Stop donating your customers' data to Google Analytics - <AUTHOR> https://dev.to/goatandsheep/stop-donating-your-customers-data-to-google-analytics-191 <comment><USER2> So the solution is to use Amazon's tracker?

I appreciate the problem and I would like to stop using GA in my static pages as well, but trading one privately-owned software from a tech giant for another privately-owned software from a different tech giant seems a bit ludicrous. I would readily swap GA for some decent open-source solution though.

<comment><USER3> I'd say the following to this (very reasonable) argument against using AWS: AWS makes money by selling services, not collecting data. Should Amazon make the leap and start harvesting data from AWS for marketing purposes, the data from their analytics platform will be the least of our worries.

Thus far, AWS has proven to be safe for companies to host their data upon, and there have been no leaks of data stored in AWS into Amazon's marketing program. The HIPPA, PCI, and FedRamp certifications help back up their claims that a company's AWS data stays in AWS.

<comment><USER4> People said the same about Apple, and then it turned out to be bullshit.[0] And, big surprise, their customers did not seem to hold them accountable.

So in the end, paying for stuff just shows that you're a more valuable product to sell. And gives them a great primary key to track you by.

[0]: [https://news.ycombinator.com/item?id=22106536](https://news.ycombinator.com/item?id=22106536)

<comment><USER3> I've said this to most naysayers, but AWS aims itself at businesses, who are much more forward with their pocketbook and lawyers in protecting their privacy. AWS _can 't_ safely market data stored in their systems without running the risk of being abandoned and sued into oblivion.

Even Google doesn't dare monetize data stored in their enterprise customer's databases.

EDIT: Failing to offer a privacy-enhancing feature, and actively compromising and mining your customers data are quite different scenarios.

<comment><USER5> Google doesn't dare _directly_ monetize data stored in their customer's databases. There's zero doubt in my mind they are piping everything somewhere, completely anonymized, and feeding their models.

</comment></comment></comment></comment></comment><comment><USER6> I see a lot of suggestions for free or open-source analytics packages, but I would refrain from recommending anything you haven't _personally_ used.

I've tried to separate myself from Google in various ways, and one of those was to replace Google Analytics with open source software. I tried several; they're all either non-functional out of the box, or require significant time investment to even start approaching Google Analytics.

After losing about a month of stats (which matters when you're also running AdSense), I ended up going back to Google. It took the same amount of time to set up as when I initially set it up: around 2 minutes of adding the tracking code and uploading it.

<comment><USER7> If you're using AdSense, you're already giving Google your visitor data, no matter what visitor analytics package you use.

<comment><USER8> _If you 're using AdSense, you're already -selling- Google your visitor data, no matter what visitor analytics package you use._

FTFY

</comment></comment></comment><comment><USER9> The headline is wrong, it should be changed to "Stop donating your customers' data to Google Analytics ... donate to another large corporation instead!"

There are much better options out there. Quite apart from the solutions listed in these comments, a better option is to reconsider whether you really need analytics at all. Maybe the answer is yes if you are a business trying to understand your customers. But not every blog and project page needs analytics.

<comment><USER10> Or you could write the 10 lines of JavaScript that'll do what 99% of people use Google analytics for

<comment><USER11> If you think you can replicate that with 10 lines you have no idea what Google Analytics is used for.

<comment><USER12> I'm ashamed to admit that I use GA on my blog to essentially count page views. The other information is interesting but mostly unused (by me). I would be far better served by a tool or service handling server logs (any recommendations?). But GA is 0 friction, so it's what I picked up back in the day. I suspect there are a lot of people in this boat.

<comment><USER13> Many of the common web log analyzers are a bit long in the tooth.

I've have used GoAccess for a while now and is mostly happy with it. It's fast enough and can generate pretty good looking static html which is mostly what you want for those simple use cases.

A side effect of processing log files is that you can freely try software on historical data.

<comment><USER12> Do you have a recommendation on log format for GoAccess? I run a lot of custom services with no nginx etc in front, so I'll have to figure out the logging myself.

<comment><USER14> You can always create an issue on their github page, lots of help in there: [https://github.com/allinurl/goaccess/issues](https://github.com/allinurl/goaccess/issues)

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> A bit tangential but a quick click on the author's name in the article and their bio reads:

> ex-Amazon contractor, front-end lover, accessibility nerd, down for building > cool shit, especially Vue.js and Amplify.js consulting

My alarm bells ring when the answer to "stop using X" is to "start using Y" where Y == company I worked for.

This isn't to say GA is or isn't problematic, but the article's bias is problematic.

</comment><comment><USER16> It would be handy if people listed here all the alternatives that don't steal your customer info.

<comment><USER17> [https://usefathom.com/](https://usefathom.com/)

[https://goaccess.io/](https://goaccess.io/)

[https://github.com/NYPL/google-analytics- proxy](https://github.com/NYPL/google-analytics-proxy)

[http://matomo.org/](http://matomo.org/)

[https://ackee.electerious.com/](https://ackee.electerious.com/)

[https://www.goatcounter.com/](https://www.goatcounter.com/)

[https://count.ly/](https://count.ly/)

<comment><USER18> I gave many of these a visit.

fathom - Looks great. I am OK with closed source products (my motivation is self-hosting/privacy) but the direction is not clear to me. Maybe they will have a blog about it at some point - [https://github.com/usefathom/fathom/issues/268](https://github.com/usefathom/fathom/issues/268). Having multiple code bases is going to be super hard.

goaccess.io - this analyses web logs

google-analytics-proxy - project is dead

matomo - this is what i use now and it works great. has a lot of quirks but if you spend some time, you can make it work.

ackee, goatcounter - simple but looks like this does not track users/sessions. it's mostly for page hits.

countly - looks good if you are enterprise. there is no pricing :(

freshlytics (from another thread) - page says it's in beta and not production ready

<comment><USER19> GoatCounter author here: doing some form of session tracking is on the roadmap; check back in a few months. The project is still quite new, with the first "real" release only being last week :-)

As for Fathom, I find that last "since that people are confused"-comment rather funny, since their messaging on this has been confused for almost a year, haha

<comment><USER18> Will do! I am already following your project :)

</comment></comment></comment></comment></comment><comment><USER20> This seems like more of a promotion for AWS Pinpoint than a criticism of GA.

</comment><comment><USER21> Interesting that the page breaks if you're using Adblock because of Google Analytics being in the URL.

Shows me a fun 'You are not connected to the internet' page that lets you doodle on the page.

<comment><USER22> Not on Firefox with uBlock Origin.

<comment><USER23> I'd check your filters - EasyPrivacy has -google-analytics- blocked in the URL

I got to it by adding the following filter

        @@||dev.to/goatandsheep/stop-donating-your-customers-data-to-google-analytics-191?i=i$xhr,1p

<comment><USER22> EasyPrivacy was enabled.

My Firefox was a minor update earlier than the one on the sibling comment (72.0.1). It has updated now, and the site claims that my connection is down on my machine too.

Now that I have seen the message... It's a funny thing for a web page to claim.

</comment></comment></comment></comment><comment><USER24> The problem is usually competing with "free" and Google knows this, there are privacy respecting alternatives like [https://www.visitor- analytics.io](https://www.visitor-analytics.io) though.

</comment><comment><USER25> > Tracker blockers are increasing in popularity so consumers can protect > themselves against this tracking, reducing the effectiveness of your > analytics.

More to the point: there is probably going to be a bias in the analytics. Different people have different reasons for protecting themselves against tracking, but it is highly unlikely that people who are unaware of or disinterested in the issue will use a blocker.

</comment><comment><USER26> "My competitors tracking solution is ridiculous. You should get your head examined if you use it. You should use mine instead."

Terrible argument.

<comment><USER27> You seems to have missed the arguments made tho. You get to avoid the cookies and as someone else pointed out Amazon doesn't use the data. It's your data.

</comment></comment><comment><USER28> Did not read through, but from a quick look, I suspect anyone can grab the code, and fill in your AWS with terabytes of garbage data which will end up in an enromous amount of dollars in AWS billing.

Am I missing something?

<comment><USER29> Machine learning. How can you say no to machine learning? Did I mention machine learning?

</comment></comment><comment><USER30> Interesting topic. This among others is one of the reasons we started building Harvest. Just as with Google Analytics, you can start tracking data with just a small snippet of Javascript.

We use Splunk as our data engine and you can install it on your own server. This way you have full control, access and ownership of your data without letting third parties get any data. In that sense Harvest is basically the infrastructure that allows you to collect, store, use and visualize your data.

Besides that, we have been focusing on features that will help companies comply with privacy regulations. It is proven that this is not always easy in the complex world of online data.

For more information check [https://harvest.graindata.com/en](https://harvest.graindata.com/en).

</comment><comment><USER31> The suggested Google Analytics implementation today is a collection of three separate Google technologies: the original GA, Doubleclick cookies to track demographics and interest, and Tag Manager to manage them.

The original GA does not give Google useful cross-site user data because it uses only first-party cookies and anonymizes data as it collected it. To my knowledge you can still implement GA this way If you want to. Such an implementation would be GDPR compliant in not tracking any personal data, although your counsel might still say you need to list them as "analytics" cookies in a cookie banner (mine did).

<comment><USER32> Yes, you can configure Google Analytics so that no data is shared with other Google services, at least no data about single visitors. I also came to the conclusion that using GA this way complies with the GDPR and I don't really understand what all the fuzz is about.

<comment><USER33> As someone going through this right now, the main difficulty in being GDPR compliant with GA is the cookie problem.

You can either disable cookies to run GA in cookieless mode [1], which presumably will affect how GA performs, since they can't determine repeat visits (but this might be fine, depending on the type of site you have), or you need to gain active consent to enable analytics cookies [2], which isn't much good if you want metrics for all users, not just those that opt-ed in.

If someone has solved this reasonably, I'd love to hear how! For now it seems like cookieless is my only option.

[1] [https://developers.google.com/analytics/devguides/collection...](https://developers.google.com/analytics/devguides/collection/analyticsjs/cookies- user-id#disabling_cookies) [2] [https://ico.org.uk/for-organisations/guide-to- pecr/cookies-a...](https://ico.org.uk/for-organisations/guide-to-pecr/cookies- and-similar-technologies/)

</comment></comment></comment><comment><USER34> I didn't know about AWS Pinpoint before, but from what I can see, it only offers analytics for email and other messages, not for web pages, so presenting it as a full alternative for Google Analytics is misleading.

<comment><USER35> The article doesn't even seem to mention anything for which GA is nearly indispensable. E-commerce analytics, conversion funnel visualization, customer segmentation, etc.

</comment></comment><comment><USER36> I have fun looking at these stats (sites with Google tracking vs. sites without) in a Firefox addon I made: [https://bitbucket.org/tayler/google- spy/src/master/](https://bitbucket.org/tayler/google-spy/src/master/), [https://addons.mozilla.org/en-US/firefox/addon/googley- eyes/](https://addons.mozilla.org/en-US/firefox/addon/googley-eyes/)

</comment><comment><USER37> While running my first business GA was not really usefull (We used internal tools easier to integrate in the code and adapt to our needs).

However GA data showed its usefullness when selling the business. The data was considered as a _trusted_ source of information for the buyer. And all the definitions (unique user, etc) were aligned with the buyer's, so it was easier for them to assess the metrics.

</comment><comment><USER38> I tried Matomo (Piwik) recently, but I only do log analysis and it doesn't really treat log access as a first class citizen. If you use Javascript tracking, it's probably the right way to go.

I switched back to AWStats for my personal stuff. It's probably too basic for business or company apps, but for your personal stuff without javascript/cookies, it's still a great analytics tool.

</comment><comment><USER39> I have created a simple workflow using AWS Lambda + Kinesis + S3 to track our customers and not to have any 3rd party dependency. It took roughly 2 weeks but it is worth it since do not leak customer data and we have much tighter control over what we collect (no PII except the source ip that gets hashed in the process).

<comment><USER40> > I have created a simple workflow using AWS Lambda + Kinesis + S3 to track > our customers and not to have any 3rd party dependency.

Except for each of the 3 components you listed that make up your system. They _are_ 3rd party dependencies,

<comment><USER41> Everything is a 3rd party dependency then. The only way to not have a 3rd party dependency is to build your own infrastructure and use open source solutions (and even with OS you're still dependent).

I think OP was clearly referring to a self-managed solution as opposed to a set of 3rd party services like GA, Segment, etc, where the flow of data is out for your control.

</comment></comment></comment><comment><USER34> [http://archive.is/RAXU6](http://archive.is/RAXU6)

</comment><comment><USER42> Why not spin your own? This tool comes with a lot of tools out of the box and can also run personalization techniques and more: [https://harvest.graindata.com/en/store](https://harvest.graindata.com/en/store)

</comment><comment><USER43> a few weeks ago my blood needed a checkup. They sent me the results by mail. The results where on a non password protected but 'unguessable' url. And the page ofcourse contained google analytics, I'm in the EU, I wonder if this is legal

<comment><USER44> If they haven't notified you, and hence you can't/didn't comply, it probably isn't. Especially medical companies are scrutinized for following gdpr. You could make a case here to either the companies privacy officer, or your countries privacy watchdog.

[https://gdpr-info.eu/art-39-gdpr/](https://gdpr-info.eu/art-39-gdpr/)

</comment></comment><comment><USER45> You really have 2 choices:

Are you relying _only_ on data you can get from your app? There is no reason not to build your own solution.

Are you relying on data you can't get from your app/website? Then you can only use GA, since FB does not have a service like this.

</comment><comment><USER46> The main issue is that competition is basically cut out due to the free pricing of GA.

Very few businesses/people would choose to pay for something when GA is free. Why do that? To tell your customers "we value your privacy"?

<comment><USER47> Don't you think that, in today's climate, customer knowledge and involvement about online tracking, fingerprinting, filter bubbles etc. is at an all time high? And that makes this the best time ever to indeed be proud to tell your customers that "we value your privacy".

It's one of Apple's strongest marketing pillars.

</comment></comment><comment><USER48> Related: the discussion about Goatcounter [https://news.ycombinator.com/item?id=22044854](https://news.ycombinator.com/item?id=22044854)

</comment><comment><USER49> I'm currently building a _free_ analytics service that's the fastest. Ever. Faster than Fathom, Simple Analaytics, pretty much everything except Google Analytics you can think of.

[https://sdan.io/pingpong](https://sdan.io/pingpong)

Still building it, but you can sign up for when it launches here: [https://forms.gle/MhojBWWfdiWjZatC7](https://forms.gle/MhojBWWfdiWjZatC7) (I know it's ironically on google forms and I'll move away soon)

> [https://sdan.io/pingpong](https://sdan.io/pingpong)

<comment><USER50> > I'm currently building a free analytics service that's the fastest. Ever.

How do you intend to make money from this free service?

<comment><USER49> If you're getting over a million hits I might add some incentive to donate, but mainly I take this as my payback to the developer community. I'm launching another product in a different domain at the moment and hoping that can compensate.

At the end of the day, if anything goes wrong, I'll always be happy to open source the whole thing.

</comment></comment></comment><comment><USER51> I have used simpleanalytics for a while. It offers a lot less granular information because it deliberately collects less for privacy reasons

</comment><comment><USER52> The problem is GA is orders of magnitude better than the competition for price to performance ratio.

</comment><comment><USER53> Is there a free alternative that has feature parity with GA and isn't very difficult to set up?

</comment><comment><USER54> Yeah right, stop using GA and start using Amazon analytics. Very good suggestion.

</comment><comment><USER55> And firebase analytics is much the same as GA right? In fact I think it's even viewed on the GA portal.

<comment><USER56> Connecting Firebase to Google Analytics is optional, for now.

</comment></comment><comment><USER57> > And if you think that's okay, you should take your head out of the sand > because consumers are demanding it. Please tell me how many of your users > like the large cookie agreement popups that they have to dismiss...I-I mean > read and accept just to consume your content. Agreements that you're forced > to have them agree to because you're using cookie-based trackers like GA.

I think that's the heart of why I so despise the GDPR. In an intent to change site behavior, politicians passed a law putting a burden on sites that did an undesirable thing (rather than, say, making the undesirable thing itself illegal).

Perhaps they thought sites would avoid the burden.

Did they not anticipate full shifting of burden onto end-users? Because being able to know how a site is used is _extremely_ valuable to the site's owners.

</comment><comment><USER58> Anybody ever heard of server logs?</comment>


Seven Languages In Seven Weeks: Week 1 (Ruby) - Day 3  - <AUTHOR> http://nickknowlson.com/blog/2011/12/15/seven-languages-week-1-day-3/

<comment><AUTHOR> I didn't manage to find much to write about for Day 1 and Day 2 of Ruby, but I think Day 3 has enough to give it a chance of being interesting to a larger audience.

I hope you enjoy the read!</comment>


Make Docker Compose easier to use with app packages - <AUTHOR> https://github.com/docker/app <comment><USER2> Seems interesting. Abstraction over abstraction over abstraction.</comment>


Apple patented a way to keep people from filming at concerts and movie theaters - <AUTHOR> http://qz.com/718939/apple-patented-a-way-to-keep-people-from-filming-at-concerts-and-movie-theaters-on-their-phones/ <comment><USER2> Infrared cut-off filter to the rescue: [https://en.wikipedia.org/wiki/Infrared_cut- off_filter](https://en.wikipedia.org/wiki/Infrared_cut-off_filter)

</comment><comment><USER3> Discussion of news: [https://news.ycombinator.com/item?id=12000574](https://news.ycombinator.com/item?id=12000574)</comment>


A Hot $100M Home Design Startup Collapsed Overnight - <AUTHOR> https://marker.medium.com/how-homepolishs-extremely-instagrammable-house-of-cards-came-tumbling-down-d7a7d1780ddc <comment><USER2> Several new companies I've worked with have folded recently after being unable to raise their next or initial round.

Seems like risk appetite has shifted: [https://www.bloomberg.com/graphics/startup- barometer/](https://www.bloomberg.com/graphics/startup-barometer/)

</comment><comment><USER3> [https://outline.com/UmMMqp](https://outline.com/UmMMqp)</comment>


Zero Knowledge Proofs: An illustrated primer (2014) - <AUTHOR> https://blog.cryptographyengineering.com/2014/11/27/zero-knowledge-proofs-illustrated-primer/ <comment><USER2> Thanks for posting this!

Are all ZKP probabilistic in nature?

Anyway, now I need to figure out a protocol that can be done manually and in a reasonable timeframe for a following problem: there is a group of good and evil people. There's no more evil people than good people in this group. Evil people know each other, and only one good person knows who everyone is; the rest of the good people don't know who is in which group. How can that one good person pass their knowledge to everyone without revealing their own identity? Also, the protocol must resist the evil people trying to disrupt it.

Yes, I'm trying to stop people playing Avalon in my office in a very over-the- top, ultimately nerdy way - by literally providing a winning strategy and calling it GG.

[https://en.wikipedia.org/wiki/The_Resistance_(game)#Avalon_v...](https://en.wikipedia.org/wiki/The_Resistance_\(game\)#Avalon_variant)

<comment><USER3> > Are all ZKP probabilistic in nature?

Yes, but in some cases the probability is too small to consider.

For example, take digital signatures. These are in effect a proof that the person claiming to have signed it is in fact the holder of the private key behind them, without revealing the private key. But it is possible for someone to accidentally generate a valid signature without having the private key. Extremely unlikely. But possible.

\-----

The problem you pose is interesting because most ZKPs involve a prover and a verifier. Here, there are many separate verifier entities each with different information that need to be convinced.

What kind of communication is allowed?

<comment><USER2> > _Yes, but in some cases the probability is too small to consider._

Thanks!

> _What kind of communication is allowed?_

Any kind. People are free to say whatever, whenever - the question is, whether or not you believe them.

In the game, each person takes a turn to select a 'squad' for a 'mission'. Then, everyone votes whether or not to accept the squad, and if the squad is accepted, it goes on a mission. The mission consists of the entire squad voting in secret whether the mission is a "failure" or a "success". Good people can vote only "success", evil can vote either "success" or "failure". The votes are tallied (without revealing who voted which way), and if there's one or more failures, the mission fails. The good team wins the game if 3 missions end with success, the evil team wins if 3 missions end with failure (or if the general vote fails to accept the squad five times in a row). The twist is, if good team wins, evil team has one last chance to guess which of the good players was "Merlin", i.e. one who knows who is in which team. If they guess correctly, the evil team wins.

The game consists mostly of the good players trying to guess who is good (to avoid taking evil players on missions), and the evil players trying to confuse everyone. Merlin, who knows who is good and who is evil, can't be too obvious about revealing his/her knowledge, lest he/she gets sniped at the end.

So my question is - how can Merlin pass his knowledge about the composition of two teams to everyone without revealing his/her own identity? We can assume that whatever protocol there is, at least half of the players (i.e. the good team) will be willing to follow it, and the rest might want to disrupt it or maliciously insert false information.

I've been thinking about it for quite a while, but I don't have much experience or knowledge of the area, so any pointers would be appreciated.

<comment><USER3> You can upgrade the system to have private communication with a public-private key system. I thought about ways to make it work otherwise and I can't come up with any. I don't think that regular zkp techniques will work here. Interesting problem though.

</comment></comment></comment></comment><comment><USER4> There's a lot of security applications for zero knowledge proofs that go beyond just cryptography. Nuclear Weapons verification using ZKP has been getting quite popular

[http://lnsp.mit.edu/zero-knowledge-warhead- verification/](http://lnsp.mit.edu/zero-knowledge-warhead-verification/)

<comment><USER5> > By comparing the hash values for a real and test warhead, one can confirm if > the test warhead is a match or not.

But if only the weapon owner knows what is in the "real" warhead, couldn't he simply submit a dummy as his "real" one, and then offer up a load of dummy warheads for test?

<comment><USER4> Yes, authenticating a first one is required. However, if this bothers you, consider what we do currently on verifying nuclear warheads -- nothing.

</comment></comment></comment><comment><USER6> I am quite relieved to find out that there's a protocol that uses zero- knowledge proofs to do password authentication. In a cryptography class I took, the teacher asked the question "What can we use zero-knowledge proofs for?". My suggestion was "to communicate passwords over an insecure network", but he shot it down with "Ehm no, hashes are for that.". Kept me confused for a long time. I guess the protocol is just a little obscure.

In retrospect, maybe I should have known better, as the same teacher did not understand why some students would question the accurateness of the statement "this data is random because it satisfies Golomb's postulates".

<comment><USER7> Some of the new ZK PAKE[0] schemes are very cool and would prevent phishing attacks. You only share your password with a party which proves in ZK that it already knows your password. Kinda surprised someone hasn't built a startup around it: "Make your enterprise immune to phishing with our expensive auth appliance".

I really want Chrome to roll it out as some sort of browser mediated authentication scheme.

[0]: [https://en.wikipedia.org/wiki/Password- authenticated_key_agr...](https://en.wikipedia.org/wiki/Password- authenticated_key_agreement)

<comment><USER8> Unfortunately phishing is a social problem, not a technical one. Users will happily put their password into any random webpage which tells them they really really need to, regardless of how much you train them only to put it into a specific application.

<comment><USER7> It is trivial to make a phishing login where the login page that looks exactly like the legitimate login page. Of course under such conditions training will fail. The rules of the game are such that no amount of training is going users not make mistakes here.

Consider instead that passwords are only entered into some special and distinct OS controlled textbox* that webpages are prevented from mimicking (or even a physical device). This is a far easier training target (only enter passwords into boxes that look like X).

* The software behind this textbox ensures that the site knows the password before asking the user for the password.

<comment><USER8> > Consider instead that passwords are only entered into some special and > distinct OS controlled textbox

No, I understood this already. This is the easy technological solution which doesn't actually solve the real problem: some users (or really all users some of the time) will always be willing to enter their password into some other box which looks nothing like the one that webpages are prevented from mimicking.

Hell, I did it myself today: I entered my work password into an intranet site which was showing a "certificate error", even though in past experience this site had valid certs. Could that have actually been someone who broke into the intranet and set up a honeypot? Absolutely. But I needed the resource that was behind that password box in order to do my job, so I entered my password anyways.

<comment><USER7> >some users (or really all users some of the time) will always be willing to enter their password into some other box which looks nothing like the one that webpages are prevented from mimicking.

Phishing sites mimick real user sites because that greatly increases the success rate. You can always find someone who will do something, the important question is how often.

I don't think we should just throw up our hands and say user problem are unsolvable with technology. Good UX solves user problems, compare an AppleII to a iPad.

We have two problems: 1. it is easy to mimic password prompts, 2. it is hard for computers to tell who is legitimate and should be sent the password. This solution solves both.

<comment><USER7> You could be right, I could be right, only way to know for sure is to build it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> For a mathematical background we are editing this soon to be published doc about zk-SNARKS: [https://drive.google.com/file/d/0B57LWnAurZr_OGhVOENnbHRoaGM...](https://drive.google.com/file/d/0B57LWnAurZr_OGhVOENnbHRoaGM/view?usp=sharing)

<comment><USER10> Does CoinFabrik (the startup you are at) use zero knowledge proofs in any form?

<comment><USER9> Some of our work is related to integrating apps with zcash.

</comment></comment></comment><comment><USER11> I google bumped into this article a few months ago when I was trying to understand Zero Knowledge, so it was quite surprising (in a good way) to see this come up in HN today. Thanks.

Took me a while to understand the point of the time machine/simulation and verifier, which in a roundabout (to me!) way led to the conclusion that only the verifier could verify the ZKP and yet not leak information to others.

If anybody has an even-clearer explanation, I'm all ears!

</comment><comment><USER6> I would argue that zero-knowledgeness is a property that (from an information theory perspective) can only be approximated. It is not possible to have a technique based on information theory that works like the example with the hats; you always give a tiny bit of information about the solution (this information is the hash in the commitment scheme), and this is kind of interesting.

<comment><USER3> Well, yes, but as long as you use a nonce and sufficiently large hash you can make the probability of brute forcing the hash arbitrarily close to zero. So it works well enough :)

</comment></comment><comment><USER12> The non-interactive version of this is still a mystery to me. I'd love to see a simplified explanation of that if it exists.

<comment><USER3> I wrote about the general ZKP in a post here: [http://manishearth.github.io/blog/2016/03/05/exploring- zero-...](http://manishearth.github.io/blog/2016/03/05/exploring-zero- knowledge-proofs/) . It covers the graph coloring ZKP without requiring physical presence.

(I'm not sure what you mean by non-interactive -- is it the one with the hashes? "interactive" in a ZKP is a process with a back-and-forth. I guess you mean the ZKP that doesn't need physical presence? Regardless, I explain that a bit in that blog post.)

<comment><USER12> For instance a zkSNARK as used in ZCash. It's just a piece of data that's put there on the blockchain. It's "non-interacrive" (a term I heard, not one I made up) in that no challenges are made on it by those verifying transactions. It just encapsulates the necessary evidence all on its own. Even though I roughly understand the interactive sort of zkp, this still blows my mind.

Thanks for the link, I'll check it out.

</comment></comment></comment><comment><USER6> "In the next post I'll talk about some of those — specifically, the efficient proofs that we use for various useful statements. I'll give some examples (from real applications) where these things have been used. Also at reader request: I'll also talk about why I dislike SRP so much."

Did he ever write this? I can't find it.

</comment><comment><USER13> He should change "Next they fill in the graph with a valid solution, but using the new random ordering of the three colors" to "... with _the same_ valid solution, but using the new random ordering of the three colors."

<comment><USER14> Suppose Prover has multiple (>1) valid solutions to the problem. What changes if the Prover not only picks representation at random, but also pick a solution at random each round?

To me it looks that at least in this case entirely different solution and different representations are permutations of the solution, therefore both are allowed?

<comment><USER13> Sure, it's allowed, and makes sense in this particular example. But someone reading this might think that the scheme depends on using a random coloring in the second round, which is precisely not the case.

In ZKP, usually the claim is "I have constructed this 3-colorable graph, and I wish to prove to you that it is 3-colorable without giving you any info about the coloring", and I only know the one colorability that I constructed the graph with (so the narrative given about Google calculating a coloring for you isn't the best analogy to begin with).

Or, "Here's a number that's a product of two big primes, a fact which I will prove to you without giving you a hint on what the primes are," in which there is obviously only one solution.

</comment></comment></comment><comment><USER15> Question about the hat example given:

The author says that the phone company wouldn't learn anything about google's solution by keeping notes because of the randomization of the coloring. that doesn't seem to be true to me.

Assuming the solution that Google colored in was correct, the phone company doesn't necessarily need to know the frequencies of the edges, merely that they are different: which _is_ learned by recording the results after E^2 selections.

Am I wrong here?

<comment><USER3> These are always adjacent nodes being compared. Assuming the solution is correct, adjacent nodes will always have a different color.

So the most information that can leak is the correctness of the solution. Which is exactly what we need.

</comment></comment><comment><USER16> The proof of zero-knowledgeness using the time machine still doesn't make sense to me.

What if the Verifier says, "the information extracted will only be deemed 'useful' if I can be satisfied with a reasonable certainty that google has indeed found a solution."

In other words... yeah we could trick my Verifier with a time machine but forget all of the information extracted on a cheat run. Can we indeed not gather information only from the successful runs?

<comment><USER3> I think the time machine example is circular logic. Consider a scheme where you uncover three adjacent nodes instead of two. We know that this _does_ leak information, since it will tell you whether or not two nonadjacent nodes share a color.

Applying the time machine to this, you can't fake having the solution with a time machine because after many runs the verifier will know which nodes share colors, and will find an inconsistency (unless you had the correct solution after all).

In effect, the time machine doesn't work because you cannot simulate a given run of the process without leaking the same information that a correct solution would leak unless you actually know a correct solution.

\-----

It's pretty easy to determine that the regular two-node scheme doesn't leak data. In each run, the verifier is just given the information that the colors of two adjacent nodes differs. Assuming a correct solution, this isn't new information. Because of the permutation the actual colors don't matter and can't be correlated between runs. So the only information that "leaks" is the fact that the coloring is in fact valid, which is all we wanted.

</comment></comment><comment><USER17> "How to explain Zero Knowledge Protocols to your children": [http://pages.cs.wisc.edu/~mkowalcz/628.pdf](http://pages.cs.wisc.edu/~mkowalcz/628.pdf)

</comment><comment><USER18> Anyone have a link to part two?

<comment><USER19> Since there are no new posts in the [category 'fundamentals'][1], I assume that there is no part two yet.

[1]: [https://blog.cryptographyengineering.com/category/fundamenta...](https://blog.cryptographyengineering.com/category/fundamentals/)</comment></comment>


Honk more, wait more: Mumbai traffic police introduce the 'punishing signal' - <AUTHOR> https://weather.com/en-IN/india/news/news/2020-02-01-honk-more-wait-more-mumbai-traffic-police-punishing-signal <comment><USER3> Honking is very uncommon in Sweden, and I remember my driving instructor pointing out to me that the only time you ever use it is to call attention to avoid an immediate accident. In practice, I see many drivers not even doing this. I routinely see people jaywalking in urban environments and cars just stopping until they've crossed.

One thing that might be semi related to this is the entitlement of drivers. My view of Sweden is that most people accept that cities "belong" to pedestrians first hand, and cars need to be careful. In other parts of the world, the "get out of my way" entitlement of drivers is very apparent and I don't think it's very helpful.

<comment><USER4> In Germany if you don't start accelerating when the light turns yellow, the guy behind you will start honking.

<comment><USER5> > In Germany if you don't start accelerating when the light turns yellow, the > guy behind you will start honking.

Don't generalize. Usually, you have some seconds until the driver behind you will honk. I normally count "21 - 22 - 23", then I honk if there hasn't been any reaction (restarting the engine, pressing the brake pedal, etc.). But your mileage my vary.

<comment><USER4> Maybe it's area dependant, in my city they definitely honk in under a second.

</comment></comment></comment></comment><comment><USER6> I once worked on a QA system for a car manufacturer. The idea was to data mine for commonly ocurring problems and then support a workflow to do root cause analysis and organize a fix in order to reduce warranty expenses.

One problem that had been identified was "Cars of this model produced in this factory have the horn fail very often within the warranty period".

The root cause analysis was: "This factory produces for the Indian market. The horn is designed for 50k activation cycles. Due to the higher use intensity in India, this is not sufficient."

They were still debating whether to install a more sturdy horn only in cars delivered to India or everywhere.

<comment><USER7> Was it German manufacturer? We experieneced lots of Skoda (basically anything of VW group) horn failures in India!

<comment><USER8> I'm pretty sure pretty much every low/mid range car in India has a custom fit horn that is loud more or less to a train.

</comment></comment></comment><comment><USER9> The honking situation in India genuinely fascinates me (apart from driving me insane). If someone's not experienced it, you won't know what we're talking about. Comparing it to France / other places won't do justice. I compare it to Bats using sonar echo to move while being almost blind (I know this analogy doesn't hold exactly but you know what I mean?).

I have seen bikes in smaller town hoking continuously down a straight empty road - probably because they want to announce they're coming and letting kids / other people know they're coming and you better look out (not to annoy you but out of genuine concern for YOU).

Bigger cities have the same problem amplified. Everyone letting everyone else know that they're around, watch out.

I've lived in other crowded cities in developing nations like Nairobi - it has the same traffic problems but not a single car honking! The entire town stuck in traffic and complete silence! So it is possible, I just don't understand what gave Indian drivers the idea that this helps in their driving.

<comment><USER10> The safety part does have something to do with it. But more often the horn is used as a stress ball, as if pressing it will somehow get traffic moving faster. There's also this category of bikers who want to speed on empty roads looking all "heroic" who honk away without a care in the world.

<comment><USER11> I am from Bangalore, and in 2012, I tried an experiment in an auto-rickshaw (tuk-tuk). I offered to pay the driver double the meter price if he didn't honk even once during an upcoming 1 hour-ish ride.

The driver thought I was nuts to offer him this obviously easy money, and accepted it. I told him up front that the first honk, and the extra money was off the table. He said - ok - and we started the ride. The first few kilometers were pleasant, and the driver was cool with it - but as we entered the business district with more traffic, he became more and more frustrated and started to hum and sing to take it out a bit. Then, he kind of started "barking" (for the lack of a better word) at other drivers who irritated him. He then resorted to outright shouting at the drivers. Eventually, something snapped and he honked once. I told him the deal was off, and the rest of my trip was a veritable honk-hell.

I have always believed the stress ball theory after this one-off experiment.

<comment><USER12> Recently shifted to Bangalore, will try this out !! Haha

</comment></comment></comment></comment><comment><USER13> Incessant honking is just another form of mass of mass ignorance.

Whether it is spitting, throwing cigarette butts, stealing any small thing that isn't locked down, or honking, the end result is that everyone's quality of life decreased - even the people doing the bad thing.

The ignorance is that anyone who took just a moment to think through the situation would realize that such actions do not help. But for some reason, large numbers of humans default to low level mental functioning whereby they spend most of their lives operating without rational thought.

<comment><USER14> It's like the tragedy of the commons:

I honk -> I arrive faster

We all honk -> We all arrive slower

How to change these problem behaviors en masse is still an open problem, as far as I know. The approach taken in the link by the Mumbai police, of introducing a negative feedback mechanism for the behavior, is a psychologically sound approach.

</comment></comment><comment><USER15> NYC tried for over 30 years, and failed, to use signs to get people to stop honking. Unnecessary honking will still get you a $350 fine, though.

[https://www.npr.org/2013/02/12/171837301/new-york-city- ends-...](https://www.npr.org/2013/02/12/171837301/new-york-city-ends-30-year- experiment-with-dont-honk-signs)

[https://www.silive.com/news/2017/08/350_fine_for_improper_ho...](https://www.silive.com/news/2017/08/350_fine_for_improper_honking.html)

<comment><USER16> Signs aren't sufficient. It needs to be enforced and it isn't. These tickets are never given out and everyone knows it.

</comment></comment><comment><USER17> There's an easy solution to this: the horn should be as loud inside the car as it is outside the car.

<comment><USER18> As someone who walks 99% of the time this is something I have said on numerous occasions. When someone honks at me when I am legally crossing the street with a walk signal the car horn should be just as loud for you as it is for me.

</comment></comment><comment> green-bottle I feel this is a problem in the majority of Indian cities. Perhaps Mumbai stands out here as it has more Traffic hence greater levels of unnecessary honking.

Having worked at Bangalore and Hyderabad, living along/nearby any road with regular traffic lead to poor sleep quality due to sound pollution from senseless honking. Poorly enforced regulations regarding the hours when construction is allowed don't help either.

<comment><USER19> Add the temple loudspeakers to the list. Also, public defecation and rampant littering. S. Asia has a poor regard for public spaces.

<comment><USER20> For me the worst impact on sleep came from warring packs of stray dogs.

<comment><USER19> That never frustrated me as much. Somehow I find the actions of animals more excusable than the rationalizations provided for man made noise pollution.

<comment><USER21> Tolerating packs of stray fogs is the actions (or perhaps inaction) of men, only manifest as dogs.

</comment></comment></comment></comment></comment><comment><USER22> I strongly believe the nature of a society is best visualized through its traffic sense. Whether it's showing empathy, collaborating, cooperating, patience, discipline, following rules, the anything-will-do attitude, etc.

I'm expecting the sabotaging nature will have a ton of people consciously going out of the way to screw up everyone else.

<comment><USER23> That's not what I found at all. Traffic is chaotic, but people in general are very cooperative. The cooperation just happens in an ad-hoc way rather than by traffic rules. Yes, there is a lack of discipline, but I don't think any society will behave differently if you put that many people in that small of a space.

<comment><USER24> Umm, Both Japan and HK have a lot of people in a small space and have 1/100th of the absolute utter mindless chaos that prevails on the roads in Delhi/Mumbai.

<comment><USER23> Agree with that, and that is interesting. Replied below to a similar comment. You also have to consider that infrastructure is far less developed in Mumbai, though.

<comment><USER25> > You also have to consider that infrastructure is far less developed in > Mumbai

That is not true atleast in Mumbai, the traffic signals work but lot of drivers dont follow the signal because no one is going to catch them, if they dont obey the lights, if they see a traffic cop most drivers will obey the lights.

<comment><USER21> Does enforcement count as infrastructure? As discussed, laws/signs without enforcement do little. Is seeing police that rare that everyone would risk it? Accountibility is foremost before progress.

</comment></comment></comment></comment></comment></comment><comment><USER26> This is great in idea but do seems like a gimmick. Do you honestly believe everyone on that road can read your sign posted in English ? I can judge this because I am from Bombay. After few min, crowd will just ignore the traffic light and take off. I really hope this works though ! Its insane how bay the noise pollution is.

<comment><USER27> No, but I assume most can read the numbers? People are good at seeing patterns.

The countdown timers seem well-established so people know what they are.

The decibel meter is probably something people will figure out quickly (number goes up when noise goes up).

The reset is something people will definitely figure out quickly - <USER2> number goes over 85, countdown resets.

Are there no fines for ignoring traffic lights? Since this is deployed to only a few traffic lights, seems like handing out a bunch of fines to everyone ignoring the light once or twice should be enough for a sufficient number of drivers to stop ignoring it.

</comment></comment><comment><USER28> Why India loves honking

[https://www.atlasobscura.com/articles/the-origins-of-horn- ok...](https://www.atlasobscura.com/articles/the-origins-of-horn-ok-please- indias-most-ubiquitous-phrase)

<comment><USER29> That still doesn't explain why they honk at red lights when no overtaking is going on.

<comment><USER30> Because with enough honking, they can get the crowd to ignore the traffic light and start to inch forward anyway.

<comment><USER31> If the lights start spending 2x longer often, surely that will push people to defy the light itself more than they did before.

Using group punishment to curb individual behaviour is always at risk of undermining group obedience.

I wonder what variables affect most whether the policy will be successful or detrimental.

<comment><USER32> If they're already so frustrated, some powerful force must be preventing them running red lights. That force is obviously very strong so it probably works on double-frustration pushiness too.

</comment></comment></comment></comment></comment><comment><USER33> But wait!

I doubt that their "decibel meters" are very directional. So perhaps drivers that currently have the green could honk more, and so force the signal to skip a cycle.

<comment><USER34> Alternatively, only prolong the red, but allow the green to proceed to yellow at the normal pace. (But then there's no cross-cutting traffic to keep people at the red in place...)

<comment><USER33> Right, give everyone red, until the noise level drops below some threshold.

But then, people with loud horns could shut down traffic.

<comment><USER35> And screw themselves in the process... not a net gain unless someone's wanting to share a bad day, I suppose.

<comment><USER33> Well, some American kids I know would do it for the lulz.

</comment></comment></comment></comment></comment><comment><USER36> We have the same thing in France but to prevent speeding when a light is about to go red.

On some lights, there's a speed sensor, if a car exceeds the speed limit, it instantly goes from green to yellow then red.

<comment><USER37> That...sounds dangerous.

<comment><USER38> I presume the red is unilateral, meaning they don't (immediately) change the other side to green in response.

<comment><USER39> Even still, much like in India where drivers will learn to ignore the the punishing light, it could be drivers in France will learn that running reds does not increase a chance of collision because it's only a signal of speed.

<comment><USER27> It only has to increase the chance of getting a really expensive ticket and points on your license to discourage that.

<comment><USER39> When a light turns yellow, a driver has to make a very quick calculus of a number of factors, including estimating stopping duration and distance, traffic presence, penalties, even judgement from other drivers. Some people will place more weight on one or another of those factors. If there is any significant portion of the population that places weight on "this isn't a real red light; it is only meant as a nagging signal" then it seems that the chances of a miscalculation (and high-speed collision) become greater overall.

<comment><USER27> The obvious solution would be to combine each nagging signal with a red-light camera, at which point it becomes very "real".

</comment></comment></comment></comment></comment></comment></comment><comment><USER40> They need better signage that explains the concept, looks like a lot of people were just confused. Perhaps a sign in local language.

Also, wouldn't this cause issues with the general flow of the traffic? One delay and you have cascading effects that perturbe macroscopic traffic patterns at the city level.

This type of punishment would be detrimental in well coordinated traffic (probably not Mumbai): Study of traffic is an entire field in scientific research, [https://en.wikipedia.org/wiki/Traffic_simulation](https://en.wikipedia.org/wiki/Traffic_simulation)

<comment><USER41> It's mostly a one-off exercise (to teach people a lesson), they most probably don't plan to continue doing it.

</comment></comment><comment><USER42> I think it's because of the cows! In India, the cows roam around freely, and if you have ever been on the road with a cow in front of you, it does not give a shit and will basically just stand there, eventually move when it feels like it. The obvious action to alert something/someone hindering you is to use the horn, "you are in my way", but that does not work for cows that well.

Over time, this weird culture developed of honking. Often honking in reply to each other, like a rhythm almost.

</comment><comment><USER43> Was initially thinking this would be easy to troll, but then there's good old fashioned mob justice.

<comment><USER44> Maybe there'll be an uptick in the number of handheld air horns sold... eg. A pedestrian sees the lights about to change NOT in their favour: honk, and then they've got time to cross.

See also: Cobra Effect

[https://en.wikipedia.org/wiki/Cobra_effect](https://en.wikipedia.org/wiki/Cobra_effect)

<comment><USER45> From the video it seems that there need to be many cars honking together for the threshold to be passed. A single pedestrian would probably not be able to trigger it.

</comment></comment></comment><comment><USER46> Nice idea, but honestly, horns do not even come into the top 10 problems for most people. You have terrible roads and public transportation, corrupt government-commercial nexuses and whatnot; is this seriously the most important thing for you to focus on?

</comment><comment><USER47> It is an interesting idea.

I wonder if they just said it was happening, without actually changing anything, if properly advertised would it have an impact?

<comment><USER48> Many traffic lights in India have a visible countdown timer. You see it counting to zero... or in this case resetting to 120 or whatever.

It looks like this: [https://i.imgur.com/MynJKCl.jpg](https://i.imgur.com/MynJKCl.jpg)

<comment><USER47> Ah, thank you.

</comment></comment></comment><comment><USER49> This seems like a great way to train people to ignore red lights. When the lights just stay red people are going to just inch out until they block the other traffic and then start going. Formerly traffic light controlled intersections are going to turn into effectivly uncontrolled intersections with the resulting decrease in throughput.

</comment><comment><USER50> Chongqing just wound up banning horns in cars altogether, but that only works in authoritarian contexts.

<comment><USER51> my first thought when reading the article was to simply suggest something softer like a geometric delay on honking. First honk 10 seconds wait time, if you honk to quickly push the delay up. With software nowadays finding some strategy to punish serial honkers shouldn't be too difficult.

I don't think it requires an authoritarian state either, this would be pretty normal regulation in any country.

</comment></comment><comment><USER52> I've often wondered how often honking is actually useful, e.g. for preventing an accident, versus just something to vent frustration. It seems some people instinctively reach for the horn before the brakes.

<comment><USER37> In India honking is used for signalling that we are coming etc. Many times it's just about saying you do what you are doing, I am overtaking you so don't move.

<comment><USER53> This is common in many parts of the world.

</comment></comment></comment><comment><USER54> From my experience, Chennai had it 10x worse than Mumbai. Almost every truck had "Honk please" hand drawn in various styles on their rears.

</comment><comment><USER55> Some countries have a different kind of punishment signal. Instead of being connected to a camera and a fine system, the speed radar is linked to a red light a few hundred yards later.

You can drive at the signed speed, or you can drive over the speed limit and wait for longer at the red. It's your choice.

<comment><USER56> So, collectively punish everyone on the road (in front of you) because you crossed the limit instead of punishing you, the culprit, alone? That sounds very weird as a punishment.

</comment></comment><comment><USER57> Whoever honks (in any country) without a legitimate need (to prevent an emergency) should be fined severely or get his driving license postponed. Even is somebody violates the rules, you should not honk unless you sincerely believe an accident is going to happen if you don't honk.

</comment><comment><USER58> Honking in India is not the same as honking in your country. It has a different meaning.

</comment><comment><USER59> Tragedy of the commons. It only takes 1 person honking to delay everybody.

<comment><USER60> Not sure that applies here since one person honking won't gain them any advantage. Very possibly a tragedy of some other sort.

<comment><USER29> Yep. "Tragedy of the commons" specifically refers to when the individuals incentives are different from the collectives incentives.

This case would just be trolling. You gain nothing other than the fun of upsetting others.

<comment><USER61> As a pedestrian individual with an air horn you gain access to the road.

<comment><USER29> Only if you are close to the road while it is currently running in the direction you want. Seems like a difficult thing to abuse.

<comment><USER62> Doesn't it incentivize honking when the light is green for you?

<comment><USER63> They're already hongking all the time. If they're now only honk during green light, that's already an improvement.

</comment></comment></comment></comment></comment></comment></comment><comment><USER64> From what a local told me, the car horns in Mumbai are by design less loud than the ones in Europe or the US. This fits my experience, but that might also be simply being used to the sound.

<comment><USER56> Many people change the horn from the factory fitted one to another of their liking (louder and/or different sound pattern/music), though it's not legal. I don't believe that the factory fitted horns are less loud than in Europe or the US.

</comment></comment><comment><USER65> What if there was a tax on honking? Like 0.1 cent for every honking. With advanced enough car technology I see this as being a real thing.

</comment><comment><USER66> Entertaining to watch but I can imagine kids with air horns would find it hilarious to mess with drivers if this was rolled out widely.

</comment><comment><USER67> in NYC the honking is endless. I imagine the noise pollution from a single honk in midtown impacts thousands of people who are around the immediate intersection and possibly 2-3 city blocks from it.

I had hoped Tesla would've pioneered mesh networking their cars with internal alerting/signaling mechanisms. Eventually selling the tech to other manufacturers.

</comment><comment><USER68> Parabolic dish from hotel room directly to sound sensor will DOS the intersection. And be difficult to detect.

</comment><comment><USER69> Bring it to New York

<comment><USER70> There's no-one honking at red lights in NYC; if you're getting honked there, it's because you're stopped at the green.

<comment><USER69> If you live or spend time in a out-facing room, you'll the amount of unnecessary beeping that goes on in this city. Honestly, I think I have it good, all things considered, but coming from Europe it's very annoying to hear people use the honk to "communicate" instead of "alert" (which is essentially what this article is about).

</comment></comment></comment><comment><USER71> This video seems off to me. Sure the idea is fun, but in no way am I convinced that this really happened. This is just cute editing and CGI. At least as far as I can tell.

</comment><comment><USER72> Awful website keeps popping around

</comment><comment><USER73> does that mean you can extend a green signal by honking too?</comment>


Show HN: 1upHealth – API to Get Electronic Health Data into Your App in Minutes - <AUTHOR> https://1up.health <comment><AUTHOR> 1upHealth ([https://1up.health](https://1up.health)) enables any app to get EHR data via API in minutes using only patient authorization (via OAuth2). So this means you don't need to create integrations health system by health system. You don't need to know the IT team there or have C-Suite level approval for your app. You just need your patients to authorize access. This saves you months. We are live at 126 health systems ([https://1up.health/health-systems](https://1up.health/health-systems)), so if you or your users are at any of those orgs, you can incorporate real health care data into your apps today.</comment>


Flat design in print? - <AUTHOR> https://www.medium.com/design-ux/73745b834d81

<comment><USER2> What the hell is the author talking about? Swiss style graphic design has been around forever and is by and large "flat". It's been massively influential worldwide.

<comment><USER3> Absolutely agreed. It's like the author has never seen a magazine. Flat design has been around since color print became common.</comment></comment>


Are Venture Capitalists Pushing Entrepreneurs Towards Trendy Ideas? - <AUTHOR> http://mytwoandahalfcents.com/scripted-innovation-venture-capitalists-pushing-entrepreneurs-trendy-ideas/ <comment><USER2> In all seriousness - haven't they, at some level - always done this? Even in the sense that VCs will take a stance such that "we only invest in mobile".

<comment><AUTHOR> That's debatable - look at the late 90s early 2000's. They were playing catchup. Now, it appears they are setting the tone.

</comment></comment><comment><USER3> The funny part is those all seem like bad VC bets to me. Not sure of any 10 billion dollar companies come out of this areas in the next 5-7 years. I think the timeline is longer. IOT is a 1% product. Same with vr. ML requires massive data sets.</comment>


Lyra: An Interactive Visualization Design Environment - <AUTHOR> http://idl.cs.washington.edu/projects/lyra

<comment><USER2> How does this differ conceptually from Tableau? Yes, I'm asking this (annoying) question even though the OP states, "Lyra is more expressive than interactive systems like Tableau, allowing designers to create custom visualizations comparable to hand-coded visualizations built with D3 or Processing."

...yeah, but how exactly? Because it looks about as complicated of a GUI as Tableau...and I don't have enough knowledge of Tableau to compare it against the video, as Tableau's interface is so befuddling that I thank God I stumbled unto web development, as painful as that journey has been, so that I could code my own interactives rather than have to learn Tableau's conventions.

I guess the issue with Lyra is the same with all other programs that claim "custom visualization design without writing any code"...the two desired features, "custom" and "without writing any code"...are, IMHO, at odds with one another. If you want to do anything custom and interactive, you will pretty much have to do something as complicated as code...and pushing a series of buttons and clicking through menus may end up as being as intellectually challenging as just learning programming.

Also, I don't see how the Lyra visualizations are comparable to D3...D3 is amazing because it is a relatively minimalistic framework for coding visualizations...the kind of flexible, expressive visualizations you can do are possible because you are allowed to expressively code them via D3. I don't really see how Lyra (or any GUI) could accomplish that conceptual feat.

<comment><USER3> I work on this project.

One crucial thing to make the GUI simpler than code is direct manipulation. Working with a graphics program, like Inkscape, for example, is much easier for most graphics tasks than writing raw SVGs.

For most tasks in Lyra, you can simply drag-and-drop elements onto the visualization to make it respond the way you want. In advanced cases, true, you do have to navigate menus and buttons. For many of those cases, rather than writing raw D3 code, there's the Vega project. Vega is a declarative format for describing visualizations using a JSON format. Lyra generates Vega specifications for rendering, which can then be modified manually.

Vega: [https://github.com/trifacta/vega](https://github.com/trifacta/vega)

<comment><USER2> Thanks for the response...I know of Vega and think this is a great use of it. Being able to export into an open format already puts this ahead of Tableau in my book.

</comment></comment></comment><comment><USER4> I haven't tried this one, but did use Tableau (weird and difficult to spell) for a while. But till date, only tool i found useful is Statwing. Tableau is somewhat helpful with its multiple options but using it isn't intuitive at all. The thing i liked about Statwing is that just throw your data to it and start experimenting with different relations between data. I see Statwing as the first level of analysis and then move to more sophisticated viz in d3 as next step. But i'm interested in this area and using more of such tools to get the viz right.

</comment><comment><USER5> I've been tracking this for awhile, the design potential is fantastic. I'm really excited for when it can be used to quickly create dashboards with streaming updated data.

</comment><comment><USER6> Great job! Impressive to see an open source project to pick a fight with established software packages like Tableau. I used many BI packages in my life (only few of them for longer than a while) and consider my self an intermediate D3 programmer.

Some feedback if you need it: the UI seems very slow on Chrome, and I don't find it intuitive - there's a lot of dragging and dropping from various places to establish a simple data vis. Ideally you'd like to see what is available, choose it and later play to tweak it, not having to do lots of configuration upfront. Perhaps you could default your tool to do a line chart (or some other kind of early visual feedback ) so the user knows he's on the right track from the beginning?

</comment><comment><USER7> Free software built for astronomy that appears to do what Tableau (and to some extent Lyra) does, without the gloss.

[http://www.star.bris.ac.uk/~mbt/topcat/](http://www.star.bris.ac.uk/~mbt/topcat/)

</comment><comment><USER8> something similar but does dashboards+ [https://my.infocaptor.com/free_data_visualization.php](https://my.infocaptor.com/free_data_visualization.php)

</comment><comment><USER9> Ah, I love seeing programs inspired by Bret Victor's talks and demos!

<comment><USER10> Where does it say it is inspired by Bret Victor?

<comment><USER11> "Data Table View. Data pipelines include a data table view, using a layout inspired by Bret Victor [Vic13]." from [http://idl.cs.washington.edu/files/2014-Lyra- EuroVis.pdf](http://idl.cs.washington.edu/files/2014-Lyra-EuroVis.pdf)</comment></comment></comment>


Facebook is looking into a subscription model - <AUTHOR> https://www.cnet.com/news/facebook-is-looking-into-a-subscription-based-model-report/ <comment><USER2> "pay the social network to avoid ads and maintain their privacy." If they are collecting info on people NOT using their platform, how will this work? imho this seems like a 4th amendment violation or heading that way. I stopped posting on fb almost 2 years ago.. should delete my account.

</comment><comment><USER3> Too little, too late, methinks. They've already blown all the trust they had.</comment>


Why We Choose Python - <AUTHOR> http://www.sixfeetup.com/blog/why-we-choose-python <comment><USER2> I love Python, but it's a rubbish article I regret to have upvoted.

> Python is robust

This paragraph does not feature a word about robustness. There are mentions of speed and scalability and some sort of benchmark showing a case where Python is faster than Ruby or PHP. Conclusion: "It's also very fast".

The rest is less terrible but does not mention any of Python's shortcomings.

<comment><USER3> Are there any widely-used languages that _aren't_ robust? That seems like kind of shallow praise.

<comment><USER2> Depends what you call robust. If you mean "strongly typed", PHP and Javascript come to mind immediately.

<comment><USER3> By robust, I mean the language/compiler has a strong test suite and the runtime is known to work reliably in production settings. I've heard horror stories about Sun's HotSpot JIT crashing frequently, but that was what, 10 or 20 years ago? Now that I think about it, Scala might be a modern example of that, but I haven't kept up with how they might have improved.

<comment><USER2> In this case, yes, real-world languages have a solid runtime/compiler. Though I'm surprised you have issues with Scala, at least the runtime part should be rock solid, given that it runs on a very much battle-tested JVM.

</comment></comment></comment></comment></comment><comment><USER4> I made it as far as ".... Python is the language of choice for serious developers" before I bailed.

I love Python, but let's not make this a True Scotsman fallacy.

<comment><USER5> Thing is, Python is becoming rapidly the language of choice for scientists, statisticians, and other knowledge workers who only do a bit of development.

<comment><USER6> That has no relation to the idea that "serious developers" use Python.

<comment><USER7> ...but it will generate flame on HN.

</comment></comment></comment></comment><comment><USER8> Please don't use the TIOBE index as a measure of language popularity. It's trash.

[Disclaimer: I love Python and if anything, it's more popular than TIOBE indicates. This comment expresses an opinion about TIOBE, not Python]

<comment><USER9> BASIC is more popular than JavaScript on it O.O

<comment><USER10>
        Ratings

        The ratings are calculated by counting hits of the most
        popular search engines. The search query that is used is

            +"<language> programming"

I wonder why BASIC is so popular :)

<comment><USER11> Funny thing... that has a bias over syntax complexity of the language, easier to pick (and IMO better quality) languages wouldn't require to google about features that often. No wonder why Java is the first.

<comment><USER12> They are using "number of searches people initiate," but "number of hits in the search engine." I would think that the number of hits in the search engine wouldn't be a function of how often one is required to Google for an answer.

</comment></comment></comment></comment></comment><comment><USER13> I use python because it is functional psuedocode. Before I learned python, my sketches for algorithms on whiteboards looked like python.

Also, the community practices for coding style are so strong in Python that I can open up nearly any piece of code on the internet and have no problems reading it no matter how junior or senior the person was who wrote it. This is a big win for maintainability and one of the main reasons why I prefer Python over Ruby or Perl.

</comment><comment><USER14> It would be strange if this guy had anything negative to say about Python since "Should you need assistance with your Python project, we'll be happy to help through a variety of professional services."

<comment><USER7> Why would you need assistance when "Python is easy to learn and use"?

</comment></comment><comment><USER15> One business metric that is worth considering is the cost of putting together a Python team vs., say, PHP. Here "cost" doesn't mean salaries as much as it means "cost function" or "difficulty score". Get away from Silicon Valley's reality distortion field and I think Python, today, might still have some issues in this regard.

I am not talking about finding one developer. I am talking about finding one, scaling to five and then beyond that.

<comment><USER16> Well, to be fair, SixFeetUp is based in Fortville, Indiana (a bit far away from the "reality distortion field" you mention).

Also, with more and more colleges switching to Python as their Computer Science major's language of choice, finding a team of competent Pythonistas is getting easier. I would think that it helps tremendously to be able to hire remote workers (especially since a town of 4,000 probably won't have more than a couple of people who are Plone experts, at most!)

<comment><USER17> Hah, Fortville is on the outskirts of Indianapolis, so we have a robust base of developers. Indiana's colleges produce a ton of IT students as well. We do also use remote developers, we are actually looking for a Python developer and a sys admin. Devs can be remote, the sys admin needs to be local. <http://www.sixfeetup.com/company/jobs>

Also some of the big local companies like to use Python including Angie's List.

</comment></comment></comment><comment><USER18> The thing that keeps pulling me toward python is the ecosystem. NumPy, SciPy, Pandas, Mapnik, Cython, PyPy, IPython, Jython, Sage, PyQt/PyGTK, PyCuda/PyOpenCL. I rarely have trouble finding a tool that I need.

It is frustrating, because Ruby and Java are the standards where I work, and Clojure/Haskell are my favorite new toys. But I refuse to program in Java, and none of the others have ecosystems anywhere near as awesome as Python.

<comment><USER19> I agree about the awesome range of libraries for Python. But, in Clojure, doesn't access to the all the JVM libraries make up for this?

<comment><USER20> No, because JVM numeric libraries are awful, and, because the Clojure community leans toward things like web development instead of scientific computing, there are seldom Clojure wrappers available for them. Incanter, for example, isn't even maintained anymore.

It is a shame, because Clojure is a better language.

</comment></comment></comment><comment><USER21> I can vouch for 'easy to learn': if you can already program in another language, learning Python is like being reintroduced to an old friend who has grown up quite a bit since you last met him.

<comment><USER22> I found the opposite. For example, I find it extraordinarily frustrating not to be able to know what kind of object something is by looking at the point in code where it is created; something like

variable = somefunction(inputParameter)

where variable did not exist before leaves me having to look up the documentation of somefunction to know what kind of object it is returning.

<comment><USER21> Hopefully, whoever defined somefunction did something like this:

      def somefunction(inputParameter):
          '''
          inputParameter: List of seven positive integers
          representing a poker hand
          Returns: A positive integer used to score that hand
          relative to all other possible hands, better hands
          receive higher scores.
          '''

<comment><USER22> You know they didn't. These are programmers we're talking about :)

</comment></comment></comment></comment><comment><USER23> And one of the best features of Python: The community

The Python community allied with the good programming habits (aka PEP 8) really does the difference.

<comment><USER24> I LOVE PEP8. There it is I said it. I love that I can look at Python code I wrote eight years ago and it looks like I wrote it yesterday (apart from the fact I've got better and working with python).

Even better I can look at someone else's code and if they've bothered to follow PEP 8 I am straight in, understanding the code and not their formatting. It removed a cognitive load that in C++ just kills me.

It's bloody great.

<comment><USER25> I couldn't agree more, we actually posted on that a while back as well. We are huge code standards fans.

<http://www.sixfeetup.com/blog/why-pep8-for-plone-development>

</comment></comment></comment><comment><USER26> I have been a PHP developer for more than 10 years. Since a couple of years Python has become my language of choice. I'm addicted to Python, every project I now start is in Python.

But I don't see any real valid reasons in the article to convince people. Do I have a valid reason? Probably not, every project has their own reason to use a specific language.

One valid reason to choose Python instead of PHP: Encoding. Never had any big problems in Python and a lot in PHP. Oh and multithreading.

<comment><USER27> > Encoding. Never had any big problems in Python and a lot in PHP

Encoding is rarely a problem in PHP. Use UTF-8 everywhere, make sure every part of the system uses it (the database server, the database client in PHP, the web pages, etc.). If you're going to work with e.g. Japanese characters, use <http://www.php.net/manual/en/mbstring.overload.php>

<comment><USER26> Agree, but sometimes you have to work with systems from other people. The fact that encoding issues can occur, means it will happen someday.

<comment><USER27> What kind of encoding issues are we talking about? I fail to see how PHP in itself should be specifically vulnerable to encoding problems.

</comment></comment></comment></comment><comment><USER28> You cannot write an article like this if you cannot first write an article on Python's warts

[http://web.archive.org/web/20070202012909/http://www.amk.ca/...](http://web.archive.org/web/20070202012909/http://www.amk.ca/python/writing/warts.html)

<http://www.rittau.org/python/warts>

in fact I would love a warts wiki for frameworks, libraries and more. Python or not. Its important to have these debates out loud.

</comment><comment><USER29> I once joined a project that had been going on for 5 years with >100K lines of Python. At any given time we had more than 25 programmers. In my two years on the project I never had a problem reading someone else's code - it was great for maintainability. Our project was used by hundreds of engineers on a critical path of a multi-billion dollar project. Anyone who thinks Python doesn't work for serious development doesn't know what they're talking about.

</comment><comment><USER30> I just came here to praise python and hate on php, because that seems to be the popular thing to do. But I do like the idea of it being functional pseudocode, because my pseudocode usually starts approximating the syntax of the language, with progressively more erase marks and crossed statements due to getting a bracket wrong, or some other minor problem.

Note: Yes, I write source code on paper. Alot.

</comment><comment><USER31> > [Python is] rivaling PHP to become the most popular interpreted language

Hahahaha. I love Python and loathe PHP but this is just ridiculous.

</comment><comment><USER32> > Python is now one of the fastest-growing programing languages

I love Python but looking at the long term trends on TIOBE I am not sure I'd agree with the above statement [http://www.tiobe.com/content/paperinfo/tpci/images/tpci_tren...](http://www.tiobe.com/content/paperinfo/tpci/images/tpci_trends.png)

</comment><comment><USER33> I thought that Google was migrating to more towards complied languages, (C++, Java, Go), and away from Python?

<comment><USER34> Haha, no. We absolutely write new Python code daily and it's one of our core languages.

<comment><USER33> Thanks for the update. I was concerned that Guido leaving Google meant more than just Guido leaving Google.

</comment></comment></comment><comment><USER35> this is so 2005</comment>


U.S. is terminating its relationship with World Health Organization, Trump says - <AUTHOR> https://www.reuters.com/article/us-health-coronavirus-trump-who/trump-says-terminating-us-relationship-with-world-health-organization-over-virus-idUSKBN2352YJ <comment><USER2> This is not going to reduce China's influence on the WHO.

Who is going to be the trusted source now? The NIH?

Every year Trump proposes budget cuts to the NIH, and Congress ignores him and increases the budget.

I bet this money will end up in private companies' pocket.

<comment><USER3> I hate to see you getting down-voted because I do agree with point one. It won't diminish Chinese influence at all. In fact, it might increase their influence. China has always worked to replace America, why not at the UN?

<comment><USER4> China and Russia have been increasing soft power significantly over the past few years by filling voids the USA has left. We have been leaving the table, and they have been taking our seats.

</comment></comment></comment><comment><USER5> I would love to see some of the money routed to NIH.gov instead. They have lost a great deal of funding over the years and we have a greater need for scientific research of diseases now more than ever.

<comment><USER6> Dividing global response isn't bad enough?

He already cut NIH and is now doing the same with WHO. These both are bad decisions from an incompetent leader.

This is a sad situation... Again.

<comment><USER7> Agreed, if we had a fallback solution it wouldn't be so bad, but as is, I just feel like the whole world is the worse for it.

Hopefully something good will come of it, but I can't see what from here. Funding cuts to CDC, now this. I just wonder whether the WHO could have been repaired as-is?

<comment><USER8> > I just wonder whether the WHO could have been repaired as-is But that's the > thing. The WHO isn't perfect and I'm uncomfortable with how much power China > has inside of the UN in general, but I don't understand why people are > saying it's broken. I've been searching for those arguments and the only > sources I can find are conspiracy theorists and far-right news > organizations. Could you please explain the reasons you think the WHO isn't > functioning?

</comment></comment></comment></comment><comment><USER9> If the US pays a magnitude of money more than China to the WHO, how are we to believe that the WHO is China's puppet, and not an extension of western power? How is China so clever with its maneuverings that its relatively puny contributions go so far?

<comment><USER10> The theory goes (which I'm not espousing just relaying) that you could simply bribe top WHO officials and avoid having to provide magnitudes of money.

The WHO has been in scandal before regarding [exorbitant spending on travel.] ([https://apnews.com/3d8569ea7bd140e4ba02bc1712cd12ab](https://apnews.com/3d8569ea7bd140e4ba02bc1712cd12ab))

<comment><USER3> I don't know if it's bribery at work here. Rather, it's anger at American behavior over the last decades which is pushing it closer to China. America is the WHO's primary superpower sponsor, and protector. In the courtship of a new sponsor, China, it could be just that: stoking anger and offering a choice.

<comment><USER10> I don't know either. I think all of this is obviously couched in the fact that the poor initial US response to Coronavirus has made it politically expedient to [make this a story about China] ([https://www.foxnews.com/politics/gop- memo-advises-candidates...](https://www.foxnews.com/politics/gop-memo-advises- candidates-to-attack-china-over-coronavirus))

That doesn't mean the WHO or China have clean hands, just that in an election year for the US my bias would lean towards this being about politics.

</comment></comment></comment></comment><comment><USER3> I don't agree with this. Freezing of funding, investigating, etc. is fine, we should. But this is like the withdrawing of ambassadors. Not quite breaking off diplomatic relations but we really should want more cooperation with US and UN officials, not less.

</comment><comment><USER11> How does this make the US safer?

<comment><USER12> It gives the US the ability to create a non-corrupt institution. Right now the WHO is not a reliable global partner. If the US can find other people that feel this way you get a more efficient institution that possibly is more efficient.

Whats not safe is continuing to work with someone obvious playing fast and lose with the world.

<comment><USER8> > WHO is not a reliable global partner

That's based off of what evidence? When I search for "WHO corruption" I only find conspiracy theory youTube videos and far-right leaning publications that have a leg in that race.

Besides, as was said earlier, this is the equivalent of pulling diplomats out of a country. If corruption is the issue (and I'm not convinced it is) then you'd cut funding. This is a political stunt which is trying to draw attention away from an administrations failed response to a pandemic.

<comment><USER13> I'm sorry, wasn't the interview with Dr. Bruce Aylward enough to convince you that there's something seriously wrong with the organization's leadership?

<comment><USER14> No, I see a physician-epidemiologist by training from Newfoundland Canada struggling to manage a global pandemic with two global superpowers in a political arm wrestling match on the global stage when he knows he needs both to cooperate.

</comment></comment></comment></comment></comment><comment><USER15> Here's President Donald Trump's announcement. Hong Kong's special trade status is also revoked.

[https://twitter.com/realDonaldTrump/status/12664558344579686...](https://twitter.com/realDonaldTrump/status/1266455834457968640)

<comment><USER3> Thank you for posting this, it was nice to see Honk Kong's status under review; does congress need to approve? We have tools we can use to reign in China's harmful behavior - perhaps next in the dock for consideration should be China's Most Favored Nation status....

</comment></comment><comment><USER16> in line with Make America Great Again..

</comment><comment><USER6> Let's be clear here. This is not about China.

The US under Trump wants to make billions of profits because of Covid-19.

The WHO wants to make the medicine available for free.

That's why he is out of the WHO and frankly, if that is the reason, the WHO is better off without the US.

Ps. I have no doubt that he would buy the stock of the creator of the vaccine to earn billions with his access to private information.

</comment><comment><USER17> Somehow withdrawing funding from the current only worldwide public health organization at the beginning of a pandemic seems ?? shortsighted.

Is trump admitting that he is incapable of negotiating his desired changes in WHO functionality, that his ability to communicate and work with international players is so deficient that his only option is to take his baseball bat and baseball and go home?

Or is this all a political move to attempt to shift the 'blame' for his/Trump's failings to some other boogeyman? My bet is on this option -- he failed to recognize the magnitude of the epidemic, he failed to take timely and early actions to mitigate the impact on the US economy and lives, he repeatedly minimized the size of the tsunami of death that was approaching our shores, he failed to motivate his FDA/CDC to get working PCR viral tests immediately and produce them in the amounts needed, he failed to coordinate obtaining necessary PPE supplies for the 50 states leading to a dysfunctional free-for-all where states were bidding against each other and FEMA confiscated all shipments they could find, he refused to take any responsibility for all of the above failures, he has recommended use of experimental medical treatments out of clinical trials (hydroxychloroquine), he has actively interfered with the public health necessity of transitioning the US to a "mask wearing culture" by making it a macho / political question instead of a life saving public health intervention, he has demanded that States not follow the 'reopening' metrics advanced by his own covid-19 group.... need I continue?

<comment><USER18> It's 100% blame-shifting.

We all saw this happening in China for 2-3 months before it got here, then in Italy a month before it got here. It was all over the news. And we did nothing, as you note.

So now the line is that the WHO abetted some sort of cover-up? Does everyone have the memory of a goldfish?

</comment></comment><comment><USER19> Who's performance has been abysmal, and they've proven to be the lap dog of the CCP. I totally agreed with the funding hiatus, this is a surprise move to me. There's a lot we don't know.</comment>


Cox to introduce "Anti Commercial-Skipping Technology" - <AUTHOR> http://www.dailytech.com/article.aspx?newsid=7211 <comment><AUTHOR> I frankly don't understand this _at all_. Whether they like it or not, whether it's moral or not, they're in direct competition with people just downloading the full def episodes from bit torrent. Just do more product placement and get it over with (apparently the last Pierce Brosnan Bond film was paid for entirely by product placement - the box office revenue was pure profit). It reminds me very much of Starforce, the ridiculous, OS destroying DRM solution for Windows games. It happily fucked up the machines running legit copies and the cracked versions of the game just totally disabled it.</comment>


Serverless hapi services using stackery - <AUTHOR> https://www.stackery.io/blog/serverless-hapi-services-using-stackery <comment><USER2> Sweet, seems like you could potentially retrofit existing services to be "serverless" this way.

I'm guessing this could be done similarly using Express, too?

<comment><USER3> Yeah, I've been researching Express, too. It's pretty straightforward as well. Expect a blog post on that shortly :).</comment></comment>


The danger of surrogate metrics (2007) - <AUTHOR> https://blogs.msdn.microsoft.com/ericgu/2007/05/10/the-danger-of-surrogate-metrics/ <comment><USER2> I observed a (non-engineering) team successfully use this argument to avoid being measured at all except through the customer feedback that they were a primary channel for.

As such, they were oft quoted as being amazing. I can't say that they weren't - my interactions with them were tangential to their main purpose - but the work that my team had that depended on them or their input was often not done or missed the point completely (and criticism dismissed as they are the posterchild team).

I think you _should_ use surrogate metrics. You should just know them for what they are, and be able to argue as to why they aren't representative when they are bad and when they are good.

This means you can't make somebodies job, bonus, or promotion depend on the metric.

But it means you do get a heads up when something might be going wrong. And it means you get a heads up when something might be going right.

It also means you have to deeply understand what a metric really is, and what each particular metric is to the mission of your company and your job. This is hard.

<comment><USER3> Yes! I've seen these called guardrail metrics. Having a single metric be the one to optimize works pretty well if that optimization is what you want. But optimizing a teams work is messy and generates organizational instabilities. Tuning the guardrails feels like the best way to make sure that you get enough instability for interesting things to happen but not enough that other teams start deciding to take over whole functions just to get work done.

</comment></comment><comment><USER4> See also Goodhart's Law: When a measure becomes a target, it ceases to be a good measure.

[https://en.m.wikipedia.org/wiki/Goodhart%27s_law](https://en.m.wikipedia.org/wiki/Goodhart%27s_law)

</comment><comment><USER5> I know this is from 2007, but it's funny this is coming from Microsoft... with all the W10 metrics, telemetry and spyware bloat that replaced the old and effective "Send error report" button. Kind of seems like they didn't follow their own advice - provided user satisfaction is actually what's on the line here.

</comment><comment><USER6> In the bio/pharma scene, this is most cruelly illustrated (in recent times) with this example failure: [https://blogs.sciencemag.org/pipeline/archives/2017/05/18/no...](https://blogs.sciencemag.org/pipeline/archives/2017/05/18/now- this-is-a-drug-that-does-not-work)

tldr:

\- statins have a measurable effect on HDL and LDL levels that correlates really well with how much they reduce your risk of dying, and that risk reduction is real and big.

\- therefore HDL/LDL levels shall be a great surrogate metric for new drugs; let's go find some.

\- we found this great drug that does even better than statins do at HDL/LDL level changes

\- two years and 12k patients in trials later: this new drug doesn't affect mortality literally at all.

\- ...crap.

</comment><comment><USER7> Every consumer internet company needs to heed this warning. Instead of digging deeper and deeper into metrics like "time spent in feed" or "upvotes per session" or "minutely active users" (because daily and monthly active users is so 2015)... It's pretty simple. Find a way to ask your users what they actually think of your product (then, yeah, by all means use data to validate/explain that)

<comment><USER8> But in the end, isn't "what a customer thinks about your product" also a surrogate metric? There are a lot of products that were loved by the users that still failed to be a sustainable business.

If you give a valuable product away for free, for example, your users will love you.... but it you will soon run out of money and go out of business if you don't also have a way to generate revenue.

<comment><USER9> "What a customer thinks about your product" is a _input_ , not a metric. You can still fail, just like a chair factory can fail to produce chairs if provided with unlimited amounts of wood but no nails or glue to hold the pieces together.</comment></comment></comment>