0day vulnerability full disclosure: American Express - <AUTHOR> http://qnrq.se/full-disclosure-american-express/ <comment><USER2> Typing this up in real time ...

I called American Express Australia to report the defect & I was transferred through to the American call centre.

The CSR to whom I spoke transferred me through to a different department, after I explained that I didn't have an account. She did ask whether "I received an email" which I assume was some sort of inquiry as to whether I had been phished.

I then spoke to an online services rep., who after asking for my card number, listened to my report. She then put me on hold.

(The call had taken 10 minutes by this time).

After a few more minutes on hold, the CSR came back on the line, asked me to repeat the information, and confirmed for the umpteenth time that I don't have an American Express card. I explained that it wasn't my find, but that it had been published online & so was by now _very_ public.

(15 minutes by this time, most of that on hold listening to advertising for American Express, including some ironic praise for their website).

CSR comes back on the line. She's spoken to her 'technical team' who assure me that there's nothing insecure going on because it's all over HTTPS. So I politely walked her through the process - visit the page, add ?debug to the URL, click the admin link & behold: lots of should-be-secure stuff.

At this point she thanks me profusely, & asks that I hold while she speaks to her supervisor. Back to the American Express ads ...

(20 minutes at this point).

The CSR came back on the line, thanked me again, & said that her supervisor had taken a screenshot of the issue & escalated it. Job done.

So, yeah, I can totally understand the frustration experienced by the guy who discovered the vulnerability. But it certainly wasn't impossible for me to report the issue, & I'm in Australia.

<comment> T-hawk Do remember that for every real serious problem such as this, American Express and any other large company receives a hundred or a thousand calls for non- issues like phishing or minor issues like a compromised card number to cancel and reissue. The system is optimized for these common cases; the edge case of a real public vulnerability will require extra effort and it's not a failing of Amex that the system is so.

<comment><USER3> when the cost of a false negative is so damn high, you'd think they would know not to filter so aggressively

<comment><USER4> at some point, all the people dealing with the false positives will be costlier.

<comment><USER5> Seriously? I won't take American Express anytime soon, I can tell you that. If this gets picked up in mainstream media, it is devastating.

<comment><USER6> More likely: people will be assured the problem is fixed, and then not care.

</comment></comment></comment></comment></comment></comment><comment><USER7> Some years ago when I was doing more stuff in spam and phishing I came across a phishing site for a small US bank. The list of phished card details was available through the interface and it was clear that there were some real people local to the bank who had given their name, address, card number, PIN, SSN, ... everything.

I decided to contact the bank. After filling in the form for contact on their web site giving all the details of the site, I did get an email back and eventually I got someone on the phone. This person (who said they were in charge of bank computer security) thanked me and said that they were going to try to deal with it (I had also contacted the school district whose computer was hosting the site to get it shut down).

I then told this person that there were real account details on the phisher site and would they like the list of people's account numbers so they could inform their customer/shut down their debit card etc. The bank officer replied, "No." As far as they were concerned the people who were that stupid got what they deserved.

I was flabbergasted, but couldn't do much to make the bank do something.

So, using the names and addresses of the people from the phishing site I managed to track a couple of them down (they were small businesses whose business addresses were available on the web) and phoned them up so they would be alerted. They took it pretty well considering that some weird British guy was calling them from France to tell them their US bank account details were at risk.

<comment><USER8> A few years back, when "Verified by Visa" first came out, I was taken aback the first time I saw it. It's not at all hard to imagine that you're being phished by this strange page.

I called the customer service number for my Visa card and asked if this was a _real_ Visa card "feature". After spending a couple of minutes asking around, nobody knew what the heck it was.

If Visa has a division that takes security seriously, they certainly need to work hard on the customer-facing aspects of it.

<comment><USER9> VbV has to be some of the worst security engineering I've ever seen. iframe content, arbitrary domain (securesuite?!), trivially guessable or resettable details.

<comment><USER10> And to add on top it _looks_ like a con, the design is horrific.

</comment></comment></comment></comment><comment><USER11> They knew this was open. They even took it out of their robots.txt :)

<https://www.americanexpress.com/robots.txt>

User-agent: * Disallow: /us/admin/ Disallow: /us/heroes/ Allow:

<comment><USER12> I apologise in advance for a lack luster comment, but seeing incompetence on so many levels like this on a monthly basis from financial institutions makes me want to be sick.

This is like putting a sign out the front of your house saying please do not enter though the back window, it's open.

<comment><USER13> I look at this as a good thing. I know that if I am ever injured in such a way as to receive severe brain damage, I'll still be able to get a high-paying programming job.

</comment></comment></comment><comment><USER14> The first three Twitter messages by the vulnerability reporter are:

"@AmericanExpress Who can I contact regarding security vulnerabilities in your system? I'm not available through phone, physical mail or fax"

"@AmericanExpress Just to clarify: I have vulnerabilities. This should be "urgent", so no technical support jungle please :-)"

"@AmericanExpress I've been trying to get in touch with AMEX regarding security vulnerabilities in your system for a while. Who do I speak to?"

I think this is not ideally expressive language when you talk to a lay-person representative on Twitter. I believe a better result could be achieved with simpler and clearer language:

"@AmericanExpress I have discovered a serious security issue in your web system (money can be stolen). Please help me report it to someone responsible."

<comment><USER15> yep, credit that the guy partially tried - but prefacing your first interaction about a serious issue by "I'm not available [to contact through most of the usual communication methods]" is sort of self-defeating.

<comment><USER16> He's reporting a vulnerability on a _website_. It is absolutely reasonable to expect to be able to report it through email, and utterly ridiculous of AMEX to refuse. That's where the conversation ends, not with "well, you should spend your time fighting through these costly and obsolete mechanisms so you can do us a favor".

</comment></comment></comment><comment><USER17> Here's something I learned from AMEX last week ... if one of your cards gets compromised and you cancel the card, AMEX will continue to allow charges to flow through that old "canceled" number to your newly issued number if those charges are coming from a "trusted recurring entity". I discovered that charges were continuing to flow through a number that I'd canceled due to it being compromised even though I thought it'd been nullified. AMEX explained that their policy is to allow these charges to continue, and it took a number of months before I caught the problem because the charge was coming from a business I continued to have business with. Apparently the person that stole my number had setup a recurring charge with this business as well. To their credit, AMEX removed all of these charges even though they spanned a number of months ... but it caught me completely by surprise that a number I though was canceled was still allowing charges to flow through it.

<comment><USER18> I have an AMEX card that expired in 2007 and it is still successfully charged by AWS each month. Apparently, it's a big pain to get customers to re-enter new payment details when cards expire, as a result I believe merchants are often allowed to charge to cards that have long since expired.

<comment><USER19> I was once very close to a server (that was in active use) getting disconnected/wiped by a hosting provider because my CC expired, and their mail to inform me of that got lost.

Only figured that one when the site went offline, didn't come back, and I started bitching at their support.

So I have some sympathy for the CC company being lax with recurring charges on expired cards. Would be a nice service if they went ahead and called you up in such a situation.

<comment><USER20> One would think it would be common sense to double check recurring charges to a canceled card with the account holder. Then again, when have financial institutions ever followed common sense..

</comment></comment></comment></comment><comment><USER21> The author should have contacted the email addresses given in the DNS WHOIS (email@example.com, email@example.com) and the obvious aliases (security@...).

However I can understand and sympathize, it's enraging how hard it is to get into contact with a person of any kind at certain companies (KLM/Air France, I'm looking at you). I understand they want to save money, but if you run a business, you have to be contactable in one way or another. And snail mail as the last option really doesn't cut it in the 21st century.

<comment><USER22> Extremely hard to get in touch with Google as well. And you only tend to realise it when something goes horribly wrong - like when your adsense account gets suspended.

<comment><USER23> Yeah, but it's not hard to report a security problem: [https://www.google.com/appserve/security- bugs/new?rl=usrwf3z...](https://www.google.com/appserve/security- bugs/new?rl=usrwf3z65ebo2rey87mtsxmr)

</comment></comment></comment><comment><USER7> Wow. All you need to do to activate this is append ?debug to the main American Express URL: <https://www.americanexpress.com/?debug>

</comment><comment><USER24> When a major company, especially a financial services company, is subject to public security vulnerability disclosures like this, it should really make other companies stand up and take notice. There is absolutely no excuse for these kinds of vulnerabilities to exist on a production system. When Citibank was recently hacked by simply changing the account number in URLs, that should have been enough for other financial institutions to do an internal security audit to make sure they weren't susceptible to anything similar. Don't wait until it's too late. For the sake of their customers I hope this is resolved swiftly.

<comment><USER25> It seems the bigger the company is the more irresponsible they become. In UK in the bank I use, you can activate protection of your debit card / current account (usage analysis, higher insurance), but to do that you need to register with Experian (credit rating company). The process for that is: put your recent bill, bank statement and photocopy of ID in an envelope and post it to them via normal mail.

I decided to ignore that great offer and keep my account secure in traditional way. Apparently ignorance with regards to the internet sites is not what causes big companies to act in stupid ways. It's the whole mindset...

<comment><USER26> I'm pretty sure normal mail is generally quite secure. Sure, there's very little barrier to someone opening your envelope, but perhaps because the ratio of sensitive stuff vs. letters to grandma is so low, I'm not aware of it ever happening much.

<comment><USER25> There's one big difference in those letters though. The letter to grandma will be addressed to a person. The letter with documents for Experian will be addressed to... Experian, which is a known company dealing with money and personal data.

<comment><USER26> True, but the sheer volume of mail makes sorting through it a formidable task. The US Postal Service has sorting capacity like you wouldn't believe.

A criminal could in theory target Experian's mailing address, so perhaps it simply comes down to whether you believe they can secure their property.

</comment></comment></comment></comment></comment><comment><USER27> // don't ask me how exactly, but this gets the main domain froma hostname;

This explains a lot. What I don't understand though, is why this guy, who doesn't understand basic regular expressions (the expression is also wrong), is working on the American Express website.

<comment><USER28> The regex:

// don't ask me how exactly, but this gets the main domain froma hostname;

      var hostArray = /([^.]+(.com))$/

LOL.

</comment></comment><comment><USER29> Next time, I would try reaching their Public Relations group for help. PR people are almost always accessible by name, phone, and email -- they're usually on the bottom of every press release that goes out. They also have good internal channels to every part of the company and know who to contact.

Googling for "american express public relations" turns up a page with three NY-based vice presidents, with direct lines and email addresses listed: <http://about.americanexpress.com/news/media_contacts.aspx>

</comment><comment><USER30> Unrelated, it looks like someone at AmEx finally improved their crazy, broken password system at least, this used to be the password requirement:

 _"Your Password should contain 6 to 8 characters . at least one letter and one number (not case sensitive), contain no spaces or special characters (e.g. &, >, _, $, @) and be different from your User ID."*

Now it's this:

 _"Your Password must be different from your User ID, must contain 8 to 20 characters, including one letter and number, may include the following characters: %, &, _, ?, #, =, -, cannot have any spaces and will not be case sensitive."_

<comment><USER31> Is the "will not be case sensitive" just a typo or do they enforce case insensitivity?! If they do, that's horrendous.

<comment><USER32> Try logging into various sights with a case-flipped version of your password, you'd be surprised(horrified?) how often it works

</comment></comment></comment><comment><USER33> Can someone explain the origin or meaning of the word "hero" to describe primary marketing/call to action sections? I saw it first in the twitter bootstrap code [1], and now here.

[1] view-source: <http://twitter.github.com/bootstrap/examples/hero.html>

<comment><USER34> I'm not so sure about the origin, but it's commonly used in design/UX to showcase one primary or "Hero" product, and refers to a large space front-and- center above the fold on a page. Think apple's site putting up a huge iPhone image on release day (<http://www.sprint.com> is another good example).

I think this likely started in physical product sites and the lingo just stuck.

</comment></comment><comment><USER35> Oh wow, unprotected admin tools and an XSS vulnerability on their main homepage that is used for customer logins. That's pretty bad.

<comment><USER36> The utter lack of a mechanism to report bugs, particularly security bugs, seems far worse.

I've encountered this problem frequently when interacting with various organizations. The pervasive availability of bug-tracking systems and/or bug- reporting email addresses makes the absence of one quite conspicuous.

<comment><AUTHOR> I've many seen organizations applying spam filtering on their email@example.com address, leading to tons of reports ending up in spam boxes without being noticed by the company. The researcher doesn't receive any feedback on his responsible disclosure and multiple reminders, and finally submits the vulnerability to a full disclosure list.

<comment><USER36> Even worse: some businesses apply spam filtering to their abuse@ address, which thus rejects reports of spam as...spam.

</comment></comment></comment></comment><comment><USER25> This is crazy... when you go to the admin panel <https://www.americanexpress.com/us/admin/> you actually get access to user cookies (session ids) which probably allow you to hijack their session (haven't tried it in case it's going to be traced back...)

</comment><comment><USER37> Surely a DM message to the AskAmex account, with some actual details written in clear English, not jargon or "hacker lingo stuff" would have been more suitable? Or asking someone on here like Thomas to make a phone call?

I understand the argument between full disclosure and responsible disclosure, but if the author could have DM'd it on Twitter. Or posted it on Twitter wholesale, since its now public anyway.

<comment><USER38> The operator of the AskAmex account seemed completely clueless on security- related matters. I doubt saying, "visit this URL: [https://www.americanexpress.com/?debug=true&heroOverride...](https://www.americanexpress.com/?debug=true&heroOverride=%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%27%68%61%78%27%29%3c%2f%73%63%72%69%70%74%3e) would have registered as a problem for her.

AMEX made it incredibly difficult for this guy to report the issue to anyone who had the slightest clue as to its severity. Banging his head against the wall until someone finally clued in would not have fixed that communication issue. Full disclosure just might.

<comment><USER37> All the more reason to make as clear and straightforward a declaration as possible. Not "I have vulnerabilities", but a DM saying "American Express is leaking customer information at this URL and it is imperative this is reported to your security department." It's their problem to escalate if they don't understand, but you have to give enough information to make escalation possible.

<comment><USER15> Agreed Robin - it's likely that the person operating the twitter account for most huge companies has minimal, if any, interaction with IT/security and its lingo.

Speak plainly people.

<comment><USER38> How much more plain than "Who can I contact regarding security vulnerabilities in your system" can you get? When she asked what kind of vulnerabilities, would saying, "unsecured admin panel and xss allowing for session jacking and spoofing" really have been more meaningful than what he said? Even saying "unsecured admin panel" on twitter would have sent people scrambling for it. He was attempting responsible disclosure before he turned to full disclosure.

<comment><USER39> Right.

All you guys (not targeted specifically at you here) that say 'He tried it in a clear way': Call one of the lesser technical inclined people in your family/among your friends. Tell them you've just read about a security vulnerability and wonder if they could describe what that is to one (possibly less technical inclined) people in their family/among their friends.

That's essentially what you're looking at if you throw these words at a corporate marketing (with some links to support) drone that needs to fill in his/her supervisors to make anything special happen.

</comment></comment></comment></comment></comment></comment><comment><USER40> It's amazing that such a huge oversight can be made. I hope American Express doesn't try to sue this guy.

<comment><USER41> The admin page is completely unprotected, you don't even get a notice about the system being private. They can't sue him, they wouldn't have a leg to stand on.

To me it looks like somebody left a "DEBUG = True" somewhere on the site and went to the beach :)

<comment><USER42> _They can't sue him, they wouldn't have a leg to stand on._

Why not? I've been clicking around various US laws and have yet to see any mention about a login screen or "Go away, private!" messages being required before it counts as unauthorized access:

[http://www.irongeek.com/i.php?page=computerlaws/state- hackin...](http://www.irongeek.com/i.php?page=computerlaws/state-hacking-laws)

<comment><USER43> The question is, is the disclosure of this (technically public) resource location litigation material?

IANAL, but I can definitely see both sides of this debate being highly defensible.

<comment><USER44> In the US the first time you sue someone can be for any reason. It's only considered abusive if you do it _several_ times without reason.

</comment></comment></comment></comment></comment><comment><USER45> Does going to the url <https://www.americanexpress.com/us/admin/> constitute "computer hacking"? It's not protected in any way, shape or form.

<comment><USER42> _Does going to the url<https://www.americanexpress.com/us/admin/> constitute "computer hacking"? It's not protected in any way, shape or form._

I believe that the level of hacking/cracking required is irrelevant to most laws around the world; if you're not meant to be there, you're guilty of an offence.

I'm sure lawyers could argue intent all day long, but whether or not a logic screen appears is irrelevant.

<comment><USER46> _if you're not meant to be there, you're guilty of an offence._

But how would I know? If someone's private property is not marked as such in any way, would I be a trespasser if I wander into it? Let's say it's part of a field or a forest, not a building with doors ...

<comment><USER42> _But how would I know? If someone's private property is not marked as such in any way, would I be a trespasser if I wander into it?_

According to this page (the first result I found in Google - there may be more reliable information out there), it's not an easy question to answer:

<http://www.ucc.ie/law/odg/messages/060222b.htm>

 _Can trespass to land be committed without fault? The answer should be obvious but I have found it surprisingly difficult to track down. I am referring, not to cases of involuntary entry onto land (there are clear cases saying no liability if you get pushed or fall unconscious), but to the sort of case where you (without carelessness) cross over someone's boundary in the bush (maybe more likely in Australia than the UK!) without knowing it_

<comment><USER47> In Canada there is assumed permission unless no trespassing signs are put up (in the bush you even have right of way, they can't legally stop you!).

Also, in areas where you are legally allowed to hunt the land owner has to put up markings that mean "no, I do not give you permission to hunt" if they do not want you to hunt.

</comment></comment></comment></comment></comment><comment><USER48> This is kind of a cool debug interface. Anyone feel like forking it and putting it on Github?

</comment><comment><USER49> I work at AXP and have escalated internally

<comment><USER50> I'll bet you that reporting this on HN is a more effective way than going through channels.

</comment></comment><comment><USER28> For the longest time, American Express had a password system that only allowed 8 alphanumeric characters and was case-INSENSITIVE.

Moreover, sometimes the AJAX used to submit your payments did not activate, and often, no feedback at all was given if a payment did go through.

This kind of vulnerability seems par for course for their tech team.

</comment><comment><USER19> FWIW, on his homepage there's also a nice small vulnerability in reCAPTCHA. The Google developer who wrote the buggy code actually had to do a hack to shut up PHP warnings about it. Duuuh...

</comment><comment><USER51> The admin page is still there. Amazing.

<comment><USER52> It seems to be fixed: <https://www.americanexpress.com/us/admin/>

</comment></comment><comment><USER53> google + "Amex security response team" = firstname.lastname@example.com

also

[http://www.reddit.com/r/netsec/comments/l2uzj/0day_full_disc...](http://www.reddit.com/r/netsec/comments/l2uzj/0day_full_disclosure_american_express/c2pbt39)

<comment><USER54> Don't you think then that if you asked their customer services via twitter for a way to report a security issue that the customer service rep should have sent that address?

<comment><USER53> Should have? Maybe. But, with corporations that size it's unlikely. I'm not saying this fall entirely on him, but I feel he didn't exactly do his fullest before puling the trigger on the full disclosure.

</comment></comment></comment><comment><USER55> I don't consider telephone contact for security vulnerabilities to be that unreasonable. They should support PGP encrypted email, yes, and have a page about how to report incidents, issue tracking numbers, etc., but it took me ~3 minutes on the phone to get the right info for Amex corporate security.

</comment><comment><USER56> Unfortunately, I've had this kind of difficulty far too often when reaching out to large companies with disclosures. Most recently, the only thing that worked was blasting off an email to all the internal people I could find through google: the CTO, vp of engineering, and head of support were on the list, as were a few lower level employees. The lower level got back to me right away, eager to cc the CTO on their response =)

</comment><comment> eric-hu 08:39 PST: the page says it's removed for me.

<https://www.americanexpress.com/us/admin/>

</comment><comment><USER57> Check out the site now, it looks like this has been fixed. At the very least, not bad response time on their part once they got wind of it.

</comment><comment><USER58> I empathize with the developer, but this disclosure is wildly irresponsible.

It's a pain contacting live representatives at any large corporation. When you're dealing with the financial industry, you should grit your teeth and find a way to do it anyway. If you have no choice, publish a warning about the exploit, but don't release all the details without a long warning period.

<comment><USER59> No. It's about time we stop letting the financial industry get away with incompetence. Every other software vendor would be raked over coals for not having a publicly available security disclosure email address and utterly failing to properly route a request via Twitter.

Responsible disclosure exists so that vendors have an incentive to respond to vulnerability reports in a timely manner. In fact, it is the responsible thing to publicly disclose vulnerabilities so that AmEx learns to implement a proper security reporting process.

<comment><USER60> No. I agree with almost everything you wrote, but this sort of disclosure doesn't punish the company, it punishes its _users_, and doesn't give them an easy way to make the causal connection. Unless this story is picked up by the mainstream media, how are any victims of this exploit to know that it happened because AmEx is incompetent, instead of e.g. because credit cards are risky?

</comment></comment></comment><comment><USER13> So 90 comments and no mention of "didn't he try emailing email@example.com". That would be my first step, not harassing a marketing account on Twitter. Marketing campaigns are often run by third-party companies. Whoever gets security@ emails, not so much.

If you want to inflate your ego, post to full-disclosure; don't annoy people on Twitter and blog about it.

</comment><comment><USER61> Target.com had an almost identical problem on their newly designed site (years in the making).

</comment><comment><USER62> Since AMEX caters to wealthier customers you would think that they would be on top of this kind of thing...

</comment><comment><USER63> Ugh, it would just be easier to sell the vuln than try to inform one of these clueless dinosaur companies about it. I know why companies like Amex build these giant fortresses around their communications, but they should be more cognizant of the damage that can cause.

</comment><comment><USER64> Wow. This is a huge vulnerability. I hope they fix this very soon. The cognitive dissonance going on with that twitter conversation makes me think he was talking to a bot. Also I love the "These cookies are secure" bit on the admin interface.

</comment><comment><USER65> protip: if you're a bank or credit card company you need top security folks and procedures. just a thought.

</comment><comment><USER66> I don't think this is anything dangerous. All the data is static, its just some sort of demo. It doesn't matter who goes to the page, they will always get the same data, it never changes. I'm not a customer so can't try once logged in. If I was to wildly speculate, I'd say honeypot.

<comment><USER67> This is dangerous! Someone has left the debug=true in the config somewhere. Anything could be possible on the site, not just the script injection in the url and the debug page, but a lot of other stuff as well. When the debug flag is true on our sites, we have a link which will authenticate us as an admin without any credentials for example!

<comment><USER43> > _When the debug flag is true on our sites, we have a link which will > authenticate us as an admin without any credentials for example!_

Well, get rid of that and push for a change in your company's workflow. This kind of control shouldn't be deployable to the main servers _at all._

Have separate, staging servers and run your tests and debugging interfaces on it, but as much as possible, don't deploy administrator interfaces to the servers that talk to the customer. [1]

[1] I'm undecided which kinds of heisenbugs would justify breaking that lemma.</comment></comment></comment>


Idris 2 - <AUTHOR> https://www.youtube.com/watch?v=DRq2NgeFcO0 <comment><AUTHOR> repository (published a few days before this talk at Curry-On 2019): [https://github.com/edwinb/Idris2](https://github.com/edwinb/Idris2)</comment>


Dutch secret service 'also has access to information from PRISM' - <AUTHOR> http://translate.google.nl/translate?hl=nl&sl=nl&tl=en&u=http%3A%2F%2Fwww.nrc.nl%2Fnieuws%2F2013%2F06%2F11%2Faivd-heeft-ook-toegang-tot-informatie-uit-prism%2F <comment><USER2> Here's an attempt at a quick translation for those interested. Note that 'De Telegraaf' is a tabloid-y newspaper, and the Algemene Inlichten- en Veiligheidsdient (AIVD) is the Dutch secret service.

\---

Dutch secret services also receive information from the United States' internet wiretapping program, PRISM. When the Algemene Inlichten- en Veiligheidsdient marks an American e-mail address as being suspect, within five minutes everything is known, said an AIVD agent this morning in De Telegraaf. According to the paper the agent was working for the department tasked with monitoring Muslim extremists.

According to the agent many companies are actively collaborating in giving access to their data. 'All large commercial internet services are being forced to provide an application with which [secret] services can browse [their data]'. Together these applications make up the American secret service NSA's program for collecting private internet data.

'EVERYTHING IS BEING SHARED BY SKYPE, GOOGLE, AND FACEBOOK'

According to the agent Skype refused for years to provide access [to their data], but since it has become property of Microsoft everything is said to be shared, as is the case with Google and Facebook. Last Saturday the leading men of both companies said not to be aware of the internet wiretapping program.

Dutch companies are said to cooperate willingly as well. 'When a request comes in one is just given direct access to the data, everything on a silver platter.' When a company does not cooperate, an agent is 'activated' that has access to the information at the company. 'Within companies and organizations, everywhere there are agents that can be activated, who are waiting for an information request.'

<comment><USER3> > According to the agent Skype refused for years to provide access [to their > data], but since it has become property of Microsoft everything is said to > be shared.

I bet people won't think I'm so crazy now for posting before that the only reason Microsoft paid the incredible amount of $8.5 billion for Skype (and 2x as much as Google was willing to pay) for no good reason, is because they already knew they were going to make at least half of that money back from NSA:

[http://www.theregister.co.uk/2009/02/12/nsa_offers_billions_...](http://www.theregister.co.uk/2009/02/12/nsa_offers_billions_for_skype_pwnage/)

Also this: "Microsoft's patent application for Legal Intercept was filed in 2009, well before the company's $8.5 billion purchase of Skype in May":

[https://www.computerworld.com/s/article/9218002/Microsoft_se...](https://www.computerworld.com/s/article/9218002/Microsoft_seeks_patent_for_spy_tech_for_Skype)

So they were already preparing to make it a _spy technology_ before they even bought it. Microsoft bought Skype in May 2011. Look at the PRISM slide. They adopted PRISM for Skype in June 2011, a whole _month_ after they bought it (in a hurry much?):

[http://www.washingtonpost.com/wp- srv/special/politics/prism-...](http://www.washingtonpost.com/wp- srv/special/politics/prism-collection-documents/images/prism-slide-5.jpg)

<comment><USER4> Why would anything think you were crazy? That was widely discussed around the acquisition.

Then Microsoft completely altered Skype's design (from supernode/P2P to client-server) making it cost a LOT more to maintain while offering no obvious advantages, which more or less confirmed it.

<comment><USER5> Where's a reference for it now being client-server? I can't find anything with a quick search.

<comment><USER6> I was able to pull up this: [http://arstechnica.com/business/2012/05/skype- replaces-p2p-s...](http://arstechnica.com/business/2012/05/skype- replaces-p2p-supernodes-with-linux-boxes-hosted-by-microsoft/)

Quote from Microsoft PR on the change:

 _As part of our ongoing commitment to continually improve the Skype user experience, we developed supernodes which can be located on dedicated servers within secure datacentres. This has not changed the underlying nature of Skype's peer-to-peer (P2P) architecture, in which supernodes simply allow users to find one another (calls do not pass through supernodes). We believe this approach has immediate performance, scalability and availability benefits for the hundreds of millions of users that make up the Skype community._

</comment></comment></comment></comment></comment><comment><USER7> Here's an interesting thought (to me). Supposedly there is a law that forbids NSA from using PRISM to directly spy on Americans. Let's imagine, for a brief, laughable moment, that this law is followed. It would be technically compliant with the law if the NSA could send a request to Dutch authorities, and ask that they send any information they have or can obtain on a US person. The Dutch have access to this system, and would know what the NSA is getting at, so the Dutch would query the system and send the info back. This could all be done via API in a matter of milliseconds.

The NSA could then tell their overseers that _they_ have never used PRISM to spy on Americans, which would be technically true, while they would enjoy unfettered access to intelligence on US persons with absolutely no oversight or authorization from anyone. This seems to be one of only a few logical explanations for giving other countries access to the system.

<comment><USER3> That doesn't seem like a huge stretch of imagination at all. There have been rumors years ago that they're doing this with the UK, too, and probably other countries, too.

I wonder if that's why Germany is the most spied upon in EU. Does Germany have the same deal with US? You spy on us, we spy on you?

It can either be that, or US spies on Germany because they want all sort of information from their politicians, businesses, and so on. I doubt most terrorists reside in Germany. So those can be the only 2 explanations.

<comment><USER8> I suspect the NSA and CIA remember the Cold War and still regard Germany to be an occupied US possession.

<comment><USER9> Do the flip test:

Would the US allow the Dutch, the Germans, the Belgians and the French to have military bases on US soil?

<comment><USER10> They come over here and train all the time. If they had the numbers they probably could carve out a base within one of ours, or even a separate area.

There is at least one U.K. facility home-based here in the U.S. in fact.

<comment><USER9> If you're talking about Nellis that's a US airbase with a few UK planes/pilots stationed there mostly for training purposes, which is clearly not the same thing.

<comment><USER10> I'm not talking about Nellis.

Edit: I can't say what I am talking about, but I will say that we (the U.S.) ended up having to lease usage of the U.K. facility even though it was physically located here in the U.S. and protected by U.S. forces.

<comment><USER11> Guy...

You're not inspiring the average American's confidence in the US Government.

<comment><USER10> So? Inspiring confidence in the government is not my job, defense of the nation is.

<comment><USER11> They are the same thing.

<comment><USER10> They are not at all the same thing.

In fact if Americans weren't in general wary of the government I'd be wondering who kidnapped all of America and replaced them sleeper cell aliens. There's no finer American pasttime than distrusting the government, it's right up there with chopping cherry trees and baseball.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Any government will do large-scale surveillance if they can. It's been said a thousand times before: do not use centralized social networks, cloud services, proprietary software if you value your privacy and freedom. This may be inconvenient, but we can't have freedom without paying its price. I had hard time explaining my friends and relatives why I am not on Facebook (or vk.com, which is more popular here in Russia) or why I would not use Skype, but at least I know that am not cooperating with those who are taking our freedom away.

<comment><USER10> I know I sound like the NSA shill here but I agree with this 100%. Stuff I've allowed to be on G+ or FB is done with the full knowledge that even the "Restricted" settings will not 100% reliably stop it from leaking to the Internet. Even without the NSA there are problems with corporate insiders, hackers, implementation bugs, countless other things.

Data I have that needs to be private is not stored anywhere on any cloud, except perhaps in an encrypted format sufficient for Data-at-rest.

In fact I was looking for a cloud service provider to use for some work- related stuff (PII) when I came to the conclusion that I couldn't actually trust any of the available cloud services, since it would always be possible for a cloud provider to gain physical access to the machine even if I use full-disk encryption.

What I'm hoping is that someday providers like Heroku will kind of meet-in- the-middle and setup a provision for setting up an enterprise cloud service (inside the protected WAN) that can be provisioned and managed similar to the public cloud SaaS services. Something where the enterprise would have the hardware and network interfaces but Heroku would provide the OS and management software.

</comment></comment><comment><USER13> >If a company does not cooperate, an agent 'activated' who has access to the information of the company. "Within businesses and institutions everywhere activate waiting for a request for information. Agents are"

In other words: the problem may be as much the fact that personal data exists in the hands of third parties at all as it is that there's any formal framework that enables law enforcement/national security agencies to legally access it.

<comment><USER14> I find the claims that moles within Google are responsible for this, to be, not impossible, but very improbable. The way Google's internal employee network is setup, the way the code reviews work, the way automated security audits work, the way the data is stored, there are lots of checks and balances that would make it hard to pull off without being noticed.

It's not like an employee can just hack in a device onto the network and start committing code with backdoors, putting trojans on servers, or slurping up network packets.

<comment><USER15> I find that you underestimate the training of top undercover agents.

<comment><USER11> You underestimate the training of your average Stanford CS grad.

<comment><USER15> Who says that some of top Stanford CS grads are not working as undercover agents.

The way secret services are shown in movies is a little bit different than the real world. All of them recruit top students from different universities. There is no "university for spies", where they teach agents all the skills they need to get the job somewhere. It's the other way around: they recruit people who already have those skills and teach them how to be agents. That's much easier because teaching someone how to become agent is their expertise.

<comment><USER11> "...Who says that some of top Stanford CS grads are not working as undercover agents..."

Some of them may be...

but the others will undoubtedly spot what's going on. These guys are not dull. They REALLY ARE the smartest guys in the room.

</comment></comment></comment></comment></comment></comment><comment><USER16> It seems clear that the post 9/11 "you're either with us or you're against us" policy was directed primarily toward establishing a global, connected police state (at least as it pertains to surveillance / privacy). The US needed everybody on board, 9/11 was abused to serve that purpose.

At the time I just viewed it as generalized anti-terrorism, anti-Al Qaeda type coalition. In hindsight it seems comically obvious what they were really targeting.

<comment><USER17> And Pakistan still quakes under the thread of being bombed back to the stone age. I wonder how many other countries were threatened by the "leaders of the free world".

"They hate our freedoms"? What, as much as the US hates and compromises every one else's?

Now can any one help me with a definition of a Rogue State?

</comment></comment><comment><USER18> I wouldn't take detailed technical claims from a Dutch tabloid very seriously. Even Glenn Greenwald, who likes to be meticulous with his facts and who has spent months working on this story, seems to have gotten some details wrong.

(Yes, I said Greenwald is meticulous with his facts, notwithstanding his extremist and not always well-supported OPINIONS. That's one of the juxtapositions that makes him so interesting.)

<comment><USER19> The NRC is actually one of the top-rated newspapers in the netherlands, quite similar to the Guardian and far from a "tabloid". If this were published in the "Telegraaf", you'd have a valid point.

Edit: Seems the story was first published in the Telegraaf, which makes the parent a very, very valid criticism!

</comment></comment><comment><USER20> Maybe not 'news', but interesting since some of the founders of Kazaa also started Skype. I can understand their morale at first: "Skype wouldn't share any information at first with the agencies, but since it's owned by Microsoft they have full access"

<comment><USER21> I think you meant "since it's owned by Microsoft".

Also, if anyone is wondering, this article is actually from one of the most respectable Dutch newspapers.

<comment><USER22> > Also, if anyone is wondering, this article is actually from one of the most > respectable Dutch newspapers.

Not quite. The NRC is one of the most respectable newspapers, yes. It is however _citing another newspaper_ , the Telegraaf, which is not quite as respectable. That said, they probably wouldn't publish this unless they were somewhat confident about the story.

<comment><USER21> Seriously? I missed that part. That's cheeky...

</comment></comment></comment></comment><comment><USER23> Note that The Telegraaf is one of the most unreliable newspapers in the Netherlands.

According to Larry Page Google does not give access to all your data within 5 minutes: [https://news.ycombinator.com/item?id=5860313](https://news.ycombinator.com/item?id=5860313)

<comment><USER24> I don't really care what Larry Page says. The government says they have to hand over the data and make a way for the government to store it in real time. Of _course_ Google is cooperating with them. Just like everyone else.

<comment><USER25> If you don't care what anyone at google says, what would make you believe otherwise?

<comment><USER24> Why would I believe a company that is bound by law to (a) hand over my data and (b) tell me they're not doing that.

I can't be convinced it isn't happening at this point because we have _evidence_ that it is from the government.

<comment><USER25> They aren't bound to tell you they are not doing that. Again, i'm not sure where people get this idea. They may be compelled to be _silent_ about it, but not compelled to lie.

</comment></comment></comment></comment></comment><comment><USER23> Serious question: How do we know PRISM is real? The only source I could find is The Guardian and the PPT of the so called PRISM project.

Some facts:

      * The Guardian is the only source.
      * We don't know how they verified the authenticity of the PPT.
      * We don't know anything about Edward Snowden.
      * All companies 'involved' never heard of PRISM and also don't know how the NSA does gather user information without a warrant.

<comment><USER26> Obama has confirmed its existence.

But you do raise an interesting point. Does anyone know exactly what PRISM is, from a technical point of view? It seems that everything we know about it comes from the leaked powerpoint slides.

</comment></comment><comment><USER27> An interesting development, the Dutch minister of security refuses to expand on the details of the AIVD and NSA relationship, stating that it has to be discussed on an European level first.

[http://www.nrc.nl/nieuws/2013/06/11/aivd-heeft-ook- toegang-t...](http://www.nrc.nl/nieuws/2013/06/11/aivd-heeft-ook-toegang-tot- informatie-uit-prism/)

</comment><comment><USER28> When it says "within five minutes all known" does it mean that the ISP translates the IP address with the name of the person who signed the contract with the Provider?

<comment><USER29> I don't know about the US, but there's a project here in the Netherlands where ISPs can voluntary submit that information to a central databank where law enforcement can access it. There's _some_ due process that has to be done before law enforcement may access it, but it's been shown that the process is faulty or not adhered too.

</comment></comment><comment> tech-no-logical our minister (Ivo Opstelten) has just said that he hasn't had any complaints concerning prism.

probably because it was a secret... duh... the way our (as in netherlands and EU) politicians are responding to these issues are so laughable it makes me depressed.</comment>


80188 MP3 Jukebox Project - <AUTHOR> http://wolverine.caltech.edu/eecs52/projects/188mp3/188mp3.htm <comment><USER2> This reminds me of the LP3 player attached to the parallel port (LPx). You could cat an mp3 file (up to 192 kbps) to /dev/lp1 it and it would play it back in hardware. Worked with almost any computer, and also had with plugins for XMMS and Winamp.

</comment><comment><USER3> I seem to remember that 386s couldn't decode and play MP3 files. In this project they're using the 80188 to control a separate MP3 decoder chip (the MAS3507D). Looks like an exciting project for an EE course.

<comment><USER4> A 386/40 with a Cyrix FPU could _just barely_ play low-bitrate low-sample-rate mp3s. Your point stands though:

[https://www.youtube.com/watch?v=6Jj97NXgHw4](https://www.youtube.com/watch?v=6Jj97NXgHw4)</comment></comment>


Ask HN: How did you find meaning? - <AUTHOR>

A few hours ago, an interesting thread (and a even more insightful comment section) popped up on HN: Fatal silence: Why do so many fortysomething men kill themselves? https://news.ycombinator.com/item?id=9366219
I'd like to ask you: how did you find your own meaning? What core values or practice let you get rid of doubts and hollowness? <comment><USER2> God, as in Jesus Christ, not in that "all roads lead to fulfillment" or "let us each follow our own path". Nothing worth having comes that way.

If you live according to a standard of truth with accountability on the inside, you will break out of that "hollowness". If you stay where you actions compromise your true values, because it's enjoyable or you don't believe you have accountability, you will stay "hollow" no matter your success or accomplishments.

</comment><comment><USER3> My older sister was murdered in 2000:

[http://www.leoweekly.com/2008/11/deadly- delay/](http://www.leoweekly.com/2008/11/deadly-delay/)

She was a truly amazing young woman, with limitless potential- especially as a writer. The years following her death were hard for me and my family, but seeing how her life could be so easily snuffed out, and seeing how the local government fought tooth and nail from admitting any guilt on its part, compelled me to accept the inherent absurdity that is life.

Once I stopped taking the world seriously, stopped taking myself seriously, I suddenly found all metaphorical walls removed.

I would not recommend tragedy for everyone though, obviously. But perspective really is everything. We all really are just specks of dust floating in the aether.

</comment><comment><USER4> Life is inherently meaningless -- all meaning must be created by human beings. So, you don't _find_ meaning -- you impose it upon your life.

Decide what meaning you would like your life to have, then change your life to suit the meaning you've given it.

</comment><comment><USER5> doubts? hollowness? all still there.

It's how you deal with them. As skidoo says, perspective is everything. If you can switch perspective on negative thought processes you can dodge nasty side effects.

Better than going to the doctors for happy pills anyway, which seems to be the default action for 'I feel sad/bad about many things, I need help' these days. And that's not meant to belittle folk with mental health issues in any way.</comment>


Users fear for privacy after Google buys Fitbit - <AUTHOR> https://www.theguardian.com/technology/2019/nov/05/fitbit-google-acquisition-health-data <comment><USER2> This doesn't add significant new information over the HN threads on the topic. In fact the HN threads might as well be a primary source for it.

[https://news.ycombinator.com/item?id=21418232](https://news.ycombinator.com/item?id=21418232)

[https://news.ycombinator.com/item?id=21378471](https://news.ycombinator.com/item?id=21378471)

</comment><comment><USER3> This type of headline isn't healthy, 'tossed my Fitbit in the trash' is almost implying it's a solution to Google now having your Fitbit data; in reality, the article goes into the correct way to perform this: deleting your fitbit account.

<comment><USER4> Last time I checked you still needed a fitbit account to use the device though.

What are the alternatives ? MS band ? Apple watch ? xiaomi ?

<comment><USER5> I've asked myself the same thing. After some digging I've found Withings that looks fairly promising:

[https://www.withings.com/us/en/pulse- hr](https://www.withings.com/us/en/pulse-hr) [https://www.withings.com/us/en/steel-hr- sport](https://www.withings.com/us/en/steel-hr-sport)

Though they are still gathering a lot of data. It feels better than Fitbit/Google, but I wish they'd spend some time on encryption / privacy.

For example, all the GPS data, that's useful for showing a map of the run and measure the distance, but certainly doesn't need to go on their servers. They should encrypt the GPS points and only send the shape (vector path) to their servers. That would contain info about distance, but not where in the world the person was running.

Similar things could be done for other things.

<comment><USER6> A vector path is just a jigsaw puzzle piece. There are only so many places in the world where you'd have a certain shape dictated by local streets, footpaths and bridges.

</comment></comment></comment></comment><comment><USER7> I'm a lot less worried now, actually. Google's model doesn't include the outright sale of data. The way Fitbit was going, I thought they'd lose control of it somewhere.

<comment><USER8> They scrape email for cross selling already, I could totally imagine seeing them use heart rate data to segment their audiences by happiness. Then they can show you ads when you are more likely to convert when you are happy/awake/resting etc. Slimy but not without precedent.

</comment></comment><comment><USER9> One of the worst things that ever happened to the internet it's called Google. This rogue CIA backed crap that violatates every single day your privacy data. I was one step from buying a Fitbit watch and spend $200 but after Google made it's move I stepped back.

</comment><comment><USER10> Everyone and their cats are looking at Google to see if they are misusing private data.

Nobody cares what Fitbit is doing with the data.

But lets trust Fitbit more than Google.

<comment><USER11> FitBit has your health data but not all the other data about you which Google is squirreling away. If you have an email address for Gmail against your Fitbit info then that health data is now available to be merged with all your other data. It can then be sold to anybody who offers enough for it or you will start to get ads for health products when Google starts analyzing your health info.

</comment></comment><comment><USER12> I can't wait for the time when users fear for their privacy when they buy a non-free hardware with non-free software installed on it.</comment>


Ask HN: Seals/certifications are a scam... but are they worth it? - <AUTHOR> We FeeFighters help SMB's save money on credit card processing. We do need some somewhat sensitive information to run our reverse auctions, like the amount of credit card receipts a company expects. We're going through the process of TRUSTe and BBB certification. It's not really much of a process, really, you pay ~$1000 they ask a few questions and you can put the seal on your site... As we know seeing what happens in the credit card processing business, there are many companies that have A+ ratings that treat their customers like crap. Until a few months ago, Ritz Carlton, Disney, and Wolfgang Puck had F ratings but Hamas had an A grade. (see here: http://abcnews.go.com/Blotter/business-bureau-ritz-carlton/story?id=12151154)
We're doing the TRUSTe certification, and they only asked a few cursory questions... but they present case studies with a significant bump in conversion rate (trustguard has a somewhat hilarious link on their site that says "Trustguard increases conversion rate 60%). I personally have never given any credence to a security seal on a website.
Have you seen conversion rate increases due to the presence of a security, BBB, or Trust seal? How do people feel about the seals generally? <comment><USER2> We did some testing on this a couple years ago... trust-e showed no statistically significant boost with where we placed it.

We had tested the 'hacker safe' logo ( that mcaffee since bought and renamed ). Depending on where it was placed in the order process ( it was a multiple step process ), it either had no noticeable effect to a 15% conversion boost.

For customers outside the US, neither had any impact at all, where we tested them. For the hacker safe logo, it had the biggest effect when placed near product selection and when the user was entering credit card information.

I would suggest doing some serious a/b testing to figure out where the logos should go if you get them as from my experience, placement is everything.

<comment><AUTHOR> Cool... what kind of site were you testing it on? We'll do our own a/b testing but I think it makes sense that near product selection and credit card entry is the place for it to go. For us it'll be near where they enter sensitive information.

<comment><USER2> Health and beauty site.

Vitamins, Fish Oil, Acne Medication etc type stuff.

</comment></comment></comment><comment><USER3> A couple of notes:

a) Placement of your seals / certifications makes a huge difference in regards to conversion rate : [http://conversionvoodoo.com/blog/2010/07/proper- placement-of...](http://conversionvoodoo.com/blog/2010/07/proper-placement-of- trust-logos-can-make-a-huge-difference-in-conversion-rate/)

b) These certifications and seals are a necessary evil for online commerce & the BBB has tested for us as most important.

We've found time and time again that the BBB symbol is the MOST powerful of the seals and this is across many industries.

Consumers trust the BBB, businesses realize that the BBB is essentially like paying Mafia protection money.

The one positive I can say, however, is that the BBB acts like a lightning rod - angry customers will file complaints and that gives you the opportunity to resolve those complaints often before they head to merchant processing, etc.

<comment><USER4> Ugh, I hate the fact that BBB charges you an extra $xxx just to put their seal on your site, in addition to you paying their basic fees. It's extortion in my mind, but yes, Mafia like protection

</comment></comment><comment><USER5> I've found, in the small startup I'm working with right now, that those of us with more of a marketing and sales background think seals and stamps and certifications are the cat's meow, and those of us with more of an engineering background think they're just noise, and make our websites ugly.

I wouldn't trust data from the agency selling the certification - but it'd probably cost more than the certification cost to setup, gather, and analyze your own collection of data.

Our group expects to have a mutually beneficial relationship with certain industry groups - we've gone to the trouble of creating our own custom designs that contain the name of the external group to serve the place of a seal that link to the appropriate spots on the websites of those other industry groups. These fit the look of our site better, making our design guys happy, and kept the marketing guys happy because they can display our relationship. Our engineering guys still think they're mostly noise, but grudgingly admit they probably do get peripherally noticed the same way one notices the hash marks in a crosswalk.

</comment><comment><USER6> If someone did a study on these, I'd love to see the effect of posting a meaningless seal. That is, a logo which was made up to LOOK like some official seal, but which is not actually issued by any organization.

My guess is that the effect on conversion rate would be rather similar. After all, who _actually_ knows what TRUSTe is?

<comment><USER2> We did that. Swapped out the 'hacker safe' logo with one we created that just said '100% Secure Server'. About 10% drop off at that step.

YMMV. But that 10% drop off level was still higher than with no seals at all. In the case where we did that, it was only on step 4 of the process where we collected credit card information.

</comment></comment><comment><USER7> i know someone that has proven through their own A/B testing that a seal (i forget which, possibly TRUSTe) increased their conversions. not 60%, but maybe 10%.

they referred to it as the #1 change they made in testing that increased conversions.

<comment><USER2> 2 biggest things we did in testing that increased conversions where.

1\. split a 1 step order process into 4-5 smaller ones. ( 40% increase at the time ) 2\. modified pricing ( increased conversion but more importantly, increased effective revenue, ie conversion boost offset the lower price and then some. )

<comment><USER7> i should clarify (since i can't edit anymore) that this was/is an ecommerce site that didn't have much wiggle room in changing prices

</comment></comment></comment><comment><USER8> We have seen a negligible (and debatable) conversion rate increase using Trust Guard. However, it's much cheaper than any of the alternatives- so cheap that we opt to have it despite concrete evidence of it's success.

I agree with you in that all of these certs are a sham, but I would argue that for many customers of standard e-commerce (especially online retail) operations they are another thing going in your favor in attempts to appear as a professional outfit.

I'd never put any credence in a seal, but there are many customers that may. It's not worth a $1000/year to us, but it is worth ~$125/year.

Hope this helps!

</comment><comment><USER9> I've been looking at this lately with my work with Torbit. One thing to keep in mind is the performance hit you may take from including that seal. They are usually served directly from the certification companies website and often take multiple seconds to load. Depending on how they block the rendering of your page, the seals could actually hurt your conversion rate just from the performance hit.</comment>


Is MySQL Doomed to Extinction? - <AUTHOR> http://opensource.sys-con.com/node/1386279

<comment><USER3> The problem with this new product is that their business model seems to be selling the software with hardware and there are no indications that the software is open source. As such, it's really more a competitor for other proprietary products since their pricing starts in the $100,000 range.

I know that it's become fashionable to write of MySQL or SQL in general and many large sites are migrating away from it to non-relational data stores. However, for many sites, MySQL does a wonderful job and relational features cut down development time. The founder of Flickr spoke to this at a Django conference saying something to the effect of, "ever since there was more than 200 sites on the internet, it has been better to target a framework at the rest of the internet than at the top 100 sites". Specifically, he was speaking to sharding and other highly scalable techniques that Django doesn't deal with natively and saying that the vast, vast majority of sites will never have to deal with those questions.

Relational technology definitely has its place and does offer developers advantages. And relational technology does scale for some high-traffic operations. Look at Wikipedia. It's the 6th most trafficked site in the world and backed by MySQL. Granted, they do use caching and other techniques as well, but it's a highly available, highly trafficked site. In fact, I can't remember the last time I heard about Wikipedia going down.

New technology directions are great. I'm really excited about Cassandra. Do we really have to declare something dead and something else the winner?

</comment><comment><USER4> "Is <specific technology> doomed to die?

Mr. Someone, who just started a business competing with <specific technology> says yes!"

<comment><USER5> To be fair, that doesn't imply that Mr. Someone is merely claiming so out of self-interest. If he started a company to compete with the technology, he must really believe it's going to die.

Which means you can't simply dismiss his statements; you have to look into them and judge them on their merits.

It's a bad sign for HN that this facile dismissal has (as of this writing) twice as many points as this much deeper but also critical analysis:

<http://news.ycombinator.com/item?id=1332039>

<comment><USER6> Actually, I think in the hypothetical case it would be fair to write what Mr. Someone is saying off as FUD, and ignore them, unless false negatives are of serious consequence (eg, you're an investor).

Self interest aside, it's such a trollish statement that adds nothing to the real discussion, which is a) what's wrong with product x, and b) what my product y does to fix this. Such behaviour correlates reasonably strongly with incompetence, at least in my experience.

My problem with the grandparent post is more that the question was actually posed by a journalist, which is night and day different. They're sexing up the content to sell a story. So reframing the quote as being from the Clustrix guys is quite dishonest.

Had the quote actually been theirs, I'd have no problem laughing at their expense, although I realise such behaviour is not encouraged here.

</comment></comment></comment><comment><USER7> It's going to take a lot more than an expensive, closed source, hardware integrated, clustered database that talks the MySQL protocol to even make even a tiny dent in MySQL's popularity. Outrageous headline used to draw people in to an annoying article that reads like marketing copy.

<comment><USER8> It's going to take ... Postgresql.

<comment><USER9> ..an oft-overlooked option, sadly

That and cheaper hardware used more intelligently.

Even more sadly,I have found these topics, RDBMSes and hardware, to be areas of great ignorance and, perhaps therefore, fear among software folk.

More importantly, it will probably take a substantial effort to de-mystify these two.

</comment></comment></comment><comment><USER10> Not when the product they are talking about is query compatible with it.

Kinda reminds me of how Litespeed built a httpd.conf/.htaccess compatible apache replacement - it's drop-in ready but many times faster in comparison. But it's very pricey so you won't see Apache going away anytime soon (and people also switch to nginx for free if they don't need the compatibility factor).

</comment><comment><USER11> This particular product not only can not doom MySQL, but it actually requires MySQL success in order to have customers.

Only PostgreSQL or a similar more featured database can doom MySQL, and I don't see this happening soon.

In fact, this product even strenghts MySQL in the market, by making it scale up for enterprise customers.

</comment><comment><USER12> On a long enough timeline the survival rate for anything drops to zero - - <USER2> as _why put it "programming is rather thankless. u see your works become replaced by superior ones in a year. unable to run at all in a few more."

</comment><comment><USER13> I tried to read this article but gave up because the pop-up ad took up my entire iPhone screen and scrolled when I tried to get to the 'close this window' link. Anyone have a quick work-around for this?

</comment><comment><USER14> Yes. At least in my own company.

We were picking a vendor and had gone deep in talks with the MySQL folks to license their technology, and then Oracle stepped in and we picked somebody else.

Following the technology since then, it's clear that Oracle doesn't really know what to do with this thing. I think it would be a mistake right now for any company to pick MySQL for any major work without plans on moving it out of their product at some point in the future, it's simply on far too unstable ground as a database to rely on anymore.

</comment><comment><USER15> Well I'll tell you what deserves to die: that website with popup ad so huge that its close button is out of bounds of netbook screen.

Text obstructed; didn't read.

</comment><comment><USER16> Sure it is. So is everything we run on our computers, as well as the computers themselves. We don't run dBase II on CP/M anymore. The same way msql was replaced by MySQL, MySQL will be replaced by superior software at some point of the future.

Just don't bet on these guys.

And, BTW, isn't this the Maureen O'Gara that wrote that "exposé" about Groklaw?

<comment><USER17> Yeah, Sys-Con are a sketchy company.

<http://aralbalkan.com/2022>

<comment><USER16> Three banners stood out. One very annoying from Microsoft, two other banners from them and one, smaller, from Oracle.

I wasn't going to buy anything Microsoft for the foreseeable future. Oracle got one more penalty on my book.

</comment></comment></comment><comment><USER18> That writing style was so annoying I could not finish article.

<comment><USER19> I love news outlets that don't include a single link to any of the company websites they mention. (Yes, guessing clustrix.com was pretty easy.)

</comment></comment><comment><USER20> Oracle has been extremely hostile to former sun customers. I can't even download firmware now without buying service contracts for all my servers.

If they won't even provide proper service to hardware customers, I think they will be downright hostile to a competing bread and butter product that they now control.</comment>


Deschooling Society - <AUTHOR> https://medium.com/@marksaroufim/deschooling-society-d1f0a0640ba6 <comment><USER2> Too little nuance. Which would one prefer: a home-schooled neurosurgeon or an accredited one? A home-schooled nuclear physicist working at a power plant or an accredited one?

Universities won't go away; some things you just can't learn at home. However, the education system is indeed loaded with problems. There are too much students who study for the wrong reasons; too few teachers who can teach; archaic teaching methods, e.g. lectures; mandatory education; and the overwhelming amount of useless degrees, e.g. gender studies, tourism, marketing, etc.

[https://philomath.boards.net/thread/20/readme](https://philomath.boards.net/thread/20/readme)</comment>


Ask HN: If Alan Turing never died, could Britian have been Silicon Valley? - <AUTHOR>

It was Turning's birthday a while back.
It's pretty obvious what caused Alan Turning's death but I have this weird feeling that Alan Turning wasn't the only one affected by this.  When you look at it, Alan Turning's death coincides with Silicon Valley's founding.
It almost looks like if the British never killed their own golden goose and set a precedence to all those involved in the industry about their worth to the nation, they too could have had their own technological revolution. <comment><USER2> To rephrase your question: Was Alan Turing going to start a company that would have rivaled HP or Intel? I think the answer to that is no. Would Turing have put an unknown school like Stanford on to the map? Again the answer is no.

There have been some amazing technology entrepreneurs in England like Sir Clive Sinclair who were just as good as their counterparts cross the ocean. The thing is that there was no ecosystem to really support folks like this. Although to be fair in America there were some amazing companies outside of Silicon Valley that never grew an ecosystem that became larger (a good example might be IBM).

</comment><comment><USER3> Turing was a brilliant mathematician, but he wasn't a businessman or a charismatic leader. He did have a go at leading a computer development project (the ACE project) at a government lab, but got frustrated enough with the project and his role that he wound up decamping to what we'd now call a systems programming job for the machine being built at Manchester. And even his fellow academics regarded him as a bit of an odd duck, not always easy to get along with or even to understand. (Maurice Wilkes's memoir has some relevant anecdotes, including a conference talk in which Turing did blackboard arithmetic in the least-significant-digit-first notation that he'd adopted for the Manchester Mark I, to the general bafflement of the audience.)

There's a larger question, though, of whether something _else_ could have made Britain a success in the computer industry. Especially since they briefly started to do that. It's not just that the British were hugely innovative (the group Turing joined at Manchester developed, among other things, the first index register, very early HLLs, and ultimately virtual memory). More importantly, they were also the first to deploy computers in industrial use. Ferranti's commercial version of the Manchester Mark I is arguably the first commercial machine to be delivered to a customer, and the LEO (a machine based on Cambridge University's EDSAC) was running logistics for a chain of tea shops in 1951.

So, why didn't these take off? A couple of possible reasons: First, building computers at the time was a very capital-intensive business, and there wasn't a whole lot of money for speculative ventures at the time --- both because "Venture Capital" in the way we're used to didn't really exist yet anywhere, and because postwar Britain was in pretty bad shape generally. Second, rather than try to create conditions that would encourage researchers to branch out to industry, the government had an explicit policy of trying to license British-developed technologies to all comers, notably including American companies like IBM. There's an MIT Press book on how this worked out; it's a dry read, but the title tells the tale: "Innovating for Failure."

(By the way, similar things happened in other fields: The Brits developed the world's first jet airliner, and wound up basically ceding the market to Boeing, Douglas and Lockheed.)</comment>


Iomega and LenovoEMC NAS Vulnerability – US - <AUTHOR> https://support.lenovo.com/us/en/product_security/LEN-25557 <comment><AUTHOR> And a related Forbes article: [https://www.forbes.com/sites/daveywinder/2019/07/17/lenovo-c...](https://www.forbes.com/sites/daveywinder/2019/07/17/lenovo- confirms-36tb-data-leak-security-vulnerability/#67862fb162b9)</comment>


LG converts its smaller, crazier projects into startups - <AUTHOR> http://www.engadget.com/2016/05/16/lg-converts-its-smaller-crazier-projects-into-startups/ <comment><USER2> I'd really like to know what the details are:

> _since LG employees can go off, form a startup and -- if everything > collapses within three years -- come back to the company no questions > asked._

Is this an open offer to all employees, or just to those that decide to join these sanctioned startups, and how does one go about getting your "crazy project" inside LG turned into a startup. Is it in their contracts, or just spoken? It's certainly an interesting approach.

I think there's an interesting idea here - and an interesting article to be written on the topic - but this one didn't go where I wanted it to.

</comment><comment><USER3> That Acanvas self-charging design is brilliant. You hang up the painting above a wall socket and it drops a cord down to the socket to charge when the battery gets low. Then it pulls the cord back up so it appears wireless the majority of the time.

[https://www.kickstarter.com/projects/acanvas/acanvas-the- cor...](https://www.kickstarter.com/projects/acanvas/acanvas-the-cord-free- art-display-and-streaming-pl?ref=video)

<comment><USER4> The video shows three canvases next to each other, how would the ones on the sides charge? Most people don't have three wall sockets spaced exactly like how they show the three frames

<comment><USER5> [https://ksr-ugc.imgix.net/assets/011/165/794/c4b7b104c6d147d...](https://ksr- ugc.imgix.net/assets/011/165/794/c4b7b104c6d147d58cbe4e7dd9fc1f4b_original.gif?w=680&fit=max&v=1462979164&q=92&s=bba537457a4953631af9d52b76f5ec73)

This animated GIF shows it dropping into a "receptacle" which is just a box with a cord, presumably plugged in to the nearest actual receptacle.

Interesting idea, for sure.

</comment></comment></comment><comment><USER6> This is the first "Nordic-style" startup plan I've seen from a major tech company. Have any of the other majors tried something like this?</comment>


Evidence-Based Estimation for Project Delivery - <AUTHOR> https://medium.com/@planrockr/evidence-based-estimation-for-project-delivery-4c2a69a17084#.5cjzoszeo <comment><USER2> Cool, it's very interesting</comment>


Spring Boot 1.4.0M2 Revamps Unit Testing, Improves JSON, Couchbase, Neo4j - <AUTHOR> http://spring.io/blog/2016/04/13/spring-boot-1-4-0-m2-available-now <comment><USER2> Speaking with my working-in-the-same-company-but-at-quite-a-distance hat, it's been really great how the Spring team have solicited feedback from Pivotal Labs and Cloud Foundry engineers.

Both Labs and CF engineers are TDDers, so the expansions in test support and convenience is awesome.</comment>


Getting (Unremarkable) Things Done: The Problem With David Allen's Universalism - <AUTHOR> http://calnewport.com/blog/2012/12/21/getting-unremarkable-things-done-the-problem-with-david-allens-universalism <comment><USER2> I think author misused GTD. GTD allows me to dedicate uninterrupted time for "deep work" precisely because I know that there is dedicated time and place for dealing with "shallow" work and it's take out of the way. Allen himself writes about not being to do everything, for me it means that there should be conscious effort to limit amount of "shallow work" you do and may be decide not to do some items at all. In other word if all you time goes to "shallow work", then you prioritized your projects wrong.

Also, GTD book is one of the most badly written books, the style is watery, and just hard to get through. It could be compressed threefold without the loss of meaning. I opted out for audio version which I could listen to on faster speed. This is a pity that invaluable advise comes in such package, recently I started to re-read, but now thinking about trying to reading some of this "GTD Summary" books instead. I wish somebody would buy license from Allen to rewrite it in digestible, concise way.

Also, I was using (and paying for) RTM for years for my list keeping, but it's just not optimized for GTD and web UI needs long-required update. Nirvana HQ finally got smartphone client, I switched to it and it's really good. Nirvana's web UI is well structured, compared to RTM it needs better keyboard shortcuts and group operations, but overall it's much easier to use for GTD than RTM.

<comment><USER3> what are these "GTD Summary" books you talk about?

<comment><USER2> There are (as far as I understand) unauthorized summaries on Amazon. This one looks promising, but it's hard to assess the quality without actually reading it: [http://www.amazon.com/Getting-Things-Done-Summary- Productivi...](http://www.amazon.com/Getting-Things-Done-Summary- Productivity/dp/1477490086)

</comment></comment></comment><comment><USER4> Something I've found with GTD is something that's somewhat alluded to in the book. Granted I don't remember the book outright (perhaps I could do with another reread...), but the gist is that if you're having trouble with a "thing" on your list, you just need to reduce that "thing" down more because it's too broadly scoped as stated.

Instead of "work singlemindedly and with complete focus on MyNewWebApp", perhaps "Write user authentication module for MyNewWebApp" or even "Get basic username/password authentication working for etc."

Just about anything and everything can be broken down this way; in fact I struggle to imagine something that is incompatible with this! The author of this piece even fails to give any examples of what he means by something that couldn't be broken down.

The other thing is that GTD is a framework. You can follow the way the book tells you to do it to the letter, but then you're missing out. Start with the book, add a little, take a little, mix in whatever works for you. Once you've got the foundation, improvements will come naturally. I'm doing a little GTD mixed in with pomodoro right now and it works incredibly well for keeping my ADD-addled mind in check.

<comment><USER5> _Just about anything and everything can be broken down this way; in fact I struggle to imagine something that is incompatible with this! The author of this piece even fails to give any examples of what he means by something that couldn't be broken down._

Any chunk of work that pushes the limits of your brainpower is hard to break down into pieces.

For example, coming up with a Mathematical proof. You might be able to break the problem down to some extent, but there's a lot of time spent just thinking, and it's very difficult to predict how long solving a problem will take.

</comment></comment><comment><USER6> I agree with the author. I remember reading a Seth Godin post from about six months ago that addressed this albeit in different words.

I wrote about the subject myself a bit here: <http://sicklittlebeast.com/2012/07/25/how-does-it-fit-in/>

"Are you avoiding important work by doing busy work?"

<comment><USER7> I was very pleased to see the first couple of comments on this agreeing completely. I often get the vibe the HN community doesn't understand this risk of the GTD philosophy, but apparently I was happily mistaken.

</comment></comment><comment><USER8> Thank you - you solidified my own thinking as a GTD practitioner. I think the last paragraph is essential. What GTD has done for me is mechanize the rote, bureaucratic aspects of life and work, which leaves more time and an uncluttered mind to haphazardly pursue creative, open-ended tasks.

</comment><comment><USER9> >As a graduate student, I didn't need better lists of next actions. I needed instead to be _training my ability to focus hard on meaningful things for long periods of time — even after it becomes uncomfortable._

This is the part I'd like to figure out how to do.

<comment><USER10> Well, I'm one of the fortunate few who managed to escape from graduate school (Masters and PhD) in 4.5 years in an engineering field. I am the first to admit that I am very, very, very lucky in a variety of ways that made this possible. But one of them is as follows.

I similarly have a hard time focusing for long periods of time. Like many people, while I'm not manic-depressive, I have manic-depressive tendencies. For a week or two I feel depressed and don't want to do anything. Then for a week or two I'm really excited about research and get a ton done. Then back to depressed. It's just the way I am, and my situation doesn't seem very unique from talking to many of my friends. Sometimes research is inspiring, sometimes it's frustrating and tedious. I think much of that is perception, and that really all that's changing is a fundamental chemical shift in your moods.

In any case, what I realized back in undergrad is that when I'm in a depressed mood, I _don't work_. At least, not on creative, difficult, interesting stuff. It's just impossible, intimidating, frustrating, and a waste of my time. All it does it work to prolong my depression.

Instead, I focus on what I call cultivating boredom. I do things like read hacker news until I've read all the articles. Or god forbid read slashdot. Or NPR. Or meditate. Or much better; practice karate, go for a walk, take mind altering substances (you know, like nicotine), hang out with friends, cook, that sort of stuff. Sure, I still take care of the little logistical things that need doing, but I don't try to do creative work when I'm in this mood. It's counterproductive.

Instead, I basically use up all my avenues of distraction, and eventually doing that creative, hard, difficult, complicated work becomes attractive again in comparison with sitting at my computer reading facebook. This process takes about 3-4 days. Then, I suddenly just... flip. And then I'm manic again, and I'm roaring through piles of highly creative work that is of incredibly good quality.

So instead of wearing myself out doing superficial tasks, I try to actually _let myself rest_ and most importantly, become bored so that my mind can recover. This is the only way I have found to work productively as a graduate student.

It's only anecdotal, of course, but I probably worked an average of 25 hours a week. I'd spend two weeks straight working 9-10 hour days and then coming home and writing grants and papers and thesis. Then I'd burn myself out and do literally nothing worth even remembering for two weeks. And after two weeks of that I'd be bored and really excited about working a ridiculous amount again. And in this way, I managed to graduate in 4.5 years, in a lab where the median graduate student was in their 5th year, and many were in their 7th year. It's quality of work, not quantity of work, nor time spent in lab that lets you graduate.

Anyway, worked for me. Might not work for you. Try at your own risk. But I've never found another way to work that makes me happy, lets me get through my depressive periods in a reasonable period of time, and which produces high quality creative work products.

</comment></comment><comment><USER11> pg wrote about this very subject in his essay Good and Bad Procrastination <http://www.paulgraham.com/procrastination.html>

<comment><USER6> "That's the sense in which the most impressive people I know are all procrastinators. They're type-C procrastinators: they put off working on small stuff to work on big stuff."

That's it, really.

</comment></comment><comment><USER12> I made a few attempts at GTD but got stuck on something that is related to the authors point. It had to do with the literalism of the "next action."

Most of what I experience as a problem in my work relates to getting overwhelmed by the scope of ongoing projects. I'm a music producer, a lot of the projects I do go over a period of weeks or months.

I could never figure out the level of granularity for the next action. A common unit of my work is a song. Producing a song has many such levels. The highest/largest would be "produce song X. From there there are obvious chunks: pre-production, recording, mixing. Recording could be broken down to basic tracks and overdubs. Overdubs to vocals, horns, percussion. And so on.

So on a given day, I might have planned to mix a song (could take a day). Is my next action "mix the song" or is it "boot the computer." The task is a whole series of steps that all must be completed.

After a while I started to think that my problem wasn't getting started, it was getting finished! Mixing music is a difficult task that requires a lot of concentration, and I am usually very resource constrained.

Since I have a lot of projects that I am working on, more than I can do, I'm already heavily prioritizing my time. After a while it just seemed like more trouble than it was worth to write out all of these next action, as they were usually obvious.

What I experience as my problem is not having enough time to get a project done. I'm working efficiently, but as I come up against the resource constraint, which I always do, my subjective experience of stress goes up, and I start getting tired, the stress adding to my stress so to speak. This is when I'm in the thick of it working as hard as I can.

I'm sure I am missing something with GTD, but I gave up on it pretty quickly. Though it did make me feel a lot more comfortable with deleting/trashing things I don't need.

I'm probably just in the wrong business.

</comment><comment><USER13> I agree as well, it definitely matches my experience. GTD will only work on a certain type of work.

In startup environments there are often significant tasks that go out of your comfort zone (if you're an engineer, you may have to write a tutorial or a script for a video). Those don't typically go on my "pending" list although they are very important to the business, sometimes even more so than dealing with whatever technical situation that might have come up in the last few days.

This is why I have stopped feeling guilty about what I used to call "procrastination". Sometimes you have to avoid your task list and work on the complex things.

This said, the Service Desk / Issue tracking system we develop adopted a GTD- like philosophy in its latest iteration (a pretty significant UX change) and the feedback from our internal and external customers has been outstanding. It helps you keep your head level.

</comment><comment><USER14> For people who want to focus but cannot always, GTD is a floor. While doing deep work, he should do nothing else. When he is not, or more importantly when he cannot, he at least takes care of small things and chips away at his big projects until he's pulled back into them completely.

I like a literary analogy here: I would recommend GTD to an obituaries editor for everything. I would have recommended it to Samuel Coleridge to keep him working during his low periods, since they prevented him from finishing his work. I would never recommend it to a busy genius like Shakespeare or Dosteyevsky for fear of ruining their ability to write (I assume I would have recognized their genius as a contemporary; please work with me.)

</comment><comment><USER15> While I agree completely, it's worth mentioning that the author does use GTD for his mindless, shallow tasks (that he can't delegate or get rid of). Presumably that boost in efficiency gives him more time for deep work.

<comment><USER6> Yeah - GTD is a useful system - partially for the reason that it can "open you up" to clearer thinking and deeper work.

</comment></comment><comment><USER16> Somewhat agree with the author, but I make the big tasks calendar events or put them on their own context list (ie "edit paper" is not on my office list, but my "research" next action list). The idea with GTD is to choose the best next task, not just hammer them out mindlessly, so I think the author misunderstands GTD.

</comment><comment><USER17> The problem isn't GTD, it's this desire to do and be "remarkable" all the time. To only want to do "deep work" so people will remark about it and then tell other people how awesome you are is shallow at best.

I think Dale Carnegie had it right when he said:

 _Generally speaking we like the big stuff because it seems to make an impact. Huge tasks should equal huge rewards, theoretically. If you do a lot of little things really well, however, it reflects positively on your character. You seem like a person who gets a lot done and does a great job. The little tasks may not always seem exciting, but you have a lot to gain by completing them with the same passion as a larger project._</comment>


Dice Loaded Against Public in Canada's Copyright Term Extension - <AUTHOR> https://www.eff.org/deeplinks/2015/04/dice-loaded-against-public-canadas-copyright-term-extension

<comment><USER2> It's interesting to see corporate interests flexing their muscle internationally. It's so easy now, and almost no western country stands in very much contrast to the other anymore.

Oh well. Canada used to seem like the last bastion of decent civilization. Harper et al saw to that and seem to have murdered it good.

<comment><USER3> Personally, I hope the Charter challenge against "Fair" Election Act (that has serious problems) will help, particularly in the next election.

</comment></comment><comment><USER4> > "In just a few short years, songs we recorded in the late 1960s will no > longer have copyright protection in Canada."

... So? Did the fact that the copyright would expire around 2020 stop you from creating? No? What was the driving reason then? Why does an extension help create incentives - why did these incentives disappear over the past couple decades?

</comment><comment><USER5> I fully expect this to become law without anyone I talk to in Canada knowing about it.

<comment><USER6> It's not like there is much we can do about it :(

<comment><USER7> Write your MPs?

How do referenda work in Canada?

<comment><USER6> I may, but the Canadian political landscape right now is one where the ruling party has a majority so they can push through pretty much any bill they want. Also the party has pretty much discouraged MPs from expressing any opinions counter to the party line.</comment></comment></comment></comment>


Should We Kill the Dollar Bill? (2012) - <AUTHOR> http://www.npr.org/sections/money/2012/04/19/150976150/should-we-kill-the-dollar-bill <comment><USER2> I was curious if hoarding dollar coins would actually happen, so I did some research comparing the US and Canada. Very similar economies, and their respective dollars have roughly the same purchasing power.

The estimated 2016 GDP of the US and Canada are respectively 18.7 and 2.05 trillion of their dollars. The US Federal Reserve estimates that there are 11.4 billion dollars of dollar bills in circulation. The Royal Canadian Mint has produced about 1.34 billion "loonies", the dollar coin introduced in 1987. I'll assume that most of them are still in circulation. So that's 610 US dollar bills per million of GDP, versus 654 Canadian dollar coins.

So Canadians aren't leaving their dollar coins in jars.

[https://www.federalreserve.gov/paymentsystems/coin_currcircv...](https://www.federalreserve.gov/paymentsystems/coin_currcircvolume.htm) [http://www.mint.ca/store/mint/learn/1-dollar-5300014](http://www.mint.ca/store/mint/learn/1-dollar-5300014) [http://www.imf.org/external/pubs/ft/weo/2015/02/weodata/weor...](http://www.imf.org/external/pubs/ft/weo/2015/02/weodata/weorept.aspx?sy=2013&ey=2020&ssd=1&sort=subject&ds=.&br=1&pr1.x=38&pr1.y=6&c=156%2C111&s=NGDP&grp=0&a=)</comment>


Ask HN: Whats a good way to handle my 497 bookmarks? - <AUTHOR> I've accumulated these over the course of 7 years. Some exported from IE, firefox, Chrome, del.icio.us some saved as .lnk files, some as text files. You get the idea. I realized a lot of them are dead (sadly). What do folks use to keep your bookmarks relevant ? <comment><USER2> I had accumulated about 300 over the years and went through the following process to tidy up. 1\. Get all links into a html format 2\. Run through a python script to weed out invalid / dead links. 3\. Of the remaining active links , run them through a script ( used headless chrome puppeteer ) to gather title , tag info for each link . 4\. Check if any of the links were part of a named folder and catalogue. Unfortunately some of the bookmarks were not filed into named folders. 5\. Run a script to check for common keywords or terms and group. ( Used R script ) 6\. Manual check again and group them with appropriate #'s into Bear app which I use for note taking. While it might seem Heath Robinson'ish way of achieving something , I went about it this way to hone the skills around python , Puppeteer and R.

Now when I bookmark something I catalog why and what I want from that link clearly noted down in Bear app with tags.

</comment><comment><USER3> Look into pinboard.in

It's what I use to manage my bookmarks, way better than delicious.

</comment><comment><USER4> You're not the only one with this problem.</comment>


FBI has been using drones since 2006 - <AUTHOR> http://touch.latimes.com/#section/-1/article/p2p-77565378/

<comment><USER2> This always seems to happen. They do stuff that is illegal for about 5-10 years prior to even lobbying to make it a law, and then Congress makes it a law, and nobody ever punishes them for doing it illegally before.</comment>