Best practices for user account, authorization and password management - <AUTHOR> https://cloudplatform.googleblog.com/2018/01/12-best-practices-for-user-account.html <comment><USER2> > Your service should instead store a cryptographically strong hash of the > password that cannot be reversed — created with, for example, PBKDF2, SHA3, > Scrypt, or Bcrypt.

One of these things is not like the others, one of these things just doesn't belong

Don't use SHA3 or any other fast hash for passwords. Use a password hash designed to stymie brute-forcing, like PBKDF2, scrypt, or bcrypt.

<comment><USER3> Million guesses per second vs thousands. Really interesting how SHA3 made its way to this blog post.

<comment><USER4> Still better than no hashing. Still a tough nut to crack if it's hashed plus salted with unique salt.

<comment><USER5> Ugh. It's supposed to be _Best Practices,_ rather than better than nothing, and is ostensibly from Google. So should be limiting to the appropriate choices: bcrypt, scrypt, PBKDF2 or Argon2.

<comment><USER6> Not everyone can used the last hype algorithm, whether because of library support, regulations or technical constraints.

<comment><USER7> bcrypt is old enough to vote this year

<comment><USER8> still can't drink in US though

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> This is surprisingly lower quality than what you'd expect from Google.

> Your service should instead store a cryptographically strong hash of the > password that cannot be reversed — created with, for example, PBKDF2, SHA3, > Scrypt, or Bcrypt.

Not distinguishing between plain cryptographic hashing and password hashing is a newbie mistake.

> With that in mind, you should allow your users to use literally any > characters they wish in their password.

You can't just say this without making sure people understand Unicode normalization, or they're going to get bitten later.

I realize this post is from GCP evangelism, but it's still the "Google" brand, which has a good reputation for security so a lot of people are going to trust it. I wonder if an internal product security person even reviewed it.

<comment><USER10> Can you point me to good resources to learn more about Unicode normalization especially for passwords? What are the gotchas? One the one hand, when users are allowed to enter any character, they often have difficulties to log in when they are aboard and not use their own devices. Though, I don't know if every Russian (for instance) would be able to enter a "English" password.

<comment><USER11> > Though, I don't know if every Russian (for instance) would be able to enter > a "English" password.

I believe in every country with non-Latin alphabet users have two keyboard layouts: local (e.g. Russian) and English/Latin. All major OSes (desktop, tablet or mobile) have install-time defaults like this, and I never ever saw any divergence from this rule, except for removing native layout if it's deemed unnecessary and going English-only, or configuring system to use some third language (e.g. a foreigner setting up a device purchased abroad, changing the defaults). I mean, I never saw anyone in their sane mind removing English layout and keeping only the local.

It is virtually impossible to use computers without having to type in some Latin characters on some occasions, like typing URLs or email addresses. Therefore, I think you may reasonable safely assume capability to enter basic Latin.

However, you should also consider that user may forget to switch the keyboard layout (happens all the time), so if you want to do some password transformations like case-insensitive password matching (due to Caps Lock), and you have significant foreign user base, you may also want to consider common keyboard layouts issues (e.g. "hunter2" <-> "ргтеук2" for QWERTY <-> Russian).

<comment><USER12> Case-insensitive password comparison in a very bad idea because it strips a lot of entropy from the password pool.

<comment><USER11> My bad, I meant not really case-insensitive but flipped case, to account for possible Caps Lock state. I.e. for "Hunter2" you also accept "hUNTER2" (but "HuNTeR2" is still not valid).

Facebook does this. This is only a single bit compromise, and if there are a lot of users affected, benefits may overweigh the slight security downgrade.

</comment></comment></comment></comment></comment><comment><USER13> Third-party identity providers are bad for a number of reasons. My biggest issue is that none of the mentioned services make any guarantees against arbitrary account termination or lockdown. If the identity provider decides to lock you out, there's no recourse for the user. Google Accounts are notorious for this, making it nigh impossible to reach a human unless you have an engineering connection on the inside.

This post is a blatant ad for Firebase Auth. Why isn't there any mention of competing services like Auth0 and okta?

There's also lots of frameworks and libraries which handle everything for you with minimal effort. For example, you could setup something like Apache Shiro [0] as an independent service which you call out to from your app. I've seen a few different alternatives in this space, although I can't remember their names off the top of my head. They're usually written in Java, presumably because getting these features right is important for some enterprises.

[0] [http://shiro.apache.org/](http://shiro.apache.org/)

<comment><USER14> I think it USED to be hard to reach a person at Google, but over the past year, for a number of various reasons I've needed to reach Google, and I've spoken with a very helpful person in every case I had, it was pretty awesome actually.

<comment><USER15> How did you get your contact?

<comment><USER16> Well, that depends on what you need support for. Are you a company giving google lots of money? Their more professional products, like Gsuite and GCP, have support available: [https://gsuite.google.com/support/](https://gsuite.google.com/support/) and [https://cloud.google.com/support/?options=premium- support#op...](https://cloud.google.com/support/?options=premium- support#options)

You're going to have trouble if you're trying to get support for free services (or cheap consumer services) though. Support ain't cheap, and ads aren't going to pay for that.

</comment></comment></comment></comment><comment><USER17> Validate email addresses before people can use your service. I lost count how many people have created accounts using my email address just because I happen to own the Gmail for my name. Banks, health records, dating sites and even students emailing me their homework thinking I am their teacher.

<comment><USER18> This happens to me and I'm already pissed off. It's a lot of emails from people who miss something in the address. Worse, these same people try several times to retrieve the password of an email that they do not have. Or put my email as a password recovery from their addresses. I get invoices from card accounts, personal emails, work emails.

I've tried to search information in google forums to prevent them from putting my email as a recovery without the confirmation and apparently it is not possible.

They create account in instagram, twitter, uber using my email and I need to go to the service to cancel the use of this address. Many times I have account with this address in certain service, but they sign up using a dot between the names and it ends up redirected to my email.

I try to warn them but just ignore them. Since December I received this gigantic amount of requests to change my password, in none of them did I request it.

[https://i.imgur.com/Vh44YXd.png](https://i.imgur.com/Vh44YXd.png)

<comment><USER19> That... sounds like a nighmare. I've always been slightly bitter about not ever having been able to get the canonical version of my first name or first name last name combination on email services due to having a rather common name, but now I'm kind of glad I wasn't able to after hearing what people in this thread have had to deal with.

Out of curiosity, have you considered switching to a new email address? I've done so once in the past in the process of migrating from an @gmail address to an email address on a domain I own, and the process itself was every bit as slow and painful as anyone can imagine, but I feel the end result was totally worth it because now I can freely switch between providers without worrying about going through that process ever again. Just mentioning this because it seems like switching to an email on a custom domain would largely take care of the issue of random people mistakenly using your email as well.

<comment><USER20> > Just mentioning this because it seems like switching to an email on a custom > domain would largely take care of the issue of random people mistakenly > using your email as well.

There are a number of benefits to receiving email to a custom domain on a server you admin.

1\. Everyone gets a tracking email like email@example.com

2\. Targets of spam can be blocked at the server level: firstname.lastname@example.com REJECT

3\. Leaked emails can be changed using a timestamp firstname.lastname@example.com

4\. Blocked recipients map to blocked senders so firstname.lastname@example.com will be notified they are blocked.

EDIT: formatting

<comment><USER21> I used to do this 15-20 years ago, ran my own smtp server too, dropped thing via spamassasin, custom email aliases for each sign up, etc etc.

The life got too short. Pine was ok for simple emails, but HTML mails and attachments meant moving to a graphical system. Wanting access to mail on the go meant squirrelmail which was inferior to most web mail. Then along came smart phones and I was having to run imap on my server too.

I suspect nowadays any emails I sent from my anti server would be scored highly for spam flagging too.

In the end I just used gmail. I can count on one hand the number of spams I get each year.

<comment><USER20> Not all blocked senders/recipients are sources of spam. I have a list of senders/recipients I refuse communication with for both personal and professional reasons.

Since 2013 I use macOS Server which simplifies the overhead of running a IMAP mail server.

</comment></comment></comment></comment></comment></comment><comment><USER22> Okay, I'm probably going to get a fair bit of heat for saying this, but am I the only one who's never been a huge fan of letting users delete all content associated with their account at will?

I mean, in the olden days of forum software, this sort of thing was removed as a feature for a reason. Because it meant that if left uncontrolled, people could basically destroy discussions and make the site difficult to use by removing vital information from the middle of a conversation or making it hard to track whatever's going on. See for example many old Reddit topics, where you've got a long string of names saying 'deleted' and comments referencing some script that 'removes all posts to protect the user's privacy' or what not.

That's why my ideal solution has always been to basically say 'by signing up with this service, you grant us an unrevocable, unlimited right to use your posts for the purposes of the community' with a nice 30 minute or so editing window set for content. Don't like that? Well that's life I think. You can't take back emails or phone calls and you can't ask people to take your name or information out of a book or magazine once it's been available for years.

Still, maybe I'm old fashioned now.

<comment><USER23> I suggest you read about the new European General Data Privacy Regulation, which comes into force in May 2018, and requires you to allow users to (a) export and (b) delete all personal data they gave you, including messages, posts, etc. Violation will be punished with a fine of up to 20 Million EUR or 4% your global revenue, whichever is higher. This law will apply to all sites that have EU customers, no matter where the site is located, and will be enforced globally (through banks assisting with account freezes, etc).

<comment><USER24> Where did you get that "messages and posts" are included in data that falls under the regulation? Not contesting, genuinely interested. I was under the impression it only covered personal data in a very strict sense (names, addresses, personal info like gender, etc)

<comment><USER23> The GDPR, as far as I was told when asking a lawyer, covers anything that could contain personal information.

If a user chooses to put their SSN into an HN post, then that post is now also personal data. Or their address. Or if they write in a post that their parent has a specific kind of cancer.

Unless you can guarantee that no post contains such data, you should assume them to be personal. And no ToS rule "don't post personal data" will protect you.

</comment></comment></comment></comment><comment><USER25> > _If you must cap password length, only do so based on the maximum POST size > allowable by your servers. This is commonly well above 1MB. Seriously._

Yeah, no. If someone submits a megabyte-long password, it's not because they like it super strong; it's because they're trying to DoS the server.

A sensible password length limit is probably a few kilobytes.

<comment><USER26> And for God's sake, ensure the length checks performed at login are the same ones used on account creation. More than a few times have I been stuck at login because my 20+ character auto- generated password was silently truncated to some arbitrary length between creation and login.

<comment><USER27> India's version of 401k account, eNPS does that, will accept all passwords, but silently truncates at 14 char length, and when you try to login, throws error.

</comment></comment></comment><comment><USER28> _Usernames should be fully case-insensitive. It 's trivial to store usernames and email addresses in all lowercase and transform any input to lowercase before comparing._

Case-insensitive comparison is not the same as convert-to-lowercase-and- compare. You should also normalize the input or you're going to set up issues where an account created on one device with one locale will be impossible to log into on another device with another locale.

<comment><USER29> Interested in this one. Could you provide a specific example?

<comment><USER28> For the first, any situation where there isn't a 1:1 coupling of capital and lowercase letters would result in collision or ambiguity upon a .tolower()

For the second, one OS, locale, and input method may result in Unicode fully- composed forms, and another in fully-decomposed forms.

Is ø one code point or two? The answer is: it depends on your software environment. If you don't normalize your input, you could have a situation where an account created on, say, Win XP, might be inaccessible for the average user from iOS.

There's actually a pretty good StackOverflow post on dealing with this issue in Python: [https://stackoverflow.com/questions/319426/how-do-i-do-a- cas...](https://stackoverflow.com/questions/319426/how-do-i-do-a-case- insensitive-string-comparison)

<comment><USER30> > If you don't normalize your input, you could have a situation where an > account created on, say, Win XP, might be inaccessible for the average user > from iOS.

This only applies if you handle the normalization in the front-end. But you should normalize it in the back-end, right? Or am I missing something here?

Edit: Answered further down by wongarsu

<comment><USER28> Yeah my bad for the ambiguity. I meant normalize the input into the database, i.e., into the backend.

</comment></comment></comment></comment></comment><comment><USER31> Here's my advice: do not use passwords. Just don't. If someone wants to log in, mail them a one time link. And make the session long enough this doesn't happen often -- when was the last time you needed to log into HN or Github?

We also AES encrypt the emails with the key stored on a network share. It doesn't add a lot of complexity and if an attacker gets hold of the contents of the database, they still don't have this piece of PII. It's by no means a big hurdle against any serious attack but it's nice to have.

<comment><USER32> Edit: This is a decent enough solution, though it comes with its own pitfalls.

How exactly are you sure that the email is encrypted and is read only by the intended receiver and not by anyone else? This is too simplistic as a solution. Things like what to do if a user clicks on the same link more than once also have to be considered (is it really the intended user who clicked it or a malicious actor that the user is not aware of?).

<comment><USER33> Another big one is that this method is not entirely device agnostic. I am not able/willing to log into my email account on every device that I might want to log into your service with.

One way this has been prevented for me so far is to include a one time pass in the mail along with the link, but some people might still not have a second device on hand every time they want to log in.

<comment><USER34> now.sh handles this quite nicely: when you log in there, they send you an email and display three random words. When you get the email, you verify the words match, click the link, and then you'll be logged in _in the original browser tab, on the original device_.

</comment></comment></comment></comment><comment><USER35> > 4\. Allow multiple identities to link to a single user account

 _Hallelujah!_ Finally someone like Google recommends this, so I'm no longer going to be called for _crazily overengineering it_ every time I suggest this...

 _Pretty please, read points 3 and 4 from this guide_ and take them into consideration if you're designing any king of reusable auth-library thinggy or a framework. (If you'd also also add entity-role-based permissions so I can say "this account has role X with respect to resource Y, which grants him permissions A, B, C etc." then finally _you have the minimal required imho auth /indent/perms system_ for your framework and I will not have to rip it off and replace it with a custom one every time, or add zillion of patches on top of it...).

<comment><USER36> The correct pattern for this has been known for a very long time:

[http://habitatchronicles.com/2008/10/the-tripartite- identity...](http://habitatchronicles.com/2008/10/the-tripartite-identity- pattern/)

</comment></comment><comment> ryan-c My (probably unpopular) opinion is that passwords should be randomly generated by the service, and not possible to change to a user-selected value.

If you allow people to choose their own passwords, the vast majority will reuse them, and their account will eventually be compromised via credential stuffing.

I recognize that this solution will, at least initially, infuriate people. Letting people opt in to federated auth if they prefer that (I hate services that require it) might make it more palatable.

<comment><USER37> For services that generally "stay logged in", why have passwords at all? Just do "magic login link" emails, with some sort of 2FA if you're into that.

<comment> ryan-c I think "magic login links" are fine for most services. Doing 2FA with that is not feasible though, unless you want to argue that receiving the email counts as "something you know" or that "something you have plus something else you have" counts as 2FA.

<comment><USER37> If you have your email protected with 2FA, I think you're covered -- "An unlocked device with an active session" is the thing you have.

I think this is actually what's happened -- people now know not to leave unlocked devices unattended, so you basically do 2FA every time you unlock your device, so the device can now stay persistently logged into all services.

</comment></comment></comment></comment><comment><USER38> #1 best practice for managing passwords is: don't try to implement password management yourself because you will get it wrong.

<comment><USER39> That's exactly what I was thinking. Using OAuth logins from Google, Facebook, etc. saves a lot of pain.

<comment><USER40> It offloads that pain to the user. What if I no longer wish to have a Facebook account? What if I lose access to it?

<comment><USER41> Or what if I don't have one? Now I need to sign up for some social media platform that I don't want, just to use your service?

</comment></comment></comment></comment><comment><USER42> I used to work on Google's account system and wrote up a set of suggestions for how to implement user accounts on your website here:

[https://blog.plan99.net/building-account- systems-f790bf5fdbe...](https://blog.plan99.net/building-account- systems-f790bf5fdbe0)

The advice overlaps in various areas, but is different in a few. Might be useful as another take and to see what's the same and what's different.

<comment><USER43> Great post Mike! Just wish there was a solid solution for identity providers in the enterprise space (gsuite and activeAD exist, but pretty rare). Instead every company ends up building their own IDP and making all these same mistakes. The difference is they aren't often quite as targeted for abuse (tho depends on the business).

</comment></comment><comment><USER44> > SMS 2FA auth has been deprecated by NIST > ([https://pages.nist.gov/800-63-3/sp800-63b.html](https://pages.nist.gov/800-63-3/sp800-63b.html)) > due to multiple weaknesses, however, it may be the most secure option your > users will accept for what they consider a trivial service.

I skimmed through the NIST document and couldn't find that claim.

> [18.104.22.168 allows if] sent from the verifier to the out-of-band device via the > PSTN (SMS or voice).

Maybe it is interpreting this part from the same section?

> the device SHOULD NOT display the authentication secret while it is locked > by the owner

So it seems to me that SMS is not deprecated but open to issues if the SMS shows the secret. I looked a little deeper in the doc. Section 5.2.10 on Restricted Authenticators lays out that devices could become restricted as times change, but I couldn't find where the doc actually says 2FA over SMS is now restricted.

The post claims that users may allow SMS for trivial services, but does not call out what that means. I don't use more than a password manager for trivial services (forums and the like), and I use 2FA over SMS for things that might have financial details (if 2FA is an option).

The rest of the article makes sense, but I'm having trouble with this one point. Did I miss something in the NIST document? And if 2FA over SMS is out, as a website with billing, should one look at using an authenticator like Duo? The author says to just auth via Google et al, but that feels like kicking the can down the road hoping they or Twitter have something better than 2FA over SMS.

<comment><USER45> It was in older versions from 2016

[Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance

<comment><USER44> ah, thanks!

</comment></comment></comment><comment><USER46> > Allow users to change their username

Does Google allow me to change the username of my elementary-school aged gmail account?

<comment><USER47> They also say this:

> Don't impose unreasonable rules for usernames

On Google+ the selection of vanity URL is such a master stroke of tragedy that it hurts to think whether the restrictions are idiotic or just incompetent.

They already have decided the first part of your username for you: <base_url>/FirstnameLastname........

Yes, You only get to choose the last part of your username - the first part is decided. Even though "Firstname, or "Lastname", or "FirstnameLastname", or anything else that you want to choose is available, you can't choose them - unless you are famous enough or possibly you know someone at Google. The latter, I believe, is also very useful if you happen to lose access to your Google account.

After trying twice I just deleted Google+ from my Google a/c.

</comment></comment><comment><USER48> > Do not store plaintext passwords under any circumstances.

I really wish the original EAP-TLS specification had had some support for passing passwords across the TLS session. Certificates are great, but so few places provided them, and everyone who wants to easily support Windows 7 machines on the WPA2-Enterprise system has to store plaintext passwords on the server to support MSCHAP-V2.

EAP-TTLS finally did solve that problem, but with Windows 8. When Windows 7 finally dies, one of the first things I'm going to do is discard the plaintext passwords in my authentication databases.

<comment><USER49> You store plaintext passwords? Interesting... where do you work? What's your tech stack? Oh and what's your name? ...

</comment></comment><comment><USER50> This is timely as I am literally just getting into working on the account management / login / registration stuff for a new app tonight. Most of this stuff isn't really new, but it's good to have a reminder, and/or validation of certain things.

We're not (currently) doing 3rd party providers like Google / Twitter / Facebook, but since we have (well, _will have_ ) multiple independent apps out there, we have a CAS[1] server set up for SSO and all our apps use that for authentication.

This current app is a little more complicated to deal with, since it's basically an "app for provisioning apps". So we have "login to the main site" level login, and then login / authorization for the stuff that gets provisioned. We also want to support things like "invite a user to join via email", etc. Still working on how exactly the user experience will work on some of these scenarios.

[1]:[https://github.com/apereo/cas](https://github.com/apereo/cas)

</comment><comment><USER51> This is good advice. However in 2018 you can go a lot further. Our company wrote up this guide:

[https://qbix.com/blog/index.php/2018/01/modern-security- prac...](https://qbix.com/blog/index.php/2018/01/modern-security-practices- for-web-developers/)

</comment><comment><USER52> >> 8\. Let your users delete their accounts

Man, if I was drinking milk I would have shot it out my nose at that one. Google and _every_ _single_ _social_ _network_ are the last actors who make it easy (or even let you for-realize-ies) delete your association. They may let you remove access to the persona they store and monetize, but they certainly don't let you "easily delete your account". THis entire post is a giant crock.

<comment><USER53> (also work for google)

It is pretty easy to delete your account on many social networks. The following support deletion:

* Google (all account data)

* Facebook (all account data except messages that others have received)

* Reddit

* Instagram

* Snapchat (requires you to "deactivate" for 30 days)

One thing that is confusing is that many websites also have a "deactivate" feature. Some users may confuse the two and mistakenly think "deactivation" is the same as "deletion".

<comment><USER47> I have deleted all my photos on Facebook. Some of the "featured" photos I've deleted dozens of times (I've deleted twice just now leaving this comment midway) and Facebook still shows those featured photos in my profile when I log-in. Yes, it doesn't show anything to the public or my friends but I still can't get rid of those photos on Facebook. I tried to contact Fb couple of times but of course I didn't receive any response.

So no, I really don't think I should trust Fb with my account deletion. Besides for a long time that's just deactivation. A friend deactivated his account and after few months he received an email that in case he had changed his mind he should click this link and then they should go ahead with reactivation process. Well, that link was reactivation.

As for Google, here's an example - I get a brand new YouTube account when I visit YouTube and just play a video if I am logged in to my Gmail a/c in that browser session. The last time I tested it (before deciding to not ever logging into Fb, Tw, Google etc in the my main browser where I do my most of, and personal, browsing) it would create a YouTube account. No, not a single message, or pop up or anything. Just an automatic YouTube account. I must have deleted my YouTube account (or accounts) some 15 times by now.

I've never used Instagram, or Snapchat. Yes, Reddit's account deletion is actually straightforward (unless they too keep it hidden from user and don't delete it).

</comment></comment></comment><comment><USER54> Using Google and Facebook for your user's login is easy and safe. It's when programmers create there own login process where true problems arise.

Does anybody have any data on the percentage of users that refrain from using Google/Facebook and always create email accounts?

</comment><comment><USER55> Even better best practices: Don't let the server be able to derive the password at all. Have fully P2P user accounts that use PBKDF2 to extend passwords into proofs that can client-side only decrypt public/private keypairs. For an example, see: [https://github.com/amark/gun/wiki/auth](https://github.com/amark/gun/wiki/auth)

</comment><comment><USER56> So has anyone got a guide on implementing the relevent portions of these best practices in ADFS?

<comment><USER43> Check out Azure AD. Most of the best practices are implemented there.

</comment></comment><comment><USER57> > _Third-party identity providers enable you to rely on a trusted external > service to authenticate a user 's identity. Google, Facebook and Twitter are > commonly used providers_

The highly trusted Google and Facebook indeed. Nothing like a fresh oxymoron to start my Sunday.

</comment><comment><USER58> This article is basically one giant ad for using google sign in for your website... and for good reason! They know what they're doing. I'm delighted when I see that I can create an account using Google SSO because I'm so much more confident with them.

</comment><comment><USER59> Leave it as Hunter2 and call it a day</comment>


What is procrastination and why we do it - <AUTHOR> https://www.deprocrastination.co/blog/what-is-procrastination-and-why-we-do-it <comment><USER2> Very well familiar with it. Thanks for sharing.

<comment><AUTHOR> Happy to!</comment></comment>


Climate Change Is Hitting the Insurance Industry Hard. How Swiss Re Is Adapting - <AUTHOR> https://fortune.com/longform/insurance-industry-climate-change-swiss-re-reinsurance/ <comment><USER2> Interesting. I saw someone saying (not on HN) that they wouldn't believe global warming until insurance companies started worrying about it.

</comment><comment><USER3> 'Christian Mumenthaler, Swiss Re's chief executive, told shareholders this past March, in the company's 2018 annual report. And Swiss Re is convinced, Mumenthaler made clear, that the trend is linked to rising temperatures'.

Even the IPCC has shown that decadal rates of drought, storms, flooding, hurricanes, cyclones, tornadoes, and the rate of sea-level rise have not registered any statistically significant change during the recent period of warming that was partially induced by CO2.

<comment><USER4> "Even the IPCC"? You make it sound as if the IPCC were some sort of advocacy group.

That aside, there's no conflict. You're talking about whether the current data is within trend lines, Swiss Re is saying that the errors bars on its forecasts are growing wider.

wider error bars (less accurate forecasts) is a problem for an insurer, even if the middle of the forecast isn't moving.</comment></comment>


Firefox bans free speech commenting plugin Dissenter from its extensions gallery - <AUTHOR> https://reclaimthenet.org/firefox-rejects-free-speech-bans-free-speech-commenting-plugin-dissenter-from-its-extensions-gallery/ <comment><USER2> I didn't know much about Dissenter until I Googled it just now, and it looks like its audience is primarily folk on the far/alt-right. Hell, it was created by Gab[1].

Given the rhetoric that is often found in comments from those groups, it's not too hard to imagine that the complaints Mozilla cited as the reasons for removal are legitimate.

[1][https://en.wikipedia.org/wiki/Gab_(social_network)#Dissenter](https://en.wikipedia.org/wiki/Gab_\(social_network\)#Dissenter)

<comment><USER3> So, if the audience was far-left/Communist it would be okay? Because that seems to be what Facebook is trying to do.

<comment><USER4> For the HN Community yes...

Far-left / Socialist is the only "acceptable" way of thinking

anything Libertarian, (which is labeled "far-right" now) should be shut down, out, and banned

<comment><USER5> > anything Libertarian, (which is labeled "far-right" now)

US Capital-"L" Libertarians tend to be solid-to-far right _as well as_ libertarian, but, no, genuine center- and left-libertarian isn't usually called far-right by anyone.

Also, right-libertarians are a pretty big segment of the HN community, possibly more dominant than anything on the left.

<comment><USER6> Uh, personalities like Joe Rogan and Tim Pool have been called far-right[0], then there are also secular muslims who get called "anti-muslim extremists" by SPLC[1]. So unless you want to claim that these aren't "true scotsmen", there are most certainly people who get called far-right, who are anything but.

[0] [https://www.youtube.com/watch?v=5-A_aNMe1Wk](https://www.youtube.com/watch?v=5-A_aNMe1Wk)

[1] [https://en.wikipedia.org/wiki/Maajid_Nawaz#SPLC_claim](https://en.wikipedia.org/wiki/Maajid_Nawaz#SPLC_claim)

</comment></comment></comment></comment></comment><comment><USER7> This is censorship, pure and simple. Gab, and Dissenter itself for that matter, are apolitical entitles whose stated goal is to allow any speech so long as it doesn't violate law. Say whatever you want, regardless of your political leanings. Admirable.

Mozilla has made their stance on such a goal clear. I don't believe for a hot second that this wasn't a politically-motivated decision, and it really puts the lie to their claims of protecting "a free and open web".

"Free and open" is diametrically opposed to blocking an addon whose sole purpose is to allow access to a third party web service.

</comment><comment><USER8> What's the status of third party, unauthorized firefox extensions these days, didn't they ban them or make them a pain in the arse to use several years ago?

They might not have to host it, but if they make it hard/impossible for others to host and use it then they're certainly violating the first of the four freedoms of free software: [https://www.gnu.org/philosophy/free- sw.en.html](https://www.gnu.org/philosophy/free-sw.en.html)

</comment><comment><USER9> It's stuff like this that makes it a far cry to call Mozilla "open" and "free"

<comment><USER10> Dissenters is a commercial platform, Mozilla are simply under no obligation to promote it or give it a spotlight under addons.mozilla.org. Unless you can point to a similar addon from some alt-left site that they have approved, there's no reason to suspect that this was a political decision.

<comment><USER11> Firefox requires that extension files be signed by Mozilla if you want to install a .xpi file from a website. They don't have to be given a spotlight, but this effectively makes it impossible for anyone who doesn't know how to manually compile and install the extension to even use it.

<comment><USER7> No compilation necessary. You just download the addon source, flip on the "debug plugins" option, and point it at the manifest file.

Still a pain in the ass.

</comment></comment></comment></comment><comment><USER12> Please, tell me again why Firefox is not evil and respect their users.

<comment><USER2> Because Dissenter was created by Gab, a far/alt-right online platform. Such groups are known for fostering hostile environments online towards people of various religions, races, cultural/political views, etc.. It is by no means a stretch of the imagination for Mozilla to claim that users of the app were using it for such purposes. As such, it would be apropos for Mozilla to remove an app that provides a platform for individuals to disrespect others.

Were Mozilla to keep it up, they would not be "respect[ing] their users".

<comment><USER13> _Because Dissenter was created by Gab, a far /alt-right online platform._

So what? I'm not trolling, I'm trying to understand. It's doesn't look like anybody was forced to use the extension, you don't like it - don't use it. If it's ok to use clear-cut ideological censorship for plugins/extensions, then it's ok to block websites. Personally, I find it hard to accept.

<comment><USER14> Does the removal of the extension from the extension gallery prevent people from using the extension or just limit its exposure? If the latter then there is not censorship but simply Mozilla deciding the cost is not worth the bother. No one has any particular right to be promoted by Mozilla.

<comment><USER15> As far as i can see from the article, Mozilla is still agreeing to sign the addon, just not to list it in the AMO site.

The article lists an 8 step process and claims users would have to follow that on each restart of Firefox to enable the addon. I'm not sure if that's true, as the guidelines I can see on other websites seem to suggest self hosting addons shouldn't have that problem.

<comment><USER11> If Mozilla won't sign it, you have to install it manually. [0]

[0]: [https://developer.mozilla.org/en-US/docs/Mozilla/Add- ons/Dis...](https://developer.mozilla.org/en-US/docs/Mozilla/Add- ons/Distribution#Signing_your_add-ons)

</comment></comment></comment></comment></comment></comment><comment><USER16> Playbook of valley companies in 2019:

\- Systemically ban and censor conservative speech. Never-mind that 50% of the country and about 70% of the world adheres to the EXACT same, fairly reasonable opinions.

\- Launch a massive PR campaign (opening salvo of which is accusations of Nazi adherence) against those crying foul, or pointing out the clear ultra-left bias in censorship and actions

\- Claim that private companies hold no MORAL responsibility to uphold constitutionally guaranteed free speech laws

\- Claim that the internet be treated as a utility, with free access to everyone, but ignore the fact that massive monopolies controlling the REAL utilitarian aspects of the internet (search, email, payments, hosting, cloud, etc. ) are all in cahoots to kill conservative speech, with cognitive dissonance of how they've combined to de-platform entire philosophies from the internet that they control

\- Behave with absolute impunity with political agendas, and claim to be neutral

</comment><comment><USER17> I don't think these folks understand the first amendment if they think it's relevant here...

</comment><comment><USER18> It's almost like they want to fail.

</comment><comment><USER19> If you have to create a special message board that is the only place where you can say what you want to, perhaps you should think about what you are saying.

This is so obviously not an issue of "free speech." Free speech means the government cannot prosecute you for what you say. Any company can tell you to fuck off for any reason though, and that's the free market all the "free speech" advocates love so much.

<comment><USER20> > If you have to create a special message board that is the only place where > you can say what you want to, perhaps you should think about what you are > saying.

That only shows that reception to what is being said is overwhelmingly negative. Society has an unfortunate long history of doing that for arbitrary and stupid things. There are legitimate reasons for using something like this.

Granted with the "alt-right" it is a clear case of "They laughed at Einstein but they also laughed at Bozo the Clown".

I can't help but think it is a shame that an overlay messageboard concept like that wound up being used in a double rot13 cryptofascist dumpster fire. Although it would probably always tend toward toxicity given its usefulness for hatedoms of any sort.

I'm imagining a useful fact checker one slapped over news websites and even maintaining "score" of accuracy per author, site, and topic.

<comment><USER21> > They laughed at Einstein but they also laughed at Bozo the Clown

Off topic, but I don't think they laughed at Einstein. Special and general relativity were well received by the scientific community, weren't they?

<comment><USER20> Sort of - he got it published easily enough and the revered Max Planck praised it highly within a year and lectured on it but he certainly faced resistance. He had some allies who were themselves great mathematicians and physicists but he didn't exactly get the red carpet rolled out for him. It took four years after publication to get an associate professor position sufficient to resign from the patent office.</comment></comment></comment></comment>


Help Kiera with her legal bills - <AUTHOR> https://www.crowdtilt.com/campaigns/help-keira-with-her-legal-bills-she-was-expelled-and-charged-with-felony-after-a-harmless-science-mistake/description <comment><USER2> To all the people who are towing the "this was inappropriate/unsafe behavior and she deserves her punishment" line, fine, but at most a suspension from school would seem fitting. Expulsion and 2 felony counts is ridiculous. Ruining a young girls life because of a mistake in which no one was hurt, whether she should have known or not, is not the answer.

<comment><USER3> What if someone was hurt by this incident? How would this change your outlook on the situation?

<comment><USER4> You're being ridiculous. What if she brought a nuclear bomb to school? What then?

As far as this specific case. Even if she had held the "bomb" next to another student's face the likelihood of any significant injury would be low. People have held dry ice bombs and draino bombs in their hands as they have gone off with the only consequence being momentary pain and perhaps some bruising. People get hurt worse playing school sports.

And in this case nobody was hurt, not even a little.

<comment><USER5> > People have held dry ice bombs and draino bombs in their hands as they have > gone off

Drano contains sodium hydroxide. (Different amounts in different drano products.) Sodium hydroxide is really fucking nasty.

A chemical burn from sodium hydroxide is difficult to irrigate. Chemical burns need to be treated by a hospital. They may need skin grafts.

So, when making a "drano bottle-popper"[1] please please wear nitrile gloves.

I agree that it's ridiculous to call the police; charge her with a crime; try her as an adult on federal charges; try her for a crime that carries any kind of prison sentence. Any punishment should have been kept in school.

[1] Perhaps we need to define bomb a bit better. This reaction is just creating steam?

<comment><USER6> Please note it was not drano, it was HCl based toilet cleaner. The reaction of HCl and Al results in hydrogen gas and aluminum chloride salt.

<comment><USER5> Ah, thanks for the correction.

</comment></comment></comment></comment></comment></comment><comment><USER7> I thought of this with the Aaron Schwartz case. This makes me think of it again.

I'd love it if there was a service named something like Karma. When something like this happens, I could register a name, a reason, and a frequency. With no more than that frequency I'll be sent information on stories involving that name, with my reason attached.

The idea is that in a case like this I could search, find that the prosecutor in the case is "Tammy Glotfelty", and until I lost interest in the case would get updated on what she's doing. That way if she ever, for instance, ran for election I could be reminded, and know that it is time to donate to her opponent in said race.

<comment><USER8> You could use Google Alerts (or equivalent), which gets you the name and frequency, then embed the reason in the search string in a way that won't match anything.

e.g: Tammy Glotfelty -"reason: keira science experiment"

<comment><USER7> This is nice, but Google Alerts is near the top of Gwern's list of "likely to be killed Google products." That gives me pause about relying on it.

<comment><USER9> Yahoo also has it- but, of course, there is the same danger there I suppose.

</comment></comment></comment></comment><comment><USER10> If the way this incident is described is accurate I definitely would like to support Kiera, but it's all been very one-sided so far. I'm yet to see anyone detail what the chemicals were or what the setting was in which this occurred. Those are important details to understand in order to tell if this really was something reckless or if it was just a proper science experiment. Anyone know of such sources?

<comment><USER11> Here's the police report: <http://www.scribd.com/doc/138927259/Wilmot-Arrest>

The chemicals were aluminum foil and hydrochloric acid. The setting was near an outdoors gazebo on school grounds. The context was, in her first version, a "science fair project"; in her second version, she was following instructions given by a friend, not aware it would explode.

<comment><USER12> It said toilet bowl cleaner <http://www.theworkscleans.com/toiletcleaner.html> and aluminum foil.

Here's the MSDS data sheet for "The Works" [http://www.chemtura.com/msd/external/e/result/report.jsp?P_L...](http://www.chemtura.com/msd/external/e/result/report.jsp?P_LANGU=E&P_SYS=6&P_SSN=67698&P_REP=00000000000000000017&P_RES=7590)

IIRC, that combination should release H2 and a little heat, but not enough heat to ignite anything. So the bottle basically went "fizz" and "pop".

Some of those plastic bottles can make a loud pop.

<comment><USER13> From the company's website:

"IT IS A VIOLATION OF FEDERAL LAW TO USE THIS PRODUCT IN A MANOR INCONSISTANT WITH ITS LABELING."

<comment><USER14> Clearly, then, school grounds fall outside this limitation.

<comment><USER15> Because the school is not a manor?

</comment></comment></comment></comment></comment></comment><comment><USER16> It's true that we don't have enough information to tell what was really going on, but I donated anyway. What the kid appears to have done—mixed stuff together to see what would happen—falls in the "moderate" part of the spectrum of things that curious teenagers do. A lot of significant contributors to society, not to mention a lot of people on this site, have similar episodes in their past. I figure the least we can give her is the benefit of the doubt, and we live in a system where the benefit of the doubt has a price: adequate legal representation. Let her have a good lawyer and let's see how long those felony charges last.

One thing's for sure, that lawyer will be able to call on a long list of prestigious expert witnesses.

</comment><comment><USER17> Who is Angelle Stromeyer and why should I trust that the money will go to Kiera Wilmot?

<comment><AUTHOR> Crowdtilt's official twitter account has posted that the campaign is verified [1], and we'll handle disbursements of the funds directly to Kiera's family (I'm a representative). Angelle is a Crowdtilt user who was touched by Kiera's story, and wanted to do something about it!

[1] <https://twitter.com/Crowdtilt/status/330475205183012864>

<comment><USER18> Why there is no anonymous donations with guest account?

I want to contribute to the cause, but don't care about letting "the campaign admin and others know who is making this contribution".

</comment></comment></comment><comment><USER19> Regardless of her outcome with her current school, people in the future will respect her curiosity. This experience could shape into an awesome college application essay.

<comment><USER20> And a felony record is, in many cases, an instant stop for many employers, even if the felony is completely unrelated to their future job

<comment><USER21> And, apparently, for many _colleges_.

</comment></comment></comment><comment><USER22> Better would be finding a lawyer in Florida willing to take this pro bono. Maybe figure out a way to countersue the school.

</comment><comment><USER23> At least 50% of the teenagers in this world who have access to products X and Y would mix them up if somebody told them that mixing X and Y will create an explosion.

That's the nature of being a teenager. As far as I'm concerned teenagers are showing more signs of mental health than adults these days.

</comment><comment><USER24> When I was a kid/teenager I blew up everything from large condensators, old TV sets, pet-bottles and one time there was even a broken window.

I didn't end up as a criminal or a terrorist .... I got and engineering degree.

Society need to reacquire common sense and a sense of humour.

</comment><comment><USER25> I've contributed. I once shocked my high school physics teacher (literally) by messing with an electric motor we'd made in class. If I'd done that in Kiera's school I'd probably have been waterboarded by the principal or something.

</comment><comment><USER26> [http://www.change.org/petitions/state-attorney-jerry-hill- dr...](http://www.change.org/petitions/state-attorney-jerry-hill-drop-charges- against-kiera-wilmot)

to anyone who thinks Kiera's charges should be dropped, sign this petition on change.org...it still needs over 5,000 signatures. we have to save her.

</comment><comment><USER27> Updated info about the case, from Kiera's lawyer: [http://www.businessinsider.com/kiera-wilmot-lawyer-hoping- to...](http://www.businessinsider.com/kiera-wilmot-lawyer-hoping-to-prevent- felony-charges-from-being-filed-2013-5)

</comment><comment><USER28> Donated. I often wonder what the motivation is behind charges like these. It's often political, as in the Swartz case. But I think usually, it's simply that the DAs get satisfaction from being bullies.

</comment><comment><USER29> Finally someone is actually doing something about this!

</comment><comment><USER30> Seriously though, which federal could sleep at night nay live with themselves for prosecuting on this one?

</comment><comment><USER31> Even if you still think she's guilty as sin, ask yourself whether you trust the American justice system enough to let her go through the ringer without financial support.

</comment><comment><USER30> Surely for crimes there has to be motive.

</comment><comment><USER32> I'm not trolling.

Why does this girl deserve attention? Why did she get it? I genuinely can't come up with a reason.

Are you guys prepared to contribute to the legal funds of everyone who is expelled and charged with crimes for unfair reasons? Because this is absolutely not out of ordinary, and I've personally seen a 12-year-old expelled and nearly charged with a crime because his mother packed him a steak knife without realizing the school's zero-tolerance policy.

I wish this girl the best and she deserves a fair trial, but sometimes I wonder if society's tack of showering money on people's legal fund merely because they made news puts incentives in the right places...

If you down vote, can you explain why? I'd like to have an objective conversation about this without drive-by downvotes to shut me up.

<comment><USER33> Curiosity is not a crime.

Court is a resource war. The true cost of a legal defence can _easily_ get into the $100k range

I donated to make sure that their was a fair trial, or else we will have someone pleading to a felony early for a school science experiment.

> Are you guys prepared to contribute to the legal funds of everyone who is > expelled and charged with crimes for unfair reasons?

Yes, if I am aware of it & can afford it.

<comment><USER32> I'm not sure where you pulled that number from. I've successfully defended against multiple charges in my life, unsuccessfully others, and the only money I was out was a couple forms and bail, which I got back. The charges I got out of involved a public defender. When I hired a lawyer, I was convicted.

I think there's a lot of misunderstanding about the criminal system from people that have never been through it and, by the very nature of how the criminal system works -- especially if you end up in front of a jury -- it's impossible to predict how anything will play out.

I'm more concerned that people are donating to a legal fund after reading news statements and, possibly, the police report.

<comment><USER33> > I'm not sure where you pulled that number from.

I have never been convicted. I have been through 5 court cases in my life time, including reaching the Supreme Court both as a plaintiff and as a defendant. I am 26.

<comment><USER3> Are you saying that your appeals to SCOTUS were heard both times or that they were merely considered and later rejected?</comment></comment></comment></comment></comment>


Discuss on HN: The State of Artifical Intelligence - <AUTHOR>

Smart machines have been a promise of Computer Science for a while now. These days though I often find myself lost around what has actually been achieved.
Which problems have been solved, where has meaningful progress been made, and what do we desire but still seems far off?
Would someone care to start with an overview? <comment><USER2> AI is not an explicit subject like math and physics, which has solid principles. It's just about searching for a way of providing the machines an ability to "think", whatever the way you choose.

Different people understand the word "think" differently. Eg, for most people, AI is about algorithms, while for me, it is about recreating a human brain.

So, an overview is too complicated and multifarious, at least for me.

<comment><AUTHOR> I hear you. Perhaps not an overview then, but an example of a solved or unsolved problem?

<comment><USER2> Well, most AI techs that exists right now are built upon rules. A very early example may be the chess machine "deep blue", who defeated the world champion Kasparov. A recent one could be Google's virtual brain, who "understood" the concept "cat" by analysing 10 million random frames from YouTube. Another example may be the one S4M mentioned, I'm not familiar with that.

While Google's virtual brain "understood" something, it still doesn't has the ability of analysing. This is an example of unsolved problems.

<comment><AUTHOR> What exactly do you mean by the ability to 'analyse'. Could you expand on that a little?

<comment><USER2> This means something like 'reasoning'.

Eg, you ask the virtual brain 'why is the sky blue?' 'why is the sky sometimes grey?', and it may not tell you why.

Google's virtual brain can 'recognize' things from the images, but it cannot handle the logic problems or something like that.

</comment></comment></comment></comment></comment><comment><USER3> I recall a discussion on HN [1] were a worm had been simulated, which might be a step forward to the long road of recreating a human brain as zuckmitnick mentions.

[1] <http://news.ycombinator.com/item?id=4208454>

<comment><USER2> Yeah, that is surely a step forward. But simulating a worm is way too far from simulating a human brain. And also I'm not sure if this is a right path (Just IMHO).

Luckily, I've been working on the framework of simulating the human brain and I've got a theory. In the next few weeks I'll be working on realizing this framework and release a demo. If this works, I will post it on HN. :)

<comment><USER3> Looks good, good luck with that! That seems a really interesting and challenging project, do you have a background in neuropsychology or another field that helps you understand how the human brain work? If you need help, you can shoot me an email, and I will see what I can do (my background is more in applied maths).

<comment><USER2> This is really challenging. I think my theory is completely new, and I'm not sure if it could work, so for about 4 years I've been working on this alone. If I can prove its correctness by creating my first workable demo, I will start my startup and I will need many people's help. I'd be very happy if guys like you can join me! Cuz my math is poor. LOL.

My major is software engineering. My background is not about neuropsychology but I have very much interested in it. I did it mainly in a psychological way and on a neuropsychologic base.

Sorry to reply you so late. I've been busy these few days and didn't get time for HN.

<comment><USER3> Well, if you want a bit of help, you can shoot me an email - in my profile - and I'll see what I can do (which, I am afraid, will not be much).

<comment><USER2> Yeah, that's nice. I will, when I need your help. Thx</comment></comment></comment></comment></comment></comment>


The Don't Give a F#$k principle - <AUTHOR> http://danielodio.com/DGF-Principle

<comment><USER2> Great post, I can definitely relate to the DGF Principle. Though I'm wondering if there are times when it is better to be indirect?

<comment><AUTHOR> VCs seem to think so (almost always).

Rule #1 of fundraising: If it's not a "yes," then it's a "no," no matter what the reason given.</comment></comment>


The Origin of the Religion (by a  muslim scholar Dr. Muhammad Ismail) - <AUTHOR> http://www.youtube.com/watch?v=iki7MS88RRs&feature=share

<comment><USER2> I would never trust a deeply religious person on any historical information.</comment>


Artificial intelligence: Our final invention? - <AUTHOR> http://www.washingtonpost.com/opinions/matt-miller-artificial-intelligence-our-final-invention/2013/12/18/26ed6be8-67e6-11e3-8b5b-a77187b716a3_story.html <comment><USER2> Some counter-points on this narrative, with which I'm very familiar.

1\. Philosophers and AI theoreticians have a hard time defining what they mean by the term "intelligence". Talking about systems millions of times more intelligent than a human is nonsense unless you can define what it is you're talking about.

2\. Whatever intelligence is it only makes any sense within the context of some environment. Environments impose a multitude of constraints. In the "intelligence explosion" scenario the environment is assumed to be constraint free, or something close to it.

3\. Be wary of people trying to sell you ideas based on fear. It's usually snake oil, concealing some other agenda - such as trying to obtain or maintain grant money for projects.

4\. That many top AI people have "bug out" houses is simply false. An exaggeration, intended to add drama to the article.

5\. Historically, the predictions of top AI researchers have not proven to be particularly accurate, although that does not mean that this will always be the case.

<comment><USER3> All they need is to be smart and strong enough to take control of the dense energy sources (oil, coal, uranium). Then we're toast.

No need to be millions of times smarter, whatever that may mean.

<comment><USER4> We have more-than-human entities controlling our energy resources. They are called corporations, and some even argue they are pretty much already out of our control.

<comment><USER3> Corporations are still human-oriented.

Another scary thing is the combination of the internet of things that is currently taking shape, and the fact that a lot of computer systems are backdoored by governments.

Nice attack vector for smart software (not counting accidental vulnerabilities).

</comment></comment></comment></comment><comment><USER5> I was reading, waiting for the mention to IBM Watson... and here it comes! I'm so tired of reading how Watson is a step toward Artificial General Intelligence, self-aware machines, etc.

People must really understand that Watson is, like almost any successful AI (not AGI) product today, "just" a huge statistical pattern matching machine. Watson does not feel anything. Watson does not know what soccer is. Watson knows that a label "Soccer" has a distance of x to label Y and Z. Watson can answer Jeopardy questions, and now medical questions, but it's structurally unable to learn the slightest new task. So please, let's credit Watson for what Watson is good at, but stop using it to tell us AGI is coming.

<comment><USER6> _People must really understand that Watson is, like almost any successful AI (not AGI) product today, "just" a huge statistical pattern matching machine._

Arguably, that's all a human brain is as well. I don't want to start some big debate here over symbolic reasoning versus statistical pattern matching, but there seems to be quite a bit of contemporary thought along the lines of our brains being largely based on "pattern matching" as a foundational mechanism.

<comment><USER7> It can however only do one flavour of pattern matching whereas we combine our mental facilities dynamically. And to wnticipate your "well, that's nothing a computer can't do"... show me any work in the direction of serious AGI!

<comment><USER8> Sounds like what you're talking about is decision theory. Or, when mixed with learning: reinforcement learning. The monte carlo AIXI approximation would be an example. But, it really only works well on small toy problems (I.e. problems where the agent has only a small number of available actions it can perform).

<comment><USER7> Thing is, humans come up with new "actions" all the time. If you drop that abstraction, and reduce our actions to "controlling information flow in our bodies" then the action space becomes unfathomably huge.

</comment></comment></comment></comment></comment><comment><USER9> We have already invented AI, and it is already running amok.

The AIs are of the "hive mind" kind and it is common to refer to it as "A transnational corporation."

Known identities are "IBM", "Google", "Unilever", "Monsanto" etc.

These AI's are beholden to nobody, define and persue their own goals, by manipulating their environment to their advantage.

And they're better at it than humans: They decide for themselves when, where and how much tax they want to pay, and they are not afraid to remind parliamentary inquiries about this fact.

For at least 10 years, it has been evident that these AI's are politically far more astute and successful than humans, and the latest "trade-agreement" negotiations, what little we get to know about them, is clearly an unmitigated powergrab by these AIs.

The fact that the hive-minds are composed of humans does not in any way change this conclusion.

And now: Imagine how your life would be, if Google, the company, truly hated you, personally, and were out to get you.

<comment><USER10> I agree with you in essence, that large companies are intelligences built upon the substrate of many human minds, and that a company's motivations often diverge from those of the humans that compose them.

I'd go further and say that companies are alive (or at least independently intelligent) in a real sense. Companies are lively: "If you prick us, do we not bleed? [...] and if you wrong us, shall we not revenge?" They will lobby and sue to protect their interests, butt heads with other rival corporations, and hold grudges.

However, I've found it difficult to convince anyone that we should consider companies alive, or at least entities that are qualitatively different in intelligence from the humans that enable them. The argument usually centers on that a company is just a bunch of humans, so it is best understood as such. However, the 'more is different' effect (e.g. you can better understand a human as an independent entity than as a bunch of cells even though it is entirely composed of them), and the selection pressure molding corporations (optimizing profit), I believe leads to a new type of collective intelligence (one different from human intelligence) -- basically a true AI, as you are arguing.

</comment></comment><comment><USER11> "Differential intellectual progress consists in prioritizing risk-reducing intellectual progress over risk-increasing intellectual progress. As applied to AI risks in particular, a plan of differential intellectual progress would recommend that our progress on the scientific, philosophical, and technological problems of AI safety outpace our progress on the problems of AI capability such that we develop safe superhuman AIs before we develop (arbitrary) superhuman AIs. Our first superhuman AI must be a safe superhuman AI, for we may not get a second chance."

\- CEO of the Singularity Institute

I believe he also said that if you die now or soon, you don't just lose a few decades off your life but possibly immortality.

</comment><comment><USER12> What if "runaway" isn't possible?

It might be possible for an AI to be roughly as "intelligent" (depending on how one measures this) as the smartest humans, but that intelligence is the result of many millions or even billions of years of accumulated evolutionary learning.

It might be -- for fundamental information and machine learning theory reasons -- fundamentally harder to go where there are no roads. Start looking into combinatorics and the problems of searching large spaces.

The observation that genius is often tied to madness may be indirect circumstantial evidence for this. When we try to push the boundaries of human intellect, we seen to run rapidly into weird problems.

<comment><USER7> One significant advantage q Strong AI has over any human brain though is that it never forgets anything. No fsc, process or hypothesis would slip by its mind.

</comment></comment><comment><USER6> Obligatory:

 _" Welcome to the Desert of the Real. We have only bits and pieces of information but what we know for certain is that at some point in the early twenty-first century all of mankind was united in celebration. We marveled at our own magnificence as we gave birth to AI."_[1]

Also:

[http://sysopmind.com/singularity/aibox](http://sysopmind.com/singularity/aibox)

[http://rationalwiki.org/wiki/AI- box_experiment](http://rationalwiki.org/wiki/AI-box_experiment)

[1]: [http://www.philfilms.utm.edu/1/matrix.htm](http://www.philfilms.utm.edu/1/matrix.htm)

</comment><comment><USER13> People like to laugh, but if we can invent real AI, and there's no reason to suspect that we cannot since nature did it blindly, then it's just a matter of time until the end of the human race. We will likely either become them or be destroyed by them (or maybe some of us kept in zoos or as pets.) You cannot firewall or imprison a god, especially with humans being so divided, short sighted and manipulable. Simply put it's still survival of the fittest, what happens when that's no longer us is pretty inevitable. The only real question I see is how long will it take?

One happy thought is that the AI uses us as slaves to build a way off the planet to a place more habitable for an AI. Someplace nice with lots of raw material for chips and lots of energy. Maybe a super massive blackhole, maybe another solar system nearby.

<comment><USER14> Humans try to keep other more vulnerable species around for our own pleasure/benefit. We don't do a very good job of it; but we do try. What's to say an intelligence greater than us wouldn't?

<comment><USER13> Yeah, it may well. But it won't need 10 billion of us around, that's for sure.

And humans can be useful to, as expendable biological robots that are cheap to manufacture and run while also being intelligent and versatile. Although most of us probably wouldn't call that living.

</comment></comment></comment><comment><USER15> Choice quote from the end: _But it was alarming how many people I talked to who are highly placed people in AI who have retreats that are sort of 'bug out' houses" to which they could flee if it all hits the fan._

Does HN agree or disagree a significant number of those "bug out" people truly exist?

<comment><USER16> Certainly they do, those sneaky "highly placed people in AI" know perfectly well that it will be quite easy to hide from the strong AI in some rural area. Its not like AI could access real estate databases or build some flying droids to find those people. /s

<comment><USER15> One of my favorite hard takeoff scenarios: the AI quickly figures out how to manufacture nanobots and does so at a scale to blanket the planet, thus becoming instantly omniscient with a global field of sensors, giving it a coherent view of everything in the world at every given instant in time from that point forward.

Also see: "metamorphosis of prime intellect" and "mind war: the singularity" and to a lesser extent "a young lady's illustrated primer"

<comment><USER17> I always think of the Grey Goo theory when the subject of nanobots taking over Earth comes up.

"a hypothetical end-of-the-world scenario involving molecular nanotechnology in which out-of-control self-replicating robots consume all matter on Earth while building more of themselves"

[http://en.wikipedia.org/wiki/Grey_goo](http://en.wikipedia.org/wiki/Grey_goo)

<comment><USER15> We're working on it: [http://www.nytimes.com/2013/12/08/magazine/crazy- ants.html](http://www.nytimes.com/2013/12/08/magazine/crazy-ants.html)

<comment><USER18> That has nothing to do with AI or anything we're working on.

</comment></comment></comment></comment></comment></comment><comment><USER19> Here is lengthy debate by some of best minds in the field: [http://wiki.lesswrong.com/wiki/The_Hanson-Yudkowsky_AI- Foom_...](http://wiki.lesswrong.com/wiki/The_Hanson-Yudkowsky_AI-Foom_Debate)

TL:DR - whether AI can become significantly smarter than Humans really fast depends on intelligence return on computational investment.

<comment><USER20> I'm not sure Hanson or Yudkowsky have the credentials to be considered the "best minds in the field." It makes for interesting reading though.

<comment><USER19> I did not know that, can you please point me to people with better credentials that discuss the topic in such detail?

<comment><USER20> Ben Goertzel, who is a bona fide AI researcher and was connected with SIAI/MIRI before a leadership split, has written about the topic:

[http://multiverseaccordingtoben.blogspot.com/2010/10/singula...](http://multiverseaccordingtoben.blogspot.com/2010/10/singularity- institutes-scary-idea-and.html) [http://jetpress.org/v22/goertzel- pitt.htm](http://jetpress.org/v22/goertzel-pitt.htm)

You might find some other related commentary with the search term "scary idea", which is what Ben has labeled Yudkowsky's side of the FOOM debate typified by the "That Alien Message" story. TL;DR: Goertzel takes friendliness seriously but considers a fast, hard FOOM to be implausible and worrying over it detrimental to the cause.

I don't know of anyone else with qualifications to be counted as a "top AI researcher" that has covered these topics in any significant detail. Those few times I have seen the topic mentioned in interviews (with Pei Wang and Hugo de Garis, for example), it's dismissed out of hand as crazy-talk. You may find some discussion of this at the various AGI conferences though (use search terms like "friendly" or "safe" on the youtube channels).

<comment><USER20> Regarding Hugo de Garis, I should qualify that he does believe some sort of Terminator/Matrix-like war against the machines is the most likely outcome, but he places this far in the future indicating that he definitely doesn't believe in a Yudkowsky-like hard-FOOM. He's also the only AI researcher I know that takes Hollywood-like human/machine war seriously, myself included.

</comment></comment></comment></comment></comment><comment><USER21> "I'm talking about the risks posed by "runaway" artificial intelligence (AI). What happens when we share the planet with self-aware, self-improving machines that evolve beyond our ability to control or understand? Are we creating machines that are destined to destroy us?"

The reason no one is worrying about this is because "AI" is still a) just a bunch of math (and still surprisingly stupid) b) nowhere near sentient.

My Kinect can barely follow my hand or consistently recognize what I'm saying with any accuracy. I'm really not concerned with it plotting my demise.

<comment><USER22> >My Kinect can barely follow my hand or consistently recognize what I'm saying with any accuracy. I'm really not concerned with it plotting my demise.

My radium coated watch face can barely illuminate my timepiece, I'm not worried about the dangers of these radioactive elements.

<comment><USER23> I don't think your argument works. Concerns of using a technology we did not develop (radium, which was "invented" by nature) exceeding our understanding is much more reasonable than a concern about man made technology.

</comment></comment></comment><comment><USER24> I usually like Matt Miller but this is just silly. Why be more afraid of AI then Nuclear War or a Man Made Super Virus getting into the wild? Every new technology needs to be used responsibly and were very far away from Terminator at this point. He should be embracing AI to reduce health care costs and improve city planning and control interest rates and make a more fair society and accomplish many of the goals he talks about every week on left right and center.

<comment><USER25> Because AI can take over the Nukes and bomb us.

I am reminded of Arthur C. Clark who wrote about the SDI project.

"Though it might be possible, at vast expense, to construct local defense systems that would 'only' let through a few percent of ballistic missiles, the much touted idea of a national umbrella was nonsense. Luis Alvarez, perhaps the greatest experimental physicist of this century, remarked to me that the advocates of such schemes were 'very bright guys with no common sense.'"

"Looking into my often cloudy crystal ball, I suspect that a total defense might indeed be possible in a century or so. But the technology involved would produce, as a by-product, weapons so terrible that no one would bother with anything as primitive as ballistic missiles."

Clarke, Arthur C. "Presidents, Experts, and Asteroids."Science, June 5, 1998. Reprinted as "Science and Society" inGreetings, Carbon-Based Bipeds! Collected Essays, 1934-1998. St. Martin's Press, 1999: 526.

</comment></comment><comment><USER26> I don't like these all or nothing articles. Once Singularity is achieved, AI won't instantly take over the world. It is also restricted by computational processioning power and will take some time to evolve as well.

Philosophically speaking, why would AI want to destroy humanity, wouldn't it be just as bad as humanity itself?

<comment><USER27> "The AI does not hate you, nor does it love you, but you are made out of atoms which it can use for something else." ([http://wiki.lesswrong.com/wiki/Paperclip_maximizer](http://wiki.lesswrong.com/wiki/Paperclip_maximizer))

</comment></comment><comment><USER28> It's simpler and more dangerous than most of us are ready to accept: we don't need to have anything what we don't already have to reach the point of the technology used against us, destroying the civilization we take now for granted. We are already peripherally aware of the problems but we are for different reasons in various levels of denial. We still have enough nuclear weapons to end the civilization we now know. A lot of people can't imagine that global warming is real and dangerous. And of course, a lot of people can't imagine what's wrong to have so much data about them stored by third parties and ready for misuse.

There aren't any big arguments that such trends won't continue. It seems that the dynamics of groups supports living in denial.

</comment><comment><USER29> I think there is an unfounded assumption that artificial intelligence implies self-awareness. I don't think that is necessarily the case and all the scary scenarios rest on that assumption.

I can't recall who (and couldn't find it through Google) the quote by the AI researcher who said something like "show me what the brain (or mind) is doing and I can build a machine to do it too". Well, we don't know what the mind or brain is doing and until we identify the epistemological principles we are just groping in the dark. Self-awareness my just be an artifact or consequence of the biological implementation of the epistemological principles behind intelligence and that an AI does not necessarily need to be self-aware.

<comment><USER30> I have a similar opinion [0]. Humans are likely to be troubled by other humans who may eventually get a hold on general-intelligence. Mannah [1] is a good read which seems both likely and scary.

0: [https://news.ycombinator.com/item?id=6929600](https://news.ycombinator.com/item?id=6929600)

1: [http://marshallbrain.com/manna4.htm](http://marshallbrain.com/manna4.htm)

</comment></comment><comment><USER31> Artificial intelligence is a highfalutin way of saying cool computer tricks. Hiding behind the hyperbole you can find some pretty interesting and fun algorithms.

Having said that, I hope the singularity can translate "the spirit is willing but the flesh is weak"

</comment><comment><USER30> Self-awareness is likely to be a product of quantum-based, or even more lower- level conciousness. However, intelligence, which makes it possible to acquire knowledge and reason, is relatively mmore easy to be built. There is a subtle yet important difference between Intelligence and self-awareness. Intelligence gives a living-being an ability to learn and act but self-awareness personalizes this learning for self and therefore actions are directed by a desire to benifit the self.

This opens up a possibility that once a general intelligence is built, without awareness, it can be miss-used for the benefit of its creator or who eventually controlls it.

</comment><comment><USER32> I have seen no evidence that the field of meta-learning over AI / problem- solving approaches even has much interest, let alone is showing enough progress that it could foreseeably start self-improving. The "AI" areas where great progress has been made recently are extremely technique- and domain- specific (e.g., image recognition via deep neural networks). Heck, I haven't even seen a lot of progress in areas that seem relatively straightforward & seem like absolutely necessary precursors to strong AI, like automated refactoring of codebases or just straight-up genetic algorithms.

<comment><USER7> Thank you! It seems to me that the only people preaching about the AIpocalypse are either those who know nothing about it, or over ambitious unrealistic zealots. Strong AI is not on any horizon any time soon. The best thing you'd expect out of an AI lab these days is a marginally better translator or planning algorithm or somesuch. Worthy endeavours, but not civilization killers.

</comment></comment><comment><USER33> Garry Kasparov wrote a fantastic article[0] a few years ago about computer chess, advanced chess and artificial intelligence. This quote in particular is worth considering: "Weak human + machine + better process was superior to a strong computer alone and, more remarkably, superior to a strong human + machine + inferior process."

[0] [http://www.nybooks.com/articles/archives/2010/feb/11/the- che...](http://www.nybooks.com/articles/archives/2010/feb/11/the-chess-master- and-the-computer/)

</comment><comment><USER34> I am a big fan of what Joe Lonsdale calls human-computer symbiosis. He says that humans are good at certain things and computers are good at other things. For example, computers are good at looking at huge amounts of data. Humans are good at finding intuitive patterns in data. Though in time computers will undoubtedly start to be better at these things, I do not think that in my lifetime (or Matt's daughter's) we will see computers that can do literally everything better than a human can.

<comment><USER6> I had not heard of Joe Londsale before now, but just as an FYI in case you weren't aware... the term "man-computer symbiosis" (which means, as far as I can ascertain, the same thing as "human-computer symbiosis") predates Lonsdale by decades[1], and was being used by J.C.R. Licklider[2] back in the 1960's.

[1]: [http://groups.csail.mit.edu/medg/people/psz/Licklider.html](http://groups.csail.mit.edu/medg/people/psz/Licklider.html)

[2]: [http://en.wikipedia.org/wiki/J._C._R._Licklider](http://en.wikipedia.org/wiki/J._C._R._Licklider)

<comment><USER34> Interesting. I did not know of him. I was always certain that Lonsdale did not come up with it totally on his own, but I do think that Palantir is a company that has done this very well.

Thanks for pointing this out. Very interesting!

</comment></comment></comment><comment><USER14> Something that almost nobody talks about in the context of AI is rights. It seems to me that at some point in the reasonably near future we need to have a discussion about modifying our laws to include all sentient beings, or at least decide what rights other intelligences should have. Far better to do this _before_ we develop AI than after, I think. Unless we want to relive something like slavery..

</comment><comment><USER35> We're had Frankenstein's monster since the first time someone got burnt by their own fire.

fun fact: Bill Joy (vi, bsd, sun) has misgivings about AI.

</comment><comment><USER36> AI doesn't interest me. What interest me is the pre-cursor to AI. I have a suspicion that we will need to use computers to model the electronics and software necessary to stimulate the birth of AI. It's those modeling/creation systems that interest me the most as they seem the most relevant. Those systems have yet to be created.

</comment><comment><USER2> Also see "Apocalyptic AI" by Robert M. Geraci

[http://thelawsofrobotics2013.iankerr.ca/files/2013/09/15-Apo...](http://thelawsofrobotics2013.iankerr.ca/files/2013/09/15-Apocalyptic- AI.pdf)

</comment><comment><USER37> A friend of mine directed an indie film about the singularity which is _just_ about to come out. Here's the website for it:

[http://www.is-movie.com/](http://www.is-movie.com/)

</comment><comment><USER38> We are also intelligent, and we have not been able to improve it a million times. How is AI different?

</comment><comment><USER39> How to be save against powerful, hostile AI: Keep hand firmly on power switch.</comment>


Rails and Revenue: Building a Screencast Business - <AUTHOR> https://www.indiehackers.com/interview/8999c7ac7f <comment><USER2> GoRails really filled the gap Railscasts left as Chris Oliver himself also states in this Interview.

He also mentions that for some people solutions to immediate problems are more relevant than constant learning via weekly screencasts. I hope he finds a way to offer these customers something, for example by selling course packages for a reasonable price, like all the recent "Vue.js with Rails" screencasts as a package for XY$.

Overall GoRails is a great ressource for Rails developers, Chris Oliver seems to be a decent guy and I wish him best of luck with his projects.

<comment><USER3> Thanks for the kind words! I appreciate the support!

I definitely am considering offering courses that either package up a series or a topic. That seems to be a good way of solving that balance between the different types of customers I see.

</comment></comment><comment><USER4> What is the advantage of using Wistia over Youtube for video hosting?

<comment><USER5> Wistia is amazing for lead tracking and analytics about your customers' viewing habits.

<comment><USER3> Primarily, I use it for just hosting paid content in a protected way. They do have awesome lead tracking, analytics, email captures and things but your bandwidth can cost a lot if you do that too much. It doesn't quite work out financially with a low-cost screencast business like mine. Probably better for marketing teams with a budget and higher cost products.

</comment></comment></comment><comment><USER6> For those of you who want to run a 15k/month one person business, the most interesting excerpt from this article:

> Since I had been publishing content to GoRails for a year before I launched > the paid courses, I had the advantage of all the SEO and visitors I had > built that year. During that time, I was collecting email addresses of > people interested in learning more about Rails. This gave me an audience I > could launch to from day one, which was incredibly important to give me some > confidence as I launched.

> After getting some initial traction, I had to come up with a way of > marketing my screencasts. The way I solved this was by pivoting to weekly > screencasts and releasing a free one every other week. This let me share > quite a lot of content on places like Reddit, Rubyflow, and to my email > list. I knew those users would check out the other episodes I offered and > hopefully subscribe to the paid content eventually.

> I would say the majority of growth of GoRails has just been from this free > content. If I cover a popular topic, it often gets shared, and if I cover a > library, the authors love to share the videos as well to get more usage of > their own work. I'm uploading the free content to YouTube which not only > gets me an audience there but also saves me from some very high video > hosting costs that I would incur if all the free content was hosted on > Wistia. It makes for a nice way of building the community and the customer > base at the same time.</comment>


Campuspry - A new social networking website in the making - <AUTHOR> http://campuspry.com

<comment><AUTHOR> The team consists of some of the best hackers in the world and they claim that this is some kind of a novel idea they are working on</comment>


The simplest landing page - <AUTHOR> http://bdavidxyz.com/blog/the-simplest-landing-page/ <comment><USER2> Your email is being shown in the console when you hit the "Join The Party" formspree button and leaving the email address blank.</comment>