How I Came to Write D (2014) - <AUTHOR> http://www.drdobbs.com/architecture-and-design/how-i-came-to-write-d/240165322 <comment><USER2> Logged in today and saw this! Walter here, AMA!

<comment><USER3> Hi!

I dimly remember a fairly deep analysis/comparison of C++ and D that went into how opaque or transparent abstractions were to the compiler, and what that means for performance (models) and compile times.

I thought it was by you, but can no longer find it. Might you be able to point me at it?

<comment><USER2> I don't recall writing such an article. It sounds intriguing, if you do find it, I'd like to see it.

<comment><USER3> Sorry! I'll keep looking.

<comment><USER4> Might possibly be Andrei Alexandrescu's The Case for D -also in Dr.Dobbs.

See here: [http://www.drdobbs.com/parallel/the-case- for-d/217801225?pgn...](http://www.drdobbs.com/parallel/the-case- for-d/217801225?pgno=1)

</comment></comment></comment></comment></comment><comment><USER5> Back when Andrei Alexandrescu was working at Facebook, I had hoped that Facebook would adopt D as a standard language. That didn't happen, and it seems unlikely that D will get a powerful corporate sponsor. I think that would have greatly helped D not just in terms of resources, but also in terms of popularity.

In an ideal world, good programming languages would win or lose on their own merits, but that doesn't seem to be the case in the world we actually live in.

<comment><USER6> Corporate support or not, Rust seems to be a better contender for the crown of the sane successor to C++.

D might have been an important evolutionary step, possibly showing what _does not_ work well for the niche it was trying to fill.

<comment><USER5> I think Rust is the clear winner for OS-level programming. I'm not at all sure that it's the right solution for application-level programming. I think Go got two things right for the statically compiled application-level space: Fast compile times and garbage collection. Of course I feel like they got everything else wrong [1], but that's what we've got in that space right now. I think that D might be a much better fit for this space, but it doesn't matter because Go has sucked up all the oxygen.

[1] I realize that this is not a universally held opinion, but it certainly seems to be pretty widely held.

<comment><USER7> How does Rust have a clear hand over Ada?

<comment><USER8> Rust's cutting edge compiler is free, for one thing. I love Ada, but Adacore may well have killed any chance it had of being a commercially viable language (its use declines precipitously each year, even in the defense and avionics industries where it used to be strong).

Plus, Rust has a thriving community whereas thanks to Adacore, Ada has a dying one. Community is critical for programming languages.

But otherwise, Ada is a brilliant and ultra safe language whose safety features go far beyond the memory and type safety that Rust features.

It's a shame.

<comment><USER9> If anything Adacore has helped Ada a lot.

It is the only Ada compiler available for free, fully updated to Ada 2012, with all the remaining ones are still on their 90's style prices.

[https://www.ptc.com/en/products/developer- tools/objectada](https://www.ptc.com/en/products/developer-tools/objectada)

[https://www.ghs.com/products/ada_optimizing_compilers.html](https://www.ghs.com/products/ada_optimizing_compilers.html)

[https://www.ddci.com/products_score/](https://www.ddci.com/products_score/) (frozen in Ada 95)

Thanks to them Ada has become a regular presence at FOSDEM and is being teached at quite a few European university.

<comment><USER10> according to wikipedia, their 'free' compiler is GPL without a linking exception. the comparison chart on their page also says it is 'for open source GPL software'.

<comment><USER9> Apparently people keep forgetting without GPL, Linux would never happened.

<comment><USER8> GPL for an OS is I've thing. GPL for a compiler and runtime is entirely another, since only the latter forces any project you create with it too carry the GPL license.

<comment><USER9> Ah you mean gcc, the compiler that everyone ignored until Sun started the trend of UNIX vendors to charge for their compilers.

<comment><USER8> GPL's runtime isn't GPL, it's got the runtime exception:

[https://www.gnu.org/licenses/gcc- exception-3.1.en.html](https://www.gnu.org/licenses/gcc-exception-3.1.en.html)

<comment><USER8> Sorry, I meant GCC's runtime isn't GPL.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> I hear so many great things about D, but I haven't started coding in it yet. A friend of mine has gotten in there, coding up his new trading platform in it. Also virtually all his social media posts are about D, so he's keen.

Suppose I am a c++ guy who does a lot of time sensitive code. Who else has made the leap, and what were your impressions? How often do you turn up nothing on stackoverflow? How often do you find there's no lib where you'd expect to have a few in c++?

<comment><USER12> There is this guy who does VST plugins in D and sells them: [https://www.auburnsounds.com/blog/2016-02-08_Making-a- Window...](https://www.auburnsounds.com/blog/2016-02-08_Making-a-Windows-VST- plugin-with-D.html)

"This is a touchy topic that already has filled entire blog posts. Virtually everyone in real-time audio is using C++ and it's probably still the sanest choice to make. [...]

I worked with both languages for years and felt qualified enough for the inevitable bullet point comparison. The most enabling thing is the D ecosystem and package management through DUB, which makes messing with dependencies basically a solved problem. Development seems to "flow" way more, and I tend to like the end result better in a way that is undoubtedly personal."

<comment><USER13> _"...makes messing with dependencies basically a solved problem."_

Huh. Now I'm interested.

One constant in my professional (and hobby) careers has been "DLL Hell". I'd pretty much do anything to be hassle free.

Thanks for the tip.

<comment><USER14> On that point. In the D world there is a habit to use "derelict" bindings which are dynamic loaders for dynlibs. This has the advantage of supporting multiple dynlib versions, and also does not complicate the build with a linking option... If you are making anything cross-platform it is a boon.

<comment><USER15> Can you please expand on that? Are there examples to look at of derelict bindings?

<comment><USER14> For example you want to depend on SDL.

You add the "derelict-sdl2" package to your DUB dependency list. DUB will download and build that "derelict-sdl2" library. This is a small library that will load functions pointers in the SDL2 dynlib (aka dynamic loading).

You'll still have to distribute your cross-platform app with SDL2, however there is no linker option, the linker doesn't need to know about an import library. Voila, same build for all platforms.

Conversely in C and C++ you would probably only have static bindings as a choice, and it can be a pain for cross-platform builds. On Linux, it has to be packaged. On Windows, you must find the right .lib.

There can be considerable list of libraries in linker settings, essentially because there is no package manager that makes dependencies something _composable_: dependencies would then leak on linker settings across the chain. C++ forums are full of people failing to build, that's not the case with D.

Documentation: [http://derelictorg.github.io/loading/loader/](http://derelictorg.github.io/loading/loader/)

<comment><USER16> How is this dynamic loading implented? Is it effectively a cross-platform wrapper over LoadLibrary/GetProcAddress/etc. (and their POSIX equivalents) or is there more to it? Is it possible to make link time optimization work with dynamic loading?

<comment><USER17> > Is it possible to make link time optimization work with dynamic loading?

No, but nor can you with regular ol' linking against shared libraries. Or against static libraries (except for some mundane stuff like function reordering). LTO requires toolchain support and occurs _before_ code generation.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> D is a great language. It simply lacks in hype like other languages in the same space. Otherwise I find little to complain about it as a casual user

<comment><USER19> That's been my experience as well. I haven't done a great deal of work with it, but the work I did felt very nice. It's a refreshing improvement upon older, flawed languages...but doesn't seem to have the evangelical community that, say, Rust has behind it.

I wonder why that is? Maybe it just needs a cooler name (:

<comment><USER20> The Dust programming language? Joke aside, I fear "D" came before Search Engine product names were considered. Sadly sometimes I google "dlang" and still get some odd results.

</comment></comment></comment><comment><USER21> D is one of the few languages that allows named scoped imports.

<comment><USER22> What are those?

I don't know D, and I had a quick Google, but couldn't find anything by exactly that name - apologies for the lazy question.

<comment><USER23> void foo() { import std.stdio; writeln("sup") }

</comment></comment></comment><comment><USER24> Take note: _" Who the hell do you think you are thinking you can write a C compiler?"_ If you take that challenge it will seriously elevate your computer programming skills. In some circles, this will get you immediately hired.

Try a simple language, maybe devise an emulator to go along with it.

<comment><USER25> > "In some circles, this will get you immediately hired."

Is this true though? I mean Google famously didn't give a shit about hiring Max Howell (creator of homebrew) because of hazing-style pointless whiteboard trivia [0].

I'd guess the number of circles where a thoughtful side project that digs into deep computer science fundamentals as well as difficult implementation specifics would even get you the slightest attention for an interview is close enough to zero as to render it meaningless.

If you think about a lot of possible different self-study options, ranging from cramming and shallow memorization of leetcode garbage or Cracking the Coding Interview, all the way to patiently applying craftsmanship and self- learning to a side project that exercises and demonstrates core fundamentals in a pragmatic way, the shallow memorization garbage will earn you money, while the side project will earn you an email with a hyperlink to HackerRank.

It is one of the worst aspects of our industry, and a major reason why I would advise younger people to treat the idea that there are direct, stable, good- paying jobs with job security in the tech industry with a lot of skepticism. It's an industry constantly trying to invent new ways to shift the demographics more and more into the least experienced and least expensive quantiles of candidates, and to arrange businesses where actual software labor productivity doesn't have a strong tie to the company's bottom line, except maybe for a tiny population of experts.

[0]: < [https://www.quora.com/Whats-the-logic-behind-Google- rejectin...](https://www.quora.com/Whats-the-logic-behind-Google-rejecting- Max-Howell-the-author-of-Homebrew-for-not-being-able-to-invert-a-binary-tree) >

<comment><USER26> > I mean Google famously didn't give a shit about hiring Max Howell (creator > of homebrew) because of hazing-style pointless whiteboard trivia [0].

People usually omit the part that Homebrew was at that point a quite shitty reiteration of ideas well-implemented in many other places (RPM/Yum, DEB/APT, and half a dozen other package managers). It was a common complaint that installing one package could break several others, because Homebrew updated some common dependency and the new one was missing symbols or had otherwise incompatible ABI. There also was this hilarious bug report that Homebrew served everything over plain HTTP (and Homebrew had no digital signatures whatsoever), and the ticket got closed by a Homebrew team member saying it's not a problem, which spoke tons about their competency in package management.

I don't know how the situation looks now, but when Howell was interviewed by Google, Homebrew was not something you could be proud of writing.

<comment><USER27> >Homebrew was not something you could be proud of writing.

Anyone should be proud of writing a widely used tool that provides value to so many individuals and companies, regardless of nitpicks from the peanut gallery.

<comment><USER28> Nitpicks, Glaring security issues that are design "features" and thus will effectively never be fixed... sure those are the same thing.

</comment></comment></comment></comment></comment><comment><USER29> Discussed at the time: [https://news.ycombinator.com/item?id=7555426](https://news.ycombinator.com/item?id=7555426).

</comment><comment><USER30> For anyone new to and interested in D, here are a handful of command-line utilities and other small programs written in D (on my blog), which may help give an idea about (just some of) the kinds of things that D can do, and whet your appetite for more:

[https://jugad2.blogspot.com/search/label/DLang](https://jugad2.blogspot.com/search/label/DLang)

A few of the posts in that sub-feed are about D videos and confs, so you can skip past those if you want. Some of the videos are interesting too, though.

</comment><comment><USER31> > The path that led Walter Bright to write a language, now among the top 20 > most used, began with curiosity — and an insult.

Is D really a top 20 language? I don't remember seeing it anywhere close to the top 20.

[https://www.tiobe.com/tiobe-index/](https://www.tiobe.com/tiobe-index/) has them in 31

<comment><USER12> It was at #12 in March 2009: [https://www.tiobe.com/tiobe- index/d/](https://www.tiobe.com/tiobe-index/d/)

<comment><USER31> So it's getting less popular over time (assuming the ranking is accurate)? That's not very felicitous.

</comment></comment></comment><comment><USER32> D is the language I really like, and always intend to use for my next project, and have been saying this for the last 5 years. Every time there is something that makes me decide to use C or C++ just one more time. I don't even think it's mostly valid reasons.

Well I'm just about to restart an opengl project so I think I'll go wholeheartedly into D this time

</comment><comment><USER33> Just so you know, when I visited the article from my iPad I was prompted to download one of those scam iPad cleaner apps.

It's a 10" iPad Pro (maybe you can check the log and see which advertiser is being naughty).</comment>


Contract Theory Nobel Prize - <AUTHOR> http://www.bloomberg.com/news/articles/2016-10-10/hart-and-holmstroem-awarded-2016-nobel-prize-in-economics <comment><USER2> OH God I miss this University</comment>


Monzo Lost £6.7M Last Year: And This Should Terrify Traditional Banks - <AUTHOR> https://www.contino.io/insights/monzo-lost-6-7-million-last-year-and-this-should-terrify-traditional-banks <comment><USER2> No idea how the article justifies traditional banks should be terrified because Monzo lost £6.7M?

<comment><USER3> Because they are using "the latest technology such as AWS, Docker, Kubernetes and cloud native architecture"

/s

<comment><USER4> TBH, this shouldn't be sarcasm. Having first hand exposure to finance infra & software architecture.. traditional organisations are crippled by tech debt and decisions made 20-30 years ago!

I'm betting most traditional organisations are envious of being able to start their architecture from scratch.

</comment></comment></comment><comment><USER5> I just started working for a "traditional bank". To my surprise, we're operating just like Monzo (and other tech startups); small, talented teams working closely with product owners, using the latest and greatest tech (our tech stack is very similar to Monzo's).

The banks aren't stupid. If there's a buck to be saved by switching to a different operating model, they will absolutely swap. In fact, it's already happening.

</comment><comment><USER6> there is also another company called Revolut in London doing the same thing.

<comment><USER7> They're very different, they don't have a banking license, don't want one & are mainly focused on international payments, rather than current accounts & an open marketplace.

<comment><USER8> "don't want one"?

they are offering personal bank accounts and recently, business bank accounts (apparently powered by Barclays).. the growth and interest seems to be not less than Monzo`s, so one would guess they'll have to get their own banking license soon.

</comment></comment></comment><comment><USER9> I asked google.com what mozno is and haven't found a thing

<comment><USER10> Monzo, not mozno. It's a startup aiming to provide a replacement for the traditional current account.</comment></comment>


Personal and social information of 1.2B people discovered in data leak - <AUTHOR> https://www.dataviper.io/blog/2019/pdl-data-exposure-billion-people/ <comment><USER2> I was at an Elasticsearch meetup yesterday where we had a good laugh about several similar scandals in Germany recently involving completely unprotected Elasticsearch running on a public IP address without a firewall (e.g. [https://www.golem.de/news/elasticsearch-datenleak-bei- conrad...](https://www.golem.de/news/elasticsearch-datenleak-bei- conrad-1911-145091.html), in German). This beats any of that.

Out of the box it does not even bind to a public internet address. Somebody configured this to 'fix' that and then went on to make sure the thing was reachable from the public internet on a non standard port that on most OSes would require you to disable the firewall or open a port. The ES manual section for network settings is pretty clear about this with a nice warning at the top: "Never expose an unprotected node to the public internet."

Giving read access is one thing. I bet this thing also happily processes curl -X DELETE "http:<ip>:9200/*" (deletes all indices). Does it count as a data breach when somebody of the general public cleans up your mess like that?

In any case, Elasticsearch is a bit of a victim of its own success here and may need to act to protect users against their own stupidity since clearly masses of people who arguably should not be taking technical decisions now find it easy enough to fire up an Elasticsearch server and put some data in it (given the amount of companies that seem to be getting caught with their pants down).

It's indeed really easy to setup. But setting it up properly still requires RTFMing, dismissing the warning above, and having some clue about what ip addresses and ports are and why having a database with full read write access on a public ip & port is a spectacularly bad idea.

<comment><USER3> I've been using ES off and on since before 1.0 came out. It has always baffled me that ES doesn't require a username and password by default.

ES is a database that has to exist on a network to be usable. Heck, it expects that you have multiple nodes, and will complain if you don't. So one of the first things you do is expose it to the network so you can use it.

Yes, it takes some serious incompetence to not realize you need to secure your network, but why in the world would you not add basic authentication into ES from the start? I'd never design a tool like a database without including authentication.

I am serious about my question. Could anyone clue me in?

<comment><USER2> It has to exist on a private network behind a firewall with ports open to application servers and other es nodes only. Running things on a public ip address is a choice that should not be taken lightly. Clustering over the public internet is not a thing with Elasticsearch (or similar products).

If you are running mysql or postgres on a public ip address it would be equally stupid and irresponsible regardless of the useless default password that many people never change unless you also set up TLS properly (which would require knowing what you are doing with e.g. certificates). The security in those products is simply not designed for being exposed on a public ip address over a non TLS connection. Pretending otherwise would be a mistake. Having basic authentication in Elasticsearch would be the pointless equivalent. Base64 (i.e. basic authentication over http) encoded plaintext passwords is not a form of security worth bothering with. Which is why they never did this. It would be a false sense of security.

At some point you just have to call out people for being utter morons. The blame is on them, 100%. The only deficiency here is with their poor decision making. Going "meh http, public IP, no password, what could possibly go wrong?! lets just upload the entirety of linkedin to that." That level of incompetence, negligence, and indifference is inexcusable. I bet, MS/Linkedin is considering legal action against individuals and companies involved. IMHO they'd be well within their rights to sue these people into bankruptcy.

<comment><USER4> Software should be secure by default. Don't blame the user.

mySQL in comparison wont even let you install without setting a root password. And it only listen on localhost/unix-socket by default. Then you need to explicitly add _another user_ if you want to allow it to login from a non local ip. I don't think it's even possible - to both set a blank root password _and_ allow it to login from a public IP.

So you really think the solution is to blame some low level worker, and sue him/her? The blame should always be on the people in charge, usually the CEO, who set the bar for engineering practices, proper training, etc, or the lack of.

<comment><USER5> This is ridiculous.

Software should be built in the best method of delivering maximum value to its users. A trade-off for usability can be made for certain cases like ease-of- use for new software. Redis was part of this a while ago [http://antirez.com/news/96](http://antirez.com/news/96).

Engineers should know their tools before using them. It's a huge part of our jobs. You could introduce a ton of other vulnerabilities in software: XSS, SQL injections, insecure cryptography. Security is part of our job and matters we must know.

You don't blame a plane for a pilot mistake that was meant to be part of his training. Engineers in every other sector are responsible for their mistakes, we should be too.

Also, you don't sue the worker, you sue the company.

<comment><USER6> "Software should be built in the best method of delivering maximum value to its users."

Yes, and defaulting to insecure, thus repeatedly causing huge data breaches, is the exact opposite of delivering maximum value to users. It's delivering maximum _liability_.

<comment><USER7> I would argue that the single command to begin using the application and the ease of on boarding / querying data was a huge factor in expanding its usage. Elastic optimized for initial spin-up and getting things running fast. It works really well! Until you load it full of data on a public IP, that is.

<comment><USER8> That single command to spin up the application can easily generate and show a copyable random secret required to use it, so that you can use easily but there's no option to use it _that_ insecurely.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> It's a tragedy that all of this data was available to anyone in a public database instead of.... _checks notes..._ available to anyone who was willing to sign up for a free account that allowed them 1,000 queries.

It seems like PDL's core business model is irresponsible regarding their stewardship of the data they've harvested.

<comment><USER10> If your in Europe or California, I suggest sending both companies an erasure request: [https://yourdigitalrights.org/?company=peopledatalabs.com](https://yourdigitalrights.org/?company=peopledatalabs.com) [https://yourdigitalrights.org/?company=oxydata.io](https://yourdigitalrights.org/?company=oxydata.io)

Disclaimer: I'm one of the creators of yourdigitalrights.org.

<comment><USER11> Can I use this on behalf my @company users HIBP has just emailed me about?

</comment></comment></comment><comment><USER12> I found a vulnerability in linkedIn a few years back that allowed anyone to access a private profile (because client side validation was enough for them I guess..?)

They didn't take my report seriously (still not completely patched) and I feel like that told me all I needed to know about their security practices.

<comment> john-radio I reported an issue to the LinkedIn competitor [https://about.me](https://about.me) two years ago where signing in with my Google credentials gives me access to some the account of some random other person with a similar name to me. I think that during registration, I attempted to register about.me/johnradio (except it's not "johnradio"), but he was already using it, and then the bug occurred that gave me this access.

I randomly check every 6 months or so and yep, still not fixed.

<comment><USER13> My gmail is my first initial followed by my last name. There are other people on this planet with same first initial and last name, some of whom seem to think that must be their email too, because I keep on getting emails where they used it to sign up for things.

<comment><USER14> I had a lady send me a zip file that contained a VPN client, certificate and a word document with usernames and passwords to the VPN and a number of industrial control systems at the factory she was a manager of.

She sent it religiously, every 90 days.

<comment><USER15> Do you have any clue who she thought you were?

<comment><USER14> Oh yes, she was emailing a copy of her stuff to "herself".

<comment><USER15> Seriously?

How the hell could she think that your email address was hers? I mean, wouldn't she notice that she never got the messages?

<comment><USER14> Totally serious. There are about a dozen people who regularly do this. One guy has missed 4-5 job interviews.

<comment><USER15> So is it typos? Like one letter off?

I can imagine someone mistyping an address, and then reusing the "to" link.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> The number in the HN headline was changed from 1.2 billion to 1 billion (despite the original source's headline saying 1.2). It is kind of amazing that leaking the personal data of 200 million people is now just a rounding error that can be dropped from headlines.

<comment><USER17> Imho, it's more impressive that it's basically a non-story outside of it security news.

<comment><USER18> The general public just shrugs upon hearing such news. They still think there is nothing dangerous if their data gets leaked.

</comment></comment></comment><comment><USER19> I think the solution here is laws which require anonymity, and that includes in banking (where it will never happen).

That is because a couple days ago, I got a text message from tmobile (which seemed genuine) basically saying that my account was one of a larger subset of prepaid phone accounts which had been compromised and that my personal information had been potentially taken by "hackers".

To which I got a good chuckle, because tmobile is one of the few phone companies that will let you create completely anonymous prepaid accounts using cash and without filling out any information. AKA you buy a sim card for $$$ and that is it. So, basically the only information they lost of mine as far as I can tell, is the phone number and type of phone I'm using (which they gather from their network). If they got the "meta" data about usage/location/etc that would have been different but it didn't sound like the hacker got that far.

Had this been a post-paid account they would have my name/address/SSN/etc.

<comment><USER20> Do you think it's reasonable to believe your name / address / SSN / DOB / etc is already out there?

I'm of the opinion it's too late for prevention and we need, instead, mitigation.

<comment><USER21> Exactly. The very reason for existence of the two companies, pdl and oxy, is to tie n pieces of data with m pieces of data.

So depending on how the "anonymous" phone number was used, it's plausible that the number can be connected with other PII.

In fact I wonder if there is any such thing as non-PII, given the existence of such companies.

<comment><USER22> Companies need to stop treating knowledge of this information as proof that you are who you say you are. I would have no problem publicly posting my name, social security number, birthday, mother's maiden name, etc., if not for the fact that someone can actually use this information to open a bank account or take out a loan in my name. It's ridiculous that this is all it takes in most cases.

<comment><USER20> > Companies need to stop treating knowledge of this information as proof that > you are who you say you are.

If we assume that isn't happening in the very immediate future due to the latency of introducing new legislation...

Do we have any other options to protect ourselves?

I've personally worked myself in to a bad credit rating. I have a home loan and a credit card, but any new credit applications auto-reject. Not the ideal scenario though!

</comment></comment></comment></comment></comment><comment><USER23> > Analysis of the "Oxy" database revealed an almost complete scrape of > LinkedIn data, including recruiter information.

"Oxy" most likely stands for Oxylabs[1], a data mining service by Tesonet[2], which is a parent company of NordVPN.

It is probably safe to assume, that LinkedIn was scraped using a residential proxy network, since Oxylabs offers "32M+ 100% anonymous proxies from all around the globe with zero IP blocking".

[1] [https://oxylabs.io/](https://oxylabs.io/)

[2] [https://litigation.maxval- ip.com/Litigation/DetailView?CaseI...](https://litigation.maxval- ip.com/Litigation/DetailView?CaseID=Epee88Womxg%3D&logstat=false&Party=Luminati%20Networks%20Ltd.%20v.%20UAB%20Tesonet)

<comment><USER24> How is that possible? LinkedIn blocked mining the data this way several years ago.

Is it still possible if you pay LinkedIn enough? Or is this old data?

<comment><USER25> A large number residential proxies and fake LinkedIn accounts would look the same to LinkedIn as normal browsing.

<comment><USER24> There's information on the leak that wouldn't be widely available without accessing LinkedIn data using their APIs. Phone numbers and emails, for example.

<comment><USER25> The article mentions it is a blend of data from [http://oxydata.io/](http://oxydata.io/) and [https://www.peopledatalabs.com/](https://www.peopledatalabs.com/)

Both are aggregators that get data from many sources, correlate them, and sell it. The phone numbers and emails could have come from anywhere.

See this screenshot from PeopleDataLabs: [https://d1ennknj6q36vm.cloudfront.net/images/cblead.png](https://d1ennknj6q36vm.cloudfront.net/images/cblead.png)

</comment></comment></comment></comment></comment><comment><USER26> Out of curiosity how do you guys think they managed to scrape LinkedIn on such a large scale?

I've been wanting to do some social graph experimentation on it (small scale - say 1000 people near me) but concluded I probably couldn't scrape enough via raw scraping without freaking out their anti-scraping. (And API is a non- starter since that basically says everything is verboten).

<comment><USER27> I've crawled a popular social network on a large scale, currently doing the same for dating services as a hobby. God, wish I'd still got paid for webscraping.

Here are some tricks which may or may not work today:

\- Have an app where user logs in through said website, then scrape their friends using this user's token. That way you get exponential leverage on the number of API calls you can make, with just a handful of users.

\- Call their API through ipv6, because they may not yet have a proper, ipv6 subnet-based rate limiter.

\- Scrape the mobile website. Even Facebook still has a non-js mobile version. This single WAP/mobile website defeats every anti-scraping measure they may have.

\- From a purely practical perspective, start with a baremetal transaction- isolation-less database like Cassandra/ScyllaDB. Don't rely on googling "postgres vs mongodb" or "sql vs nosql", those articles will all end in "YMMV". What you really need is massive IOPS, and a multi-node ring-based index with ScyllaDB will achieve that easily. Or just use MongoDB on one machine if you're not in hurry.

\- Don't be too kind on the big websites. They can afford to keep all their data in hot pages, and as a one man you will never exhaust them.

<comment><USER28> You forgot the part about exposing your finished database to unprotected elasticsearch http endpoint ;)

In all seriousness does anyone know why you can even host an elasticsearch database as http and without credentials? Seems to be the default. What is the use case for this?

<comment><USER27> Tbh I'm still selling that data.

For a while I've had reoccurring nightmares that my DB had been stolen and published together with an article on how stupid and incompetent I am.

<comment><USER29> If I've understood you right, you break the TOS on other websites to collect users personal info, and then you have nightmares about people taking that data from you? Doesn't that raise ethical concerns in your eyes?

</comment></comment></comment></comment></comment><comment><USER30> People data labs's data is pretty accurate. Here is mine: [https://api.peopledatalabs.com/v4/person?api_key=9c6a1382204...](https://email@example.com&pretty=true)

You can try it for yourself by changing the email. All of the information is public, so I don't mind. They are basically doing data integration.

<comment><USER31> Haha, when I was a kid and scared to use my real name for things, for some reason I used my email... which had my real name in it, to open a Github account with a fake name

So the api knows me as the famous architect, Art Vandelay

<comment><USER32> There is a way to get every developer's email on github thanks to git commits adding it :))

<comment><USER33> In your github account you can add a new email address that doesn't even exist or have a valid TLD, like "firstname.lastname@example.com". Don't use it as your primary email and it won't require confirmation. You can now set your git user.email to this fake address and any commits you make will be attributed to your account without exposing your actual email address.

<comment><USER34> You can use email@example.com instead of adding a fake email, and your commits will still show up on your contribution graph and be linked to your username.

</comment></comment></comment></comment></comment><comment><USER35> It should be illegal for any company to store my private information like this. The 'anonymous' sharing of my information is easily de-anonymized. Sites asking for your phone number for "security purposes" are a joke.

You just have to accept that absolutely everything you've done online is public information. If it isn't now, it is being stored and future tools / databases will make what is either difficult to access or difficult to interpret very easy to use in the future.

<comment><USER36> Using phone number as an example of private information is pretty hilarious. Remember when the phone company used to literally print your name and phone number in a book and send it to everyone in your town? Man, their security was _terrible_!

But it works perfectly fine as a two-factor auth mechanism to prove that whoever setup the account is the same person trying to log into it at some later time.

<comment><USER37> Birthday is commonly used to verify people despite the practice of broadcasting it to people on Facebook.

</comment></comment></comment><comment><USER38> Firefox monitor can tell you if your information was leaked in data breaches. I don't think they have this data set though.

[https://monitor.firefox.com/](https://monitor.firefox.com/)

<comment><USER39> Does this cover more leaks than haveibeenpwned.com?

<comment><USER40> Maybe in the future it will, but it uses Have I Been Pwned. From the FAQ[0]:

How does Firefox Monitor know I was involved in these breaches?

Firefox Monitor gets its data breach information from a publicly searchable source, Have I Been Pwned. If you don't want your email address to show up in this database, visit the opt-out page.

[0] [https://support.mozilla.org/en-US/kb/firefox-monitor- faq#w_h...](https://support.mozilla.org/en-US/kb/firefox-monitor-faq#w_how- does-firefox-monitor-know-i-was-involved-in-these-breaches)

</comment></comment></comment><comment><USER41> > 400 million+ phone numbers. 200 million+ US-based valid cell phone numbers.

Sounds like a nightmare in the making for those cell phone users and their carriers when those begin to get SIM jacked.

<comment><USER42> Is that all you need to SIM jack a phone? The phone number?

<comment><USER43> Yes and no. You need a phone number, but you still need to carry out a variation of an attack that replaces the SIM associated with that phone number. Sometimes this is carrier-specific. Sometimes it's trivial, sometimes it requires a menial amount of work, and in extreme cases you might have to access an actual network. Most of the time there is nothing stopping the attack if they have your personal information.

</comment></comment></comment><comment><USER44> Yet another Elasticsearch server wide open. This is going to make the flurry of open mongodb servers look trivial.

<comment><USER45> I wouldn't be surprised if the starting point for this vulnerability wasn't ES, but Docker. Docker by default modifies iptables and if you hack together a system that uses both software running directly on the host and in containers, it's going to expose the forwarded containers to the Internet - which you might not be expecting, since a bind to localhost would be enough to expose a service. It's always a good idea to have a separate firewall running outside of the your system - this is the one Docker can't fool.

<comment><USER46> No. It's not dockers' fault you did not read the manual and expose the ports wrong: you can bind the port to specific ips for export and tjat address should be 127.0.0.1

<comment><USER45> I see where you're coming from, but I disagree. I believe that good software and abstractions should take little training to use - everything unintuitive is a design failure and should be fixed. "Reasonably secure" should be the implicit default, not something you need to explicitly added. E.g., it's better to force authentication and force the administrator to add an account than let everyone in by default. Or it's better to bind to 127.0.0.1 than to 0.0.0.0 by default, like most web servers built into frameworks I saw do.

Unfortunately, instead of good intuition, Docker is built on caveats, be it networking, storage, caching, image sharing, container/image distinction, authentication, deployment or building a cluster. Every subsystem I experimented with "works", but fails in weird ways in some situations. In my opinion, that means that Docker is a good idea, but has terrible UX/functionality/error handling. I kind of think the same way of Git.

</comment></comment></comment></comment><comment><USER47> This is why I lie about my birthdate by a couple of days on anything where it's not something like a medical record or where I am required to tell the truth for whatever reason. I also never provide my social security number unless it is required by law.

<comment><USER48> One of my coworkers generates a fake middle name for every service they sign up with. According to him, this serves as a unique identifier allowing them to determine when a service is selling their data to a third party (or data is being leaked).

<comment><USER49> Fastmail has subdomain addressing, so if your email is email@example.com, you can use firstname.lastname@example.com to sign up for HN.

That way you'll know for sure who leaks your data, and nobody's going to strip it away like some services would strip away plus addressing (as in, firstname.lastname@example.com).

<comment><USER50> I have excellent results with a subdomain. Even though PDL probably has a lot of data on me, they have (not yet?) been able to glue it to my primary mail address. That one only has my name, gender, github, country and name of my employer. They can't seem to map the remainder to anything else.

</comment></comment></comment></comment><comment><USER51> From what I could see the data returned on me was all derived from publicly available sources (eg: my "public" LinkedIn page, my public github page etc). Perhaps others have more but this looks more like an aggregator of public information than a breach of non-public information.

Having said that, I find these companies unspeakably evil - their intent is to make money by harming people (eroding their privacy by making otherwise private personal information easier to get, obviously a gold mine for identity thieves etc).

</comment><comment><USER52> In retrospect, it would have been interesting to have a bunch of accounts each containing a unique "map trap", at all of the larger services. Then years later, when the aggregator/broker guys get hacked/sold/leaked, you'd have some picture of the genealogy involved.

<comment><USER53> The problem is that you often can't find access to the actual "password" used in the breach. Does anyone know where I can see if it was an actual password or just some made up thing?

<comment><USER54> There was no password on the original ES instance it was open to the web.

<comment><USER53> I meant my password.

<comment><USER55> There's a torrent going around

<comment><USER56> Do you know where I can find a torrent for this leak?

<comment><USER55> I don't think it's wise to add a magnet link here.

But as I recall looking for Breach Compilation may help finding the requisite gist on GitHub.

</comment></comment></comment></comment></comment></comment></comment><comment><USER57> This is all scrapped public social media data. No credentials or govt information. It's very easy to download or buy this data legally.

<comment><USER58> are you sure? how did you come to that conclusion. thanks for the info though, very glad to hear it.

<comment><USER57> Yes, there are dozens of these data enrichment companies. They scrape public sites and use browser extensions, SaaS tools, inbox addons, etc. They mix it together into profiles, and pretty much have the same dataset by now.

Clearbit is one of them and even a YC company.

<comment><USER59> Yep! And as someone who has worked with these data sets and worked on the scraping tools on services like LinkedIn, a lot of the data is outdated, incorrect, or mixing together different entities with the same name into one person or splitting the same person into separate entities incorrectly.

</comment></comment></comment></comment><comment><USER60> Genuinely hope somebody goes to prison for this, but not gonna hold my breath.

<comment><USER61> This data is accessible at small scales just by registering for a free api key at People Data Labs and making a GET request, and if you want more robust access you could just pay PDL for it.

<comment><USER60> Sorry, I should have been clearer, I'm talking about whoever is responsible for leaving it completely open to the public internet.

<comment><USER62> I mean it is INTENTIONALLY exposed to the public... the only mistake is they are giving it away instead of charging for it. If you don't like it when they give out all the information for free, it doesn't make it better if they charge money.

</comment></comment></comment></comment><comment><USER63> Where can i download the data?

</comment><comment><USER64> Linkedin the last social media membership I have. I've been mulling over whether to delete my account because I'm not sure how it will look to prospective employers.

<comment><USER65> Hope this helps: [https://www.pcmaffey.com/finally-i-closed-my- linkedin](https://www.pcmaffey.com/finally-i-closed-my-linkedin)

<comment><USER64> Thank you for writing this. Much like the fear you expressed, I'm going to delete my account as soon as I lock in my next job.

</comment></comment></comment><comment> rm_-rf_slash Good thing I just updated my LinkedIn profile. Wouldn't want hackers to think I have gaps in my resume.

</comment><comment><USER66> I've gotten some strange spam phone calls this last week, including like 3 from Egypt. Wonder if this is why.

<comment><USER67> Probably unrelated. These security researchers found this open database, it doesn't necessarily mean someone else found it.

</comment></comment><comment><USER68> I guess it's time to start leaking billions of records of junk data to pollute the waters.

</comment><comment><USER69> There's estimated to be 4.4 billion internet users in 2019, so this is over 25% of people on the internet.

</comment><comment><USER70> Maybe I am missing something here, but I do not really see the scandal here with the "leak" and I rather think the term is missleading in this context.

What happened?

As far as I understand, there are companies who search the web for public data of people like me, without my consent.

Then they sell that data. Also without my consent.

So that data was avaiable anyway, allmost for free. If this data would contain sensitive information, then I see this buisness practice as a scandal.

But the mere fact that all this data which was gathered without consent is now avaiable for free because of possible db missconfiguration .. is not a scandal to me.

And a leak is usually when a company loses sensitive data of its customers, who expected that data to remain confident, like emails. Not what happened here. Feels more like PR.

</comment><comment><USER71> I don't know about other people, but I have zero personal info with LinkedIn and Facebook.

They only info they have about me is info I don't mind being public. If I want something to be private I don't tell it to them. It's as simple as that.

Google on the other hand, knows lots of private things.

<comment><USER72> Facebook has a lot of personal information about you even if you have never had a Facebook account. For example: your GPS location data, approximate age, gender, ethnicity....

Welcome to the future komrade. Sadly, it's not a matter of just "not giving them" your location data. Your devices supply it.

<comment><USER73> And your friends too. I dutifully kept a new number out of FB until a friend messaged me with, is this your number right? Xxx-xxx-xxx. They can also tag you and auto tag you through face recognition.

</comment></comment></comment><comment><USER74> Cyber alarmists would call a telephone directory: 'A verified threat incident'. Yet these are the same companies selling OSINT data. These alarmist groups need to put down the buzzwords, step off from their white horse and take a look at the hypocrite in the mirror.

If you use social networks, you don't have a reasonable expectation of privacy. You've published your data publicly. If you want to keep this information private, then don't publish it on the Internet.

From: [http://www.dmlp.org/legal-guide/publication-private- facts](http://www.dmlp.org/legal-guide/publication-private-facts)

>2\. Private Fact: The fact or facts disclosed must be private, and not generally known.

</comment><comment><USER75> > In order to test whether or not the data belonged to PDL, we created a free > account on their website which provides users with 1,000 free people lookups > per month.

Well that's very generous of them. Now I know what I'm gonna do next.

</comment><comment><USER76> Is there a way for an individual to check if he's in the dataset ? I am curious about what kind of data they'd have aggregated around me.

</comment><comment> 83-qw-13-f4-as When this type of leak happens, where does this data actually appear? On the dark web? Who has access to this and how does one get it?

</comment><comment><USER77> Seems like the ball is with Google at the moment, the exposed data is on their GCP servers. So, they can figure out next steps.

<comment><USER78> Imagine the equivalent in another industry:

"Hello, Bank of America? There's an ATM machine of yours that's spitting out cocaine.

Yes, I understand that it's probably not your cocaine and that's not your business, but don't you think you should maybe shut it down?"

<comment><USER79> But would you call VendingMachinesCo because there is a vending machine outside the local supermarket, operated by said supermarket, that spits out cocaine? Pretty sure that whatever you put in there is the machine owner's responsibility, not the manufacturer. GCP does not put content in their VPSes themselves the way that a bank operates an ATM.

I think it's more like the responsibility of an ISP to poke their noses in what they transfer, since it might be illegal content (similar to whether Google should poke their noses into people's VPSes). I'm not sure if we should want to require them to do that.

</comment></comment></comment><comment><USER80> Why are there people running _anything_ publicly accessible?

If you are running on the cloud, there is no need for any VMs to have any public IPs at all. Exception for your Bastion host, and even that should be restricted to known networks.

All incoming traffic needs a layer of indirection. On cloud providers that's usually their load balancers.

</comment><comment><USER81> I wonder whether FB/Linkedin can manipulate the timing of negative news like this, for strategic reasons...

<comment><USER82> Facebook/LinkedIn are not implicated in the breach at all; it was some random third-party data enrichment service. The Facebook/LinkedIn in the title refers to the fact that people's FB/LI accounts were one of the fields in the database. So were their Github, and basically any other public-facing account that these scrapers can gather.

</comment></comment><comment> _-___________-_ ES is the new Mongo. If you make software this easy to use, then people with little or no experience are going to use it. Just have secure defaults, like authentication, how many times do we have to learn this lesson...

</comment><comment><USER83> Isn't it creepy that People Data Labs, "a data aggregator and enrichment company", collected data on 1.2 billion people?

Isn't it exactly what GDPR came to prevent? Are there no Europeans among this group?

</comment><comment><USER84> Welp, time to change all my passwords, maiden names, and friendships.

</comment><comment><USER85> The IP address in question does not seem to be working at this time. Clearly whoever runs the server has shut off access. I wonder if someone managed to save a data dump somewhere?

</comment><comment><USER86> Unless we go after every customer who used the services of PDL, nothing is going to change. We will see a $3 fine per individual after 1 or 2 years of talking about this.

</comment><comment><USER87> When will people start going to prison for stuff like this?

<comment><USER88> For what? For scraping public data?

</comment></comment><comment><USER89> "including close to 260 million in the US."

So basically, _everyone_ in the USA minus those not online. And I bet this will go unreported by the mainstream media.

</comment><comment><USER90> Is there any way to see what data they had on me?

</comment><comment><USER91> "1B" is a surprisingly bad abbreviation here, considering its resemblance to a much ... less impressive number.

</comment><comment><USER92> Ugh. To whomever is currently wasting their time and effort on differential privacy, take a good long look.

<comment><USER93> Why? Interested in why you think differential privacy would make any difference... The fault here seems to be an open es server.

<comment><USER92> That is precisely my point. Differential privacy would NOT make any difference, and I was pointing the many folks who are working on it to the much simpler issues that are in fact being encountered in the field. This past IEEE S&P had quite a few theoretical privacy talks.

</comment></comment></comment><comment><USER94> Is this public facing information that's been crawled, collected, and categorized?

</comment><comment><USER95> Is it illegal to download/scrape data from a wide open database like this one?

</comment><comment><USER96> I just had a look at "my" data on this and it is almost hilariously wrong.

<comment><USER97> Where can we look up our data?

</comment></comment><comment><USER98> To check if you're affected use haveibeenpwned.com

</comment><comment><USER58> does anyone know how we can search the data to find info about our (more than likely) entries in this database? or did they simply find it but not release the info?

<comment><USER99> Not the aggregate data set, but one of the two data sources (People Data Labs) offers free access for under 1,000 searches per month.

</comment></comment><comment><USER100> Does this mean we don't need to do a census any more?

</comment><comment><USER101> It would be a shame if someone corrupted these ES indexes.

</comment><comment><USER102> >According to their website, the PDL application can be used to search: Over 1.5 Billion unique people, including close to 260 million in the US. Over 1 billion personal email addresses. Work email for 70%+ decision makers in the US, UK, and Canada. Over 420 million Linkedin urls Over 1 billion facebook urls and ids. 400 million+ phone numbers. 200 million+ US-based valid cell phone numbers.

Too bad there aren't any laws regulating this sort of private data aggregation and sale. Well, besides GDPR (which apparently isn't enforced) and CCPA (which won't be enforced either.)

</comment><comment><USER103> Let me make sure I understand: If I take gigabytes of "enriched" personal information and make it available to the public for free, then I'm an irresponsible, idiotic, incompetent buffoon. But if I put a paywall in front of it and sell that same data for a fair price, then I'm a business genius?

Seems to me that if the data is legally acquired and can be legally distributed, doing so at a cost of zero does not constitute a data leak. It may be bad business, but since when is that a crime?

</comment><comment><USER98> that IP:9200 address is down, any mirrors?

</comment><comment><USER104> where cam i download the leaked data?

</comment><comment><USER105> Data Enrichment Companies. Marketing speak for highly vulnerable privacy eradication service.

Vote #1 for some sort of global GDPR where these businesses are no longer profitable.

</comment><comment><USER106> Can I do a GDPR request for the data about myself? How?

<comment><USER26> >Can I do a GDPR request for the data about myself? How?

And send it where? It's unclear who owns this server

<comment><USER106> People Data Labs?

<comment><USER107> From the article it seems that you can just create a free account and query your own name.

> In order to test whether or not the data belonged to PDL, we created a free > account on their website which provides users with 1,000 free people lookups

</comment></comment></comment></comment><comment><USER108> I wonder how high the GDPR fine will be.

</comment><comment><USER109> Is Elastic going to be punished under GDPR especially given that it's a Dutch company?

<comment><USER46> That is a terrifying thought with terrible chilling effect should somebody official would even voice this thought in any way.

<comment><USER109> Was this an AI-generated sentence?

</comment></comment></comment><comment><USER110> There's a video at [https://www.youtube.com/watch?v=VNLEEogFo18](https://www.youtube.com/watch?v=VNLEEogFo18) where People Data Labs' chief executive speaks at an insurance conference this year about their business.

They describe the data as being sourced from a 'data co-op' of over 1k companies which share data. It wasn't clear whether that means that those companies are collaborating and pooling data, or whether it's a roundabout/wordy way of saying that they scrape public personal information from thousands of sites.

They also claim that they're GDPR and CCPA compliant; I'm no expert but I do find one or two references that seem to suggest that scraping EU citizens' personal data without consent hasn't been GDPR-compliant for some time.

It does also raise another question: even if PDL themselves aren't GDPR- compliant, would any resulting fines against them reclaim a significant portion of the utility captured from the distribution of that data? As per comments on this thread, PDL API keys seem to be free to create.

Hypothetically speaking it could be within the interests of a group of businesses to provide a small amount of funding towards operation(s) that harvest and redistribute personal data: if the revenue base is low, the operation(s) can eventually fail (once legal proceedings catch up with them) and the group as a whole incurs little cost.

The speaker also takes a question from the audience regarding potential use- cases for this kind of personal data, and answers that knowing about an individual's life events (such as marriage) can be an opportunity to sell products to them, as can differentiating pricing if they'd just started smoking cigarettes.

Although I'm no expert, my understanding of insurance has been that risk is spread across a large pool of customers, allowing them each to pay similar premiums despite potentially slightly different backgrounds, with the understanding that they mutually benefit by paying into a shared fund so that the (random, potentially high-cost) risk of loss to each member is greatly softened.

We're seeing a situation here where more precise, per-individual data is being collected across large populations and could potentially be used for price differentiation.

If the insurance industry doesn't defend itself, this could lead to premiums which are essentially calculations based on 'pre-existing data' \-- information which the consumer may not have consented to sharing, and which an insurance company might not be able to collect from application forms.

We don't seem to be particularly good, collectively, at escaping from cycles which seem to introduce or further wealth disparity at the moment and I worry that this kind of tech-driven attempt to optimize revenue efficiency of the insurance industry would only lead to further inequality.</comment>


Show HN: React-redux-async-hooks: A package to track redux async action states - <AUTHOR> https://github.com/KevinZhanglulu/react-redux-async-hooks <comment><AUTHOR> Implement three custom hooks: useIsAsyncPendingSelector, useOnAsyncFulfilled,useOnAsyncRejected</comment>


California Wildfires: Inmates Are Risking Their Lives for $2 a Day - <AUTHOR> https://www.newsweek.com/california-wildfires-inmates-prisoners-firefighters-1061905 <comment><USER2> _Inmates ... are allowed to volunteer for the firefighting program and are trained for two weeks in fire safety... Once the exam is passed, prisoners are sent to live in one of 43 low-security field camps throughout the state._

 _Inmates do recognize that there are perks to the job. Their outdoor camps allow for more freedom. The food is better and grown in on-site gardens. Families are allowed to use barbecue pits for their visits and can often spend the night in nearby cabins._

It's voluntary, gives inmates a change to spend outside time in low security environments (potentially seeing family), gives them a break from monotonous prison environments AND gives them 2 days off their sentence for every one day served. Not sure how this voluntary labor with significant benefits for an inmate is equivalent to slavery.

<comment><USER3> > _It 's voluntary and gives inmates a chance to [...]_

Bullshit. Nothing is truly voluntary when you are in a situation of such extreme power imbalance. Other things that are voluntary in name only: pleading guilty because the DA made you an "offer you can't refuse"; working in a prison-run sweatshop for a fraction of minimum wage; buying basic necessity goods at a huge premium from the prison store.

> _Not sure how this voluntary labor is any worse than involuntary community > service._

You are correct, they are equally terrible.

<comment><USER2> I mean, should there be an equal power balance in prisons...?

<comment><USER3> > _I mean, should there be an equal power balance in prisons...?_

I think a better question is "should inmates be protected from the risk of abuse created by extreme power imbalance? And if so, where do we draw the line as a society?".

My answer to the first question is yes, they should be protected.

My answer to the second question is: respecting the universal declaration of Human Rights and the US constitution would be a great start.

<comment><USER4> It's voluntary...they receive training, see family, get time knocked off, serve the community/others.

Dare I say it actually sounds like a rehabilitation program.

Of course it's very easy to criticize on a forum behind a screen. So tell us how you have personally helped a prisoner combat the extreme power imbalance you observe beyond criticizing existing programs.

<comment><USER3> > _Of course it's very easy to criticize on a forum behind a screen. So tell > us how you have personally helped a prisoner combat the extreme power > imbalance you observe beyond criticizing existing programs._

Yes, it's very easy to criticize behind a screen. In some cases, people who do it too much even develop an extreme sense of entitlement, and start acting like the world owes them a response to even the most ridiculous demands. Although I have noticed that it's mostly white men who develop this issue - excessive entitlement is a common side effect of excessive privilege.

<comment><USER4> Asking someone for more than criticism of a topic isn't criticism or entitlement, it's engagement.

If I were to have blindly said the program is more than you have ever done for the encarcerated, without knowing your experience, fine, but I didn't do that.

I personally have served as legal counsel to untold numbers of detained immigrants and criminal defendants. I coordinated the legal representation of all the Haitian minors in the 2008 Hallandale Beach Haitian boat crisis. I have made complaints against guards in the Chrome Detention Center for referring to my client as a bitch in front of me specifically referencing my clients physical appearance as a result of a hormone imbalance that gave my male client breasts. I have filed motions for fraud upon the court against the chief broward county prosecutor against the interests of my own career. I know a thing or two about the system and the ugliness of the system, and tried engaging you and your generic response about declaration of human rights and the constitution to support your criticism of this program. And your response is to lash out against white males because their excessive privilege and suggesting my _demand_ is ridiculous, that's very interesting.

<comment><USER3> It's great that you did all these things. But it doesn't make your demand any less bizarre and entitled. If your experience made you wise and knowledgeable, by all means, share your wisdom and knowledge with us! So far all I'm seeing from you is this bizarre "credentials contest".

<comment><USER4> As I stated before my experience and knowledge of the realities of the system suggests this sounds like a rehabilitation program.

On the other hand I haven't mentioned my credentials...I mentioned some small bit of my first hand experience in relation to the topic of encarceration and power imbalance.

My wisdom, if any, suggested to better understand your point of view I'd ask about your experience...I never knew trying to understand someone by asking about their experience was a bizarre entitlement and privilege of the white man. It's funny though my encarcerated clients have always been more than happy to share their experiences with me, their experiences that lead to encarcerated, their experience being encarcerated...and they were always happy to ask about mine.

<comment><USER5> It could be rehabilitation, if they were actually able to work as firefighters after serving their sentence.

Also, I am concerned by the lack of death benefits for the families of those that die. It's a pretty clear statement that their lives are nearly worthless.

Indirectly telling someone their life is of very low value, then putting barriers in the way of them returning to work and society after they have served their debt to society does not sound like rehabilitation to me.

<comment><USER4> There is a lot there.

Lack of death benefits/life insurance speaks to a much broader issue facing most non-incarcerated individuals, including, many with high risk jobs. However, if they have the resources the family could take out life insurance policies, and even if waivers are signed if the program was negligent in training or providing faulty equipment to the participants then the family/heirs have access to courts and lawyers take wrongful death cases on contingency. For example, look at Walmart, using sophisticated computer systems they take out life insurance policies on their employees (including minimum wage workers on food stamps/SNAP) and cash in when the employees die and give the families nothing.

Whether they participate in this program or not, it is true there are barriers in place to a living wage for people transitioning out of incarceration. Again I'd say the reality is there are many barriers for people who have no criminal record to getting a job. The question might be does this program hurt them from getting a job...well obviously if you die yes, but otherwise, it can only help. Personally I don't think it's society or the _system_ , it's individuals in the companies making decisions with the reality of the number of people competing for the same job...despite low unemployment numbers I believe all potential employees are low value.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Title is intentionally inflamatory (no pun intended). It's a voluntary system, for which they get $2/day plus $1/hr, get to live in a low security camp with more freedom than prison, and get 2 days off their sentence for every day they're working.

I'm not saying it's enough, or good or bad, but to claim that it's only $2/day is just being willfully ignorant, and really gets in the way of leading any real discussion on what the propert pay should be for prison labor.

</comment><comment><USER7> A lot of the comments here suggest that, because participation is voluntary and because there are other incentives, like spending time outside, reduced sentences, etc, this practice is unquestionably fine. For me, the thing that makes it ethically complex is precisely that there are strong incentives for the prisoners to engage in risky, difficult work. Would you apply the same logic to people engaging voluntarily in affairs with powerful superiors?

<comment><USER8> I worked as a seasonal firefighter for 6 years as I paid my way through college, at the time it was called California Dept. of Forestry (CDF) now California Dept. of Forestry and Fire Protection (or Cal Fire). I worked alongside the very hardworking inmate handcrews many times, their work like mine was difficult and risky yet we both chose to be there.

I made great money for my skill/expertise at the time _, there isn 't much I could have done with my summers that would have benefited me more, so there was a strong incentive for me to go back every summer, even given the inherent risks. I think an argument could be made that for many inmates, the benefit of a reduced sentence is similarly worth the risk, the payout in accrued daily/hourly time is just another bonus.

The article mentions not being able to be employed as a firefighter once they are released. This is (or at least was) false, there is (was) no requirement for an EMT and I personally worked with a former inmate as a firefighter and he's a captain now. I've talked to these guys/gals several times and they were all very happy and proud to be there, they had to be on their best behavior to stay and it was certainly a privilege for them.

Seriously though, these guys/gals work HARD! They are called handcrews because they use hand tools (chainsaws, axes, Pulaskis, McLeods, etc.) to cut fireline, this is by far the hardest thing I have ever done and they do it for hours in hot and smokey conditions. When we would see an inmate crew coming, it made our day and we were all very thankful for them.

_ Note, my hourly pay wasn't actually great, but during fires I racked up tons of overtime. It probably isn't too much different than locking an McDonald's employee in for weeks at a time, but having to pay them for the entire time they were there.

</comment></comment><comment><USER9> Inmates can choose to do this. Considering that, I don't have a problem with this at all.

</comment><comment><USER10> I assume firefighters are not unionized in California? Otherwise I imagine the union getting pretty upset that unskilled, non union members are being paid to do the job of union members.

<comment><USER11> That's a pretty bad assumption. . .

<comment><USER10> I guess I should have said... I assume the firefighters they are working beside are not unionized. I've never seen a union allow un-unionized workers do the job of one of their members.

</comment></comment></comment><comment><USER12> $2 + 2 days of freedom

</comment><comment><USER13> I would wager some HN karma that people that are libertarian (classical liberal) likely see no major issue with this practice.

<comment><USER14> libertarianism contradicts classical liberalism

I think this is where I read the best argument for this ([https://chomsky.info/government-in-the- future/](https://chomsky.info/government-in-the-future/)) but I might be thinking of a different essay

<comment><USER13> For obvious reasons libertarianism has multiple meanings. Chomsky is close to anarcho-syndicalism (left) whereas what we commonly call Libertarian today is close to anarcho-capitalism (right). Relating to the article, the inmates are making a choice without direct use of force against them. Libertarians view this choice as voluntary.

</comment></comment></comment><comment><USER15> "See that's that privately owned prisons Get your piece today They prolly all in the Hamptons Braggin' 'bout what they made Fuck you and your Hampton house I'll fuck your Hampton spouse" \- Kanye West</comment>


Pakistan's stockmarket - The world's most dangerous haven - <AUTHOR> http://www.economist.com/displaystory.cfm?story_id=10567602&fsrc=RSS

<comment><USER2> current value = risk x potential value in the future

The more risk you are willing to take the greater the potential return.

And the risk in Pakistan seems to be pretty huge...</comment>


Grive: Open Source Google Drive Client For Linux - <AUTHOR> http://www.webupd8.org/2012/05/grive-open-source-google-drive-client.html

<comment><USER2> Thank you. When the "DriveForLinux" grumbling and whining started, my response was simple: "Since when do we whine about things and not just do it ourselves?" The response I got back was mostly "because [insert excuse]."

I'm not in a position where I could've done this (openly), or helped. (Contributing to open source is in a contractually grey area for me... may become my employer's property, so I avoid it. [Yeah, yeah, because [insert excuse] ;) ] So I'm happy to see somebody step up and do something. Sure, it's not full-service. But it works.

So again, thank you to those responsible. Maybe now El Goog will decide to release their Drive client for Linux.

<comment><USER3> You should move to California, where contracts aren't able to enforce that should you work in your own time on your own hardware.

<comment><USER4> Can you elaborate? What ruling was this, and how do they define "own time"?

<comment><USER3> [http://www.leginfo.ca.gov/cgi- bin/displaycode?section=lab...](http://www.leginfo.ca.gov/cgi- bin/displaycode?section=lab&group=02001-03000&file=2870-2872) In my limited understanding, that should allow you to continue to work on open-source projects on the side. Personally, I generally use it as leverage to get more reasonable language in my contracts at time of signage, but that seems unnecessary.

</comment></comment></comment></comment><comment><USER5> It's cute. It builds easily (albeit with cmake, sigh...). It's a single binary. The usage is straightforward if a little primitive (run it in a directory and it will sync that directory to the cloud).

It's very much not dropbox, but it's not bad.

</comment><comment><USER6> The project page: <https://github.com/match065/grive>

</comment><comment><USER7> Open source...interesting...so one could jam an encryption layer in between. Make use of the free storage w/o privacy & security issues.

<comment><USER8> The synchronization software doesn't need to be open-source in order for you to throw, for example, EncFS into the mix. Open-source might make integration easier, though.

In either case, you will lose one of the most powerful features of Google Drive, which is that you can search and edit your documents online.

</comment></comment><comment><USER9> A FUSE filesystem interface would be the best, so you can mount it

<comment><USER5> Difficult: the Google API doesn't seem to support random access to files, only whole downloads. So you'd need a caching layer to buffer any changes, prefetch, etc...

And even then, it would be catastrophically slow for true random access. Note that even Dropbox isn't implemented with FUSE; it just watches your ~/Dropbox folder with (presumably) inotify.

<comment><USER8> Both Dropbox and Google Drive keep a local copy of all your files unless you explicitly tell them to sync selectively. Your local filesystem _is_ the cache, so there is no need for random access to remote files. FUSE would be not only slow but also completely unnecessary for this use case. inotify is exactly the right tool for the job.</comment></comment></comment>


Three Things about the Back-End that Front-End programmers need to know about - <AUTHOR> https://medium.com/@peterbsmith/three-things-about-the-back-end-that-front-end-programmers-need-to-know-about-74c9f15963a2 <comment><USER2> #4 - You will, eventually, need to learn some back-end code.

November of last year, I began re-designing my site to use AngularJS / Firebase. After looking at some examples, I fell in love with the live updating of the data, single page design.

In July it went live.

And now, on the edge of October, I find myself writing pieces in PHP / MySQL and accessing them via a http request to do any number of things from querying user data, to sending email via Mailgun, to triggering a Twillio message.

Pick a language / database - doesn't matter if its PHP or Ruby, MySQL or Postgres - but learn 1 of each - I still love and use Firebase, but it's no good if I can't perform the simplest of queries like "select * from users where school_id=x". No fancyness on the frontend will negate the power of a properly formatted sql statement.</comment>


Ask HN: What odd/unusual/funny software licences have you come across? - <AUTHOR> Two that come to mind for me are the Do What The Fuck You Want To Public License:[0]
0. You just DO WHAT THE FUCK YOU WANT TO.
and Floatator's (a fluid dynamics simulator) licence[1], in part:
The purpose of this program is to remember the great days of my relationship with a person I was deeply in love with long time ago. By using this software, you implicitly declare your condolences about this breakup.
[0] http://www.wtfpl.net/
[1] http://floatator.cichon.com/ <comment><AUTHOR> Well, it seems this was immediately removed from public view. Why?

<comment><USER2> It's hard to know what you mean by "immediately removed from public view." As of this writing, it's got its initial single vote.

From the FAQ:

> _"How are stories ranked?"_

>. _"The basic algorithm divides points by a power of the time since a story was submitted. Comments in comment threads are ranked the same way."_

> _"Other factors affecting rank include user flags, anti-abuse software, > software which downweights overheated discussions, and moderator > intervention."_

In general, it's better to contact the mods directly via the contact link in the footer if you Have questions like this. They're the only ones who can provide a definitive answer.

<comment><AUTHOR> Thanks :-) Yeah, I've read that stuff. I meant, after about 2 seconds it disappeared from the Ask page(s), couldn't find it anywhere. I'm not sure how else to describe that. Maybe having 2 links triggered auto-removal? Well, must have been, I guess, it was a matter of seconds.</comment></comment></comment>


HandmadeCon videos – game programmer interviews - <AUTHOR> http://www.twitch.tv/handmade_hero/v/28507308 <comment><AUTHOR> HandmadeCon is a small convention where Casey Muratori (of Handmade Hero) interviews game programmers. What I enjoyed was the way Casey drives each interview deep into the gory details of gamedev - how they did their asset pipeline, how their builds worked, how their networking handled errors, etc. Great stuff.

Videos:

00:02 - Tommy Refenes (Super Meat Boy)

01:20 - Mike Acton (Insomniac Games, Ratchet & Clank..)

03:05 - Pat Wyatt (Warcraft, Diablo, Guild Wars..)

04:27 - Jonathan Blow (Braid, The Witness)

06:01 - Ron Gilbert (Monkey Island, Maniac Mansion..)</comment>


Annoying Things that VCs say or ask (and how to think about them) - <AUTHOR> https://elizabethyin.com/2019/05/17/15-annoying-things-that-vcs-say-or-ask-and-how-to-think-about-them/ <comment><USER2> This is a good list with some good advice.

As a personal anecdote, I had a very well-known investor tell me that my business would never make more than $5m per year (not venture scale). And this was even knowing that my business is a pretty standard enterprise software business model. We are well past that at this point, so I am proud to have proved him wrong.</comment>


The Case Against Reality(2016) - <AUTHOR> https://www.quantamagazine.org/20160421-the-evolutionary-argument-against-reality/ <comment><USER2> The concept "illusion" presupposes an independent reality by which to distinguish such perceptions. His whole argument is a form of the fallacy of denying the validity of the senses.</comment>


Show HN: I made wits.io where writers can earn money with book summaries - <AUTHOR> https://www.wits.io/contribute <comment><USER2> Why are only 50% of _profits_ (not even revenue) redistributed to contributors? The content creators are the ones adding all of the value to your website.

Or am I reading it wrong and that is ON TOP of the revenue they get from engagement?

Either way, nice website.

<comment><AUTHOR> Its just a start... I wasnt sure about the number hence started with 50%.... I can bump it to a bigger number... What makes sense? 70/30... or 80/20? or 90/10?

<comment><USER3> I would go with 85/15\. This is what Skillshare used to charge (15%) when they had in-person/live classes marketplace. I think it's pretty fair. Good luck!

<comment><AUTHOR> Done. Its now 85/15 :)

<comment><USER4> I know its only a few minutes since the change, but the contributions page still shows 50%. Edge Caching?

<comment><AUTHOR> Can you please try again. Should be fixed by now.

<comment><USER5> [https://www.wits.io/writer](https://www.wits.io/writer) says 85% but [https://www.wits.io/contribute](https://www.wits.io/contribute) still says 50%.

<comment><USER4> yes, the linked/submitted page is /contribute, and it still says 50%

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> "1,337 people have signed up so far."

Is that just boilerplate or was I really lucky?

<comment><USER7> Looks boilerplate.

<comment><AUTHOR> naah... its real... maker here.

</comment></comment></comment><comment><USER8> I had an idea to do something similar but with the following differences:

\- publishers could submit either text _or_ audio

\- publishers could choose between summarizing the entire book, or each chapter

\- the app would have a kind of "marketplace" where summary writers could link up with audio producers. This would be helpful for (a) people who want to publish both written and audio summaries but didn't have audio knowledge, and (b) people who want to monetize their audio capabilities but don't necessarily know any books to summarize.

Feel free to steal my ideas. I _reeaaalllyyy_ want an app where I can find decent long-form podcast-style summaries of non-fiction books that I don't have the time to read.

<comment><AUTHOR> Thanks so much. Audio summaries are such a great idea that I never thought of before. Once I have couple of writers/authors I will throw this idea on them.

<comment><USER8> yeah just stream it like spotify and then charge a monthly fee. I'd throw my money at that.

<comment><AUTHOR> Audio is going big everyday, so definitely I will look if I can make something there.

</comment></comment></comment></comment><comment><USER9> If a book's ideas can be absorbed in 15 minutes, was it ever really a book?

I've seen these business summaries on offer elsewhere--it always struck me as an approach to signaling, not learning. In this model the "reader" can manufacture the appearance of knowledge of a subject without taking the time to invest oneself in it. Or perhaps now the books even manufacture the appearance of knowledge while being tiny ideas unworthy of serious consideration.

I think if I was working with anyone who used a service like this though, I would have second thoughts about them. Isn't this just trend-chasing dressed up as knowledge acquisition?

<comment><USER10> Sunmaries are not there to prevent you from reading a book, but to highlight which books are worth reading.

Most books spend about 80% of the content defending an idea. Something like 33 Strategies of War can easily be summarized into 15 minutes, but it will lose its charm, as the book relies on historical storytelling to get its points across.

</comment></comment><comment><USER11> Holy sh*t. No kidding. I just made [https://booksummaries.me](https://booksummaries.me) based on the idea that publishers summaries could also give a good idea especially the videos where they talk about the general idea behind the book.

Take it for a spin y'all - [https://booksummaries.me](https://booksummaries.me)

<comment><USER12> I get the desire to post this here, but perhaps it would be more appropriate to do your own Show HN instead?

Also, I looked at the reviews on the first book you have listed (Crazy Rich Asians), and many of them are pure gibberish. Like not even real words. Shouldn't be too hard to clean that up, and it'll make the site look a lot more credible when you do.

</comment></comment><comment><USER13> Don't know if this is helpful, but Derek Sivers has a giant review page of all the books he has read. Maybe wits.io competes with this by better reviews, maybe not. In any case, I'm putting this here for all interested parties: [https://sivers.org/book](https://sivers.org/book)

</comment><comment><USER14> No terms of use, privacy statement ? About us ? So who are you and why would anybody trust you ?

<comment><USER15> He is from Balochistan, Pakistan terrorized area and an entrepreneur. Be easy on him, he will add it soon.

<comment><USER16> What does him living in Pakistan have to do with anything? How do you know this?

<comment><AUTHOR> Totally :) Thanks to Stripe Atlas I am able to build this website and try to make a business out of it.

</comment></comment></comment></comment><comment><USER17> I've been using [Instaread][[https://instaread.co](https://instaread.co)]. I find it to be a pretty good source of high quality book summaries, which you can read or listen to.

</comment><comment><USER18> Awesome idea! Apparently I hesitated as there was no trial or anything. I have no idea what I can expect or how good the quality is. But really good selection of books for HN.

<comment><USER10> Yeah, I think there should be a few books in a "free tier" section. Maybe very popular books like the 4 Hour Workweek or Lean Startup.

Then leave the rare content for membership tier. There is a 7 day trial, but it's a huge turn off as I'd just procrastinate and never look at it properly.

Blinkist would put their low quality books in the free tier, which was also a turn off.

<comment><AUTHOR> I thought about it a lot about putting a free tier... but the work that needed to be done (code) is not there yet... for sure will add the free tier section where you can read at least couple of books for FREE

</comment></comment></comment><comment><USER19> I would like to see a sample. I am, also, annoyed a little by the three "Apply to contribute" and the "Write & make money", all on the same page.

</comment><comment><USER20> For more context, check out [https://wits.io](https://wits.io) and [https://www.producthunt.com/posts/wits- io](https://www.producthunt.com/posts/wits-io)

From their website:

Weekly summaries of great books recommended by founders and makers

Cut through the BS and get 10-15 minute book summaries sent to you, weekly. Become a more creative and innovative individual each week.

<comment><USER21> If a book can be summarized in 10-15 minutes and the rest of the book was worthless "filler", I wonder whether or not that's the sort of book worth summarizing in the first place.

<comment><USER10> Most non-fiction books usually spend about 80% of it explaining a concept.

Book summaries will tell you what the concept is, but not why it works or how they defend it.

The book Outliers has some very bold concepts - the 10,000 hour rule, as well as justifying that underdogs are usually the winners. These are easy to claim, hard to defend, and you have to read the book to understand it.

<comment><AUTHOR> Totally. Hence the summaries. If you like the summary of a book so much you can always go back and read the book. The summaries are not meant to stop you from reading books.

</comment></comment></comment></comment><comment><USER22> UX comments: 3 buttons on a page which do the same, is very confusing. And then the button in the corner, what does it do? Also, what will you do with this content? Examples? I am interested in the project but as a reader, not a contributor writer.

</comment><comment><USER23> Just curious, how does copyright work in this case? To summarize someone's book (especially if we are selling the summaries), don't we have to get permission from the book's authors?

<comment><USER24> No. The ideas and the knowledge in the book don't fall under copyright, the concrete expression does.

But the more interesting point is how they use the names of well-known people. They try to pass Elon Musk and Bill Gates off as affiliated with their site.

I'd say there's a pretty good argument that this is illegal and could be shut down hard.

<comment><USER23> Cool. So I can take your book, summarize, sell the summary without having to get your permission first?

The same thing is true for podcasts etc then? Say, I summarize 2 hour podcast into 15 mins?

<comment><USER25> Writing down your thoughts and selling them is perfectly fine and legal in most places. Even if those are thoughts you had after reading a specific book and those thoughts are about the content of that book.

</comment></comment></comment></comment><comment><USER12> Is there a way to contact you directly? Didn't see anything on the site or in your HN profile.

<comment><AUTHOR> Hi there! Yes but when you signup for trial under FAQ.

</comment></comment><comment><USER26> "Whenever a wits.io member likes your book summary, you earn money."

What is your business model?

<comment><USER27> Subscriptions: 5$/month, 49$/year (I am not the creator)

<comment><AUTHOR> Thanks. This is right. $5/month and $49 a year. I havent really figured out the details of profit sharing with authors yet... Which I will do once I have some people willing to contribute and after checking whats fair.

</comment></comment></comment><comment><USER28> I love the simple design and look of the site. Did you do that yourself?

<comment><AUTHOR> Yes. But I am not a designer at all. I have looked at different sites over time and tried to incorporate what I liked there and made sense for wits.io

</comment></comment><comment><USER29> Where can I buy those summaries?

<comment><AUTHOR> You can subscribe to wits.io</comment></comment>


Windows 10 Calculator is now running on WebAssembly, natively on iOS and Android - <AUTHOR> https://platform.uno/a-piece-of-windows-10-is-now-running-on-webassembly-natively-on-ios-and-android/ <comment><USER2> So looking at [https://calculator.platform.uno/](https://calculator.platform.uno/)

\- 84 HTTP requests

\- 10.2 MB transferred

\- 51.9 MB in decompressed assets

\- 23.44 seconds to start the application.

For a calculator, these are pretty extreme numbers.

<comment> jeromelaban-nv dev here - this app is based on mono-wasm, which uses the very young support for AOT compilation from .NET IL to WebAssembly. There are limitations in WebAssembly (namely the lack of support for exceptions) that force the mono codegen to add a lot of weight to respect the .NET semantics. The rest is what it is because mono-wasm still is in the "make it work" phase.

23s, especially if it is the second run where the wasm is cached, to start the application is very high though. It should be below 4s (which is still high) on a desktop class machine. Was that on an Android phone by any chance ?

<comment><USER2> Chrome, OSX, Macbook Pro (2018). I retried today and it took 30 seconds, looking at the Network tab.

</comment></comment></comment><comment><USER3> This is pretty incredible work.

I'm curious to hear how well Platform Uno works in practice with real world projects. The demos are quite impressive.

I always thought that UWP was a much nicer platform to develop for than Android. It's a shame that Microsoft's mismanagement pretty much killed Windows Mobile as a viable platform.

</comment><comment><USER4> This is like the opposite of KISS.

</comment><comment><USER5> If only it could load a bit faster. To mask that time, you can use the load progress screen.

</comment><comment><USER6> I think it is pretty impressive and I want to know more about porting UWP apps to WebAssembly.

</comment><comment><USER7> Why does a calculator needs Network Permission? (atleast on the Android version)

<comment> X-Cubed It's capable of currency conversion and pulls the latest rates from a web API.

</comment></comment><comment><USER8> Did they remove the telemetry?</comment>