Unbelievable balancing robot - stabilizes an articulated inverted pendulum  - <AUTHOR> http://hackaday.com/2010/11/27/balancing-inverted-pendulums <comment><USER2> The guy whose thesis this was comments on it here: [http://www.reddit.com/r/math/comments/ebql6/double_inverted_...](http://www.reddit.com/r/math/comments/ebql6/double_inverted_pendulum_crosspost_from_rphysics/)

I had guessed they were using visual sensing because of how the two halves of the pendulum were painted in contrasting, bright colors, but I was wrong. There are angular sensors at the joints of the pendulum, and a position sensor in the wagon at the bottom. The control system also needs the velocities of the parts of the pendulum, which it gets through a state observer (<http://en.wikipedia.org/wiki/State_observer>).

The interesting part for me was how the control system stands the pendulum up: it figures out the potential energy the pendulum will have when upright, then jerks the wagon around to add that amount of energy into the system as kinetic energy, then guides the system around a constant-energy landscape until it's upright. Pretty clever!

<comment><USER3> So how much would it cost to build one of those robots?

<comment><USER2> It looks like a big linear motor like in the video is probably $1000 to $2000 dollars. Angle sensors are pretty cheap (just a few bucks). Then you'd need an A/D-D/A board to control it with ($500 to $1000).

<comment><USER4> And a smart PHD student, which are pretty cheap I hear ;)

<comment><USER5> Although the 'smart' ones are something of an endangered species

<comment><USER6> don't worry, one day some smart PhD student will create a robot that's smart enough to replace smart PhD students

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Allow me to draw your attention to this astounding diagram my friend showed me: <http://en.wikipedia.org/wiki/File:All.png>

_"The colour of each pixel indicates whether either pendulum of a double pendulum flips within 10 (green), within 100 (red), 1000 (purple) or 10000 (blue). Those that don't flip within 10000 are plotted white. The angle that the upper pendulum makes with the vertical initially ranges from -3 at the left-hand side of the plot to +3 at the right-hand side. The angle that the lower pendulum initial makes with the vertical ranges from -3 at the top to +3 at the bottom."_

Mathematics people: Does this image represent the landscape this robot walks in any way?

<comment> brown9-2 _within 10 (green), within 100 (red), 1000 (purple) or 10000 (blue)_

What are the units being discussed here - "within 10" of what?

<comment><AUTHOR> on the wiki page it says "oscillations"

</comment></comment></comment><comment><USER7> My controls lab in college (University of Washington, Aeronautics & Astronautics) had an inverted pendulum. I designed a controller to balance it and maintain position along the track for a controls class. We took a picture of Gumby standing on top of it for our report. It used rotary optical encoders to measure the angle, and a motor driven belt to move the base along the track. Somebody in our department developed a controller to flip the inverted pendulum up and balance it. Another stabilized a jointed pendulum in various configurations (both arms up, one up & one down, one down & one up). All are non-trivial problems. Combining them is commendable.

</comment><comment><USER8> Original video: <http://vimeo.com/2952236>

</comment><comment><USER9> My hunch is that balancing a real inverted double pendulum in that way is not possible (and that the clip is a hoax -- perhaps using servos at the middle joint to hold it relatively straight at the right time). Would love to be proven wrong though.

<comment><USER4> The forces involved in double pendulums are very well studied. As other posters have pointed out the robot has sensors on the two pivot points which makes it straight forward to counter the movement (once you have a precise robot, the right force equations and a PHD in physics) once the pendulum enters the required state.

ps I voted you up from you negative state, I don't see a reason for a downvote in your comment.

<comment><USER9> I know a little physics, and understand that the physics of double-pendulums is well studied (the case where it hangs with a stationary base is a standard grad school dynamics problem), but what little intuition I have tells me it can't work and would just collapse. Would _love_ to see an illustrative/graphical/animated example of how it works.

<comment><USER4> <http://www.cs.washington.edu/homes/marc/learn_ctrl.html>

<comment><USER10> I love the way the 150 second trial behaves... It makes the task seem effortless. Swinging the arm slowly and deliberately until the double pendulum is above the plane of motion, then quick small motions keep the system straight while longer slower motions swing the now straight system up to equilibrium...

I think it might be possible to do by hand now that I have seen it done like that.

</comment></comment></comment></comment></comment><comment><USER11> This reminds me considerably of the "Pole Balancing Problem"[1] which was tackled by neural networks for a long time. It's since been solved by them. Seeing a real-world version of that problem is pretty cool, though.

[1] The pole-balancing problem isn't exactly like this problem. A single pole is balanced, rather than two; and even in the double-pole balancing problem, the two poles both rise from the base, not one pole atop the other. That should be a minor variation to it.

</comment><comment><USER12> Apparently, it's an application of this: <http://en.wikipedia.org/wiki/Kalman_filter>

<comment><USER13> I would immagine that almost every non-trivial robot you find in a research lab today includes a Kalman filter somewhere.

I know the balancer I worked on (<https://collab.cc.gatech.edu/humanoids/node/1241>) certainly does, although from that project I can also tell you that most Kalman filter implementations are probably incorrect. It's fairly easy to implement a filter which behaves quite well but does not actually behave like a Kalman filter.

</comment></comment><comment><USER14> Note that this experiment (balancing an inverted pendulum, then moving on to balancing an articulated inverted pendulum) is one of the examples from the original Papert LOGO papers of neat robotics problems which grade schoolers can understand and start working on (using the LOGO turtle or similar), but which can be refined as far as the student wishes to take it.

<comment><USER15> A crucial difference is that a 2-link pendulum is a chaotic system. It's much harder from a control-theory point of view.

<comment><USER16> I agree. While the inverted pendulum is fairly straight forward to implement with a PI controller, the 2-link pendulum is quite an accomplishment.

</comment></comment></comment><comment><USER17> Does anyone know if a human has ever done that?

<comment><USER18> I'm pretty sure it's impossible for a human. On the other hand we can do amazing feats of balance that no robot can do, like walking quickly on two legs across an uneven surface. It's all a matter of specialisation.

<comment><USER19> I think you vastly underestimate people, concider the two tricks at 3:30 <http://www.youtube.com/watch?v=uHDnGp1_W8c> flip something from foot and then balance it on your head without using your hands. Note unlike the example pendilum it needs to balance in two directions.

Even more flips, [http://www.youtube.com/watch?v=w6NgAPmSCKM&feature=relat...](http://www.youtube.com/watch?v=w6NgAPmSCKM&feature=related)

</comment></comment></comment><comment><USER20> bnu.edu.cn's lab on triple inverted pendulum, 2 axis

<http://v.youku.com/v_show/id_XMjMzMTkyMzY=.html>

and quadro

<http://v.youku.com/v_show/id_XMjMzMTk2NDA=.html>

</comment><comment><USER21> Neat. Reminds me of something I built in college: <http://www.youtube.com/watch?v=Lfh9upwZWA0>

I must admit that mine was quite a bit simpler.

</comment><comment><USER22> That's pretty awesome. Actually, I'd like to see it balance _itself_ on a (double) pendulum.

</comment><comment><USER23> Could make a camera tri-pod (in this case, "mono-pod") that fits in your pocket.

</comment><comment><USER24> The title is a little bit exaggerated... But the robot is very interesting.

<comment><AUTHOR> To those of us without a background in hard mathematics or engineering but with enough knowledge to know what it means that a double pendulum is a chaotic system, this video is initially quite staggering. Perhaps it doesnt fit the literal semantic meaning of "unbelievable," but then if we all spoke completely literally language wouldn't be much fun.

<comment><USER24> OK. The robot is impressive. It's just that the title felt... Digg-ish...

<comment><AUTHOR> Now that you mention it you're right, it does have that SUPERLATIVE NOUN - VERBS AN ADJECTIVE NOUN! structure doesn't it. I shall have to take a long look in the mirror.

<comment><USER24> :-)

</comment></comment></comment></comment></comment><comment><USER25> Pencil balancer in 2D, using very fast silicon retina cameras:

<http://www.ini.uzh.ch/~conradt/Projects/PencilBalancer/>

(The cameras: <http://siliconretina.ini.uzh.ch> )

<comment><USER26> Saw a lecture by Tobi Delbruck at my uni last month and was really impressed by this application among others. Seems like some really interesting technology. Can post a link to the lecture recording (audio) if anyone wants it?

<comment><USER27> That'd be great!

<comment><USER26> <http://www.deityproject.com/Delbruck.WMA>

also of interest,

<http://www.deityproject.com/Kuipers.WMA>

Ben Kuipers takes us through his investigations to date on the subject of robotic cognition - using some very adorable footage of a "research student" (actually the students 2yo son) to show just how far we have yet to go. Focusses on the "grasp" function of human object interaction. Bit slow in places as it's just audio and the slides were important, but could help someone find further information.

Sorry for WMA, it's the native format my dictaphone uses =S

There is another up there for linguists - Geoff Ketland discusses his notion of language as platonic solids... I found it VERY interesting stuff.

Note: I'll keep them up for a week or two in case anyone is interested, but I'll be using the domain for something soon, so can't provide permanent links.

</comment></comment></comment></comment><comment><USER28> It's pretty cool, but I've been running it for two hours and it still has not found a solution.</comment>


Good News, Part 1 - <AUTHOR> https://johncarlosbaez.wordpress.com/2015/12/24/good-news-part-1/ <comment><USER2> Kind of a missed opportunity to not stick an "everyone" in there :-). Or is the phrase copyrighted/trademarked?

</comment><comment><USER3>
        "(There seem to be people who are too optimistic—but
        strangely, I don't know them personally. Am I just
        avoiding them, or are they avoiding me?)"

Interesting question -- optimism, at least in the extreme, seems much rarer then pessimism.

<comment><USER4> When I watched Tomorrowland, this is the idea that struck me: that it had been a _long_ time since I've seen anyone who was so determined to be optimistic.

There's a really great quote I came across in a comic [0]:

      Max: Fear is easy. Fear is cheap.
        Instead of fear, we're going to give the people hope.
      Sam: Fear vs. Hope. Hardly an even match.
      Max: That's because you think of hope as something light
        and fragile. My version of hope has calluses and dirt
        under the fingernails and isn't past bringing brass
        knuckles to a fight.

I like to think there's a sort of grinding optimisim that really gets things done. Where people slog through the hard work, slowly and gradually dragging us to a slightly better future. You can knock a lot down with some FUD conflagration, but there's some stuff that will be lasting. And this article highlights stuff that will - at least - last a couple decades.

[0] [http://tvtropes.org/pmwiki/pmwiki.php/Quotes/Freefall](http://tvtropes.org/pmwiki/pmwiki.php/Quotes/Freefall)

<comment><USER5> I think that custom demands that one provides a link to the actual comic: [http://freefall.purrsia.com/ff2500/fv02418.htm](http://freefall.purrsia.com/ff2500/fv02418.htm)

<comment><USER4> Yup, looking back TVTropes linked to it; not sure how I missed it the first time. It's one of my favorite lines, but I always have a hard time searching for it. At least I'll be able to find it through via the sideways channel of your comment now!

</comment></comment></comment></comment><comment><USER6> Lots of good news. But we should be careful not to misinterpret one point.

The Ebola virus isn't "defeated." It has gone back into hiding in animal populations. It may well appear again.

<comment><USER7> True, however we also have a vaccine now so pandemics are less likely. So that is an improvement in the state of the art.

<comment><USER8> Ebola has never been the global threat it has been made out to be. It can be controlled by simple sanitation and common sense (i.e. avoid contact with bodily fluids emanating from people with active cases of Ebola). This was demonstrated by the fact that when the virus was introduced in the U.S. it didn't spread. For Ebola to spread requires some pretty abominably lax public sanitation practices. Having a vaccine in hand is just a bonus.

Oh, there's also probably a treatment for ebola if someone can be bothered to do the study: [http://blog.rongarret.info/2014/12/the-cure-for- ebola.html](http://blog.rongarret.info/2014/12/the-cure-for-ebola.html)

</comment></comment></comment><comment><USER9> I really find this type of news reporting refreshing. I've always found it hard to find a good feel-good-news site, it really lightens the mood. I've wondered why there was no central website that was dedicated to feel-good- news; instead, a bunch of small sites and posts scattered throughout the internet. Any reccomendations?

</comment><comment><USER10> Related:

[https://news.ycombinator.com/item?id=10793969](https://news.ycombinator.com/item?id=10793969)</comment>


Caffeine - A User's Guide to Getting Optimally Wired - <AUTHOR> http://scienceblogs.com/developingintelligence/2008/02/optimally_wired_a_caffeine_use.php

<comment><USER2> Caffeine: do stupid shit faster!

<comment><USER3> Not necessarily. Some folks don't seem to react well to caffeine. Others thrive on it. If you like a quiet calm atmosphere when working caffeine will probably not help. But if you're like me and like working under stress (and late at night while listening to energizing music) then it can work wonders.

</comment></comment><comment><USER4> What goes up must come down.</comment>


How PostgreSQL Processes a Query - <AUTHOR> http://www.postgresql.org/developer/ext.backend.html

<comment><USER2> Blatant self-promotion, but people interested in PostgreSQL query processing might also be interested in these slide decks:

"Query Execution Techniques in PostgreSQL" <http://neilconway.org/talks/executor.pdf>

"Inside the PostgreSQL Query Optimizer" <http://neilconway.org/talks/optimizer/optimizer.pdf></comment>


Twitter acquires Gnip - <AUTHOR> https://blog.twitter.com/2014/twitter-welcomes-gnip-to-the-flock

<comment><USER2> The 2 biggest competitors in the firehose business are Gnip and Datasift. I am pretty curious if Gnip will pivot in a Twitter only firehose or it will continue to serve data from Twitter's competitors.

<comment><USER3> I wonder if Twitter will be able to use the data from Twitter's competitors transiting Gnip's firehose for their own analytics/machine learning/relevance purposes. (From a legal standpoint that is, I'm sure they have the technical chops to do so)

</comment></comment><comment><USER4> Interesting move. Gnip was already their authorized provider for reselling stream data. Guess they figured it'd make more-sense to just bring the whole thing in-house.</comment>


Why I'm not paying the Troll Toll - <AUTHOR> http://toddmoore.com/2013/07/02/why-im-not-paying-the-troll-toll/

<comment><USER2> _My company TMSOFT was recently sued by Lodsys in the eastern district of Texas._

Again with this "eastern district of Texas". Might there be a way for the tech community to punish this podunk little area for letting themselves become a thorn in everyone's side? Refuse to ship or sell there? Put something in the TOS that refuses all support for products used there? Seems like something needs to be done to get the attention of the residents of this area and let them know that their local court has been usurped by trolls and is creating a national nuisance. If they all woke up one morning to find that Netflix was out and they couldn't even google why, it might get their attention.

<comment><USER3> If that's a Federal circuit (which seems likely, [1]) then I don't think there's anything that the local Texans had to do with it one way or the other. It's a Federal circuit court that happens to be located in Texas, Texas doesn't actually appoint the judges who serve there.

[1] [http://en.wikipedia.org/wiki/United_States_District_Court_fo...](http://en.wikipedia.org/wiki/United_States_District_Court_for_the_Eastern_District_of_Texas)

<comment><USER4> Several articles indicate it's also the jurors: [http://www.thejuryexpert.com/2010/03/east-texas-jurors- and-p...](http://www.thejuryexpert.com/2010/03/east-texas-jurors-and-patent- litigation/) [http://www.businessinsider.com/why-patent-plaintiffs-win- in-...](http://www.businessinsider.com/why-patent-plaintiffs-win-in-east- texas-2013-1)

So I think the parent post might be on to something. Let's mess with Texas!

<comment><USER5> Juries just seem like a terrible idea in general. Let's put more non- knowledgeable people in positions of power!

<comment><USER6> The purpose of a court isn't to get the best answer. Its to get a decent answer while resolving the matter with finality. An adverse opinion of experts can be accused of bias and other things that can cause the conflict to continue to fester. The opinion of a group of layman cannot be attacked that way.

<comment><USER5> Instead they can be attacked about having no clue what they are talking about, which seems to be the case for many subjects.

> An adverse opinion of experts can be accused of bias and other things that > can cause the conflict to continue to fester

Please correct me if I am wrong, but isn't this comment thread and the parent's article doing exactly that? To quote from [1]:

> And juries in East Texas like to hand out big awards to plaintiffs, jury > consultant Julie Blackman has written for the Jury Expert blog.

[1] [http://www.businessinsider.com/why-patent-plaintiffs-win- in-...](http://www.businessinsider.com/why-patent-plaintiffs-win-in-east- texas-2013-1)

<comment><USER6> The jury isn't charged with "having a clue." It is charged with deciding what happened and who to believe. The judge, the lawyers, and the experts are charged with understanding the problem and spoon-feeding it to the jury. The idea is that if you can't explain to a group of ordinary people why you should win, its hard to say that you really deserve to win. You can call the jury stupid, but stupidity doesn't bias a jury against you. And any other jury would have been just as stupid. With experts its different. You can accuse an expert of being biased or interested (because experts are usually in the same industry as the litigants). You can claim that you would have won, if only you had a different expert.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> IANAL and I don't have any business to sue, but my mind wanders about "creative" approaches to patent trolls.

1\. I live in Houston, which is a reasonable drive from the eastern district of Texas. If I got sued, I'd probably show up in court just to make them show up in court.

2\. I wonder if a layered defense would work? "Every problem in computer science can be solved by yet another level of indirection." I've read about holding company structures where Company A holds the trademarks, code, IP, etc. for a business and then licenses it for use by Company B. Company B is a shell that passes back everything to Company A. The only one doing business potentially "making, using or selling" the potentially patented IP is Company B, which can string the troll along, then close up business overnight and reappear as Company C, with new licensing agreements from Company A. Probably doesn't work long term, but it sure would slow them down.

3\. What about "patent troll delayers" as a service? These would be people who live near the court that are given, say, 0.01% of the company. As "owners" of the company, they may appear in court pro se, without hiring a lawyer. I think there are requirements to be in the patent bar before appearing in patent trials, so pro se is not an option, but just showing up, acting pissed off, and demanding your rights might gum up enough of the court's docket to be some major friction in the troll's process. We aren't talking about million dollar judgements here, just enough friction to cost more than the settlement amount they were looking for. Imagine if the federal judge had to take time to throw out pro se defendants in hundreds of cases. There goes the court's schedule, and it would make great television.

<comment><USER8> 1\. Uh, they have local lawyers in EDTX, and those lawyers are friendly with the judges. They are happy to. In fact, in EDTX, they have (or at least had) a local counsel requirement (IE if you didn't live there, you needed to also have an attorney who was local be retained), and plenty of local counsel charged ridiculous rates for the privilege

2\. They'll just sue everyone anyway. What you are arguing about is the merits. Most have never cared about the merits. They care about getting settlements, or large verdicts in some small cases.

3\. This is a great way to get thrown in jail for contempt.

<comment><USER9> Regarding #1, EDTX allows any attorney of any state bar, not just of Texas to be admitted to practice. I live within a 30 minute drive to Marshall, TX. There are plenty of lawyers and attorneys around their courthouse too, which I have to imagine rake in cash.

Check out page 36, "Admission to Practice". [http://www.txed.uscourts.gov/cgi- bin/view_document.cgi?docum...](http://www.txed.uscourts.gov/cgi- bin/view_document.cgi?document=1164#page=36)

<comment><USER8> What you say is true, but not at odds with what I said. Even though they technically allow it, pro hac vice is not that common, and it takes a while for them to process out-of-state admissions usually.

They used to have an explicit rule, similar to LR 83.10 that you can find still in the northern district [http://www.txnd.uscourts.gov/pdf/CIVRULES.pdf](http://www.txnd.uscourts.gov/pdf/CIVRULES.pdf)

</comment></comment></comment></comment><comment><USER10> I'm against conceptual patents like these. I feel they are too abstract, monopolize a common functionality/method, and hurt competition. Way to go Todd Moore, even if they settled for $5, fight what you believe in!

A general abstract patent that I can think of in relation is one I researched recently that Comcast filed, patenting online video playlists[0].

[0] [http://patft.uspto.gov/netacgi/nph- Parser?Sect1=PTO2&Sect2=H...](http://patft.uspto.gov/netacgi/nph- Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=%2Fnetahtml%2FPTO%2Fsearch- bool.html&r=2&f=G&l=50&co1=AND&d=PTXT&s1=%22video+playlist%22&OS=%22video+playlist%22&RS=%22video+playlist%22)

</comment><comment><USER11> Patent Trolls are one of the reasons I've kept my small business under the radar and rely on word of mouth or known clients to spread it.

I just can't afford it, and I'd rather open source the whole damn thing over giving some random slimeball in texas a dime.

I've read about Patent Litigation/Troll Insurance, has anyone tried this? Recommendations?

<comment><USER10> I would definitely (and will now) look into it. There is nothing more heart breaking and disappointing then coding for hours, setting up an infrastructure, becoming bootstrapped...then getting a cease and desist. Only thing to compare to that type of disappointment would be doing a quick patent search on a business method you might be implementing.

<comment> chao- There are two issues with what you suggest (looking up patents ahead of time):

1\. Many times the Cease & Desists, or "Invitations to License" are about completely tangential topics or technologies to the core of your business.

2\. If you do specifically look for patents ahead of time, and this becomes known in any legal proceedings, the penalties for willful violation of assorted IP are higher. IANAL but have heard this often enough from people, without seeing it refuted. Someone do correct me if I'm wrong.

<comment><USER12> Willful patent infringement may lead to triple damages. (In legal terminology, called "treble" damages.)

However, if you've never even looked at the patent, then by definition you cannot be infringing willfully. The payout will be limited to 100%.

</comment></comment></comment></comment><comment><USER13> I generally support the fight against patent trolls, yet one of my biggest frustrations is that way too frequently the nature of discussion online regarding this issue obscures or even hinders substantive legal discussion about ways to actually reform the patent system.

Unfortunately, it seems as if there is some of that going on here. Lost among all the valid criticism of Lodsys in the linked article is the actual motion to dismiss their claim. Rather than take the opportunity to challenge Lodsys' patent on validity grounds, which is what would really be needed to push meaningful reform, the author's attorney has chosen to pursue relatively unimportant civil procedure and state law defenses that seem a) unlikely to succeed (although IANYL) and that b) will do absolutely nothing to affect the state of patent law in this country either way.

The defendant here isn't paying the "troll toll" because he doesn't want to cough up that money and believes he's in the right. Many of us probably agree with that belief. But it seems a bit disingenuous to write an article championing patent reform yet explicitly avoid the opportunity to take a real stand on that issue all while asking others to put their skin in the game to fight the good fight. Perhaps my time in IP law has left me cynical, so I've asked the author in his comments to address this and I'll update this post if he responds...

</comment><comment><USER14> I am currently in the same situation. (I posted here on HN a while back: [https://news.ycombinator.com/item?id=5272575](https://news.ycombinator.com/item?id=5272575))

The author was lucky enough to find a lawyer that will defend him pro bono, but in my case (and I assume many other cases that we don't hear about), the cost of defending is more expensive than settling. The problem is that it is really cheap for patent trolls to file a lawsuit, since they basically copy and paste the claim, which is most likely to be too poorly written to stand a chance in court. I wish the court had a strict approval process.

<comment><USER15> Personally, I think it will cost you _more_ to settle in the long run because settling makes patent trolling profitable, which means more companies will do it and you'll get hit more often.

<comment><USER16> There's a name for this.

In the long run it's in everyone's best interests to fight this but it's each individual member that risks the damage by losing so it goes on. It's not the group being sued it's just one member.

Maybe everyone should pool resources into an entity to take up defence of anyone. I don't think the legal system allows it though.

<comment><USER17> > There's a name for this.

The inverse tragedy of the commons?

<comment><USER18> What's inverse about it?

<comment><USER17> I thought "Tragedy of the commons" referred to people over-harvesting limited resource in an unsustainable fashion knowing it is wrong because it wont matter if "just they" do it. And then everyone does it, and the resource dries up and everyone starves.

This would be inverse in the sense that there is no limited resource being depleted, but bad seeds being sown, choking the environment and making it unsustainable.

To me it seems like the same category of problem, but with the opposite kind of adversary and feedback loop, so I assumed it wasn't covered by that term.

But it's also very likely that this is just the sort of unproductive, needlessly detailed nitpicking which geeks are so very much famous for. I've been known to go down that road before :)

</comment></comment></comment></comment></comment></comment><comment><USER19> Is it possible to patent patent trolling, so trolls can be sued back? "Method for finding patent infringement in software" maybe?

<comment><USER20> IBM and Halliburton are both in the process of trying!

[http://www.npr.org/blogs/money/2012/08/01/157743897/can- you-...](http://www.npr.org/blogs/money/2012/08/01/157743897/can-you-get-a- patent-on-being-a-patent-troll)

<comment><USER19> Now we're talking!

</comment></comment></comment><comment><USER21> Here is a simple suggestion to end the lawsuit madness: The loosing party must bear all costs of the process. This is how it works in Germany. Added benefit: The expected value for suing people over the most ridiculous things is suddenly negative.

<comment><USER12> You don't even have to go to a civil law jurisdiction like Germany. Loser-pays is also how the British legal system works.

I have a better one. A losing plaintiff should pay some small percentage, say 2%, of the damages that they sought. This discourages people from filing suits for ridiculous amounts of money, in the hopes of getting a reduced award later on. Whereas if reasonable damages were sought, then 2% will be much less than the legal fees even if the plaintiff loses. Thus, it would not deter reasonable lawsuits.

</comment></comment><comment><USER22> This sound like "We don't negotiate with ... no not terrorists ... trolls !"

@Lodsys: if you are suing patents because of a pod-cast: you are a not only a patent troll, you are a troll in every regard !

</comment><comment><USER23> Lodsys is simply despicable.

</comment><comment><USER24> Best of luck to TMSOFT, glad to see them fighting the good fight.

</comment><comment><USER25> I am not very familiar with USA's legal system, but is there no way to sue the troll after winning the trial so that they pay your legal expenses? I know this is possible in some European countries. Also, is there no way to file criminal charges for harassment (or something similar) against this kinds of companies?

<comment><USER26> Yes, but these cases for drag on for years. Many of the defendant companies (especially the small ones) do not have the resources to continue to pay legal counsel until the case is resolved.

<comment><USER27> Also the troll often doesn't act directly, but sets up an "independent" company to which it assigns IP rights for a limited period. If that shell company loses the lawsuit, it simply disappears and the IP reverts to the parent. There aren't any assets to attack.

If they did set up a loser-pays system, it would also require the use of escrow accounts to avoid this problem. This seems to have helped combat the SLAPP phenomenon.

</comment></comment></comment><comment><USER28> Its Always Sunny - [http://www.youtube.com/watch?v=dJ8G2s-- 1zA](http://www.youtube.com/watch?v=dJ8G2s--1zA)

</comment><comment><USER29> I don't know Todd, but I'm assuming he donated the $3500 and he should state that to get more people interested.

<comment><USER30> I don't think he has any moral obligation to donate the amount asked by Lodsys. Putting his head on the block like this is already helping a lot more than $3500 given to lawyers could.

<comment><USER29> He definitely doesn't have a moral obligation, but it is a fairly minimal number to help prove his intentions are genuine and not simply a strategy to save $3,500.

Also, he should stress the risk he is taking in defending his position since most readers will not have any idea how big it is.

</comment></comment></comment><comment><USER31> How else are you going to get into the boy's soul?</comment>


How the equals sign changed the world - <AUTHOR> https://arstechnica.com/science/2017/07/how-the-equals-sign-changed-the-world/ <comment><USER2> The headline may sound like an overstatement, and as written it probably is, but "the equals sign changed mathematics" would be a simple statement of fact. Proper understanding of the use of the equals sign is highly correlated with mathematical ability; studies have actually been done to demonstrate this.

On the other hand, see [https://cseducators.stackexchange.com/questions/1300/how- do-...](https://cseducators.stackexchange.com/questions/1300/how-do-i-teach- math-equality-vs-cs-assignment-vs-cs-equality-logic-operat) for an illustration that we shouldn't take too literally this story's conflation of math's `=` with the various flavours of `=` in programming languages.</comment>


How to be anonymous in the age of surveillance - <AUTHOR> https://www.seattletimes.com/business/technology/special-sunglasses-license-plate-dresses-juggalo-face-paint-how-to-be-anonymous-in-the-age-of-surveillance/ <comment><USER2> The article mentions the use of "Juggalo" style face paint to avoid face detection. This type of countermeasure is effective against conventional HOG- SVM type face detectors such as [1], but would be inadvisable for daily use.

To deal with more advanced convolutional detectors, consider wearing a hat or clothing with adversarial patches [2], simple patterns that can be printed onto stickers. These patches work by feeding the detector inputs that cause an overwhelming bias toward a particular class (eg. toaster), which drowns out the real signal (eg. human face). Even the first generation of adversarial patches are effective against most detectors deployed as of 2020.

[1] [http://dlib.net/face_landmark_detection.py.html](http://dlib.net/face_landmark_detection.py.html)

[2] Brown et al. [https://arxiv.org/abs/1712.09665](https://arxiv.org/abs/1712.09665)

<comment><USER3> A lot of these CV hacks work only on existing tech. If I a human can still recognize a face then it is almost certain that a better CV tool can. The bulletproof method is to wear clothing that entirely covers your face religious style clothing comes to mind. Total face covering may not be totally socially acceptable in your area but it almost certainly is more acceptable than dazzle makeup.

A fairly casual setup that looks pretty acceptable is to be riding/walking with a bike, helmet on, sunglasses on and a bandana covering the face (This is normal to stop bugs).

<comment><USER4> > The bulletproof method is to wear clothing that entirely covers your face > religious style

There are no methods that will remain bulletproof, for determined adversaries / state actors. Biometric gait analysis can potentially defeat facial camouflage, and the technology will continue to improve, especially as it becomes more widespread in non-surveillance applications, e.g. athletics and fitness

See discussion in other comments here

<comment><USER5> Probably a bit much to deal with everyday, but - what about a line of shoes that have varying heights, angles and weights? Or even a single pair of high- tech shoes that automatically randomize these elements every 24 hours.

<comment><USER6> You're probably better off just throwing a pebble or two at random spots in your shoe. Random height/angles are most likely going to fuck with your joints and just make it too hard to move efficiently, while a pebble or two will be annoying but tolerable and should be enough to change your gait up.

</comment></comment></comment></comment></comment><comment><USER7> It should be pointed out that the various accessories mentioned in the article primarily serve to make a statement, they do not actually provide any kind of practical anonymity from competent surveillance infrastructure. Robust anonymity can't be created via technical means.

<comment><USER8> Indeed.

Anonymity in meatspace is arguably a dead issue.

Whenever I leave the house, I assume that I'm under surveillance. So I just act normal.

Edit: In particular, I play "harmless old man".

<comment><USER9> If you knew that no surveillance was being conducted, would you be acting any differently?

<comment><USER10> Remember when answering that they know your IP address.

<comment><USER8> They know _an_ IP address. But, without a ridiculous amount of work, not _my_ IP address.

But anyway, the thing is that I do know that I'm under surveillance at least some of the time. So I might as well assume that it's all of the time. Because it's hard to know.

And sadly enough, I won't even speak freely with my wife, unless she's turned off her cellphone, or put it in the utility closet or bathroom, with the water running.

<comment><USER11> wow. why wouldn't I talk freely. and yes I talk about a lot that could be used to construct a case against me if some state(like) actor would want to.

So let them. actually I am still hoping for the day at least the US puts me on a no entry list. I would see this as a badge of honor.

</comment></comment></comment></comment></comment></comment><comment><USER12> I would like for it to be illegal for apps to ask for address-book permission and similar. Your name, phone number, address, email and other details, perfectly packaged together, should not be free for any random contact to give out. The social contract was for only that contact to have the information. Privacy becomes impossible otherwise.

We need resistance to systems/services/initiatives that enable and encourage people to leak each other's data to third parties.

<comment><USER8> That's just one reason why I don't use smartphones.

<comment><USER13> That doesn't stop others from saving your number/email (probably bundled under the same contact) next to your name - so long as you have a number.

That, and the classic security/usability-tradeoff, render your implied suggestion somewhat obsolete, no? Sorry if I'm missing something.

<comment><USER14> You presume that telecom companies are not selling your information and haven't been for decades? I can assure you that in the US AT&T sells it's customer information. They were doing this to land line customers 20 years ago or more.

<comment><USER13> That wasn't the point of this thread (at all, mind me). Op said that _ones contacts_ shouldn't be allowed to share informations about you via perms on their address-book, as this was never part of the social contract you made with them when giving them your number.

Someone then argued "thats why I don't have smartphone", to which I responded that not having a smartphone doesn't affect the aforementioned conflict. So unless I'm missing something here, you just went entirely off topic.

Regardless: I'm european, so I'm somewhat confident that my ISP doesn't sell my data due to GDPR; Americas lack of consumer protection isn't really my business, nor should it be deemed 'the standard', as it isn't just that.

<comment><USER8> OK, _mea culpa_.

It was basically an emotional response to the idea.

I suppose that at least, not having a smartphone, _I 'm_ not sharing stuff about others. Except for the number, which is already ~widely known. But I wasn't thinking that when I wrote the comment.

</comment></comment></comment></comment></comment></comment><comment><USER15> Ironic that the Seattle Times website asked me to subscribe before I read the story on how to maintain anonymity.

After you subscribe, you probably get a page saying:

"Well, not this way."

<comment><USER16> Disabling CSS works for me, and makes the article readable.

</comment></comment><comment><USER17> I really miss the times when these articles were a .txt file with legit tips on how to improve anonymity. Did not matter that it was written by a random high schooler, instead of a paid journalist. Now this article title will rank highly on search engines (authoritative website with paid-to-write expert content), and people looking for privacy will buy Juggalo face paint to not look conspicuous when shopping groceries.

</comment><comment><USER18> Facial recognition highlights one issue that anything which a human can recognize may eventually be done by a machine. We saw it before for fingerprints and learned from it that they are not unique as they assumed from matching terrorist fingerprints with a guy in Spaim who wasn't even in the country of the attack. Currently facial recognition technology is a terrifying Morton's fork where it is uncertain if accuracy or inaccuracy is worse. An inaccurate one accepted leads to false positives. An accurate one leads to reliable tracking.

Transparency and equal accssibility of data is likely the most viable and just path in the future given that it is between an arms race and outright impossible. It would leave everyone on equal footing essentially and minimize exploitability. It wouldn't be easy to adjust to, especially with embedddd societal hypocritical expectations. Japan for one has a perfect example in Sariaman culture that it is expected to head out and get smashed with coworkers after work but shameful to be identified while drunken. It would be healthier in the long run for society to learn to rid itself of cognitive dissonance one way or another. Laws would also need adjusted to keep up with actual need of enforcement so they don't depend upon selective enforcement - which is good practice period. Public drunkenness for instance is meant more for being a drunk disruptive ass than just cuffing anyone with a BAC above a threshod. Anyway all of that doesn't change the fact that said transition would be painful.

<comment><USER19> > We saw it before for fingerprints and learned from it that they are not > unique as they assumed from matching terrorist fingerprints with a guy in > Spaim who wasn't even in the country of the attack.

A quick search shows that you are talking about Brandon Mayfield. From what I can gather, there wasn't a collision in fingerprints, but a falty analysis (arches in opposite directions, etc) on the FBI's part.

</comment></comment><comment><USER20> Why does it feel like we are discussing reality described in Cyberpunk?

Based on everything I read thus far, short of removing yourself from society, a true anonymity is not available to an average person. And that kinda defeats the point.

Maybe it would change if politicians' every move was crowd sourced.

<comment><USER21> > _Based on everything I read thus far, short of removing yourself from > society, a true anonymity is not available to an average person._

We have plenty of recent examples here in Europe where people came from another continent, discarded their previous identity and got a new one based on their own claims about their age, name, origins, religion etc. ... Perhaps it's not available to the "average person", just to people from particular regions, but it's a proven, very effective way to obtain multiple/new identities.

</comment></comment><comment><USER22> There is also a tradeoff between anonymity and target of interest.

All these suggestions only work when a lot of people apply them. Otherwise you end up just like with using privacy operating systems, like Qubes OS. Yeah, you will be safer, but everyone also immediately thinks that you have something to hide, which causes systems to double down on tracking you. You might even get some human "attention", if you actually have something to hide. A couple of users using Tor, are not anonymous. A couple of people wearing IR glasses, are not anonymous. Millions of people using AdBlocker, that's already doing something. Think of masses.

If you try to be anonymous just by yourself, you are running into the trap of making your trails so uncommon, that people will still be able to track you. An example: Qubes OS causes so unique browser fingerprinting, that even under TOR, I will still be uniquely identified. That's why OS like Tails, spend so much effort avoiding different fingerprints for different users.

<comment><USER23> Is this[1] your source about the browser fingerprinting in Qubes?

It's the only thing I could find on the subject.

[1] [https://www.reddit.com/r/Qubes/comments/ai5obg/my_whonix_fin...](https://www.reddit.com/r/Qubes/comments/ai5obg/my_whonix_fingerprint_is_unique/)

</comment></comment><comment><USER24> > To keep reading, please turn off your ad blocker, create an account or > support us by becoming a subscriber.

So Seattle Times doesn't want me to read this article unless I share my identity with them so they can sell it to others.

<comment><USER25> Without JS I just got a blank page. Enabled the main domain temporarily and I could see the article but then I was prompted to login with Facebook or Google. :D

<comment><USER8> For this and many troublesome sites, selecting reader view as soon as content loads evades the paywall.

Or for Wired, which apparently doesn't offer reader view, hitting escape as soon as content loads.

<comment><USER26> I'm curious if you or someone else could explain exactly how "reader view" gets around paywall and login walls. This feature for me has become invaluable.

<comment><USER27> The body text is all still there. It's just being hidden by some piece of JavaScript that reader view ignores.

</comment></comment></comment></comment></comment><comment><USER28> Hahaha .. uBlock origin has flagged 21 blocks, Privacy Badger 12 potential trackers. "Staying annymous"..

<comment><USER29> Shows how hollow most of this "privacy" culture is.

Stallman wgets websites and prints the text to read them, that's real privacy conscious.

</comment></comment><comment><USER30> I looks like those glasses just overexpose the video. You could probably turn down the exposure digitally and identify the person.

<comment><USER31> No, they don't just do that. They block certain wavelengths of light so the wearers eyes cannot be filmed.

</comment></comment><comment><USER32> No one cared who I was til I put on the mask.

</comment><comment><USER33> I wonder if people that buy this kind of masking techniques, still have a mobile phone in their pocket.

<comment><USER34> Even if they do:

      * They are aware of those, and therefore may use other countermeasures.
      * The masking still reduces the "surveilance surface".

EDIT: formatting

</comment></comment><comment><USER35> Funny Era.

</comment><comment><USER36> You have to accept surveillance, as it increases security of everyone.

<comment><USER37> No. It decreases the security of dissidents and many people living outside normal or legally approved modes.

<comment><USER17> Which Western country uses their military surveillance to decrease the security of its dissidents? I can't find such as case, while I can find many cases of surveillance used to stop tragedy. Seems like military surveillance in the West is predominantly used correctly: to counter terrorism and illegal crime.

Sharing military surveillance mitigation tricks is not unlike sharing 0-days against government systems, and can be seen as unethical and counterproductive: Military surveillance will try to improve their systems, and bad people will use it to avoid surveillance.

It is too simplistic to deem any and all surveillance as inherently bad and invasive. No country can ensure the safety of its tax payers if it cripples their counterintelligence, foreign intelligence, border security, counterterrorism.

People who deem national security as more important than individual security, or the security of anti-nation dissidents, or people living outside the legally approved modes, should be applauded. It is not very nice to decrease the security of me and my family to obtain an ideological goal.

<comment><USER38> The UK has been flirting with declaring Extinction Rebellion (an environmental protest group with a preference for street theater) as an extremist group. The US _did_ designate environmental and animal rights groups as terrorists in law back in the 90s.

<comment><USER8> I bet that Earth First was one of them.

[https://earthfirstjournal.org/store/product/ecodefense-a- fie...](https://earthfirstjournal.org/store/product/ecodefense-a-field-guide- to-monkeywrenching/)

<comment><USER38> I've only seen the designation applied to Animal Liberation Front and Earth Liberation Front, but my understanding is that there's considerable overlap between the latter and Earth First. They're an interesting legal example in that both groups explicitly disavow the destruction of human life and targeted their efforts toward property destruction, which is rather at odds with the popular understanding of 'terrorism' as discussed herein.

[https://fas.org/sgp/crs/terror/R44921.pdf](https://fas.org/sgp/crs/terror/R44921.pdf)</comment></comment></comment></comment></comment></comment>


Show HN: Nutrients Per Calorie, a web interface to the USDA foods database - <AUTHOR> http://ryanatkn.github.com/nutrients-per-calorie

<comment> bink-lynch This is great! My wife and I were just discussing the nutritional value of amaranth (Calcium in particular) and then I saw this.

To be clear, the bottom bar graph represents what 2000 calories of that food would contain of that nutrient? Being used to reading ingredient labels and the recommended values, I was thinking amaranth contained ~90% of Calcium per serving, then I watched the video. Do I understand this correctly? If so, you might want to label that somehow.

Very nice work! We love it!

Thanks!

<comment><AUTHOR> Thanks for the feedback!

Yes, that's correct, but everything is relative. The recommended daily intake is the recommended nutrient amount divided by 2000 calories, and this value is then compared against every other food. The bars for each nutrient are calculated according to the formula ((nutrient/calorie)/maxValue), where maxValue is the highest (nutrient/calorie) in the comparison set, and the result is a percentage of the maxValue, and is the percentage the bar is filled. So it's all relative - the highest value will always be a full bar. If something has half as much per calorie, the bar will be half-full. On the nutrients page, there is no daily value that's being compared against - it's just foods against each other.

Measuring something per-serving isn't something that you can glean from the data as presented. For amaranth, if you compare it to the recommended daily intake, you'll see a full bar for amaranth and just a sliver for the recommended daily intake, meaning 2000 calories of amaranth would have way more calcium than you need. More usefully, the app can show you how amaranth compares against other foods to help you make choices. I'll think about how per-serving data could be included - thanks!

<comment> bink-lynch Thanks for the explanation. I figured there was no per serving information from the data. Seems like there would not be a consolidate source for that.

I get it now. Again, nice work!</comment></comment></comment>


All you ever wanted to know about building a secure password reset (NSFW) - <AUTHOR> http://www.troyhunt.com/2012/05/everything-you-ever-wanted-to-know.html?HN2 <comment><USER3> This happened to be posted literally, to the minute, while I was ripping out some of the advice from my codebase, so let me take exception with one recommendation:

If someone attempts a password reset on firstname.lastname@example.com, and there is no record in the DB for firstname.lastname@example.com, immediately tell them so.

Why?

1) While this does "leak" the fact of firstname.lastname@example.com not being in the DB (and, by consequence, can be used to verify whether any email is in the DB), naive implementations of the best practice will _also_ leak that via a side channel. If you would not immediately greenlight $20k to have a security consultant spend one week auditing this feature extensively to avoid the timing attack, a) your app is _not important enough_ for this level of security and b) this buys you no real security, just the illusion of it.

1.5) This is totally security theatre if you have a registration process which checks for provided emails already being the in the DB, for example for telling people "That email is taken." Different route through the maze but same cheese at the end.

2) You can already spearphish people for their accounts on example.org . Start with an email list of people. Spearphish for their accounts irrespective of whether they have them or not. Collect wins since losses cost your botnet nothing at the margin.

3) MOST IMPORTANTLY: you're buying yourself six years of frustrated emails from customers which had _90% totally automatically discoverable solutions_ if you do this the "right" way. I'm speaking from experience. Many of your customers have multiple emails they habitually use. If you do the best practice, every time they misremember which one they signed up with, you get a support email. _This will be your #1 cause of support emails and the cost for dealing with them is astronomically higher than the minimal marginal gain in security for your users._

Edit: Omnibus response for people doubting that a side channel attack is possible:

The attacker wins with microsecond precision over the open Internet and nanosecond precision over the local network, which is plausibly achievable on all of the cloud providers than HNers like to host their apps at. Microsecond precision is enough to discriminate between "record in DB" and "record not in DB" on many plausible application architectures, even if your HTML/headers returned are exactly identical for the two cases (and they frequently won't be out of the box).

For example, the relevant code for Bingo Card Creator includes the line

user = User.find_by_username(params[:email])

This line takes approximately 30x longer to execute if it finds a user in the DB versus not finding a user. Why? ActiveRecord. You could, if you had a mind to, trivially discriminate between the two cases in under a week over the open Internet. If you _really_ wanted to ruin my day, you could get a prepaid Visa card and get a VPS from Rackspace on the same intranet, then discriminate between the two responses in under an hour, again without tripping anything.

Some folks think there are trivial ways to defeat timing attacks. You are either mistaken or you have a very different view of the word "trivial" than I do.

<comment><USER4> Not showing "user not found" errors may not be a strong security measure, but it's an effective and important privacy measure.

And while you may think that the fact that your app isn't a risk because it doesn't deal with sensitive issues, your users may not agree.

<comment><USER5> If the site has a registration form, then hiding e-mail in password reset is pointless.

Site's registration form validation will give the same information and without side-effects.

<comment><USER6> That's false for well designed signup forms. Signup forms should never leak "email/username does not exist" but only "this combination of email/username and password is unknown". This prevents the trivial attack. Timing attacks might still be possible, but then at least you're on the same level for both attack vectors.

<comment><USER7> _Signup forms should never leak "email/username does not exist" but only "this combination of email/username and password is unknown"._

Can you explain this to me? Is the only difference the error message used, or are you suggesting that apps should support multiple accounts with the same email/username but with different passwords? Or something else entirely? :)

Personally, I don't understand what difference a message makes; it'd be trivial for a user to test by signing up for an account themselves. And not having a unique login identifier would be a nightmare. Which makes me think I'm missing something obvious (damn this headcold, it makes me feel so much more stupid than usual!).

<comment><USER6> I'm sorry, my mistake here. I was thinking login forms. But the same thing can be done with signup forms, as explained in the response to the comment following yours.

</comment></comment></comment></comment></comment></comment><comment><USER8> The inclusion of the large graphic taken from a pornographic web site is not necessary (he could just write a single paragraph describing the potential to discover subscribers of porn sites) and shows poor judgement by the writer.

<comment><USER9> The style of the article was showing screenshot examples of relevant sites. That may or may not be the most productive use of screen space, however the porn screenshot fits in with the other ones.

Just to be clear, I think the inclusion of screen shots is an excellent use of screen space.

<comment><USER10> Screenshots are useful. But it would have been trivial to _keep a technical article SFW_.

As-is, this is a solid article that I can't send to my team because of that one poor choice.

Here's why:

1) I don't know the personal histories of everyone I work with, and it's none of my business (they aren't expected to tell me).

2) Some people would be seriously distressed to have their boss or co-worker email them anything with remotely sexual content.

3) I can't reliably identify who these people are, and so I simply shouldn't send anything with sexual content to co-workers/employees.

Doesn't this same logic apply to just about everyone?

</comment></comment></comment><comment><AUTHOR> I don't usually do this, but I am genuinely curious about this happening. At about 10:31 BST this morning the following item was submitted (not by me):

<http://news.ycombinator.com/item?id=4280213>

It quickly gained an additional 5 upvotes, and I was looking forward to the HN community's discussion, because I am about to revamp a certain site, and was looking to see what people thought about the specifics listed on that page.

It got to number 7 on the front page at about 11:10. Then it disappeared. It's now down between 900 and 950 or so. Yes, I went and checked.

I was disappointed - I always look forward to in-depth and/or illuminating discussions on HN - but more than that, I'm _really_ curious to know why this item has been flagged so heavily, or, alternatively, buried by the moderators/admins.

So please, here it is again. You're (obviously) free to flag it again if you feel the need, but please, let me know why.

Thanks.

 _Added in edit: If you upvote this submission then you should probably go upvote grn's original:<http://news.ycombinator.com/item?id=4280213> ._

<comment><USER11> I didn't flag it, but I remember reading about it some time ago. Probably here <http://news.ycombinator.com/item?id=4005239>

</comment></comment><comment><USER3> P.S. This article is a) very good even if I disagree with the advice and b) NSFW due to an unfortunately chosen example using a large image sourced from a pornographic site.

</comment><comment><USER12> His flowchart is missing an edge, between "user changes their password for any other reason other than password reset" and "password resets corresponding to that user are deleted from storage".

It's a minor detail, but an easy one to get right.

<comment><AUTHOR> Something like this?

<http://www.solipsys.co.uk/images/PasswordResetFlow.png>

I agree that there's more going on, but this is beyond the original remit. The flowchart can be made seriously more complex by adding in the flow for the simple changing of a password, which needs similar attention to details.

Would you care to assist in producing such a chart? I have provide the DOT source for this image if you like.

</comment></comment><comment><USER13> Can the porn picture be removed so people who want to keep their jobs can read it? Really, most of us keep-up with HN from work and would violate work-place policy by reading this article due to the choice of picture.

<comment><USER6> Actually, I'm a bit curious (and even though it's off topic) and since I'm from europe I'd love this to get a peek into american workplace ethics:

Why is this NSFW? The picture does not show nude girls, actually the level of nudity is about what I can get to see in a public pool or on the street on a hot day. The picture certainly is suggestive and hints at something more. The article does not link to a porn site, load images from a porn site or even discuss a porn site. Is the hint that porn sites (or this specific porn site) exists sufficient for the NSFW marker?

I'm asking since this is certainly not considered NSFW for anyone I know - <USER2> can see "worse" in respectable TV documentaries which air in the regular evening programme. And I guess there's little chance of minors being around here either.

<comment><USER7> I'm also from Europe, and find it shows a poor sense of judgement, mostly because the image is not necessary to prove the points being made.

The other problem I have is, as you say, the image _is_ suggestive. Imagine someone at your office glancing at your monitor whilst walking past. Would they bat an eyelid? I can't think of many workplaces outside of the porn industry where your professionalism wouldn't be called into question, however briefly.

<comment><USER6> Actually, yes. I'd be absolutely unconcerned to have the picture on my screen since it's obviously a screen cap in some article. In some work places I worked I'd be more concerned about coworkers/clients seing me reading a blog on paid time instead of coding than about that screencap.

<comment><USER7> _Actually, yes. I'd be absolutely unconcerned to have the picture on my screen since it's obviously a screen cap in some article._

Wow, that's interesting _and_ surprising; where are you based, and what types of companies have you been working for?

I'm definitely haven't worked in lots of cultures, but have worked in offices in the UK, Poland, Belgium and Germany, for major companies and for small, and in each one of them, Questions Would Be Asked were I to have that image on my screen, and in most cases - but admittedly not all - my professionalism would be called into question.

 _In some work places I worked I'd be more concerned about coworkers/clients seing me reading a blog on paid time instead of coding than about that screencap._

Hehe, well that's a very different argument, and one that you and I agree on :)

<comment><USER6> I'm currently berlin based, but worked all around germany from bavaria in munich, stuttgart, karlsruhe and cologne. I worked for all kinds of companies that revolve around web stuff, been the tech lead of a top 25 ranked web- development shop and had anything from tiny via government jobs to enterprise- class customers. However, I didn't do short-term jobs with changing coworkers, so I guess it's a bit about how well you know your coworkers and how much trust you have in them. It might draw a tongue-in-cheek kind of remark, but not a serious question of my professional abilities.

I'm more curious about the fact that people could obviously be afraid that this might be a firing offense - and I can't think of a single place where this could be possibly used to construct a case.

</comment></comment></comment></comment></comment></comment><comment><USER14> Even if the password-rest-page doesn't leak information about which e-mail addresses have accounts associated with them, the register-new-account-page usually does. Of course websites could work around this by sending an e-mail message to the address to confirm ownership first, but this is rarely done in practice.

An easier fix is for users to randomize the email-addresses they use. For example, if you have a Google Mail account, you can receive messages at firstname.lastname@example.com; if you use different random data for each site, nobody will able to probe for your account as described in the article, even on poorly-designed websites.

The advantage of this approach is that it's something that privacy-minded users can do themselves, without having to rely on website developers to get things right.

</comment><comment><AUTHOR> As requested, marked NSFW. It will be interesting to see if the mods change it back, or to something else.

<comment><USER15> is it NSFW because of graphic or nude images, or because of language?

<comment><USER16> screenshot of porn site with nudes.

<comment><AUTHOR> Er, except they're not nude. Suggestive, yes, but not nude.

<comment><USER16> I was in my garden, the sun was on the screen. Looked more-or-less nude from where I sat.

</comment></comment></comment></comment></comment><comment><USER17> Really good article, well written. Easy to read.

>> Everything i believe is important

In the spirit of completeness, you could expand the details of this paragraph:

>> What we want to do is create a unique token which can be sent in an email

There should also be a Time to Live on the token, and it should only be usable once. On the landing page for the link, the user needs to enter* their email address to avoid someone arriving at the url from a means other than the original email.

I feel like i should give an example there, let's say the attacker figured out your random id generation method, say it's a hash of a timestamp for simplicity, if they generate a few thousand links for around 6pm, they may get lucky).

* They don't actually need to enter it, UX guys would be having minor heart attacks at that suggestion, but they could choose their email address from a small table of plausible looking but made-up addresses, or something to that effect, e.g. Bank of America uses a photograph the user setup beforehand.

<comment><USER18> Rather than force people to do an extra step, why not just use a secure method of generating reset IDs?

</comment></comment><comment><USER19> I'm late to this party, but one thing I take minor issue with in this article, is the "log everything" section. I agree that logging is good, and don't want to give a wrong impression on that, but, logging _everything_ can have some problems. Users regularly clicko the username/password fields and you'll get exploitable logs of: odd username from IP followed shortly by real user name from same ip with successful log-in. If you don't secure your logs well, you now have a potential security breach, and those log systems can be vulnerable to all the stuff you went through that password securing rigamorole to avoid (bad software, sql injection, etc, etc.) I bring it up, because a lot of times people don't think to secure the logging system as much as the other stuff, partly because it is regularly behind the dmz, and partly because it is just off the standard security map for user security issues.

Just $.02 for this conversation :)

</comment><comment><USER20> > Bottom line: treat secret answers as secret!

Bottom line: never give real answers to secret questions! I can change my password, I can change my credit card if it's compromised, I can even change my social security number if need be, but I can't change the name of my first pet or where I first met my spouse. Never give real answers to secret questions.

</comment><comment><USER21> The one thing I've seen mentioned before that wasn't in here is to delete the reset token if the user successfully logs in.

</comment><comment><AUTHOR> As expected, this submission has been flagged.

As expected, no one has said _why_ it's been flagged.

Unexpected bonus, the original submission has gained enough points to be back on the front page despite having been flagged off it. So that's a win.

 _Added in edit: Now it's been flagged off again. There are times I really don't like the dynamic on HN._

<comment><USER22> I've seen this happening on a couple of accasions with stories that are uncomfortable for HN. E.g. see <http://news.ycombinator.com/item?id=4160121>

It might be interesting for one of the sites that scrape HN to reverse engineer the decay factor for different type of stories and find out which stories are "disappeared" quicker.

</comment></comment><comment><USER23> Don't store reset tokens in database, PITA and not scalable. Instead HMAC sign reset URL, using Rails' MessageVerifier class for example.

The reset URL should also expire in about a day, so include and sign timestamp as well.

And the way we know this is good advice is that most large sites do it this way already.

<comment><USER24> You'll also want to implement some defense against short-term replay attacks (i.e. before the token expires).

You could include a sequence number in the token, but this, of course, involves a database write, which is what you were trying to avoid in the first place.

A better approach would be to store in the database the time that the user's password was last changed, and refuse to honor any reset tokens that are timestamped prior to that time.

<comment><USER25> Beter yet, mix in a random data field from the user record into the reset link (have it signed with HMAC), and regenerate the random each time reset it done. This way no reset link can be used twice, and no db writes are done when reset link is created.

</comment></comment></comment><comment><USER26> How about this:

        if database.contains(email) or md5sum(secretSalt + email).startsWith('4'):
            print "An email has been sent to this address with further instructions"
        else:
            print "Sorry, this address does not exist in our database"

Now one in 16 (pseudo-randomly selected) emails will appear to be in the database, whether or not it is really there.

The attacker will still see the "confirmation" when they enter the victim's email address, but they cannot know if it was really in the database or if it was one of those random false positives.

<comment><USER27> Timing attack vulnerability. A negative containment check is probably faster (at least statistically measurably so) than a positive one, so you'll see three peaks:

\- contained \- false positive \- not contained

Probably with the first two being close together and the latter two being close together.

</comment></comment><comment><USER28> TLDR; [http://lh5.ggpht.com/-ke9GVduXaaY/T7rBCWHFkYI/AAAAAAAADmY/xv...](http://lh5.ggpht.com/-ke9GVduXaaY/T7rBCWHFkYI/AAAAAAAADmY/xvEOczv44Zg/Password- Reset5.png?imgmax=800)

<comment><USER16> There's still a timing attack there, just compare the time it takes for the server to send the email, instead of the time it takes to return the message.

<comment><USER29> What? How does the attacker know when the server sends mail?

Nice summary, sandstrom. Not as useful as reading the whole article, but much higher value-per-effort. ;)

<comment><USER16> You can leak that data in a number of ways. Trivially, the server might timestamp the email. Less trivially, you could position yourself on the same network as the server and just time how long it takes to receive the email (I'd opt for this technique personally). You might be able to monitor IP IDs of the mailserver to see when it sends an email (technique: <http://nmap.org/book/idlescan.html>). The emails themselves might have some kind of predictable sequence/message ID in the headers so you can cause the server to send many many emails and watch for the sequence increment. You could create a custom DNS server for your email domain that causes the email server to hit your DNS and log when the lookup was made. Probably other techniques.

edit: Not to mention that this chart _still_ leaks the fact that email@example.com is or is not a member of the site in question.

</comment></comment></comment></comment><comment><USER30> This is welcome, useful and covers many of the salient points. However, without wanting to detract from the content, this is 2012. None of these issues are new. For people who aren't doing some or all of this, isn't it time to consider not reinventing this well-worn wheel? Libraries of reusable code; now there's a good idea! Now I know what mom meant when she talked about the OO silver bullet.

I'm off to invent distributed processing and BSD sockets.

<comment><AUTHOR> You have libraries that do all this? Fantastic - please submit a reference so we can all benefit from it - thanks.

</comment></comment><comment><USER31> I have to disagree with this point

        Despite plenty of guidance to the contrary, the first point is really not where we want to be. The problem with doing this is that it means a persistent password – one you can go back with and use any time

If a developer can't work out how to implement a one-use password that forces a password change after login, they shouldn't be writing code.

<comment><USER32> That puts the onus on the user to immediately log in after receiving the temporary password. Until they do (which could be months later), they have their password to the site stored in email. The DoS issue that was mentioned in the next paragraph is also a pretty good reason to use a reset link instead.

<comment><USER31> So you're suggesting that a user who goes to a site to login, and can't (forgotten password) will then completely lose any and all reason to login to the site, AFTER doing what's required for a new random password to be generated and sent to them?

Sounds pretty far fetched to me.

</comment></comment></comment><comment><USER33> While it's not common practice, I strongly believe that for particularly important services, there should be a time delay built into the reset process, so that if a user's email account is compromised in such a way that both the attacker and the victim receive the emails, the victim gets a chance to stop the reset process before any damage is done.

</comment><comment><USER34> Please mark this article as NSFW!

<comment><USER35> Now we know what kind of sites this Microsoft MVP likes to peruse. :-)

</comment></comment><comment><USER36> i just came to say I am really looking forward to reading this.... when i get home. why did you post porn in this?

<comment><AUTHOR> Just wanted to ask: Are you one of these people who can't distinguish between the author of a post, and someone who posts a link to it?

<comment><USER36> it was most of a generalized comment on the post than an actual question. I promise to be more careful next ColinWright.

</comment></comment></comment><comment><USER37> So I read it at work because it was marked NSFW

<comment><USER30> National Science Fair at Wisconsin?</comment></comment>


Impact of EV Vehcile-to-Grid Charging During UK Lockdown [pdf] - <AUTHOR> https://www.kaluza.com/wp-content/uploads/2020/06/White-Paper-Freeing-up-the-Locked-Down-Grid_Final-Version-.pdf <comment><AUTHOR> This is quite an information rich PDF, so jump to page 12 if you want to see how vehicle-to-grid charging responds to demand on the electricity network.</comment>


The absurdity of American health care pricing, in one chart - <AUTHOR> https://www.google.com/amp/s/www.vox.com/platform/amp/policy-and-politics/2018/5/9/17337134/health-care-costs-hospital-rates-insurance <comment><AUTHOR> I think the conversation around health care costs in the US should start here. 30% of spending is on hospital care, and 20% is on physician and clinical care outside the hospital. Increasingly hospital-led health systems own outpatient clinics, so their bargaining power is massive. Groups like Sutter, Ascension, HCA control significant swaths of this 50% chunk of US health spend with monopolies or near monopolies in some regions, and can push insurance companies

Yet the conversation is focused on drug pricing, which represents 10% of US healthcare spend. If we brought our per capita drug spend down to OECD averages it would basically result in flat year over year growth for just one year, and then things would go back to normal. I work in biotech (and know egregious stuff happens) but am also starting a company aimed at tackling the issue mentioned above for full disclosure, but I think the data are pretty supportive of those positions

<comment><USER2> Your comment about hospital system negotiation is really important.

A good example of the crazy costs hospitals pass onto insurers are drug costs. If a patient goes to their physician for say Rituxan, the doc gets paid a 4.3% mark-up on what they pay for the drug, plus the infusion fee.

At a hospital? They mark-up the drug by 100%+, and often get a 340B discount so they can profit wildly.[1]

Hospitals have been acquiring physician practices at an astonishing rate, which means costs go up when the service offered doesn't change at all.

And your comment about local monopolies is very true. If your a hospital system in a rural location (only game in town). You can bend insurers over with your fees.

[1][http://www.drugchannels.net/2016/04/new-data-how- outrageous-...](http://www.drugchannels.net/2016/04/new-data-how-outrageous- hospital.html)

<comment><AUTHOR> Medicare part b drug pricing / economics is such an unfortunate part of our healthcare system. Fortunately there aren't too many drugs under that payment system but it creates a whole lot of weird incentives for those that are. There's a great investigational video on price of part b cancer drugs but I can't seem to find it, I think it was done at MSKCC or elsewhere in NYC

</comment></comment></comment><comment><USER3> It would nice to have the actual link to the website instead of the Google amp version.</comment>


When Should You Hire a Junior Developer? - <AUTHOR> http://blog.airbrake.io/devops/when-should-your-hire-a-junior-developer/

<comment><USER2> It's going to be interesting to see whether or not the development market collapses in the next couple of years when SF is finally either out of ideas or full on people (if it arguably isn't already), and the rest of the country can't keep in step because most other cities' markets are clamoring just as badly (if not worse) for the seniors. The issue, though, is that it's a catch-22 right now. Companies in smaller cities want seniors so they can get work done and not have to train anyone, but the seniors generally don't want to work in places that aren't SF/NY.

Someone has to budge, unless the market is to die completely. I can't mention how many times I've seen companies posting for the same position for upwards of a year instead of simply taking a chance on someone. Sometimes it doesn't work out, but that's business. Don't run one if you can't take the risks.

<comment><USER3> _Companies in smaller cities want seniors so they can get work done and not have to train anyone, but the seniors generally don 't want to work in places that aren't SF/NY._

Disagree strongly. In fact, I'm moving to Baltimore (from NYC) for a few years (probably) and really looking forward to it. There are a lot of smart people there-- a lot of different kinds of smart people, unlike in, say, the Valley where there's one kind of smart people and that's programmers-- and DC is only an hour away. I might end up in California eventually, but I'm seeing a lot of interest in the most talented people in getting away from the legacy-laden "star cities". It's not quite an "exodus", but I hear more conversations about Austin than San Francisco around NYC. Six or seven years ago, Austin was barely on the map; even New York was the hinterlands except for Wall Street. Now, the general sense is that the Bay Area is for older people who were able to get in and buy a place at a reasonable price, before it got all fucked up.

Makers like new places and open opportunity, as well as freedom from established hierarchies. That means they'll always be moving around from one generation to the next. To tell the truth, though, macrolocation (California vs. Texas; Northeast vs. South) seems to matter a lot less over time, and microlocation (cities vs. suburbs, proximity of cafes and bike paths) matters more. I think that trend's continuing, thanks to the Internet. 20 years ago, or even 10, being an unusual person (3-sigma intelligence; gay; artistic inclination; minority religion or, in many communities, no religion) in a B city meant social isolation. In 2013, it really doesn't; you can find your tribe even if you are, say, an atheist in the South.

 _Someone has to budge_

I think that the next 15 years of talented young people are going to be more dispersed than the last 15. That means there will be fewer superhubs and that's a good thing. It does, however, fragment the labor market, which means that the volatile culture-- the two-sided itchy trigger finger dynamic-- of promiscuous job hopping and fast firing will have to go. Companies will also be more willing to invest in talent. They'll have to be that way; the extremely liquid talent market of the Bay Area now won't exist (anywhere) in 10 years.

<comment><USER4> What is it you like about Baltimore? I haven't heard of it having many technology jobs but it is an interesting place. I live near Baltimore now. Drop me an email if you have any questions.

<comment><USER3> What's your email address?

<comment><USER4> I think I just emailed you. Not sure if I got the right email.

</comment></comment></comment></comment></comment><comment> UK-AL Considering a lot of start up founders are pretty much straight of college. And many people develop projects in their own time. I think junior developers are really underestimated. When you hire a junior you could be hiring someone crap, or someone who could be better than your seniors(I've met some bad senior developers), especially if they've been developing code since they 13 or something. Informally those types could have more experience than your experienced devs.

Self taught developers may also underestimate what a cs degree confers. They may not know specific frameworks, but they probably know more than you about compilers, formal grammars, machine learning and stuff like that.

<comment><AUTHOR> Good point. Especially given how easy it is to retrain junior developers through things like Treehouse and dev bootcamps, I think it's an investment more companies will start making.

<comment><USER3> I'm skeptical of the Dev Bootcamp phenomenon, if only because it seems like many of them are very expensive. I've heard of five-digit tuitions for three- month programs.

Then again, I guess it's good for us that this is happening because it will drive up the value of high-end programming talent. I've heard that "teaching programming is the new teaching English abroad" and that could be good for us as a group; we'll get better pay and more autonomy in the long run.

<comment><AUTHOR> Sure, but considering that an average salary in SF is 80-90k, seems like an investment worth making if they can deliver what they promise. Especially when compared against the cost of a 4 year CS education.

<comment> UK-AL I don't like dev bootcamps. I think they produce people who know specific things like web dev with ruby or iOS development. They are like the java schools spolsky warned us about.

I think the best developers are generally educated in cs.

</comment></comment></comment></comment></comment><comment><USER5> I'm a "junior developer" (and first time poster!) who is about to graduate with a degree in CS and have a little over a year's worth of internship experience both at a medium/large (1500-2000 employees at HQ) and small/startup (~70 employees) sized company. As I apply to a number of companies I'm interested in working for it still surprises me that the majority of these listings for dev's are asking for 3+ years or 5+ years experience. Now I completely and whole-heartedly agree that if the job description mentioned something ridiculous (we need you to create custom SOAP requests using haskell) then perhaps the experience is merited. But when I actually reach out to the companies asking for 3+ years experience and ask what they're trying to accomplish in the immediate future, where they need additional developers (i.e. what team is this for), etc. I'm surprised to hear it's nothing unusual. There might be the need to occasionally do packet inspection (or something else semi-uncommon) for debugging or what have you but is this really beyond me and my peers? It might be beyond some, and while I can't speak for all the junior dev's out there, I personally am comfortable enough to do this on my own.

Now please correct me if I'm wrong but basically it comes down to this: if I were the hiring manager I wouldn't focus so much on the number of years the dev has but rather if that dev "still has it" (if they're older/more experienced). By "still has it" I mean a genuine passion for writing solid code and being humble enough to know when they're wrong and changing their behavior. If it's a younger dev maybe it's best to focus on trying to determine if they have a genuine interest in becoming a better programmer and a real thirst for knowledge/love to learn (in-line with the article). My only gripe with the latter point are _how_ some of these companies are filtering but that's entirely their choice.

<comment><USER6> Just because they put 3+ years experience on the job req, doesn't mean that not having 3 years experience will preclude you from consideration. Job reqs are often a wish list, and they'll hire someone who only fills some of the reqs.

</comment></comment><comment><USER7> I saw Vinod Khosla @StartupGrind and he had this to say about junior people on teams (I am paraphrasing a lot):

You want to have a balanced team of experienced people and junior people. This creates a team that is willing to try new "risky" ideas and at the same time allow for insight from experience. Age should not be a factor in seniority.

He also noted that, unfortunately, we usually hire in our own image.

</comment><comment><USER8> Joel said it best: Smart and gets things done. That's really all you need. They don't need to be rock stars or 10xers or top 1%. You just need to be able to give them something to do and have confidence that it will get done in a timely manner and the code won't end up on Daily WTF. They need to have enough passion to bring some new knowledge to the table once in a while without you explicitly telling them to go learn about X. They need to get along with their teams. I think if you just push hard for those simple things, you will end up with some top tier developers anyway.

</comment><comment><USER9> junior / senior are just titles that don't always mean something.

better to hire a junior who is willing to learn than a burnt out senior who can't adjust to change.

to be honest though in my 10 year experience in the field i've seen a lot of junior developers who believe that finishing university was the last time they ever had to learn something new.

<comment><USER10> > better to hire a junior who is willing to learn than a burnt out senior who > can't adjust to change.

ageism much?

I think it depends on the background of each candidate, and age is irrelevant. Job history, on the other hand, isn't irrelevant.

<comment><USER11> I don't think they're saying all senior revs are like that, just that an eager junior is better than a jaded senior. Obviously an eager senior is best of all. See the above discussion about how hard it is to find those people.

</comment></comment></comment><comment><USER12> I've been job hunting for a while as a sort of "Junior Rails Dev", and am finding it near impossible to find a job at a startup. I really question which companies will train people in some startup-heavy technologies like Rails and Node.

<comment><USER13> Startups aren't the place for junior devs in any technology stack. What you need is an established, profitable small business that's NOT a tech startup. The company I work for sells makeup. You'll probably inherit a broken pile of shit, spend a year or two cleaning it up, refactoring, and upgrading to the newest stack. Take the opportunity to learn best practices and CS theory and use them in your job. When you're done, consider yourself ready for a more serious job.

</comment></comment><comment><USER14> This is a pretty interesting post from a company who's product languished for years, and was an absolute bear to use. Opening up the market for people like GetSentry, Errplane, etc. I suspect they needed more senior devs not less.

</comment><comment><USER15> I've seen it defined a couple different ways, so I'll ask for HN's opinion: What exactly constitutes a junior dev?

Less than 3 years? 5? Less than X jobs?

<comment><USER6> Here's one: someone who doesn't yet know how to work in an industry environment, instead of an academic environment.

Another: Someone who both needs hand-holding when starting a task, and lacks confidence in their final output.

</comment></comment><comment><USER16> when you have just enough money to allow for it, but not enough money to pay for someone with any higher skill level or experience.

</comment><comment><USER17> A little bit meta, and to be clear I'm making no assumptions, statements or complaints about here; but it's interesting that this describes the hypothetical junior developer as female. In the following line, why would the author not just say _their_ , to include both genders?

>> When you hire a junior developer, you're going to have to invest resources in her training.

<comment><USER18> 'their' is plural and therefor would be grammatically incorrect

<comment><USER19> > 'their' is plural and therefor would be grammatically incorrect

No, while "their" is grammatically plural which affects verb conjugation (e.g., "he goes" vs. "they go"), its use for cases which where the antecedent is singular in number and indefinite in gender is well-established English usage which long predates the Latin-inspired prescriptivist attempt to erase such usage and was never seriously diminished in use despite that prescriptivist effort.

In English as it is, rather than English as some lovers of Latin wished it would be, "they" is perfectly correct for this use.

<comment><USER18> Ok, thanks for the correction. I was not aware of the storied history of plural they. I rarely, if ever, see this pattern in professionally edited writing, though. Is it just me?

<comment><USER20> You likely see it all the time and don't notice it.

[https://www.google.com/search?q=site%3Abbc.co.uk+"has+their"](https://www.google.com/search?q=site%3Abbc.co.uk+"has+their")

[https://www.google.com/search?q=site%3Anytimes.com+"has+thei...](https://www.google.com/search?q=site%3Anytimes.com+"has+their")

[https://www.google.com/search?q=site%3Aguardian.co.uk+"has+t...](https://www.google.com/search?q=site%3Aguardian.co.uk+"has+their")</comment></comment></comment></comment></comment>


Tapbots: Don't Panic - <AUTHOR> http://tapbots.com/blog/news/dont-panic

<comment><USER2> Agreed, Twitter requiring you to get in touch with them should your app grow past 100k users seems like they're just setting a public limit for the point at which they want to vet that your application is behaving correctly.

From my experience with the Twitter API team, they've always been open and responsive, particularly with regards to a "Hey, I would like to do X with your API, is that alright?"-type questions.

I think Twitter have taken a lot of unfair flack from this announcement, when it seems like a really positive step forwards.

<comment><USER3> Here's their response to the suggestion that they allow CORS:

<https://dev.twitter.com/discussions/1291>

Here's App.net's:

<https://github.com/appdotnet/api-spec/issues/10>

Can you spot the difference? Hint, consider the nature of the relationship between the platform and developer in each case.

<comment><USER2> _Can you spot the difference? Hint, consider the nature of the relationship between the platform and developer in each case._

Be fair, you're comparing apples and oranges; a world as it would be nice to live in when discussed amongst friends, as opposed to those who have to maintain a world with _just a few_ more people involved in it than that.

<comment><USER3> Something tells me the support tickets with advertisers looks more like that App.net thread.

</comment></comment></comment></comment><comment><USER4> TL;DR: one of your favorite twitter clients doesn't see most of this being a problem for a couple years --- and even then, they imagine there will possible routes for them to take when that time comes. Granted, they may be misunderstanding their relationship with twitter, but they really do sound optimistic.

It doesn't acknowledge the worry of newcomer developers to the twitter ecosystem, but I feel that we've been doing a good enough job of speaking to the doom and gloom here on HN. ( __Edit: __See lukifer's comment. Excellent example of one of the difficulties that new apps will face)

<comment><USER3> We got completely different takeaways from this article. My takeaway tldr is: "don't stop buying our app just because the future is bleak". This statement struck me in particular:

> We'll be working with Twitter over the next 6 months to make sure we comply > with these new requirements as much as possible.

As much as possible? You have to comply 100%, I'm pretty sure Twitter won't be happy with you just making an effort. The new display requirements and the requirements not to include extended functionality nearly eliminate clients' ability to compete on anything other than just looks. Tweetbot features like Mute are going to have to go away.

I'm not doubting their commitment at all, by the way. I just read this article as a glass half-full perspective.

</comment></comment><comment><USER5> I'm impressed with their positivity but then they have effectively just been granted a monopoly.

<comment><USER6> ...how have they been granted a monopoly?

<comment><USER7> "Monopoly" is too strong a word, but "advantage" is not quite strong enough. In short, new Twitter apps will have a cap of 100k user tokens, while Tweetbot gets 2x their current number of tokens (hypothetically, if they have 400k users now, they get 800k tokens). A new developer will _never_ be able to get 800k tokens while the new rules stand.

Of course, there's nothing to stop Twitter from creating new new rules that kill Tweetbot or remove the advantage.

<comment><USER8> > A new developer will never be able to get 800k tokens while the new rules > stand.

What makes you think that?

Twitter didn't set a hard limit of 100K tokens for all new apps. That's just the _initial_ limit. You can request more, and I assume they would grant them to popular, legitimate apps.

<comment><USER9> It will be difficult however for "traditional" clients to get deals for more than 100k tokens.

<comment><USER10> Where was this stated?

<comment><USER9> > That upper-right quadrant also includes, of course, "traditional" Twitter > clients like Tweetbot and Echofon. Nearly eighteen months ago, we gave > developers guidance that they should not build client apps that mimic or > reproduce the mainstream Twitter consumer client experience."And to > reiterate what I wrote in my last post, that guidance continues to apply > today.

<https://dev.twitter.com/blog/changes-coming-to-twitter-api></comment></comment></comment></comment></comment></comment></comment>


Ask HN: How can I contribute? - <AUTHOR>

To put it bluntly, I currently offer no value to the tech community that has gotten me to a position where I am employable; and I don't like that.
What I am looking for is advice on how I can give back. Yes, I know I could write some blog posts and craft amazing open source projects that make everyone's life easier, but I don't know how. What do I write about? What would my amazing open source project do?
Also, I would like to join discussions here on HN. The problem with that is that I am the kind of person who, if I don't have anything to add to the conversation, does not say anything. And I almost always feel like I have nothing to add.
How do I get over all this and become useful? <comment><USER2> The classic answer is: "please write all this boring documentation stuff for $your_favourite_project", or pick a boring bug report in some project, triage ot and fix it. It's all very valuable stuff, but it's fracking boring.

The real answer is: find a project you like, even a small one, and patch it to do something you find even more useful. If you think you can't do it, maybe it's a good chance to use it as a skill-up project. Or, rewrite an interesting lib or useful tool from $language_you_dont_like to $language_you_love. Or just put on GitHub some private tool you wrote that someone else might find useful.

</comment><comment><USER3> You know, people (myself included) write on HN not because they want to "contribute" or being "useful to the community." But because it is an interesting past time. Is being useful to other hackers really your goal?

</comment><comment><USER4> You could write the process and steps that got you to where you are now, for others who also want to become employable.

Focus on replying to the questions in the 'ask' thread. This is the community directly asking for feedback/input.

Your best projects will come from working on things you're passionate about.

</comment><comment><USER5> work on an existing open source project that does something you need/want.

<comment><AUTHOR> This is a problem I've had before. I couldn't find anything that I needed or wanted. Recently though, AngularJS has struck a chord, so maybe I'll give that a try.

<comment><USER6> Well, if you're looking to give back, you could try finding something that many people want.

</comment></comment></comment><comment><USER7> Make a decent pivot table for BootStrap + KnockOut.js :).</comment>