Microsoft Azure's use of non-US IPv4 address space in US regions - <AUTHOR> http://blog.azure.com/2014/06/11/windows-azures-use-of-non-us-ipv4-address-space-in-us-regions/ <comment><USER2> I would say that this is going to become a normal occurrence soon in many other IT companies running out of IPv4 space. An easy way currently to get more IPv4 space is for example to buy them from other regions like EUs RIPE.

RIPE for example actually sold IPv4 classes at some point so all those are actually owned by their respective owners and can be rented out or outright be sold. In order to be able to use any of these RIPE IP spaces all you will need is to have a valid PA account/membership with RIPE and you can use them anywhere and not only in EU.

</comment><comment><USER3> This is not limited to the US, either. I have an Azure account hosted in the North Europe datacenter (in Dublin), and our IP addresses are associated with Brazil in the GeoIP databases.

</comment><comment><USER4> Oh, this is why I can't download Youtube videos via Azure VMs.

</comment><comment><USER5> How did the phrase "non-US IPv4 address space" even acquire meaning? The purpose on an IP address is to name a system on the internet such that you can send packets to it. WTF does that have to do with geography? (Apart from the fact that you might generally want to aggregate geographically close systems into contiguous address ranges in order to keep routing tables managable, but that obviously has exactly zero to do with borders of countries and stuff like that, and more with the physics of signal propagation ...)

<comment><USER2> I think this has more to do with GeoIP databases than anything else and registry CIDRs allocations across the world.

<comment><USER5> Yeah - but what's the point of GeoIP databases? Most if not all of the use cases are idiotic. The browser tells me that the user understands English and French, but since the GeoIP database tells me the client's address is "brazilian", I'll deliver portuguese text! WTF? Similarly, routing requests to servers in the same country is kinda stupid - you want to achieve responsiveness, and responsiveness comes from shortest paths in the network graph, not from being inside the borders of the same country, or even from shortest geographic distance. In that case some suboptimal routing at least should be of little consequence, so it might be a usable approximation. Limiting access to content because you are in the wrong place is about as counter to the idea of the internet as you can get, so it's idiotic simply because of that. There simply is no sane reason to even have a concept of a "location of an IP address", other than its location in the network graph for packet routing purposes.

(edit: and the first one of those is causing lots of unnecessary pain, not only to travellers who suddenly have to deal with a "different internet" simply because they moved their body to a different place on the planet, but also for people in multi-lingual countries, who regularly have to deal with moronic websites forcing them into some particular language version that supposedly is the "language of their location", ignoring the fact that the user not only doesn't understand the language, but specifically tells the server via appropriate headers which languages the user understands.)

<comment><USER6> This is a pet hate of mine. Tech companies, especially US ones have a horrible habit of assuming language preference based on location. In Spain != Spanish. Or do say 14 million Catalan speakers anyway. Whenever I travel abroad I notice how sites ignore my Accept-Language HTTP header. It is just impolite.

</comment></comment></comment></comment><comment><USER7> I read somewhere that MIT or Stanford have more IP addresses than China or Africa. Perhaps there is an option to buy those?

<comment><USER8> No, Stanford gave that block back in 2000. See: [http://arstechnica.com/information- technology/2014/06/with-t...](http://arstechnica.com/information- technology/2014/06/with-the-americas-running-out-of-ipv4-its-official-the- internet-is-full/)

Microsoft has been purchasing blocks of IPv4 space (they bought some off of Nortel a few years back). Obviously they don't have enough.

</comment></comment><comment><USER9> I understand that there are really no other options, but this is a pretty bad place to be in. It doesn't sound like Azure can make any hard guarantees that this issue will go away, only that it will be "alleviated." That wouldn't make me feel good as a customer.

</comment><comment><USER10> Why can't they move to IPv6?

<comment><USER11> Because then services offered by their customers would not be reachable for over 97% of the internet.

I would assume that's bad for business.

<comment><USER12> Many cloud customers would be fine with IPv6-only VMs and one IPv4 adddress on the outside of their load balancer. Yet cloud providers are building the opposite architecture.

<comment><USER13> Most cloud customers are fine with RFC1918-IPv4-space VMs and one IPv4 address on the outside of their load balancer.

</comment></comment></comment></comment><comment><USER14> This kinda leads me ask. Why don't we start allocating the E-Block? I know its a shitty solution and IPv6 would be better, but isn't that a short term bandage?

<comment><USER15> if you mean 240.0.0.0->end, it is actively in use for private purposes..

<comment><USER16> And a lot of IP stacks will treat any traffic from it as invalid. Even if the standards were revised to declare it as usable, it'd be impossible to use in practical terms.

</comment></comment></comment><comment><USER17> So I guess the next step is to buy the remaining African address space?</comment>


(Part 2) We Just Undid Three Months of Dev work. Here's What We Learned. - <AUTHOR> http://blog.scoutapp.com/articles/2009/10/20/part-ii-we-just-undid-three-months-of-dev-work-heres-what-we-learned <comment><USER2> Hmm,

 _We launched a major development initiative based on our internal ideas of what users wanted. In retrospect, we should have spent much more time speaking with customers and vetting the ideas._

I do not know a magical formula for features that make money. I do know that Steve Jobs very clearly says that he creates products by asking what would be really cool to have. Sometimes users know what they want and are correct. Sometimes they wrong in the sense that what they describe won't really satisfy them.

There could be difference between a niche market and mass market in these considerations as well as many other consideration. This is not to demean the article in the least - it's more that this is really hard problem and there aren't easy answers even if what works in a given situation is usually something simple.

</comment><comment><USER3> The skill comes with being able to digest and boil down what the users are saying. This is going back to the old Ford lesson, that if he'd listened he would have built a faster horse.

There is just going to be a lot of noise and out of that one must pick out recurring themes and look for patterns that tell you whether or not something needs to change.

</comment><comment><USER4> great article. we all need to constantly remind ourselves to listen to our users and to not just look at the competition.</comment>


Ask HN: Is Perl still useful in 2014? - <AUTHOR>

On what areas is it used? What can I learn from it as a language? <comment><USER2> Perl I think, if nothing else, shows a great example of how a language can evolve dramatically. You can almost date the code you're reading (or the programmer, or the age of the online tutorials the coder read) based on style of the code.

I've been paid to write perl in a team maintaining high-volume web properties and internal APIs for a large telco, and I also spent a few years in a Bioinformatics role which used it a fair bit at a national science agency (the research community in that particular corner of the discipline had some pretty awesome tools/libraries written in perl, but the full gamut of stuff we used also included ruby, python, R, C, Fortran...)

Just a few days ago I wrote how I missed Perl's Moose OO framework now that I'm doing mostly Python [1] [2], and that interestingly it's this that has prompted me to think more seriously about using a more strongly/statically typed language for large projects in future.

[1] [https://news.ycombinator.com/item?id=8627143](https://news.ycombinator.com/item?id=8627143) [2] [https://news.ycombinator.com/item?id=8627819](https://news.ycombinator.com/item?id=8627819)

<comment><USER3> I'm at a military hospital, the only language they'll allow is perl. But I can have any version I want installed (eg Padre). But I can remote I to HPC systems with ipython. Not sure if the left hand is talking to the right.

<comment><USER2> Although large organisations tend to have a goal of minimizing the number of languages and platforms they depend on, rarely does this turn out to be the case in practice. HPC systems in particular are expensive assets which could never justify themselves if they could only run one kind of workload in one particular language :-)

If I had to guess, you're working in a business unit that is heavily invested in perl and so sticking other stuff in that environment is perceived as an unnecessary future maintenance burden. The HPC system on the other hand is perhaps shared across multiple business units who don't have the exact same stacks as each other so it's flexible in that way.

python + pandas is pretty awesome though, I was able to delete thousands of lines old perl code dealing with irregular time series when I re-wrote with pandas - it made sense in that instance to ditch the old perl code, it doesn't always though.

<comment><USER3> To be clear, I'm a pathology resident trying to do research. My code wouldn't affect anyone. I just want to think in python instead of perl.

<comment><USER2> Ah, so a little more arbitrary than I assumed. I initially hated perl when I first started with it, for what it's worth. I guess you've progressed beyond the point of finding [1] helpful (even if the perl looks a bit strange to me in places). And, apart from Moose I also miss perl's lexically scoped variables :)

It would suck to do numerical work without pandas though. I love pandas.

[1] [https://wiki.python.org/moin/PerlPhrasebook](https://wiki.python.org/moin/PerlPhrasebook)

</comment></comment></comment></comment></comment><comment><USER4> Of course it's still useful. It's as useful as it ever was, but now there are serious competitors in spaces that it used to dominate.

I know several dynamic languages and perl is still my go to choice for smaller jobs. Personal preference perhaps.

</comment><comment><USER5> Perl is still used in bioinformatics daily. People can write for days about why to use x instead of Perl, but at the end of the day, people can use modern perl 5 to do anything anyone can do in any other technical community.

The only serious downside to Perl (which is a pretty serious one I'll admit) is that it might be harder to lure in good programmers. I have met plenty of Perl programmers who advocate Perl because they are afraid to learn anything else. Still, I know a lot of Perl programmers who are so good they are not insecure and simply enjoy using it.

At this point, I only use Perl for ad-hoc data munging-- things that I could just as easily use python for.

<comment><USER6> Hm, I'm using ruby for bio-informatics[1]. I've found the 'bio' gem pretty much complete, but there is a _serious_ lack of documentation. The best option for scientific-related project, programming-wise appears to be Python because it has a huge set of libraries and much better documentation than ruby (and I guess perl too).

[1] [https://github.com/atmosx/dogma](https://github.com/atmosx/dogma)

</comment></comment><comment><USER7> I pretty much only use perl. And use it every day. What can you learn? What ever you want, you can use any paradigm: oop, functional, procedural, ect. You can make webapps, or database driven apps. To really learn you are going to have to make it to one of the perl conferences though. I used perl for 3 years, but at my first perl conference, I learned more in a couple of days and than the last 3 years....

</comment><comment><USER8> Would Perl be a good langauge to learn if you were looking for a niche?

<comment> adam-_- As a programmer looking for a job? Maybe. A lot of places looking for Perl developers are looking for senior developers who understand the tooling, eco- system and a selection of "modern Perl" best practices and modules, as well as the language itself.

That's probably what you would need to learn if you wanted to be employed as a Perl developer.

Of course, if you are less experienced, you could work for a larger, modern Perl-using company where you can learn these things.

</comment></comment><comment><USER9> What can you learn from PERL? How about regular expressions?

PCRE has been widely adopted. [http://www.PCRE.org/](http://www.PCRE.org/)

</comment><comment><USER10> yea its still used for shell/web/config management. i would only use it for data conversion and shell scripts anymore. not serious: you can learn good and bad of language design. i guess its going away b/c u can use php/node/ruby/python for scripts more and there are more stand alone apps for shell to do jobs you used have to code by hand in perl.</comment>


Sourcing.io - <AUTHOR> https://sourcing.io/ <comment><USER2> Engineers are valuable for what they can learn (skills and about the problems they are solving) not for what they know at a particular point in time.

A myopic way to look at hiring.

Edit:

You should care about the _delta_ of an engineer's career and knowledge. That says a lot more about how they'll perform now and in the future.

These days companies prove themselves to engineers. I'd rather see something like a more descriptive and meaningful glassdoor so that I can know what companies are worth my time.

Tags/attributes like:

"$company is in the 67% percentile for employee freedom in your job type [Software Engineer]"

"$company practices open allocation."

"$company is known for fast-firing. They are also known for paying XX% above average for your job type [Software Engineer]"

I don't want some bullshit tag-based skill endorsement clone of LinkedIn profiles. I hate LinkedIn for a reason. I definitely don't need to be even more discoverable by recruiters - my website is a fucking curse on that front as it is. I leave it up because I do get valuable conversations going because of it.

I'm more interested in sites that could further balance the lopsided information power dynamic between employers and employees.

I want to know if there's a chance of a fit between me and the company before I even email somebody.

A company is more likely to be able to recruit me the more _substantive_ information I have about what it's like to work for them. Shut the fuck up about perks, tell me about how you empower your employees to perform their best and entrust them to do the job as it needs to be done.

Things like sourcing.io don't just hurt engineers, they hurt the companies that recruit like this (technology checklisting) too.

-

Making it even easier for lazy recruiters to be shitty is a bullshit thing to do. May the spam of a thousand recruiters looking for "Senior Java developers" flood your inbox and decimate your sanity MacCaw.

<comment><USER3> (I'm working with Alex on Sourcing.io.)

Hi Chris--I completely agree that an engineer's ability to learn is a huge part of their value. With that said, many companies are searching for engineers who are intimately familiar with particular languages or frameworks. Anyone can get comfortable with a new framework over a weekend--it takes much longer to be become an expert.

Your idea for a better Glassdoor is an interesting. In the future we're hoping to build a set of tools for engineers who are interested in getting a job-- we'd like to cater to both sides of the market.

Alex and I do not want to increase the volume of recruiting spam in the world. Poorly-constructed, boilerplate emails are the mark of a bad technical recruiter--we're not building tools to help them. We want to give the great technical recruiters a tool to help them figure out if they should be sending an email to an engineer in the first place. Furthermore, we're encouraging our customers to have the C*O's and engineers construct and send the initial emails--an email from the person you'd be working with is much better than another piece of recruiting spam.

If you'd like to get in touch and chat more please feel to email on firstname.lastname@example.com.

<comment><USER4> I don't know if it's universal (Dutch freelance IT); but I would loooove to have a tool that would:

* broadcast my availability to a group of approved (company) recruiters

* let recruiters propose companies to me (and have me list companies I already have contacts at or was introduced at.)

* let me set up job interviews with the interesting opportunities

* and, _most importantly_ , let the recruiters/companies place bids on me negotiate.

I've found that every time I'm on the market I'm essentially running this auction myself and it's a lot of work.

Given the massive impact it has on my earnings I'd love some tooling that would let me focus on the important parts of this process rather than the administrative minutiae.

<comment><USER5> That is an interesting idea to have some kind of broker platform where you trade skills against rates. I have been exploring a small job platform idea too, and maybe anyone out there wants to chat more?

<comment> w0rd-driven During my latest round of searching for a new gig, I realized I could use an application to at least track the opportunities I had. If you juggle a bit of interviews at once it becomes a little difficult to keep things sane if you aren't careful. Having something to help me refine my crappy interviews or take adequate notes to realize the pros and cons for future endeavors would've been a godsend. I hadn't really done a lot of interviews for development shops around here so I had no clue what I was missing until I saw it first hand. I kept somewhat adequate notes in OneNote (yes, windows phone and yes I know I'm one of 3 users). I even made an Excel spreadsheet to keep most of the information together but nothing beats charts, graphs, or adequate reminders like "Hey, you should likely prepare for the interview you're about to have buddy" because the ones I weren't prepared for sucked hardcore and they were totally my fault.

I had the idea that it could be beneficial to freelancers/contractors as they do the same thing but usually in much more limited time scales to the x months I took. I'm one to share ideas because if someone makes it, I'll stop building it. As someone that wants to be a freelancer at some point, I don't look forward to the oDesks of the world (no offense to people that do great there) but having just something to keep all of these plates spinning more freely would help a lot of people I think.

<comment><USER5> Interesting, so you say it is also a problem to track the jobs that company offers? I totally agree that ODesks, elance, etc. are very poor to find a good match between project and interest and rate. These platforms are really about "out-"sourcing, often not about developing solutions to your unique problems.

Well, the main problem is that companies often don't know what skills they really need, and employees don't get a sense for the work culture from vague job descriptions.

Last, from what I heard was that most freelance jobs go via the personal network anyhow.

Just curious if there are others interested in discussing a better project platform for freelancers, and the way to meaningful work? Have a look at [http://voki.me](http://voki.me) for a rough prototype.

</comment></comment></comment></comment></comment></comment><comment><USER6> Right, so I'll just come right out and say this:

What the flying fuck?

I already get a TON of recruiterspam (much of it hilariously inaccurate, like offering me a relocation bonus to move to the city I was living in).

Based on their "How do you find engineers" answer

      >  We scour the web, and use multiple different sources of public data to find candidates. Next we put all that information through a variety of different algorithms to try and separate the wheat from the chaff.

I would presume that you're gunna scrape my github, notice that I've got code in a couple of big projects, and then proceed to email me? How the hell do I opt out? Or view the profile that you've got for me?

<comment><USER3> (I'm working on Sourcing.io.)

We don't currently have a quick-and-easy way for you to opt out--we will do soon. If you'd like to email me on firstname.lastname@example.com I'd be more than happy to find your profile, show it to you, and remove it permanently.

As an aside, we _really_ hate recruiter spam too. We've just got started but our plan is to build a tool to help great recruiters manage engineer-to- engineer outreach--it's much better to receive a recruiting email from the person you'd be working with. If you're interested, they can connect you to their technical recruiter who can manage the process from there.

<comment><USER6> Email sent. Looking forward to hearing back.

<comment><USER3> Reply sent--thanks for getting in touch.

</comment></comment></comment></comment><comment><USER7> I don't understand. They say "we find you developers from our database of 4 million devs" but later say that they find them from YOUR github/fb/linkedin/twitter connections? So is this a sort of web scraping tool?

<comment><USER8> Time for the damn GitHub to introduce more privacy, instead of putting all you ever do in a PUBLIC activity feed, with no opt out.

<comment><USER9> Time to stop using GitHub.

</comment></comment></comment><comment><USER10> Hi, I'm the co-founder of Sourcing.io, and the engineer who built it. Stoked that we're on HN, and get the chance to respond to the engineering and hacker community.

Our introduction blog post says a bit more about our mission.

[http://blog.sourcing.io/hello-world](http://blog.sourcing.io/hello-world)

Believe it or not, I hate 'spam' recruiting emails as much as the next engineer. This is how I feel about them:

[http://blog.alexmaccaw.com/recruiting- emails](http://blog.alexmaccaw.com/recruiting-emails)

We're not here to increase the spam problem - quite the opposite. We've put a number of safe guards in place against this kind of abuse:

* We don't allow big recruitment agencies known for spamming on the system.

* Our system is geared around referral based recruiting - finding people already connected to your company. For example, promoting candidates who follow one of your engineers on Twitter. This is the type of recruiting we live for and want to promote.

That said, there are definitely some things we should (and will) do.

* Allow developers to see, edit and update their own profiles

* An instant opt-out button

Let me know if there's anything else I can answer.

<comment><USER11> I appreciate this idea leveraging data from Twitter and GitHub and truly believe that's the better way to find professional engineers which are associated with your community somehow. What about intelligent algorithms to evaluate and to display engineer skills (points or school grades)?

<comment><USER10> We actually originally started generating a 'score' for engineers, and it's still part of our API. However, we dropped it from the interface since it was confusing a lot of people, and the score tended to reflect how popular an engineer was, rather than how good they were. As you can imagine, figuring out the latter is a very complex problem. For now, we've removed it.

<comment><USER11> That's true. It's nearly impossible to evaluate accurately how good an engineer was, but for me personally it seems to be useful to display similar informations to companies. Something like "geek cred" (coderwall.com) or open- source track record, because building many projects is one of the key-factors of experience. Coderwall published that they work with statistical methods like central tendency. [https://coderwall.com/blog/2012-02-05-the-companies- id-want-...](https://coderwall.com/blog/2012-02-05-the-companies-id-want-to- work-for)

</comment></comment></comment></comment><comment><USER12> That they launched with a price tag and functionality for recruiters but nothing to even let developers see the profiles they've assembled, without consent, by scraping public data tells you all you need to know about their respect for engineers.

<comment><USER3> (I work at Sourcing.io.)

This is a very valid criticism--we need to do a much better job of explaining the service to engineers. Like most startups, we've got a list of things we'd love to build but haven't had time to. With that said, the tools for engineers could certainly have been prioritized. At the very least, we should have added a simple way to opt out. We will be adding this soon.

</comment></comment><comment><USER13> Not honest to say its 'our database' when you are just scraping/searching github and stuff.

But I looked at the [https://help.github.com/articles/github-terms-of- service](https://help.github.com/articles/github-terms-of-service) and I don't think it says you can't scrape to a database, although at least one clause about reselling or whatever causes a question.

Its cool if they are honest in their marketing and actually add something to github search, which I am pretty sure they do, because github search isn't very good.

Anyway seems very useful but don't really like the marketing.

<comment><USER3> (I work on Sourcing.io.)

I'm sorry to to hear that you don't like the copy on the homepage--it's definitely a work in progress and I appreciate the feedback. We're going to be adding a section for engineers soon.

Just as Google keeps a copy of the web, we have an index of all the engineers we can find in a database. This is built up by crawling publicly available information.

</comment></comment><comment><USER14> When developers on a team using sourcing.io connect themselves to the service (in order to enable the social search functionality), does this add them to the sourcing.io database? If so, doing this would probably lead to more spammy recruitment emails for all those devs.

<comment><USER3> (I'm working on Sourcing.io.)

Great question. Our database is built up by indexing publicly available information. Some (or all) of the engineers that connect their accounts will already have a GitHub account and, if so, will probably be in our index. However, we certainly don't use the social connection feature to index _even more_ people, particularly if they're not publishing code and are more private.

The ability to see your team's extended network of engineers is really useful but we recognize that it's pretty scary to connect your personal social accounts to an app that's work-related. We're working hard to earn the trust of the engineers who happy to share their network with their employers.

</comment></comment><comment><USER15> First of all, best of luck with this guys.

This approach has been already tried many different times. I've got some friends that really pushed really high on that whole "recruiting via web scrapping" thing - [https://masterbranch.com/](https://masterbranch.com/) ( feel free to contact them, they are really nice guys ).

I wish you luck because I understand this approach never really worked for anyone. IMHO, it's simple [Disclaimer: I created a super fancy ATS software / job board too and did all the sales up to a point of really hating HR people :)], recruiters are truly lazy and are interested only on tools that do their job - something understandable as the sourcing part of the job is really weary. Web scrapping tools instead of doing their job just add more noise to it, i.e. forward them tons of profiles that are not really interested in the specific job posting they are marketing. You might think most developers are always open to move because some of us might be, but many people are really happy with their daily jobs, so this sort of tool always ends up making angry both sides of the coin: the developer and the recruiter.

So, it does not really matter that your "database" has 4M people on it. Even if those are somehow linked to the company recruiting. When as a recruiter I search for "node.js programmer" and get 100 results back but 99 of them are not interesting in changing jobs, well... that sucks. I wouldn't use the tool again myself. And going further with this example, well, believe me, most recruiters would think the tool sucks if just the first three profiles are not interested in the job.

But hey, I insist, I wish you the best of luck. Just pointing some stuff I learnt ( hopefully for you wrongly learnt ) during my HR entrepreneurship stage.

<comment><USER3> Thanks for sharing the link Masterbranch--it looks like they're catering to both sides of the market place. I'd be really interested to hear more about what you learning during your foray into recruiting--could you email me on firstname.lastname@example.com?

</comment></comment><comment> w0rd-driven I was expecting an ability to view the data not so much as a way to opt out, but to see if there's anything I could improve. Maybe something is public that is only hurting my "score" so to speak. Maybe the little I contribute to other OSS projects due to limited free time is hurting me more than I expect?

I purposefully went to the site hoping I could see something on myself without going behind a paywall. I'm starting a new gig on 1/6 and even if I weren't, I'm not quite the "target market." I do want to recommend this to the powers that be and hopefully use myself as a "control" to find a somewhat adequate replacement. I'm such a jack of all trades though that I'm afraid I may not be adequate for that either.

I do quite understand that $95/mo is much less than any recruiter fee over time so I completely understand the value of this service. It'll just be really hard to do a cold recommendation to have my soon-to-be-ex employer spend money on something they wouldn't be able to evaluate as easily as I can. I may be addressing problems Sourcing.io can't really speak to anyway. These may be "shoot ourselves in the foot" sort of issues no one can address but them.

</comment><comment><USER16> Scraping data of engineers not looking for jobs with the purpose of recruiter spam?

Sounds like that dating site that scraped facebook and called it their userbase:

[http://www.wired.com/business/2011/02/facebook- dating/](http://www.wired.com/business/2011/02/facebook-dating/)

Honestly, sometimes this stuff really works and only seems shady before it takes off.

But sometimes it's just shady.

</comment><comment><USER17> Yikes, on the one hand this sounds like a very useful search tool for technical recruiting. On the other, it sounds like its usefulness depends on how many members of your team you sign up for it...and once someone is signed up they scrape all their data and add it to their "database".

<comment><USER3> (I work on Sourcing.io.)

Although the social connections feature is really helpful, there are lots of other ways you can use Sourcing.io to search for engineers. There a lots of other ways to filter the data: location, project contributions, language experience, current employer, et al. For example, to find people who might be a fit for your DevOps role at Perfect Audience, you might want to see all the engineers that had contributed to Graphite's web app ([https://github.com/graphite-project/graphite- web](https://github.com/graphite-project/graphite-web)) or have lots great DevOps people following them on Twitter--we try make these kinds of searches really easy to do.

</comment></comment><comment><USER18> So how does one know if they are in your database?

<comment><USER3> (I work on Sourcing.io.)

Right now we don't have a simple way for engineers to see what their profile looks like--we'll be adding this soon. In the meantime, please feel free to email on firstname.lastname@example.com so I can show you what your profile looks like. If you'd like to be permanently removed from our index I can do that right away.

<comment><USER19> Hmm, so there might a profile created for me without my permission? This is wrong in my opinion, and illegal too in Finland.

</comment></comment></comment><comment><USER20> Alex and Richard good job. looking at the progress of your competitor's link below, suggest to me that what you are building is needed. [http://techcrunch.com/2013/06/19/entelo-the-big-data- recruit...](http://techcrunch.com/2013/06/19/entelo-the-big-data-recruiting- platform-used-by-box-yelp-and-square-lands-3-5m-from-battery-and-menlo/) leverage social data to search for and identify great candidates

</comment><comment><USER21> While I may like the project, I really hope that in many countries is illegal to earn from profiles of oblivious people who never choose to be part of an "offer"

</comment><comment><USER22> Why does it need my credit card number during trial period?

</comment><comment><USER23> This is one specific reason I have no Twitter, LinkedIn, or Facebook. (And I still get tons of recruiter spam calls and emails.)

</comment><comment><USER24> won't this just enable recruiters to spam developers?

<comment><USER3> (I'm working on Sourcing.io.)

While that is a possible outcome, we're working _really_ hard to make sure that doesn't happen. We'd hate to be responsible for an _increase_ in the volume of recruiter-spam sent to engineers every day. Although this isn't on the homepage, we are planning to add a set of tools so that engineers can manage their profiles and companies' technical recruiters can coordinate engineer-to-engineer outreach. We believe that it's a lot better when engineers should receive cold recruiting emails from the people they'd actually be working with.

<comment><USER9> So the answer is /yes/. Everyone you index has to know about you, and go to your website in order to opt them out of receiving emails they never asked to receive in the first place? That means it's spam.

</comment></comment></comment><comment><USER25> Ok, It's good that you are working in an opt out, but how about of an opt in?, many developers don't have a public profile to scrape their abilities..

</comment><comment><USER26> How is this different to [http://www.3sourcing.com/](http://www.3sourcing.com/) (500 Startups 007 batch) ?

</comment><comment><USER3> Hello, I'm working Alex on Sourcing.io. Please feel free to ask me a question here or email me at any time (email@example.com).

<comment><USER27> I asked this on Twitter and never got a reply - how do I opt out?

I get enough spam already from recruiters on LinkedIn - even though I've said I'm not looking for work.

If you want to make this useful, become opt in only. As a recruiter, I don't want to waste time emailing people who aren't looking for work.

<comment><USER3> (I work with Alex on Sourcing.io.)

Apologies for the delay in responding your tweet--I found it here([https://twitter.com/edent/status/415537481829068801](https://twitter.com/edent/status/415537481829068801)). I'll get back to you over Twitter as soon as we've removed you from the index.

We are working on a set of tools to allow engineers to manage their profile on Sourcing.io (and opt out)--I hope that they'll be good enough to encourage you to re-join.

<comment><USER27> Thanks. Although, in the spirit of HN pedantry, I cannot _re_ -join as I never joined in the first place.

Please, I urge you to move to an opt-in only model. Otherwise you run the risk of being as despised as Klout and other similar forced participation sites.

<comment><USER3> Correct! That was not clear. I hope you'll forgive the transgression as I'm juggling a few forms of communication at the moment--this HN submission came out of the blue.

I completely understand your perspective. The problem for companies who want to recruit great people is that most of them aren't looking for new a job (several studies put the percentage at around 80%). Therefore, companies are forced to reach out to those people to pique their interest. There's a subset of great companies who take the time to craft personalized, relevant emails to these people; there are some who even get their engineers to write the initial email. We want to work with these kinds of companies.

<comment><USER9> > The problem for companies who want to recruit great people is that most of > them aren't looking for new a job

Right, then they're not looking for a new job. What part of that do you not understand?

<comment><USER28> I'm not actively seeking new employment and am very happy at my current position. However, I am always (passively) interested in new opportunities, and am not going to ignore something awesome that falls in to my lap. A service like this is actually very valuable for someone like me.

That said, opt-in is the way to go. I definitely don't understand the seemingly contradictory point of view of them saying "we don't like recruiter spam either" and "we find ways for companies to send unsolicited requests".

So, I would fall under the categorization of "aren't looking for a new job", while at the same time don't agree with the opt-out (without an actual opt-out mechanism) nature of this service.</comment></comment></comment></comment></comment></comment></comment>


Where's the Proof That Mindfulness Meditation Works? (2017) - <AUTHOR> https://www.scientificamerican.com/article/wheres-the-proof-that-mindfulness-meditation-works1/ <comment><USER2> Great example of reductionist Intellectual Yet Idiot garbage.

TRILLIONS of trial and errors - thousands of years of meditation practice by untold billions of practitioners who have ever lived - or one almost certainly mistakenly-designed experiment?

I think in areas of highly interconnected complexity, the evolutionary utility that arises out of trial & error is usually much greater than what can be found in a double-blind clinical experiment.</comment>


Apple unlocked iPhones 70 times for Feds - <AUTHOR> http://www.thedailybeast.com/articles/2016/02/17/apple-unlocked-iphones-for-the-feds-70-times-before.html <comment><USER2> A story in ARS from least year to provide context: [http://arstechnica.com/tech-policy/2016/02/after-three- month...](http://arstechnica.com/tech-policy/2016/02/after-three-months-apple- wants-judge-to-rule-on-forced-iphone-unlock-case/)

The case is 15-mc-1902. Documents turn up via Google.

Footnote 3, page 3 of the order states:

 _Apple has previously been ordered to extract data from devices running iOS 7 or earlier and has performed such extractions. These orders generally come in the body of search warrants and contain specific language to avoid confusion over the scope and legitimacy of the demand on Apple. This case marks the first time a judge has questioned the authority of the All Writs Act to grant supplemental orders to accompany such warrants and asked Apple for its views on the feasibility and burden associated with such an order before issuing_

[https://cryptome.org/2015/10/apple- search-011.pdf](https://cryptome.org/2015/10/apple-search-011.pdf)

I didn't dig any deeper to confirm the claim of 70.

<comment><USER3> Maybe they have unlocked 70 historically, but this all changed with the introduction of the Secure Enclave and TouchID. I believe they're saying they can't do it now, so the 70 number is essentially irrelevant in the context of the current debate.

<comment><USER2> Secure enclave isn't available on the iPhone 5C involved in the high profile case that Apple has been responding to publicly.</comment></comment></comment>


Checkout & vote for Loogla (fellow startup changing how we think via language) - <AUTHOR> http://ves.to/loogla/

<comment><USER2> Loogla is amazing! Help get their passion project the funding it needs to blossom!

</comment><comment><USER3> These guys deserve support for a new way to learn language!</comment>


Microsoft's app store was designed by engineers - <AUTHOR> http://marakblog.wordpress.com/2013/02/09/microsofts-app-store-was-designed-by-engineers/

<comment><USER2> First off, ugly is in the eye of the beholder. I don't find it ugly, I find it nice and original.

Secondly, the idea isn't to push as many apps as you can in one space. That just leads to the paradox of choice. A smaller selection on the screen which is readable and not overwhelming can be quite effective.

I agree that a search box should maybe be present, but I disagree with most of this article.</comment>


A Few Weeks with Atom - <AUTHOR> http://bramanti.me/a-few-weeks-with-atom/

<comment> atom-x Every article I've read on this topic tends to say the same thing: Atom is a decent (but somewhat performance-hindered) text editor that borrows some, but not quite all, of the features and nice bits of Sublime.

Given this, why would I want to switch until it has parity with everything I've come to expect from being a paying user of Sublime?

<comment><AUTHOR> For the UI. Atom is a significant update in user interface, and while there are performance dips (mainly at startup or using complex packages), the overall experience of using Atom has improved my workflow.

<comment> atom-x Interesting. I'll check it out, but unless I can get the same level of integration, super-fast file loads and searching, and parity with packages... I'm likely to not be a convert.</comment></comment></comment>


Where Geek Girls Come From - <AUTHOR> http://siderea.livejournal.com/1283810.html <comment><USER2> I don't know that men don't have origin stories. I knew I was 'truly destined' to be a chemist when I fell asleep on my ochem book before I got to the NMR section, and went to the exam the next day, bombed everything, except the NMR part, which I deduced entirely from first principles. Before that, in high school, I wanted to become a chemist when my hip chemistry teacher showed us how to use the water tube to put out a fire (guess I also wanted to be a fireman).</comment>


What Apple Learned from Automation: Humans Are Better - <AUTHOR> https://www.theinformation.com/articles/what-apple-learned-from-automation-humans-are-better <comment><USER2> this should be titled: humans are cheaper than fixing some corner cases.

given extra money and/or time the corner cases can be eliminated.

Apple, tesla and boeing have still automated an enormous amount of manufacturing, and the amount is just rising over time.

</comment><comment><USER3> Without paywall : [https://appleinsider.com/articles/20/06/04/how-apple- learned...](https://appleinsider.com/articles/20/06/04/how-apple-learned- automation-cant-match-human-skill)</comment>


Shakespeare's language not as original as dictionaries think - <AUTHOR> https://www.theguardian.com/books/2016/sep/06/shakespeare-language-not-original-david-mcinnis-claim-oed-bias <comment><USER2> Plutarch wrote 'Lives of the Noble Greeks and Romans' (also called Parallel Lives or Plutarch's Lives) somewhere around the second century AD and Shakespeare wrote 'Antony and Cleopatra' in 1606. Shakespeare took 'some' inspiration from Plutarch. Plutarch wrote in Greek, Shakespeare in Elizabethian English.

Here's Thomas North's translation of Plutarch's work:

"...she disdained to set forward otherwise but to take her barge in the River Cydnus, the poop whereof was of gold, the sails of purple, and the oars of silver, which kept stroke in rowing after the sound of the music of flutes, howboys, cithernes, viols, and such other instruments as they played up in the barge.

Here's Shakespeare's work:

"The barge she sat in like a burnished throne, Burned on the water_ the poop was beaten gold; Purple the sails and so perfumed that The winds were lovesick with them; the oars were silver, Which to the tune of flutes kept stroke, and made The water which the beat to follow faster, As amorous of their strokes"

This is definitely no coincidence. What's more interesting is that even though it's almost a fact that Shakespeare had Plutarch open while writing this, we can actually see him doing some creative work. He added some alliteration, and for some reason we humans love to listen to a series of words that all start with the same sound.

<comment><USER3> Mark Forsyth's _Elements of Eloquence_ uses exactly this example for alliteration, the resemblance between your comment and what he wrote is uncanny. >:(

> _"The thing about this is that it's definitely half stolen. There is no > possible way that Shakespeare didn't have North open on his desk when he was > writing. But also, Shakespeare made little changes. That means that we can > actually watch Shakespeare working. We can peep back 400 years and see the > greatest genius who ever lived scribbling away. We can see how he did it, > and it's really pretty bloody simple. All he did was add some alliteration."

Excerpt From: Forsyth, Mark. "The Elements of Eloquence: How to Turn the Perfect English Phrase."_

<comment><USER4> >All he did was add some alliteration.

No that's not all he did, he also included some striking images, the throne, the perfumed sail, the lovesick wind ...

<comment><USER3> That's within the style of that book, it has a very light tone and doesn't take itself all that seriously. That paragraph is specifically about alliteration, and I'm sure Forsyth wouldn't actually disagree with you.

</comment></comment></comment></comment><comment><USER3> In a way it's a rather strange idea, even if not taken to extreme, because his plays absolutely had to be understandable to his audiences, which would have put a limit on how many novel expressions he could have and still be understood. After all, people do sometimes forget that Shakespeare was not merely a manufacturer of devices to torture schoolchildren, but he was, in fact, also a playwright.

Is it possible that what happened was that pre-digitization research was too time-consuming, so the OED overemphasized easily available sources, like Shakespeare, when looking for first uses of words?

<comment><USER5> Even if his allegedly invented words were entirely novel, I think it's unlikely people would have had issues understanding him. The same mechanisms (combining extant prefixex, suffixex, roots into new combinations and onomatopoeias) are easily visible in slang today—just listen to hip-hop. Just this morning I heard "discriminize" instead of "discriminate" to fit a rhyme scheme. Is that really so different from creating "assassination" from "assassin"?

But, it's a narrow interpretation of the results that this is novel. Etymologists have always been extremely skittish of assigning firm origins to words, much less calling Shakespeare an inventor of them himself. His demonstrated vocabulary is simply massive, and statistically some of the words are going to be early.

<comment><USER6> This is purely speculative, but I think also that introducing new words, or novel combinations would have kept audiences' ears "on their toes" and tuned in to the dialog. The plays ran 2-3 hours. You have to keep the audience engaged.

</comment></comment></comment><comment><USER7> I studied a reasonable amount of Shakespeare as part of my university English and Drama studies (Class of 2002). While I had a pretty damn good scholar running those courses, I didn't think there was anything unusual in the fact that he always described these as "words or phrases that were first written down by Shakespeare" rather than "invented by". Particularly when it comes to slang, words/phrases are often written down at some distance after they become commonly spoken.

Hopefully the digitisation of additional early modern and medieval works helps with etymology - always frustrating to search for something and get six competing theories, all of which seem equally specious.

</comment><comment><USER8> Doesn't really support or refute his argument (which I think is good) but this reminds me of a great New Yorker cartoon from many years ago: two woman are walking out of the theatre; the placard shows they have just seen Hamlet. One woman remarks to the other, "That was just one cliche after another"

</comment><comment><USER9> Reminds me of how so many quotes are misattributed. If it's attributed to someone you've heard of, it's more likely they didn't say it.

<comment><USER10> If, with the literate, I am

Impelled to try an epigram,

I never seek to take the credit;

We all assume that Oscar said it.

\-- Dorothy Parker

("Oscar" being Oscar Wilde)</comment></comment>


NRO Key Talking Points: NGA Sentient (2016; approved for release 2-19-2019) [pdf] - <AUTHOR> https://www.nro.gov/Portals/65/documents/foia/declass/ForAll/051719/F-2018-00108_C05112983.pdf <comment><AUTHOR> Excellent discussion: [https://www.theverge.com/2019/7/31/20746926/sentient- nationa...](https://www.theverge.com/2019/7/31/20746926/sentient-national- reconnaissance-office-spy-satellites-artificial-intelligence-ai)</comment>


PageRank is an abomination (mathematically) - <AUTHOR> http://inperc.com/blog2/

<comment><USER2> Don't agree with article. Parameters that can be tuned are not mathematical abominations.

In a mathematical model there is often a single value for a parameter that can be shown to be optimal. In the complexity of the real world, tuning is often necessary and an optimal number can usually not be proven.

<comment><USER3> Second parent, I don't agree with the article either. Real world engineering is not pure theory. It is a subtle difference. A perfectly valid reason for this type of problems is "it works well in practice", or "it is good enough".

</comment></comment><comment><USER4> The quality of the article can be summed up by one of its sentences: _The consequences are dare._

You could try to reverse engineer that sentence to figure out if it came from "truth or consequences" or "truth or dare", or you could just flag it and move on to something well-written.

</comment><comment><USER5> Don't agree. You can study the PageRank as a Markov Chain (including the d parameter). Now you have a theory.

</comment><comment><USER6> >Then I started to realize that there can't such a theorem.

He accidentally his whole premise.</comment>


The FreedomBox enables you to control your view of the internet - <AUTHOR> https://www.zdnet.com/article/put-the-internet-back-under-your-control-with-the-freedombox/ <comment><USER2> Wow, I backed this on Kickstarter in 2011 for $60.

I was supposed to receive "A custom made FreedomBox Foundation MicroSD card reader so you can keep your freedom running in style and a MicroSD card loaded with Freedom Box software"

...I have not received anything (yet?)

</comment><comment><USER3> These home server boxes never include self-hosting email. Is it because anyone running their own SMTP is assumed to be a spammer?

It's annoying because hosted email services are strangely expensive. Oh, they'll let you have multiple email addresses for a low rate, but as soon as you want multiple _mailboxes_ (which is just a separate directory as far as the server is concerned), suddenly I'm paying way way more.

<comment><USER4> _> These home server boxes never include self-hosting email. Is it because anyone running their own SMTP is assumed to be a spammer?_

Yes, that's part of the issue. Because many home computers got infected by viruses to become bots sending bulk spam, email sourced from residential ip addresses became "guilty until proven innocent".

Even the recent $499 "home email appliance" such as Helm[1][2][3] for private encrypted email ends up using a _centralized_ service such as Amazon AWS for the routing of email packets.

 _> Oh, they'll let you have multiple email addresses for a low rate, but as soon as you want multiple mailboxes (which is just a separate directory as far as the server is concerned), suddenly I'm paying way way more._

If you don't need business-class type of email service ("business" meaning Outlook sync, shared calendars, 99.999% uptime, etc), then the cheapest way I found for multiple mailboxes is a shared hosting plan. E.g. I pay $49/year for 5 website domains that includes email hosting with _unlimited mailboxes_. Not just unlimited addresses/aliases but _mailboxes_. Shared hosting is way cheaper than the $144/year that Rackspace charges for just 5 mailboxes.

[1] [https://thehelm.com/](https://thehelm.com/)

[2] [https://arstechnica.com/gadgets/2018/12/review-helm- personal...](https://arstechnica.com/gadgets/2018/12/review-helm-personal- server-gets-email-self-hosting-almost-exactly-right/)

[3] TWIS also had a 1 hour discussion with Helm's CEO: [https://www.youtube.com/watch?v=1BhOreZKXPA](https://www.youtube.com/watch?v=1BhOreZKXPA)

<comment><USER5> I recently switch to mailcow-dockerized on a cheap 3€/month VPS and it works perfectly. I can create as many mailboxes as I want (until the disk is full) and also have as many domains / email adresses connected. It's really awesome and way easier than I imagined.

Mailcow: [https://github.com/mailcow/mailcow- dockerized/](https://github.com/mailcow/mailcow-dockerized/)

My blog post: [https://jlelse.blog/thoughts/2019/mail- server/](https://jlelse.blog/thoughts/2019/mail-server/)

</comment></comment></comment><comment><USER6> My main issue with things like this is security. I don't particularly want to be responsible for running Internet-facing services as a hobby. I would only consider it if they had a good track record and really solid story around security, perhaps including rapid automatic updates or a remote kill switch in case something critical is found.

<comment><USER7> People are already running home servers. It's just that we call them 'modems' and 'routers'. Most come with few if any system updates. Enough that the FBI have issued national alerts to reboot routers[0].

Turris Omnia[1], based on OpenWRT and maintained by the Czech national domain registrar, is a notable exception, and it is itself a highly capable server. It updates automatically and regularly over the network. With the (optional, supported, and documented[2]) addition of an SSD storage, or an external drive (USB or network), it can provide read/write-heavy services as well (otherwise the onboard flash storage wears too quickly).

Though standing in as a personal social/media server is not its core goal.

Disclaimer: happy owner.

________________________________

Notes:

0\. [https://krebsonsecurity.com/2018/05/fbi-kindly-reboot- your-r...](https://krebsonsecurity.com/2018/05/fbi-kindly-reboot-your-router- now-please/)

1\. [https://www.turris.cz/turris-omnia/](https://www.turris.cz/turris-omnia/)

2\. mSATA drive installation: [https://youtube.com/watch?v=71_M2N3ga7s](https://youtube.com/watch?v=71_M2N3ga7s)

<comment><USER8> Wait so is your argument that people are already vulnerable so being vulnerable twice is okay?

<comment><USER7> No.

It's that the stumbling block of "people won't run servers" is already untrue. People do.

(They may not realise it, but they do.)

They run fairly limited servers, with fairly low attack surfaces and assets, and they (with no small fault of vendors) administer them very poorly. But they run servers.

I am both enthusiastic about what FreedomBox are trying to do and apprehensive of both possible success and consequences (I've been submitting multiple related articles to HN myself over the past few days). I'm watching the discussion with interest, there are good points being made.

If you break down the challenge, it has multiple parts.

Hardware really _isn 't_ the problem -- a $25 RaPi, the Olimex box, a Turris product, or one of Zotex's Pico systems[0] could serve amply, at price-points up to about $300, with full ownership of data, hardware, and link.

Software _mostly_ isn't -- the basic pieces exist, though some are rough. The federated social space, probably Friendica, is a good bet. Mastodon addreses microblogging. For blog-type interactions, RSS/Atom and a feed reader or aggregator works well, and would be a good addition to the FreedomBox.

Social graph -- user adoption -- is a huge issue, though it's also somewhat self-sorting. Early adoptors of such technologies tend to be a fairly high- affinity and the space, _if_ it develops sufficient early momentum, something that could be as few as several 100s or 1,000s of active users (and that could be 10k - 10m registrations or trials) may take root. Though early organic growth may appear slow.

It's the soft areas can be frustratingly hard: picking the technology stack, from harware to OS, protocols, and implementations. This is where choice cuts two or three ways, often leaving bloody stumps. For the advocates, it's a battle for supremacy, for the general public its all a confusing blur. A hidden benefit of tech monopolies is that the constrain choice and simplify decisionmaking.

As we've learnt over the past five years or so, the social consequences, large and small, of wholly unregulated _or_ cabalistically controlled media systems are huge, and how FreedomBox or equivalents peturb that dynamic isn't clear, though I might be prepared to place some bets.[1]

Media systems simply do not and _can not_ resist hierarchical consolidation for reasons of basic graph theory, though the particulars of that consolidation and the administration, objectives, and guiding principles of key hubs fall along a wide continuum. Even with FreedomBox, it's certain that people will share resources and systems -- possibly a handful as families, households, and friends, possibly communities of hundreds, thousands, or millions. Services are _cheap_ \-- the direct provisioning costs of Diaspora run about $0.25/user-year[2], which is the definition of "too cheap to meter". As a service, bundling at less than 100-1,000 users is logistically impossible. Among my thoughts is how community bundlng might be facilitated.

Running persistent network services over consumer-grade broadband (or worse) is also a major pain in the backside, often through vendor limitations, though those are imposed with good reason. Registering and keeping control of a domain space is an obstacle to most people. Maybe not you, maybe not some of your friends, but yes, the general public.

And then we get to the direct service-administration risks: anything from service interruptions to hardware failure, data loss, system compromise, botnets, malware, denial of service, surveillance, credentials fraud, blackmail, legal regulations (copyright, patents, privacy, libel), and more. Decidedly nontrivial.

FreedomBox at least is building from some of the best possible bases: Debian GNU/Linux, experts in online law[3], Free Software, open protocols, and simple, inexpensive hardware. It might succeed, and if it fails, the lessons should be highly illuminating.

But, and back to my point previously, the hurdle of getting people to run dedicated server appliances is _not_ the core challenge, though possibly having them do that without realising they're doing so is informative.

________________________________

Notes:

0\. [https://www.zotac.com/product/mini_pcs/zbox_p_series](https://www.zotac.com/product/mini_pcs/zbox_p_series)

1\. I'm somewhat involved in a project in this space, [https://Darcy.is](https://Darcy.is)

2\. Experience from [https://pluspora.com](https://pluspora.com), run by two people and hosting 10k+ users. Mind that additional admin and moderation services add to this.

3\. Eben Moglen, a/k/a "Richard Stallman's lawyer", and Yochai Benkler ( _Th Wealth of Networks_ ), whom I'm very late to the party in discovering just within the past week, among many others.

<comment><USER9> FTR: Eben Moglen is no longer working for the FSF:

[https://www.fsf.org/news/fsf-announces-change-in-general- cou...](https://www.fsf.org/news/fsf-announces-change-in-general-counsel)

<comment><USER7> Fair point, though Moglen still references the a/k/a, as here, from 2017:

[https://youtube.com/watch?v=ZUN44U_oTUA](https://youtube.com/watch?v=ZUN44U_oTUA)

(Timestamp: 10m45s, though the full preso is highly recommended -- Moglen somewhat lengthly introducing Yochai Benkler.)

</comment></comment></comment></comment></comment></comment><comment><USER10> As I've mentioned on other stories about this device (like [1]), a part of the user story that's still missing is how these devices are supposed to interact with each other. Running a few web services inside your home network is neat, I guess, but not very useful if they're only accessible within that network.

There's also a lot of weird overlap between the services provided by the various apps installed by FreedomBox. It's unclear how much, if any, integration work FreedomBox is doing, or if the user is expected to do that on their own.

[1]: [https://news.ycombinator.com/item?id=19722179](https://news.ycombinator.com/item?id=19722179)

<comment><USER11> If it's a web server, then it would be accessible outside your home Internet network, would it not?

Regarding the use cases for something like this, I can think of a few:

\- Roll-your-own cloud storage (pics, documents, videos) and access them anywhere you are. No need to hand over more of your data to iCloud, Dropbox etc

\- Host a personal website. For the types that complain about being deplatformed from Twitter or whatever, here's the solution.

\- Pihole or the nearest equivalent. All devices could have network-wide adblocking automatically.

</comment></comment><comment><USER12> Interesting concept. A user friendly Pi-alike that runs services locally so you don't have to trust the big corporations. (said corporations may have very different goals than you do for your data, he says as neutrally as possible...)

I'm very happy that such things are possible nowadays: small inexpensive hardware running Linux, with some well constructed software UI on top. Similar to what Mozilla is doing with their IoT webthings gateway (which I have running on my Retropie since most of the time it sits idle and sips tiny amounts of power). I know it's "on the shoulders of giants" but I think we shouldn't underestimate the power that an open, hackable platform like the Pi gives back to people.

</comment><comment><USER13> The website says the hardware has built-in battery backup that can run it for 4 to 5 hours if power goes out. That is pretty dang cool.

</comment><comment><USER14> This should support home automation devices, especially security cameras. Don't let that stuff go off-premises. Maybe log encrypted video to an external site, but with a key the external site does not have.

</comment><comment><USER15> Wonder who their target demographic is. People balk at paying for email from a known provider, let alone buy a box to run it out of their own home for $100. You'd have to have a lot of motivation to do so, and it feels like the Venn diagram of people who are savvy and motivated enough to care about digital privacy, intersected with those with technical skills feels like nearly 90% overlap. And I'm not so sure the privacy group is so sizable. I'd probably be in this camp but I really don't want to have to worry about spam filters, triggering them in others by sending from my home ISP, nor dealing with backup or corrupted databases. Wonder what their plan is there...

The average person who wants this without being their own sysadmin should probably just use Apple products. I work for Apple and can attest that privacy isn't just marketing — it permeates all decision making in every discussion I've been a part of... sometimes making it harder or impossible to create the things we'd like to have (privacy wins). I know many on HN will want their "freedom" as in "freedom box," but the average user massively benefits from an ecosystem designed to make things as easy, desirable, and supported as possible.

<comment><USER16> I assume you're getting downvoted due to the Apple advocacy in your second paragraph, and hopefully not for your first paragraph. I entirely agree with that. I wish I didn't have to be cynical about things like this, but I just don't see the market for this device, and when it comes to social-network-like things, you _need_ a large market for network effects to kick in.

<comment><USER17> The initial idea was a device similar to a answering machine in size, price and interface. That is, a $10-$20 price range and a simple configure-once-and- forget interface.

Pioneer Edition FreedomBox Home Server Kit is clearly not there yet, but I would hazard a guess that their target demographic is currently on developers and tech savvy privacy advocates who can afford a bit steeper price for a "server kit".

<comment><USER16> But still, who would buy that $10-$20 device? If it doesn't replicate their Facebook/Instagram/whatever experience, and they don't know how to get their friends on it (the majority of whom probably aren't too privacy-conscious), it's just a paperweight

</comment></comment></comment></comment><comment><USER18> the stable release was in 2017.06 so almost two years, how often are they updating the code(e.g. security fixes)

is this supposed to be standalone home server, or something like a node of a large self-organized network(private social network,etc)?

<comment><USER19> The stable release is Debian stable (Stretch) which still gets security fixes from Debian.

</comment></comment><comment><USER20> I love the vision, but there are some pretty sizable hurdles not so easy to clear. Dynamic IPs, ports blocked by over zealous ISPs, bandwidth throttling, power redundancy, etc, etc...

</comment><comment><USER21> Just by joining the zeronet[1], you get most of the functions you can get the clearnet in decentralized form: Forum, Blog, Social Network, Search Engine, Wiki, Mailing, Chats, e.t.c.

[1] [https://zeronet.io](https://zeronet.io)

</comment><comment><USER22> What does this do that a Raspberry Pi or NAS does not?

It just seems like an always-on computer, nothing revolutionary or new.</comment>


Particle Life - <AUTHOR> https://fnky.github.io/particle-life/ <comment><USER2> wonderful!

Coincidently, I read today a paper [1], which has a nice video demo here [2] describing a very similar system but with only one type of cells and a simple rule. Surprisingly enough, particles form cell type structure and seem to "reproduce".

[1] [http://www.nature.com/articles/srep37969](http://www.nature.com/articles/srep37969)

[2] [https://www.youtube.com/watch?v=makaJpLvbow](https://www.youtube.com/watch?v=makaJpLvbow)

</comment><comment><USER3> How does this explain entropy? How is it increasing in this system?

Are the complex/organized/cell-like structures supposed to be a higher entropy configuration?

 _edit:_

I played with the parameters with "chaos" as the template. There's a parameter called "friction." I believe anything with a non-zero value here will cause energy to dissipate away from the system.

If you set that friction value to zero, the system is closed and entropy goes up and stays up. In this state no complex structures form. However when you let energy dissipate out of the system via friction you start to see the cells, which is in line to the theory on how life can form despite rising entropy.

<comment><USER4> >> How does this explain entropy?

Does it have to explain entropy?

<comment><USER3> No it doesn't. I'm just questioning it.

Initially it seemed to me as if the system was closed and thus entropy would go up. However entropy was not actually going up while observing the simulation which violated my notions of the nature of entropy and life.

It formed a contradiction in my mind and that was what I was questioning.

However the "friction" value made everything make sense. The system is not closed.

</comment></comment></comment><comment><USER5> Link to the github repo: [https://github.com/fnky/particle- life](https://github.com/fnky/particle-life)

Couldn't find that in the actual page anywhere.

</comment><comment><USER6> Full screen seems to be glitchy - particles dont go all the way to the bottom

<comment><USER7> Looks like it gets the window size at the beginning and locks the canvas size to keep universe size constant, not to affect the simulation.

Kinda clever if you ask me.</comment></comment>


Exploiting the TOR-Browser - <AUTHOR> http://www.hackerfactor.com/blog/index.php?/archives/761-Exploiting-the-TOR-Browser.html <comment><USER2> > The things that makes TOR useful for people avoiding prosecution also makes > it useful for people involved in malicious and criminal activities ... > Everything from spam and network attacks to trafficking people and > contraband.

> Although the Tor Project could promote options to restrict these malicious > actions, they choose to do nothing. Seriously: if a TOR hidden service > offers hard-core drugs or human trafficking or fake IDs, then they should be > shut down.

I hope I can convince some folks here to be skeptical of this kind of thinking.

Think about it: If the Tor project came up with some clever way to take down bad hidden services, then what would be stopping a government from forcing them to take down legitimate hidden services too? And meanwhile, the criminals would move on to some other Tor-like service, and keep doing their thing.

In short, you're not going to stop criminals, who will always find a way to keep doing what they're doing. You will, on the other hand, impede the free speech of honest users.

The Tor project should focus on making it impossible for hidden services to be taken down--even by the Tor project itself! And they do :)

<comment><USER3> > The things that makes TOR useful for people avoiding prosecution also makes > it useful for people involved in malicious and criminal activities ... > Everything from spam and network attacks to trafficking people and > contraband.

It is ok if someone that doesn't understand it says those sorts of things, but when an organization like cloudflare[1] jumps on the goof-troop bandwagon, it really does make a difference.

[1] [https://blog.torproject.org/blog/trouble- cloudflare](https://blog.torproject.org/blog/trouble-cloudflare)

<comment><USER2> I hope I can make you more skeptical of the "Cloudflare is the bad guy" trope. Cloudflare is lightyears ahead of any CDN when it comes to supporting Tor.

They specifically built controls so that web sites can remove CAPTCHAs for Tor users completely.[0]

They also do not block/CAPTCHA Tor users automatically. They treat Tor IPs like any IPs: if they detect abuse from the IP, they start giving the CAPTCHA.

Finally, Cloudflare has stated publicly[1] that they have a desire to setup .onion sites for their customers automatically. But they cannot do so until the Tor project is able to upgrade the hashing algorithm used for .onion addresses. If the two organizations could work together, this could be game- changing for online anonymity. Imagine millions of web sites automatically supporting Tor!

I can't understand why the HN crowd is so anti-Cloudflare. This Tor thing seems to be one of the major misconceptions.

Disclaimer: I'm not affiliated with with either Tor or Cloudflare in any way.

[0] [https://support.cloudflare.com/hc/en- us/articles/203306930-D...](https://support.cloudflare.com/hc/en- us/articles/203306930-Does-CloudFlare-block-Tor-)

[1] [https://blog.cloudflare.com/the-trouble-with- tor/](https://blog.cloudflare.com/the-trouble-with-tor/)

<comment><USER3> My link was a direct response to your second link.

I do not believe cloudflare on your first link (that they treat tor ips like any ips).

I can tell you from experience that I have never connected to a cloudflare backed site with tor that didn't require multiple captchas. So every tor ip is hostile to cloudflare sites? If so, how is that practically different than just blocking tor?

I think that if you read the response at your first link again, you can see that they are implying what you are saying, but that are not saying what you are saying. I think they are blocking tor, but explaining it in a diplomatic way.

<comment><USER4> >So every tor ip is hostile to cloudflare sites?

OP blog post claims 96% of the traffic going to their tor hidden service is hostile. It doesn't seem unreasonable to me at all that every tor ip is hostile.

<comment><USER3> It is their definition of "hostile" that is the problem. They do not explain. I suspect it means "I can't track you, so you are hostile." Otherwise, where is the data for this?

</comment></comment></comment></comment></comment></comment><comment><USER5> > In my experience, HTTPS makes you more distinct and trackable than plain > HTTP.

You lost me here.

[https://www.wired.com/2017/01/half-web-now-encrypted- makes-e...](https://www.wired.com/2017/01/half-web-now-encrypted-makes- everyone-safer/)

<comment><USER2> The author is correct. HTTPS adds more vectors which can be used to form a fingerprint, such as the TLS version or the preferred cipher suites of the browser.

For example: [https://www.ssllabs.com/projects/client- fingerprinting/](https://www.ssllabs.com/projects/client-fingerprinting/)

Anecdotally, I can tell you I have heard of ad tracking companies actively using this (for years now).

<comment><USER6> That's what you use when you don't have the richer information offered by HTTP sniffing.

TLS versions tell you someone is one of a billion users of iOS version X; with HTTP they can piece together session cookies across every site and service you use, or with active attacks use things like the Verizon injected tracking code uniquely identifying you across devices.

<comment><USER2> That's true. If you're talking about your ISP sniffing your traffic, HTTPS is a win. But since the author was talking about using Tor, I figured he was focusing on fingerprinting by the websites themselves, where HTTPS is easier for them to fingerprint than HTTP.

<comment><USER6> > fingerprinting by the websites themselves, where HTTPS is easier for them to > fingerprint than HTTP.

Could you explain your reasoning on that? If they're using the Tor browser every user is going to be very similar on crypto suites, user-agent, etc. — it's a rebadged Firefox distributable so it's going to be using their HTTPS implementation and you won't even get the OS version variations unless someone at the Tor project massively screws up.

The bigger problem is that if you are being targeted by the website, there are far more interesting attacks they can try – convince the user to turn on JavaScript and do all of that profiling for WebGL/canvas rendering, local fonts, network resource timing to look for cached content from other sites, etc.

<comment><USER2> Yes, great point. But I said _easier_, not _easy_. Using HTTPS, a user may have a more outdated version of the Tor browser with different cipher suites than everyone else. Using plain HTTP, that can't happen.

> unless someone at the Tor project massively screws up

And that is what the author of the article is claiming.

My comments here aren't in agreement with the author of the article, and I'm not claiming "HTTPS is bad" or anything like that. It's simply a categorical fact that HTTPS has more vectors to be fingerprinted than HTTP.

But of course, as you mentioned, features enabled by Javascript are the bigger problem, which is why users who wish to be anonymous should completely disable it!

<comment><USER6> Adding HTTPS plausibly adds a single low-cardinality signal but it removes a ton of other ones for network-level observers. When it comes to hostile site owners, realistically you're screwed but from a privacy perspective it's a question of whether you're one of the small percentage of users who have a) failed to install updates and b) disabled JavaScript.

That's a pretty small percentage of users for whom HTTPS isn't an across-the- board win for privacy.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> > Seriously: if a TOR hidden service offers hard-core drugs or human > trafficking or fake IDs, then they should be shut down.

If it were possible to do this, TOR would lose any shred of value it has for people using it to fight oppression.

Ok, let's say we put technology in place to "shut down" sites that sell fake IDs to teenagers (god forbid!).

Well now, Mr. Lawman from the U.K. or China is going to come in and say "hey, wait a minute, you can shut down websites that illegally peddle fake IDs, so you obviously have the ability to shut down websites that peddle illegal extremism (meaning falun gong, anti-government groups, etc.)." The _only_ defense against the TOR project and its supporters being forced to do this is that it's not technically feasible.

It's _really bad_ that this isn't manifestly obvious to someone who is apparently involved with the TOR project to a substantial degree.

<comment><USER8> > If it were possible to do this, TOR would lose any shred of value it has for > people using it to fight oppression.

Most people in that field mess up their opsec sufficiently often that this is very well possible, see SilkRoad and its successors.

When it comes to the kiddyfuckers, I'm a bit torn myself when I ask myself if child pornography (and apparently people even shared videos of raped _toddlers_ ) is an excuse for hacking and exposing actually innocent TOR users. It's the classic 4chan/reddit dilemma: what kind of content justifies which measures, and when is it worth to limit the right to free speech?

For the record, I support anything done to bring child porn offenders to justice, but I also recognize that this opens dangerous doors - from the issue of "now it's an excuse for the Chinese/Russians/Iran/Saudi-Arabians to crack down on legitimate activities" to "people are actually already planting fake child-porn evidence, including in scareware/ransomware".

<comment><USER9> The thing is, a person wearing a mask is only hidden in a crowd, if the crowd of people wearing masks exist in the first place.

By removing all evil from tor, you expose the good, leaving it vulnerable. That defeats the purpose, I suppose.

<comment><USER8> Yeah, certainly removing child porn from TOR reduces the amount of background noise in traffic. But there should still be vast quantities of people using TOR for file-sharing to provide significant noise...

<comment><USER9> Why target one illegal activity and not the other? It would serve no purpose to allow some crimes to take place, but not others. I believe that organizing drug sales, small amounts as well as large, is just as horrible and can ruin just as many lives as distributing images and videos (I wonder how many are duplicates) of exploited children.

<comment><USER8> Because it's usually the drug consumer him/herself who decides what to buy and consume - and given that most of the drug sellers apparently don't cut their products with weird stuff from rat dung to lead, fentanyl or other stuff that sometimes causes dozens of ODs (fentanyl-contaminated heroin batches are well known for this, and a plague for ERs because the victims always come in a bunch) one might argue that clean, vetted drugs via TOR/Silk Road are better for society than if the users would hit the streets. Also, drugs bought on the streets directly finance the street mafia and contribute to gang violence, as well as negative reputation for the "dealer city quarters". Internet drug shopping kills off this part of the chain totally.

Child porn is just ... inexcusable no matter how you think about it. Fine, if some porn stars make themselves look young, okay, but that's consenting adult performers. Abusing Toddlers and children for porn is not just violent in itself, it literally creates wrecks.

<comment><USER9> You cannot defend one type of crime, because another type is much worse. If possible, one could argue that child pornography is less horrible than hitman services and human trafficking, given that the majority of the content shared is not new content of new victims.

Let's not try to justify serious crime, because other crime may be seen as more serious.

<comment><USER8> The point is that child pornography (and also sexual abuse of children) is viewed as evil across all societies and groups.

Human trafficking, drugs and hitmen services, however, are not - the most notable exception being the various kinds of mafia or other organized crime.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Browser fingerprinting is not new.

See also: [https://panopticlick.eff.org/](https://panopticlick.eff.org/)

"Panopticlick will analyze how well your browser and add-ons protect you against online tracking techniques. We'll also see if your system is uniquely configured—and thus identifiable—even if you are using privacy-protective software."

Tor bug #6119 ([https://trac.torproject.org/projects/tor/ticket/6119](https://trac.torproject.org/projects/tor/ticket/6119)) talking about using this tool specifically for Tor browser. There are also continuous efforts in Tor Browser to remove fingerprintability (e.g. #22127 - [https://trac.torproject.org/projects/tor/ticket/22127](https://trac.torproject.org/projects/tor/ticket/22127)).

</comment><comment><USER11> The title is clickbait. There are no exploits involved. He's not dropping NITs on users, for example. Fingerprinting is not a huge issue. The main defense is preventing adversaries from learning one's ISP-assigned IP address. Maybe Tor Project does encourage too much confidence in the "all users look alike" feature. They certainly do, in my opinion, regarding the security of Tor browser in Windows, with no protection against exploits and Tor bypass.

</comment><comment><USER12> This is little more than an opinion piece. AFAICT, the only "vulnerability" is that with JS on, it can detect the Operating System.

At some point it claims it can also detect screen size

> However, there are not too many people using the same OS and same screen > size and visiting the same sites at around the same time. You will likely > stand out.

but both my tests and themselves contradict that:

> On a normal desktop browser, the Window Size is smaller than the Screen > Size. (Mobile devices may show a Windows Size that is larger than the Screen > Size.) To prevent screen profiling, the TOR-Browser sets them to be the same > size.

Note that _detecting_ Tor Browser is doable from the User-Agent, so there's no point in setting Window Size = Screen Size.

Definitely not "exploiting", and I suspect that's why it couldn't get a reply from security MLs, which see a lot of these. Flagged.

</comment><comment><USER13> A number of people may consider drug markets as fighting oppression. [1] Ross Ulbritch certainly did. Law and morality evolves.

[1] Psychedelics and cognitive liberty: Reimagining drug policy through the prism of human rights

</comment><comment><USER14> Let's say X event happens and Tor shuts down. What will happen with all that horrible people using the Tor network? Will they stop doing horrible activities? Probably not. Maybe they'll have more difficulties in their activities since they'll be geographically isolated.

Tor it's just a channel that horrible people uses, but the horrible stuff that they do happens in real life.

There is one approach that for sure it's going to solve the horrible activities that people do. Put a camera in every house. Put a camera in every corner. Then you can monitor every person and check if they're doing horrible things.

Would be worth to live in a world like that?

<comment> angry-hacker Do you also think the same say about gun control? Hate speech?

</comment></comment><comment><USER15> A little condescending and obnoxious for my taste but mostly everything here is well-known and while the TOR-Browser devs could implement everything this guy wants it, and it will end in a moral dilemma of what could be considerable "malicious". IMHO the Tor Browser is not suitable for the truly paranoid but usually this wont matter because the truly paranoid is not using the TOR network as-is (with the integrated browser) and those who aren't truly paranoid can live with those risk.

<comment><USER16> what are the truly paranoid using?

<comment><USER17> [https://stallman.org/stallman-computing.html](https://stallman.org/stallman- computing.html)

<comment><USER18> So IceCat over Tor. Actually pretty sensible.

</comment></comment></comment></comment><comment><USER19> All in all not a really in-depth article, but the author has some valid points. All parameters exposed by the browser should be variated, especially the scroll bar size which seems to be the real offender here.

Not sure how the Tails [0] distribution handles it, but IIRC it notified me of the screen size / view port size problem as I maximize the browser.

0: [https://tails.boum.org/](https://tails.boum.org/)

<comment><USER15> Just disable JS by default and it will be good for 99.99% of the cases you don't allow explicitly allow it.

<comment><USER8> You can still target for the screen size using CSS - you can even track _changes_ by creating a css file with literally thousands of thousands of media queries, where each media query sets e.g. the background-image property of a hidden div.

Thanks to gzip compression, this shouldn't even take much data to transfer.

Oh, and as I think of it, would this here still work?

        a#mylink span.tracker { background-image: url(http://myservice.onion/track.php?uid=xxx&trackedsite=reddit.com); }

<comment><USER15> Of course but that will require to also accommodate for the fact that after N queries the circuit/endpoints changes and unless you have a unique tracking system per every "attacked" user (like an random generated ID per CSS served) or a way to store persistent across sessions, Screen Size alone won't be able to identify everyone on the TOR network, and that's my point if you disable JS (raise the security level to the max for the case of the tor browser) you will be good for the most common attacks for "APT's" you pretty much don't stand a chance unless you go "outside the grid" aka don't use the integrated browser.

<comment><USER8> You have _lots_ of signals to generate without JS. System font base (this alone should provide a fairly unique identifier!), screen aspect ratio, DPI value, "pointer" media query, the relationship between width/device-width... and on non-TOR-scenarios you can fingerprint supported HTTPS encryption layers plus the user-agent. Oh, and you can also passively fingerprint on the presence of an ad blocker.

<comment><USER15> If you can identify _a single person_ on the TOR network with the TOR Browser, across several sessions, just with the data you are describing and without false positives, it will probably make a case but those attacks are well-know since 2k8 and so far no one has made the same claims you firmly believe, so unless you know something that no-one in the world, then for the common "TOR user", those who use the integrated TOR Browser are in good standing just by disabling JS alone. If you are THAT paranoid, you should already know that you shouldn't use the integrated browser itself, since you are loosing half the battle just there by giving your adversaries a well-known attack vector.

</comment></comment></comment></comment></comment></comment><comment><USER20> > Since this exploit is one of the minor ones, I've decided to not try to sell > it.

He would try and sell larger vulnerabilities? It only proves the point, but I still consider this a little bit disturbing.

</comment><comment><USER21> Don't use Tor Browser. It's probably the least safe browser on the Internet.

[https://news.ycombinator.com/item?id=13623735](https://news.ycombinator.com/item?id=13623735)

(For people unfamiliar: Tor and Tor Browser are not the same thing!)

<comment><USER22> What to use instead?

<comment><USER21> Literally any other mainstream browser.

<comment><USER23> Hardly good advice. Tor Browser is specifically built with privacy and security in mind. Using any "mainstream browser" and then expecting to do all those tweaks is not practical advice nor feasible.

<comment><USER21> Read the link upthread. I didn't explain the argument here because it's explained in depth there. Never, ever use Tor Browser.

</comment></comment></comment></comment></comment><comment><USER24> So, make a browser extension that gives you a different fingerprint every time you use it.

</comment><comment><USER25> I have a habit of browsing with random window sizes (usually shrunk to just fit what I want to see. I guess if I ever need to use the TOR browser, I'll need to get out of that habit! This researcher disclosed his simplest approach to fingerprinting TOR browsers but if he really has 12 factors, you'll only be safe browsing sites with huge amounts of traffic.

</comment><comment><USER26> Complaints do not help. Contributions and donations do.

Tor is spelled Tor, not TOR.

<comment><USER18> TOR is the legacy name, an acronym for The Onion Router. The modern spelling is preferred, but it isn't incorrect to call the project TOR.

[https://en.wikipedia.org/wiki/Tor_(anonymity_network)](https://en.wikipedia.org/wiki/Tor_\(anonymity_network\))

<comment><USER11> Well, Paul Syverson says that it's Tor, not TOR, and has never been an acronym.

[https://www.acsac.org/2011/program/keynotes/syverson.pdf](https://www.acsac.org/2011/program/keynotes/syverson.pdf)

<comment><USER27> > He would respond that it was _the_ onion routing, the original program of > projects from NRL. It was Rachel Greenstadt who noted to him that this was a > nice acronym and gave Tor its name. Roger then observed that it also works > well as a recursive acronym, 'Tor's onion routing'. It was also his decision > that it should be written 'Tor' not 'TOR'. Making it more of an ordinary > word in this way also emphasizes the overlap of meaning with the German word > 'Tor', which is gate (as in a city gate). To sum up, "Tor: The Second- > Generation Onion Router" is about the design of onion-routing systems, not > just onion routers themselves. Tor is the third generation of onion rout- > ing, not the second. And the 'r' in 'Tor' represents 'routing' not 'router'. > In hindsight we probably should have spent a bit more time on the paper > title.

You have a significantly different definition of "not an acronym" than I do.

<comment><USER11> Sorry, I misspoke. It's not an acronym for "the onion router", but rather for "the onion routing".

</comment></comment></comment></comment></comment><comment><USER28> You may prefer the Epic Privacy Browser.</comment>


NYT: News spreads so fast online that it blurs together with prediction - <AUTHOR> http://www.nytimes.com/2007/07/09/business/media/09link.html?ex=1341633600&en=ddcb9a6c03daae4c&ei=5090&partner=rssuserland&emc=rss

<comment><USER2> This may be apocryphal, but I've heard that the reason Galileo invented the telescope wasn't to look at the stars, but rather to look into the future. Supposedly he'd stand in the St. Mark's Sq. Bell Tower watching for foreign ships, and then use this information to arbitrage commodities.

<comment><AUTHOR> The seas around Venice are all shoals with just a few approaches. And the air is pretty hazy. I think small boats would bring news of approaching ships before anyone could see them from St Mark's.

Apparently Galileo did demonstrate his telescope from the top of St Mark's, showing some Venetian senators that with it they could see the sails of distant ships. For that information to be valuable, though, it would have to be the first news to be had of them, and that seems unlikely.</comment></comment>


Yahoo CEO Jerry Yang Tries to Save Face  - <AUTHOR> http://www.techcrunch.com/2008/05/04/yahoos-yang-speaks-on-yodel-anecdotal/

<comment><USER2> If Hacker News is going to be mainly posts where Michael Arrington pulling shit out of his ass, what's the point in staying here?

<comment><USER3> meh, posting every techcrunch articles to hacker news is now just plain karma whoring.

alternatively you can think of it as comment thread to techcrunch articles with Hacker News analysis.

</comment></comment><comment><USER4> I wouldn't want to be in is shoes tomorrow morning specially when when the top story on the front page of is own web site is: "Yahoo CEO on hot seat after rebuffing Microsoft's $47.5B bid" <http://biz.yahoo.com/ap/080504/microsoft_yahoo.html></comment>


Jonathan Schwartz says Google's Android didn't need license for Java APIs - <AUTHOR> http://news.cnet.com/8301-1035_3-57420304-94/former-sun-ceo-says-googles-android-didnt-need-license-for-java-apis/ <comment><USER2> testimony of Sun co-founder Scott McNealy essentially nullified everything said by former CEO Jonathan Schwartz less than 30 minutes prior.

[http://news.cnet.com/8301-1001_3-57422366-92/oracle-turns- to...](http://news.cnet.com/8301-1001_3-57422366-92/oracle-turns-to-mcnealy- to-bolster-its-case/?tag=featureRiver)

1\. McNealy affirmed to Oracle counsel David Boies that Java was "extremely valuable" to Sun and that it involved "lots of intellectual property."

2\. Going over the restrictions that Sun had in place through licensing, McNealy explained that the "most important one, with respect to Java, is to maintain compatibility because that was one of the most important value propositions that we offered."

3\. In an effort to null the testimony the jury heard from Schwartz less than 30 minutes prior, Boies asked if it was ever Sun's policy to allow any company to implement an incompatible version of Java so long as they didn't call it Java. "I don't recall that was ever a strategy that we pursued nor allowed in the marketplace," replied McNealy.

4.When asked if he saw Schwartz's November 2007 blog post (now a notable piece of evidence bounced around by both sides to their own -- but different -- advantages in this case) praising Google's announcement of Android.... McNealy asserted that it was company policy that those kinds of blogs were not corporate, but rather personal.

5.Boies asked about if allowing an incompatible version of Java to exist on the market would adversely affect Sun's economics. After a long explanation, McNealy finally said it would have a "negative" effect. "It was a very clear corporate strategy for the Java platform to stay compatible," McNealy said.

<comment><USER3> It doesn't really nullify it at all.

There's a big difference between not encouraging something and having the ability to forbid it. The strategy of making Java an open platform accelerated adoption, at the risk of having it replicated. This happened before as well -- remember the Microsoft-Sun dispute re: Microsoft J++?

Also consider the fact that there are at least two major POSIX-compliant implementations of Unix-like systems on the market today. BSD was a cleanroom implementation of AT&T Unix -- very similar conceptually to what is happening in Oracle vs. Google.

It's also absurd to claim that the public writings of the CEO or other officer of a corporation, published on a corporate website, are merely "personal opinion".

<comment><USER2> 1\. all versions of BSD prior to 4.3 BSD(?) incorporated proprietary AT&T Unix code and were, therefore, subject to an AT&T software license.

2\. Google's chief Java architect: it's 'likely' I copied Sun code found in Android, 'I'm sorry' if I did

[http://www.theverge.com/2012/4/19/2961128/google-chief- java-...](http://www.theverge.com/2012/4/19/2961128/google-chief-java- architect-likely-i-copied-sun-code-in-android)

If Oracle can prove that Google willfully broke Sun/Java copyright and license, Google needs to pay up.

<comment><USER4> You do know that he was agreeing to have copied 9 lines from one file, Timsort? And you do know that those 9 lines are just a range check? I mean:

        private static void rangeCheck(int arrayLen, int fromIndex, int toIndex) {
            if (fromIndex > toIndex)
                throw new IllegalArgumentException("fromIndex(" + fromIndex +
                           ") > toIndex(" + toIndex+")");
            if (fromIndex < 0)
                throw new ArrayIndexOutOfBoundsException(fromIndex);
            if (toIndex > arrayLen)
                throw new ArrayIndexOutOfBoundsException(toIndex);
        }

Literally a rangeCheck.

And not only that, 9 lines written by the stealer himself ( [http://cr.openjdk.java.net/~martin/webrevs/openjdk7/timsort/...](http://cr.openjdk.java.net/~martin/webrevs/openjdk7/timsort/raw_files/new/src/share/classes/java/util/TimSort.java) ) and given to Sun/Oracle!

Still, i agree with, Sun/Oracle do have the copyrights for that. Google needs to pay up, is ten bucks alright for this?

<comment><USER5> Apparently you're not familiar with what it means to claim you've implemented a "clean room" version of something.

Even a few lines of copied code explodes the whole claim.

</comment></comment></comment></comment></comment><comment><USER6> Good guy Schwartz does the right thing.</comment>