you give us some examples?

<comment><USER14> As there are relatively few goals, anything that can turn a goal into not a goal or vice versa can have a massive impact on the game. For example the penalty decision against Croatia in the final. Another thing that adds to the randomness is the chance that a key player may be sent off or injured.

<comment><USER15> To make that be specific -- in 44 of 64 games, and in every single penalty shoot-out, turning one goal into not a goal or vice-versa would've changed the outcome.

<comment><USER16> It is not so simple because goals in football are not independent from each other. A team that scores first has the opportunity to play more cautiously and go for more counter attacks.

</comment></comment></comment></comment></comment><comment><USER17> People love to beat up on these companies because of this stupid world cup prediction. Yes, Goldman is a giant vampire squid wrapped around the face of humanity (Matt Taibi quote). But it turns out it's really just great marketing for their research teams.

Also, I've seen some people say (not in this forum) that banks now look stupid because they're in the business of making predictions and they can't even get the world cup right. Guess what? Banks make no money on predictions. They make money on flows and taking spreads on trades they do with clients. Any research or prediction is meant to be a catalyst for that trade.

<comment><USER5> _> Banks make no money on predictions. They make money on flows and taking spreads on trades they do with clients._

You're mostly right but to further clarify, an investment bank like Goldman Sachs has revenue from mostly "market making" spreads but it does also have activities that depend on predictions such as their proprietary trading (before the Volcker Rule shut them down) and their GSAM (Goldman Sachs Asset Management) fund. The GSAM is basically a hedge fund for their wealthy clients' money. They will run predictions on macro trends on data like interest rates, commodities, indexes, etc to help them pick stocks for their portfolio.

As the pdf noted, the World Cup data models and simulations came from Adam Atkins of GSAM.

<comment><USER17> The Volcker Rule shutdown approximately 0 amount of proprietary trading on wall street. Any articles you can point me to were merely media stunts by their respective firms.

The rule was too complex and onerous to be implemtable. Case in point, it's already being rolled back... Certainly because of the current administration we're in. But more because it was just a poorly written and thought out idea to start with.

</comment></comment></comment><comment><USER18> I am somewhat shocked that GS would jump into the prediction business of the World Cup, even as joke. The risk of people getting the wrong idea about the prediction and GS itself is too great, even with a perfectly defensible model.

This is an enterprise for bookies, not Goldman Sachs.

<comment><USER19> FYI - I worked at Goldman Sachs and then a hedge fund for a decade. On the Capital Markets / Trading side, you are _literally_ a bookie. In fact the nomenclature is "you have a book." You are setting trading spreads based on where you think things will go. Depending on the market, your work may be more or less statistical and you're trying to gain a statistical advantage.

<comment><USER20> Off-topic: were you able to retire after that decade?

<comment> lloyd-christmas Not OP, but I worked in finance as an trader for more than half a decade. I make more per hour once I switched to software development in NYC.

I think people have a strange view of finance. Most people aren't paid obscene amounts of money in finance, just like most software developers don't make the salary of a senior developer at Big Tech. They also work an obscene amount of hours. During earnings season, I would be at my desk by 5am and work 80+ hours per week. Nowadays, It's a rarity to go more than 50. My brother currently works at Big Bank, and makes more than I do on an absolute basis, but I definitely make more than he does hourly. I get to work at 9:30-10, he gets to work at 7:30-8. I get home at 6:30-7:00, he gets home 8:30-9. He works at least a half day every Sunday, I enjoy my hobbies. I'm also commenting on HN at 11:00...

Most of my college friends still work in finance. I make more money than a few of them based on overly honest drunken conversations, and we're all more than 10 years into our careers. There is a glass ceiling in tech that is a lot more all-encompassing, but it's not like it doesn't exist in other industries. There are only so many higher-up positions, and most people burn out (or aren't capable of competing) before they even get in position for that promotion. The running joke when someone was getting poor performance reviews was "That's it, I'm moving to Vermont to open an antique store".

For some more comparison, I grew up in a 1%er town in the suburbs of NY. The average lawyer family lived in nicer houses than the average finance family, who in turn lived in nicer houses than the average medicine family. However, the most expensive house was owned by the CFO of Big Bank. Income is very right-skewed in finance.

</comment></comment></comment></comment><comment><USER21> The "Ludic Fallacy" strikes again [0].

> The ludic fallacy, identified by Nassim Nicholas Taleb in his 2007 book The > Black Swan, is "the misuse of games to model real-life situations."

...

> The alleged fallacy is a central argument in the book and a rebuttal of the > predictive mathematical models used to predict the future – as well as an > attack on the idea of applying naïve and simplified statistical models in > complex domains. According to Taleb, statistics is applicable only in some > domains, for instance casinos in which the odds are visible and defined.

Both Taleb's books, "The Black Swan" and "Fooled by Randomness" are an interesting take for such models. Meanwhile, most economists know about "Knightian Uncertainty" [1] which talks about differentiation of risk and uncertainty.

> "Uncertainty must be taken in a sense radically distinct from the familiar > notion of Risk, from which it has never been properly separated.... The > essential fact is that 'risk' means in some cases a quantity susceptible of > measurement, while at other times it is something distinctly not of this > character; and there are far-reaching and crucial differences in the > bearings of the phenomena depending on which of the two is really present > and operating.... It will appear that a measurable uncertainty, or 'risk' > proper, as we shall use the term, is so far different from an unmeasurable > one that it is not in effect an uncertainty at all."

[0] [https://en.wikipedia.org/wiki/Ludic_fallacy](https://en.wikipedia.org/wiki/Ludic_fallacy)

[1] [https://en.wikipedia.org/wiki/Knightian_uncertainty](https://en.wikipedia.org/wiki/Knightian_uncertainty)

<comment><USER13> Damn, do I disliked Nassim Taleb. I don't think I've ever heard him say anything deep. That wikipedia article is an excellent.

In [0] you have the following:

> The ludic fallacy, identified by Nassim Nicholas Taleb in his 2007 book The > Black Swan, is "the misuse of games to model real-life situations."

And he gives an example of this:

> One example given in the book is the following thought experiment. Two > people are involved:

> Dr. John who is regarded as a man of science and logical thinking

> Fat Tony who is regarded as a man who lives by his wits

> A third party asks them to "assume that a coin is fair, i.e., has an equal > probability of coming up heads or tails when flipped. I flip it ninety-nine > times and get heads each time. What are the odds of my getting tails on my > next throw?"

> Dr. John says that the odds are not affected by the previous outcomes so the > odds must still be 50:50.

> Fat Tony says that the odds of the coin coming up heads 99 times in a row > are so low that the initial assumption that the coin had a 50:50 chance of > coming up heads is most likely incorrect. "The coin gotta be loaded. It > can't be a fair game."

> The ludic fallacy here is to assume that in real life the rules from the > purely hypothetical model (where Dr. John is correct) apply. Would a > reasonable person bet on black on a roulette table that has come up red 99 > times in a row (especially as the reward for a correct guess is so low when > compared with the probable odds that the game is fixed)?

So Nassim Taleb wanted to discuss "using games to model real-life situations" and to demonstrate the pitfalls he uses two characters. He _portrays_ the characters as "man of logical thinking" vs "man who lives by his wits", but as we'll see he's missing one dimension to his characterization.

The first problem here is that implicitely he's suggesting to the reader that the decisions of the "man of logical thinking" represent the pitfalls of "applying games to model real-life situations", whereas the the other guy's decision represent.... it's not specified, but clearly has a better outcome.

The second problem, is that he conflates "applying something you read on some textbook to real life without thinking" with "modelling real-life". He suggests to the reader that those two people are actually "logical" vs "instinct", but they're not. They're a dumb guy who knows maths vs a smart guy who doesn't know math. _Obviously_ real-life is more complex than your textbook examples, and so the smart guy is going to win because his fuzzy heuristics beat the first guys decisions which are optimal within his flawed model. An actual smart and logical person would update his model based on new evidence (i.e. "I was told that this coin was 50-50 but actually the chance of what I just saw is so small that it's more likely that I was just lied to") and then use maths to make predictions and beat the guy who's smart but doesn't know math.

So ironically, he wants to portray the dangers of using over-simplified models and to do that he uses an example where he obscured one dimension.

Nassim Taleb is really good a rhetoric but light on substance.

[0] [https://en.wikipedia.org/wiki/Ludic_fallacy](https://en.wikipedia.org/wiki/Ludic_fallacy)

<comment><USER22> Nassim Taleb is basically a stopped clock. He's pretty big on pointing on how we're all prone to find illusory correlations (not his discovery) and he's a great promoter for Kahneman and Tversky, but there are other areas where he clearly is out of his depth. It's beyond obvious, for instance, that he's never gotten past Popper in his studies of philosophy of science. Unfortunately, his disciples are (ironically) quite terrible at thinking for themselves and buy into his demagoguery.

Basically a book by Nassim Taleb is an incoherent summary of the books that Nassim Taleb has read within the past year, with a few morsels of recycled insight here and there.

</comment></comment></comment><comment><USER23> If anything, this is a clear illustration of poor use of probabilistic prediction. When used for investments you have many outcomes. If the model is any good, you will most of them right. In the World Cup you have very few. Even if you count all games played. Definitely not excusing Goldman Sachs here, they should have known better than to try to predict this. There was only a tiny chance this could be great advertisement for their model.

<comment><USER24> > they should have known better than to try to predict this.

There's no downside, only free publicity. If they, by good fortune and a following wind, get it right - then the publicity is incredible. If it's wrong they laugh and say "well, better stick to predicting what we're good at!" and they _still get a shitload of headlines and awareness of their product_.

This was not a mistake.

<comment><USER25> Well, there's the downside of articles like this pointing out they've had 4 years to work on their models and they've got worse

</comment></comment></comment><comment><USER26> PS: If you want to build or train your own model or make predications, you can find open (structured) data about all world cups at the football.db, see [https://github.com/openfootball/world- cup](https://github.com/openfootball/world-cup) and [https://github.com/openfootball/world- cup.json](https://github.com/openfootball/world-cup.json) Enjoy the beautiful game.

</comment><comment><USER9> The predictions were not _so_ bad. At least one of the favourites won in the end. GS had France winning with 11.3% probability, second to Brazil with 18.5%. UBS was less fortunate, they had Germany (24%), Brazil (19.8%), Spain (16.1%) and England (8.5%) before France (7.3%).

I compared the logloss for their predictions with the "uniform" benchmark (giving each team 1/32 probability of winning, 1/16 probability of getting to the finals, etc) and the results are the following (if I transcribed the data properly):

Getting to second round:

GS: 0.495 UBS: 0.495 bench: 0.693

Getting to quarter-finals:

GS: 0.463 UBS: 0.459 bench: 0.562

Getting to semi-finals:

GS: 0.310 UBS: 0.327 bench: 0.377

Getting to final:

GS: 0.231 UBS: 0.269 bench: 0.234

World-cap winner:

GS: 0.097 UBS: 0.113 bench: 0.139

The performance of the models was ok until Croatia got to the finals. This hurt specially UBS, who predicted less than 0.9% probability of such an event (compared to 2.1% in Goldman's model).

Edit: these would have been the "best case" scores (if the high-probabilty teams had classified to each round, ignoring that this may be impossible due to the structure of the tournament):

GS: 0.432 0.302 0.220 0.141 0.079

UBS: 0.365 0.251 0.176 0.111 0.070

UBS could potentially achive lower logloss metrics because it had more extreme predictions.

</comment><comment><USER27> Isn't this a little like flipping a coin four times - getting heads four times in a row, and looking at your friend and saying "but you told me the odds were 50/50 each flip?!"

<comment><USER11> Yes, it is.

</comment></comment><comment><USER28> This article didn't compare the Goldman Sachs model to any other models-- why not compare it with sports betting odds? Would Goldman have made or lost money betting their model was better than the crowd?

<comment><USER29> Or compare it with the fivethirtyeight blog predictions.

</comment></comment><comment><USER30> >Soccer, with the many factors that affect game outcomes — players' injuries and intra-team conflicts, the refereeing, the weather, coaches' errors and moments of inspiration — remains only a tightly-regulated game involving a _few dozen people_. The behavior and performance of big corporations, _entire industries and nations_ is arguably even more difficult to model based on data about the past.

Author misses the way models work entirely, the larger the entity, the more statistics and averages kick in, and as a result, better model can be built.

<comment><USER31> Depends on the complexity of the interactions between variables. There are plenty of examples where we have excellent local models, but make (comparatively) worse prediction at scale. A pretty classic example is biology - we have excellent knowledge about how genotypes work and their interactions in cells, but models of phenotypes are typically expensive, error-prone, or non-existent.

</comment></comment><comment><USER32> I watched quite a few matches and among the things I saw in the matches but not in any statistics are:

\- motivation (Germany and Croatia were the two extremes here, no idea how to measure it)

\- team cohesion (number of articles in a few journals questioning the team cohesion, maybe also articles about individual players)

\- creativity in offense (maybe measurable via "target missed from close distance" \+ "ball passed front of the goal")

\- number of errors in defense that didn't lead to a goal

\- percentage of times ball possession was lost from own goal to enemy's area (England was really bad here against Croatia)

<comment><USER33> These kinda show what makes predicting football particularly difficult. I like the ideas, and I think we (or more likely some ML algorithm) can come up with the set of conditions that showed why France prevailed against the specific opposition at this specific World Cup ... but I suspect that the conditions would be pretty unique and invalid for Euro 2020, WC 2022 etc.

As you identified, motivation could be pretty hard to measure ... but even if we could it might be a pretty poor predictor anyway. France in the early stages didn't look very motivated, while England and Colombia looked pretty lively.

Team cohesion - the German team were pretty consistent (not dazzling, but consistent) and we know how that ended. Again France didn't really impress until the latter stages of the WC.

Creativity in offense - I guess it can indicate a sort of calm or confidence in front of goal but actually it can actually be seen as pretty negative. For example Arsenal a few years back came under fire for having plenty of possession in the 18 yard box but failing to convert. Spain's confident quick pass-and-move "tiki-taka" was ever-present and has in my eyes been impotent in the last few years (and more important as a neutral viewer - very frustrating to watch).

Defensive errors that didn't lead to a goal could be a nice indicator of the ability of a defence to pick up after each others mistakes - but at the same time these errors that lead to goals (i.e. Croatia's second goal in the final) are relatively rare and a lack of a goal could just point to the opposing team's inability to convert due to a poorly organised or a lack of opportunism from their strikers.

I'm not sure what you mean with the last one, but I think this could be a nice one - if you mean "times you lost possession in your own half". A profligate midfield and defence is bound to ship goals, I doubt there are many teams that can either fight back after trailing by a goal or two or score enough to maintain a reasonable buffer.

I applaud the effort though - it takes more creativity and care to think of some new angles (like you did) than to think of some possible counter examples (like I did)!

<comment><USER32> Thank you for the warm words, I guess the reason is my occupation plus the fact that I just spend my last few weeks watching many games with family and friends.

> I'm not sure what you mean with the last one, but I think this could be a > nice one - if you mean "times you lost possession in your own half"

Almost, England lost the ball frequently (> 50+x% with a large x AFAI could see) due to the keeper sending out long balls. I'd like to measure that somehow. Could be done via number of seconds in possession after a goal kick, an indicator whether a hypothetical 85% marker of the field was reached or measuring whether the ball was at least 5x successfully passed (or resulted in a goal).

<comment><USER33> Ahhhh I see. Actually this is something I've really been curious about myself - whether the better strategy overall for a keeper returning the ball into open play (from goal kick or from hand) is to just boot it as far up-field as possible or passing it short to one of the defence or midfielders sitting deep.

Interestingly something like this is a tactic used in Rugby ([https://www.youtube.com/watch?v=cbti6mLvSJs](https://www.youtube.com/watch?v=cbti6mLvSJs)). I used to play a lot of football when I was younger and at our level (waaaay down the scottish league pyramid) against tired, hungover or generally weak opposition, keeping them under pressure by dominating the territorial game but sacrificing possession was criminally underrated. Usually if you could keep hammering them for 60 minutes and had the legs to step up a gear in the last 30 or so you could grab a valuable goal or two :-)

</comment></comment></comment></comment><comment><USER34> _Thanks to the use of more granular data, made possible by AI, this year's model should have worked better than the 2014 one.

If anything, it worked worse._

"If anything"? All the results are available, so it would be easy to put a precise number on this. Measure the Bayesian regret, or just report the winnings if you had used the GS model to bet on the outcomes. Unless it reports some concrete numbers, this article is garbage.

It doesn't report any concrete numbers.

</comment><comment><USER35> Soccer is a sport with a big random component. This is probably why it is so exciting. An average team can beat a better team.

The reason is easy to see. The game can be decided by one, two or three key plays. Compare that to basket ball. To win a game you have to consistently score more and defend better. Rarely the game is decided by one or two plays. That only happens when the game is already very tight.

</comment><comment><USER36> I put money on Belgium (12.0 decimal odds) and Croatia (15.0) after the group stages, where some form was visible, combined with knowledge that they had some of the world's best players.

The odds shortened as the tournament progressed, I was able to hedge as the shortened odds made lay betting profitable.

(High variance in football outcomes means there's no guarantee of profit, I don't bet big sums.)

<comment><USER37> This answer is very useful and contains proper strategy advice :)

If someone were to bet during the round of 16, if someone were to bet $1 on the bottom 8 and $2 on the top 8, the strategy would most likely yield a small profit or a small loss, rather than a total loss.

</comment></comment><comment><USER38> It's a fools errand to predict high variance events like football games.

<comment><USER39> Only predict events that are easy to predict, never fail!

</comment></comment><comment><USER40> Financial modeling is about risk adjust return. Because GS knows they can not determine with certainty the outcome of a given investment, they diversify and hedge. Most of all, GS is a market maker, the equivalent of a bookie. To say that GS's models "didn't come close" is to ignore all the ways in which such a grading scheme is different than GS's actual business model. If their WC prediction efforts acted as anything more than a fun spirited PR project, it was likely that GS wanted to somehow keep its employees engaged and adding business value during the WC which they otherwise would have been certainly watched all month.

</comment><comment><USER41> In addition to the many other problems with this article, I would like to point out that if, somehow, Goldman Sachs had managed to create a model that could accurately predict the results, the game of soccer would have to be changed to make it more unpredictable somehow. It is intrinsic to the nature of sport that, in order to be entertaining, there has to be a realistic chance for more than one team to win. Not many people (even from the winning country) would bother watching if it were accurately predictable.

</comment><comment><USER42> Good... There was this discussion thread few days back on HN

[https://news.ycombinator.com/item?id=17509407](https://news.ycombinator.com/item?id=17509407)

Did this investment bank use same set of algorithms that they use for financial predictions?

...And then I remember there was this Octopus[1] who used to predict winners with 85% accuracy

[1][https://en.wikipedia.org/wiki/Paul_the_Octopus](https://en.wikipedia.org/wiki/Paul_the_Octopus)

</comment><comment><USER43> You'd have to run this world cup thousands of times by simulation, running it a single time and determining the results are not in line with the model is meaningless and silly.

It's as silly as saying my claim for the odds of nearly perfectly modelling a coin toss (approximately 50/50%) is wrong because a series of 10 coin tosses show different results from my model. The model is not any less correct.

</comment><comment><USER44> It's as good time as any to plug in EA's simulation results: [https://www.easports.com/fifa/news/2018/ea-sports- predicts-w...](https://www.easports.com/fifa/news/2018/ea-sports-predicts- world-cup-fifa-18)

</comment><comment><USER45> Duh. Looks like there's a fundamental misunderstanding of how statistics works all around. The probability of an event does NOT predict a particular outcome. Ever. It only says that if the experiment is performed again and again and again, like a few thousand times, then X% of those will match that probability.

If I toss a fair coin you cannot predict the next outcome. You can only say that if I toss the coin a 1000 times, then close to 500 are going to turn up heads, and another 500 are going to turn up tails.

It was stupid of Goldman Sachs or whoever to predict an outcome. It was stupid of anyone else to lend credence to that prediction.

Hopefully, Goldman Sachs is not relying on prediction of singular outcomes to make their investment decisions. I don't think they are. Probably just marketing brouhaha to ride the soccer wave. Although I'm not sure if that worked as expected.

<comment><USER46> > It was stupid of Goldman Sachs or whoever to predict an outcome.

If you read the actual report they did[0], they never claimed that any single outcome was more than 18.5% likely.

[0]: [http://www.goldmansachs.com/our-thinking/pages/world- cup-201...](http://www.goldmansachs.com/our-thinking/pages/world- cup-2018/multimedia/report.pdf)

</comment></comment><comment><USER47> They don't have an edge like they do in their bread and butter markets, combined with a small sample set == high probability of a single year of sports predictions falling over like this

</comment><comment><USER48> If GS would need to bet money - their actual business model would likely be to sell a bit of each higher probability losers (less risk) vs. buy big on a projected winners (higher risk).

</comment><comment><USER49> This site is a good counter-example for website optimization: While it uses many assets, so a CDN domain makes sense, it spreads them out thinly. It loads over 100 CSS files, most of which are below 1K. Similarly it loads approximately 30 JS scripts, most of which are just a few K each. This is mitigated to a large extent by using HTTP/2.0, which permits a few dozen or so parallel requests, but it still means that a repeated load of the page takes 2-3 seconds. (Without HTTP/2.0 this probably takes ages, since browsers open only a few connections to each origin at most). There is also almost no difference between reloading with and without the cache.

</comment><comment><USER50> In the world of models increasing precision for not necessarily increase accuracy.

</comment><comment><USER46> In case anyone was interested here is a table of how likely the model thought each team was to make it through any particular stage[0] along with the stage that that team went out in and the probability that the model gave for that particular outcome (i.e. [probability of making it through the final stage they made it through] - [probability of making it through the stage they went out in]).

                    Groups  Round_16  Quarters  Semis  Finals    Out_In  Probability
            Brazil   87.5%     60.8%     42.0%  27.9%   18.5%  Quarters        18.8%
            France   81.4%     58.4%     36.6%  19.9%   11.3%       Won        11.3%
           Germany   80.5%     49.5%     30.5%  18.8%   10.7%    Groups        19.5%
          Portugal   75.2%     52.8%     32.2%  17.3%    9.4%  Round_16        22.4%
           Belgium   78.5%     51.1%     27.7%  15.8%    8.2%     Semis        11.9%
             Spain   72.3%     50.1%     28.8%  15.4%    7.8%  Round_16        22.2%
           England   73.1%     46.6%     24.4%  13.4%    6.5%     Semis        11.0%
         Argentina   79.7%     44.2%     24.1%  11.8%    5.7%  Round_16        35.5%
          Colombia   74.9%     37.3%     17.0%   8.5%    3.7%  Round_16        37.6%
           Uruguay   74.4%     34.6%     17.2%   7.2%    3.2%  Quarters        17.4%
            Poland   68.5%     30.5%     12.8%   5.8%    2.3%    Groups        31.5%
           Denmark   47.8%     26.3%     12.4%   5.2%    2.0%  Round_16        21.5%
            Mexico   52.0%     23.2%     10.5%   4.9%    1.9%  Round_16        28.8%
            Sweden   45.9%     19.4%      8.3%   3.7%    1.3%  Quarters        11.1%
              Iran   35.4%     18.1%      7.2%   2.6%    0.8%    Groups        64.6%
              Peru   37.3%     17.2%      6.8%   2.5%    0.8%    Groups        62.7%
         Australia   33.5%     15.4%      6.3%   2.3%    0.7%    Groups        66.5%
            Russia   47.9%     16.3%      6.0%   2.0%    0.7%  Quarters        10.3%
           Croatia   49.8%     16.9%      6.3%   2.1%    0.6%    Finals         4.2%
       Switzerland   52.8%     15.9%      6.1%   2.0%    0.6%  Round_16        36.9%
           Iceland   45.2%     15.1%      5.6%   1.8%    0.5%    Groups        54.8%
        Costa_Rica   36.8%     13.3%      4.7%   1.6%    0.5%    Groups        63.2%
            Serbia   32.9%     12.1%      4.5%   1.5%    0.5%    Groups        67.1%
             Japan   36.5%     12.8%      3.8%   1.3%    0.4%  Round_16        23.7%
      Saudi_Arabia   43.4%     12.7%      4.2%   1.3%    0.4%    Groups        56.6%
           Tunisia   35.2%     13.3%      4.1%   1.3%    0.4%    Groups        64.8%
             Egypt   34.4%      8.7%      2.5%   0.7%    0.2%    Groups        65.6%
       South_Korea   21.6%      5.9%      7.1%   0.5%    0.2%    Groups        78.4%
           Morocco   17.1%      6.8%      1.8%   0.5%    0.1%    Groups        82.9%
           Nigeria   25.2%      6.5%      1.7%   0.4%    0.0%    Groups        74.8%
           Senegal   20.1%      4.9%      1.2%   0.3%    0.0%    Groups        79.9%
            Panama   13.2%      3.3%      0.5%   0.1%    0.0%    Groups        86.8%

[0]: Exhibit 2 in [http://www.goldmansachs.com/our-thinking/pages/world- cup-201...](http://www.goldmansachs.com/our-thinking/pages/world- cup-2018/multimedia/report.pdf)

Edit: Fix copy-paste errors and atrocious maths.

<comment><USER51> Japan went out in Round_16

Croatia went out in Finals

And I do not understand what the last column means (except for France and teams out in group phase)

<comment><USER46> Urgh, I hate that you can't edit HN comments.

First two were just me making a mistake because I write that in manually.

That last column makes no sense. It was supposed to be the probability that the model gave to the outcome that occurred, but I got the maths wrong.

<comment><USER52> There's an edit window of a couple hours, which has probably just past. We've opened it up again so you can go ahead and edit.

<comment><USER46> Brilliant, thank you very much. Although it might be a tad late now.

</comment></comment></comment></comment></comment><comment><USER53> GarbageIn = ML = GarbageOut

</comment><comment><USER53> I worked in GS; Soccer/football prediction is not their forte

</comment><comment><USER54> While I agree that it's somewhat silly to try and predict a word cup winner like this (and I suspect it was just a bit of fun anyway), there is one other reason that could explain why all these attempts got it so wrong.

Cheating.

Before people start booing, let's not forget where this tournament is being held, and all the other nefarious things that country has been up to recently.

<comment><USER55> FIFA has been corrupt for decades. Although supposedly its been cleaned up since Blatter was removed, it is doubtful the institutional corruption has been eliminated completely. The only question is how pervasive it is.</comment></comment>


Facebook Ads Are All-Knowing, Unblockable, and in Everyone's Phone - <AUTHOR> http://www.bloomberg.com/news/articles/2015-09-28/facebook-ads-are-all-knowing-unblockable-and-in-everyone-s-phone <comment><USER2> All that talent at Facebook, and they use it to come up with creepier and more invasive ways of ad targeting. I could not help laughing at the quote about it being for "the greater good". Hot Fuzz flashbacks ahoy.

<comment><USER3> The same can be said about Google, no?

<comment><USER4> We also make self-driving cars, to keep our conscious clean.

<comment><USER5> It's nice to know that some Google employees are resistant to cognitive dissonance.

I remember reading somewhere that there is a (underground?) group within Google dissatisfied with the dominance of advertising at the company, both in business and product decisions.

<comment><USER4> Advertising is a brilliant business to be in for Google, and the main cash cow. Nothing wrong with success. The ads are paying my salary indirectly.

(If all ads were like Google ads, I wouldn't have bothered installing an ad- blocker in the first place.)

> I remember reading somewhere that there is a (underground?) group within > Google dissatisfied with the dominance of advertising at the company, both > in business and product decisions.

We have very vocal employees. You can find people complaining about everything. (Including the lack of M&Ms in some micro kitchens.) I am sure there are also people dissatisfied with ads.

If you want to hear me complain, ask me about the choice of programming languages we are using. Or about open plan offices.

Still the best run company I've worked for.

</comment></comment></comment></comment></comment><comment><USER6> What people don't seem to have considered is whether or not unblockable ads in FB's app would be enough to make users who install ad blocking abandon FB. There's a tacit assumption that FB is more important to users than blocking ads, but until that's been tested I think we ought to remain skeptical whether such an assumption is correct.

I think it's reasonable to think that someone who pays money not to see ads would be willing to leave FB if their app fails to respect that wish, and FB might well _allow_ blocking to avoid any sort of cascading network effect a core group of users leaving might have.

<comment><USER7> Should restaurants respect the wishes of people who want to eat without paying? If they kick them out they might leave a bad Yelp review.

<comment><USER8> You don't get unilateral power to trade free services for arbitrary obligations. If you have a restaurant where you've decided to list all your menu items at zero cost, that doesn't automatically grant you the power to kick people out because they refuse to eat off the floor.

Your customers must first explicitly agree to such a thing before you should be able to enforce it. You don't get to make all the decisions for both parties. That's obviously exploitative.

<comment><USER9> > If you have a restaurant where you've decided to list all your menu items at > zero cost, that doesn't automatically grant you the power to kick people out > because they refuse to eat off the floor.

Why not? Kicking someone out of your restaurant is exactly what you should do if you can't come to an agreement.

<comment><USER8> There _is_ no agreement. That's my point. People serving websites with advertising are doing so under a bargain that users have never actually agreed to: that they are exchanging free content for advertising views. But the website makes an agreement with advertisers, not with the public.

So in our restaurant analogy, it would be like if you had an agreement with your _food supplier_ that they will provide you with cheap food if you make customers eat it off the floor, and now you're complaining that customers are not fulfilling their end of this deal. The customers don't have a deal with you. You just offer them free food, and they are taking it and trying not to eat off the floor. It's not their fault you offer free food. Don't do that.

<comment><USER9> The agreement with the food supplier is irrelevant.

If a customer walks into your free-food restaurant and finds the conditions unsuitable to them, they should leave. If they refuse, you should kick them out.

<comment><USER8> Then do it. Kick everyone off your website if they use ad blockers.

<comment><USER9> You just said I (the restaurant owner) don't have the power to!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> No idea about how things are on iOS, but on Android there is Xposed with MinMinGuard that does the job of removing in-app ads really well. Not absolutely perfect (some apps may crash in rare cases, but they're really rare), but at least on par with in-browser ad blocking. Or, given than there aren't too many ad libraries (way less than web-based ad networks), maybe even better.

<comment><USER11> There's also AdAway for more "traditional" system-wide ad blocking via hosts file or applications like "Tinfoil Hat" which opens the mobile Facebook site in a sandboxed wrapper so you are essentially able to view the site without using their dedicated app or needing to open an incognito tab in Chrome or Firefox before visiting the mobile site.

Ads and tracking aside, it's worth it even if just for the lowered system resource usage (my battery life improved by a decent margin even though I still check out Facebook every 1-3 days on my phone).

</comment></comment><comment><USER12> What a spammy title. The ads are only "in your phone" if you use a Facebook app.

Breaking news! Ad-powered app shows ads in its app!

Does anyone know whether Facebook also tracks you into and out of WhatsApp, by the way?

<comment><USER13> > Does anyone know whether Facebook also tracks you into and out of WhatsApp, > by the way?

It most certainly does. I have contacts in WhatsApp that I have no other contact with (nor do they with me, dont know my name etc.), yet after the first time I chat with them on WhatsApp, they are in my recommended friends on facebook. Pretty infuriating.

<comment><USER10> Does both WhatsApp and Facebook use (and were actually allowed to use) phone's built-in contact/address book subsystem?

Honest question, I don't use either app, so no idea. Just thought this could be a possible that WA had created a contact in the system-wide address book and FB saw it.

<comment><USER13> I have other people in my phone contacts that Ive never communicated with on facebook and I have never been suggested to be friends with them. So Im doubtful.

</comment></comment></comment></comment><comment><USER14> I have as few phone apps as possible. Undesired ads and asking for waaaaaay too much access to my phones data and features, no thanks I'll just use my browser and view your page. I'm sure many in the HN crowd practice similar behaviors however for the majority of people I'd assume this article holds more weight.

</comment><comment><USER15> Just browse FB in safari with an ad blocker ?

</comment><comment><USER16> Isn't it an exaggeration to say the ads are unblockable even on apps on phones? The apps generally do have more control on what's shown and what's not. To start, couldn't the ads be filtered and masked from one's router or on a (home) proxy server that one uses? The apps could be written such that they detect if an ad is being replaced with empty content, but I don't think the apps are there yet.

On this topic, what are the latest alternatives available for routers/proxy servers that are as good as uBlock Origin (or ABE) on the desktop (sharing the same popular block lists)?

</comment><comment><USER17> Wrong.

No FB app, adaway + ublock + pale moon.

<comment><USER18> I use Fb but the Fb app is a disgrace, and not only because of privacy reasons

It usually shows me what's happening last week instead of the latest posts

<comment><USER19> _the Fb app is a disgrace, and not only because of privacy reasons_

Having it installed also kills your battery life. Probably a knock-on effect from the privacy invasion (but at least I have a reason not to use facebook that doesn't weird out normies).

</comment></comment></comment><comment><USER20> Um, not if you don't use Facebook?

</comment><comment><USER21> FB continues to promote the self-serving fallacy that users really, really want ads.

According to FB, users just desparately want those ads to be highly targeted and relevant. And, that's awesome, because it just happens to correspond exactly with what advertisers want.

Most amazing is that advertisers continue to believe it. Testament to the power of desparation and wishful thinking.

<comment><USER22> No one really wants ads, but people do want facebook for free.

<comment><USER23> In other words, they only want facebook because it's free?

<comment><USER24> If Facebook charged money to the end user it would be immediately abandoned. It's weird that such a large service has such a low value to users. Most other huge free services could charge end users and get away with it but FBs value is tied to the fact that it's free and accessible by anyone.

</comment></comment></comment></comment><comment><USER25> They're not in my phone, I don't use facebook on it.

</comment><comment><USER26> Not for people that refuse to use it.</comment>


The Linux Foundation Has Helped VMware Lie About Its Deliberate GPL Violations - <AUTHOR> http://techrights.org/2020/04/28/openwashing-vmware-after-gpl-abuses/ <comment><USER2> _Disclosure: I work for Red Hat, who is a competitor of VMware, but I felt this way long before I went to Red Hat_

I find this extremely troubling. While I am not a GPL purist (I think there is definitely a place for the GPL, but I don't think everything should be GPL[1]), I do think it is critical that the GPL have teeth. If violating the GPL is not a big deal, then there isn't a way I can think of to release free software with assurance that it won't be used to violate others' freedom.

I detest lawsuits, but the GPL must be defended.

[1]: [https://www.gnu.org/licenses/license- recommendations.html](https://www.gnu.org/licenses/license- recommendations.html)</comment>


Show HN: HN Status Page in the style of HN with detailed metrics - <AUTHOR> https://hn.hund.io/ <comment><USER2> I guess I'm used to nearly a megabyte of javascript coming over the network, but...

Four embedded fonts? Just to get the character ⓘ and a checkmark, both of which are just regular unicode characters that these font files mis-encode?

Does anyone even look at anything any more?

<comment><AUTHOR> Most of the fonts loaded are variations of Open Sans, which are used throughout the pages. We'll look into improving the degradation when the icon font loads; it's just the Octicon font set. Thanks for pointing this out.

<comment><USER3> Instead of using Octicon, you could use the Unicode characters for circle-i U+24D8, checkmark U+2713, and calendar U+1F4C5.

</comment></comment></comment><comment><USER4> Hi Corben - I like the marketing angle! Just some feedback from a potential customer. I wouldn't use hund.io today because of this: "Our self-healing infrastructure is distributed across multiple AWS regions and availability zones. We run critical services in in."

I want my monitoring service and status page to have 0% overlap with my infrastructure because we all know that cloud providers sometimes have global downtime. It would be awesome if you could let users decide which cloud platform their service was hosted on: Azure, GCP, AWS, DO, etc.

Besides that the product looks great! And there is definitely a need for a combined monitoring / status page service!

On a side note, can you talk a bit about how you've approached the design theming/customization feature?

<comment><AUTHOR> Thanks! We understand that it's important for monitoring and status page's to be distributed, and separate from your infrastructure. That said, our application is designed to be highly-available at all levels. With our enterprise plan, we are capable of hosting on different infrastructure.

The design customization allows uploading brand images, and gives full CSS customization as well as custom HTML. More about the customization can be found in our knowledge base here: [https://hund.io/help/documentation/customization](https://hund.io/help/documentation/customization). We also plan on providing support for "page fixtures" to allow rearranging and changing how the information on the page is presented. You can see a little more on them in our roadmap here: [https://trello.com/c/HeHVXFkQ/84-page- fixtures](https://trello.com/c/HeHVXFkQ/84-page-fixtures)

</comment></comment><comment><USER5> How about a Status/Issues page in the style of the Hacker News or Reddit homepage?

Each link is an issue you should fix with your site, or a TODO item you could finish, or a bug report, or a chart of some site data. Automatically generated and refreshed to keep the addictive fresh content factor high. Comments from your coworkers. Trick you into doing work rather than surfing HN.

</comment><comment><USER6> Wow, this looks great!

What kind of event will trigger something showing up in the "Recent History" section?

<comment><AUTHOR> Thanks! The recent history is populated by automated status changes (i.e. outages and degradations) and manually created issues. Status changes are automated via watchdogs, which support a variety of integrations, including our own built-in monitoring solution that provides both the statuses and metrics you see here. For an example, take a look at [https://status.sherlock.stanford.edu](https://status.sherlock.stanford.edu).

</comment></comment><comment><USER7> It appears that a lot of the links aren't real links. I tried to open them in a new tab and it also navigated the current tab.

</comment><comment><USER8> Pretty nice but the scaling for the "Website TCP Connection Time" graph seems off: average time seem to be in the mSec range but scale max is 100 so you just see a nearly flat line at 0.

</comment><comment><USER9> What are you using to generate those svg graphs ?

<comment><AUTHOR> A very modified dimple.js: [http://dimplejs.org/](http://dimplejs.org/) We plan on making our own library with improved rendering speeds and extended functionality.

</comment></comment><comment><USER10> Looks cool, sadly they charge $70 for password protection, else I would consider it.

<comment><USER11> I think you commented on the wrong post?

<comment><USER12> Not according to the pricing page?

[https://hund.io/pricing#calculator](https://hund.io/pricing#calculator)

</comment></comment></comment><comment><USER13> doesn't load, not a really great status page then</comment>


How Mountaineering is like Mathematics - <AUTHOR> https://www.youtube.com/watch?v=0bv6VovSmQ4 <comment><AUTHOR> One of the talks given at this year's "MathsJam" annual gathering.

I'd be interested to know if any HN readers were there ...</comment>


PAM Vulnerability in Ubuntu allowing root access - <AUTHOR> https://lists.ubuntu.com/archives/ubuntu-security-announce/2010-July/001117.html

<comment><USER2> It looks like a user could reset an environment variable, resulting in convincing the PAM module ( running as root ) to write a file somewhere the user should not be able to write. I assume since this could allow root access, it can overwrite something that can be executed as root by another process.

<comment><USER3> Actually, from the looks of the tweet linked above, it seems to allow a user to chown an arbitrary system file so that it is owned by him, in that case the shadow file. Having access to the shadow file would allow the user to trivially reset the password for every account on the machine, including root. With that access, a user could then do just about anything to the box, and then reset the password/shadow file back to its old value/permissions so that sysadmins would be none the wiser.

<comment><USER2> Neat. Similar idea but definitely different.

</comment></comment></comment><comment><USER4> Anyone care to describe _how_ this can be used to gain root? I'm running Lucid...it'd be interesting to try the hack on myself before updating...

<comment><AUTHOR> Just one tweet will do it ;-)

<https://twitter.com/jonoberheide/status/18009527979>

<comment><USER5> Works for me on Mint (a Ubuntu derivative). I'm glad I use Slackware on my production machines (no PAM).

</comment></comment></comment><comment><USER6> Thank you for posting this... I often ignore doing updates because they're just not as interesting as other things I'm doing. This kicked my butt into gear to install the updates.

<comment><USER7> This is important if you're running a website too - this exploit can be used to take over the machine if the hacker finds a way to execute code as the website (i.e. once they used a different exploit to break in, they would be able to escalate from www-data user to root).

</comment></comment><comment><USER8> I am on Ubuntu 10.04, what do I need to do besides updates and "proper" use to remain safe? I don't have an antivirus or anything of that sort!

<comment><USER3> Assuming you're still using the default package mirrors, updating is sufficient.

</comment></comment><comment><USER9> Is this bug restricted to ubuntu or does it affect debian/rhel etc?

<comment><USER10> I can't seem to replicate on a Debian unstable box, where pam hasn't been updated since April [0], but I don't have an Ubuntu box handy to verify that I'm properly trying to exploit it.

[0]: <http://packages.qa.debian.org/p/pam.html>

<comment><USER11> The security hole was introduced by a Ubuntu-specfic patch to pam. The pam_motd-legal-notice patch was added in July 2009 due to <https://bugs.launchpad.net/ubuntu/+source/pam/+bug/399071>

</comment></comment></comment><comment><USER12> Dumb question - what's PAM? To me that means "phone as modem"...

<comment><USER10> Pluggable Authentication Modules. It's an auth framework used by many Linux distributions.

See: [http://en.wikipedia.org/wiki/Pluggable_Authentication_Module...](http://en.wikipedia.org/wiki/Pluggable_Authentication_Modules) and <http://en.wikipedia.org/wiki/Linux_PAM>

</comment></comment><comment><USER13> It didn't work on 9.04, which I guess is good.</comment>


Show HN: NeedNumbers.me, import contacts from "New Phone, Need #s" FB groups - <AUTHOR> http://neednumbers.me

<comment><USER2> It would be neat to bypass the facebook group method and just have a website that you can request people's phone numbers (just a simple submit form). Then the numbers aren't publicly available for everyone to snoop.

The reason people make the group or event is because when you invite everyone they get a notification and a lot more people see it rather than a status update (that maybe <10% of your friends see). So maybe creating an event or group then linking to givemeyournumbers.com/john_smith

</comment><comment><USER3> No, if you need to ask for phone numbers by using a facebook group you are doing it wrong. This just serves to encourage more people to do the wrong thing.

</comment><comment><AUTHOR> OP here.

Many said this isn't wide-used anymore. But as a high school student, I still get invited to those groups/events frequently, and people said they've been waiting for something like this for a long time. So there is still a big market here.

Glad I could contribute my little bit to make this process a lot faster. Well worth making this as my 5-hour side project.

</comment><comment><USER4> Although this is less common than it once was I still get invited to these groups a few times a month so this is useful. I've just graduated high school and I think some of my other friends would get them even more as my friend group is slightly more technical.

</comment><comment><USER5> I remember need a new number groups used to be quite common before the wide adoption of smartphones. Is this still a thing?

</comment><comment><USER6> Wait, people do this?

<comment><USER7> Yes. It used to be much, much more frequent before smartphones. It is decreasing rapidly, though, as we'd all expect in a time and age where smartphones seemlessly backup contacts to the cloud.

<comment><USER8> You still see it in places and with communities where smartphones are less popular. I see a lot of them from students in middle and high school. (Although usually as status updates, not groups.)

</comment></comment></comment><comment><USER9> Very useful!</comment>


Sacklers Would Give Up Ownership of Purdue Pharma Under Settlement Proposal - <AUTHOR> https://www.nytimes.com/2019/08/27/health/sacklers-purdue-pharma-opioid-settlement.html <comment><USER2> Dave Chappelle's sketch on if we treated corporate criminals like street drug dealers is relevant (and funny) [https://youtu.be/HeOVbeh2yr0](https://youtu.be/HeOVbeh2yr0).

Yet more relevant when the corporate criminals are drug dealers.

</comment><comment><USER3> The short of it from the article (my interpretation much simplified): the Sacklers would keep the bulk of their prior gains (however that may be defined) but will give up their ownership of the manufacturer of Oxycontin, a large contributor of their potential future gains. So yeah. That certainly doesn't seem like much of a penalty, given the fortune the family has already made and doesn't seem to provide any real disincentive for others not to follow suit in the future ....just make enough money before the lawsuits start. <sarcastic tone> Feels a little like FB's recent FTC "slap on the wrist".

<comment><USER4> The thing is though, this stuff is hard. Getting the law to punish stuff like this is not as easy as people think it is. Prosecutors are out trying to find creative ways to sanction these sorts of people and corporations, but it's just not this simple, quick thing you can do.

Also, keep in mind a lot of this is being done with an eye to the future. In a very real way, the Sacklers are only, what? Maybe 8 to 10% of the problem? The rest of the opioids came from other corporations. So you get a settlement with the little guy, all of a sudden you're in a better position to pressure the other guys.

Maybe it does suck. Maybe it is infuriating. But the alternative is that you potentially lose leverage and you never get any of the bad guys. I guess I'm just saying, this stuff is harder than people think it is.

<comment><USER5> That's the problem. You have 30,000 statutes to deal with a street dealer, but a billionaire family selling drugs is "hard" to prosecute. Justice never comes for the rich in the US.

Settlements for criminal conduct should be illegal full stop. Money shouldn't be a get out of jail free card.

</comment></comment></comment><comment><USER6> It's very sad that they were allowed to willfully do this for years. And now that law is finally catching up on them, they will pay a chunk of their blood money and go scott free.

<comment><USER7> > _they will pay a chunk of their blood money and go Scott free_

Based on what?

We saw similar pronouncements following Elizabeth Holmes' civil charges. And pretty much every scandal preceding and succeeding that.

This settlement is similar to the J&J public-nuisance ruling in Oklahoma. Public nuisance does not require proving intent. Proving intent is difficult.

Many believe prosecutors in the United States, Canada, and Europe, will find evidence of ill intent amongst members of the Sackler family. That would lead to additional confiscations of property and, if criminal convictions can be attained, potentially even jail time.

But that's a longer, more difficult and more expensive process. Hence why this comes first.

<comment><USER8> Except profit motive is not often considered ill intent, and that's something I take issue with. More often than not, this basically goes down as something like 'bad business decisions' which carries little if any personal liability for the executives of the given company, and why exactly is that? Just because you were a decision maker at a large company, or part of a team that made a given decision, when the harm done is this catastrophic, how do you get to just walk away?

And before you say "this comes first" or "we're not there yet" just think back to the 2008 banking crisis, and how the people who got incredibly rich(er) off of the backs of working class people are still very much incredibly rich, many _still working in the industry they royally screwed up in._

</comment></comment></comment><comment><USER9> This is a payoff from the Sacklers to stay out of jail. Accountants and Lawyers crunch the numbers to come up with a payoff that allows them to keep their wealth and move on as if it never happened. They'll negotiate a little and bump the number by 20% and live out their lives like the Kennedy's.

<comment><USER10> For those who are ignorant.

What about this parallels the lives of the Kennedys?

<comment><USER11> I think it has to do with the bootlegging maybe?

<comment><USER12> And securities fraud.

<comment><USER13> Joseph Kennedy made his fortune off securities fraud, and was appointed by FDR as the first SEC Chairman, saying "set a thief to catch a thief".

[https://www.professorbainbridge.com/professorbainbridgecom/2...](https://www.professorbainbridge.com/professorbainbridgecom/2005/12/it- takes-a-thief-the-first-sec-chairman.html)

[https://www2.gwu.edu/~erpapers/mep/displaydoc.cfm?docid=erpn...](https://www2.gwu.edu/~erpapers/mep/displaydoc.cfm?docid=erpn- jpk)

</comment></comment></comment></comment></comment><comment><USER14> Turn it into a generic manufacturer and distribution hub that will lower generic prices deep and wide...

<comment><USER15> I would go one step further. Nationalize the company.

There is always talk about "if companies are people, how do we punish them when they break the law?". Well, what about nationalizing them for the public good for a certain number of years that matches what a person would get in prison for a similar crime?

Purdue Pharmaceuticals could be put under the umbrella of Medicaid and ordered to manufacture generic drugs for the next 30 to 50 years (or forever if contributing to tens of thousands of deaths would be equivalent to a life sentence)

<comment><USER16> How does it serve the public interest to have government management run a company into the ground? Do you want more Amtraks? That's how you get more Amtraks. If you want a nuclear bomb for corporate misconduct, it seems like the best approach would be to distribute the shares to the victims while keeping the company privately owned and operated.

(Downvoters are on the wrong side of history. Nationalizing companies is a failed experiment. Privatization of state-owned companies is one of the few things nearly everyone agree on, from the US to Sweden to putatively Marxist countries like Vietnam: [https://www.forbes.com/sites/ralphjennings/2018/12/30/vietna...](https://www.forbes.com/sites/ralphjennings/2018/12/30/vietnams- promises-big-privatization-push-for-2019-but-reality-may-fall-short))

<comment><USER17> > _Do you want more Amtraks?_

That gave me a good belly laugh. In the metrics I care about, Amtrak could be seen to represent the government at their best.

The trains run on time, are more comfortable than flying, and often cheaper too. The dining cars are surprisingly good (snack cars are lackluster though), and I've found _every_ Amtrak employee I've ever dealt with to be a kind and courteous professional. And they look after their customers in other respects too, such as chasing away the notorious serial-gropists known as the TSA. Amtrak treats regular people like humanely in a way that contrasts sharply with how American airlines behave.

From my perspective the primary problem with Amtrak is disappointing coverage of the country, so yes I want more Amtraks!

(Incidentally, my experience with them is more limited, but I found the workers of the Alaska Marine Highway, a ferry service operated by the state of Alaska, to be similarly pleasant people. So maybe there is a trend here..)

<comment><USER16> > The trains run on time

Amtrak has abysmal reliability, even on the Northeast Corridor (which is Amtrak-owned and doesn't share traffic with freight lines). On-time performance on the northeast corridor is just 75% [https://www.washingtonpost.com/news/wonk/wp/2014/07/10/the-s...](https://www.washingtonpost.com/news/wonk/wp/2014/07/10/the- sorry-state-of-amtraks-on-time-performance-mapped). Many scheduled flights along that route ( _e.g._ DCA to JFK or LGA) have 90% on-time performance. And of course, trains aren't supposed to have airline-like delays. One of the key selling points of trains is that they don't have to deal with airport congestion, late arriving equipment, etc., and so relatively short intercity trips are predictable and hassle-free. (Unlike Amtrak.) My wife and I rode Amtrak twice a day for two years between DC and Delaware. It was a nightmare. Routinely delayed trains, cancelled trains at least once a month, etc. No private business would survive operating like that.

It's also odd that you'd cite TSA as a bad thing. TSA is, of course, what happened when the government nationalized airport security, taking it away from the private security forces airlines previously used.

<comment><USER17> To be clear I don't blame airlines for the TSA, but I certainly credit Amtrak with keeping them at a distance. If you had opened with criticism of the TSA, not Amtrak, then I would have upvoted you.

As for the rest, I'd rather be a little late than be treated like shit. The Amtrak delays I've encountered have all been less than an hour, compared to numerous incidents of multi-day delays when flying (I'll never do business with Delta again under any circumstances. Being stuck in Atlanta for two days is pretty bad, but the shear malicious joy their employees were expressing at the situation was as bad as any stereotypical DMV encounter.) A few hours of delay isn't such a problem, but some Americans seem to enjoy being in a perpetual state of hurry...

I can't help but wonder if such impatience is somehow related to the general surliness of airline employees, relative to Amtrak and the Alaska ferry. The last ferry I was on got delayed for several hours one morning after responding to a mayday and being kept on the scene by Canadian Coast Guard during the search. The crew was _unnecessarily_ apologetic while nearly all the passengers were, if anything, a bit proud or appreciative. I shudder to think of what such a delay on a plane would look like, with the sort of personalities that would likely be involved...

</comment></comment></comment></comment></comment></comment><comment><USER18> I can't tell from this whether the Sacklers are being contrite and genuinely sorry for what's happened, or they've simply decided this is the best way to preserve whatever assets they have. I'm guessing they'll still be mega-rich whatever happens.

<comment><USER19> They're probably sorry for what's happened, but not _that_ sorry. They're likely too disconnected from many of the effects of the opioid crisis to truly feel its devastation. Just like other high-level drug dealers, really.

<comment><USER20> They're sorry they were caught.

</comment></comment></comment><comment><USER21> Why not charge them with a few 100,000 counts of reckless engagement and a few thousand counts of depraved indifference?

The punishment for causing this level of death and suffering should not be limited to writing a check.

</comment><comment><USER22> What criminal wouldn't trade 1/3 of profits for immunity for their crimes?

</comment><comment><USER23> As long as they end up in jail for the rest of their life, it's OK by me.

</comment><comment><USER24> Walking away seems like a pretty sweet deal

</comment><comment><USER25> Of course, when it comes to the rich and powerful, no mention of jail time.

</comment><comment><USER26> It's amazing how they took calculated risk and ended up with net gains and avoided any criminal charges.

Do you need a really high IQ to think way? Is one person able to make such strategy or do you need a group of high IQ people to pull off something like this?

Are there lots of people they know in power?

</comment><comment><USER27> Does anyone have a workaround for this paywall, please?

<comment><USER28> Just subscribe and pay for good journalism. it's like asking for a workaround for the SAAS website people here work on.

<comment><USER27> I would, if there was something like a global Netflix for newspapers. I'm European, what point do I have in subscribing in a shitload of US newspapers?

Media desperately needs a convenient and affordable financing model that does not depend on selling off their users' data to the highest bidder.

</comment></comment></comment><comment><USER29> Good start, but not good enough.

The executives should be facing execution [0]. In exchange for dropping the death penalty they should get no better then life time in prison.

[0] if can execute a black kid for being a driver in a botched robbery, why can't we RICO these assholes to the gurney? Purdue Pharma can supply the execution drugs

<comment><USER30> Because RICO doesn't work that way - period. The drugs provided were clean and of the specified doses and they never ordered any capital crimes. Thus nothing to RICO chain for overdoses or secondary effects.

The felony murder rule has some messed up assignment of responsibility (fair enough for eggshell patients and causing dangerous situations but dead accomplices or absolving reckless use of force by pinning it on the felon are problematic) but it also isn't one of the enumerated crimes.</comment></comment>


Passwords are dead. It's the future - <AUTHOR> https://hackernoon.com/passwords-are-dead-its-the-future-e3e95affd9a6#.sfl06tl5d <comment><USER2> Seems like another flavor of the month authentication schema that won't catch on [https://en.wikipedia.org/wiki/SQRL](https://en.wikipedia.org/wiki/SQRL)

I think we need to work within the existing schema of passwords because that's what people are used to. They have muscle memory for entering passwords that is very hard to wipe. They have entire ecosystems based around passwords-for- profit (1password, Lastpass, and any number of 2FA solutions).

I think the general consensus now is that passwords only serve the threat model behind them. If I use a sixteen character password with at least 3 emojis, numbers, and no dictionary words for storing 4chan memes on Imgur, then something is desperately wrong with my threat model.

Likewise if I'm using a six letter alphanumeric password to get access to my email account (which might be tied to all my other accounts), then there's something awry with my threat model.

SQRL on the other hand could serve other threat models and seems useful for quick-and-dirty interaction with the Internet. If I want to leave a single anonymous comment for example, on Hackernews/Reddit, I shouldn't have to do the password dance each time.

</comment><comment><USER3> I started this very angry, due to the title. Happily, it wasn't that way, and it was instead a parody (ish).

I do wish that the general public would use password managers instead of using "password1234" on all of their sites. Would be nice if more browsers built in deep support for LastPass/KeePass, especially more mobile ones, since that's where most 'normal' users are now.</comment>


Apple sold nearly 1 mln iPad 2s in debut weekend: analysts - <AUTHOR> http://www.reuters.com/article/2011/03/14/idUSL3E7EE1K920110314

<comment><USER2> > The iPad 2's early success is a warning sign of a global tablet bubble, > where supply could outpace demand for tablets by about 36 percent, said J.P. > Morgan analyst Mark Moskowitz.

It's official: everything is a bubble now.

<comment><USER3> So you're saying we're in a bubble bubble?

<comment><USER4> Well, economy seems to be a fractal bubble if you look from a future distant enough, is a bubble that grows bigger and then a similar bubble replaces it and grows, and then another, and another, and another...

</comment></comment></comment><comment><USER5> The most interesting thing is that 70% customers purchasing the iPad 2 are first-time iPad buyers.

<comment><USER6> First-generation aversion?

That was my reason to buy the iPad2 when the iPad was originally announced. Let the product prove itself and let them fix whatever mistakes they made. Nobody wants to own the next Kin.

<comment><USER7> In my case it was because I didn't order it online and kept trying to get one at a store when I would happen to be there (always sold out), eventually it was thanksgiving and I decided to just wait a few more months for v2. This time I ordered it Friday morning and it will be arriving in ~two weeks.

</comment></comment></comment><comment><USER8> Whats becoming interesting to me is how effective Apple's consistent product cycles are at stimulating demand and in fact how customers are likely timing their purchases to these releases.

Their product sales have to be becoming very cyclical and regular and in fact may start getting consumers tuned to a particular upgrade cycle (every other release?) I don't know another company that is so consistent in their release cycles so people really have no idea when the "next" version is coming.

<comment><USER9> I'm not sure whether many people are really following Apple releases so closely but it is certainly true that it is very easy to predict when the next iPods, iPhones and iPads will come out. (It's a bit harder for Macs.)

That's kinda funny considering that Apple usually doesn't pre-announce. (Exceptions are usually only first generations and operating systems.) They are predictable, but not because they are keeping us informed.

</comment></comment><comment><USER10> They did it again. I don't think any company is as consistently great as Apple. Not a fanboy, just calling it like it is...

<comment><USER11> Unfortunately. I wonder why there cannot be another company like Apple, but with other principles and/or design choices.

<comment><USER12> I have become something of an Apple fanboy, but I completely agree with this sentiment. I would love to see a company that could create an Apple-like computing experience but with a much more progressive view toward the computer industry (licensing, developer support, even product specification info). With Android, Google seems to be the strongest challenger, but I suspect they will likely never have the focus necessary to compete successfully in Apple's market, much less any other existing company.

<comment><USER13> The thing is, there are NO challengers in the _hardware_ arena. Google et al do software pretty well and will continue to improve. But who else could create hardware as beautiful and functional as Apple? I've been a Windows- then-Linux guy for 15 years and it's the _hardware_ behind MacBooks and iPhones that drew me to Apple. There is simply NO competition. And, unfortunately, it's much easier to be a software startup than a hardware startup. Microsoft and Google aren't even playing the same game.

</comment></comment></comment></comment><comment><USER14> At an average selling price of $650 (including accessories), that's $650MM of revenue for Apple.

</comment><comment><USER15> "Analysts expect Apple Inc to have sold close to a million iPad 2 tablet computers in its first weekend."

So, no official number, although we do know that they've sold out in many places. That's somewhat less exciting, though I don't doubt that a massive number of iPads are being sold.</comment>


Europe is Literally Running out of Money - <AUTHOR> http://www.theatlantic.com/business/archive/2012/05/europe-is-literally-running-out-of-money/257836/

<comment><USER2> _It's time to print some money._ \- From end of article

It would seem to me that printing more money, and therefore causing the value of said money to drop (inflation) you would only be band-aiding a wound, a wound that needs to actually heal. Unless I'm misunderstanding the author.

<comment><USER3> AFAIU the idea is that by printing money you basically take the money stuffed into matresses and give them to the disposal of the state. The question, of course, is whether the state is able to use them in such a way as to make them flow rather than get stuck once again.

<comment> cgrand-net Printing money means inflation and inflation is bad for debt owners (unless the debt is in another currency) and indeed also for "matresses".

<comment><USER4> But inflation is good for debtors themselves, and debt-made money eventually requires _some_ inflation to make the debt load maintainable.</comment></comment></comment></comment>


Top Black Hat Hackers - <AUTHOR> http://www.improgrammer.net/top-10-black-hat-hackers/

<comment><USER2> I have some issues with this list.

1\. If we know who they are, are they really the best? David Smith is, as the article says, the only person to go to jail for writing a Macro virus, the past time of script kiddies everywhere (at one point at least; I'm not sure if you can still perform the necessary tricks with overwriting the default template, etc). I find that rather telling.

2\. I would never call Hotz a "Black Hat" for hacking on hardware he owned. I wouldn't describe RTM, Lamo, or James that way either, though they accessed systems that weren't theres. Only three of the people on this list sought any kind of material gain; the rest of them have questionable ethics, but are mostly motivated by curiosity. Even McKinnon, for whom black hat is probably a fitting epitaph, was in search of information he believed was being unjustly withheld from the public.

Maybe this is just me, but I think of someone as a black hat if they are out to do harm; to destroy systems, steal money, or sap resources.

3\. Maybe this is a nitpick, but packet sniffing is a passive attack by someone with access to a router, switch, WiFi encryption keys, etc. ARP spoofing is an active attack performed by ordinary hosts on the same LAN as the target that can achieve similar goals.</comment>


Book Review : The Architecture of Open Source Applcations - <AUTHOR> http://stephenhaunts.com/2013/02/20/book-review-the-architecture-of-open-source-applcations/

<comment><USER2> While the first volume is a good book (haven't read the second) this is not a review. At most it's a summary. :-/</comment>


The Luxe Quarantine Lives of Silicon Valley's Elite - <AUTHOR> https://www.vanityfair.com/news/2020/08/luxe-quarantine-lives-of-silicon-valley-elite <comment><USER2> Is this censorious? Luxe is pretty much what Vanity Fair is all about.</comment>


Webhooks, REST and the Open Web - <AUTHOR> http://apiux.com/2013/09/12/webhooks/

<comment><USER2> Webhooks are in need of some standardisation for sure, so moving towards something like PuSH is a step in the right direction. However this technology has been around for a while, so whether this will become standard or not remains unclear.

PuSH solves a couple annoyances with webhooks that comes to my mind:

\- Lack of debuggability: the inability to subscribe to events forces me to explicitly set up callback URL(s) on service providers' dashboards or in query strings in requests. IF I managed to set them up correctly, data will come crashing in any day in the future, throwing exceptions, or bouncing on unspecified routes. And all these POST catchers and local tunnels developers play with to get this right in the first place.

\- Ad-hoc verification schemes: Every service comes up with their own way of ensuring the data originated from their servers. Signature hashes as 'X-*'-headers, a number of extra fields inside the JSON body, etc.

There are more, but these two has annoyed me for quite some time.

<comment><USER3> We've (Runscope) tried to make debugging better than what you can do with a simple post catcher like requestb.in. The nice thing about our forwarding setup is that if a webhook fails on your server you have a log of that and can retry it.

<comment><USER2> Yeah, I saw your service on Heroku a couple of weeks ago. Haven't tried it for our API's yet but I recall you had a pretty nifty approach. Good work!

</comment></comment></comment><comment><USER4> Nice article with a concise overview of PubSubHubbub and HTTP Subscription Specification. It would be really nice if you could complement it with pointers to some real example of interfaces using one or the other approach. This could help practitioners identify is the better fit for their use case.

</comment><comment><USER5> I don't understand the diagram.

The POST to /subscription line going from left to right is clear. What is the GET request below it, is that another HTTP GET requests or a the response to a POST. If it is a GET why is the arrow going from Server to Client.

Then the response to that GET has a 201 code but that is going from client to Server?

<comment><USER6> The POST to /subscription informs the API server that there is a "webhook endpoint" that's available to respond to API events. This request happens only once.

The GET request represents the "webhook request", where the API server makes GET requests to the webhook endpoint. These requests are on-going and regularly occurring as a result of service events.

The dotted arrow at the bottom is the webhook endpoint responding to the webhook request, and many API services treat responses with 2XX code as successful, whereas 4xx and 5xx response codes are unsuccessful. In the event of an unsuccessful webhook request then the API service will make multiple attempts at sending the webhook request.

For example:

* HN comment gets posted

* webhook endpoint receives GET request with related information (eg: user id, username, comment date, comment body)

* webhook endpoint responds with 2XX indicating success

<comment><USER5> I think I understand now, thank you for explaining!</comment></comment></comment>


Write code that is easy to delete - <AUTHOR> https://programmingisterrible.com/post/139222674273/write-code-that-is-easy-to-delete-not-easy-to <comment><USER2> I find the difficult thing with this advise is that people always want to skip step 1.

From my experiance once you introduce the principle of refactoring repeated code into functions no one wants to repeat code and will go to great length to justify abstractions before they know if its needed.

I see this with teams following iterative product development processes as well - they never want to build the 'simplest thing' first and learn. There is usually an idea of the final product and people want to jump straight to that.

Would be interested to know if anyone else has seen this and how they have overcome those challenges.</comment>