Identity Is Dead - <AUTHOR> https://www.constellationr.com/blog-news/identity-dead <comment><USER2> Shameless plug: IRMA Authentication is an open-source app [1] [2] and protocol that offers privacy-friendly attribute based authentication and signing using Camenisch and Lysyanskaya's Idemix [3].

It's currently heavily focused towards The Netherlands, where citizens can obtain attributes from the Dutch civil registry, such as name, home address and age. These attributes can then be selectively disclosed directly to a relying party, without the identity provider being able to see the transaction [4]. Multiple disclosures are also unlinkable as long as the attributes themselves are not identifying.

It's not currently using the verifiable claims data model, but it would very much fit it. It also doesn't use a 'blockchain', simply because it's not necessary to do so, and makes it all a lot less complicated.

[1] [https://itunes.apple.com/gb/app/irma- authenticatie/id1294092...](https://itunes.apple.com/gb/app/irma- authenticatie/id1294092994) or [https://play.google.com/store/apps/details?id=org.irmacard.c...](https://play.google.com/store/apps/details?id=org.irmacard.cardemu&hl=en)

[2] [https://github.com/privacybydesign](https://github.com/privacybydesign)

[3] [https://privacybydesign.foundation/publications/](https://privacybydesign.foundation/publications/)

[4] [https://privacybydesign.foundation/meeting- slides/slides-8-3...](https://privacybydesign.foundation/meeting- slides/slides-8-3-19/ringers-8-maart-2019.pdf#page=2&zoom=auto,-68,540)

<comment><USER3> > It's currently heavily focused towards The Netherlands, where citizens can > obtain attributes from the Dutch civil registry, such as name, home address > and age. These attributes can then be selectively disclosed directly to a > relying party, without the identity provider being able to see the > transaction [4]. Multiple disclosures are also unlinkable as long as the > attributes themselves are not identifying.

The fact that the government is involved in this is utterly amazing to me. Are you aware of the conditions which brought about this situation in The Netherlands? I'm wondering why other governments are not following this example, given the issues we've seen with identifiers like Social Security in the US.

<comment><USER4> IRMA has existed for a while, it's a non-profit spinoff from a Dutch university. But to my knowledge it is nowhere as widely known or accepted by relying parties as DigiD[1], this system is run by the government and based on passing the BSN (citizen service number)[2] to the relying party with SAML. It exists since 2005 and has become quite widespread: I can use it to file my taxes, make an appointment at pretty much any municipality town hall, and log in to my health insurance provider to name a couple of things.

Before DigiD, the Netherlands has had a central digital population register since 1994 called the Gemeentelijke Basisadministratie Persoonsgegevens, but before that analogue version of a population register was in use for quite some time as well.

[1]: [https://www.digid.nl/en/about-digid/](https://www.digid.nl/en/about- digid/) [2]: [https://www.government.nl/topics/personal-data/citizen- servi...](https://www.government.nl/topics/personal-data/citizen-service- number-bsn)

<comment><USER5> We can't have one of those in the US because lots of people are afraid that it will be the "mark of the beast" from the book of Revelation in the bible.

I'm not kidding.

Nothing would make more sense at this point then some kind of federal identity standard that used real crypto to prove someone's identity. The US Postal Service already has offices in every community that could be used for enrollment. For what it's worth, the Federal Government does this for all it's employees.

</comment></comment></comment></comment><comment><USER6> > Now, I agree in theory that bank accounts for example may be regarded as > "identities", and it follows that banks could be regarded as "identity > providers" (IdPs). But these conceptual models have proved sterile. How many > banks in fact see themselves as "identity providers"?

In Poland if you want anything from your government online you need to prove who you are. Easiest way to do that is to get redirected from government website to your bank website and login there then be bounced back to gov website.

Not sure how the system came to be but I'm very glad it's in place.

<comment><USER7> Same here in .nl, you have a government digital id called Digid, but it's just a login and password with optional sms 2fa, but we also have IDIN, which uses your banks hardware token, etc, to identify, which is better.

</comment></comment><comment><USER8> I thought Civic ([https://www.civic.com](https://www.civic.com)) was one of the most interesting projects to come out of the blockchain space for secure identity, but haven't really seen it adopted anywhere. Facebook sign in is everywhere, but Facebook is also completely untrustworthy when it comes to personal data and so I tend to avoid it whenever possible. This idea of sharing attributes seems interesting but does it go any further than "This app wants access to your email address, contacts, and photos" that already exists?

<comment><USER9> Blockchains have very little to do with "secure identity", and in fact more frequently serve to damage the security of the individual. If everything is recorded in a central ledger, how long do you think it takes for oppression to emerge?

<comment><USER8> As opposed to being stored in Google/Facebook's databases? I don't know if blockchain is the answer, but I would prefer not to trust any of these large corporations and use a decentralized identity system where no third-party has control of my identity information.

</comment></comment></comment><comment><USER10> I was at the Napa identity conference referenced in the first paragraph. It was expensive but we were invited because of the unique identity work we were doing with our startup Gliph at the time.

Our goals then we're to be an identity provider. We were not the only ones trying at this—-personal.com was much better funded and tied into DC—did nothing interesting but also hoped to store personal data securely and make it available when users desired to share.

We hunted use cases for identity like the Predator. Pivoting into secure messaging, Bitcoin, and finally a marketplace. But could not find a way to make it work.

Building identity in the vacuum of a useful and popular service doesn't work. At least, we were unable to make this work.

<comment> grey-area _We hunted use cases for identity like the Predator. Pivoting into secure messaging, Bitcoin, and finally a marketplace. But could not find a way to make it work._

The entire existing global payments system would not function without verified identity.

Healthcare would not function without verified identity (both for payment but also for tracking treatments and outcomes).

Existing marketplaces often require verified identity (as it helps combat fraud).

Vehicle license plates depend on verified identity (and are part of a system to enforce that).

Border control requires verified identities.

There are so many places in our current society where verified identity is essential, and already a solved problem (yes the solutions aren't perfect, but they are in place). Bitcoin failed IMO precisely because it actively avoids tackling identity, which has been a central part of finance for as long as it has existed. It might be hard to usurp the place states have claimed for themselves in verifying the identify of their citizens, or to make money from it, but it is absolutely central to how any society functions.

Identity is not dead just because some purveyors of online authentication think it would be easier not to deal with it. In fact I think identity not provided by states but claimed by the individual is a very interesting unsolved problem.

<comment><USER10> Not sure what your suggesting. Are you saying there is room for some new identity provider?

Fwiw, people have been hyping what an "interesting unsolved problem" identity is for a long time.

As far as I can tell, the existing solutions are more than good enough that any additional hacks are already built on top of them.

<comment> grey-area I'm suggesting that, contrary to the article's thesis, bitcoin's thesis and the parent's assertions, identity is central to many core functions of our society and is not something to be elided or ignored.

Identity is not dead, nor does it deserve to die.

Is there room for a corporate or distributed version of identity? Probably, but it might have to wait for the power of nation states to wane further, and it needs to acknowledge that identity is a core concern in many of these domains.

</comment></comment></comment></comment><comment><USER11> Identity, Single Sign On, and 'information gleaned for marketing' etc. are all different overlapping issues.

Truly there are almost zero situations in which an entity needs to know your real identity. You bank, surely, but you go into the bank to do that.

Single Sign on via Google and FB is now normative because they're ubiquitous and convenient, and of course, FB id's come with a greater possibility of legitimacy, and nice FB pixel marketing data.

I suggest that thre is something that could work, it just needs to be put forward by a credibly entity that for whatever reason feels it's in their interest, whereupon those interests are not entirely conflicted with the individuals right to privacy.

<comment><USER12> >Truly there are almost zero situations in which an entity needs to know your real identity.

1000 percent this!

What entities _really_ need to know to do their function is shockingly small compared to what they ask for. Here are some examples:

\- Bank: proof you are authorized to make decisions for a given bank account. (Possibly jurisdiction info if the government forces banks to screen on citizenship.)

\- Voting: proof that you didn't vote twice. (Possibly jurisdiction info if you are only allowed to vote in a specific area.)

\- Job: a nickname, contact info, where to send compensation, a way to grant (and revoke when terminated) your access to non-public information. (Possibly jurisdiction info if the government forces companies to screen on citizenship or calculate taxes in a specific way.)

\- Social media network: way for others to connect with you (eg email).

\- Bars: (possibly proof of age, if the government forces establishments to limit sales on that basis.)

\- Online or in-person payments: proof that the funds transferred to the business's account.

<comment><USER13> > jurisdiction info

How would someone do that? How do I prove that I am right now here, to someone else that's not physically present?

On a related note, how do I, right now, while doing this activity, prove that I belong to this jurisdiction, and not others.

Important when buying weed online, for example.

<comment><USER14> Your delivery address proves your jurisdiction in case of weed.

<comment><USER3> > Your delivery address proves your jurisdiction in case of weed.

What if that address is a mail forwarder? How do you prove that I reside at the delivery address?

<comment><USER14> I am just speculating but if they don't provide door to door delivery then you probably have to upload whatever documents they need defined by law. This clears them and it doesn't matter that they are sending stuff to a mail forwarder as now you are committing a crime.

</comment></comment></comment></comment></comment></comment><comment><USER15> No, but nice try. Identity is not dead, and attributes are a poor substitution for identity in a number of circumstances, for a number of reasons, too many to enumerate - but prosecutability maybe being the main one.

Also, people want to be themselves - and want others to be themselves even online, for a multitude of reasons too, personal fame being one. A few rightly sees this a privacy risk, and resolving this conflict is the real unsolved issue.

Identity verification is largely solved in countries where the government (in some cases via banks) backs such services. The US lags behind, but that's another issue.

<comment><USER16> > "Also people want to be themselves - and want others to be themselves..."

No, but nice try. Maybe in some circumstances, maybe even several, but this isn't THE concern online. Anonymity is not always bad.

Anyhow my main issue with what you've said is how you've glossed over how you think the author is wrong. What are some reasons attributes are a poor substitution for identity as described?

</comment></comment><comment><USER17> Even with banks, what they really need to know is that you are not laundering money and you pass KYC checks. Verifiable claims would be a way to pass those checks and get a bank account without the bank needing to store any of your personal info.

We're a long ways from that sort of thinking of course. And on that note, there are still an estimated 1.1 billion people in the world lack _any_ recognized formal identity. There's a chance for many of them to leap frog us by going straight to digital identities rather than carrying around cards.

<comment><USER18> A bank needs to be able to recheck every client's status any time the rules change (which happens on a weekly basis). If they don't hold adequate information about their clients, that would mean suspending their accounts until a new verifiable claim was provided.

<comment><USER3> > A bank needs to be able to recheck every client's status any time the rules > change (which happens on a weekly basis). If they don't hold adequate > information about their clients, that would mean suspending their accounts > until a new verifiable claim was provided.

Exactly. Anyone who has had to deal with the OFAC list (which in reality is every single business in the US) knows that the more information you collect up front, the less disruptive of a user experience you can guarantee (for most users).

</comment></comment></comment><comment><USER19> This is one of those scenarios where it could be amazing if the whole ecosystem were mature from top to bottom, but the incentives aren't really in place to have it happen naturally.

As an example: I'd love to be able to allow (and then revoke) Amazon's knowledge of my name and street address, but in the absence of GDPR-style regulation with real teeth (or the ecosystem being so mature as for Amazon to request delivery of a black box to identity XYZ and have some other company request permission and fulfill it) there is no incentive for them not to store anything I give them for eternity upon gaining access once.

</comment><comment><USER20> Don't expect it to go out without a fight.

</comment><comment><USER21> "Identity" is who you are, not something you have. It's not an attribute assigned by some other party.

Digital systems traffic in _identifiers_ \-- strings of some sort, usually, which purport to identify one and only one ... something. A person, a business, a role. The holy grail is that no one such identity (the actual behind-the-identifier entity) has multiple identifiers, though this always fails, least of all because developers and authorities require flexibility.

What identifiers actually track, mostly, is _relationships_ , between some individual, and ... well, some interested party. Are you a homeowner, patron, customer, insured, user, employee, employer, vendor, client, ...? And here, a large part of the conundrum becomes apparent: relationships differ depending on the relation between entities, a single individual has many relationships, possibly (or probably) with even a single other party.

Much of the attempt to track identity comes down to credit (or creditability), rights, trust, entitlement, responsibility, or other _ongoing relationships over time_. Are you the individual who has a legitimate claim to the contents of a bank account? Or a data storage account? Are writings A, B, C, and D the work of one or multiple individuals? Is that individual (or individuals) credible? If I want to listen to a musical performance, do I owe you a payment? If you listen to a musical performance of mine, how do I assert, and correctly collect on, a payment claim? Are you claiming to be A but are actually B? Is this transaction potentially fraudulent?

Some claims are more enduring and critical than others. Entitlement to a pension or government social insurance claim. Tax liabilities (or refunds). Voting. Others are inherently limited -- for all the risks of fraud in commerce, once a transaction has conclusively completed (and the tax office gets its vig), identity is largely moot.

(Service-based relationships change this, though whether that's worth the hassles is another question.)

In-person assertions of identity, as with voting, are expensive to spoof, particularly at scale. This is why the interesting acts of voting fraud very, very, very seldom involve individuals voting multiple times -- the costs are too high given the desired benefits. Far easier to corrupt the process elsewhere: eligibility, ballot formats, voting places, counts, and the like.

The power and curse of digital information it is independent of presence. Actions can be taken independent of place, and often of time. One work-around is to require an in-person registration at some periodic interval, or anchoring to a specific location (as with mailing addresses), or to payment. That last is why financial transactions records are so hotly sought: there's literally a cost to creating these, hence they're vastly higher quality than other data. (In the data analysis world, data tied to payment is virtually always more reliable than data which isn't: in U.S. health care data, procedure data, on which payment is based, is far more reliable than diagnosis. And since payments are contingent on both, each is gamed (through physician billing coding software) to maximise revenue.)

</comment><comment><USER22> Worked on digital identity for government services in a variety of ways (public and private sector) and its applications in broader society some years ago, here were my findings:

\- identity requires the ability to bear risk.

\- an identity not blessed by government bears very limited risk.

\- the use case for government issued identity is only in enforcement (fines, taxes, service eligibility, etc.)

\- The private sector does not need "strong," identity for anything other than credit/collections, for which banking IDs are the legitimate portal to govt identity today. There isn't a consumer driven use case for "strong" identity.

\- "strong" identity reduces to being sufficient to target that person with court ordered violence. Everyone talks around it, but that's what they mean.

\- an alternative strong identity provider is a de-facto state. (looking at you, FB/AAPL/GOOGL)

The attribute based models are technically interesting, but what we are really talking about is equivalent to financial instruments and securitization of identity.

The quality of any given individual identity assertion can bear up to a certain amount of risk. A tranche of identity assertions can bear even more risk, as the failure of some does not significantly impact the rest of them, and the cost/benefit of accepting the tranche is greater than the projected loss.

Futuristically speaking, the most likely identity technology two decades from now will be a set of collateralized attributes tied to securities, and ones that are asserted as bearing risk up to a certain grade. The rehypothecation or leverage on that identity will be a part of its score, which relying parties will assess and request additional collateral on accordingly. It sounds complicated, but it's not.

What such a "securitized," identity (so-called anonymous ID) breaks is the income tax and other individual enforcement use cases, where transaction taxes are viable, but tying them all back to a single state issued identity becomes unfeasible. The trade off is like the one we're encountering with cryptocurrency today, where it's useful for everything except state approved markets.

What's most likely is that innovation in identity will happen in countries where mature public services that require income taxes are not an impediment. e.g. the way that "developing," countries leapfrogged rich countries on wireless telecoms because they didn't have sunk costs in copper infrastructure, similar countries will leapfrog rich countries on digital identity and commerce because they don't have as much of a sunk cost in a strong government identity-based taxation model. When you look at how taxation works in resource-based (oil) and tourist (island) economies vs. services economies ("on shore"), they have more opportunity to facilitate digital identity services.

Identity is not dead, it's just that identity is not about identity.

</comment><comment><USER23> I think we don't really need identity, per se. What we really need is a system like this.

1\. ANyone with a public key can become an identity provider. Services will only work with a list of authorized providers, though. The list should be supplied by the govt, or some external, trusted org (like Visa for credit cards). When authorizing, data management policies and security should be reviewed, and policies should be enforced, i.e. how claims are verified, ability to port out to a different provider etc.

2\. Organizations like the government would have some number or token, and the provider used by every citizen. Information about them, like their age, them being convicted, having unpaid depts etc. would be sent as cryptographically signed claims to the provider. To be authorized, a provider must promise to not reject any valid claims.

3\. When authorizing with an external service, a request should be sent to the user's provider. Then, the user should be authenticated to it, shown what the service wants, and, upon approval, the request should be fulfilled.

4\. Services would usually request assertions (fail if the conditions I've just sent you aren't true). Assertions could include:

\- The user must have an age claim signed by the govt where age > 18.

\- The user must not have a valid "has some credit problems" claim.

\- The user has a citizenship claim from the state of California or the state of Nevada.

\- The user doesn't have a "convicted" claim where date of conviction >= 2010.

\- the user doesn't have a "banned" claim, signed by me. As a blog author, I could use that to not identify users across visits, but block spammers easily. \- The user has a "personalInfo" claim from a government. This would be used to ensure that, in case this user does something really bad, a court could force the provider to link the token given to us to a specific, living person.

5\. Services could also request capabilities, like the capability to send information to the user (without getting their email address), to get the same token across visits (which wouldn't be the default), to transfer $15 every month from their account for the Netflix subscription.

6\. If there was no other way, services could also request access to information, like the user's home address for a pizza delivery service, or the user's location for Uber.

7\. All requests could be one time or continuous.

8\. All services would need central authorization for getting any sensitive data.

This model wouldn't make the user experience suck, provide the companies with what they need, and npt expose too much data unnecessarily.

<comment><USER24> You would also need a GDPR requirement that the user doesn't have to provide info he doesn't want to, and that is not a reason to deny service (e.g bar doesn't get to demand your age, only above 21 or not).

It also assumes that users providers will be forced to store information on your behalf (such as the knowledge that the user has been banned).

<comment><USER23> This should be part of authorization, as I've said before. ANy provider proved of commutting fraud in that aspect would need to be banned, immediately. THis wouldn't even need to be a law, simple, app Store like guidelines would suffice.</comment></comment></comment>


Show HN: My weekend project to connect coders with non-profits - <AUTHOR>

After a weekend of coding, last night I launched a very early-version MVP of Coders Who Care. - The goal of the site is to connect nonprofits with developers willing to donate time to a good cause.
Right now, it's simply a directory, but in the future I'll be adding more tools for devs and organizations, including ways for charities to post projects and tools to notify developers when a project is posted that matches their interests, etc. I'll also introduce some social components, like recommendations/endorsements, and I have plans for eventually adding a software distribution system that open source developers can use as a means of stirring up support/donations for their favorite organizations.
Anyway, big plans, tiny beginning. I thought HN might be interested.
http://coderswhocare.org <comment><USER2> I'm very curious about how many people you get to volunteer time. One issue you may want to look at is, many non-profits don't need a developer, they need a consultant who can help them come up with what the developer is for. Getting people to understand the difference is important for both ends of the agreement.

Also the black on white and white on black on the homepage is hard on my eyes.

<comment><USER3> That's a good point. My brother -- who until recently ran a small non-profit -- last year had a grant to build a new website and put out a RFP to a bunch of local and national design firms. I think at times he was overwhelmed with the responses and utilized me to sort through them. I spent a good deal of time going over the proposals with him and helping him understand the differences between WordPress and Drupal and PHP vs. Ruby and what sort of features he actually needed on his organization's new website.

In the end he told me that I could probably make a living doing consulting like that strictly for non-profits. There is definitely a need for that sort of guidance.

I think that's where orgs like NTEN can help, and maybe this site could also act as an information clearing house and community for those on the non-profit side to learn about what sort of technologies are available, what they need, what's possible, and how to get it done.

</comment></comment><comment><USER4> I've participated in several such initiatives over the years, so I'd like to offer a tidbit of advice:

The development part is easy.

What happens before (identifying what the group really needs) and after (maintenance, hosting, back-ups, training, support) is the hard part. Too many well-meaning groups put together stellar software that non-profits don't get enough use out of due to lack of attention to the before-and-after pictures.

<comment><AUTHOR> Thanks for the advice. It seems to mirror what some others have been saying and is something I've been putting a lot of thought into today-definitely going to give it some serious consideration going forward and see what I can come up with on that front.

</comment></comment><comment><USER5> This is awesome! I don't know if this may be of interest, but I know a lot of Universities in our area with college students trying to start non-profits or social ventures whom need help with the developing portion or coding portion. Here's my email: firstname.lastname@example.com Please let me know if you are interested!

</comment><comment><USER3> Clickable link: <http://coderswhocare.org>

</comment><comment><USER6> i think this is a great idea. In austin there is a company convio which provides a platform for non-profits. It might be helpful to talk to them to see if you can form some kind of partnership - they have a lot of connections to non-profits.

This is a chicken and the egg problem and it seems like you need developers. But developers might need to see non-profits that inspire them before getting involved.

<comment><AUTHOR> Thanks. I'll keep Convio in mind - I have connections in Austin, so that's definitely something to consider. I've been getting more involved in nonprofit work lately and have several friends ho are, as well, so we can and want to start reaching out more.

I agree about the chicken/egg problem. I had considered adding a sort of nonprofit showcase, or case studies to the site, or even just covering them on an associated blog, something. I think one of the first things I'll add next is a "tell us your story" type page where nonprofits can submit info on what they're up to and I can start building up a database of interested organizations and details about them.

I'm attending a couple of big-ish charity events soon and primarily wanted to get the site up and hopefully get a few people signed on board prior to that, work out a solid plan going forward, add what I can in the mean time, and start doing some serious promotion in about a month.

It's a bit of a catch-22 on the promotion end of things, as well. You don't want to promote an empty site, but you need to get users somehow - which is a problem I'm sure everyone on HN who's ever launched a member-based site has face, and I'd love some tips on dealing with it. Right now, I'm mostly pushing it among friends.</comment></comment>


Ask HN: What are your greatest tips to hire freelancers? - <AUTHOR> <comment><USER2> Don't take their word that they can do something. Never hire without proof of their skills and examples of their work.

Also, communication is a big factor in hiring a freelancer. If you are outsourcing something to someone in another part of the world, watch out for timezone differences as well as making sure the person is a good communicator.

It's also just good general advice to always have them invoice you, just so you can have it on record for tax purposes.

</comment><comment><USER3> Have a contract ready as soon as possible. Don't leave your freelancers hanging. It's better for both of you if you are under contract.</comment>


Retiring the Netflix Public API - <AUTHOR> http://developer.netflix.com/blog/read/Retiring_the_Netflix_Public_API <comment><USER2> This is a good reminder to all of us that any API key is just that: A key. A key to a lock you don't own and a lock that can be changed at any time.

<comment><USER3> Indeed.

Any API key is just that. A key. A key to the stairs up the shoulders of giants. A place that can be shrugged. From which one can fall. But also from which one can see further. Further even than the sacred concept of "ownership".

</comment></comment><comment><USER4> I too am very disappointed and agree with the other commenter who said they are big enough that they don't have to worry about closing it. When I realized I wanted an API key they had already stopped handing them out, and now the axe falls again. I don't argue it's not within their right, it's just sad.

I have upwards of 1200 graded movies in another service that I used for a long time and that has a public API. Nowadays, I use trakt.tv a lot (and pay for it, because I really want it to be around, like I pay for Netflix and Spotify) and they also have a public API that I can use to write a tool and migrate/sync my movie grades there. Netflix' recommendation engine could have learned more about me in 5 seconds than it will in 5 years, and any grades I put into Netflix will never leave it.

Yes, I know I'm an edge case. Yes, I know it doesn't make business sense to cater to me. I still need to gripe a bit.

I have a custom app for managing my music too that uses the Spotify C library (wrapped in Go). I love that I was able to do that, and the day Spotify EOLs that library (and doesn't provide an alternative) is probably the day I leave their service.

Enough ranted. Sorry. I just like to take my data with me when I go.

<comment><USER5> I agree it is stupid that data you enter into a service, which you cannot know if it will remain (and that means every service), you can't extract to do with it what you want (log it yourself). It just gives me a better feeling if I can extract my netflix watching habbits and ratings for my own usage instead of relying on their ways (but their way isn't bad).

Also I just recently tried Mopidy again, a year ago it would crash a lot and time outs and stuff, but now I have it running as my main MPD with MPDroid on my phone and also Mopidy-Spotify. It is really awesome! I can just use my own keyboard shortcuts again to prev/play/pause/next again which I always found a burden in the spotify client. I'm with you on that Spotify C library, it would suck so much if they would EOL it without replacement.

<comment><USER6> They might get some flack for suddenly being less open about data. Adding a [download my ratings] button on the account page seems much less ambitious than maintaining an API so that might be on the table in the future.

</comment></comment></comment><comment><USER7> > To better focus our efforts and to align them with the needs of our global > member base, we will be retiring the public API program

What a sad statement, there is no need for this corporate-drone talk. "We're shutting it down because it doesn't make us money, and we think we will be better off being a closed platform" would have ringed much better, not necessarily in these words. Honesty is always appreciated.

<comment><USER8> > What a sad statement, there is no need for this corporate-drone talk.

I've always wondered if PR-types think that people "buy" stuff like this. It's somewhat expected from "old" companies but you would think a company like Netflix would be different.

<comment><USER9> whats "old"? they're pushing 20 years now. that feels pretty ancient in internet time :)

</comment></comment></comment><comment><USER10> There is something here that I really don't understand.

Why would they want to shut it down?

With something like Twitter, I get it. In order to make money off their customers' use of Twitter's free service, they need to be in control of the customers' experience (so they can do things like show ads). So they pulled this intentional bait-and-switch where they screwed over the independent developers who had made Twitter successful in the first place, but they did it because they needed to in order to make their profits.

The Netflix API story is different. First of all, APIs were always an additional offering: Netflix was grown on the backs of their mail-order business and third party apps that could just as well have been done via partnerships instead of open APIs. So they're at least not screwing over the one who brought them to the dance.

But the APIs have been a source of good will from the developer community (probably all out of proportion to the number of actual tools built using them). And the APIs are not harming Netflix's income stream in any way. (They might, in a tiny way, be helping, but I accept that this effect is negligible.) So where is the motivation to retire them?

Does it really cost so much to maintain the APIs? After all, they need to maintain them for Instant Watcher, Fanhattan, Yidio, NextGuide, Flixster, Can I Stream It?, FeedFliks, and Instant Watch Browser for Netflix. So it's not like they'll save the cost of keeping the APIs running. And I don't see how this can be about the cost of managing communications with the public -- if, instead of announcing that the APIs were now closing down, Netflix had announced that the primary support channel was now a public forum where users could help each other I doubt anyone would have batted an eyelash.

So help me out here: what is the motivation?

<comment><USER11> It's probably about reducing maintenance costs. The public API is implemented by software which calls internal Netflix services/APIs. Over time, those services accrue technical debt and need to be refactored or rewritten. Every system that uses those internal services needs to be updated to match.

A published API makes this more difficult. The behavior of published APIs, particularly those that are in wide use, _can not_ change in any way without raising the ire of developers. This restricts the internal refactoring you can do and makes the whole exercise (already complicated enough) even more challenging.

Working with a small, curated list of apps means that they can coordinate with developers on API changes rather than worrying about maintaining compatibility. This lowers their maintenance costs and increases their architectural agility.

</comment></comment><comment><USER12> My comment from an earlier post:

I was disappointed to get that email, I have an API key and am using it for an ongoing (small) side project of mine.

It seems counter to everything else Netflix engineering promotes with its tech blog and open source contributions. To be so public and open on one hand, and then shut down the public API on the other seems strange.

Trying to cut down on third-party access to user account functions like managing queues could be understandable, but I hope there is some kind of access to basic Netflix library data. Otherwise people will just turn to custom scraping solutions to get the data anyway.

<comment><USER13> Same here, have a working side project that has been working like a clock watch for the past 3 years, with a few thousands regular users. I will now need to see if scraping is a solution that can work.

At the same time, when they announce last year they were stopping the new API keys, I was wondering how long it will take for them to terminate the existing ones.

<comment><USER14> If you only need movie information, that there are arguably better sources available now like TheMovieDB.

<comment><USER13> Unfortunately no, the project in question was specific to Netflix.

</comment></comment></comment></comment><comment><USER15> R.I.P. NetflixItNow - a weekend hackathon Greasemonkey/Chrome extension that sent you an email when user-selected movies became available for streaming (not just disc delivery).

Though the project was short lived, I am very sad that it is no longer possible to implement similar projects.

Netflix API code (very simple): [https://github.com/swanson/netflix-it- now/blob/master/check_...](https://github.com/swanson/netflix-it- now/blob/master/check_instant.rb)

Video demo: [https://www.youtube.com/watch?v=h-zXOUsyXjA](https://www.youtube.com/watch?v=h-zXOUsyXjA)

Entire repo: [https://github.com/swanson/netflix-it- now](https://github.com/swanson/netflix-it-now)

<comment><USER16> They indicate they plan to continue providing access to CanIStreamIt, and I believe that website provides that service.

</comment></comment><comment><USER17> This just means more people will rely on covertly scraping their data. It also means, much like Twitter and the way they nerfed their developer ecosystem, Netflix will gain much more control over any available 3rd party offerings (as they've clearly outlined). Seems like a very short-sighted trade off if you ask me, but, hey, maybe the public API was just underused and they didn't want to devote more resources to maintaining it.

<comment><USER18> NFLX would prefer we not measure their offerings against AMZN's. That's what I think, anyway. Amazon has more headliners than they know what to do with - they rotate them on and off Prime's frontpage regularly enough to give the impression you'll never watch all of it. Netflix, on the other hand... Netflix and I fought an 18-month staring contest over whether I was going to watch The Lincoln Lawyer.

<comment><USER19> I don't think that's the case as they are allowing Can I Stream It? to stay up which is specifically for seeing what streaming services (including Amazon) offer particular titles.

</comment></comment></comment><comment><USER20> Sadly, this marks the end of an era for me with Netflix. After an initial 'meh' experience with the DVD rental service when they first debuted, one of the things that really got my attention with them was their developer contest to create a better suggestion service. But it seems that working with the developer community now is a thing of the past for them. Sadly, I foresee more companies going that way.

<comment><USER21> Wbat is funny is that put up that bounty. It took a years to get a hit and then it got a crazy. What is also funny is before they killed that program, they actually implemented any of the techniques from people that won those contests.

</comment></comment><comment><USER22> "Thank you to all of the developers who have participated in the ecosystem throughout the years."

I'm not sure "thank" is the word they wanted.

<comment><USER23> well, it has a vowel and ends with 'k'.

<comment><USER24> Took me longer than it should have.

</comment></comment></comment><comment><USER25> When business schools a few dozen years hence discuss this period of API development, they'll talk of how we learned to use an open API as a weapon wielded by a mid-size company to fend off competitors until the company has grown to a place of market dominance.

</comment><comment><USER26> I worked for Netflix in 2009 and 2010, first documenting the consumer API and helping out with things like oAuth, and later working on the original iPhone and Android apps, which ran inside a Web view using nothing but HTML, CSS, JavaScript, and the consumer API. (The morbidly curious should see "Mistakes I Made Building Netflix for the iPhone," at [http://www.slideshare.net/kentbrew/mistakes-i-made- building-...](http://www.slideshare.net/kentbrew/mistakes-i-made-building- netflix-for-the-iphone.))

At the time, Netflix didn't run on an API; the API had been retro-fitted onto Netflix. Even a simple thing like "please tell me the availability of all the discs in this season of this television series" took several calls and a fair amount of head scratching to accomplish. Every new device that came along got a slightly different version of the API, support was terribly difficult, and when we launched for PS3, Wii, iPhone, and Android, it became obvious that our own apps had to take precedence.

I am not surprised to see the Netflix consumer API shut down. This will, of course, result in rampant screen scraping and the creation of an unofficial Netflix API, which, when it breaks, will be all Netflix's fault.

</comment><comment><USER27> Netflix just keeps creeping one tiny step at a time farther and farther away from the awesomeness that they once were.

I used to love Netflix. I was a loving, loyal, evangelical customer and fan.

Now I just find them somewhat useful. In the future, who knows?

<comment><USER28> Completely agree with the sentiment.

</comment></comment><comment><USER29> Netflix is big enough not to need a public API, so they are closing it.

It also makes things a bit easier on the technical side after they moved away from generic "REST" to device optimized APIs.

</comment><comment><USER18> Good. Drive them into the ground, Jeff.

What was it, 2003-04 when Blockbuster's engineering team sent Netflix that concession letter? 10 years go by and guess who's stuffing their bra for lack of content.

</comment><comment><USER30> Does anyone here happen to know how Netflix is charged for content? Specifically, do they pay owners per viewing while they have a title licensed, or do they license get a license for unlimited customer uses? And, even if they do get rights for serving an unlimited number of viewings, do they have to supply the usage data to the content owners, who may use the information in future negotiations.

I ask, because it seems like these details would have pretty significant impact on Netflix's incentives for effective recommender systems and user portals. They would need to balance the satisfaction rates necessary for retention of subscribed customers with variable costs of serving content, especially recently released feature films.

<comment><USER26> Content owners are paid for unlimited viewings during a specific window of time. Here's a guide to how some of those windows work: [http://www.vodprofessional.com/features/a-guide-to-pay- windo...](http://www.vodprofessional.com/features/a-guide-to-pay-windows-for- tv-movies/)

It's Byzantine, and must be renegotiated studio by studio and sometimes film by film.

</comment></comment><comment><USER31> Seems like you could just watch the network for whatever those apps are doing and reverse engineer whatever remains of the API. You might not be able to build a business on that, but you can build your own apps for yourself, friends and your family that way.

<comment><USER32> Or easier:

If you're an EU citizen, just baksmali the Android App. As long as you don't copy code from their App decompiling is completely legal as per EU law there is no copyright on source code, but only on the implementation.

And for private use the API access will also be allowed.

Though I am not a lawyer, and this topic is still being discussed even in EU courts, so I wouldn't recommend using it for larger projects.

</comment></comment><comment><USER33> I think the list of 3rd party services they are _not_ going to shut down shows a weakness -- without an easy public API to use, it is less likely other such services that extend and add value to the Netflix experience will evolve.

</comment><comment><USER34> 8 projects made that they are now incorporating into the product proper.

These 8 projects were at cost of management of the public API.

If true that more projects of equal caliber will be developed in the future, what is the opportunity cost of maintaining the API? How would you measure this opportunity cost?

Corollary: If Netflix had gone Tesla with the public API, I'm talking a full developer tool marketplace platform- what would be the opportunity risk/reward conversation look like? I'm thinking would be a very valid strategy for cornering the video media marketplace, setting the groundwork to take a bite out of YouTube/Twitch/etc's marketshare.

</comment><comment><USER35> This is the problem with modern web companies:

Protocols, not companies. There should be a Netflix protocol that any business could host. There should be a Twitter protocol so anyone could set up a Twitter server.

<comment><USER36> The protocol is hardly the issue with setting up your own movie-search db - it's data.

I guess Freebase might be a way to go, once you've resolved the initial dataset with wikipedia, update incrimentally with just the changes.

Or, you know, you have to license the material from somewhere.

</comment></comment><comment><USER37> I am glad my site moved away [1] from their API to TMDB. Just in time.

[1] [http://fllix.com](http://fllix.com)

<comment><USER38> FWIW, the link to TMDB on the bottom of your site is broken.

</comment></comment><comment><USER39> Having a public API is about growing new services that can rely on your data.

Imagine if they had never had one, would flixter, etc have popped up?

A public API can save you money in the long run by offsetting the risk/reward of trying new things with the data and diversifying.

</comment><comment><USER40> Does this mean Android apps, like NetQ[1] are essentially done?

[1] [https://play.google.com/store/apps/details?id=com.sporadicso...](https://play.google.com/store/apps/details?id=com.sporadicsoftware.NetQ)

</comment><comment><USER41> Well they're still recruiting for their API team but I guess it is an internal API now: [http://jobs.netflix.com/jobs.php?id=NFX01289](http://jobs.netflix.com/jobs.php?id=NFX01289)

</comment><comment><USER42> Bateflix[1] is noticeably absent from the list of partnered apps.

[1]: [http://bateflix.com/](http://bateflix.com/)

</comment><comment><USER43> Writing was on the wall as soon as they stopped releasing API keys.

</comment><comment><USER44> This probably means abetterqueue.com will be shutting down?

</comment><comment><USER45> moreflicks.com not on that list

</comment><comment><USER46> ugh just harsh - what a slap in the face to all the developers. unilateral crap.

</comment><comment><USER47> This is why I will never create a business based on an API of a third-party. They can take it away at any time..and your business is done.

<comment><USER48> Even if that company's business is providing the API?

<comment><USER49> Of course - they can retire said API and don't extend your contract. Or they can force you to a different API etc etc.

</comment></comment></comment><comment><USER50> I don't know what is the big deal. It's as if these startups were in a Bachelor/Bachelorette style of competition and everybody but a few lost. It's not like the terms and conditions said the API would be there forever or for everybody.

<comment><USER51> People devoted their time and energy to building things that serve to give Netflix free publicity.

</comment></comment><comment><USER52> The real reason they closed the api is because of Bateflix.com

<comment><USER53> It is easier to just pull up porn then watch a movie with some nudity and sex it but otherwise your site is great for porn discovery on Netflix, good job.

</comment></comment><comment><USER54> I'm hoping this isn't going to be an end for instantwatcher.com.

<comment><USER55> Instant Watcher is first on the list of applications that will continue to function.

<comment><USER56> ... for now.</comment></comment></comment>


The Iron Law Of Evaluation And Other Metallic Rules - <AUTHOR> http://www.gwern.net/docs/1987-rossi

<comment><USER2> The Iron Law of Oligarchy [0], Pournelle's Iron Law of Bureaucracy [1], and the Iron Law of Institutions [2] are all closely related. They are essential to understanding how the modern world works and doesn't work and why.

The Iron Law of Wages is how Marx and others described the key consequence of the great Thomas Malthus's Principle of Population. [3]

Google finds various Iron Laws of the Market, Valuation, Prohibition, Finance, Volunteering, and more, but the only ones I hear in regular conversation are the ones I mentioned above. The one from sociological evaluation in OP is interesting to see also.

What Iron Laws are there in your field or conversation?

[0] [http://en.wikipedia.org/wiki/Iron_law_of_oligarchy](http://en.wikipedia.org/wiki/Iron_law_of_oligarchy) [1] [http://www.jerrypournelle.com/reports/jerryp/iron.html](http://www.jerrypournelle.com/reports/jerryp/iron.html) [2] [http://rationalwiki.org/wiki/Iron_law_of_institutions](http://rationalwiki.org/wiki/Iron_law_of_institutions) [3] [http://en.wikipedia.org/wiki/Iron_law_of_wages](http://en.wikipedia.org/wiki/Iron_law_of_wages)

</comment><comment><AUTHOR> Submission prompted by [https://news.ycombinator.com/item?id=9011436](https://news.ycombinator.com/item?id=9011436) and [https://news.ycombinator.com/item?id=8981236](https://news.ycombinator.com/item?id=8981236)

</comment><comment><USER3> _There are no social science equivalents of the Salk vaccine._

Vaccination is the gold standard for effective intervention? There is now a large and growing movement underway to withhold vaccines from children. The parents are no longer afraid of the diseases. The social trumps the biological.

<comment><USER4> gwern mentions a particular vaccine specifically. Polio vaccination brought the common illness to the brink of extinction, and is one of the most successful cases of planetary-scale cooperation ever.</comment></comment>


Inside look at Spotify - <AUTHOR> http://14islands.tumblr.com/post/33885479591/inside-look-at-spotify

<comment><USER2> Hi,

is there any slides of the presentations there so I can learn more about this? I was not able to attend the meeting as I was out of money, but I'm an awarded hacker by Andrew Mager, so this is very important for me. Mager sent me a pair of headphones from the US to me. He said I'm a embassadour and is talented.

Also, did the speakers mention anything about a engine called Spider, from previous speaks I heard about it, and it was used for internal pages in the Spotify client before the introduction of the spotify apps, though it still used by the oldest parts of the spotify client (like artist and playlist pages).

<comment><AUTHOR> Not there I know of but you could follow the event on Meetup to see if they post something: <http://www.meetup.com/Spotify/events/81283222/>

Don't recall any talks about Spider.</comment></comment>


Cloud Provider DigitalOcean Exposes Users' VM Data - <AUTHOR> http://www.wired.com/wiredenterprise/2013/04/digitalocean/

<comment><USER2> Rackspace/Slicehost & VPS.NET were identified for the same issue April 2012 [1]. Cloud providers _MUST_ securely erase customer media upon release, so that this attack cannot happen.

[1] <https://news.ycombinator.com/item?id=3890905>

</comment><comment><USER3> I hope that part of their follow-up to this includes information about not being able to fully trust that non-encrypted data on SSD drives can be 100% wiped. Users of hosting services should not be storing extremely sensitive unencrypted information on any shared hardware.

</comment><comment><USER4> They fixed it: [https://www.digitalocean.com/blog_posts/resolved-lvm-data- is...](https://www.digitalocean.com/blog_posts/resolved-lvm-data-issue)

</comment><comment><USER5> ouch...</comment>


Help MuckRock crowd-FOIA Stingray usage around the country - <AUTHOR> https://www.muckrock.com/news/archives/2014/jun/16/help-foia-how-police-across-country-are-watching-u/

<comment><USER2> I wish you guys the best.

But it does make the whole "USA IS A POLICE STATE!!!1" claims a bit harder to take seriously. I keep trying to imagine East German civil libertarians publically crowd-sourcing requests to the Stasi to divulge the particulars of their surveillance appartus, in ways that don't result in the murder of themselves or their families.

I don't mean this to be snide though, this kind of civil action and distrust of authority is precisely what it means to be an American, and precisely what is needed to ensure that our various police forces don't actually become a modern day Stasi, so keep it up! :)

<comment><AUTHOR> We're not claiming a police state, and certainly not the Stasi. I typically assume good faith on all sides, and I do genuinely believe that the program is being promoted by people with either the best intentions or simply trying to make a buck with easy federal money flowing, no sinister plot for a police state intended.

But it's now pretty well documented that the federal government is currently encouraging, sometimes by force, local agencies to violate their state laws in order to keep secret a widespread federal program that has, at least by one circuit court, been found illegal.

Given past experience, it's probably also incredibly wasteful, and without this you're giving local police that can literally barely operate a thumb drive the surveillance equivalent of a flamethrower, and just hoping nothing goes wrong.

In other words, I don't think we're trying to expose a New World Order so much as a lot of legal and practical problems just waiting to explode.

<comment><USER2> Yes, I should have made it more clear that I was piggybacking on this story to make a more general observation.

As a member of the military myself, the increasing militarization of law enforcement in the U.S. is something that has me concerned, which is why I hope your efforts are successful in identifying (and fixing!) any of the legal and practical problems with new technologies in the hands of untrained police departments.

<comment><USER3> Hey it's not like there's script kiddies out there that like to send over militiarized and bored SWAT teams into unsuspecting houses for no reason at all. Oh, right.

[https://news.vice.com/video/swatting](https://news.vice.com/video/swatting)

Because well-off suburban NJ needs a federally granted armored vehicle for... who knows what.

You and me both are terrified.

</comment></comment></comment></comment><comment><USER4> Very surprised that a search for my local police department and a few terms like 'stingray' or 'cell phone tracking/privacy/tapping/gps' yielded more results than expected along with a state SC case initiated because of the actions taken by our department. Not specific to Stingray usage, but I still filed a request.

I hope this campaign successfully increases the awareness and insight into the fact that this is happening everywhere and has been for close to a decade.

<comment><AUTHOR> Thanks tesq!

</comment></comment><comment><USER5> I was planning to donate but it requires subscribing to Beacon with monthly recurring donations and you get a CD/thumbdrive? I just wanted to throw some one-time cash their way ala kickstarter. I don't really care about subscriptions/CDs.

<comment><AUTHOR> Thanks for the feedback!

That was the template Beacon Reader gave us and how they're set up. We're looking at building out our own donation tools to enable one-time, zero-signup donations, but not quite there yet (we do take PayPal at email@example.com though).

<comment><USER6> I'm under the impression that FOIA does not apply to records at state or local level. Am I wrong?

<comment><AUTHOR> You are correct, but every state has its own equivalent. We handle all 50 states' rules and customize it as appropriate.

<comment><USER7> I'm guessing you're not active there, but maybe you know someone / some outfit that is. I would assume Canadian authorities are also snapping this equipment up.

A while back, I knew someone who played a significant role in helping pass a FOIA-like measure in British Columbia. (I'm no longer in touch with them.)

If various U.S. authorities remain uncooperative, I'm not overly hopeful about Canadian, but maybe?

And while I guess that wouldn't focus on U.S. authorities' _use_ of what is already a fairly well understood technology, I bet a few Canadians would like to know when and how this technology is being used up there.

</comment></comment></comment></comment></comment><comment><USER8> The manufacture and use of Stingray type equipment is clearly in violation of Federal law and is punishable by up to ten years in prison. Two parties conspiring to infringe on a citizens civil rights. Read for yourself.

[http://www.justice.gov/crt/abo..](http://www.justice.gov/crt/abo..).

It is also agains FCC rules with 2 years in prison on $50,000 fine.

Section 705 of the Communications Act

Section 705 of the Communications Act adds to the Federal Wiretap Act additional restrictions on the unauthorized interception of communication "by wire or radio." Specifically, the Act provides

No person not being authorized by the sender shall intercept any radio communication and divulge or publish the existence, contents, substance, purport, effect, or meaning of such intercepted communication to any person. No person not being entitled thereto shall receive or assist in receiving any interstate or foreign communication by radio and use such communication (or any information therein contained) for his own benefit or for the benefit of another not entitled thereto. No person having received any intercepted radio communication or having become acquainted with the contents, substance, purport, effect, or meaning of such communication (or any part thereof) knowing that such communication was intercepted, shall divulge or publish the existence, contents, substance, purport, effect, or meaning of such communication (or any part thereof) or use such communication (or any information therein contained) for his own benefit or for the benefit of another not entitled thereto.Violations of Section 705 carry strict penalties, with willful violations "for purposes of direct or indirect commercial advantage or private financial gain" meriting fines of up to $50,000 and prison for up to two years for the first offense.

</comment><comment><USER9> Pretty neat, and somewhat relevant: [https://github.com/SecUpwN/Android-IMSI- Catcher-Detector](https://github.com/SecUpwN/Android-IMSI-Catcher-Detector)

</comment><comment><USER10> ...huh?

<comment><AUTHOR> If you fill out the form on the page, we'll submit a request to your local police department, asking for policies, invoices, etc. that will detail if and how they're using cell phone scanning technology (including Stingrays), and even what vendors have unsuccessfully pitched them on the technology.

<comment><USER11> Reading this post made it seem like muckrock is more of a ideologically driven site than a neutral data dump. Which is totally OK, but I was thinking maybe it be nice to just to have a place to get data regardless of the topic or how it fits in with a particular set of opinions.

So I'm all for using FOIA to make public data accessible for the greater good, but I'm not sure if what you're doing is the right approach.

<comment><AUTHOR> Anyone can sign up for and file any request through the site, and the request pages are about as neutral as can be ([http://j.mp/UG3TMB](http://j.mp/UG3TMB)). We also publish news, analysis and commentary on select documents, but that's handled fairly separately, so if you just want the raw docs, that's very easy; if you want to better understand why they're important, we try to make that easy, too.

We don't typically take too many ideological stances except that agencies should probably follow the public records laws that they're subject to, which generally isn't too controversial an opinion. We're looking for other ways to allow more analysis and context, but keeping the data clean and easily accessible will always be a part of what we do.

<comment><USER12> You might say that there is an implicit ideology in what kinds of government activities people find interesting or concerning. For example, the _Sacramento Bee_ has made great use of CPRA to find out about things that went wrong in the construction of the new Bay Bridge. Other people are concerned about government surveillance and send a lot of requests to try to expose information about it. Not everyone finds it intuitive that the ability of police to know your cell phone's location is a concern on par with the quality of the welding in the Bay Bridge.

<comment><USER13> I don't drive over the bay bridge. Nobody I know regularly drives over the bay bridge. Nothing I buy is likely to be transported over the bay bridge. I don't even live in the same state as the bay bridge anymore. By and large, the bay bridge just doesn't have any significance to me.

I, like every other person in America, do live within the jurisdiction of a law enforcement agency that may be buying/using this technology.

It seems strange to suggest that an entity must be ideologically driven because it's focusing on something that affects an entire country instead of a distinctly local issue.

<comment><USER12> I guess I meant to compare concerns about the Bay Bridge with concerns over whether SFPD or OPD has IMSI catchers (or drones), rather than over whether any law enforcement agency anywhere has them.

A very significant fraction of public records requests relate to something that the requester is concerned about or objects to or fears is being mishandled in some way. Deciding where to focus one's concerns and questions could be viewed as ideological, or at least ideological concerns help make particular topics more salient and interesting to people.

By way of analogy, take a look at the series of questions that these journalists decide to pose to Victoria Nuland, then spokeswoman for the U.S. Department of State, about the activities of European election observers in Texas during the 2012 elections there:

[http://www.state.gov/r/pa/prs/dpb/2012/10/199824.htm](http://www.state.gov/r/pa/prs/dpb/2012/10/199824.htm)

Obviously journalists have the right to ask Ms. Nuland about anything that interests them, and supporting that right isn't (very) ideological (within the U.S. political context). But it seems pretty clear that the line of questioning that they were pursuing was inspired by a concern or belief that Ms. Nuland herself didn't share: that there was something improper or disturbing about European international institutions observing an election in Texas.

If you share that belief, you might find the questioning pretty natural and obvious and even wish that it had been pursued a bit further and uncovered more information about the relationship between the U.S. and OSCE. If you don't share that belief, you might find the questioning perplexing or annoying, and be bewildered that the journalists didn't accept Ms. Nuland's perfectly reasonable replies.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Your name sounds an awful lot like MuckRack.</comment>


IBM's Role in the Holocaust (2017) - <AUTHOR> https://www.jewishvirtuallibrary.org/ibm-and-quot-death-s-calculator-quot-2 <comment><AUTHOR> > In the concentration camps, IBM's code for Jews was 8. Its code for Gypsies > was 12. General executions were coded as 4, death in the gas chambers as 6.

I was aware that IBM played a role in the Holocaust, but didn't know the extent to which it resembled any regular government software contract today.</comment>


Ask HN: Do sponsored posts on Facebook deliver value?  - <AUTHOR>

I decided to test Facebook sponsorship with a post including my Christmas card. I paid $8.80, which after about two weeks corresponded to 5 likes and 5 user comments (since I just had another unsponsored post with 13 likes I didn't immediately perceive this as value, and wondered if people deliberately didn't like it because they saw it was a sponsored post).
Anyways, about a month later I get message from Facebook claiming to reveal the results. I get the following two pieces of information from them:
"Your post has had 3.3x as many views because you promoted it." and a weird bar graph that shows regular views at "30%" and paid views at "70%" (30% and 70% of what I have no idea).
To conclude, is there any value here? I think the sponsored post discouraged people from liking it early, and I believe that the time in the news feed also correlates to the number of people that like it. Consequently, a post liked by many people will probably be in the news feed for more than 3.3x as long, and get even more views than a sponsored post.
The conclusion would be to only sponsor posts that few people will like. At least that's my logic. Anyone else have a similar experience? <comment><USER2> I reckon it's highly dependent on quality of content and type of audience you gathered on your page. Facebook is presenting your post to users and their friends but it doesn't mean that they have to click like.

 _The conclusion would be to only sponsor posts that few people will like_

I would go in a completely opposite direction in here - sponsor the posts that you know will go viral. It will have a bigger impact and might bring more people to your page.</comment>