Mike Stonebraker: The "NoSQL" Discussion has Nothing to Do With SQL - <AUTHOR> http://cacm.acm.org/blogs/blog-cacm/50678-the-nosql-discussion-has-nothing-to-do-with-sql/fulltext <comment><USER2> Guys, please check his Wikipedia page before starting some random rambling. This guy is a _living legend_ and has several of the most prestigious awards. He also is/was an entrepreneur and large DB corp CTO. Oh, and a very early open source advocate and developer. Among _many_ other things.

Don't say something stupid just because you like NoSQL. In fact, he was an early and strong critic of the one-size-fits-all commercial RDBMS solutions.

      [...] These papers presented reasons and experimental evidence
      that showed that the major RDBMS vendors can be outperformed
      by 1-2 orders of magnitude by specialized engines in the data
      warehouse, stream processing, text, and scientific database
      markets.

1-2 orders of magnitude, that is in the range of 2-99 times faster.

And in particular, if you didn't read at least 5 of his papers you can't pretend to have a clue about how database engines, and in particular the major RDBMS, work.

Thanks.

[A n00b DB engine writer, currently working on a non-SQL database]

PS: If I get to achieve 10% of what he did so far in his life I'd consider my life amazing. And he is still making new things. Respect!

<comment><USER3> I'm a bit shocked by your post. So because he is a living legend one should not say nothing before reading all the papers cited even if from the article his point is already clear and one may say something meaningful even as a modest developer?

I'm going to say one for instance: the article's main point is about the fact that because of a threaded and disk-based architecture you can't get much faster than well engineered SQL architectures. For instance Redis is completely excluded from this reasoning, being in-memory and single-threaded.

Another point: where are the numbers? For instance I can trivially give proof that Redis can handle 150,000 operations/second per core in a decent Linux Box. I want to know what's the performance of the SQL solutions cited in the article.

Another one: all the SQL solutions cited in the article are names I never heard before of today. NoSQL DBs are tar.gz you can download for free from sites and compile _now_ without paying nothing.

Respect does not mean to shut up.

<comment><USER4> > the article's main point is about the fact that because of a threaded and > disk-based architecture you can't get much faster than well engineered SQL > architectures.

I disagree. His main point is that current SQL databases are slow not because they use SQL but because their implementations suck. He then lists 4 areas where the implementations spend most of the time and argues that all of them can be eliminated (how this should be done is explained in the linked paper).

<comment><USER3> Yep but I read in the article:

> Second, many No SQL systems are disk-based and retain a > buffer pool as > well as a multi-threaded architecture. This > will leave intact two of the > four sources of overhead above.

That's not always true.

For the other points, please give me the download link of this SQL database that can scale without problems (I want an opensource one since I'm a cheap startup).

Also scalable != fast, it only means that adding more nodes I can scale, possibly almost linearly, but again for startups that are cheap it is also _very_ important how many boxes you are going to need, so it's important to have numbers about this superior SQL engines to do some math.

That said the article is interesting, as the idea is more or less that in theory it's possible to build SQL databases that are very scalable and that mostly our problems in the past where about poor implementations. I guess this is true, but I can't imagine how an ACID SQL system is without overhead compared to a key-value store, even when the right technology is used for the implementation. The only fix for this is to show numbers.

Well also I don't think at all avoiding SQL is a bad idea, but the author wrote in this article he is going to show how the other NoSQL claim is false (the claim is that SQL sucks at modeling a lot of problems).

Anyway the author resembles a lot Adam from Battlestar Galactica and this is a good point.

<comment><USER4> > For the other points, please give me the download link of this SQL database > that can scale without problems (I want an opensource one since I'm a cheap > startup).

He didn't say that there are such systems, but that he expects them in the next years.

> so it's important to have numbers about this superior SQL engines to do some > math.

In the paper he talks about speedups of 1-2 orders of magnitude compared to current OLTP systems.

> I can't imagine how an ACID SQL system is without overhead compared to a > key-value store, even when the right technology is used for the > implementation.

If he is right, then there should be no big difference (maybe 10-20%) between a SQL system and a key-value store, assuming that both offer the same ACID guarantees, because most of the complexity lies in the ACID guarantees and not in the data-storage itself.

> Well also I don't think at all avoiding SQL is a bad idea, but the author > wrote in this article he is going to show how the other NoSQL claim is false > (the claim is that SQL sucks at modeling a lot of problems).

He's going to do that in the next blog entry.

</comment></comment></comment></comment></comment><comment><USER5> My summary: it's possible to jettison a lot of ACID requirements and implement sharding and still have SQL as the interface to your data.

My response: Sure, in theory, but for right now Redis/Tokyo Tyrant/etc actually exist and are free. They don't support a lot of what traditional databases consider required features, but the NoSQL movement is based around a recognition that many applications can sacrifice those in favor of performance and scalability.

Key/value stores are like C, barely disguised assembler that lets you shoot yourself in the foot, but is incredibly flexible. NoSQL is about acknowledging that sometimes that's the right tool for the job. This article doesn't address that choice at all, just handwaves about the wonderful technology that will handle all the problems automagically Real Soon Now. Point me at an SQL database I can use to handle my data workload of thousands of updates a second on a cheapie EC2 instance, that will be a discussion I can use.

<comment><AUTHOR> _Sure, in theory, but for right now Redis/Tokyo Tyrant/etc actually exist and are free._

Yes, there's a question of whether we are talking the right way to build systems, or which system you ought to use in production tomorrow. Building a whole "movement" around the simple lack of some software is a little short- sighted, IMHO.

BTW, Stonebraker's VoltDB (www.voltdb.com) is a high-performance OLTP engine, and apparently an alpha release will be open-sourced shortly (a few months, I believe).

 _the NoSQL movement is based around a recognition that many applications can sacrifice those in favor of performance and scalability._

You make it sound like the NoSQL people were the first to observe this. That is very far from the truth -- IMS, Codasyl, Berkeley DB, object-oriented DBs, etc. have all been around for a long time.

<comment><USER6> So, maybe you can clarify something for me.

Stonebraker cites Greenplum / Vertica / etc as examples of sql dbs that scale out. But all the ones he mentions are data warehouses that measure time from load to queriability in minutes. Not ms like the OLTP-focused nosql distributed systems.

And of course systems like RAC or pgcluster rely on a SAN, so that's not really playing the same game either.

Am I missing something? Feels like Stonebraker is cheating a little to make his point to me.

<comment><USER7> no your not missing anything. And I can speak from experience that RAC doesn't even help. We are in the progress of migrating from a RAC system to a NoSql system. RAC doesn't scale either.

<comment><USER8> Could you give more detail about what are you doing?

<comment><USER7> Suffice to say that RAC has been nothing but trouble since we moved to it from DB2 for scale reasons. Rather than pay a consultant tons of money to help us get it stable after less than a year on it we are now migrating off to a non- relational solution. I can't give more detail than that really. Maybe later I'll be able to get permission to post a blog post about it.

</comment></comment></comment></comment></comment></comment><comment><USER9> Actually many NoSQL DBs are not just about relaxing ACID requirements, but also about limiting functionality for easier scaling via DHT. They only support key/value set/get and not range scan, which is needed to implement SQL semantics.

I think the best interpretation for NoSQL so far is "Not only SQL", which has interface implication as well.

<comment><USER10> What's DHT?

<comment><USER11> Distributed Hash Table.

</comment></comment></comment><comment><USER12> The article starts with a description/definition of 'key-value stores' vs 'document stores'... but doesn't clarify the difference, if any.

When people say 'NoSQL', that doesn't preclude another kind of query language...

I assume NoSQL to mean, roughly : \- no traditional ansi RDBMS SQL \- key- value store \- graph-like / treelike data as first class citizen \- map/reduce style operations \- bundled with a dynamic lisp/python/ruby/javascript style general programming language.

You'd have to agree that 'NoSQL' is a movement - ie. many people vocalizing their shared emotional frustration at the limits of SQL. Not theoretical limits, but practical ease of use and subjective syntactic inelegance.

I personally identify with the movement, after having built traditional sql systems, preached data normalization etc., then slowly realising that this RDB approach is just really unwieldy and brittle.

Moving from XML to JSON, from C++ to lisp languages.. this makes the ugly syntax of SQL really stand out : as blatantly as COBOL or FORTRAN do to someone who has read K&R.

Maybe we havent found the right replacement... but we still know there has to be a better way.

The term 'NoSQL' is subjective, undefined, fuzzy - but its a label for a real problem that needs solving, and groups together partial solutions.

</comment><comment><USER13> Indeed Stonebreaker is a living legend. Entrepreneurs may find it interesting that he is currently pitching VCs a commercial venture to augment his latest DB project, <http://scidb.org/> (much like Cloudant is to Couch)

<comment><USER3> I also found this:

"VoltDB is an independent, Boston area-based company co-founded by DBMS R&D pioneer Mike Stonebraker and startup veteran Andy Palmer, working in stealth mode on the next-generation of OLTP DBMS."

So it's a biased legend. Sincerely if one is investing a lot in something like VoltDB this buzz about NoSQL DBs and especially the fact that they are starting to be actually used to get work done can be a problem.

<comment><USER14> I believe this is the commercialization of H-Store, which has been featured here on HN before.

</comment></comment></comment><comment><USER15> The title is correct, the article confused and somewhat pointless. NoSQL is about the systems, not the query language, but it's not about RDBMS minus atomicity and consistency, it's about saying "this _not_ SQL, don't compare it to RDBMS that you are used to querying with SQL".

Anyone talking about how you can implement SQL on top of NoSQL systems is missing the point. KV and Document stores are a different way of storing data.

SQL: express what you want to happen using relational notation, and it will magically happen. There are no real-world performance issues.

NoSQL: certain operations are fast, other operations are slow. This fact is reflected in the API.

<comment><USER16> The article isn't confused - he's using the SQL in the same way you are (in your first paragraph, anyway) - he's referring to RDBMS's. His point is that that many of the performance benefits of a KV/documentstore based db can be achieved in an RDBMS without throwing away time-tested ideas like ACID guarantees.

I was confused by your post, however. You initially state that NoSQL is about the system/approach to storing data (and not the query language) but then proceed to contrast querying APIs.

</comment></comment><comment><USER17> I am much more interested in the upcoming post.

Even tough I have not used the products mentioned. I have seen that RDBMSes can be configured and optimized but usually it costs time or money plus it can get quite complex. This complexity wouldn't be so bad if it allowed you to make the rest of your application simpler. Sadly, it usually isn't the case. You end up constantly dealing with theses two different worlds in your application and ORMs also bring their share of complexity when you do more sophisticated or customized things. And I am not even saying anything about when you need to change things.

I think one of the nice things about many of the "noSQL" solutions is that they keep things simple and under your control. You still need to do the complex stuff yourself, but its never simple anyway. I am sure they don't bring a solution to everything but it certainly is nice to see the area of databases moving again after many years of status quo. And the author is certainly one of the people pushing the field.

</comment><comment><USER18> apparently, as a supporter of the NoSQL movement, i would just like to state a small 'analogy'...

Imagine if someone from amongst our early ancestors hadn't thought of creating the wheel, where would we be?

And so it is with NoSQL - it is just an alternative way of looking at a problem which in this case is that of databases and looks at it in terms of a non-relational model. Therefore, i would like to urge all who are 'hostile' towards it - just let us do what we want. If the results are not to your liking what can we do.

i personally believe that through pursuing the principles on which NoSQL is based we will manage to achieve something new that mayhap replace SQL.

Additionally, please do also give thought to the fact that Google's Big Table, Amazon's Dynamo and Cassandra can be thought of as part of NoSQl movement.. Rebels are at first turned away from society in general - but later on society realises that the rebels had the correct idea. Change is always essential to progress without which i would not have been typing this..

On another account (sorry for the detour) i am rather getting quite interested in Gopher these days. Anybody interested in Gopher?

[ I apologise for the non-tech response.]

[ Null Expulsion - nullexpulsion [at] gmail [dot] com - how long will it be since spammers figure out how to detour around this? ]

</comment><comment><USER19> I think it's only a matter of time before this NoSQL movement morphs into a SPARQL movement.

<http://en.wikipedia.org/wiki/SPARQL>

</comment><comment><USER20> Please refer to this independent and unbiased study that bolsters my point, a study which I authored.

<comment><USER11> I see nothing wrong in citing your own work. He does make a disclaimer at the end that he is involved in several RDBMS technology startups.</comment></comment>


World's First Live-Video Augmented-Reality Mustache App For The iPhone - <AUTHOR>

After months of optimizing I was finally able to get face detection to run in under 100ms on the iPhone 4.
http://livestache.com
I thought I would share some details on how this was possible.  Using the Time Profiler in Apple's "Instruments" I measured the runtime of my face detector.
Initially I used OpenCV 2.1 compiled for the iPhone as described here: http://niw.at/articles/2009/03/14/using-opencv-on-iphone/en
However my first attempt yielded fairly poor results: it took 1500 to 6000 ms for face detection to complete on a 640x480px source image.
I then spent a few days getting OpenCV 2.2 to compile, mainly because it has some nice garbage collection features and also a new face detector (the LBP detector).
The first thing I tried fiddling with which algorithm was used.  I found that the LBP Face Detector was the fastest, however it wouldn't work on any of my asian friends.  Perhaps the dataset used to generate OpenCV's lbpcascade_frontalface.xml file was limited?  The available Haar Cascades however had no problem detecting asian faces or faces with very dark skin (definitely want to avoid an HP webcam fiasco), and among those I found haarcascade_frontalface_alt2.xml ended up being the fastest.
The next obvious thing to try was shrinking the image.  Scaling it down by a factor of 5.5 before feeding it into the face detector seemed to be the sweet spot for this application.  I used CoreGraphics to simultaneously convert the image to greyscale and shrink it, which I believe offloaded some of that to the GPU and I know gave a huge speed boost.
There are some performance parameters for the Haar Cascade that gave some speed boost as well.  You get to specify a window size (the smallest face it will recognize), which is a compromise between speed (larger window size) and not requiring the camera be ten inches from the subject's face (smaller window size).  I ended up going with a 20px x 20px window, which may seem small but remember the 5.5 image scaling factor, so really I'm requiring the face take up about a third of the 640x480px image.  I set the minimum neighbors to 4, the haar window scaling to 1.2, and set the CV_HAAR_FIND_BIGGEST_OBJECT and CV_HAAR_DO_ROUGH_SEARCH flags in the parameters I passed to the face detector.
The largest single boost however came in the way I converted the image formats.  As this was my first iPhone app I was startled at the number of image formats the different APIs used.  There are CGImages, CVPixelBuffers, UIImages, CMSampleBuffers, and more, and then OpenCV has its own format of course.  There are many code snippets out there on how to convert between the various formats, but here's where I would get sneaky.
As I was converting from a CVPixelBuffer (this is what the AVFoundation camera api returns) to CGImage, I simultaneously cropped the photo to the area of interest.  Then I found that I could simultaneously shrink, rotate, and grayscale-ify this image using various CGContext manipulations, and finally I pointed an OpenCV "Mat" buffer directly into the CGImage's data buffer, thus no actual conversion was necessary.  The data was only copied two times (instead of five or six as I was originally doing) and the GPU seemed to be doing some of the heavy lifting because I was able to get this to run in about 400ms.
The final speed boost that got the face detection down to about 50-100ms was using OpenCV's "region of interest" system, and setting the Region Of Interest in the image to the general area (plus or minus 50 pixels) where the last face was found (if there was one).  Thus the first time it finds a face, it scans the whole image (takes 400ms) and subsequent scans look at a much smaller area, and run at a speedy 50ms-100ms.
In LiveStache you'll notice the mustache updates location 3-5 times per second (on the iPhone 4 at least).  So why not more like 10 times per second if we're getting 100ms face detection times?  Because it takes processor time to draw the mustache, keep the video layer running, and keep the sound running.  Those add a little overhead and bring the speed down to a still-healthy 200-300ms.  I suspect on the iPhone 5 this will drop significantly, and we will be able to achieve real-time (10fps or so) face detection.
I hope this is helpful information for those of you with cool ideas that center around Face Detection.
Ian Charnas firstname.lastname@example.com <comment><USER2> you're going to make a million dollars off this. seriously. only suggestion I'd have is to make the facial hair overlays less cartoony looking.

</comment><comment><USER3> This is a serious amount of dedication to facial hair. Great product video too!</comment>


Improving privacy and security on the web - <AUTHOR> https://blog.chromium.org/2019/05/improving-privacy-and-security-on-web.html <comment><USER2> Wow, if this works, this is basically the end of CSRF. Essentially: CSRF relies on an HTTP POST to VICTIM.COM triggered by HTML on EVIL.COM, and that request carrying cookies. Today, even though SameSite exists, the default --- SameSite=None --- maintains that longstanding status quo. But after the change, the Chrome default will be SameSite=Lax, and while EVIL.COM will still be able to trigger POSTs to VICTIM.COM, those requests will no longer carry cookies.

To get the cookies to work from EVIL.COM, VICTIM.COM's developers will have to explicitly set SameSite=None on their session cookies. Which nobody will do, because nobody sets SameSite at all today.

Better still: 99 out of 100 CSRF exploits (maybe 999 out of 1000) target endpoints for which SameSite=None isn't needed; they're cookies nobody ever uses cross-site to begin with. There are only limited cases where anyone needs the behavior to change, and those cases don't track the most sensitive cookies.

As a vulnerability researcher for whom exploitable bugs mostly exist to spark joy: good riddance to CSRF. It was a dumb bug class, and never, ever fun to exploit.

<comment> Lx1oG-AWb6h_ZG0 Before you start emitting samesite=lax, be warned that webkit/safari iOS12 has a weird implementation: if you set the cookie in a POST method and redirect to a GET (like most default oauth explicit grant login flows), the cookie will not be sent: they consider POST pages as "unsafe". See [https://bugs.webkit.org/show_bug.cgi?id=188165#c12](https://bugs.webkit.org/show_bug.cgi?id=188165#c12) for more details.

Edit: it looks like people have found other issues since I last looked at this bug:

> It's a serious issue affecting many common user flows, including the flow of > visiting a website coming from a GMail link. If the user comes from GMail, > it reaches the destination website without any cookies, thereby breaking > functionalities that depend on session/login cookie and CSRF cookie. Only > fix for now seems to be removing the Lax flag from cookies. > ([https://bugs.webkit.org/show_bug.cgi?id=188165#c47](https://bugs.webkit.org/show_bug.cgi?id=188165#c47))

At this point, it looks like the safest approach is to only emit sameSite if the browser isn't safari.

<comment><USER3> We did just clarify this in the spec: [https://github.com/httpwg/http- extensions/commit/49bcb4fddb8...](https://github.com/httpwg/http- extensions/commit/49bcb4fddb8a8c294749ec9d81a236cde4df94b0). Hopefully that, plus the tests we'll add in [https://bugs.chromium.org/p/chromium/issues/detail?id=960375](https://bugs.chromium.org/p/chromium/issues/detail?id=960375) will help other vendors align their behavior with developer expectations.

</comment></comment></comment><comment><USER4> This is a continuation of a long arc of convergent work [1][2][3][4][5] by various people over several years; I've been following along [6].

The innovation of this proposal is to work towards the crossdomain cookie transmission being less insecure-by-default, by eventually making the current, limitless behavior opt-in.

This shifts the incentive of developers: presumably those whose sites require crossdomain acceptance of cookies will modify their sites accordingly, while those whose sites don't, or those who haven't thought about the issue will see fewer incidences of the most egregious POST-based CSRF.

[1] [https://www.microsoft.com/en- us/research/publication/atlanti...](https://www.microsoft.com/en- us/research/publication/atlantis-robust-extensible-execution-environments-for- web-applications/) [2] [https://bugzilla.mozilla.org/show_bug.cgi?id=795346](https://bugzilla.mozilla.org/show_bug.cgi?id=795346) [3] [https://github.com/mozmark/SameDomain- cookies/blob/master/sa...](https://github.com/mozmark/SameDomain- cookies/blob/master/samedomain.txt) [4] [http://homakov.blogspot.com/2013/02/rethinking-cookies- origi...](http://homakov.blogspot.com/2013/02/rethinking-cookies- originonly.html) [5] [https://tools.ietf.org/html/draft-west-first-party- cookies-0...](https://tools.ietf.org/html/draft-west-first-party-cookies-07) [6] [https://news.ycombinator.com/item?id=13689697#13691022](https://news.ycombinator.com/item?id=13689697#13691022)

</comment><comment><USER5> This is great - the `SameSite=lax` attribute is arguably how cookies should have worked in the first place, and I'm quite pleased that it's an existing RFC and not a proprietary change being done just in Chrome. Hopefully other browsers follow suit.

What worries me is the vague commitment to stop browser fingerprinting - not a lot of detail there and I'm fearful that useful features might be getting crippled. I don't think I'm as convinced that browser fingerprinting is as big of an issue as CSRF (prevented by the cookie changes here). Time will tell I suppose.

<comment><USER6> The reason this is related to browser fingerprinting is that cross-site cookies aren't _just_ used for CSRF, they're also a way to track users across sites.

With this change, developers will have to _explicitly_ declare when they're using cookies for that purpose (by setting SameSite=none) which makes it easier for browsers to identify cookies used for tracking and give users control over them.

</comment></comment><comment><USER6> Interesting. So apparently Chrome is going to stop sending cookies in cross- site requests unless they're created with `CrossOrigin=None` and the page is loaded over HTTPS?

<comment><USER3> We're proposing treating cookies as `SameSite=Lax` by default ([https://tools.ietf.org/html/draft-ietf-httpbis- rfc6265bis-03...](https://tools.ietf.org/html/draft-ietf-httpbis- rfc6265bis-03#section-126.96.36.199)). Developers would be able to opt-into the status quo by explicitly asserting `SameSite=None`, but to do so, they'll also need to ensure that their cookies won't be delivered over non-secure transport by asserting the `Secure` attribute as well.

[https://tools.ietf.org/html/draft-west-cookie- incrementalism](https://tools.ietf.org/html/draft-west-cookie-incrementalism) spells out the proposal in a bit more detail.

<comment><USER7> This is exactly the information I was looking for when I opened chromium blog post. Technical and to the point. Is there a reason why this couldn't be appended to the blog post?

<comment><USER2> Because you aren't really the audience for that post, and they can safely assume you'll dig deeper anyways?

<comment><USER8> If we're not the audience then who is? This was made to the Chromium open source blog, which is typically a developer heavy blog (with previous topics like "Hint for low latency canvas contexts"). Throwing a few reference links at the bottom shouldn't harm their message with the less technically savvy.

<comment><USER2> I'm just guessing. Something else that sparks joy for me: the fact that Google will never give any of their announcements the titles they're justifying, like, "OMG, WE KILLED CSRF!", and that I'll have to dig in a bit to see how big a deal what they just did is. It's like every "Improving privacy and security on the web" is a little gift I get to unwrap. It's like Justin Schuh and Mike West's version of "one more thing".

</comment></comment></comment></comment></comment></comment><comment><USER9> The easiest way to improve cookie privacy is to block 3rd party cookies by default. Adding new polices is not the right solution. 3rd party cookies are completely unnecessary.

<comment><USER10> Safari's Intelligent Tracking Prevention effectively blocks third-party cookies, at least for resources that are used in a third-party context on multiple sites. This google Chrome proposal also does it, but provides a dead simple workaround for trackers by sending SameSite=None and Secure with the cookie.

<comment><USER11> Let me guess: Google will tie the new proposal to a new Chrome setting which effectively identifies tracking cookies according to this new identifier, and will regularly purge them.

</comment></comment></comment><comment><USER12> Is this another way for Google to prevent you from clearing their cookies via the 'Clear Cookies' option?

Its a step in the right direction with enforcing SameSite cookie scoping, but we must be cautious that Google doesn't use this to force you to always be logged in. Google has a long way to go to rebuild trust after that last browser login debacle. I don't trust em.

<comment><USER13> Does Chrome support automatically clearing cookies at shutdown yet? I seem to remember it didn't but I haven't used it recently.

Edit: I searched for it, and it seems they have added the feature, but maybe not the related feature of clearing browsing history at shutdown.

<comment><USER14> Isn't that exactly what Incognito mode does?

</comment></comment></comment><comment><USER15> Why do cross-domain requests need cookies at all? Honest question, why couldn't we just stop sending them ever?

<comment><USER16> At my company for example we run services on multiple domains that are all authenticated by a single backend. Could probably be solved by some re- architecturing, but changing cookie behaviour would definitly break existing sites.

</comment></comment><comment><USER17> Is there a timeline for this change?

</comment><comment><USER18> Really disappointed in you Google for not addressing fingerprinting much sooner.

<comment><USER2> Be disappointed all you want, but they're not really "addressing" fingerprinting. It is exceptionally difficult --- computer-science Hard difficult --- to prevent fingerprinting; all you can really do is break popular libraries people use today. It's an arms race, and a much harder arms race than exploit-hardened runtimes are.

<comment><USER18> It's actually pretty easy overall... just don't use JavaScript and don't send user-agent string that shows browser/OS information.

<comment><USER13> User-agent strings should have been abolished long ago. It may not do much against sniffing, but it would spare us monstrosities like "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134"

<comment><USER19> I was surprised to see how many popular websites rely on things like user agent or referer header to deliver functionality. As soon as you start tinkering with them, they stop working, or say you use an older browser, etc.

<comment><USER20> Back in the day, safari 2.0.4 encountered a large amount of site breakage because sites were using useragent.indexof("4")!=-1 as the test for "are you Netscape 4", and if you were then they'd use netscape's layer apis (netscape's alternative to css). Any changes to the user agent are very scary - that's kind of how they ended being as terrible as they are.

Yet still sites continue to use the user agent to gate access. The same sites also like to complain about how bizarre UA strings are.

</comment></comment></comment></comment></comment></comment><comment><USER21> Not that any step towards additional privacy protections isn't a good thing, same for security. But Google has got to be one of the major contributors to the erosion of privacy.

How about chrome nagging to have you sign in? How about their very own ad networks?

<comment><USER18> You mean like Firefox sync and Pocket? The so called founder of JavaScript was the CEO of Mozilla, and that is the biggest cause of erosion of privacy on the web.

<comment><USER21> Absolutely. I should have the option to use a browser, be it Firefox or Chrome, without unwanted integrations or 'features'.

I'd like a browser that just browses the internet and respects my privacy. But apparently that's too much to ask

<comment><USER22> Surf / Suckless: [https://surf.suckless.org](https://surf.suckless.org)</comment></comment></comment></comment>


Show HN: I send out top JavaScript articles every Friday - <AUTHOR> https://www.weekendjs.com/ <comment><USER2> I got "The page you were looking for does not exist" when trying to confirm my subscription.

</comment><comment><USER3> here is the thing: This looks interesting but your page is missing basic information. Where are the 'about' 'contact' link ? who are you ? How do I know you are not going to spam or sell my emails</comment>


Citizens on Patrol: What If Your Neighbor Could Give You a Parking Ticket? - <AUTHOR> https://www.nytimes.com/2019/06/20/us/citizen-police.html <comment><USER2> As a minority I'm conflicted. Many urban areas have tensions between minorities and police, thousands of people face police harassment every year over minor infractions.

On the other hand, as services like Nextdoor illustrate, many neighbors have an inherent fear and discrimination against their minority neighbors, and can show the same type of overreacting behavior as the police.. I guess I'd rather have enforcement from individuals without license to kill.

<comment><USER3> > police harassment every year over minor infractions.

I'm confused by this phrase. do you think that minor infractions shouldn't be enforced at all? is it "harassment" anytime someone faces a consequence for violating the law?

<comment><USER2> When looking at the major police brutality cases over the past few years you will notice that there is a disproportionate amount of force used by police relative to the threat.

Eric Garner was accused of selling illegal cigarettes, was this a crime? Yes. Should he been put in a choke hold and held down by multiple officers despite being clearly subdued and repeatedly saying that he could not breathe? No. Sandra Bland was killed over a parking ticket. Recently, in Phoenix, a young family was threaten horribly because the daughter "shoplifted" a doll without the parents knowledge.

There is a clear pattern of disproportionate force used in relation to the actual activity being prosecuted.

<comment><USER3> The cases you cited aren't harassment, they are brutality and excessive force. I'm asking how minor infractions should be enforced, if at all, so that they are simply enforcement and not harassment.

</comment></comment></comment></comment><comment><USER4> Many condos/townhome developments in the US have "homeowners associations" (HOAs) which often empower your neighbors to do precisely that -- enforce parking and other rules within the bounds of the development.

Speaking from personal experience, while it's private property and legally allowed, and despite the HOA having good intentions in theory, this leads to an attitude of distrust amongst neighbors, people weaponizing petty complaints or viewing their neighbors as "informers", and/or a cabal being vocal, passive-aggressive complainers about everything.

A better solution would be farming this out to a private unaffiliated company -- although by no means perfect, would prevent the detrimental effects on quality of community.

<comment><USER5> On the HOA note I lived in a couple. Both times a small club of elderly women with nothing to do during the day would walk the neighborhood multiple times per day and enforce every single rule for every neighbor that they didn't like, which was nearly everyone. Car 13" from the curb? Citation. Shrubbery not trimmed? Citation. Visiting relative's car parked in driveway more than 3 nights in a row? Citation. Guest parking on street overnight? Citation. Watering your lawn not enough, too much, or during the wrong hours? Citation, citation, citation. Some tomcat or stray dog in the neighborhood pooped in your flowerbed and you didn't even notice it and thus didn't remove it? Citation. Fence paint peeling? Citation. Repainted the fence the same color as before without getting written approval from the HOA architectural committee, which was never even established? Citation. Got the committee established and got written permission to paint the same color as before but painted your fence a slightly different color of grey from the neighbors' since theirs have faded over the years? Citation. Unapproved lawn buddha statue in the backyard where no one can see it? Citation. American flag in a flag holder on the post next to the front door? Citation.

These types see themselves as defenders of law and order, protectors of good, and take pride in that not a single infraction on any day anywhere goes without a citation. They know all, and see all, and disapprove of all.

And the HOA management association loves them because they bring in tens of thousands of additional revenue per month, and even enables them to confiscate a few houses now and then should the homeowner contest the charges and refuse.

I would never ever ever ever live in an HOA controlled area again.

<comment><USER6> maybe I've lived in the wild west of Los Angeles's chaos and deterioration for too long because what you've just described sounds refreshing

</comment></comment></comment><comment><USER7> Houston has this: [https://www.houstontx.gov/parking/volunteer.html](https://www.houstontx.gov/parking/volunteer.html)

Take a 4 hour class, and you can write tickets for cars parked illegally in handicap spots.

<comment><USER8> Only handicap spots?

If so, why?

Just the easiest thing to spot and not misdiagnose, I guess?

<comment><USER9> Probably has the most sympathetic victims and has near-zero chance for self- dealing.

<comment><USER10> Would be interesting to see if there's a backlash if they could do:

\- non-EV cars in EV charging spots

\- EVs not hooked up to charge in EV charging spots

<comment><USER9> I'm not sure I'd support that and I daily drive a short-range pure EV (Nissan LEAF).

<comment><USER11> Can you elaborate on why you're not sure you'd support it?

"Charging spots are for charging" seems very reasonable.

<comment><USER9> There's already significant (and hard to fathom) backlash against electric car owners "getting free gas" at some of these charging stations. Electric car owners aren't nearly as sympathetic a victim set as handicapped.

Couple that with gpm's sibling comment and I think it's too ripe for abuse. (I hate getting ICEd out of a charging spot as much as anyone, but I'm not sure that the benefits outweigh the drawbacks here.)

<comment><USER10> I don't know the right terminology, but maybe it's a "power" thing.

For instance, if it's two people at the same power level, it gets complicated. If it's someone at a high power level defending someone at a lower power level, it's ok.

So defending handicapped people, or kids, or puppies is ok.

I've heard stories of people breaking a car window to get a kid or puppy out, and that's pretty much universally accepted.

But defending other people at the same level as yourself might be a harder sell.

I remember reading that the difference between police and citizens is that police can give out misdemeanor tickets.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> There's a part of me that would love to see this for cars parked in bike lanes. Bikes already get almost no infrastructure compared to driving or walking, having what little there is so often blocked by the more privileged party adds insult to injury. Not to mention the danger it puts cyclists into where they have to move onto the road where drivers may not be expecting bikes (because, y'know, there's a bike lane on the street).

Of course I realize that this could easily be abused, and you'd instantly get a lot of irate drivers calling for volunteers giving tickets to cyclists who blow through red lights, and it's tricky where exactly you'd want to draw a line there on citizen enforcement.

It seems like a sociologically simpler option may be soon within reach, though: once we have fully self-driving cars, you could commission a few parking enforcement bots that would tirelessly hand out tickets, in a more or less unbiased manner, all day and night long!

<comment><USER13> Why is it abuse to ticket cyclists that don't stop at red lights?

<comment><USER14> Parking tickets are much more reasonable to delegate than a moving violation.

You don't have to stop the violator, because they're usually not present, and you can leave the ticket on the vehicle.

The circumstances that lead to a finding of violation are subject to less dispute. Cyclist claims light was green, citizen enforcer claims light was red, is harder to prove vs parker says time was 5:30 and citizen enforcer says time was 4:30. Some parking tickets are more sensitive to location -- if the vehicle is very near the boundary between acceptable and not acceptable, perhaps an escalation to a sworn officer is in order, but parking in a red zone / parking in a bike lane / parking in disabled without a visible permit is usually clear cut.

</comment></comment></comment><comment><USER15> Similar program is in use in UAE for years. Anyone can use police app to snap a photo of illegally parked car. Specially trained police staff review hundreds of photos per day and issue tickets in one click. Far quicker, safer, easier approach.

<comment><USER16> Oh wow! Yeah, now this could work actually. Great comment, thanks for bringing this up!

</comment></comment><comment><USER17> I'd love this. We have people parking in the fire lanes of stores, anywhere they feel in a parking lot (make up your own spot, the lines are just suggestions), parking on sidewalks and in front yards. Even parking in the streets when parking is not allowed, backing up traffic.

It's just chaos. Local police are underfunded so they are understaffed and are too busy to enforce code or parking violations. And nobody pays their parking tickets anymore anyway. You have to rack up 20+ before they will put a boot on your car.

<comment><USER18> What's wrong with parking in front yards assuming the owner is OK with it?

<comment><AUTHOR> Many cities have laws against parking on lawns. Even if the owner is OK with it (or is parking on their own lawn), the neighbors might not be for property value reasons. There's also the problem of vehicle oil leeching into the soil:

[https://www.ksla.com/story/7065953/shreveport-council- approv...](https://www.ksla.com/story/7065953/shreveport-council-approves-ban- on-parking-in-front-lawn/)

[https://www.modbee.com/news/article108667517.html](https://www.modbee.com/news/article108667517.html)

</comment></comment></comment><comment><USER19> All the horrors of Nextdoor, brought into meatspace.

<comment><USER16> For other HNers out there that are not so up to date with Nextdoor: [https://mobile.twitter.com/bestofnextdoor?lang=en](https://mobile.twitter.com/bestofnextdoor?lang=en)

</comment></comment><comment><USER20> This reminds me of the 1990 novel 'Earth' by Dan Brin, which featured a near- future populace that all wear the equivalent of Google Glass, and use it to self-police _everything_ they see. Like an open source version of a police state.

Not saying it's a good thing, but I feel like it's inevitable with the ubiquity of cameras.

<comment><USER21> Yep.

Just imagine how effective boycotts will be. You just look at the grocery store shelf, and you automagically see which foods you can buy. They'll be able to give tickets on cars much easier as well. Just have AI's pour over everyone's monday video after hours, and get that ticket for parking in the handicapped spot in your mail on wednesday.

Most of the impact will be far more intimate though. Bartenders' glasses will just say: "Do Not Serve" when they look at a person. (Automatically keeping track of how many drinks each person is getting.) Women and men at bars will be able to just look at each other, and it will say "Sex Assault Risk", "Has Kids" or "Violent Crime Conviction" or whatever.

And that's just connecting the glasses to the public databases. They would also be connected to the small private data repositories updated by a person's close friend group. Imagine the information overlays there. Everything from "Has Girlfriend", to "STD Reported", to "Puts Out", to "Small Penis".

I can imagine life becoming almost an open book in the far future.

<comment><USER22> >and get that ticket for parking in the handicapped spot in your mail on wednesday. //

Lol, I think your age might be showing? Surely you get the charge auto- deducted from your account.

That way you can get auto-fined by the bank for having insufficient 'ShelbyvilleCryptoCoin' to pay. Then get auto-fined for getting an unauthorised over-draft, then auto-charged by the government for financial irregularity, then auto-fired by work for "bringing disrepute on the company". Then your 'worker car privelege' gets rescinded and you get picked up by a robocop, citizen, before you even finish your commute.

First your wife knows is an automated message saying she no longer owns the house as it's been sold to fund your trip to a prison colony on Rigel Prime ...

Or, maybe I watched too much dystopian sci-fi.

<comment><USER21> Wow.

I thought I was using as much imagination as possible coming up with just my likely scenarios. Yours are more Sci-Fi, but there is an uneasy feeling that maybe some of these "auto reporting" type things could actually happen. Likely not to the extent you indicate in your post, but I wonder if they may in the future just auto deduct tickets and such from your bank accounts?

<comment> exo-pla-net Precisely this is being done, today, in China. A facial recognition AI keeps track of your location and activities. If you jaywalk, it immediately deducts money from your bank account.

<comment><USER23> How much money? Are there people who just pay for the privilege of jaywalking and don't care about the money or their faces on the shame displays?

</comment></comment></comment></comment></comment></comment><comment><USER24> If enough people had driving cameras, and if insurance is mandatory, I guess individuals could report dangerous driving to insurance companies, and cause increased insurance premiums for dangerous or reckless drivers. Which is weird because then insurance companies become the police.

I wish we could report video to the police for dangerous driving... The police waste money enforcing rules that are only loosely correlated with preventing danger. Why not use the strongest signal possible - actual dangerous driving or near misses etc.

To avoid the "granny reporting everything" problem and avoid the "anti-social" problem, only allow three submissions per year?

</comment><comment><USER25> mobike and other bike/scooter/whatever sharing apps already turn users into police already. One is encouraged to report a bike that has been parked in an out of reach place, such as in someone's private backyard. I'm quite upset myself when I'm following the map for the only available bike nearby only to find out that it's obviously inside someone's apartment, so I'm torn about my feelings - i don't want to turn into an unpaid vigilante for some Chinese company, but I'm also pretty mad at the assholes who do this and would rather they not get away with it so easily!

</comment><comment><USER26> Having the citizens police each other, spy on each other is a characteristic of totalitarian regimes, notably present in both communist Eastern Germany and Nazi Germany. A fundamental part of democracy is to trust a citizen by default - not just with voting, but with behaving in general. Before police and courts come into play there needs to be a little leeway, for people to act, make mistakes, see their actions conflicting with the interest of others, to correct themselves etc.

Fundamentally, people should be put in a cooperative environment; having a significant part of the population be in "cop mode", looking for offenses, would be very harmful for society.

<comment><USER6> > people should be put in a cooperative environment

yes. but, a case can be made that someone who parks in a spot reserved for people with disabilities, or parks their car in the middle of a bike lane is disrupting and damaging the cooperative environment. furthermore, in the US the presence of guns and people willing to use guns means that confronting such a person directly is significantly riskier than it would be in some other, truly civilized, country.

</comment></comment><comment><USER27> You can do this in Buenos Aires. It's great for reporting cars parked in the bike lane or blocking your garage.

</comment><comment><USER6> They wouldn't. We're on pretty good terms.

</comment><comment><USER28> people aren't rational and hold grudges and prejudices. Empowering random people to make life hell for their neighbors isn't smart

<comment><USER21> In fairness, we already do this when we allow police to enforce the law. To be honest, police are people too. They are every bit as irrational as the rest of us. I'm sure they hold just as many prejudices as I do. (Maybe even the same prejudices that I do?)

Police would, at least, have more training though. So there's that.

<comment><USER28> Police have to adhere to well defined law enforcement

<comment><USER21> And people have to adhere to the law, but sometimes they don't.

Again, police are people. Sure they're supposed to follow the rules. But sometimes they don't.

What makes police better is that they at least have the training. So they have the knowledge of how to do it right. Whether or not they do it right in fact is an entirely separate issue.

</comment></comment></comment></comment><comment><USER29> Police are supposed to be citizens on patrol. How about having the existing police follow this short list, while we are being innovative;

> _To prevent crime and disorder, as an alternative to their repression by > military force and severity of legal punishment.

>To recognise always that the power of the police to fulfil their functions and duties is dependent on public approval of their existence, actions and behaviour, and on their ability to secure and maintain public respect.

>To recognise always that to secure and maintain the respect and approval of the public means also the securing of the willing co-operation of the public in the task of securing observance of laws.

>To recognise always that the extent to which the co-operation of the public can be secured diminishes proportionately the necessity of the use of physical force and compulsion for achieving police objectives.

>To seek and preserve public favour, not by pandering to public opinion, but by constantly demonstrating absolutely impartial service to law, in complete independence of policy, and without regard to the justice or injustice of the substance of individual laws, by ready offering of individual service and friendship to all members of the public without regard to their wealth or social standing, by ready exercise of courtesy and friendly good humour, and by ready offering of individual sacrifice in protecting and preserving life.

>To use physical force only when the exercise of persuasion, advice and warning is found to be insufficient to obtain public co-operation to an extent necessary to secure observance of law or to restore order, and to use only the minimum degree of physical force which is necessary on any particular occasion for achieving a police objective.

>To maintain at all times a relationship with the public that gives reality to the historic tradition that the police are the public and that the public are the police, the police being only members of the public who are paid to give full-time attention to duties which are incumbent on every citizen in the interests of community welfare and existence.

>To recognise always the need for strict adherence to police-executive functions, and to refrain from even seeming to usurp the powers of the judiciary, of avenging individuals or the State, and of authoritatively judging guilt and punishing the guilty.

>To recognise always that the test of police efficiency is the absence of crime and disorder, and not the visible evidence of police action in dealing with them._</comment>


Launch HN: Liyfe Clinic (YC S20) – Telemedicine for breast cancer - <AUTHOR> Hi everyone,
I'm Lily Tang from Liyfe (pronounced Life) Clinic (https://liyfeclinic.com), which launched just one week ago. We bring clinical knowledge and support to breast cancer patients without them stepping into clinics.
I worked 13 years as a cancer physicist in radiation oncology. During that time, I have witnessed repeatedly the problems associated with access to care—those patients who might have been diagnosed earlier, and those whose treatments could have been more compliant, and whose post-op symptoms could have been managed more efficiently after their initial treatment.
In fact, the average time a cancer patient gets to talk to a doctor is only 17 minutes. Without sufficient education and communication, patients often cannot understand their home instruction completely, and consequently their compliance is inadequate. All these affect treatment outcome. I wanted to change this situation.
If no one enjoys the process of hospital visits, and doctors don't have enough time to communicate with patients, how about creating a telemedicine platform? It can offer 24/7 access to personalized cancer consultation and support. This is how Liyfe Clinic began.
I met Sherry two years ago. We quickly became friends, and soon co-founders. Sherry started to build a HIPAA compliant platform for patient and doctor communication, including iOS, Android, and web versions. The platform has native HIPAA compliant communication infrastructure across all versions. It supports text, image, and video messaging, and file transfers. We also have video chat solution on top of WebRTC.
Many cancer patients need to see multiple doctors from multiple facilities, either at the same time or over some years. It is important for them to have a centralized place to store all of their medical records. This way, patients can easily share the records with all doctors—to improve communication efficiency and avoid potential medical mistakes. Therefore, we built a mini EHR system. Patients can upload and organize their profiles and medical records and choose whom they want to share.
Currently we focus on breast cancer and offer two types of services: virtual office visits and Liyfe membership. For virtual office visits, patients can choose to get a treatment second opinion, talk to a doctor, nutrition coaching, and emotional support. Once a service is chosen, we will match the patient with a provider, and then the provider can virtually see the patient using the video chat on our platform.
The membership program was developed recently after we talked to many patients. What patients really want and need is to be able to access a personalized professional help, anytime, anywhere. The membership program allows patient to text chat with a designated nurse practitioner (NP). Texting is a very low threshold access to care, and it lowers many barriers (fear, expense, inconvenience, time lost from work) to personalized professional care. Most patient questions can be answered by an NP. If there is a need to talk to a doctor or other specialists, the NP will triage that.
For long term, we would like work with local hospitals to provide a complete cancer service to patients—hospitals will take care of patients when they are at hospitals, and we will take care the rest.
If any of these situations resonates your or your family and friends' experience, we'd love to hear your thoughts. <comment><USER2> Congrats on the launch! I too am in the healthcare technology industry, but I've consciously been staying clear of the telemedicine space. It just seems extremely saturated especially these days in a post-COVID era.

Last I checked there are over 500 active telemedicine companies out there.

How do you plan on differentiating yourselves outside of your specialist physician-base? And how will you get the tool in front of users? I feel like SEO will be challenging and you may have to rely on grassroots/guerilla marketing approaches partnering with hospitals/payers to showcase the total cost value saving of using your product.

A similar use case I've seen is in my city a doctor friend just launched her own SMS care service, which acts as a "buffer" before medicare recipients call 911. By getting their less serious questions answered and thus discouraged from "abusing" ambulatory services, the payers (CMS) are very happy paying for this service on a per patient basis. They then market the tool to their patients and even provide financial incentives for using it. Just an idea of how you can spread!

<comment><USER3> Source on the 500 companies? That's staggeringly high.

<comment><USER4> If you are interesting, here is the GoodRx article I mentioned above: [https://www.forbes.com/sites/leahrosenbaum/2020/03/26/the- co...](https://www.forbes.com/sites/leahrosenbaum/2020/03/26/the-coronavirus- has-created-a-surge-of-telemedicine-demand-goodrx-now-lets-consumers-compare- services/) In my opinion, primary care is not a winner take all market, and the market is very large. What makes telemedicine interesting now is that the new solutions are become more and more innovative, both on technology side and business model side. Instead of picking from a list of providers, make an appointment, and video chat. I personally tried Khealth, and I thought it is very engaging, not a typical medical app. Another example is Forward health, it really empowers the patients to understand their situation, instead of giving prescriptions blindly.

</comment></comment></comment><comment><USER5> Don't you think that focusing solely on breast cancer is a bit too narrow? I am wondering how hospitals would be willing to invest so much into just a single subsection of their oncology department.

<comment><USER4> Great question, we start with breast cancer for two reasons:

1\. population is big enough for us to perfect our product, 1 in 8 women in the US will be diagnosed with breast cancer in their life time, Men will be diagnosed as well. 2\. the complexity of breast cancer is less comparing to other types, and there are more very good oncologists in this area as well. Since we are small, we want to maximize the quality of the service with limited resources.

We will expand to other cancer types later on. Many cancer centers actually have a separate breast cancer department, examples in new york city: mount sinai dubin breast center

</comment></comment><comment><USER6> Oh man, I've spent too much time in telemedicine. There's definitely real value there, but 99% of the challenge is figuring out who's going to pay for it.

Per-member-per-month with ACOs? Physicians increasing codes and decreasing overhead? Patients paying a premium for better access?

I like that you all are starting specific, and I wish you the best in figuring out your revenue model.

<comment><USER4> You are right, navigating through the eco-system is the challenge for digital health solutions. We are current in hybrid mode, D2C and B2B2C. We are a digital clinic, so we are handling the insurance, not our physicians.

<comment><USER6> Yep. Familiar with it. Looks like two different sales strategies though. Good luck out there.

</comment></comment></comment><comment><USER7> > The membership program was developed recently after we talked to many > patients. What patients really want and need is to be able to access a > personalized professional help, anytime, anywhere. The membership program > allows patient to text chat with a designated nurse practitioner (NP). > Texting is a very low threshold access to care, and it lowers many barriers > (fear, expense, inconvenience, time lost from work) to personalized > professional care. Most patient questions can be answered by an NP. If there > is a need to talk to a doctor or other specialists, the NP will triage that.

Is this effectively what an HMO is supposed to be, but just for communication via text?

Also, a lot of health insurance companies already offer a 24/7 nurse line, usually for free. Search for "<your insurer> nurse line". I don't think it's for extended conversations, but if you want to ask a question or understand the severity of an issue, it's a great resource.

<comment><USER4> Agree many platforms (primary care services, insurance etc) provide chat support for general health issues. Let me break down into two scenarios: pre- diagnosis vs after diagnosis.

pre-diagnosis: we got lots of patient ask "is this cancer" question. Because the symptoms sometimes are not super obvious, an oncology nurses with many years of experience is able to ask the right questions, and give you much accurate answer. The fact is that early diagnosis matters so much on the outcome.

after diagnosis: again many questions can only be answered by oncology professionals. Even the dietitian, which we also offered on our platform, they are required to have oncology training, understand chemo drugs, then be able to offer professional coaches.

We are thinking to collaborate with those primary care telemedicine/insurance platforms, so they can refer their patients to the specialties ones, like us

</comment></comment><comment><USER8> >Currently we focus on breast cancer and offer two types of services: virtual office visits and Liyfe membership. For virtual office visits, patients can choose to get a treatment second opinion, talk to a doctor, nutrition coaching, and emotional support.

As someone who gets pretty bad medical anxiety, this sounds really great. I've thankfully never had anything as sever as cancer, but I know that my family doctor and hospital staff, while professional and skilled at their jobs, were not always available for things like emotional support, general questions, nutrition info, etc. I'm sure this service will be helpful to many, so good luck!

</comment><comment><USER9> Congrats on the launch! Curious, how do you plan to acquire customers? Wouldn't hospital systems want to keep the treatment within their system or partner hospitals?

<comment><USER4> Good question, we are not the competitor of hospitals, but collaborators. I am not sure which industry you are in, it is kind of like buy vs build problem for an enterprise.

</comment></comment><comment><USER10> Is your video chat platform Hipaa compliant? How do you handle calendar and other timing or non-technical issues which would waste the providers time?

<comment><USER4> Yes, we built video chat on top of webrtc, host node.js server on aws, https termination on aws load balancer, then nginx to protect the data transition between load balancer and the server. We encrypt peer to peer text/image messages both during transition and store on the mobile device (using realm encryption storage).

In regarding your second question, I assume you want to ask the membership service. For telemedicine service, provider see patients and answer any question (even is simple), this is reimbursable from the insurance. For membership, our nurse practitioners will be the first layer on the other side to answer any question via the chat, many of them have 20-30 years of experience, and NP are actually eligible to prescribe medicine. Patient can book a full session with oncologist when need.

<comment><USER11> Hi there. this is interesting. I had this setup a few years ago for my web-rtc project in the university. Setting up Turn and Stun servers was fun /s. I really hope the quality has increased in the last 6 years.

Co-incidentally I'm building a telemedicine platform for ophthalmologists in Canada. Wondering if we can connect?

<comment><USER12> I have an online eye test (easee.online) which we are expanding globally. Would be interesting to connect to an ophthalmologist telemedicine platform. Can we connect? My email is in my profile.

</comment></comment></comment></comment><comment><USER13> This is awesome. I like that its so focused. Are there any good resources you referenced for building for HIPAA compliance?

<comment><USER4> It is much easier now, COVID-19 pushed messaging tools to build hipaa compliant version. Messaging: both twilio and sendbird provides hipaa compliant api Video: daily.co Forms: jotform AWS: backend data storage Mobile device: data storage using realms encrypting

</comment></comment><comment><USER14> id be curious to hear why you chose to apply to YC vs some healthcare industry focused accelerators like Rock Health or IndieBio?

<comment><USER4> The answer is that we actually have very limited knowledge about accelerators space, and we didn't actually "shop" around. Both me and Lily know YC, from YC alumni in this space, and the videos on Youtube. I think YC did really good job on publishing the "secret source" so that every entrepreneur can benefit from it.

In some way, our idea is kind of aligned. We want to make the barrier of access good cancer care very low so that everybody can benefit from it. Instead of working so hard to search for referrals in order to see the good doctors.

One take away from 3 months in: digital health sits on the cross of healthcare/bio and technology. YC has really diversified companies, and we benefit a lot from the perspectives in different sectors.</comment></comment>


Twitter Is Not America - <AUTHOR> https://www.theatlantic.com/technology/archive/2019/04/twitter-is-not-america/587770/ <comment><USER2> And it's not the world either (because, the US-centric, Republican/Democrat- centric prism is like... way out of focus).

Edit: and why should it be? why should any platform be "the one" when we already have so much diversity?

Slashdot was not tech. HN is not tech. Twitter is not US, is not the world, Facebook is not connecting the world.

This is fine. The Web is better when it is creating, interrogating, in the dynamic of building something, in all possible and absurd ways, rather than when it's trying to be all for everyone, to rationalise, to look at its own belly and to mistake its own limitations for what reality is.</comment>


Unix compliant arg parser for Node.js (https://github.com/bucaran/parsec) - <AUTHOR>

Long time `minimist` user here. Leanest and simplest of the pack at just 200 LOC with _no_ dependencies by the legendary substack.
Unfortunately the documentation is scarce, it has a growing number of unresolved issues and it simply does not adhere to the [UNIX utility conventions](http://pubs.opengroup.org/onlinepubs/7908799/xbd/utilconv.html) very well (see [here](https://github.com/substack/minimist/issues/50)).
Parsec is only 50 LOC and the API is simpler, and still no dependencies!
## Features
+ Well documented + Based in → [UNIX Utility Conventions](http://pubs.opengroup.org/onlinepubs/7908799/xbd/utilconv.html) + Custom aliases + Default shorthands + Default values / types + Handle --no-* options + Handle unknown options <comment><AUTHOR> Link: [https://github.com/bucaran/parsec](https://github.com/bucaran/parsec)

Long time `minimist` user here. Leanest and simplest of the pack at just 200 LOC with _no_ dependencies by the legendary substack.

Unfortunately the documentation is scarce, it has a growing number of unresolved issues → [https://github.com/substack/minimist/issues/50](https://github.com/substack/minimist/issues/50).

Parsec is only 50 LOC and the API is simpler, and still no dependencies!

Features

\+ Well documented + Based in → [UNIX Utility Conventions]([http://pubs.opengroup.org/onlinepubs/7908799/xbd/utilconv.ht...](http://pubs.opengroup.org/onlinepubs/7908799/xbd/utilconv.html))

\+ Custom aliases + Default shorthands

\+ Default values / types + Handle --no-* options

\+ Handle unknown options</comment>


Apple fires Chinese supplier for using underage workers - <AUTHOR> http://arstechnica.com/apple/2013/01/apple-fires-chinese-supplier-for-using-underage-workers/ <comment><USER2> So apparently Apple is making good on its promise to look deeper down in the supply chain. While it sucks for the workers at the plant that they're probably going to lose their jobs (shitty work is [usually] better than no work), the jobs aren't actually going away. They're just being shifted to another factory that now has the knowledge that they too could be fired for what Westerners consider egregious working conditions.

This is great, and the outcome of putting a lot of vocal and consistent pressure on Apple to behave in a less inhumane fashion. It's yet another example that well organized and vocal campaigns can result in meaningful change. They do take a while, though.

<comment><USER3> > While it sucks for the workers at the plant [..]

> This is great [..]

Aren't these statements contradictory? Isn't the supposed goal to help underage workers?

<comment><USER4> First I would like to say I am not in support of underage workers, I would never be. However, if we look at the realistic situations in certain parts of the globe, especially China, sometimes it is not always such a simple situation that we allow these underage workers to work.

In some far far away frugal rural land, a family is struggling financially. Their 14 year old son was not able to go to school, neither was there enough food to be fed to him. The news hit that there's a plant that's openly hiring workers without age restriction. The seemingly insignificant pay in the western's eyes will be a huge help to the family's financial in the remote rural China. After all, it's much better to work at such places than some coal mine that severely underpays.

Depending on where you are born from, some kids are meant to grow up faster than others. Some kids just cannot afford a normal education like everybody else should. It's not a fair world and it never will be. Is it fair for the kids? No it's not, but what's their best option?

Of course, not all situations are like this, but for situations where underage workers are actually working, there is a strong trend that this may possibly be the case. After all, who in the right mind would send their child to work at such an early age is they don't have to? Who doesn't want to live a good life? Remember Li Ka-Ching? He started working at a young age of 15 at a watch shop. See where he is at today?

Once again, I am not saying that education isn't important, I believe it is. However, under so many unique circumstances, it isn't always the most viable path one goes through.

I don't support underage workers, this comment isn't meant to bring to justice to the underage worker hiring practices in China. But it just pains me to see people generalize that the goal is to 'help' underage workers. The situation isn't the same in the West, hence why we think like that. It's a well wish and a prospect to help the country though.

<comment><USER3> Then let me say that I am in support of underage workers.

The idea that preventing children to work in these factories helps the children is ill-conceived, as you pointed out. If Apple wanted to help these children, it could have required better working conditions or better pay, but not letting them work doesn't achieve the goal.

These kids won't just say "alright let's go to school then" when they can't work anymore.

<comment><USER5> Not in the case of firing the company outright but the article clearly illustrates what happens to the children these companies employ against contract terms:

>Apple requires its suppliers to return the workers back to a school chosen by the family and finance their education. "In addition, the children must continue to receive income matching what they received when they were employed. We also follow up regularly to ensure that the children remain in school and that the suppliers continue to uphold their financial commitment," wrote Apple in its latest report.

<comment><USER3> Tough luck for those children who didn't already work there.

</comment></comment></comment></comment></comment></comment><comment><USER6> So I'll be the guy to ask it: What's the problem with underage workers? As long as it's voluntary, the conditions are okay and the pay is fair, who does it hurt?

Some societies don't have the luxury of an idle childhood. I don't feel right telling some family the choices they make in the face of extreme poverty or starvation might offend my first world sensibilities, so therefore they shouldn't get to make that choice.

Should we work at fixing the root problems which drive children to work? Yes. Should we fire them and let them starve in the mean time? I don't think so.

I'm happy about the education and guaranteed income that Apple is demanding, because it looks like they're trying to fix the actual problem, rather than just playing a PR game and kicking kids out on the streets.

<comment><USER7> The problem with underage workers is:

1) Education is a right which far too many people miss out on

2) Children's bodies and brains are still forming and so making them repeat actions many times per day is intrinsically harmful and the lack of mental development is similarly harmful

3) Children in factory jobs removes opportunities for adults to do the same jobs.

4) The pay is rarely "fair"; the conditions are rarely "okay".

You're right that it's better that children earn a bit of cash to help with family bills. But that would be better done by paying the parents a fair wage.

<comment><USER8> In a society with significant child labor, it's not clear to me how "just pay the parents more" is a serious response. When significant child labor exists, it does so for a reason.

Given that parents would probably prefer their kids get an education instead of working, it's not clear to me that depriving them of the option to work in a factory will result in the child going to school. In all likelihood, the child will continue to work, albeit at their next-best (perhaps illicit) option; their best option (via revealed preference) having been removed by enlightened westerners who don't have to face the same constrained set of choices.

<comment><USER9> "When significant child labor exists, it does so for a reason."

The reason is that it is in the interest of wealthy factory owners to keep the cost of labor as low as possible, just like when child labor was prevalent in the United States.

<comment><USER8> Lower costs explain why child labor is in demand, but says nothing about supply, namely why parents send their children off to work in a factory, something parents in productive, wealthy economies are unlikely to do.

<comment><USER7> Which is why it's important to give parents a working wage.

Part of that is strict laws about child labour, to avoid factory owners exploiting poor people. Creating a level field makes it easier for ethical employers to follow their ethics.

It would be nice if some of the premium paid for some products in the west was used to pay poor workers better, or used for health and educational projects.

</comment></comment></comment></comment></comment></comment><comment><USER10> "When new violations are found, Apple requires its suppliers to return the workers back to a school chosen by the family and finance their education. "In addition, the children must continue to receive income matching what they received when they were employed. We also follow up regularly to ensure that the children remain in school and that the suppliers continue to uphold their financial commitment," wrote Apple in its latest report."

This is a tough problem to solve. Doesnt this provide HUGE incentive to underage workers to try to get a job and then get caught?

<comment><USER11> isn't also a disincentive to employers to hire children?

<comment><USER12> Definitely, but fake documents are easily acquired and employment agencies are very sketchy in the export zones. So fraud exists, and I'm sure apple doesn't make the distinction between intentional and accidental violations.

</comment></comment></comment><comment><USER13> What is interesting to me is that I don't seem to hear anything about this where other companies are concerned. Is it a case of me not noticing or is Apple being singled out?

<comment><USER14> Any time Apple does anything it pretty much gets reported. I imagine most other major companies don't care or their supply chains are ignored by the average person. For example, do you know where your television was made, by what suppliers, and how old they were? Me either.

<comment><USER15> Until Apple starts to make televisions. Then that factory where your telly was made turns into "Apples factory" and every minor problem there ends up in NY Times first page. Every time.

</comment></comment></comment><comment><USER16> So, will any media outlet actually do the digging and find out which companies still do business with Guangdong Real Faith Pingzhou Electronics Co?

<comment><USER17> Seems to be a 'small' (<1000 employees) LED manufacturer.

[http://www.gd- realfaith.com/en/displayproduct.html?proID=100...](http://www.gd- realfaith.com/en/displayproduct.html?proID=100990419)

> Pingzhou electron becomes the largest global sub-contractor of TDK who is > the world-famous electronic industry brand

As much as I google I can't find any more names. I searched by the company and CEO name (Chunxiao Jin) but TDK's the only name mentioned... it must be and old document because when Asian suppliers work with Apple they tend to brag/tell everyone, If Apple allows them I think.

<comment><USER16> So after 1 day of articles, barredo and SoftwareMaven did more investigative reporting than actual news outlets.

</comment></comment></comment><comment><USER18> I am glad that Apple is making progress here, and I find it sad that this is not being done by the Chinese government.

</comment><comment><USER19> That news should make $AAPL drop by 5%. </sarcasm>

There's only positive things that can come out of this. A business leader taking it's leading position to put pressure on business that violates human rights.

</comment><comment><USER20> If you missed it, I recommend listening to the following American Life episodes in consideration on the light shed by this news: 454: Mr. Daisey and the Apple Factory [http://www.thisamericanlife.org/radio- archives/episode/454/m...](http://www.thisamericanlife.org/radio- archives/episode/454/mr-daisey-and-the-apple-factory) 460: Retraction [http://www.thisamericanlife.org/radio- archives/episode/460/r...](http://www.thisamericanlife.org/radio- archives/episode/460/retraction)

</comment><comment><USER21> Apple, which has the highest profit margins, is on a crusade to make labor less cheap, thus lowering profit margins for everybody, which will hurt their low margin competitors much more than themselves.

I'm not saying that's their only reason but let's be careful applauding their altruism and ignoring the business merits of their policy.

BTW, also, if some Apple competitors can only exist because of the _temporary_ cheap labor pool (one day China, India, etc will modernize a lot more. maybe it will take 50 years but it is temporary), then maybe that says something interesting about their businesses.

<comment><USER22> It takes a highly developed sense of cynicism to see a transparent effort to curb child labor as an attempt to hurt their competitors.

Furthermore, Apple has publicly committed to bringing more manufacturing to the US, which isn't exactly pool of cheap labor.

There are plenty of Apple's business practices worth criticizing. Making a forthright attempt to end child labor in the third world is not one of them.

</comment></comment><comment><USER23> Now those kids will starve :(

<comment><USER24> "When new violations are found, Apple requires its suppliers to return the workers back to a school chosen by the family and finance their education. "In addition, the children must continue to receive income matching what they received when they were employed. We also follow up regularly to ensure that the children remain in school and that the suppliers continue to uphold their financial commitment,"

<comment><USER25> I think this apply to those that remain selling to apple.

The children on the component maker that were dumped, are screwed,

</comment></comment></comment><comment><USER26> <Unbridled Cynicism>

<http://www.bing.com/news/search?q=apple+reduces+orders>

</Unbridled Cynicism>

</comment><comment><USER27> Let's not all sit here on our laptops, in our comfortable lives and try to understand the political complexities of societies where underage labour is common place.

Let's not pretend to understand, and let's not pretend that we all have some high moral duty to "protect" these children.

But, while you sip you tripple tall americano while reading forbes magazine pretending to be an expert on poverty and politics take a second to think a 12 year old boy who just lost his families only source of income, only source of food, and only source of life. These people live in a society where the cost of your fucking americano goes a long way.

So stop pretending. Because you have no fucking idea.

<comment><USER28> Very sound reasoning. By the very same reasoning, the debate about whether to abolish slavery (in the US) should still be in full rage. After all, who could definitely predict whether those poor people would be able to survive without their masters providing them food and shelter and protecting them from the harsh reality (with hardly a benefit for themselves)?

But I'm sure you will be able to demonstrate why this is not an appropriate analogy.

<comment><USER27> Enslaving people because of their race in a country that was otherwise prosperous, and hiring children in an economy and society where any thing else is nearly impossible are two entirely different things.

<comment><USER29> Slavery was the primary economic engine for a long, long time in US and its originating colonies and it was a primary reason for the economic prosperity and viability of colonies.

I agree with you that they are not the same, but both political and social wrongs that can and should be addressed (yes slavery still exists in the US, both de facto and actual i.e. human trafficking).</comment></comment></comment></comment>


Are app stores just another type of walled garden? - <AUTHOR> http://andrewgrill.com/blog/index.php/2009/02/are-app-stores-just-walled-gardens/ <comment><USER2> There is a difference between a walled garden for the sake of capturing users, and a walled garden because it makes sense.

Having a universal app store would be a pain the neck because of all the different platforms that you would have to support. It makes a lot of sense to have one app store per platform. If I'm on an iPhone, why would I want my interface to be cluttered up by Android apps or vice versa.

Nor does an app store mean that the host has to decide who gets in and who doesn't. Some platforms do, some don't. Even something like Debian that runs an app repository (which is what an app store is, sans payment system) has guidelines for submission - the key that differentiates it from the app store is that you can run unapproved code.

So a system where each platform has its own app store and apps that don't go through it are allowed to run on the platform make the most sense. Platforms that do not allow installing thigns outside their model are deficient, but this is a not a knock on app-stores in general.

<comment><USER3> An app store gives somewhere for vendors to hang up their shingle (like a mall), and -- depending on the barriers to entry -- gives some assurance to "shoppers" looking for apps.

We've just launched a new business app, bSelling - <http://bcisive.austhink.com/solutions/bselling>, on Salesforce.com's App Exchange for add-ons to Salesforce CRM, and wish that there were more such stores.

It's actually a bit like the Microsoft stranglehold on the old PC software market; there were certainly negative aspects, but the standardization effect was certainly market-making.</comment></comment>