'Just four dudes': Inside EasyList, a community-run ad-blocking list - <AUTHOR> https://digiday.com/media/just-four-dudes-inside-easylist-community-run-adblocking-list-disrupting-internet/ <comment><USER2> This piece feels like it wants me to be upset about the maintainers of EasyList, instead of the people that created the content which has become so toxic that people are scrambling for ways to block it.

<comment><USER3> Indeed. Once I finished the article I sat there and had to think: "what am I supposed to be feeling after reading this?". I _think_ they want us to be angry that EasyList is only maintained by 4 people. Or maybe just be angry that EasyList exists. I'm not really sure.

My takeaway was that it's pretty impressive they still respond to exclusion requests in a timely manner.

<comment><USER4> I was surprised it was that hard to change a route on autotrader. The article kept mentioning hundreds of thousands of pages, like they had some person editing each page in textmate.

<comment><USER5> Maybe Autotrader has hundreds of thousands of template, CSS, and JS files with those paths hardcoded. Imagine the hell it would be to work on that website.

Even so, you could fix everything with a one line Perl command.

<comment><USER6> I would love to see an example of something like this.

Please.

<comment><USER7> I've seen backends that were that horrible. Updates were often done via regex's.

<comment><USER6> That's basically half of my day to day at the moment, that's why I'm wondering

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I did run into the same issue as mentioned in the article and the Easylist forum is full of publishers having complaining that their site doesn't work anymore.

I started working on [http://blockedby.com](http://blockedby.com) , a monitoring tool to warn you when a rule would impact your website.

But after contacting a few websites that did have the issue on the forum, I couldn't find any that actually wanted to prevent this. A few discussions with publishers told me that they're more interested in convincing their users to give up on ad blockers rather than face the fact that people are not going to abandon ad blockers.

<comment><USER9> I had an issue with this recently, where buttons simply linking to our Twitter and Facebook pages were being blocked.

I'm no fan of obtrusive, JavaScript laden ads, and have used adblockers myself for years, but why block "legitimate" content?

I didn't know how to get removed from the list (and assumed it wouldn't happen anyway), so changed a couple of class names and it was working again. But I don't know how long the issue was there before I realised it :/

<comment><USER10> Depending on how they're implemented, buttons linking to your Twitter and Facebook pages can double as trackers for Twitter and Facebook.

Anyway. People rarely intend to block legitimate content. At the same time, it's not always easy to tell what is and isn't legitimate when you're writing fairly general rules.

<comment><USER9> These were just:

`<a href="our_twitter_page"><img src="/img/locally_hosted_image.png"></a>`

</comment></comment></comment></comment><comment><USER11> This is basically a hit piece on Easylist.

My take after reading this, is that the author wants EasyList to either not exist or to be run by "experts in balancing publisher monetization" (aka adman)

<comment><USER12> Not just basically - it is a hit piece. It's a website run by and for advertisers, publishers, and media, aiming to monetize content as much as possible. They are supported by advertisers masquerading as ad blockers (uBlock trying to pretend to be uBlock Origin) and sites that literally just advertise.

Just another day of unsavory corporations and the assholes that run them trying to mislead the average consumer.

</comment></comment><comment><USER13> >But it's not like they were experts in balancing publisher monetization, or like they were elected. They're just four dudes.

They were elected by people voluntarily installing EasyList. We had enough of you experts™, thanks.

<comment><USER14> Seriously -- every Adblocker will allow you to subscribe to custom lists, there's no vendor lock-in, there's no network effect, there aren't significant regulatory or commercial barriers to entry. This isn't like Facebook.

Blockers like Ublock Origin also don't benefit from legitimate sites breaking; if they're turning on EasyList by default it's because they think it's currently the best balance available for their users.

If anyone can make a better list than Easylist, then they should just go do it. In fact, companies _already_ tried to make an alternative with the Acceptable Ads initiative -- and if their list is better, people will switch to it. The only barrier of entry to displacing EasyList here is quality over time.

</comment></comment><comment><USER15> > UBlock, another Adblock-owned blocking extension

TIL According to Wikipedia: "In July 2018, uBlock.org was acquired by AdBlock"[1]

This is not uBlock Origin.

[https://en.wikipedia.org/wiki/UBlock_Origin](https://en.wikipedia.org/wiki/UBlock_Origin)

<comment><USER16> Correct. More information from the source:

[https://github.com/gorhill/uBlock/wiki/uBlock-Origin-is- comp...](https://github.com/gorhill/uBlock/wiki/uBlock-Origin-is-completely- unrelated-to-the-web-site-ublock.org)

<comment><USER15> I knew it was owned by someone else, I didn't expect it to have been sold to Adblock Plus though! I wish they would just hand the domain over to gorhill. It feels shady that they squat on it for the name recognition.

<comment><USER17> Aljoudi hijacked the "uBlock" name from gorhill (apparently because gorhill was more concernted about building a good tool than maintaining trademark protection, and I guess no one volunteered to donate (para)legal work), so handing it back would be a "wish" indeed.

[https://en.wikipedia.org/wiki/UBlock_Origin#uBlock](https://en.wikipedia.org/wiki/UBlock_Origin#uBlock)

</comment></comment></comment></comment><comment><USER18> > _But it's not like they were experts in balancing publisher monetization_

Yeah they are, the balance they're targeting is zero ads.

</comment><comment><USER19> Quote: "In the past six months, EasyList changes have broken the buy buttons on commerce site The Inventory, the video player on Animal Planet, disrupted site navigation on Fandom, and disrupted the style and CSS loading process on job search site Indeed."

Good, very good. Break them all. Learn to go back to basics, use TABLE, not gazzilion of nested DIV's for what should be a single BUTTON element instead. I run uBlock Origins, NoScript and Privacy Badger; and whenever I go, to clients, friends, family, I'll always put them up. Your shitty site has the same merchandise like many others and if your "buy" button is broke I'll just go to the next site...and while on this, how come Amazon "buy" button is not broke? Almost feels like Amazon devs actually test with ad-blockers their content before allowing it on the wild.

<comment><USER20> > I run uBlock Origins, NoScript and Privacy Badger; and whenever I go, to > clients, friends, family, I'll always put them up.

Yes! I'm doing this too, as a kind of community service. If sites get broken because their privacy-invading "like" button doesn't work, that's on them. People will just move on.

</comment></comment><comment><USER21> "Inside EasyList", yet the author presents precisely _zero_ inside information / information from EasyList insiders.

</comment><comment><USER22> I don't get the title - Just four dudes. What if it was four dudettes/chicks? Maybe it's because they started the project and they have the right to be in charge? Also, you don't have to use EasyList if you don't like it..

FYI those four dudes are whats keeping me from disabling javascript and images from every website on the face of the earth.

Thank you EasyList maintainers!

<comment><USER23> I suspect that the editor didn't actually read the text but nevertheless chose the most obnoxious title possible (as they often do)

</comment></comment><comment><USER24> >"It's crazy that more people don't know about this," said Marty Kratky-Katz, the founder of Blockthrough, which lets publishers monetize using Adblock Plus's Acceptable Ads program. "I don't think they mean any harm or have any malicious intentions. But it's not like they were experts in balancing publisher monetization, or like they were elected. They're just four dudes."

Why would you ever want your adblocking list run by "experts in balancing publisher monetization"?

<comment><USER17> Because moral fiber includes _some_ notion of acceptable ads, even if current models tend to bad.

However, I suspect that Easylist already supports acceptable ads in the form of "route the ads through the publisher's domain/servers" which puts accountability where it belongs, so it doesn't need further expert advice.

<comment><USER25> > Because moral fiber includes _some_ notion of acceptable ads, even if > current models tend to bad.

Maybe _your_ moral fiber. Definitely not mine.

<comment><USER26> Kinda had the same reaction, but if you went to your friend's house every week and drank all his beer an never gave anything back, eventually that would make you feel bad.

If I'm getting something that required skill and labor, 'moral fiber' suggests some quid pro quo. How are you going to reciprocate?

At some point someone observed "we can profit off of audiences" so that answer was "by being an audience member." But now it's kind of a mess, and either we haven't found a better model or inertia and collusion have prevented it from arriving.

<comment><USER25> I'm not sure I really agree with the analogy, but there are other approaches that don't involve assaulting my senses. For instance, they could just flat out charge money for it.

On a tangentially related note, I think there's a special place in hell for the engineers that created gas pumps that display ads while fueling. Those things are pure, unadulterated evil.

<comment><USER26> It would be better if your friend insisted you bring beer instead of launching into a sermon or his MLM pitch, sure.

But we're talking about moral fiber. For some people "they hit me first" is not ethically sound. There's some ambiguity here about who hit first, but rather than a fair exchange we are getting what is rapidly approaching brinksmanship. Nobody is really in the right here.

But we also can't seem to just go back to a paid model for high production values. We are satisfied with amateur work and underpaid professionals slowly burning a nest egg and hoping something changes. The advertisers are the only ones with a hand out, so they get to set the agenda.

I had hopes Brave was going to alter this trajectory but there seems to be some regulatory capture there. i kind of wonder if they hired some ad people and charisma won over the origin story.

</comment></comment></comment></comment></comment></comment><comment><USER27> > _But there are occasions when those changes are hard to make. In Autotrader > UK's case, for example, the change would have involved fixing hundreds of > thousands of pages._

I've got a lot of questions I'd like to ask about why exactly that's a big task.

</comment><comment><USER28> These dudes doing great job, just imagine how much energy consumed google analytics and tons of any kind of social network scripts.

</comment><comment><USER29> It always amazes me that journalists still have no clue how open source work.

And also they should talk about uBlock Origin. Not AdBlock Plus or UBlock.

<comment><USER30> This is not journalism. This is a hit-piece on EasyList, with a clickbait and false title.

It seems even plausible, reading it, that the author knows about uBlock origin but avoids naming it, instead listing the two sellouts that are morally shady.

<comment><USER31> I got similar vibes going through the article and after finding out that they are actually a Ad-centric company, I am almost sure you're right.

</comment></comment></comment><comment><USER32> I fear that with adblocking nearing 25% market penetration we're going to see fundamental changes in the way ads are delivered in response. Maybe a transition from third party ad servers to locally hosted ads that have to be added to block lists individually. Maybe YouTube will start inserting unblockable ads directly into the video stream.

Fine people like Raymond Hill will keep fighting the good fight but I wonder if someday we'll look back on the era where web content was paid for by the 90 percent of people who don't block ads so the 10 percent could block them effortlessly as a sort of golden age.

<comment><USER33> If that happens, projects like Adblock Radio will hopefully step in to make "unblockable" ads more tolerable, by automatically turning the volume down for example.

[https://www.adblockradio.com/en/](https://www.adblockradio.com/en/)

<comment><USER17> Isn't that a Browser feature that was/is fixed in 2019?

Unrequested audio is flat-out absurd behavior in a browser.

<comment><USER33> I was responding to the possibility of YouTube just embedding ads directly into the video to thwart current ad-blocking techniques. If that happens the audio would already be playing before an advertisement started. Something like Adblock Radio is a more sophisticated approach that could still detect ads like that.

</comment></comment></comment></comment><comment><USER34> At some point, for popular sites, the strategy will flip from filtering to scrapping.

We'll need some clever strategies to counter the arms race.

Image side-by-side visual diffing. Some process renders pages with and without ads. Ads are progressively identified and removed until it renders like the "print" or "reader" view.

Temporal diffing. Snap shot popular websites over time. The meat (content) will likely remain the same. Everything else is chrome or ads.

My other ad detecting notions are even more harebrained, so I'll stop there.

<comment><USER35> Doesn't seem like that effort is worth it now that content these days are basically ads. And you can't block them with a simple DOM/URL filter trick.

[https://www.reddit.com/r/HailCorporate/](https://www.reddit.com/r/HailCorporate/)

</comment></comment><comment><USER29> I remember [https://serpapi.com](https://serpapi.com) breaking with EasyList because we use Prism.js for code syntax coloration. And Prism.js is also the name of a tracker. Opened a ticket with them. However it has been easier to just rename `prism.js` to `pri-secure-sm.js`. Not sure why author is so upset about that. It's not like they are trying to break websites on purpose.

<comment><USER36> Because they're breaking things without much regard to it.

We discovered a few years ago that our list of advertisers (in a digital magazine) was being blocked by ad blockers. It was coming over the wire with the word "advertisers" in the URL. These aren't ads that pop up and display on the pages, but simply a list of advertisers in the issue.

Rather than try to get adblockers not to block it, we simply used another word in our URL and went on with things. We shouldn't have _had_ to. Those are lazy adblock rules and are incredibly likely to get false positives and break sites.

But we're realists and knew that even if we fixed the existing adblockers, another would come along and do the same lazy thing.

<comment><USER37> > Because they're breaking things without much regard to it.

This claim comes accross as disingenuous. These guys are trying to block ads accross the whole internet without ruining the user's core experience. Maintaining a hard-coded black/whitelist of URLs and elements simply wont cut it. Sometimes there will be false positives.

If this impacts enough of your users, then it's your responsibility as a web developer to test your site on environments that reflect your users' and make something that works on _their_ environment. You can always choose not to support those users, but that's _your_ problem.

</comment></comment></comment><comment><USER38> Many (even pretty well-known) Open Source projects would be happy to have four regularly active maintainers.

"Just four dudes" sounds dismissive, but everyone starts out as "just one dude" (or dudette, or whatever the proper female form of dude is), and sometimes, more join. Often that's not the case, and the project's health hinges on just one maintainer.

</comment><comment><USER39> This piece is a hit job in favor of the not-really-ad-blocking "monetizing" adblockers

</comment><comment><USER40> Nice try at spinning blame here, if publisher's didn't use such scamy Ad platforms and tracking we would be here.

</comment><comment><USER37> > the change would have involved fixing hundreds of thousands of pages

Even if these pages are static files (although any site opetating at that scale should have some kind of page-generation system), this still sounds like it could be resolved with a simple find-replace using <insert your favorite text editor>.

EasyList is definitely in the right here. Adding an exception results in an unnecessary performance penalty and creates more complexity for the project. Both of these impacts are small, but they can't afford to accommodate for every website like that.

If they want their users to use their site, they should make it work on their user's environments. I doubt they would demand Google or Mozilla accommodate for them like that.

<comment><USER41> Several years ago I worked on a monolithic website that used static files with no templating engine. The problem is they had so many contractors working on changes for specific ranges of content that there were a variety of ways that even a mundane meta tag with the same content value was written (is the tag self-closing, is the value placed before the property, are certain characters in the value encoded, etc.). Find & Replace can quickly end up becoming a bigger game of Trial & Error especially if there are no standards in place.

</comment></comment><comment><USER42> "It's crazy that more people don't know about this," said Marty Kratky-Katz, the founder of Blockthrough, which lets publishers monetize using Adblock Plus's Acceptable Ads program. "I don't think they mean any harm or have any malicious intentions. But it's not like they were experts in balancing publisher monetization, or like they were elected. They're just four dudes."

Reading the article, "balancing publisher monetization" provoked an immediate visceral vocal response from me. Truly hilarious.

</comment><comment><USER43> Useless article is useless, there is no point in emphasising the maintainers are men. No one is preventing 4 women or LGBTQ+ from starting a list with a better end user experience. But I guess their end goal is "balancing publisher monetization" which is too optimistic, no one would want to see slower pages with crap wherever they go.

</comment><comment><USER44> Is it that onerous for folks to maintain their own whitelists? Chances are, most people spend 80% of their browser usage in 20% of sites visited.

They couldn't be widely shared, but they're less whack-a-mole in practice and from a security perspective, a more superior solution.

</comment><comment><USER45> Okay the ads are no ads anymore are web experiences. Seriusly i barely can understand the level of corporatism this days, this is not an article is esencialy a weapon against adblock in particular probably paid by the same anti-adblocking groups.

</comment><comment><USER46> Considering Brave has a non existing market share, quite surprised how often it's been mentioned.</comment>


LinkedIn CEO Steps Down to Focus on Increasing Network Diversity - <AUTHOR> https://www.forbes.com/sites/kimelsesser/2020/02/05/linkedin-ceo-steps-down-and-focuses-on-increasing-network-diversity/ <comment><USER2> Maybe cut back on the totally useless and bewildering pop-ups and fix the totally unintuitive UI?

But that's none of my business...</comment>


Array Concat vs. Spread - <AUTHOR> https://jsperf.com/array-concat-vs-spread <comment><USER2> I've always found it somewhat confusing how common operations like this with identical behavior but differing syntax can have such drastic differences in speed. Another example would be `for (let i in array) { array[i]...` versus `array.forEach(...`.

For highly optimized engines like V8 and SpiderMonkey, it seems like recognizing these cases and automatically substituting in the faster behavior would be pretty low hanging fruit that could have a significant impact on existing scripts' performance.

Maybe there's some underlying reason to do with how these engines work internally that prevents such optimizations from easily being performed though.</comment>


Facebook admits to blocking Wikileaks links in DNC email hack - <AUTHOR> http://nypost.com/2016/07/24/facebook-admits-to-blocking-wikileaks-links-in-dnc-email-hack/ <comment><USER2> Further evidence of the establishment (and make no mistake Facebook is part of the establishment) manipulating the public into darkness in order to save their own hides.

Make no mistake, Facebook, Twitter, Google, reddit, etc-- they're trying as hard as they can to collude with the powers that be in order to solidify their own position in the status quo. That means censorship on demand; it means propaganda in your feed.</comment>


Show HN: a better news aggregator - <AUTHOR> http://www.mustrrd.com/interest/hn201306110836cst

<comment><USER2> first thoughts: yeah sounds cool i'd like to try

second thoughts: ho noes yet another "i'm not launched give me your email" stuff :(</comment>


They Paid What? Absurd Paintings that Sold for Millions - <AUTHOR> http://www.artsumo.com/blog/post/4

<comment><USER2> Reposting an old comment. The art world obeys supply and demand - where demand has no relation to the real world:

If you are more curious about the contemporary art world market and why $29M is not that expensive[1], I recommend "The $12 Million Stuffed Shark: The Curious Economics of Contemporary Art".

In general, brand (in this case Christie's and Sotheby's) ranks supreme above all else. Once you are branded, you can pretty much sell anything as expensive art.

Also, an interesting factoid - when we hear of Far East/Middle East buyers bidding tens of millions (or more) for a painting, we naturally tend to think - who buys that without seeing it - but as the book points out - the painting has most likely gone to see the buyer already (e.g. Dubai/Hong Kong pre- auction private tour).

Excerpts from the book:

"Money itself has little meaning in the upper echelons of the art world -- everyone has it. What impresses is ownership of a rare and treasured work such as Jasper Johns' 1958 White Flag. The person who owns it (currently Michael Ovitz in Los Angeles) is above the art crowd, untouchable. What the rich seem to want to acquire is what economists call positional good; things that prove to the rest of the world that they really are rich."

Jasper Johns' White Flag

[http://michaelovitz.blogspot.com/2011/04/weve-featured- this-...](http://michaelovitz.blogspot.com/2011/04/weve-featured-this-l.html)

<http://www.metmuseum.org/toah/works-of-art/1998.329>

Estimates on the artist economy:

"40k artists resident in London (about same number in NYC)

For London and NYC each:

75 superstar artists (>$1M/yr income)

300 mature, successful artists (>$100k/yr income)

5,000 part time artists (need to supplement their income)"

[http://www.amazon.com/The-Million-Stuffed-Shark- Contemporary...](http://www.amazon.com/The-Million-Stuffed-Shark- Contemporary/dp/0230620590)

[1] "If a great apartment costs $30 million, than a Rothko [big deal famous contemporary artist] that hangs in the featured spot in the living room can also be worth $30 million - as much as the value of the apartment. But no one could envision a $72.8 million apartment to use for comparison..."

<comment><USER3> This is the kind of conspicuous consumption that used to get people beheaded or shot in revolutions. It's an obscenity.

<comment><USER4> This is not consumption at all.

A painting is probably a few hundred $ worth of materials perhaps a couple of hundred hours labour tops.

The average person probably wastes/consumes more rubbish in a week or two.

This is a rich person not consuming if anything.

<comment><USER3> "Conspicuous consumption" refers to the practice of spending money purely to demonstrate your ability to spend money. Don't be obtuse.

</comment></comment></comment></comment><comment><USER5> This is pretty disappointing, treading over the same old ground - "my daughter could paint that". I was particularly disappointed with the inclusion of the Miro and the Rothko. Those Rothkos are incredibly subtle, and arresting, and enormous, and have dozens and dozens of layers of paint put together in really complex ways that we are still trying to understand. The Tate Modern put on a Rothko show a few years ago and exhibited a cross section of a Rothko (cut out of one of his canvasses that I believe was ruined some other way) and you could see this complexity. These paintings are often very compelling in person, even if they "boring" on the screen of your iPhone or laptop.

</comment><comment><USER6> Meh, _any_ piece of art in this price range is typically being bought mainly for the right to own "the original" of a piece that had some kind of historically important role. Sure, you can copy lots of things, which is true of older art, too. For rather less than the price of a Picasso you can get a very nice, extremely accurate copy that requires forensic methods to distinguish from the original (though some artists are easier to duplicate precisely than others). But it'd be a copy, and some people are willing to pay millions to "own a piece of history". There's no real reason that'd be different just because the piece of history is 20th-century art history, and/or you don't like the piece or the artistic movement it was part of.

Heck, one of the points of Warhol's art was mass-producing screen prints, and people still pay a lot for an original, rather than a screenprinted reproduction.

</comment><comment><USER4> Ummmm you could sell your "3 year old nephew's" art for $100,000 but for some reason you haven't? Right....

I do get tired of the old insult to art that "I could do better" but for some reason that person has 'chosen' not to make millions and be famous.

People need to stop fearing things they don't or can't understand.

<comment><USER3> What's there to understand?

<comment><USER4> Exactly, really it's not that hard, but as this blog article shows some people still just don't get art and/or how it's valued.

And it's ok not to understand things, but it's not ok to ridicule things just because you don't understand them.

<comment><USER3> I think one of us missed the other's point.

</comment></comment></comment></comment><comment><USER7> Are the paintingss absurd? or the price? The author seems to be suggesting that the paintings sold for more than their value, but the market sets the value, not the percieved effort in the creation of the art.

It isn't much different in many other industries. The buyer /market sets the value, not those who aren't in the market.

</comment><comment><USER8> This seems relevant: [http://www.jehsmith.com/1/2013/02/eefin-and-hambone-or- what-...](http://www.jehsmith.com/1/2013/02/eefin-and-hambone-or-what-is- culture.html)

What gives the appearance of some monopoly on genius to the sort of cultural output that is housed in museums and Lincoln Plaza and so on is just this: that brainless one-percenters are spending huge amounts of money to put their names on these monuments, and the brainless bourgeoisie makes pilgrimages to them, spending medium sums of money to have a brush with cultural objects that supposedly edify by their simple proximity. The illusion that genius is stored up in sites of high culture is sustained by capital and by the laziness and gullibility of culture's consumers: all the season-ticket holders, all the dupes of the museums' advertising departments, for their part driven ever further, under the compulsion of capital, to make the Ottoman sultan's throne, or medieval armor, or Greco-Bactrian statuary, look like so many things to buy-- passing them off as a special class of objects, museum objects, that you can buy in a way just by going and standing in front of them.

</comment><comment><USER9> The value of artwork (or other non-utilitarian object) is very much subjective. Human value judgements can become absurdly skewed (e.g. [1]) by our interpretation of an object as a status symbol, which can lead us to value in the extreme otherwise useless objects.

[1]: <https://en.wikipedia.org/wiki/Tulip_mania>

</comment><comment><USER10> Why does everyone want to count other people's money?

</comment><comment><USER11> Omg this is so bad, we have great paintings at <http://piazzaart.com/></comment>


7 Tips for Scoring Your First Article - <AUTHOR> http://thestartupfoundry.com/2011/08/18/7-tips-for-scoring-your-first-article/

<comment><USER2> Hang on - you submitted this about an hour ago. I still had it open in a tab - it was here:

<http://news.ycombinator.com/item?id=2900931>

Why have you deleted it and submitted it again?

Do you do this often? Is this how you've got your large average karma value - submit stuff, wait an hour, if it's had no upvotes then delete it and submit it again.

Lather, rinse, repeat ...</comment>


Wikileaks Was Launched With Documents Intercepted From Tor - <AUTHOR> http://www.wired.com/threatlevel/2010/06/wikileaks-documents/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+wired%2Findex+%28Wired%3A+Index+3+%28Top+Stories+2%29%29&utm_content=Google+Feedfetcher

<comment><USER2> This is the big problem I have with Tor, and, in particular, with the people who recommend Tor to people with serious privacy needs (such as the Iranian dissidents). A heist like this is possible because putting your traffic on Tor flags it as belonging to a subset of all traffic that is more likely to contain interesting information.

It's the same with the people trying to help Chinese dissidents evade the "great firewall". Maybe you're really helping them evade the firewall. Or, maybe you're helping a savvy government agency zero in on the traffic worth monitoring.

I worry that to the people providing the anonymizing and securing technology, this is a game. It's not for the people using the technology.

<comment><USER3> I agree with your sentiments. TOR is designed for anonymity, not privacy; which is something I think is lost on many people who use it.

If you're transmitting information that is personally identifiable, TOR isn't the means to do it. The issue I see, is that there isn't really a solution for people concerned with that.

<comment><USER4> Yes, Tor is for anonymity, not privacy. But that just means you still need to be operating over a secure channel---be that SSL or sending the documents encrypted, etc.

The fact that they operated compromised nodes does NOT diminish from Tor's anonymity. Most anonymity systems assume about 1/5 of the nodes will be compromised (which is reasonable barring a very large global adversary).

In general, timing attacks are the biggest issue in low-latency anonymity systems: if you can track packets going into Tor and coming out of Tor, you can link the sender to the destination. But, if the traffic was encrypted, that still doesn't get you the documents themselves.

Edit: More specifically to the grandparent---even with a compromised exit node, that doesn't reveal the source (that's the point of onion routing). The case of China is a hard one, due to the level of state control. There are ways to request exit nodes in the Tor network (I have no idea how well documented this is), so for them, selecting an exit outside China for accessing international sites would probably be best (this would remove/greatly reduce the risk of Chinese gov't timing attacks).

There has been some work on strategically choosing entrance/exit nodes to reduce the risk of these kinds of timing attacks, but I don't know of anything that has been published or implemented yet (I haven't worked on that particular aspect in a while). Basically, some of the methods would have automatically chosen exit nodes outside of China (to prevent exit->destination traffic from travelling through the same autonomous systems as source->entrance traffic).

<comment><USER4> After some brief digging, it appears there has been some published research on location diversity in path selection in Tor since I last worked on that problem. [https://docs.google.com/viewer?url=http://www.cs.rpi.edu/~ed...](https://docs.google.com/viewer?url=http://www.cs.rpi.edu/~edmanm2/ccs159-edman.pdf) has some good results, if anyone is interested.

</comment></comment></comment></comment><comment><USER5> I believe if the final destination of the tor communication had been https, wikileaks could not have eavesdropped and read the documents. The article fails to make that distinction when it says:

      By necessity, however, the last node through which traffic   passes has to
      decrypt the communication before delivering it to its final destination.

</comment><comment><USER6> A poignant reminder that Tor is just one of many tools and practices necessary to maintain security and privacy.

I remember during Wired's "Vanish" contest ( <http://www.wired.com/vanish/2009/11/ff_vanish2/> ), the guy on the run was using Tor. As such, there was talk about setting up a bugged Tor exit node with lots of reported bandwidth to try to intercept his Gmail sessions. I ran the odds (figuring his client chose exit nodes at random), and there was a decent chance that his traffic would have been captured at least once over the month of the contest. Unfortunately, someone pointed out that it ran afoul of wiretap laws. And the SSL MITM shenanigans to try to capture his email password would definitely have been illegal. So the idea was shelved.

<comment><USER7> Which shows a serious flaw with the contest. The only people you would go to these lengths to avoid would be someone from the government or a criminal organization. Those are exactly the two groups who either don't have the law apply to them, or are willing to break the law.

</comment></comment><comment><USER8> Talk about a conflict of interest. May I be the first to suggest that this falls into the bombshell category?

<comment><USER9> How is this conflict of interest? They were eavesdropping on private tor communication, albeit morally questionable action.

Either way I lost most of my respect for them long time ago, they are not much different from other news organization, they just put a sensationalist spin to their news. Take whatever they give with a grain of salt and understand that they are only portraying one side of the story.

<comment><USER10> Say what you want about the methods, motives, and spin of the people behind Wikileaks, but the fact is they release an incredible amount of credible primary sources. You can dismiss their spin, but you can't dismiss the hard facts they've uncovered.

<comment><USER9> I am not dismissing the importance of what they released. I am hoping that people would see their sensationalist method of reporting.

Take for example the last apache fire video. Its true that it was troubling, its true that it was gruesome and its also true that it will remind people who are otherwise oblivious to the consequences of war, even if it is for a few moments.

But how much value does that piece of video have in changing the perception of public, even after months of hyping ("CIA is following us" on twitter) about it? I suppose not much.

Was this video more significant than the revelation that Iraq never had WMD to begin with? Is this video more significant than Abu Ghraib torture and prisoner abuse? Is this any more significant than 100s of videos you will find online about armies killing Iraqis?

The simple fact is that this single incident is not anymore significant than other 100s of incidents that has been widely reported by mainstream media. People who care, read about it and know about it.

They are certainly not the bad guys but I think wikileaks have questionable ethics and when you have questionable ethics its hard to take you or the news you have seriously, even if the news are exceptional [1]. The idea that they have millions of documents that they can't release because they don't have enough funds is utterly ridiculous. Holy shit, someone tell him about a thing called "torrents".

Their whole point of the sensationalist, biased video release was to get maximum bang for the bucks and get those donations piling up. Which is exactly what happened.

[1] See also: Fox News. (not they are not exceptional, but their occasional truths are lost amid their river of lies)

<comment><USER11> _I lost most of my respect for them long time ago [--] Take for example the last apache fire video._

Do you have another example, from long time ago? That last one was widely panned, but prior to that, their editorialism wasn't criticized very much (though I seem to recall there was some; I just wasn't paying attention).

<comment><USER9> Wikileaks has been around for less than 3 years. So when I say "long time ago" you have to take it as a figure of speech. I did say I lost respect for them, but I didn't say I lost respect for them as a result of their release of any particular information. I lost respect since they started to claim that they have more than a million documents (2007) waiting to be released, but they can't release it because of lack of funds, specifically for infrastructure costs and had to close the site down. Which they later expanded into legal fees, their website (when they were shut down) showed that their legal fees is being paid by other non-profit organizations and most lawyers are working pro- bono (since they opened up the site I can't find the page or the piece of information). For the love of me I don't understand how they can have an operative cost of €600,000 per year. They never addressed the specifics of their costs.

More WTF, they listed some members in their advisory boards (including Noam Chomsky), who didn't even know that they were members of wikileaks advisory board. [1]

There are quite a few things about wiki-leaks that doesn't make sense or add up, and perhaps the nature of their work creates some discrepancies in information about their work, but that shouldn't take away anything from some of the valuable leaks that came from wikileaks.

Two rules I try to apply in my life.

1) Be skeptical of anyone and everyone. Everyone is biased and everyone has a motive. "Who watches the watchmen"?

2) Don't put anyone in unrealistic moral standard. Avoid "herofication" of individuals or an organization. Humans are fallible.

[1] [http://motherjones.com/politics/2010/04/wikileaks-julian- ass...](http://motherjones.com/politics/2010/04/wikileaks-julian-assange-iraq- video?page=2)

</comment></comment></comment></comment></comment></comment><comment><USER12> Hrm, in 2007 people were able to intercept traffic from Tor quite easily by using a packet sniffer on an exit node. It looks like wikileaks got information through an implementation of this hack possibly?

Link: <https://lwn.net/Articles/249388/>

<comment><USER13> Intercepting TOR traffic is trivial, it's not really a hack. They could have just run a TOR exit node of their own, and seen what came through unencrypted. The point of TOR is not to keep the traffic private (you use end-to-end encryption for that), it's to obscure the sender.

</comment></comment><comment><USER14> I'm of the mindset that if you _require_ anonymity and privacy, and use tools you do not even RTFM for, nor do some _basic_ investigation into the field, you _deserve_ what happens to you.

Go Wikileaks. Capitalizing on stupidity for great justice FTW.

<comment><USER15> I doubt China cared about the privacy of the documents they stole.

<comment><USER14> Which has what to do with what?

The sources they stole from (if you're referring to "the big one" a little while ago) _did_ know the basics, and presumably quite a bit more than many places. It was a fairly sophisticated attack. It's part of the risk you run in connecting to the internet in the first place, but it's 100% different than people who think TOR makes all their data private, which they'd learn if they read the short intro page. Notably the two sentences that are important enough to get their own paragraph:

 _"Tor doesn't magically encrypt all of your Internet activities, though. You should understand what Tor does and does not do for you."_

<comment><USER15> My point was that China was transmitting stolen documents over TOR, not stealing documents transmitted over TOR. Although they probably do that as well.

</comment></comment></comment></comment><comment><USER16> ahem this has been debunked folks by wikileaks itself..

<comment><USER17> Where? They seem to endorse the New Yorker article; linking to it on their front page.

</comment></comment><comment><USER18> Stick a fork in them, they are done.</comment>


Audi R8 e-tron piloted driving technical concept car - <AUTHOR> https://digital.audi-presskit.de/en/ces_asia_2015/die-technikstudie-audi-r8-e-tron-piloted-driving

<comment><USER2> Funny how difficult this was to find:

[http://www.audiusa.com/newsroom/topics/2014/piloted- driving](http://www.audiusa.com/newsroom/topics/2014/piloted-driving)

Audi has developed a philosophy and strategy for autonomous driving that it calls "piloted driving." The name accurately reflects the Audi approach to this important and growing field of technology and aspect of the ownership experience: Give the Audi driver a digital "pilot" to guide the trip and assist in making it to his or her destination safely. Yet don't usurp outright operating control of the vehicle or diminish the joy and satisfaction of driving that is a huge part of the Audi ownership experience. Making it clear exactly which entity is in control at each moment also is crucial, so Audi piloted driving emphasizes human-machine interface prompts to accomplish this. Illustrative of this approach is one automated-driving feature that Audi continues to define, called a "congestion pilot." It relieves the driver of the task of driving while the system automatically accelerates, brakes and steers the vehicle, at speeds up to about 37 mph. Once the traffic jam disperses or the end of the highway has been reached, the driver is prompted to take back control. If the driver fails to respond, the system safely brings the car to a standstill.

<comment><USER3> The ACC already does most of this (i.e. accelerate and brake, even to a stand- still if you're not driving manual ofc). It doesn't steer yet, but .. I'd guess that most traffic jams are rather straight?

The automated brake thing exists as well in todays Audis. It randomly beeps if you're driving around a corner and sometimes hits the brakes at speeds below 30km/h (in a traffic jam, for example) for no reason.

I'd trust a drunken and tired driver in a big LandRover more than any Audi technology, based on my anecdotes/my experience with three generations of A3s (currently the quattro 8V chassis/model).

<comment><USER4> I have the 2015 A3, with the driver assistance package (including adaptive cruise control) and use it every day. I drive ~35 miles/50 minutes each way to work, and would have the cruise on for all of the motorway driving (75% of the journey in time, 98% of the journey in distance).

And I swear by it.

I'll be doing 70mph, and come across traffic that's doing 50mph. The adaptive cruise detects this, and slows the vehicle. When traffic continues to build up, and eventually stops, so does the vehicle. When the traffic starts again, you tap the accelerator and the cruise kicks in again. It speeds up, based on the speed of the car in front, back to your set limit.

So, I've just gone from 70mph to 0mph to 70mph without touching a brake and tapping the accelerator once.

I've also been cut off, by a motorbike, and the car's technology has detected that and braked safely.

It's a bit rough on the brakes sometimes, and the acceleration could be smoother from a stand-still, but I continue to use it so that should be testament enough that it's reliable.

<comment><USER3> I think we agree on what the system offers (ACC at least). I'm driving manual, so it cannot do the same for me and that's obviously not the fault of Audi. That system works reasonably well, as in 'slows down and accelerates', which is what the GP found out about this 'new' thingy that is advertised prominently on HN.

The random brakes I was talking about (and the annoying beeps) are from the Pre-Sense tech or whatever they tend to call it. The "I detect that you'll have an accident in the next moment" assistant. Which in my experience either beeps just because (you're driving around a corner and the car seems to believe that you drive straight in the rails or something) or randomly (only if below 30km/h, thank god! Above that it "just" beeps) hits the brakes to avoid a collision. It's a nightmare. The rest of the car is in similar shape. So ACC: Yeah, kinda works here as well.

<comment><USER5> I find pre-sense works well, the only issue I have had is when you want approach a car that is turning left/right and pull out (around it) at the last second. The car doesn't know you are both steering in the opposite directions to avoid the collision will either beep, or in one scenario has applied the breaks (only to remove them once the car in front was no longer in view).

In general I really like the ACC, although it really high lights the inconsistency in other drivers speed (often for no apparent reason). It also isn't as clever as a driver, so you are constantly sat there observing things it can't and waiting for it to notice like a car about to pull into your lane. Another annoyance is that it will slow down for cars that you can see are moving out of your lane, or turning off, when continuing a the same speed would have been fine.

I also have the auto dimming head lights, although they too are a little dumb. They respond to seeing the oncoming car's lights, by which time you have blinded the driver of the other car. They are not clever enough to see the lights coming around a corner, and also sometimes miss a motorbike, or mistake a reflective sign for a car. They also don't work at junctions :(

Peraps next time I will drop the head lights for side assist.

<comment><USER3> Side Assist (that's the warning light in the mirrors, right?) is the ONE assist feature that I use and love. Flawless. Useful. I recommend it :)

Lane assist is silly, doesn't do jack and constantly beeps at you to take back control over the car if you drive 'too straight' (hands on the wheel, mind you).

Head lights: Same issue. I .. don't use those anymore, feeling bad about people both coming into my direction and driving in front of me. That's just insane. I'm easily blinded myself and just don't feel that I can use the lights without being an ass.

Basically this car had close to every feature checked off and by now I'm quite annoyed (keyless entry is broken as well, constantly bitches that I need to replace the batteries - which I did a couple times by now - only to work fine again sometimes. Don't get me started on the Audi connect feature set.. The saddest thing in history, really. You can send your coordinates to Twitter or share your ETA on Facebook!)

</comment></comment></comment></comment></comment></comment><comment><USER6> Interesting to note that they (like all super cars) use a lot of carbon fibre, which is very hard to recycle. Left in the ground it takes hundreds of years to break down.

You can heat it to around 300 degrees c to recover the carbon fibre out of the epoxy, but I don't think there are any commercial places doing this currently? I may be mistaken?

<comment><USER7> The BMW i3 is about 10% recycled carbon fibre: [http://www.compositesworld.com/news/bmw-formally- launches-i3...](http://www.compositesworld.com/news/bmw-formally- launches-i3-manufacture-and-assembly)

</comment></comment><comment><USER3> Why is something that says 'presskit' in the link upvoted? It seems to be devoid of content and .. an ad?

</comment><comment><USER8> So what does this "piloted driving" exactly entail?

<comment><USER9> This year i took part in a student competition sponsored by Audi, so we were around people from Audi that work in that area for quite some time. What they told us is basically that they use the term piloted driving since they don't believe it would be a good thing to have fully autonomous driving. Piloted driving means for them that the car is assisting the driver if he chooses to, but doesn't take away any power of the driver.

The argument they brought up again and again is that they are very concerned about taking away the fun of the driving. I think their marketing team told them to use the term piloted driving, to make sure no customer believes the new cars will take the steering wheel out of the customers hands and take his ability to drive in a fun way. I guess that comes from the view they have of themselves as producers of fun to drive cars, which the customers buy for the sake of having fun driving them.

If you drive in a nice Audi it seems to be hard to imagine that for most people driving a car is not as much fun. They also made it clear that they will rather not having an autonomous car then having one which would be not "Audi" looking ( camera on top etc.). At least they use these arguments when they talk about the Google car being no threat to them.

<comment><USER10> This makes me wonder what plan, if any, they have to attract people (like myself, for example) who don't enjoy driving for its own sake but would happily pay luxury prices for a luxury-grade self-driving car.

<comment><USER9> I think they don't see customers like that as an viable market for them. They seem to be convinced that a person that buys an Audi buys it for the fun of driving.

In reality most Audi in Germany seem to be driven by business people and consultants that need to travel a lot on the Autobahn, and i can imagine some of them wanting to have fun while spending 3+ hours a day driving, but most of them would be glad to do other stuff during that time.

But they probably did some market research, we will see if it works out for them.

<comment><USER11> Exactly. The thing is, a big advantage of going by train is that you can do some work, the travel time is not completely wasted. Why wouldn't you want to have that in a car, especially as a busy consultant?

I think Audi is over-estimating the 'fun' component - for many people in my generation, driving is a dangerous and annoying necessity. But maybe thats just the IT bubble I'm living in.</comment></comment></comment></comment></comment>


Why We Keep Falling for Financial Scams - <AUTHOR> http://online.wsj.com/article/SB123093987596650197.html <comment><USER2> "After I wrote my book, I lost a good chunk of my retirement savings to Mr. Madoff, so I know of what I write on the most personal level."

Now there's a backhanded endorsement of a book by its author.

</comment><comment><USER3> TANSTAAFL is a pretty good model. If a situation isn't comprehensible or doesn't seem to be sustainable, don't invest as if it were.

The Golden Rule is another thing to keep in mind: If your gains seem are so outsized that they seem like robbery, there's a good chance that they are. Two questions ensue: Do you want to gain that way at another's expense? Are you sure you're the one who's gaining?

I guess particularly in this site's environment, rich in innovators, there would be a significant amount of gain where the cause is the replacement of outdated business and technical models. But then hopefully that is taking place in fields that you understand; the transfer isn't "magic".

I've mentioned before, but watching Chicago real estate prices rise into the middle years of this decade was unnerving. The rest of the economy was not accelerating to match. It didn't seem sustainable, and it wasn't.

Not that I'm any expert. Just my $0.02, while I still have the pennies to rub together.

</comment><comment><USER4> > Why We Keep Falling for Financial Scams

I don't.</comment>


Fast and slow if-statements: branch prediction in modern processors - <AUTHOR> http://igoro.com/archive/fast-and-slow-if-statements-branch-prediction-in-modern-processors/ <comment><USER2> This particular bit of information is worse than useless for the vast majority of developers. For the parts-per-million development efforts where this sort of optimization is necessary (a tiny subset even of kernel developers) there will be many orders of magnitude more developers for whom this information is actively harmful. Devs will spend their time trying to second guess the compiler's optimizations of their if statements in order to eek out micro- seconds of performance improvement. Meanwhile, by focusing their efforts on the wrong thing they will take attention away from quality of design and execution as well as macro-optimizations. Their code will be lower quality and, ironically, slower.

Micro-optimization is a silly diversion the vast majority of the time. Wait to optimize at that level until you have the tooling and the measurements that indicate you truly need it (more often than not you won't).

<comment><USER3> Developers should know how the layers beneath them work. Sometimes that means they have to be exposed to information that could be "dangerous" if they use it in the wrong context. Such is the risk of education.

<comment><USER2> Sure. I'm not objecting to the information itself, I'm objecting to paying more attention to it than is warranted (the amount that is warranted being so close to 0.00 for the average developer that it's hardly worth mentioning).

The best-case scenario for this information is for the vast majority of developers to ignore it, or to read about it and then do absolutely nothing about "the problem".

Even in the rare case where you happen to be that one guy who's writing kernel, library, or game code which needs to be heavily optimized at every level this particular issue is extremely unlikely to be relevant. And even in the super rare cases where it is relevant the given article doesn't provide very good advice on improving performance (hint: for a lot of cases it'd be better to rewrite your loop so you don't even have a conditional inside it).

In short, this article is silly trivia, nothing more, and roughly equally useful to the practice of programming as looking at pictures of cats with funny captions, maybe less so.

P.S. The real risk here is that devs become overly focused on a "problem", lose their situational awareness and ignore more serious problems they should be concerned with. It's the sort of thing that causes pilots to crash planes while they are distracted by a warning light they can't figure out: <http://en.wikipedia.org/wiki/Eastern_Air_Lines_Flight_401>

<comment><USER4> Maybe you'd like the message better if it was inverted: "Contrary to popular wisdom, with modern processors there's very little penalty for conditionals where the same branch is taken each time. It's only when the branches are random that slowdowns occur, and even so it's usually not a big deal."

I disagree about the "one guy" theory. While it may be true that very few Ruby programmers would benefit from this knowledge, if you are bothering to use C or C++ you might as well take full advantage of the speed it has to offer. If not, why not use a higher level language? I'd certainly want the author of my interpreter to be fully aware of these issues: <http://bugs.python.org/issue4753>

</comment></comment></comment></comment><comment><USER5> The Linux kernel exploits that by using two macros (likely() and unlikely()) that give hints to the compiler using GCC's __builtin_expect:

if(likely(condition)) dosomething();

<comment><USER6> even without likely/unlikely, branch prediction still occurs in branch- prediction supporting processors. the kernel optimization just optimizes for the first case. once the branch prediction state machine as aligned itself towards the more likely branch, accurate branch prediction will occur for the resulting calls (typically iterations or something like that)

</comment></comment><comment><USER7> What the article fails to mention is branch predictors in modern CPUs are generally correct >95% of the time for real world benchmarks (usually SPEC).

Furthermore each CPU uses different approaches to branch prediction such that a bad pattern for one will not be in another. So spending time trying to optimize your code in this way will only optimize it for a particular processor which wont work if you're trying to make a distributable binary. (i.e. different x86 processors use different branch prediction algorithms. You will basically be optimizing specifically for the Intel i7 or specifically for the AMD Athlon 3)

</comment><comment><USER8> Interesting article. It has been a long time since I have worked this "close to the metal." Back when I coded at the machine level, there were no branch predictions performed by the processor to help maintain the pipeline. What you had were different opcodes for your conditional jumps - 1 for when the jump was likely, 1 for when it was not. It had amazed me (a bit) that never got reflected in higher level languages. Now that I see that the processor makes (educated?) guesses, I suppose I am no longer surprised.

</comment><comment><USER9> Would systems that use trace trees (e.g., TraceMonkey) have the same sort of issues?

I have a feeling that they would notice repeated calls to the same if- statement and optimize accordingly. They may still have the same sorts of issues, but would the used benchmark (looping and querying the if-statement _n_ times) have completely different results in a JIT system?

</comment><comment><USER10> I'm astonished at the magnitude of the difference correct prediction can make in a scenario where the effect of a misprediction is to either increment a sum or not. How is that possible? How many clock cycles does an accurate prediction save in this context, and how many are used in moving through the loop and evaluating the condition?

</comment><comment><USER11> Results from Luajit - <http://gist.github.com/413482>

D:\p\badif>..\luajit\src\luajit badif.lua

(i & 0x80000000) == 0 time: 1.057

(i & 0xFFFFFFFF) == 0 time: 0.696

(i & 0x00000001) == 0 time: 3.682

(i & 0x00000003) == 0 time: 5.339

(i & 0x00000002) == 0 time: 3.686

(i & 0x00000004) == 0 time: 3.683

(i & 0x00000008) == 0 time: 3.686

(i & 0x00000010) == 0 time: 3.856

</comment><comment><USER12> Just out of curiosity, how applicable is this to optimizing a higher-level language like python or ruby?

<comment><USER7> It is not applicable unless you plan on running your code on only a specific CPU (and by specific CPU I don't mean that you plan on running only on x86, I mean you only plan on running on the Intel i7).

GCC has some macros where you can specify if a branch is likely or unlikely so the compiler will optimize the code for you based on which cpu you are compiling on, but at higher level languages you would have to do this by hand. The performance gain from this optimization will be negligible compared to if you had spent that time trying to optimize something else.

<comment><USER4> I think you are misinterpreting this. All branch predicting CPU's will deal better with basic and regular patterns: 100 trues in a row followed by 100 falses. It's only with regard to how well they handle different ABAB-type patterns that they differ. Modern and more expensive processors are better at detecting more complex patterns.

The macros you refer to a are an even more minor effect --- they only affect what happens the first time through the loop. It's a tiny optimization of an optimization. Branch prediction is a hardware feature, and is going to happen whether you use these macros or not. It's the logic of your code that's going to make the big difference, not the macros.

<comment><USER13> It's the first time through the loop after each time the loop is evicted from the instruction cache. If the loop is short or has been unrolled heavily (causing each branch to be predicted separately) it could matter.

<comment><USER4> Is the Branch Target Buffer synonymous with the instruction cache[1]? But yes, it certainly can matter. I thought the links that 'wendroid' offered above were interesting: a Scheme interpreter, presumably already fairly well optimized, saw about a 10% improvement through the hinting macros.

But I'd argue that if this level of optimization is required, the bigger gains are to be see through changing your algorithms to become more regular: for example, using fixed length blocks in a compression scheme rather than checking for null termination [2]. But if this is for some reason impossible, then use hinting!

[1] <http://www.agner.org/optimize/microarchitecture.pdf>

[2] <http://www2008.org/papers/pdf/p387-zhangA.pdf>

<comment><USER13> Thanks, I didn't know that branch predictions are now cached separately from instruction decodings. Hopefully evictions are a rarer problem.</comment></comment></comment></comment></comment></comment>


Ask HN: Website to collect customer enhancement requests - <AUTHOR> I'm looking for a Website that offers the following services:<p>- A software developer makes a list of proposed or possible features and enhancements to his product.<p>- Customers login and vote on their favorite enhancements. Each customer gets a limited number of votes to insure (s)he focuses on what is truly important to him/her. The votes could be weighed (first vote is worth 5 points, second is 4 points, ... fifth vote is 1 point).<p>- A customer can only vote once. In a really sophisticated system, a customer could change his vote.<p>- Customers are also given the opportunity to originate their own requests.<p>- The results can be viewed in real time by all customers.<p>Most survey and polling sites are too elementary. <comment><USER2> Had the same problem a while ago with our saas product. We receive dozen of requests each week, and except a few exceptions (bigger things that we are already building anyway), most of them are pet peeves and very specific to single customers.

Long story short: we ended up writing our own solution, with a twist. Each week we assign votes to customers, unused votes expires after a while, and quantity of votes is function of customer value and seniority.

Let's be honest: a customer on the free plan or during the trial, that makes tons of request, cannot be weighed the same as a customer which has been with us for 3 years already and is on the biggest plan. A request from the latter is a serious thing for me... a request from the former not so much!

</comment><comment><USER3> I was thinking about almost this same exact idea the other day. However, I wanted customers to be able to submit requests that would not be initially visible to public facing web. They would be vetted and made anonymous, then people could vote on them.

</comment><comment><USER4> So something like User Voice?

[https://www.uservoice.com/](https://www.uservoice.com/)

<comment><AUTHOR> That looks exactly like what I'm looking for... except the annual fee is "five figures". A bit out of my range :o)

He suggested "ideascale".

</comment></comment><comment><USER5> I suspect services like ZenDesk or other helpdesk software are likely to have this or something similar as a feature.</comment>


Selling website that made over $500 in 8 days - <AUTHOR> http://www.kreci.net/blogging/selling-website-that-made-over-500-in-8-days/

<comment><AUTHOR> Want to buy it...? =)</comment>


Linux Container Internals - <AUTHOR> http://docker-saigon.github.io/post/Docker-Internals/ <comment><USER2> If you want to learn about linux container internals, I can recommend just trying to implement one yourself in some random language for fun. I wrote a basic runtime in python that can run docker images:

[https://github.com/kragniz/omochabako](https://github.com/kragniz/omochabako)

Quick demo: [https://asciinema.org/a/77296?speed=2&autoplay=1](https://asciinema.org/a/77296?speed=2&autoplay=1)

<comment><USER3> that sounds pretty cool. Sorry for ignorance (heavy Windows background) but where does one start with something like that? Is there a RFC type of thing for these images or runtime spec?

<comment><USER4> [https://lwn.net/Articles/531114/](https://lwn.net/Articles/531114/) and [https://www.kernel.org/doc/Documentation/cgroup-v1/](https://www.kernel.org/doc/Documentation/cgroup-v1/) (or the newer [https://www.kernel.org/doc/Documentation/cgroup-v2.txt](https://www.kernel.org/doc/Documentation/cgroup-v2.txt) )

Actually all that was said (and somewhat explained) in the article in question. Although i would recommend to try cgroups directly with the kernel.

</comment></comment></comment><comment><USER5> The url is correct, 'Docker-internals', but the title, and further equivocation of 'Linux Containers' and 'Docker', is a bit confusing. I'm a happy lxc/lxd user, and had to stop reading because of the cognitive dissonance.

<comment><USER6> I also thought it was about LXC. Sad.

<comment><USER7> Why is it sad?

<comment><USER8> Because LXC on a technical level is much simpler, doesn't make mess in network and filesystem setup, and is easy to understand. Docker does some heavy magic for things to work for programmers (the ones who can't be bothered to learn how ethernet bridging or IP routing work), so the whole thing feels _brittle_.

In short, LXC is vastly underappreciated.

</comment></comment></comment></comment><comment><USER9> OpenVZ is dated 2005 in the document, which makes FreeBSD look a bit alone back in 2000, but that's not really accurate. OpenVZ was just a re-branding of Virtuozzo, which was released in 2000, in an effort to upstream it.

Virtuzzo got really popular quickly in the cheap webhosting market, as a more secure and powerful alternative to shared hosting. I worked with it a lot in the early 2000s. I don't think they ever outgrew that market however, and when "real" virtualization came with VMware and friends, that's where all the money went.

It's only fair to mention where it really started in the Linux world. (Also a bit funny to see the pendulum of tech swing back again. It's about time!)

<comment><USER10> Cool! thanks for info. I've added a link back to these comments to the blog source (haven't re-generated the static html yet though)

</comment></comment><comment><USER11> This is from February, which is ancient in Docker years, but the container history and references are quite useful.

<comment><USER10> yet it covers containerd ;)

</comment></comment><comment><USER12> Also relevant:

[https://0xax.gitbooks.io/linux- insides/content/Cgroups/cgrou...](https://0xax.gitbooks.io/linux- insides/content/Cgroups/cgroups1.html)

</comment><comment><USER13> I have some small critiques of some of the hyperbole in the article:

 _" Package managers failed us due to shared libraries version differences causing dependency issues"_

Incorrect. The software administrators (read: The Users) failed to understand that installing duplicate incompatible software does not work, was never intended to happen, and shouldn't even be possible. But users are stubborn and will force a conflict if at all possible.

Containers allow users to _side-step package management_. It doesn't replace it or help it at all, because it completely ignores all the work gone into the package. Imagine putting on tennis shoes, and then trying to put on snow boots. Containers give users a second pair of feet.

And this is not a container innovation. Chroot environments have been providing the exact same functionality (installing side-by-side conflicting packaged software in a simple manner) for decades. You don't even need any extra software to use it.

 _" Docker provides a self-contained image that is exactly that same image running on your laptop vs in the cloud while i.e. Puppet/Chef are procedural scripts that need to rerun to converge your cluster machines. This enables approaches also know as Immutable Infrastructure or Phoenix Deploys."_

Unless you designed your software to be immutable, it probably isn't. Software changes as it runs, and different hardware changes software differently, so at the best this claim is disingenuous. Different networks and systems interacting in different locations add complications. If you tested it on your laptop, _do not expect it to run the same in production, period._

 _" Before Docker, LXC would create a full copy of FileSystem when creating a container. This would be slow and take up a lot of space."_

Loop and COW filesystems (Unionfs, Aufs, Overlayfs, etc) on Linux pre-date Docker by a long time, and were used with containers and container alternatives.

\--

I thought i'd see more about _linux container internals_ , not a description of how Docker works, but I guess the host name should have been a dead giveaway. Don't read this if you want to know about the kernel.

<comment><USER14> > _Incorrect. The software administrators (read: The Users) failed to > understand that installing duplicate incompatible software does not work, > was never intended to happen, and shouldn 't even be possible. But users are > stubborn and will force a conflict if at all possible._

Why doesn't it work? By whom was it never intended to happen? Why should it not even be possible?

I've shipped production software that - very carefully - links multiple versions of OpenSSL _within the same process_ , so it's not a matter of some law of physics that I can't have two versions of OpenSSL on my system used by separate binaries. It's a design choice that this is how things are going to work. You don't need containers to pick a different design choice, yes, but neither do you need chroots - just careful use of shared library versioning and symbol versioning.

Containers won because containerization tools made all of this easy. Nobody wants to piece together shell scripts to do things in chroots any more than they want to piece together shell scripts to set LD_LIBRARY_PATHs. (And way more commercial software actually does the latter, because they want to side- step package management because they have no idea what libraries are on your system.)

<comment><USER13> * > Why doesn't it work? By whom was it never intended to happen? Why should it not even be possible?*

It doesn't work because it's incompatible, and so it's complicated. If I build A with B1, and you build C with B1.1, and the user wants both A and C, they need both B1 and B1.1. Which is fine - IF they built B* with unique symbol names, and built their apps against those unique symbol names, and if everyone else in the world follows exactly the same convention. Of course, if anything else changes (cpu architecture, features, ABI, whatever) everything may break anyway. But in general the biggest problem is not everyone builds software the same way.

Both the software developers and the package managers never intended for incompatible software to be installed at the same time. The software devs could make it handle these cases, but they usually don't, so it doesn't work. The package managers could package their software uniquely every time, but that would be annoying, cumbersome and not very useful for managing systems ("do i need to remove db3 before i install db4? what are all the packages called? what's the order? what else will be affected? do i rename everything and rebuild everything with names specific to this one library package name?" etc).

It shouldn't be possible to install conflicting software because the package should be built to fail to install if conflicting software exists, or remove the conflicting software before install. But sadly there also exists the ability to remove all these safeguards, or to install unpackaged software.

Containers are just a wrapper around existing tools, such as package managers. They don't add functionality, they just simplify it. With Docker, you aren't linking to multiple versions of openssl within the same process: you're running one process in one environment with one version of openssl, unless you intentionally get really fancy, which really isn't easy. Package managers never failed, they simply weren't being used right.

Containers won because someone finally realized users don't care how they do what they want, as long as they get to do it without having to know how it actually works. Devs get to pretend they know how to deploy software or manage systems and Ops people get less responsibility because they didn't build the shit so they don't support it. It's a win-win, but it's still a mess, and none of it is new or novel.

<comment><USER14> > _IF they built B_ with unique symbol names, and built their apps against > those unique symbol names*

This isn't necessary. If you're not going to load both versions into the same process, they can overlap symbol names. This is how Linux distro version upgrades work: the system installs libfoo2, then upgrades binaries that use libfoo1 to versions that use libfoo2, then removes libfoo1 when nothing needs it any more. At all times, the system is in a working state; any given binary will load either libfoo1 or libfoo2.

The trouble is that Linux distros tend not to want to provide more security support for libfoo1 than they have to, so if you have software that still requires libfoo1, the easiest approach is to use a container/chroot/VM/whatever with an older distro release, possibly from a different vendor, that's hopefully still under security support.

(If you do care about loading both libraries into the same process, you need symbol versioning / two-level namespaces / direct binding / whatever your ld.so wants to call it, which means that every reference to a dynamic symbol specifies which dynamic library the symbol comes from. The names themselves remain unchanged, but they're referenced by a tuple of library and name. This works. Again, I've shipped software that would crash horribly if this didn't work.)

> _Both the software developers and the package managers never intended for > incompatible software to be installed at the same time._

I'm not sure that's true for software developers: I can't imagine that, say, the OpenSSL developers do their work by replacing their system OpenSSL every time they recompile. They already know full well how to test an OpenSSL in ~/src/openssl and keep it separate from the one in /usr/lib, without using chroots.

It's true for package managers, but that just means that package managers are failing at delivering a thing users want.

In particular, forcing upstream software to follow conventions and building all software the same way, and patching things as necessary, _is the entire job of a distro_. If two versions of a distro package conflict, that's because the distro chose not to make them coinstallable. If only one version of a library is available in a distro, that's because the distro chose not to make other versions available. They might have reasons for this (e.g., security support effort) but none of it is fundamental impossibility.

(Also, if you mean B1.1 in a semver sense, or equivalently a libb.so.1.1 sense, upstream is promising that it's backwards-compatible with B1, such that A can dynamically use B1.1 despite being compiled against B1. If that's not true and B1.1 is ABI-incompatible with B1, either upstream or the distro needs to rename B1.1 to B2 / rename libb.so.1.1 to libb.so.2.)

> _Devs get to pretend they know how to deploy software or manage systems_

I submit that the only valid measure of whether you know how to deploy software or manage systems is whether systems get deployed or systems get managed.

<comment><USER13> I'm not saying you can't run software with duplicate libraries installed. I'm saying there is conflicting software, both on individual distros and across distros, that is simply _not currently_ created in a way that can be installed side by side and run without extra steps involved. Specifically conflicting file names, but also conflicting functionality which extends beyond just shared library conflicts. And i'm saying that Docker serves the function of "fixing" a problem which package managers did not create.

 _> I submit that the only valid measure of whether you know how to deploy software or manage systems is whether systems get deployed or systems get managed._

If you don't care at all about the result, sure.

</comment></comment></comment></comment></comment><comment><USER15> I've been struggling with fully understanding containers. This article helps but it's a little too low level for me.

A quick question for HN'ers: If you've got a machine running say 4 docker instances, does it help resource usage if all instances are running the same Linux distro?

Or, since the kernel is the only thing shared between them does it even matter?

</comment><comment><USER16> Site looks broken, because CSS is loaded over HTTP which is disabled if site is loaded over HTTPS.</comment>


Rust to the Rescue - <AUTHOR> https://medium.com/@fbzga/rust-to-the-rescue-of-ruby-2067f5e1dc25 <comment><USER2> You should not change the original title: it is "Rust to the rescue (of Ruby)".</comment>


Stop Equating "Science" with Truth - <AUTHOR> http://www.slate.com/articles/health_and_science/science/2017/08/evolutionary_psychology_is_the_most_obvious_example_of_how_science_is_flawed.html <comment><USER2> Oh, boy. Yes, it is true, no one knows better than we scientists that science is flawed and bias-prone.

You can say science is flawed but the best available source of truth we can have, or you can say science is too fallible to be more privileged than any other source of knowledge/belief. What you _cannot_ do is have it both ways, to pretend science is infallible when you agree with it, and biased or problematic when you don't. This seems to be what many on the left are trying to do.

<comment><USER3> A thousand times this.

There is absolutely an institutionalist argument to be made against how science is practiced by fallible and biased humans. However, I've never heard of any method I'd trust more.

Science seems to be the only fair process for adjudicating when factual claims are at odds. I'd hate to rely on rhetoric, as that certainly isn't less subject to human fallibility.

At the same time, we need to be thoughtful about what are scientific questions and which are normative/ value questions.

Science could help us figure out whether ground up humans make good plant fertilizer. Humans need to make a value judgement on whether or not to fertilize plants with ground up humans.

Believing in the scientific method, recognizing the institutional ways that we can systematically fall short of its lofty platonic ideal, and understanding the limitations of science to tell us the "right" social policy is what I want.

</comment></comment><comment><USER4> _Eliminate structural biases in education, health care, housing, and salaries that favor white men and see if we fail. Run the experiment. Be a scientist about it._

That experiment's been done and "we failed". India has greater structural biases against women than the US but a higher percentage of women in tech. And it's a pretty consistent correlation between bias and women's involvement across countries.

<comment><USER2> Take a look at this:

[http://slatestarcodex.com/2017/08/07/contra-grant-on- exagger...](http://slatestarcodex.com/2017/08/07/contra-grant-on-exaggerated- differences/)

Apparently, and paradoxically, greater eqalitarianism in a society can result in higher amounts of individual choice, which can actually exacerbate inherent differences between groups (if you believe they exist).

</comment></comment><comment><USER5> Yes, our institutions of science are flawed and subject to human biases. However, what alternative to we have? At the end of the day, we need to have some notion of what is "true". We could go with taking the dominate ideology as being "true", but this is literally political correctness. We could go back to using religion to tell us what is true [0]. Or we could realize that science is the best method we have invented to find truth.

The question then becomes how much we trust our current scientific institutions. I will agree that the general public tends to put too much trust in any given finding (and often misunderstands the finding itself), but, in general, our scientific institutions are still doing some of the best science in our society. They are certainly doing better science than our political institutions are. [1]

So what do we do when our scientific institutions findings do not align with our political findings? One option is to ignore the science entirely; but without the science, we will proceed along with an ideology that becomes increasingly divorced from reality.

In the case of the Google memo, we have a disagreement about facts [2]. The question here is how to resolve this disagreement. I have seen two proposals: 1) Science and 2) Ideology and mob rule.

Both sides can play in the science debate. There is a lot of science to support the "pro (gender) diversity" side, and we can have a discussion where both sides try to use science to arrive closer to the truth. In fact, if we look at the two sides of the broader diversity debate, the pro diversity side is far more represented in our scientific institutions [3].

[0] Although it is worth noting that, even if we accept religion as the correct arbiter of truth, our religious _institutions_ also have a record of reaching a truth that supports the biases of the time.

[1] Which is not a criticism of our political institutions; their job is not to do science. It is, however, a criticism of deferring to our political institutions for factual judgements.

[2] Actually, in my opinion, most of the disagreement is about words; specifically one side not understanding what the other side is trying to say moreso than disagreeing with it. However, for the sake of arguement, I will assume that both sides understand what the other is saying and have a factual disagreement.

[3] Again, talking about populations, not individuals.

<comment><USER2> I don't think the disagreement in the case of the memo is about facts. Few outlets that reported on this controversy even seem to have read the memo, nor are the criticisms of it I have read based on facts (or on words).

They seem to be based on the idea that the writer has _drawn the wrong conclusion_. The facts or lack thereof seem to be irrelevant: if he had cited the same papers but made the opposite argument, he would have been fine.

The idea of scientists being some kind of arbiters of truth makes me very uncomfortable. The process of science is really messy. People want to publish surprising and extraordinary findings (which often turn out to be false, and the more extraordinary, the more likely this is). We have to publish or perish. And many other problems.

Over the long term, science finds truth. In the short term, it is quite unreliable. Scientists are tired of having their work used to support agendas, when in reality we only observe, and usually the observations don't even support the agendas they're being used for.

At this point, I think more and more scientists would prefer that science just be left out of politics. Politics appears to be a lost cause, far beyond any ability for facts or reason to be useful, and we have always done our best to leave politics out of science. To the left and right, I would just plead: leave us out of your petty squabbles and let us get on with advancing humanity's future. But I must admit there are some publicity-seeking members of this profession who undercut this hope.

To more directly respond to your post, there is an awful lot of confusion between what science says, and the value judgments derived from a combination of scientific observations and some ideology. I do not think the public, left or right, is generally capable of disentangling facts from their interpretations of the consequences of those facts.

<comment><USER5> >I don't think the disagreement in the case of the memo is about facts.

Neither do I, see footnote 2. However, the article this thread is responding to was talking about factual decisions, so I stuck with that assumption.

>At this point, I think more and more scientists would prefer that science just be left out of politics.

By all means, leave politics out of science [0], but we need science to inform are politics. Otherwise, we just get more of the raw ideology that is the very reason you don't like politics.

Science should not be left to just the scientists. They do the hard work of collecting data and running experiments. But mostly, they end up answering very specific questions with varying degrees of confidence. Once they have those answers, they guess at broader implications. These are informed guesses, based on their knowledge of other highly specific results and thinking that others have done. However, this latter part of science is far more accessible than most people realize. So, instead of actually engaging with the science, they simply appeal to the scientists. This is made even worse because they are attempting to understand the conclusion without the argument, and so will tend to misunderstand. Further, since the general public almost never engages with the actual science, politicians and activists have near free reign to misrepresent the results.

[0] Mostly, the question of what to study _should_ be a political one, but politics is so corrupting that I see no problem giving scientists a lot of insulation from it.

<comment><USER2> Right. I read your footnote, but if indeed the disagreement is based on "misunderstanding", it is a willful misunderstanding. Damore's opponents appear to me to not even have tried to understand his argument. They are not even attempting to engage the argument and failing; they're just not trying. The conclusion is heretical, therefore the reasoning must be wrong...somewhere. I say this as one who doesn't know and doesn't care about this argument, I just worry very much about the free speech implications.

> but we need science to inform are politics. Otherwise, we just get more of > the raw ideology that is the very reason you don't like politics.

Well, I do like politics, in the sense that I think it is a fascinating window into the most irrational sides of human behavior. But politics is far more powerful as a cultural force than science is. Politics appeals to the most tribal instincts in humans.

Yes, it would be wonderful for science to inform politics. To have a president and Congress who would look at the facts and make decisions based on those facts, which neither a Democratic or Republican administration would really do. So the best we can hope for is for politics not to infect science while we wait for science to make these silly arguments irrelevant, if indeed it does.

For example, I will note that the Obama administration, despite all its lip service to climate change, never did realize the simple fact that modern civilization requires energy, and it will consume the cheapest form of that energy available, and therefore green energy will only win if and when it becomes cheaper than fossil fuels. When researchers make green energy cheaper, I predict Republicans will, as if by magic, lose all their skepticism and reservations about climate change, and the left will abandon their unrealistic talk about emissions caps, and it will all become a non-issue.

</comment></comment></comment></comment><comment><USER6> I was going to deride Slate for presumably being on the side of the people equating "Science" with truth at the March for Science just a few months ago, but it turns out they had the exact same issue then: [http://www.slate.com/articles/health_and_science/science/201...](http://www.slate.com/articles/health_and_science/science/2017/04/the_march_for_science_was_eerily_religious.html)

I figure if I was going to smear Slate for assumed hypocrisy, I should do the right thing and praise them for their (IMO, correct) consistency when I was wrong.

</comment><comment><USER7> One mistake that (easily) gets made is thinking science is a product, a body of knowledge. Science is a _process_ , that (through repeated application) can take a body of knowledge, and improve it's depth and accuracy.

You want to get close to "the full truth, and all the truth"? It'll take asymptotically more man-hours.

At any point, there will be gaps and mistakes; but the nice thing about the process of "science" is that it's an algorithm, and exists as part of the body of knowledge it's acting on. So it can itself be improved, using it's own rules.

That's the difference between a process, and a static set of facts, when even it the core tenets permit for the possibility of mistakes, and allow for their own replacement.

</comment><comment><USER8> Science aligns (or at least should, ideally) rather more with "honesty". "honesty" isn't "truth", so ...</comment>


David start-up vs industry Goliath - <AUTHOR>

I'm sure many of you here used to work for some larger company before going on your own. I used to work for a 'larger' company myself too before they screwed me over; I was "just a hacker" at the time so none of them took me really seriously.
Now it's payback time: I've been working (and still am, ofc) on a start-up that will compete directly with them. The product itself is light years ahead so I have no doubt it'll get a great percentage of the Goliaths' sales. The questions I can come up with would be:
1. how to use Goliaths' strengths and weaknesses as my own advantages? I've read on this topic lately but still really want to hear fellow hackers' opinions.
2. how to "push" my start-up with practically no funding in a 2nd world country? I'm not looking for funding, going the 37signals way on this one. Except for the idea being super awesome and packaged in the simplest interface possible, I pretty much rely on word of mouth and SEO. Ok, and social media (which I have no experience with). Is there a "pushing your start-up for dummies" book or blog? <comment><USER2> "I have no doubt it'll get a great percentage of the Goliaths' sales"

Been learning again and again, you are going to need to map out your marketing plan and probably bring on a co-founder with a strong business background. Having the greatest product in the world will not save you from a poor approach to acquiring clientele.

Get some community validation that your product is as great as you claim, and change your plan from payback to your ex-employer and towards how you can enter their market as a strong competitor and carve out your own place. You're destined to fail if all you're going after is revenge.</comment>


Show HN: A C++ Redis client supporting cluster and STL-like interface - <AUTHOR> https://github.com/sewenew/redis-plus-plus <comment><AUTHOR> It support the following features: Most commands for Redis; Connection pool; Redis scripting; Thread safe unless otherwise stated; Redis publish/subscribe; Redis pipeline; Redis transaction; Redis Cluster; STL-like interfaces; Generic command interface.</comment>


Ask HN: What language/framework should I learn for back end web dev in 2018? - <AUTHOR> I would like to invest some time and energy in mastering a web app framework (back end) for future projects. I have experience with ASP.NET, Rails, Node...but I wouldn't consider myself an expert at any of them. I would like to really dive deep and master a framework so that I can default to the chosen framework and "just build" things in the future. I'm primarily interested in producing RESTful or GraphQL APIs...so no need to talk about built-in views or which front end framework to choose.
I know there is no "perfect" answer to this question and some frameworks excel at certain things, but surely there are some frameworks which stand out for typical web application development in 2018. I definitely don't need to be on the bleeding edge of the web but I also don't want to invest my time learning a dying stack. (Or maybe there's no such thing as a dying stack?)
Popular opinions seem to be Ruby/Rails, Python/Django, and Elixir/Phoenix.
What would you invest your time in? <comment><USER2> Consider Elixir best chose nowadays. Invest time in it because of next pros:

\- Functional programming (always interesting to learn new paradigm: pattern matching, purity, immutability, laziness, etc FP stuff)

\- Fault-tolerance

\- Hot code reload

\- Message-passing concurrency (actor model), thanks to Erlang

\- Using at large companies for high-load and real-time

\- Cool syntax

</comment><comment><USER3> Try something lite like Flask or Sinatra and compare how quickly you can churn something out compared to the bigger feature heavy frameworks

</comment><comment><USER4> Laravel is doing pretty well if you aren't too put off by PHP.

</comment><comment><USER5> Seaside?</comment>


Should MySpace Be Put Out to Pasture? - <AUTHOR> http://blog.ndarkness.com/blog/456/should-myspace-be-put-out-to-pasture/ <comment><USER2> I thought it was... I don't know a single person who still uses it...

<comment><AUTHOR> Everyday I hear more and more people say that they have deleted their accounts because they never went to the site anymore.</comment></comment>


Cybersecurity Tech Accord – Facebook, GitHub signed, Google didn't - <AUTHOR> https://cybertechaccord.org/about/ <comment><AUTHOR> "[Cybersecurity Tech Accord] signatories oppose efforts to [cyber] attack citizens and enterprises."

"No offense: We are committed to not knowingly undermining the security of the online environment, and to protecting against efforts to tamper with our products and services."

Signatories include ATLASSIAN (Jira) | CLOUDFLARE | FACEBOOK | GITHUB | GITLAB | LINKEDIN | MICROSOFT | ORACLE | HP | ....

I wonder why companies like Google, Amazon, Apple and Alibaba do not sign? Is it an indication that they are tampering and attacking?</comment>