How Silicon Valley is trying to cure ageing - <AUTHOR> http://www.telegraph.co.uk/news/worldnews/northamerica/usa/11413041/How-Silicon-Valley-is-trying-to-cure-ageing.html <comment><USER3> Mortality is the #1 bug of human hardware (with cancer a close #2). It may have been a feature a few thousand years ago, with limited resources, but it's now hampering our progress.

I don't want mankind achievements to be limited by our limited lifespan. The first 20 to 30 years are wasted on learning - almost like 1/3 of a average life. But with linespans in the 200 to 300 years, that would be 10% - <USER2> these added productive years could bring so many more good things. Imagine if Feynman and Einstein were still alive today, having new ideas, discovering new things. Imagine if we still learn during 1/3 of the lifespan - the amount of knowledge that would be acquired, and the marvels we could achieve with it.

For those who will lament on how this would be bad/capitalism/not respecting nature or (insert your favorite deity), nobody will force you do to anything. Die of old age at 90 if you want.

Personally, I want extended life or immortality to do crazy thing when I'm still young in my early 200 (or young again thanks to cures we can't even imagine at the moment)

<comment><USER4> I agree in the long run.

But you don't have to get very old before it's obvious that a lot of ageing is an accumulation of small infirmities that build up over time. There may well be a switch that can turn on or off the dramatic downturn that occurs in old age (perhaps to do with telomeres, or lossy DNA replication, or whatever), but it seems unlikely the same switch will also reverse that accumulation of infirmities. Returning a 60 year old body to the same maintenance processes as a 20 year old body won't fix torn cartilage, sciatica, or cardiovascular damage. So obviously we should be investigating the former processes, but the techniques for the latter small problems must be substantially fixed beforehand, or else we'll end up in this nightmarish middle zone of people getting more and more unwell, but not dying.

<comment><USER5> My limited understanding is that the repair processes also play a big part. For example bones become brittle because stem cells no longer fill the gaps as quickly as they appear. The body also fully replaces every cell every seven years. If they could find a way to just restore the repair mechanisms a whole host of problems could slowly start to disappear.

<comment><USER6> Bones also suffer from other processes that damage the structural properties of the extracellular matrix such as cross-linking by hard to break down sugar compounds. There is also a process of growing cellular dysregulation wherein the ongoing bone remodeling favors destruction over construction, and that is distinct from stem cell decline. Every tissue is impacted by multiple forms of damage beyond loss of maintenance via stem cell function, some of which, like the cross-linking, accumulate slowly and cannot be repaired by our biochemistry. Clearance of some sort will be needed.

The body does not replace all of its cells; different tissues have different turnover rates. Many of the cells in your central nervous system will be with you for your entire life. There is research to suggest that even some of the individual proteins in those cells are never replaced either.

</comment></comment></comment></comment><comment><USER7> A million dollars doesn't seem like much of a prize considering the result. For that kind of money, we should be X-Prize Kickstarter projects.

<comment><USER8> I'm not sure that financial prizes give much of an incentive either way for people trying to stop aging.

<comment><USER7> Financial prizes have worked for centuries. Have to be specific on a goal.

[http://en.m.wikipedia.org/wiki/Longitude_%28book%29](http://en.m.wikipedia.org/wiki/Longitude_%28book%29)

<comment><USER8> Is a good book, but I think you miss my point. Measuring longitude is exactly the sort of thing a cash prize helps with, elixirs of life already have such strong incentives attached that you might as well just award a nice cake and a balloon saying "Well Done".

<comment><USER7> Nah, you're looking at it completely wrong. There are many small steps that could improve people's lives. Many of us could get to 100 if we simply could monitor our bodies more closely, for example, and perhaps fix "small defects" that are detected early:

[http://tricorder.xprize.org](http://tricorder.xprize.org)

Some people live to be well over 100, so if we could closely identify why they live longer, we might learn a lot there too.

We know so little about the human body that one day we say eggs are bad for you then the next, they're ok to eat again.

</comment></comment></comment></comment></comment><comment><USER9> The truth is we have no idea how to stop aging. That is why it is better to fund the heck out of basic science. When you don't know where to start, then you have to wait on that amazing breakthrough. No one really knows where that may come from.

<comment><USER6> Various factions within the scientific community have a lot of very good ideas as to exactly how, in great detail, to go about research and development with a high probability of producing effective treatments for aging at the end of the day. For example, these laundry lists:

SENS: [http://sens.org/research/introduction-to-sens- research](http://sens.org/research/introduction-to-sens-research)

Hallmarks of Aging: [http://dx.doi.org/10.1016/j.cell.2013.05.039](http://dx.doi.org/10.1016/j.cell.2013.05.039)

Seven Pillars: [http://buckinstitute.org/CellCommentary](http://buckinstitute.org/CellCommentary)

</comment></comment><comment><USER10> Trying to 'cure' ageing is strange and unnatural.

We're just another species of primate, we age and we die, and we rot, and then we're nothing. Worms and pinochle and whatnot.

The only thing we should try to cure is our self-delusion and our fear. It only wastes what little time we have. If some of us start living to 120, we'll still moan that it isn't enough. It's never enough.

<comment><USER11> The improbability of immortality does not mean that life extension is worthless. Is striving to reach 80 asinine because we'll just want more? Should we have been satisfied at 40? The status quo is no argument for what we should want to achieve.

In fact, I'll argue that any serious life extension will have to come with a similarly extended lease on quality. Senesence will need to be stemmed upstream, so more of your 120 years will be good years.

<comment><USER10> I'm not saying it's worthless, i'm saying we shouldn't act as if aging or death are diseases to be cured.

<comment><USER12> no. we should absolutely, act as if aging and death is something to be cured.

A rose by any other name, is just as sweet. I mean to say, all of the STUFF associated with malady is there. So how / why does death/aging ... with all its symptoms ... differ?

It doesn't.

<comment><USER10> It differs in that it can't be cured. Although I suppose you could consider it a terminal illness then by definition.

Life can be extended, perhaps. Made more productive, certainly. But a cure for death? Show me one organism in nature anywhere near as complex as a human being with the capacity for unlimited aging and I'll believe it's possible. Technologically extending life for a few decades on average with a battery of complex and expensive medical treatments is not a cure.

Otherwise, looking at death or aging as a disease, while it might provide the catalyst for any number of worthwhile medical advances, also provides false hope. It's like waiting for the Singularity to happen so we can all upload our minds into the Eschaton. It's just another form of hoping for an afterlife.

Yes, absolutely act as if it can be cured, but don't believe it can.

</comment></comment></comment></comment></comment><comment><USER6> The prize site:

[http://paloaltoprize.com/](http://paloaltoprize.com/)

The heart rate variability thing is an interesting take on a biomarker for aging. I'm not sure I agree with its utility, but the prize should at the very least inspire enough attention to figure out whether you can artificially tinker with heart rate variability without having much of an impact on anything else. I'd expect that to be possible given (a) the existence of various heart function targeted drugs, and (b) the fact that aging results from the downstream consequences of cellular and molecular damage that is in and of itself many steps removed from large-scale systems level functions like heart beat regulation.

Some thoughts on prizes in aging-related medical research and why it is that we don't have more of them even though we should:

\</comment><comment></comment><comment></comment><comment>

Establishing a research prize is a form of investment in progress only available in the philanthropic world. At the very high level it is easy to say that philanthropists pay people to work on specific tasks. This is simple enough for smaller amounts: transfer a few thousand dollars to a research group and you have bought a very small slice of the time and equipment needed to achieve any particular goal. When we start talking about much larger amounts of money, millions or tens of millions, then there are important secondary effects that occur when making such investments. In these amounts money has gravity, money makes people talk, and money changes behavior and expectations in a far larger demographic than just the recipients. This is well known, and thus investment activities, philanthropic and otherwise, become structured to best take advantage of this halo of effects. Most of the experience in doing this comes from the for-profit world: it doesn't take too long spent following the venture capital industry to see that investment is a lot more complicated than choosing a target and writing a check, and this is exactly because there are many secondary effects of a large investment that can be structured and harvested if investors go about it in the right way.

I theorize that the reason why research prizes remain comparatively rare is that firstly they are an investment strategy restricted to philanthropy, and thus people with the money to burn have little direct experience, and secondly the whole point of the exercise is not in fact paying people to do things directly, but rather creating a situation in which near all of the benefit is realized through the secondary effects generated by the highly publicized existence of a large sum of money. A research prize works by being a sort of extended publicity drive and networking event conducted over a span of years, a beacon to draw attention to teams laboring in obscurity, attract new teams, and raise their odds of obtaining funding. Connections are made and newly invigorated initiatives run beneath the light of a large sum of prize money, but at the end of the day that money becomes more or less irrelevant. It wasn't the important thing, it was merely the ignition point for a much greater blaze of investment and publicity. By the time a team wins, they are typically in a position to raise far more funding than the prize amount provides.

The ideal end result is that a field of science and technology is rejuvenated, taken from obscurity and thrust into the public eye, made attractive to investors, and numerous groups are given the attention and funding they need to carry on independently. This is how it worked for the Ansari X Prize for suborbital flight, and more quietly, for the Mprize for longevity science: in both cases the entire field changed as a result of the existence of the prize and the efforts of the prize organization to draw attention, change minds, and build new networks. But the award of money wasn't the transformative act, and in fact that award didn't really occur at all for the Mprize, but rather change was created through the sum of all of the surrounding effects.

So consider this: people who arrive at the state of being wealthy and wanting to change the world through philanthropy, often after decades of for-profit investment participation, don't have much in the way of comparable experience to guide them in the establishment and operation of research prizes. Thus creation of a research prize falls low in the list of strategies under consideration by high net worth philanthropists. Few people do it, and so there are few examples from which others can learn. It is the standard vicious circle of development, in which steady, grinding bootstrapping is the only way to create change.

Why care? Because research prizes work well. They work exceedingly well. Depending on how you care to plug numbers into equations, a well-run prize of $10 million will generate $150 to $500 million in investment in an industry, and that is just the easily measured result. Just as important is the following change and growth enabled by that initial burst of attention and funding. The Ansari X Prize spawned a number of other prizes in various industries, but I think it remains the case that medicine and biotechnology is poorly served in this respect. Outside of the efforts of the X Prize Foundation, the New Organ prizes, and other independent efforts such as the Palo Alto Longevity Prize, there is little going on. Given the proven utility of prizes there should be many more of them, and yet there are not.

<comment><USER13> > Given the proven utility of prizes there should be many more of them, and > yet there are not.

Economically speaking, if the utility of a prize is greater than its cost, that is an arbitrage opportunity. Once enough people take advantage of that opportunity to create prizes, there will be far more prizes to choose from and the utility of the effort spent towards each prize will drop to equal its cost.

A prize is somewhat like a dollar auction, but the result of any effort you bid is more random.

</comment></comment><comment><USER14> Warning: autoplay video with sound not muted.

<comment><USER15> It's YouTube. They have autoplay on vids, unless you disable it.

</comment></comment><comment><USER16> I thought Silicon Valley was phasing out old people, not 'curing ageing'

<comment><USER17> Silicon Valley billionaires are getting older, too.

</comment></comment><comment><USER18> Perhaps the Valley should figure out it's housing problem before exacerbating the issue.

<comment><USER6> You are of course being facetious, but as for any objection to working on extension of healthy life, you should ask yourself how exactly your speculative problem is worse than the real problem of 100,000 horrible deaths every day, as well as the ongoing pain and suffering of hundreds of millions of people trapped in failing bodies.

<comment><USER13> Extension of healthy life doesn't solve the problems you mention, it merely delays them (unless the extension is forever, which is impossible given our current understanding of physics).

And population will be an issue - but I think that's largely self correcting. If everyone lives 1000 years, it may well take 500 of those to be financially stable enough to have kids, because you're competing against other people who can also plan on 1000 year spans.

<comment><USER19> It also seems weird to focus on longevity when there are so many low hanging fruit that strike people down before they've had a chance to enjoy a long life.

My aunt just died in her early 40s of cancer. Maybe one can argue that there's already enough money flowing into cancer research, ok, how about parasites, tuberculosis, malaria, the more general problem of drug resistance in infectious diseases? While we're being bold how about research into the causes of and solutions to violent behavior?

There's really some truth in advertising in calling this the "Palo Alto prize" as its impetus is clearly not really to make the world a better place or to solve serious problems affecting many millions (billions?) of people but to assuage the minds of the privileged class of soft-livers sitting in their suburban pleasure dome agonizing about the slow encroachment of inevitability.

<comment><USER15> > its impetus is clearly not really to make the world a better place or to > solve serious problems affecting many millions (billions?) of people but to

Are you suggesting millions (billions?) of people don't have a problem with death/cancer/dementia? Because that's obviously incorrect!

What do you think would happen if top research scientists lived longer and maintained their intellectual capabilities?

What would happen if people stopped thinking so much in the short term, because they expected to face the consequences of the more distant future?

What would happen to the resources that are currently being spent on diseases of ageing? Heart disease, cancer, dementia.

How much wealth would be created by an increased number of experienced people working?

Resource allocation to lifespan/healthspan doesn't seem zero-sum. Despite the temptation to create a dichotomy, there is none!

</comment></comment></comment></comment></comment><comment><USER20> Listen. As a 473 year old vampire, I can tell you it's really not all that it's cracked up to be.

<comment><USER21> That's just the hormones speaking. Once you pass your first millenia, you gain a perspective on things that significantly improves your life.

</comment></comment><comment><USER22> I think that before we get to be immortal we have to fix the basic vagaries of the human mind. I feel like the only way we can advance as human beings is by having the old with their backwards ideas (apartheid, anti-homosexuality) die and be replaced by new people with new ideas.

If we can fix the mind first then I'm all for immortality but not before.

<comment><USER23> What if aging in the brain is the reason old people aren't disproving and correcting their invalid ideas?

<comment><USER22> Perhaps they are both linked, perhaps it's the way we are wired, I frankly don't know. I am just suggesting that we should fix the way we think before we change how long we live. Just my $.02

</comment></comment></comment><comment><USER24> While population growth is one obvious concern, I am actually more worried about more immediate effects (pretending, for the sake of discussion that the feat of significant lifespan extension, or even immortality is possible).

Although the outcome where the poor have more time to accumulate wealth is possible, I think that the more likely scenario is a significant increase in the gap between the haves and the have-nots. Estate taxes will have a much smaller (or no effect), while low income families won't be able to bequeath their houses to their children.

Of course, it's hard for us to imagine the how things might play out after such a complete revolution of human life, but it would be interesting to at least explore and investigate the possible ramifications.

</comment><comment><USER25> I'm kind of with Gate's with this one. Work on alleviating pain and suffering we can cure today? Maybe work on making the process of death less painful. My fathers death was beyond painful. He had good insurance, and under the care of Hospice? It's like they sent him home and didn't give him enough medication. When the doctor says, "Sorry--I can't do anything. Look into getting your affairs in order.". You shouldn't need to ask a doctor for more Pallitive care medications? You should be able write your own scripts. No wonder people commit suicide when diagnosed with a disease--even a manageable one? It's not always clinical depression. I think about a guy I knew who was given a few months; He went right to the streets to buy herioin. He felt it was easier than waiting until a doctor who felt his pain/anxiety warranted a script? My best friend died of COPD, and something else. That something else was never diagnosed. He was racked with pain until he died in his sleep. I did take him to one of the best pain clinics in San Franciso. He got in my car and said, "They don't prescribe pain pills?" "They offered to cut some nerve?" I still don't get it. Yes, people abuse the system, but look beyond your stereotypes and alleviate the pain that's sitting in front of you? It's just going to get worse now that politicians are looking into prescription drug abuse. It's fine and dandy until you are the one seeking real relief from misery?

Happy Sunday-</comment>


Can You Build A Network On Top Of Another Network? - <AUTHOR> http://www.avc.com/a_vc/2012/03/can-you-build-a-network-on-top-of-another-network.html

<comment><USER2> _I asked if it is a network if it is built on top of another network. I think in that case, the answer is no._

Ironic that the network he's talking about is built on top of the TCP/IP stack.

I guess the point of the article is to argue about the definition of "social network", which isn't that exciting.</comment>


The Dilution Problem, and a Solution - <AUTHOR> http://www.thoughtocean.com/what/dilution <comment><USER2> Fantastic idea! I hadn't thought about that method at all. I've been researching this problem for a long time myself and wound up taking an entirely different approach.</comment>


Ask HN: How to reclaim domain when caught between Yahoo and Melbourne IT? - <AUTHOR>

Regretfully I used Yahoo Small Business to renew my domain name last time it was about to expire. I used a @yahoo.com email which I only signed up for for this.
Today I visit my site and see that it redirects me to an australian company called Melbourne IT telling me that my domain has expired.
I check my whois records and see that I used an old phonenumber and phone to register it which is why I didn't get a expiry notice. Stupid me, my bad! :(
I tried to renew it with Melbourne IT but I can't as I didn't directly host it with them.
Here comes the tricky part... Yahoo Small Business control panel claims I have no domains with them so I can't renew it. I try to find their support number to call them but they don't allow email nor phone support for "non-customers"?!
As I'm quite desperate to reclaim and renew my domain, does anyone here have an idea how I could do this?
I have posted on Melbourne IT's "24/7 support" which seems to be a community forum. <comment><AUTHOR> I have tried tweeting to @YSmallBizCare and I really hope they have a solution...

</comment><comment><AUTHOR> Does anyone know Yahoo Small Business' support phonenumber?</comment>


Facebook in talks with publishers on supporting subscription models - <AUTHOR> http://www.reuters.com/article/us-facebook-newssubscription-idUSKBN1A41EO <comment><USER2> The title makes it seem like TheStreet is the product but it isn't.

[https://www.thestreet.com/story/14233293/1/facebook-s- campbe...](https://www.thestreet.com/story/14233293/1/facebook-s-campbell- brown-we-are-launching-a-news-subscription-product.html)

<comment><USER3> That's a very misleading usage of the colon (:) punctuation mark. Is it even correct to use it like that in english?

<comment><USER4> Yes, it is used to denote the source of a bit of news or a paraphrased quote.

<comment><USER5> This should not be downvoted. One sees the source before the colon more often than after the colon, but it is common to see the source after the colon in some publications. I see several instances (e.g., "Corporate lobbying helped derail border tax: senior Republican") on the Reuters homepage right now.

<comment><USER4> Forget it, Jake. It's Chinatown.

</comment></comment></comment></comment></comment><comment><USER6> I'm more in favor of a move like this than I am having my required messenger app spammed with advertisements. At least this is completely optional.

<comment><USER7> Speaking of how horrible messenger is, I was just recently in a developing country, which gave me an opportunity to download messenger light.

It's amazing, it's so much less bloated and faster than normal messenger, and uses less data too. It doesn't have stories or the rich integration with giphy etc., but that doesn't bother me at all.

<comment><USER8> Didn't know there was a messenger light. Maybe because there wasn't when I was traveling a few years back? I'd be really interested to see it. I did install FB light on a phone I bought in a developing country and was so excited by it. The whole app was maybe a few MB at the most and it was nothing but my friends content and the basic functionality of the early Facebook wall/feed (minus graffiti.) Like stepping back in time kinda. Made me remember how simple a concept FB is/was under all the algorithms, data mining and JavaScript.

That app, ironically enough, is a major reason I'm not on FB today. When I got home and installed the standard app (at 3xx MB) and immediately felt like I was tricked into installing bloated adware. It ate my data up (comparatively) and provided me with little to no extra features beyond a prettier UI. More ads, more analytics, more shitty newsfeed clutter. I uninstalled it and haven't been back to FB since :)

<comment><USER9> You can easily sideload it on Android and works well even on our countries. :)

</comment></comment></comment></comment><comment><USER10> _" The feature is likely to allow publishers to create a paywall on Facebook's Instant Articles and guide readers to a publisher's home page to opt for a digital subscription"_

I wouldn't call that a news subscription product.

<comment><USER11> Yeah...I'd much rather they offer a Netflix-esque platform for news articles. I can't really justify subscribing to a single site, but if I could get most of the major ones with one affordable subscription I'd probably do it.

<comment><USER12> >I can't really justify subscribing to a single site

I hear this all the time, it has to be a side effect of getting all your news through facespace and other news aggregators. There's really only a handful of newspapers worth subscribing to (in the US), if you aren't reading at least one regularly enough that you'd pay for it if you had to, your money is pretty much no good. I'd expect to see more and more paywalls in the coming months/years, the economics are better, pandering to large volumes of low value readers is a race-to-the-bottom that won't support good journalism.

<comment><USER11> Honestly no, none of them are publishing content that is worth what they're trying to charge. At $15/mo, the NYT seems to be selling a feeling of intellectual superiority more than they're selling better journalism.

<comment><USER13> If you have Prime, I think the Washington Post subscription offer of 6 months free and then $3.99/month after that is a very reasonable value.

<comment><USER11> That is a great value. Way more in line with what one site ought to cost in my opinion.

</comment></comment></comment></comment></comment></comment><comment><USER14> Okay, that makes FB and the publishers more money, but how does it solve FB's fake news problem? Or does it exacerbate it?

</comment><comment><USER15> Google gives you the content for free via search as long as they get your search queries. Facebook gives you your friends content for free but could allow publishers to charge for access to their streams.

Virtual currency will run the new internet I feel - not neutrality necessarily, but something that will work.

<comment><USER16> Quite a few news sites have paywalls even through Google search, like wsj

</comment></comment><comment><USER17> I always wondered why nobody implemented an App store for news and magazine articles that can be accessed through the internet (i.e. not device specific).

Why didn't Amazon do this? Or Apple? Google?

<comment><USER18> It would be against the interests of Google for people to subscribe/pay for articles rather than searching through Google News for ad-supported articles.

It's against Apple's interests to do anything that isn't device-specific and the same could probably be said about Amazon & Kindle.

<comment><USER17> True. However, it can be against your interests, but you should always consider: what if someone else does this.

</comment></comment></comment><comment><USER19> How big a cut will Facebook take?

</comment><comment><USER20> I submitted a link to the Verge article on this with the title "Facebook to add paywall features later this year" which is the main highlight here to me.</comment>


Ask HN: Do you think Amazon Cloud Drive is in competition with Dropbox? - <AUTHOR>

Do you see these as competing services and if so, in what ways? <comment><USER2> No, I don't see them as competitors. Amazon will leave the tighter integration with the desktop to others. Amazon's strength is the backend. They don't want to have to provide technical support to tens of millions of users.</comment>


Reversing D-Link's WPS Pin Algorithm - <AUTHOR> http://www.devttys0.com/2014/10/reversing-d-links-wps-pin-algorithm/ <comment> m-app A while ago I found out that the D-Link router I had (655), had some XML output available for DHCP Lease status and interface statistics. I also noticed that these stats only became available after logging in initially from a certain IP/MAC (no session state kept). The router gives a salt that is valid for a while and on the client side that salt is used together with the password to generate a hash which is used to login. You can then proceed to retrieve the XML data.

In case anyone is interested, the (very hacky) scripts are on Github: [https://github.com/michielappelman/router- stats](https://github.com/michielappelman/router-stats)

<comment><AUTHOR> Good job, that looks interesting.

</comment></comment><comment><USER2> WPS is broken anyway. Its trivial to crack via brute force. Why its still being shipped as a feature, let alone a feature that's on by default is beyond me. The failings of the wifi consortium are pretty obvious, to the point where I wonder if there's some NSA trickery involved in making sure these things are insecure by default. I wish they took security more seriously.

[http://www.kb.cert.org/vuls/id/723755](http://www.kb.cert.org/vuls/id/723755)

<comment><USER3> For the same reason you have a bike lock, or a locker lock--to prevent opportunistic theft. You can prevent people from driveby stealing your stuff, but you're never going to stop a guy with an angle grinder.

<comment><USER4> Except in this case, it wouldn't be hard to stop people with angle grinders. The lock-maker just did a shitty job making the lock.

</comment></comment></comment><comment><USER5> Craig is so damn smart. I love how he went in looking to exploit some format string vulnerability, or an incorrect escaping of arguments passed to system(). But came out with a way to systematically grab WPA/2 keys from D-link. Why would D-link roll their own WPS key generation scheme? All the in- home routers i've seen come with the WPS pin set in NVRAM and written on the bottom of the router.

<comment><USER6> I think those labels are usually put there by the ISP who sold/leased you the device, not the manufacturer.

</comment></comment><comment><USER7> Aren't WPS Pins completely flawed in their design anyway?

I seem to remember being able to use an exploit to break into my own router that had WPS enabled about a year ago using a program called reaver.

The exploit had something to do with routers telling the attacker whether or not they guessed the first 4 digits correctly and then it narrowed it down enough to where bruteforcing was easy.

<comment><USER8> Yup! Basically the problem boils down to:

 _" An attacker can derive information about the correctness of parts the PIN from the AP´s responses.

> If the attacker receives an EAP-NACK message after sending M4, he knows that > the 1st half of the PIN was incorrect.

> If the attacker receives an EAP-NACK message after sending M6, he knows that > the 2nd half of the PIN was incorrect.

This form of authentication dramatically decreases the maximum possible authentication attempts needed from 108 (=100.000.000) to 104 + 104 (=20.000).

As the 8th digit of the PIN is always a checksum of digit one to digit seven, there are at most 104 + 103 (=11.000) attempts needed to find the correct PIN."_

Reference - [http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf](http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf)

</comment></comment><comment><USER9> Off the top of my head the only way to exploit this would be either by your ISP or the security services (via your ISP, or the router manufacturer).

Since WAN mac addresses don't travel very far upstream. Typically only to the local exchange. So in order for someone to utilise that to generate a WPS key they would have to sit at the exchange (on your side of the connection) and do it.

The manufacturer might also store the WAN mac addresses of each piece of equipment they produce (along with serial, etc) and depending on the supply chain you purchased the router down or if you registered it, they could figure out your router's WAN/WPS pin that way.

In general PIN-based WPS is a bad idea. Turn it off and do button WPS only. Or turn it on only as needed.

<comment><USER10> > WAN mac addresses don't travel very far upstream

This doesn't matter, and it's addressed in the post. He mentions many devices actually do use the BSSID (which is sent in every wireless frame), and the WAN MAC is usually very close to the BSSID anyway so you can guess it in very few tries.

<comment><USER9> Fair enough. I missed that line.

</comment></comment></comment><comment><USER11> Funny thing is that I've been looking at D-Link's (actually Cameo's) /sbin/ncc and other binaries the last couple of days (well actually nights...) on a DIR-636L.

I even have a note here wondering where they read from NVRAM or similar related to WPS because I couldn't spot it. Guess I have the answer now!

I doubt I will have the time to investigate it, but my feeling is that there is a lot of funky stuff in /sbin/ncc and the companion binaries.

</comment><comment><USER12> Question: I realize that the manufacturer has kind of dropped the ball, but would flashing the firmware with dd-wrt allow the user to patch the gaping security hole? Or does it go deeper?

<comment><USER13> I haven't used a standard "consumer" router like this for ages, but ISTR that WPS is something you can almost always disable.

To answer your question: yes, but that's not (typically) necessary.

</comment></comment><comment><USER14> Is there any reason at all the WPS pin would be derived from this kind of information? I don't want to seem paranoid, but this sounds like a backdoor?

<comment><USER15> I'm guessing the developer tasked with implementing this didn't have access to any other device-unique state, and getting the hardware team to have a new unpredictable value flashed onto each device was impractical.

<comment><USER10> If an entire manufacturer couldn't solve this, I wouldn't be surprised if others had a similar problem with a different generation algorithm.

<comment><USER16> It's nothing new, I fear.

Years ago I read about a similar predictability for ISP-supplied routers that used the MAC as seed for the default WPA key and the SSID. Once someone decoded the algorithm it was trivial to access many home networks.

At the end of the day, I believe it's cheaper to flash the same firmware image on all of the boards and differentiate them during the first boot or even at runtime like in this case.</comment></comment></comment></comment>


'I'm a Student-Debt Slave.' How'd We Get Here? - <AUTHOR> http://www.npr.org/sections/ed/2016/07/11/484364476/im-a-student-debt-slave-howd-we-get-here <comment><USER2> How'd we get here?

We hyped up college: It is your goal in life to go to send your kids to college. Everybody has to go to college. If you don't go to college you will fail.

Nobody talked about college as an investment: College isn't just another step in life. It is an investment. $75K for college makes sense if you will get a degree that enables you to get an income of $120K. It does not make sense to invest $75K in a degree that might get you an income of $40K.

We didn't tie the loan to the degree being obtained: Do we need workers with this degree? Is there a glut of people with this degree?

Etc.

<comment><USER3> >We hyped up college: It is your goal in life to go to send your kids to college. Everybody has to go to college.

I've seen many of my friends spend all their income on house/rent just to live in a good school district. There is no way they are going to let their kids not go to college, they have already created a narrative, a spiral for their kids, no way a kid can escape college at this point. Sunken cost bias.

They spend thousand of dollars on all kinds of things like swimming, piano, ballet, science clubs, coding clubs, robotic clubs, social work club ect. All gears towards making their Stanford application look good. There is no stopping now, wheels are already in motion, full speed ahead.

Kid's view of his life is a hero who lives up to expectations, against all odds. Each test is a battle that must be won. He has been raised on a constant diet of praises for his 'good work', his mind conditioned to keep the praises coming at all costs. The narrative has been set, love is love of success, fear is fear of failure.

<comment><USER4> The tech community is sort of unique in refusing to acknowledge any meaningful difference in the quality of education and research taking place at different institutions. It may be imprudent to set up your child's life according to "all educations in a given field are created equal" if their interest turns out to be in a field that doesn't agree.

<comment><USER3> >if their interest turns out to be in a field that doesn't agree.

I always wondered how 'interests' come into being. Would love to read more about this if anyone has pointers.

<comment><USER5> Some of my parents' interests rubbed off on me. I think it was because they treated those interests as things with inherent value, even if that value was just pure enjoyment, rather than as hoops to jump through _en route_ to a lucrative career. A lot of my interests were due to what I might call peer pressure of the good kind, i.e., they were things that my friends talked about at school, such as music, electronics, and computers.

The only thing I can suggest is to surround your kids with interesting things and interesting people. We're fortunate to live in a neighborhood where you can't swing a cat without hitting someone with an interesting occupation, ranging from academics to artists and musicians.

<comment><USER6> > I think it was because they treated those interests as things with inherent > value, even if that value was just pure enjoyment, rather than as hoops to > jump through en route to a lucrative career.

That's awesome!

Slightly off-topic tangent (how music is becoming a career track in China): [http://www.nytimes.com/video/business/international/10000000...](http://www.nytimes.com/video/business/international/100000004491181/88-keys- to-her-future.html)

<comment><USER5> I've heard that a jazz musician can make quite a bit of money in Shanghai right now.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> College costs so much, in part (and I'd argue in large part), because we flooded the market with money: [https://www.newyorkfed.org/medialibrary/media/research/staff...](https://www.newyorkfed.org/medialibrary/media/research/staff_reports/sr733.pdf)

</comment><comment><USER8> The first half of this article is almost content-free.

E.g. > [Q:] Let's talk about the student lending giant Sallie Mae. You report how the decision to privatize Sallie Mae in 1997 played a huge role in helping to create this debt crisis. Explain.

> [A:] Sallie Mae was a government-affiliated corporation whose board was made > up in part of public officials. When it first came into existence, it was > supposed to help create a market for the student debt that the feds were > issuing. But after privatization, it became a full-service, for-profit > corporation that really "verticalized" its involvement in the student debt > industry, everything from issuing loans to running collection bureaus. The > concern now is we replaced a program whose real purpose was to help people > go to college with something where that's kind of a secondary goal. The > primary goal, of course, for for-profit institutions is the bottom line.

Not a word of that explains how privatization created the debt crisis. It's a screed against private companies running loan servicing instead of government bureaucrats.

> [Q:] Suddenly, hedge funds, investors, lots of banks had a more direct role, > not just in lending, but in the fees, services, in the collection. And > Sallie Mae and other financial organizations began marketing private loans > with higher interest rates and fees and with fewer relief options?

> Right. All of the functions of the student loan program originally were run > by government agencies, bureaucrats, I guess you could say in a dismissive > way, but they were not motivated by profit. They were there to make the > program run. When you privatize collections, you get really aggressive > companies that come in there and work really hard to get the money back.

Ask anybody who has ever dealt with the IRS whether the government is aggressive about getting money owed to it. Besides that, private loans are a red-herring. 92.5% of student loans are owned by the federal government: [http://measureone.com/reports](http://measureone.com/reports). The interest rates are exorbitant (I pay almost 8% on mine), but that is necessary to support the extremely generous repayment terms (payments capped at 10% of disposable income). And it's bureaucrats in charge of all this, not evil hedge fund managers.

<comment><USER9> >payments capped at 10% of disposable income

That's what almost everyone fails to mention every-time "crippling student loan debt" pops up. It's capped at 10% of disposable income, and disposable income is calculated as 1.5x the federal poverty level. So if you're making under that (because you're stuck in a part time food service job), you pay nothing. As you make more money, you'll pay more, but it will never go above 10% of disposable income, and you can write off up to $2,500 per year in interest paid on the debt (so if you're making very little you'll be able to take a deduction for almost the entire amount you pay). Then if you haven't managed to pay off your loans after 20 years of making payments, the debt is cancelled [1].

The Obama administration also changed the eligibility for income based repayment plans, so that people with older student loan debt can sign up for them as well.

[1] There's still a problem with the IRS taxing cancelled deb but, it's not as bad as it seems.

First, You're only taxed up to insolvency. So for instance, if you have more liabilities than assets (including the student loan), the tax debt is cancelled. This is likely the case for someone who didn't make enough to pay off the loan in 20 years.

Second, sometime over the next 20 years as more and more people face this situation, congress is likely to do something. There are no interest groups fighting for the status quo, it won't cost that much, and it looks good as a press release, so there's good reason to think congress will fix this.

<comment><USER10> The failure to mention isn't accidental. People click on stories with big numbers. The bigger the number, the more clicks, so only the most biggest largest numbers get reported.

</comment></comment></comment><comment><USER11> I'm unique persective in that I have a degree I received 20 years ago, and decided a midlife-crisis meant going back to get an electrical engineering degree.

My chemistry class wouldn't transfer so I had to repeat it. So I took it at a local community college. Before I was allowed to register, I was forced to go to an orientation. The worst motivational speaker I've ever seen kept hammering the students about living life to the fullest and enjoying the college life. I walked out.

The last time I took a class, I could take a full course load for $700. The chemistry class was $800+ alone.

It amazes me that if you came home and told your parents you purchased a $80k car with payments they would consider you an idiot; If you told them you wanted to pay $80k for a college (with a 50% graduation rate) and received a loan that cannot be wiped out by dissability or bankruptsy -- they would think you were a genious.

<comment><USER12> Don't forget to mention that you took out the loan so that you could learn critical thinking and how to learn.

</comment></comment><comment><USER13> This makes me feel even more proud of my 20 year old self for looking around me at the people I knew who were delivering newspapers after completing a bachelor's degree and deciding "I can deliver newspapers without a degree, and my quality of life will be better if I do so without a mountain of student loans." So, I dropped out of college and went and supported my husband's career and raised kids. I returned to school when I had some idea of what I desired to do with my life.

Part of what is wrong with the world is that too many people go along with the plans other people make for them. Too many people drink the koolaid and believe the hype that a degree is a guaranteed ticket to a serious career. It absolutely is not.

</comment><comment><USER14> We got here because people have been brainwashed into thinking college is the only means of getting an education.

We have the Internet now. It make education extremely cheap. Use it.

Save actual teacher interactions for things that can't be taught over the Internet.

<comment><USER4> You can get a K12 education on Khan Academy, sure, but in the US that's already "free" (property taxes).

Can you find a collection of Coursera courses that is actually a reasonable substitute for a 4-year degree in CS? There are certainly a handful of interesting topics, but I'm not seeing the whole picture.

<comment><USER14> > reasonable substitute for a 4-year degree

You're still thinking in terms of a "degree". Education is not a checkbox on the road to getting a job. That's the old thinking, and it is doomed. A better question is what skills and experience would I need to be valuable in the workplace. Education, especially CS is an ongoing process that never ends.

Speaking from personal experience, I did a little bit of community college but dropped out because I didn't think it was worth paying tons of money for something I could learn from a $40 book (or free online now).

I'm working as a software engineer now and am earning more than most of my peers with CS degrees. No college degree, no Coursera certificates, just real world experience and learning what I needed to.

<comment><USER4> >Education is not a checkbox on the road to getting a job

Hit the nail on the head.

There is education for its own sake, for personal intellectual growth - reading, writing, and discussing philosophy, literature, (pure) math, social sciences, etc. which is really best served by a 4-year residential experience _with others who actually care about it_.

And there is education for

>what skills and experience would I need to be valuable in the workplace.

which may be best served in MOOCs, community college, specialty career training schools, or simply on the job.

Their unholy alliance in the university system is making both worse. Education for its own sake is dragged down by people who don't want to be there and don't really have the mental horsepower but are simply collecting a credential on their way to a job. It's made unaffordable to those who actually want it by all this demand from people who just want credentials.

Career training is dragged down by adherence to the structures and costs associated with liberal education (dorms, classrooms, libraries, etc), slowed down by all that "distracting" liberal education imposed along the way.

It's time the two were severed entirely.

</comment></comment></comment></comment><comment><USER15> got here looking for sugar daddies ?

[http://www.theatlantic.com/education/archive/2015/01/where-t...](http://www.theatlantic.com/education/archive/2015/01/where- the-sugar-babies-are/384547/)

</comment><comment><USER16> Slightly OT: An entertaining perspective on student debt from New Orleans artist Dee-1 [https://www.youtube.com/watch?v=JqbXQa05Z6c](https://www.youtube.com/watch?v=JqbXQa05Z6c)

</comment><comment><USER17> Because a lot of people including politicians like Obama needlessly glorified college and government started giving aide to higher education. That seems to be the problem.

Bright kids succeed. One of the way they succeed is by going into good colleges. But that does not mean any Tom dick and Harry could succeed going to any college.

</comment><comment><USER18> This article unfortunately is lacking in useful content; the real value is in the comment section. For example, one commenter says: do the first two years in a community college and save a bundle.

How we got here is a complex story that can't be explained in a few sentences loaded with obvious partisan snipes e.g. "the Republicans privatized Sallie Mae", while neglecting to mention the Bush Administration's repeated warnings about reckless lending at Sallie Mae and Freddie Mac that went ignored by a Democrat-controlled Congress. There's more than one side to the story.

One of the main problems of course is that universities find it easier to raise tuition than to cut costs. Budgets rise, tuition rises, and students simply borrow more money, in a kind of death spiral that is now reaching its logical conclusion: hundreds of thousands of graduates crippled with enormous debts and an inability to earn the necessary income to pay them off.

When I compare the campuses of today with those of the 1970s, when I was in university, and earlier in the 1960s and 1950s when my elders were in school, I am aghast at the ridiculous and profligate expenditures that have little or nothing to do with higher education. Student activity centers came into vogue in the '70s and were built all over the country: theaters, game rooms, snack bars and restaurants, activity rooms, etc.

Today they are like malls complete with food courts, clothing shops, Starbucks, cyber cafes or free wifi zones -- palatial, sprawling, with high ceilings, multi-tiered glass and steel structures that run into the hundreds of millions of dollars in construction costs and then many millions in operational costs.

Dormitories were once the most basic housing imaginable, concrete blockhouses full of doubles and triples with cheap mattresses on wooden platforms, a cheap dresser, and military style bathrooms. Today in some places at least, they are like luxury condos.

Forgiving loans is not an option. Millions of Americans worked hard to pay off their own loans and feel little sympathy for those who foolishly over- borrowed.

The only solution is a simple one: cut costs. According to my academic friends, many universities today have more bureaucrats than professors, and better paid than professors, too. Cut the staff to the bare bones, eliminate the Olympic swimming pools and town-within-a-town developments, and focus on one thing: education.

I could run a university for a fraction of the cost by renting an old warehouse, subdividing into a few lecture halls and rooms, hire 20-30 professors, a custodian or two, get a bunch of chairs and white boards and wifi routers, and poof! education will result. Students can live at home and brown-bag it. In fact I've often thought about doing this. Find a bunch of professors who are sick of dead-end adjunct jobs and offer them a way to take back their lives.

</comment><comment><USER19> Unlike regular loans, there are no qualifications for the United States of America's student aid programs and loan guarantees — they are available to any admitted college student, even if you are going to circus college.

Whereas in Germany, for example, even though universities have no tuition fees, only 28% of high school students (equivalent to 1150+ SAT) pass the exams needed to go to them. In the US, we don't pay for the whole thing, but we have no gate to pass through other than getting a college to admit you.

The problem is the implicit assumption that colleges only admit the students that are quite capable of graduating, and that the degree will be worth it. Well, those things may have been mostly true at one point, I'm sure, but without any incentives, they're not really the case now.

Graduation percentage is the key to seeing how far we fall short. First off, check out this amazing article: [http://www.demos.org/blog/5/18/14/college- graduation-gap](http://www.demos.org/blog/5/18/14/college-graduation-gap) or just look at the most essential chart: [http://www.demos.org/sites/default/files/imce/satincomegrad....](http://www.demos.org/sites/default/files/imce/satincomegrad.png)

Just to make this clearer, the average high school student scores about 1000 on the SAT (the NCAA only requires 800 for eligibility if you can pull a B average). The graduation percentages around 1000 are pretty bad, yet over 50% of high school students have gone to college since 1980, 60% since 1990 and up to 70% since then.

These graduation percentages are very challenging data. Especially looking at the students that can benefit the most from the hoped-for added earning potential. So this is difficult to confront, because it causes cognitive dissonance with our self-image as a country of opportunity.

If you were paying any attention during the mortgage crisis, you can see a pattern here. Everyone is encouraged to stretch to get the most expensive thing they can afford, and the loans are easy to come by.

Well, almost; private lenders are actually kind of strict, which means that marginal and low-ability students (or those who have poor college grades) are shut out. As in this story, they have to go to their relatives to co-sign loans instead, or lose their sunk costs (and dreams) for lack of those last few thousand dollars. Again, this is for students who aren't qualifying for debt that can't be discharged in bankruptcy...

If there was some kind of change to the employment market that significantly devalued the $1.3 trillion in student debt, that would be a heck of a write- off. So in our automated future, maybe we won't be deciding how to give everyone free money, but instead dealing with the gigantic amount of bad student loans we have on the books.

Again, this article puts student debt at $1.3 trillion. That's almost twice as much as is outstanding on all car loans, except that the cars actually exist. A lot of people never get to drive their college education off the lot. How much student aid should we budget to provide for students who never graduate, or even those who we are pretty sure never will?

</comment><comment><USER20> This sounds simply like someone complaining about what prices the market has settled on for education, for the skills that this education provides, and for loans. Yes, I too would like to earn more and pay less.

<comment><USER21> When it comes to pricing education, there is nothing remotely resembling an efficient market.

<comment><USER20> Maybe so. I don't know that that changes anything. In fact, I'm not sure what you even mean by "efficient market" in this context.</comment></comment></comment>


Webflow Visual CMS - <AUTHOR> https://webflow.com/cms <comment><USER2> Dear HN,

A bit over two years ago, this community helped my brother and I take little more than a dream and a barely-working prototype [1] and turn it into a fledgling product that we were able to launch that same summer.

From Day 1, we wanted to empower designers to build complex database-driven websites visually, but it took us another 18 months of engineering to make this work the way we envisioned. We're incredibly proud to start rolling it out today, and would love to hear your feedback!

Cheers, Vlad

[1] [https://news.ycombinator.com/item?id=5407499](https://news.ycombinator.com/item?id=5407499)

<comment><USER3> This looks good and would be better as a Show HN. I suggest you try reposting it yourself in a few days, and include the above text as a comment in that thread too.

</comment></comment><comment><USER4> So excited for this! We use Webflow to power our web site over at [http://www.payable.com](http://www.payable.com). None of our devs have touched it. That's a huge time savings. Excited to now apply it to our blog and much more in the future!

</comment><comment><USER5> How do the 'generated' sites rank in search engines? I suppose you can tweak the templates if you know what you're doing but I wonder how they perform, right out of the gate.

</comment><comment><USER6> Looks very slick, guys :)</comment>


Show HN: RandomPizza, the cheesy subscription that randomly delivers you pizza - <AUTHOR> https://www.randompizza.io <comment><USER2> Really clever idea hitting the right sweet spots of simple monthly payments and people's inherent love for pizza. Love it! #happycustomer

</comment><comment><AUTHOR> Would love to hear feedback and critiques.</comment>


An entire Mobile OS built using HTML, CSS and JS - by Mozilla - <AUTHOR> http://mobile.dzone.com/articles/mozillas-web-based-phone?mz=46483-html5 <comment><USER2> I feel like I have just seen the future and it is very bright. This would make mobile development so much easier and open up a completely new range of possibilities.

Just imagine ....

\- writing just one app that runs on every desktop and mobile phone out there.

\- apps which update entirely automatically, without any extra line of code, because they are basically just cached versions of a website.

\- a designer, who just knows CSS & HTML, can make an entirely new GUI for your phone.

\- an eco-system where the development of the interface (HTML) is completely separate from the kernel/browser and you can choose which kernels/rendering engine to run on your phone, independent of the user interface and vice versa.

\- etc. etc.

Kudos to Mozilla for their vision and for not just developing the technology, but making a good looking prototype to demonstrate it.

However, I am a little bit skeptical that a web-based OS will perform the same as a native OS, especially in terms of battery consumption. But smartphones only get more powerful and html rendering engines only faster, so it can only be a matter of time. Also a little nitpick with respect to the title: the OS not entirely build using HTML, CSS and JS, it's just the user interface, which is just small part of the OS (compared to the kernel, etc.).

EDIT: I know most of this is already possible in principle, but the user / developer experience would be completely different.

<comment><USER3> Just imagine...

\- One terrible interface for everything

\- Apps that update to broken versions without asking you and can't be reverted

\- A web designer, who knows nothing about UI design for an app let alone the specific UI conventions of each device pumping out apps

\- An ecosystem where it's a complete free for all. That always works out right?

Yeah I think I'm going to stop imagining now.

<comment><USER4> \- Everything is already one terrible interface for everything. Make a better interface.

\- The better companies will minimize this. We still depend on cloud services like Gmail, github et.. on a day to day basis. And they still mess it up occasionally.

\- There are ready designers who know nothing about UI design for each particular device pumping out apps.

\- Look at the linux ecosystem. I think its working out.

<comment><USER3> * I don't know what programs you're using. I think the iOS interface is great and rife with amazing UIs by both Apple and 3rd party devs that I enjoy using every day. If your devices have terrible UIs that are non-unique, that's your business.

* I rely on those services via clients that beat the hell out of the native web offering. Cloud services are an inbuilt way of life, cloud or web-based apps can go die in a fire as far as I'm concerned. They have two benefits: Developer simplicity and access from anywhere. Everything else is just downsides.

* Of course, but making it easier doesn't help. Just like with all fields, most programmers and software designers are amateur and lazy. IMO making even easier for these people to create terrible apps and making it the cornerstone of a mobile OS is a really bad idea.

* ...You're joking right? I don't even know where to begin with that one, except to look at Linux on the desktop numbers and then come back to me.

</comment></comment></comment></comment><comment><USER5> "This is now just running the web directly."

This makes absolutely no sense. This is borderline an insult to system developers -- because system software _is_ what the device is running directly.

I'm all for people to state a bit of sensationalist statements so they can sell there shit and be understood by the general public and so over, but this is going way too far. Being proud of an intrinsically limited product (this is a linux that runs only one program by design, so this is less capable than an android or whatever) for the improvements it can brings as side effects is one thing, but a statement like "this is running the web directly" is misleading because it will be understood as the real stuff by less knowledgeable people who will believe in some kind of incredibly innovative magic, like a magical processor "running the web" or i don't know what idiotic fantasm, instead of taking the thing for what it is: a system that can do less, with maybe _some_ advantages as a side effects, but of course some inconveniences too.

<comment><USER6> >This makes absolutely no sense. This is borderline an insult to system developers -- because system software is what the device is running directly.

It's ok. We're used to it. From the desktop to the laptop to the netbook to the phone, Mozilla and Google have been trying to exterminate us for years.

<comment><USER7> > Mozilla and Google have been trying to exterminate us for years.

I highly recommend you take a look at PNaCl: portable LLVM binaries run in the NaCl sandbox. Since LLVM bitcode can be JITed (or even offline compiled before execution), you would be looking at optimized code for whichever target you're running on. Very exciting stuff.

[http://www.chromium.org/nativeclient/pnacl/building-and- test...](http://www.chromium.org/nativeclient/pnacl/building-and-testing- portable-native-client)

<comment><USER6> Which requires that people use Chrome, running a web-browser to run native code that gets JITed from bitcode... at that point, why not just pull the blocks from the Jenga tower and run native code on your processor through an executable file loaded by an operating system?

<comment><USER7> Because installing software sucks, this is auto-updated by default and will _always_ be optimized for your processor.

</comment></comment></comment></comment></comment><comment><USER8> This runs a Linux kernel with some components in common with Android like libusb, so really linux is the operating system and there is a browser running on top of it.

Lots more info: <https://wiki.mozilla.org/B2G>

<comment><USER9> Yes, the title is misleading. It should have read "an entire phone user interface implemented in a browser" which would have been more descriptive.

I love that the mozilla guys have done the legwork of figuring out what APIs were missing in order to do that. That is a nice piece of work.

<comment><USER10> It's more than a user interface though. It's a platform for Web applications that let those apps reach all the way down to the full capabilities of the hardware.

<comment><USER9> Perhaps we share a definition disconnect. Is X11 a platform for a user interface or is it a OS?

I lean to the former definition but I'll be the first to agree that I come from an earlier time. When 'windows' came out it really was a user interface on top of MS/PC-DOS (and it still is IMO) however now several generations of folks have been brought up saying that Windows was the OS.

<comment><USER11> I don't think recent versions of windows can realistically be thought of as a UI on top of MS/PC-DOS anymore.

<comment><USER12> Can any version that was built on NT?

</comment></comment></comment></comment></comment></comment><comment><USER13> There are a lot of "looks promising" comments here. Am I the only one who thinks this does NOT look promising?

Aside from games, rendering a markup language is one the most taxing things we do on our mobile devices. When I get handed a new phone to play with, the first thing I do is load a non-mobile optimized website and see how it scrolls. This worst-case scenario is a good indicator for how laggy and jittery a mobile OS will be at sporadic times throughout the day.

Now a mobile OS built entirely on the worst-case of rendering HTML, CSS, and JS for every interaction? Sure, devices will keep getting faster as time goes on. But keep in mind that as device performance over the years increases, so do our expectations. I am skeptical that this will ever deliver a sufficient user experience when compared side by side to other mobile OSes.

<comment><USER10> And that's why we all still use Outlook instead of Gmail and Encarta Atlas instead of Google Maps, right?

<comment><USER14> I use and prefer Thunderbird over Gmail. Same for Google Earth versus maps.google.com ...

</comment></comment></comment><comment><USER15> "You can run on less expensive hardware, because you've got less technology going on under the covers. You don't have to pay the penalty of a big smart phone operating system if you're running directly on the web."

That's misleading. Sure, you might need fewer resources to pull something like a simple web page. But try using web apps that are the equivalent of native apps on Android or iOS, and you'll need a lot better hardware to run those just as well.

<comment><USER16> I think they mean that the _minimum_ hardware requirements just got a lot smaller.

<comment><USER17> Could you explain why? I might be looking at it a bit too naively, but how system build for running interpreted JavaScript apps can perform better than one designed for compiled ones?

<comment><USER16> It doesn't perform better. But at the _low_ end, you don't need to bootstrap a java VM (like Android) just to check your email and browse the web etc. You can do the little things on less hardware.

<comment><USER18> No, but you have to bring along a whole browser just to interpret code that checks the mail...

Anyway you spin it the _low_ end that can't manage android will never in a million years be able to run an "OS" in javascript. There is a reason they demo it on a SGSII ;)

<comment><USER19> They had another device running it which really was much worse then the SGSII, but with a much smaller screen it doesn't make for great video.

</comment></comment></comment></comment></comment></comment><comment><USER20> Boy, the video's constant use of " _the_ web" really annoyed me. I know that you have to cut down the jargon to make it presentable, and "HTML, CSS and JS" gets a bit confusing. What about "web technologies" or even just "a browser"?

Also: _"You can run on less expensive hardware, because you've got less technology going on under the covers."_

You can't really call a full HTML5 stack light-weight. Sure, you save some libraries, but that's mostly a space issue. I sincerely doubt that a JS-based "Angry Birds" would use fewer resources than a native app.

Having said that, I'm really looking forward to this. Hope there's a way to get it on older Android phones soon, my Nexus One is waiting for new life…

<comment><USER21> HTML5, or perhaps better termed "emerging web technologies" are an incredibly heavy stack. You have 3 different means of markup being parsed from the get- go: HTML/SGML, XML and JSON. HTML is a quite lightweight component, OK. But then you get CSS. CSS used to be simple, but it's getting incredibly complex with tons of new standardised features and vendor prefixes. Initially it just drew lines and boxes in colour with text, positioned correctly on the page according to a few simple positioning systems. Now it draws coloured boxes and lines with 3d transformations, animated, with alpha transparency, a drop shadow and rounded corners, at the same time as rendering text, and positioning them correctly on the page using several different layout systems. Then, there's the image formats commonly supported. PNG, JPEG, GIF, and ICO (Windows, favicons). SVG, a fully-featured vector graphics format which also uses CSS, as well as having its own, different animation system, and its own scripting system! Then we have common audio and video formats. MP3, WAV, OGG, MP4/H264 and WEBM. As well as the subtitle formats. Oh yeah, MathML parsing is in there somewhere too.

And then we have Javascript, a simple, not terribly complex language. OK. But we also have tons of APIs for it. The Document Object Model API. The XMLHttpRequest API. The Canvas API - a complete 2d rendering context AND full OpenGL ES 2.0. WebSockets. Local storage and session storage. IndexedDB. Game controller API. Page visibility API. Audio composition API (forgot proper name). Touch events. BlobBuilder. Geolocation. History API.

Just to name a bit of it.

<comment><USER22> Any serious candidate for an operating system is going to be complex. Personally I'm a little dismayed at current efforts to turn the browser into yet another cross-platform utopia. Some things will always be better native and pushing all this junk into the web browser just gets in the way of making basic things like a sane layout model that much more difficult.

<comment><USER23> Then just stick with the DOM and XHR APIs. Those alone have been consistently crushing most desktop applications since ~2003.

<comment><USER11> Wow. Can you clarify? Are you saying something like Google docs is crushing Microsoft Office? What DOM/XHR app is crushing photoshop?

I think there is a new class of "apps" that are emerging as web based, but they are creating a new segment as opposed to crushing an existing one.

<comment><USER16> First, JS & HTML are much more popular than Windows APIs. Second, I think johnrob meant that the DOM is more sane than most "desktop" APIs for laying out apps, not desktop publishing layouts.

</comment></comment></comment></comment></comment></comment><comment><USER24> This is a really promising direction to take for Mobile Apps. If I can write amazing HTML5+JavaScript apps for the Mobile then the logical extension to this is to write the Uber-app "Phone OS" using these technologies as well. Lets get this working on at least the Dual & Quad core beasts first and worry about the lesser-hardware ones as B2G evolves

Good work Mozilla and keep Pushing the "Open Web". A walled garden despite its many advantages, is still a Gilded Prison for some.

</comment><comment><USER25> Regardless of how it is, it's too late: Android is the new Windows, iOS the new System7, and everything else is the equivalent of AmigaOS, OS/2, BeOS, etc...

About ease of development being a gateway to shovelware, yeah right as if the artificially high and expensive barrier to iOS is keeping all the fart apps away. The fact is if there's money to be made then everyone will try to get in, even the wantrepreneurs hiring cheap coders to copy some old game and repackage it as something new (for more information check Harvest Moon).

If Android has more freemium shovelware is simply because it became the dominant OS in that industry, so wantrepreneurs are targeting that market instead, same as it happened with Windows and MacOS.

</comment><comment><USER26> Looks like with Enyo, the JavaScript app framework, and leveraging this new Boot2Gecko, smartphone hardware will become the focus rather the phone OS.

<comment><USER27> As I was watching the video I was thinking the same thing that WebOS has been out for years. I'm sure the underlying technology and framework is quite different from Mozilla, but it's not a ground-breaking idea.

Perhaps they should take the opportunity to work on the newly open sources WebOS which is likely to be able to grab more market share than an entirely new Gecko OS.

<comment><USER10> WebOS uses JS+HTML but it does not expose nor advance standards-based APIs for all the phone hardware capabilities like B2G. Also, WebOS requires you use their framework where B2G lets you use any frameworks or no frameworks -- it's really just like the real Web plus a bunch of DOM APIs for things like the phone's telephony stack and vibrator and accelerometer and all that.

</comment></comment></comment><comment><USER28> Just looking at that demo makes me want to install it. I wouldn't mind running a unstable version if _basic_ stuff would work (i.e. - calling).

Unfortunately I own this Tegra2 based POS thing and I'm quite positive that I'll never see even a glimpse of the B2G experience on this device.

Still, this is remarkably close to the WebOS approach and - I like the idea very much.

</comment><comment><USER29> This definitely blurs the line between calling an app native or web based, at least from a business-marketing standpoint. However, far more interesting is to see the waves of innovation that APIs have created. APIs are becoming the personality of computer systems in the sense that they allow interaction and shielding from the outside world. As long as developers know how to interact with a system's personality they can now build just about anything. Furthermore, experience is becoming the new IP so I believe that such technologies will bring more and more experience innovation by providing easier and faster paths for high-level programmers to contribute to the ecosystem.

</comment><comment><USER30> So, I noticed there was no mention of multi-touch events in the video, and none of the apps demonstrated used multi-touch. I did some digging to see whether this was a gap or whether mozilla had been working on multi-touch in browser (since the consequences of such a change for JS APIs are interesting to consider).

Mozilla has apparently been working on multi-touch in browser as one can see in these two links:

<http://hacks.mozilla.org/2009/08/multi-touch-firefox/>

<http://hacks.mozilla.org/2009/10/multi-touch/>

<comment><USER31> It is possible they see their OS as being suited for one-handed devices. One of the things I do not like about Ice Cream Sandwich on my Galaxy Nexus is Google has removed the "+"/"-" buttons in most of their native apps so now I have to either use some really unwieldy one-handed finger contortions or use two hands to zoom in and out. I think an argument can be made that in many instances at least on a smart phone as opposed to a tablet multi-touch while being fun to use is actually a step backwards in usability.

<comment><USER32> Did you try double tap to zoom?

<comment><USER31> Yes. You can't zoom out that way though.

</comment></comment></comment></comment><comment><USER33> The reason I'm excited about this that I won't need to wait for the carriers to update my UI. I imagine there will be a whole rage of interesting 3rd party interfaces I'll be able to browse and download.

Want and interface that's just command line. Somebody will make it.

What about an interface for Grandma that just has really big fonts in just a dialer, contacts and photo album.

I feel like I got burnt when I bought my 7" Samsung Tablet because Samsung is not supporting it anymore and it has some really clunky interfaces.

I would love to see and ecosystem where I have full and easy control to install and remove apps from my phone easily. Fingers crossed.

</comment><comment><USER34> So, this is WebOS, over again?

What is different about this other than Mozilla making it?

Appreciate any insights.

</comment><comment><USER35> Is everything cached to the device? What are my limitations in "airplane mode"?

I don't mind the concept of making cross-platform apps. My limited knowledge of HTML/CSS has shown me that while it is extemely difficult to make robust content look good across multiple browsers/platforms, it IS possible... but will developers really have the access to multiple platforms to test their UI on?

</comment><comment><USER36> This is awesome.. and it is the way forward if every device can just run a browser then what is the need for an OS, you can port anything straight to the browser.

With the likes of HTML5, jQuery, WebGL, AWS everyone could be making their own OS on the web.

It is really not that hard or revolutionary it's just using existing services effectively.. Let's carry on this way.

+rep for mozilla (gone up in my estimates)

</comment><comment><USER23> I love the mentality behind this effort. More stuff can and should be done in the browser on mobile devices. For this to succeed, the most important problem is not exposing mobile hardware (camera, gps, etc) - it's user input. The cornerstone of the web is typing a url into the address bar, and typing is still a miserable experience on phones. Clicking links on touchscreens isn't exactly stellar either (hence the new verb 'fat-fingering'). If someone can solve these problems, the browser stack is already powerful enough to do to phones what it already did to the desktop.

<comment><USER37> FYI, 'fat-fingering' or 'fat-fingered' isn't really that new and I've more often heard it used in regard to keyboards on computers.

<http://www.urbandictionary.com/define.php?term=fat%20finger> has a definition from 2005 but I think I had heard it as early as 1997.

</comment></comment><comment><USER38> The user interface doesn't look very smooth. It doesn't matter how good the UI looks (and it does look good) if it doesn't feel right.

<comment><USER19> It's improved significantly since that video.

<comment><USER39> Interesting. Do you have a video or link?

<comment><USER19> No, unfortunately. Most of the videos going around (read: all of them) are from MWC where B2G was demoed.

The development group is VERY active on IRC and there was some chatter at the time about that. Some of the slight lags in the demo were actually parts of the CSS transition they use (originally intended to avoid accidental swipes when they wanted taps) and was tweeked to be much better not long afterwards.

More recently there have been significant improvements in the actual CSS animation on the gecko side (improvements which will hit firefox in the future) which means everything feels even faster and more natural.

At this point B2G is making significant progress _every day_ so about the only real way to get an up to date idea of how it runs is to either read the github commit log frequently or put it on a device (and currently that means a GSII)

</comment></comment></comment></comment><comment><USER40> He is right about one thing: every device should be able to download and run html apps natively.

</comment><comment><USER41> That would be awesome if it actually became a mainstream mobile OS.

Otoh, what about security here? Having JS from a web site dial the phone or taking pics? How will they make sure that lazy I-don't-read-popups-but-just- click-okay users will not get pwned?

<comment><USER42> Dialing the phone and taking a picture work no differently than they currently do on iOS/Android - your app simply calls the device's native functions and then the OS takes over the operation. And once the operation is complete/cancelled, focus can return to your app if you set the proper callbacks.

Potential security concerns would be akin to the Chrome-extension snoop and inject issue where a random app or web-page could potentially try to read/write the data of other apps if the security model isn't setup right. But these are problems fixable in the short-term. On the plus side, as the phone owner, I might be able to redesign the OS dialer by changing some CSS and finally have a phone pad that goes 7-8-9/4-5-6/1-2-3 like a num-pad instead of 1-2-3/4-5-6/7-8-9.

</comment></comment><comment><USER43> We already have a lot of miles on ChromeOS. Why isn't it more popular? Is there anything fundamentally inferior about a device that is all web browser? Will B2G have the same barriers?

</comment><comment><USER44> Google is laying the groundwork for this as well. Chrome is slowly making its way into Android & my guess is that Chrome Apps are going to be next.

</comment><comment><USER45> Pretty cool. This is like a spiritual successor to WebOS, which was awesome btw.

Though, WebOS didn't take the API idea nearly this far.

</comment><comment><USER46> I like how that video in the "HTML5 zone" was using a flash player...the irony was amusing.

</comment><comment><USER47> Would this not dramatically increase data usage? ie data fees to carriers

<comment><USER48> It's 'the Web', i.e. a set of HTML pages with some CSS and JS, with access to a few newly developed APIs, like the one for dialing the phone, but running locally on the device, not remotely.

<comment><USER49> Does anyone know how the sandboxing works to allow a camera, gallery and dropbox app to access the same locally stored image files? Or for local contacts to be shared?

<comment><USER19> A media API is being developed (in co-operation with the W3C) to allow exactly that.

Further, apps will be able to request "trusted app" status to run with less cross domain restrictions.

</comment></comment></comment></comment><comment><USER50> Its just like what ChromeOS did to the Desktop/Laptop world.

</comment><comment><USER51> Mozilla should skip working with the carrier just go to the phone manufacturers and develop their own phone. Once they have their own phone it's only an matter of time before carrier jump on board with them.

Imagine the $50 smartphone!!

</comment><comment><USER52> Who decided to market this as an _operating system_?

</comment><comment><USER53> This is actually a battle cry for Mozilla. The desktop GUI paradigm is done for, it's at the end of the line. Once desktops die off in popularity there will be no growth for web browsers like Firefox unless they own the whole stack like Apple and Google have successfully done, and Microsoft and RIM are attempting to do. Mozilla is developing Boot2Gecko because without expanding into a full mobile platform Mozilla is in a really tough spot in the smartphone/tablet markets. Predictions for the future put Apple/Safari at 45% marketshare, Google/Android at 54% marketshare, and the 1% scraps left over for RIM, Microsoft and now Mozilla.

Mozilla will to have sell an awful lot of these phones for their organization to be viable in the future.

<comment><USER6> I'm sorry, desktop GUI applications are _done for_.

Someone please notify _my entire computer setup_ of its impending death. Also, my wife, my mother, my brother, my stepfather, my father, and _everyone else I know_.

Hey, everyone, your computers are dead! It's time to convert to WebSmartiPhonePadTablets running nothing but web-browsers! Sure, you don't want to because they run like crap compared to _actually writing native programs_ , but they're a growth market for corporate behemoths!

<comment><USER53> Ah yeah I should have expected such pedantry on HackerNews. You know very well I didn't mean you were going to stop using Windows immediately. I said nothing of the sort. You didn't even have the respect to read anything else I said or even acknowledge that I said anything else. Instead you pointlessly nitpicked at a generalization and added nothing to this thread.

</comment></comment></comment><comment><USER54> "This browser-based OS will revolutionize how users interact with their apps and how developers write their apps, allowing everyone to take their apps everywhere." -Jon Rubinstein, January 2009, commenting on webOS

(not a direct quotation)

</comment><comment><USER55> Didn't they try this with HP web OS. That failed I wouldn't put money on this.

<comment><USER56> I had the original Palm Pre with WebOS. The OS itself was actually top notch. I absolutely loved it. I believe it failed because Palm just didn't have enough weight behind it (like Google or Apple have) to make it reach critical mass.

That said, this isn't the same as WebOS. WebOS ran javascript apps, but they ran on the device itself. From what I can gather, B2G is running everything on the actual web. It's very different.

\--

Edit: I may have been wrong there. Apparently it is running locally. This quote from the web page through me off:

"You don't have to pay the penalty of a big smart phone operating system if you're running directly on the web"

That's a bit misleading.

<comment><USER10> B2G runs apps from the web and locally cached for offline use. B2G apps are not required to use some non-standard library to get at the phone hardware like WebOS did. APIs for camera and telephony and vibrator and accelerometer and all that in B2G are proper DOM APIs that will be web standards.

</comment></comment></comment><comment><USER57> looks promising!

</comment><comment><USER58> As a prototype this is cool, as a daily use phone, it kind of sucks. Scroll/swipe latency, anyone ? P.s iOS user here...</comment>


Ask HN: How can the Government increase the number of entrepreneurs? - <AUTHOR>

<comment><USER2> By staying the heck out of the way.

In any kind of society, no matter whether centrally planned or not, there will be people who seek out and solve needs for others, with an expectation that they'll be compensated. Even in the communist USSR, people would have side- businesses, sometimes dealing in the black market. While "illegal", these businesses were able to thrive because someone was there to fulfill the needs of others.

One of the worst things to do is to create government programs "to increase the numbers of entrepreneurs". Why? Because while some entrepreneurs will benefit, those who benefit the most are the same characters who know how to work the government to their benefit. Example: the government has set-asides for "small and minority-owned businesses". I've seen large companies partner with some small businesses, set a minority person as a figurehead, use their own people to successfully pursue the government contract, and laugh all the way to the bank. Small business, minorities, and even the figurehead guy don't really benefit from the scheme, do they?

If you let people keep more of the money they make, rather than redistribute it in an attempt to build entrepreneurship, then those who make products or deliver services _that are needed_ will benefit. Otherwise, it's just those who are best at playing the game.

<comment><AUTHOR> I wasn't really talking about 'schemes' and 'initiatives' here. I wanted something more material. Very specific policies that could have a positive impact. I definitely didn't mean eye-catching new mechanisms that would radically disrupt the free-market, like corporate giveaways.

One might be Intellectual Property reform. Another might be the introduction of computer science into the UK/US curricula. Another might be the liberalisation of immigration policy. Then there's superfast broadband infrastructure roll-outs. Maybe strengthening competition law in some online markets. Etc. Etc.

Couched in a different terms, I might say: I agree that the Government should get out of the way. But /how/ does the Government get out of the way?

I wanted to understand how to organise the traditional hierarchy of digital policy priorities.</comment></comment>


Ask HN: Question from a luddite re: cookies/web tracking, particularly by Criteo - <AUTHOR> Hi there, hackers! I experienced something very disturbing a few days ago that's been eating at me. To preface, I completely accept that browsing free websites and free content comes with the trade-off of tracking and advertising attempts. I'm not particularly tech savvy but I am careful about my internet habits because privacy is a concern for me.
Here is what happened: I was searching google for a stock photo. I clicked on one, which took me to a site called tradesy. I clicked within the tradesy website to look at the photo, but it was not what I wanted, so I clicked out. Moments later, I got an advertising email at my personal (yahoo) address from tradesy. Feeling thoroughly violated (and not in a good way), I discovered that the email was sent by Criteo, a "retargeting" company.
Somehow they got an email address that I have not used on any website, ever. I use my "spam" address for anything internet/app. The only people that have my personal address are, well, people. I am 100% certain that I did not give Tradesy my personal email address. I even checked my browser's auto-fill log and confirmed that no website has my personal email address saved. I have ad blockers and ghostery.
1) How did this Criteo company get my personal/private email address?
2) How is this okay? I don't mind some degree of advertising, but my comfort level is limited to not getting my name/address/phone number/email or other highly personal information that I should have control over, effectively stolen and used to spam me.
3) How can I block this company and similar ones from my online life? I already don't use Facebook/other social media.
I truly want to understand this phenomenon and the current internet advertising/privacy landscape, so if someone out there is able to clue me in, I would be very interested to learn. If you live in SF, I will even buy you coffee if you want to enlighten me in person! <comment><USER2> That's awful, corvallis. I agree with you that it's super-sketchy.

I admit that I use tracking cookies on my website, but I looked to find a company (RocketBolt) I was comfortable with. Gotta keep my customers' trust at all cost, and the RocketBolt cookies I use end at the border of my site, don't tap into any private databases, etc. I'm simply trying to find ways to offer relevance to my customers. Honest question: does that level of tracking upset you?

I've never heard of Criteo, but I appreciate the heads up.

</comment><comment><USER3> Found this article after some googling:

[http://www.independent.co.uk/life-style/gadgets-and- tech/cri...](http://www.independent.co.uk/life-style/gadgets-and-tech/criteo- and-the-dark-marketing-arts-that-are-growing-ever-more- sophisticated-a6731106.html)

>Some light digging unearthed the fact that the company responsible for this particular dark art is called Criteo, and the MD, John Buss, was happy to talk me through this relatively new technique. It's all legal, all cookie-based, but crucially its database – which learns about me and how I click around websites – anonymously links up with databases of email addresses it has licensed from other companies operating online. A match between the two, along with an assessment that I might be likely to splash some cash, triggers an email.

>How did my email address end up in the database in the first place? Well, at some point – and goodness knows how, because I do my utmost not to – I opted in to receive some communications "from selected third parties".

<comment><AUTHOR> I could swear up and down that I have never used my personal address on any website/app ever. (I use my "spam" address for all internetting.) So if I had accidentally opted in somewhere, it would have been with my "spam" address. Even then, they should not be able to get my email address, period! My fear is that they have other info that I am supposed to have control over, such as my address/DOB/credit card/SSN. Can they mine all of those things just from cookies/browsing or when I purchase something from amazon?

The reason I am fairly concerned about privacy is due to the nature of my work and the fact that I have a unique name. As it is, you can find my whole family and their address/phone number on a search's first page. I feel even less secure knowing that my sensitive personal info is so easily mined and distributed despite my best attempts to block ads/cookies/tracking and stay away from clickbait/social media who I would assume to be the primary offenders.

I am also a little surprised that no one else seems terribly bothered and a company like Criteo is instead lauded for its innovative methods. Do we as users just have to accept that a lack of control over personal info is the new normal?

</comment></comment><comment><USER3> I would recommend you to block third-party cookies in browser settings, that's probably how you were tracked - the same cookie(s) were used on tradesy and some another site which could connect you to your email address.

UPD A couple of relevant posts:

[https://freedom-to-tinker.com/blog/dreisman/cookies-that- giv...](https://freedom-to-tinker.com/blog/dreisman/cookies-that-give-you- away-the-surveillance-implications-of-web-tracking/)

[https://freedom-to-tinker.com/blog/englehardt/the-hidden- per...](https://freedom-to-tinker.com/blog/englehardt/the-hidden-perils-of- cookie-syncing/)

[https://freedom-to-tinker.com/blog/englehardt/how-cookies- ca...](https://freedom-to-tinker.com/blog/englehardt/how-cookies-can-be-used- for-global-surveillance/)

<comment><AUTHOR> I already block third party cookies. I have it set to allow cookies "from current website" only. I had once tried to set it to never but then I couldn't log in anywhere so that was a bust. I really don't know how they would have gotten my personal address if I never enter that one anywhere. I only use my "spam" address for any/all internetting. That's what is most creepy to me. Thanks for the links! Mostly over my head but maybe someone else reading this thread will appreciate.

<comment><USER3> Hmm, interesting! I assume you use Safari ("from sites I visit" is their preferences language)? In the last link authors actually differentiate between "Some 3p = Safari-style third-party cookie blocking" and "All 3p = Blocking all third-party cookies", so I guess Safari's method of blocking is not the strictest.

Another possibility is that you use some rare static IP, which Criteo could somehow connect to email. But it's probably a stretch.

Keep in mind also that some of your correspondents could agree to share their email list on some site or to some app, so that could leak the email itself and real name (but still it's unclear how it was connected to your browser).

<comment><AUTHOR> Yes, I use Safari! I actually have cookies set as "from current website only" \- I wrote the wrong one and edited. I suppose it's possible that one of my contacts entered in my personal email in some new website/app referral and that's how it was mined, but I clear out my cookies fairly often and don't remember clicking on anything in the recent past.

Here is the note on the bottom of the email from Tradesy/Criteo:

To opt-out of receiving Tradesy emails, click here. This message is personalized by Criteo Email based on your previous browsing behavior. To understand why you received this email and access Criteo Email privacy policy, click here. If you want to opt-out only from Criteo Email personalized emails, click here.

When I went to their email privacy policy, it doesn't explain how they got my email address.

I am very disturbed by this kind of stealth data mining. Is there a way to set up my browser to become more anonymous on the internet? Clearly my ghostery and ad block is not effective. I deleted my Facebook and Linked in after Linked in somehow spammed me to link contacts that I sold random crap to on craigslist (and probably spammed them too.) Somehow they both still deposit cookies. I am willing to pay someone who is familiar with this landscape to block trackers from invading my internetting. Or block websites that use criteo and similar. Is this possible?

I'm not one of those people that wants to go "off the grid". I use credit cards, I use amazon, I know what I'm getting into. It just seems like Criteo has crossed a line.

<comment><USER3> This all is actually puzzling, because ghostery should theoretically protect you even if Safari doesn't block all third-party cookies. You can try to switch to uBlock which is similar in functionality.

Are you sure you don't have some shady/little-known extension/plugin/app? Those can share browsing history with advertisers. Some freeware firewalls/antiviruses can too (just googled an example: "AVG, the Czech antivirus company, has announced a new privacy policy in which it boldly and openly admits it will collect user details and sell them to online advertisers for the purpose of continuing to fund its freemium-based products. This new privacy policy is slated to come into effect starting October 15.").

Maybe try to communicate with someone from Criteo (not support, but somebody higher) and describe your weird case?

<comment><AUTHOR> I went to confirm that I only had the three extensions (ad block, ad block plus, and ghostery) and when I clicked into the ghostery settings, it turns out that none of the trackers were selected to be blocked!!! Not sure how long it was like that, or how, but it's fixed now. Do you think this explains how they got my personal email address? I am still not seeing the connection, but there are obviously many things I don't understand about this space.

<comment><USER3> I don't quite understand how Safari's third-party cookie blocking works :( According to the link I posted it's more relaxed than Chrome/Firefox's third- party cookie blocking, so some cookies are allowed. But how is that decided?

Theoretical possibility then:

You still use that personal email in the same browser? That means you visit Yahoo website, which can set some cookies identifying you, including third- party ones (advertising/tracking), if those are not blocked by Safari. The same tracking cookies can be used by Tradesy, so that site can tie your visit to your Yahoo identity.

<comment><AUTHOR> I think you solved this!

I actually use the Apple mail client, so I get my spam mail and my personal mail in the same interface. My angry deleting of cookies and web history following the Criteo email would have cleared any log ins, but I haven't used the yahoo mail web interface for many years. However!! I remember going to flickr briefly about a month ago, and since it is a yahoo service, it would have been connected to my personal yahoo ID/email address (correct?). It's possible that I never logged out, so could it have mined my address that way? I am still incredulous and outraged that Criteo could use this to mine my address and spam me, but this could be how they got my personal email/yahoo ID.

Thank you so much for your insightful comments and for "investigating" with me! Even though this is still somewhat mysterious, I've learned from this and also discovered my ghostery settings were off which was very valuable. Now I just have to figure out how to block Criteo and similar invasive species. I may have to go off the grid after all.</comment></comment></comment></comment></comment></comment></comment></comment>