Gas Pump Skimmers - <AUTHOR> https://learn.sparkfun.com/tutorials/gas-pump-skimmers <comment><USER2> Chips aren't anymore secure, I can read the data off my card with a standard chip reader, and I have. The same data on the chip is on the mag strip.

Just because you are using the chip doesn't mean you are doing an EMV transaction. The unique transaction codes only happen with and EMV transaction, almost every time you dip your card it's a regular old card transaction, just as if you swiped the card. Why?

Getting EMV certified requires every part of the transaction chain to go through unified system testing, __for each combination __of hardware, software, card type, processor, issuing bank.

I've been eyeballs deep in this nonsense for the last year or so. We just can't justify the expense of getting EMV certified, so we just accept the chip and do a regular transaction.

As a consumer you have no way of knowing if your transaction is and EMV transaction or just a chip enabled regular transaction.

<comment><USER3> But also, I don't care as a consumer. Because I don't have any liability. In fact, I prefer the swipe as it is a few seconds faster.

<comment><USER4> Except getting skimmed and disputing charges is annoying, not something I care to deal with. I'd rather we have more secure infrastructure that doesn't sustain criminal activity.

<comment><USER5> It takes 5 minutes and a few clicks on a web site now a days. I'm all for more security too but like OP it isn't really my responsibility nor my liability so I have little care.

<comment><USER6> My last bank made that easy. But required a new card and a new PIN, and immediately and automatically cancelled the old one. As I was abroad at the time, this was not a fun process. Not that it's particularly fast even if you walk into a branch.

<comment><USER7> This is one of the reasons I think it's important to have more than one credit card when traveling (especially abroad). Redundancy in case one get shut down at an inconvenient time in an inconvenient place.

</comment></comment></comment></comment></comment></comment><comment><USER8> I recently traveled to the US, and stayed in a hotel of a major brand which had some outdated payment terminal that only used the magnetic strip of the card (without even a possibility to enter the PIN). The transaction was over a thousand USD. I had cards from two different banks: one failed because the PIN wasn't entered, and the second one got through. But after several months the second bank somehow freaked out and charged back about a third of the amount (probably flagging the transaction as fishy or something). I tried to contact the hotel to somehow return them the money that were mistakenly returned to me, but apparently there is no mechanism to do that.

<comment><USER9> > _some outdated payment terminal that only used the magnetic strip of the > card_

Sadly, this isn't all that "outdated" here. There are still lots of places in the U.S. that don't use the chip and basically none -- does anywhere? -- use a PIN with it. I don't even _know_ if I have a PIN on any of my credit cards, much less what it is.

<comment><USER7> I think Barclaycard is the only major CC issuer in the US to have actual PINs on their cards but it defaults to signature. Here's what they say about it:

>Your credit card is a chip and signature card with Personal Identification Number (PIN) capability. In most cases when you travel abroad, you'll be asked to sign for your transaction. However, at some unattended terminals, such as train ticket kiosks, you may be asked to enter your PIN instead of signing.

</comment></comment></comment><comment><USER10> I still don't get why _all_ credit cards have magstripe when we have chip&pin for decades. Yes, I know it's required by a standard, but I see no justification for that. I have never used magstripe , but it's right there on my every card and there's no way to disable it (I've asked my bank for it), unless you deliberately destroy it (scratching or similar manner).

<comment><USER11> It's a backup. I've heard from retailers that the failure rate on the chips is much higher than it is for swiping.

In Australia you pay for fuel after filling up, and one fuel station owner is dealing with an average of a driver or two a day who is unable to pay for fuel.

They don't carry cash, the chip/EMV is failing and they don't have the mag stripe linked to a facility since they're often debit cards.

Apparently the failure rate on phone based payments is also high(er).

It's one of those issues I wouldn't have considered before speaking to retailers.

<comment><USER12> Yeah, the chips are nowhere near as reliable as the magstripe. It seems like a transitional technology only - NFC is fast and reliable.

<comment><USER13> > NFC is fast and reliable

I know you're speaking of NFC chips in cards, but you might know — Does the phone version (Apple Pay/Android Pay/Samsung Pay) still work when my phone's battery is dead?

<comment><USER12> It won't - one reason why I think NFC-enabled cards will be around for a long time even people only carry one as a backup for their phone.

Though theoretically your phone could have a RF-powered NFC chip in it that took over when the phone is off...

</comment></comment></comment></comment></comment><comment><USER14> This is an awesome article breaking this down really well. So why are you all talking about Chip and PIN? Talk about the article and about the technology stop arguing politics of chip and pin.

</comment><comment><USER15> Most interesting part is that they managed to get the hex dump of the software. Quick glance shows there are no copyright texts in it, bummer!

I'm not an expert in PIC assembly but it seems there is very little code and there are no obvious code paths, like a switch..case like construct for processing the serial commands. Lots of I/O and not much more. Most likely they are not decoding the magstripe data in PIC but just get the decoded data and store it.

<comment><USER16> I just tried disassembling the hex file. Unfortunately, the code protect bits are set (location 0x300008 is 0x00). This means that the ROM from 0x000800 to 0x007FFF will read as zero. And indeed, that entire space is filled with zero. So, I think we're missing much of the actual firmware.

Edit: And the reset vector begins with a branch to location 0x001ACA, which is all zeroes, so I'm pretty sure most of the firmware was not read out due to the code protection.

<comment><USER17> From a quick Google Search, a Russian company is offering microcontroller code-dumping services: [https://russiansemiresearch.com/en/faq/](https://russiansemiresearch.com/en/faq/)

I have no idea if this is legit or not. I doubt your law enforcement would let you access their services anyway.

Edit: My guess would be they work with industrialized de-capping + software to dump the memory, like this: [https://www.bunniestudios.com/blog/?page_id=40](https://www.bunniestudios.com/blog/?page_id=40)

There are other "chip intelligence" companies in the US, some of which probably have such services. At a different cost.

<comment><USER18> On some of these embedded chips there are methods to glitch the fuses for read protection by messing with the power (a form of fault injection attacks). These used to work a few years back but I haven't heard if they still do.

</comment></comment></comment></comment><comment><USER19> The first gas station chain that offers Apple Pay/Android Pay as a payment instrument gets 100% of my business. I'm really hoping Costco will enable the contactless payments on their pumps sooner rather than later.

<comment><USER20> A lot of Exxon/Mobil stations do now.

<comment><USER13> IIRC, when I lived on the East Coast in the 90's, Exxon was a pioneer with contactless payments. They had a little round thing that looked like a quarter of a pencil that you could put on your keychain to make payments at the pump.

<comment><USER21> I also remember this in Canada in the late 90s. ESSO had such a device. I think other stations (Shell, Petro Canada) also did.

</comment></comment></comment></comment><comment><USER22> In the second image here [1] there's a security seal on the payment closure as a whole; I'd imagine a simple security seal along the side of the card scanner intake would thwart most would-be card skimmers, no?

At that point the employees could just make it part of the standard inspection and it'd be more obvious to customers if they were missing.

[1]: [https://cdn.sparkfun.com/assets/learn_tutorials/6/9/4/Gas_Pu...](https://cdn.sparkfun.com/assets/learn_tutorials/6/9/4/Gas_Pump_External.jpg)

<comment><USER23> It seems to me that you could just put some kind of sensor on the inside of the gas pump access door that notifies someone as soon as the door is opened. If you know there is a maintenance guy scheduled for that day/time, then you just ignore the notification. If not, then you know that there has been unauthorized access to the pump.

<comment><USER13> Lots of people have access to gas pumps and their keys. Not just the station owners, but the managers. Also city/county/state weights and measures regulators, the guy who maintains the attached screen that shows the local news and weather loop, and probably more that I don't even know about.

From what I've seen about gas pump locks, they look about as "secure" as those round keys that came with every IBM AT-clone in the early 90's. They kept the weak and the ignorant out, but you could unlock your buddy's rig at will.

<comment><USER24> So... is the trick to have your own key so you can open these things and have a look inside before you swipe your card? If the store is not going to offer me security, I'm going to take care of it myself.

</comment></comment></comment></comment><comment><USER25> Nice writeup. But in the article they write:

> Are you angry that your card has been stolen, again? Contact your local > congress person or senator and ask them to pass legislation that fines gas > stations $100 for every card that is discovered on a skimmer in one of their > pumps. It's ultimately up to the gas stations and pump manufacturers to > secure their pumps.

Suggesting a solution like it's an easy fix always bugs me a bit. Would a 100USD fine actually work here? The issue seems more with the fact that the US hasn't upgraded to a chip&pin style system. You might end up just costing the gas stations more money, when they don't actually have the power to do much about the problem.

It feels a bit like victim blaming, when in this case the victim has little choice but to work with the system as they find it.

<comment><USER26> Pretty much all US cardholders have chip+pin now. I'd say about 75% of retailers support it.

(Not sure if this is how it works outside of the US, but we currently have cards with both magstripes and chips. You use the chip where it's supported, the stripe where it isn't.)

<comment><USER27> Here in Australia its pretty much 100% chip and PIN or contactless payments (paypass). Has been for a number of years now.

I don't think anyone swipes cards unless there is something wrong with the payment terminal. Even vending machines are tap and go.

<comment><USER28> Same here in the UK - it's ALL Chip & PIN, I can't even recall the last time I had to swipe my card[1], and I use it a LOT (yay, Airmiles!).

If the payment is <= 30 GBP, it's an offline transaction as well. Anything over that amount triggers a round trip to the backend servers.

As an aside, it's now perfectly possible to live a cashless life in the UK if you wanted to.

\--

[1] That said, I think ATMs read the mag-stripe... but I don't really use those either these days.

<comment><USER13> > it's now perfectly possible to live a cashless life in the UK if you wanted > to

Perhaps in London. Try spending a long weekend in Torquay.

<comment><USER28> I'm sure the Tesco, Sainsbury, Co-Op, and Waitrose in Torquay can handle card payments if you were really stuck.

</comment></comment></comment></comment></comment></comment><comment><USER29> _If your credit card number is stolen you simply contact the provider and they will (usually) refund any fraudulent charges and send you a new card. In turn, the credit card companies simply do a charge back to the gas station (taking the money from the station and refunding it to the customer whose card has been stolen)._

There is no charge back to the gas station, the cards are used to steal other things. They were just skimmed at the station.

</comment><comment><USER30> It seems like one could make a bluetooth snooper that looks for people who connect to the skimmer? Then you could catch skimmer users when they download the data.

<comment><USER25> I'd guess the police don't have the resources/are not interested in this kind of crime. I also doubt it's much of an issue for the gas station itself. The card is skimmed at the gas station, but does that mean the cloned card will be used there?

I mean, sparkfun are great, but they're not pentesters. The fact that the police went to them probably means they didn't have the resources to hire a pentesting firm (or do it internally). I'd also guess they don't have the resources to police these crimes either (which would mean a lot of hanging around at gas stations).

<comment><USER31> It might be possible to make a small device (maybe using the same Bluetooth module as the skimmer) that listens for someone issuing the command to download the card numbers and then automatically calls the police, no need to have someone monitor it in person. I don't own a car, so I'm not that familiar with gas stations, but I assume most will have security cameras that can get you the perpetrators license plate. That ups the bar for successful skimming to also include fake car papers and will probably deter small-scale criminals.

<comment><USER25> If they already have security cameras, then they already have everything they need to catch someone installing the device.

This being the case, the criminals have likely either already figured out how to avoid the cameras (or park out of sight). Or the police are not acting on this information because it's not seen as a priority.

<comment><USER32> > they already have everything they need to catch someone installing the > device

...except for the timestamp of the installation event. Or the resources required to brute-force through mountains of footage to find the event.

<comment><USER33> Or the ability to see through the hoodie the guy's wearing.

</comment></comment></comment></comment></comment></comment><comment><USER34> I'm curious if they are also logging the zip code entered via keypad. I can't remember the last time I used a pump without zip code validation.

<comment><USER35> As a foreigner who travels to the US on occasion - and therefore doesn't actually have an US zip code - what's up with that? If you have a keypad installed anyway, then why the hell not accept the chip reader with pin code? Not complaining or anything, but it's quite baffling. Nowhere else in the world that I've seen, they don't restrict payments to locals....

<comment><USER36> Try using a pump in Israel. I had to ask for help every time. Not only is Israel still using mag stripe, there's also some sort of national ID # you have to enter into the pump. And the license plate # too I think. I think tourists are supposed to be able to use all 0, but I couldn't navigate it.

This is from 2012 but seems pretty close to what I dealt with there last year: [https://www.tripadvisor.com/ShowTopic-g293977-i1733-k5730382...](https://www.tripadvisor.com/ShowTopic-g293977-i1733-k5730382-Buying_fuel_for_the_car_in_Israel- Israel.html)

Which is to say: every country has its weird thing. :-)

<comment><USER32> In Australia, we have this weird thing where you pump the fuel then walk into the shop to pay. It's just a ruse to get you to buy energy drinks and two chocolate bars.

<comment><USER36> In New Jersey (and I think Oregon), you can't pump your own gas. Full service only.

Years ago (this predated energy drinks by a couple decades) I filled up at a rural station in GA that had old mechanical pumps. I went inside to pay, having not taken note of the cost. When the cashier asked me how much I'd purchased and I told him I'd have to go check, he waved me off and pulled out a pair of binoculars to read the charge off the pump.

I like to think now he foresaw the coming age of skimmers and wanted his pumps to remain immune.

</comment></comment></comment></comment></comment><comment><USER37> The overwhelming "defaultness" of the whole thing makes me think these were actually intended as conversion adapters or something else that wasn't purpose-built for pump skimming. The complete lack of code protection (setting it is literally a single checkbox in the programming utility --- and almost all commercial products with an MCU will have this protection enabled), leaving the markings on the chips (I've seen more legal devices with them scrubbed off), and default password unchanged are the most noticeable.

Googling "bluetooth magnetic card reader" also yields quite a few results like this one:

[https://www.amazon.com/Deftun-MiniDX4B-Wireless-Bluetooth- Co...](https://www.amazon.com/Deftun-MiniDX4B-Wireless-Bluetooth- Collector/dp/B01F4X9GNY)

<comment><USER38> The code on the PIC is protected. The hex dump that is presented has sections filled with zeros, as that is how PIC code protection works.

</comment></comment><comment><USER39> I was skimmed at a gas station last winter. I pay with cash now.

<comment><USER40> Why? You're not responsible for fraudulent charges and now you're out on points / cash back.

<comment><USER41> It's still a hassle.

I had my card skimmed while on vacation earlier this year. The next week I was eating at a restaurant and got a call from an unknown 800 number that I didn't answer. My card was declined at the end of the meal. I called the number back and it was the issuing bank's fraud department saying my card was used suspiciously and they've cancelled it. Because I was still on vacation it was a big hassle involving finding a place to fax a typed, signed letter to get my new card sent to an address I'd actually be at.

<comment><USER42> > I was eating at a restaurant and got a call from an unknown 800 number that > I didn't answer. [...] I called the number back and it was the issuing > bank's fraud department saying my card was used suspiciously and they've > cancelled it.

Once, I was also eating at a restaurant when I got a call from an unknown number. I answered, and they said it was the issuing bank's fraud department, saying my card had a couple of suspicious transactions...

But the call itself was the fraud. Luckly, I knew from the beginning that it was a fraud (the value of one of the "transactions" was high enough that I would have received a notification SMS), so I strung they along to waste their time, and stonewalled the moment they asked for personal information. And just to be sure, I went to a bank branch nearby (it was lunch time, and there are several bank branches within a few hundred meters) and they confirmed the "suspicious transactions" didn't exist at all.

</comment></comment></comment></comment><comment><USER43> _Why are we still using magstripes?_ It's 2017! There's all this cool stuff happening! I have a laser-guided robotic vacuum cleaner. SpaceX is landing rockets on boats. The Navy has a real life railgun. We have self driving cars, which means it's only a matter of time before there's a country song about a guy who's truck leaves him. Yet... I can't pay for something securely.

Please, no more signatures. NFC or Chip/Pin please!

</comment><comment><USER44> in more civilized parts of the world:

cc companies (and country acquirers) have a thick book of rules and complex/expensive certifications.

if you don't follow the rules either the device doesn't get to connect or any loss due to fraud is applied on the site owner.

also: emv + single unit sealed/tamper resistant payment component (the reader, screen and pinpad are one)

also: pumps are remotely monitored for case opening and video surveillance (at the very least to counter staff theft).

this isn't a problem in some countries.

</comment><comment><USER45> very thorough article - I've always wanted to know how these worked. I had no idea that many of them used Bluetooth / serial etc.

One revision to the post I'd like to see - I'd love to see a section on _how_ they attach to the actual reader. I know they mentioned MitM attacks, but do these readers fit over the top of the skimmer? underneath? behind the entire skimmer? are the visible from the pump itself?

<comment><USER46> They open the pump face, unplug the back of the existing reader, plug the front of their skimmer into the back of the existing reader, and connect the first plug into the back of their skimmer.

It goes from ? --> reader

to

? --> skimmer --> reader

The face of the pump appears unchanged (unless they broke a security sticker and were unable to replace it)

</comment></comment><comment><USER47> Very interesting, just installed the app they created. Going to be driving all over the northeast for the next few months. I wonder if I will find any skimmers...

<comment><USER48> This should be fun for a while, but don't expect it to last. If the persons producing these haven't seen this article yet, they will soon. Surely next batch will use a different ID and password, but additionally they could set the HC-05/1234 combo to do something nefarious when attempted. (Probably just put the skimmer to sleep for a while, so it won't be detected. The things they could potentially program it to do will be somewhat limited by the cost of additional components.)

<comment><USER49> The people installing these skimmers aren't the ones writing firmware for them. They have been mass produced in China and sold around the world. There might be a v2 in the works that works better or is more difficult to detect but people will still be buying the original version because it does the job and works well enough to get at least some cards before being found. It is similar to the OBDII reader chip, ELM327. Elm made a decent v1.0 release for their PIC-based ELM327 and forgot to lock down the firmware. Everyone then proceeded to make pirate clones of the reader. It is much easier to just keep producing the exact same chip/firmware combo than it would be to actually go back and decompile/write new code to add some stealth features that aren't going to make your new v2.0 sell any better over the cheaper than dirt v1.0.

</comment></comment></comment><comment><USER50> I would be really happy to have a solution to detect these skimmers. Either an app or device that can just pickup any of these default ids etc.

<comment><USER51> The article mentions this app: [https://play.google.com/store/apps/details?id=skimmerscammer...](https://play.google.com/store/apps/details?id=skimmerscammer.skimmerscammer)

Essentially though it's just looking for a bluetooth device called HC-05, so that is also an option.

<comment><USER50> hmm I need an iphone solution

</comment></comment></comment><comment><USER52> So if the attacker has to have a key to break into the machine and install the skimmer, isn't that the problem then?

And if the attacker opened the pump to install the skimmer, why would he need to use radios at all? Why not just log it to flash for a week, then go to the pump and fetch the skimmer again? Presumably you'd _want_ to remove the skimmer from the machine to avoid detection anyway?

<comment><USER53> Not quite. Most skimmers are affixed atop the actual card reader. From the outside it's just a bit thicker. You don't have to open the machine at all to attach them.

<comment><USER52> Yes, that kind of skimmer I'm familiar with. The reason those skimmers are so easy to detect is because they need to mount on the outside which makes it unnaturally bulky, and sometimes also contain a camera to monitor the keypad.

I'm not too worried about those because those are pretty easy to spot, especially those with cameras. But this internal skimmer is more like a pump "root kit" you can't see...

</comment></comment></comment><comment><USER54> so can I just pull out my phone and look and assume any close by BT is possible suspect for a skimmer.

<comment><USER55> HC-05, is the module code and default name for the BT connection. Seems very lazy. If I were to do it, I would atleast generate a random name and maintain a list of such names, with a hash function forming the password derived from the name itself.

</comment></comment><comment><USER56> Makes want and just may force me to use my phone to pay for gas!!!

</comment><comment><USER57> so you could download the data without needing to install a skimmer yourself, what if someone whitehatted it by downloading the data and contacting each bank.

<comment><USER58> Something tells me that doing so would raise eyebrows and require you to explain yourself. While it would be easy to say, hey I read this article and I figured I would help out. I cant help but thinking the bank would still press charges because you are in possession of stolen credit card information.

Additionally, while you can tell what kind of card it is from the CC#(3-AMEX/Diners club,4-Visa, 5-Mastercard, 6-Discover, etc) you cant always tell what the issuing bank is. Is it a capital one visa? is it a chase visa? do you want to do all that legwork, white hat or not?

</comment></comment><comment><USER59> I feel like I was just put on some watch list for viewing that.

<comment><USER60> If it makes you feel any better, you're probably already on a watch list for just _knowing_ what a watch list is.

</comment></comment><comment><USER61> Top area mentions HC-05, later in the article it says HC-06. Which is it? Or am I missing something - granted, I did skim the article.

<comment><USER62> From what I understand, both modules could potentially be used. HC-06 & HC-05 contain the same physical internals, but host different firmware.

</comment></comment><comment><USER63> This sucks, I have been war-driving these skimmers for months. Thanks spark- no-fun.

</comment><comment><USER64> > The Skimmer Scanner is a free, open source app that detects common bluetooth > based credit card skimmers predominantly found in gas pumps. The app scans > for available bluetooth connections looking for a device with title HC-05. > If found, the app will attempt to connect using the default password of > 1234. Once connected, the letter 'P' will be sent. If a response of 'M' then > there is a very high likelihood there is a skimmer in the bluetooth range of > your phone (5 to 15 feet).

Why isn't this just a part of the gas pump itself? (Or the payment station or whatever.) Is there a market for someone to make skimmer detector addons for gas stations? (If not, why not?)

<comment><USER65> If you read it, the scanner software they wrote is pretty specific to this exact skimmer. It looks for the default id of those Bluetooth modules and then sends a couple commands to see if it gets a particular response.

In other words, the scanner isn't really general purpose enough to have in every pump and it's easily defeated by very minor firmware tweaks or even just changing the Bluetooth id of the device. You'd have to have something much more complex to be reliable, and it'd have to have some sort of facility for updating it's signature database akin to a virus scanner. Gas station owners don't have much incentive to give a damn currently, especially not if it involves retrofitting a fairly complex device onto all of their pumps that they also have to pay for a service that provides updated device signatures.</comment></comment>


Cloud Affiliate Program: How to Make Money with CloudSigma Part 1 - <AUTHOR> http://www.cloudsigma.com/en/blog/2011/04/12/20-cloud-affiliate-program-cloudsigma-part-1 <comment> david-jennings Is this an open program or are there any specific requirements?

<comment><USER2> Yes--- must have a fondness for pyramids and a passion for smoke and mirrors. [Actually I've no clue, but this sets off my Amway Meter(TM) something fierce]

<comment><USER3> You shouldn't confuse a simple affiliate scheme with multi level marketing which is an entirely different beast.</comment></comment></comment>


Building threaded commenting system - <AUTHOR> http://chiragjain.tumblr.com/

<comment><USER2> When you think in terms of nosql like Cassandra, its much simpler, but I guess you are using RDBMS(which is a wise decision from manageability point of view ).</comment>


List of virtual communities with more than 1 million users - <AUTHOR> https://en.wikipedia.org/wiki/List_of_virtual_communities_with_more_than_1_million_users <comment><USER2> Be careful comparing the "Registered Users" metric on the page between sites. In some cases they're using total number of registered accounts on the forum, and in others they're using metrics that involve recent activity, like a "Monthly Active" metric.

Also, don't trust the numbers, even if they're cited. The current value for Twitter (500 million) is cited as being from an article in 2011 that mentioned 200 million. The Twitter company page - [https://about.twitter.com/company](https://about.twitter.com/company) \- says the current official monthly actives is 313 million.

<comment><USER3> Yes. StudiVZ is listed with 17 Mio registrations but it is virtually dead. People used it for the first 1 or 2 years when it was popular and then everybody moved to Facebook.

<comment><USER4> > for the first 1 or 2 years when it was popular

Context: It was immensely popular when I just entered university, which was in 2006.

</comment></comment></comment><comment><USER5> Wow, that list is waaaay shorter than I expected it would be. Kind of shocking to me that there aren't more "virtual communities" over a million users.

<comment><USER6> They are being too restrictive on what they define as a virtual community. For instance the forums in city-data.com has more than a million members. Same with bodybuilding.com

<comment><USER7> I don't see any restrictions in the article. You can edit it and add your info with a reference.

</comment></comment></comment><comment><USER8> Shorter list but at some point will be more comprehensive and source for linked article [https://query.wikidata.org/#SELECT%20DISTINCT%20%3Fsite%20%3...](https://query.wikidata.org/#SELECT%20DISTINCT%20%3Fsite%20%3FsiteLabel%20%3Fusers%0A%7B%0A%20%20%3Fsite%20wdt%3AP1833%20%3Fusers%20.%0A%20%20SERVICE%20wikibase%3Alabel%20%7B%20bd%3AserviceParam%20wikibase%3Alanguage%20%22en%22%20%7D%0A%7D%0AGROUP%20BY%20%3Fsite%20%3FsiteLabel%20%3Fusers%0AORDER%20BY%20DESC%28%3Fusers%29)

</comment><comment><USER9> Hyves used to be the thing you had as a schoolkid. It had support for showing your relation to somebody (through people in your friendlist), gifs, almost fully customisable pages, a whole set of emoticons and other things.

When Facebook came around, most people left (mostly kids) because of parents getting on the platform. There's a video of a lonely woman that had contact with friends through Hyves, and said "But how am i supposed to send my friends animated pictures now :("

</comment><comment><USER10> Not sure if tis list is worth something. Like, are you saying 4chan has less than 1 million users? Well, I don't know.

Even if it's "registered users" I'm not sure if I can believe it.

</comment><comment><USER11> Odd that wikipedia itself isn't in the list

<comment><USER12> The list is about registered users. According to Wikimedia, the number of active registered Wikimedia editors for all Wikipedia projects in February 2009 was ~85,000. ([https://stats.wikimedia.org/reportcard/](https://stats.wikimedia.org/reportcard/)) In a more recent count (and more tightly controlled against double counts) for October 2016, that number seems to be ~65,000. ([https://stats.wikimedia.org/EN/TablesWikipediaZZ.htm#activit...](https://stats.wikimedia.org/EN/TablesWikipediaZZ.htm#activitylevels)) Note also that activity can fluctuate based on month so that also explains the decreased number. (during the summer more students will contribute)

</comment></comment><comment> angry-hacker Blackplanet is surprising for me. I don't know how active those 20mil are, but that's a very good percentage from the total percentage of blacks in America.

Does anyone know more about the site or is an active member?

<comment><USER13> See page 93 of [http://www.journalism.org/files/2015/04/FINAL-STATE-OF- THE-N...](http://www.journalism.org/files/2015/04/FINAL-STATE-OF-THE-NEWS- MEDIA1.pdf)

Says 390,000 unique visitors for January 2015, according to ComScore. For comparison, DeviantArt has roughly the same number of "registered users", but gets about 6,000,000 uniques/month.

I suppose "registered users" is close to useless as a measure, because some may be automated spam accounts, some forums clean up dead accounts / others don't, etc.

</comment></comment><comment><USER14> This is badly outdated. For example iWiW have been closed years ago.

</comment><comment><USER15> Facebook (et al) is not a community; it is a platform that hosts communities. It's probably more analogous to a country or religion than a community.

<comment><USER16> What would you have called it a few years ago before the pages concept started and it was just pages of people? A community?

<comment><USER17> a place for communities to form.

</comment></comment></comment><comment><USER18> Take the stats with a grain of salt. For example, MyHeritage (which is on the list) has owned Geni (also on the list) for some time now.</comment>


Uber Coins Terms 'Jewbers' and 'UberHUE' in New Diversity Report - <AUTHOR> http://www.thedailybeast.com/articles/2017/03/28/uber-coins-terms-jewbers-and-uberhue-in-new-diversity-report.html <comment><USER2> As much fun as it is to pile on Uber these days these are employee resource groups, created by and run by the employees. I've had these at lots of places I've worked, for women, LGBTQ, etc and they're mainly a mailing list, maybe a slack room these days, and maybe a monthly meeting/meetup. This is not some huge corporate racist conspiracy.

</comment><comment><USER3> Based on the article it sounds like the employees themselves might have come up with those names.

Terms like this are tricky because it depends a lot on who came up with it. If a group of Jewish employees start calling themselves "Jewbers," that's really different from if management or HR at Uber did it.

</comment><comment><USER4> Oh my god, I was reading and thinking "I hope they don't use Los Uberos for Latinos" but they totally came within one letter of that!

</comment><comment><USER5> Uber doesn't bend over for the social justice establishment that controls the media, so they will continue to attack Uber even for the exact same things their poster-boy companies like Google do. How is an Uber Jewber more offensive than a Jewgler Googler?

</comment><comment><USER6> How about instead of making all sorts of dumb websites, and diversity programs, they just HIRE a diverse crowd and PAY them fairly?</comment>


Ludum Dare is about to start - <AUTHOR> http://www.ludumdare.com/compo

<comment><USER2> I did Ludum Dares 6,7,8,9,10,13,14,15,20,21,24 and 26.

That's a bunch of stuff that I've made that I wouldn't have without the Ludum Dare. It let me explore ideas and learn a lot. I haven't Won a Ludum Dare, nor do I expect to (I got 1st for graphics once) The standard is extremely high.

Here's a sampling of some of mine that play online.

Some Games came out a bit mad [http://screamingduck.com/Lerc/LD13.html](http://screamingduck.com/Lerc/LD13.html)

Some were insanely hard [http://screamingduck.com/Lerc/LD14.html](http://screamingduck.com/Lerc/LD14.html)

Some were pretty but otherwise fairly crappy [http://fingswotidun.com/Ludum20](http://fingswotidun.com/Ludum20)

This one just about gave every web-browser a hernia [http://www.fingswotidun.com/ld21/](http://www.fingswotidun.com/ld21/)

And some were, well I don't know what the hell this is, but it was pretty neat. [http://www.fingswotidun.com/ld24](http://www.fingswotidun.com/ld24)

<comment><USER3> I've done it twice, and while I like the concept and it was great to get feedback on my game and everything, the themes leave me cold. People vote for the most boring, broadest things. I gave up after "minimalism".

A theme should _inspire_. It shouldn't just sit there as a framework for you to shove your existing ideas into. I'd love to be prodded into exploring new game mechanics, and LD just doesn't do that for me.

<comment><USER4> Minimalism was a great theme and that round had some of the best ludum dare games in my opinion.

On the other hand, I agree that things like "You only get one" are not very inspiring.

<comment><USER5> Strangely I find the opposite - Themes like 'you only get one' imply a certain gameplay mechanic that I think leads to some real interesting games. You only get one..life? Second? What thing in games do we take for granted that we get multiple of? Themes like 'minimalism' are too broad for my liking - what does minimal even mean? Is it minimal because you only used 20 of the keys on the keyboard? Is it minimal because you didn't use every single feature in the Unreal Engine? I could submit any platformer ever made and say "it's minimal because it's limited to a 2D plane". It's so broad it quickly becomes meaningless.

<comment><USER6> I agree with you on the broad themes point and I really liked the 'You Only Get One' theme, at first I couldn't get past the 'one gun', 'one life', 'one minutes' ideas that I felt everyone would go for but I ended up making a simulation where you only get a single interaction after world generation and then it simulates a little village gathering food and building farms etc. and I was really happy with the result.

<comment><USER5> That sounds really cool - Do you have a link by chance?

<comment><USER6> Yeah, I made a gallery of my progress through development as well. Unfortunately it gets pretty slow after several decades of simulation, not much chance for optimisations in the time frame given. Windows download available here: [http://tinyurl.com/q8m7hnd](http://tinyurl.com/q8m7hnd) Source code: [https://github.com/Lockyy/YOGO-Moment-of- Interaction](https://github.com/Lockyy/YOGO-Moment-of-Interaction) Gallery: [http://imgur.com/a/13k1R](http://imgur.com/a/13k1R)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I always enjoy watching the streamers during this weekend. Its amazing how much you can learn by just watching someone code. This one snuck up on me, I haven't heard of a lot of streamers this time - does anyone know of any good ones to watch?

<comment><USER8> Just try watching the top viewed ones on Twitch.

Personally, I enjoy watching Ananace, Notch and TheCherno. Oh, and don't forget deepnight (Sebastian Bénard). He has won 3 or more Ludums and I love watching him making them.

</comment></comment><comment><USER9> If you have any interest at all in game programming, I highly recommend that you participate. It's invigorating to have a fixed deadline that forces you to actually FINISH game instead of just add to a heap of incomplete ideas.

This is going to be my 8th time participating, and I'll be livestreaming the whole thing -- which to me is at least 80% of the fun. It helps that I have a large audience to keep me motivated (I'm not Notch, but I am a YouTuber).

</comment><comment><USER10> I've enjoyed doing short game dev competitions many times before but I've never done LD. I'm planning on live streaming it this time if anyone's interested: [http://www.ludumdare.com/compo/2014/04/25/im-in-with-a- live-...](http://www.ludumdare.com/compo/2014/04/25/im-in-with-a-live-stream/)

</comment><comment><USER11> Any word on whether Notch is participating this time around?

<comment><USER7> He just tweeted that he is, but isn't sure if he will stream. [https://twitter.com/notch/status/459703644213227520](https://twitter.com/notch/status/459703644213227520)

</comment></comment><comment><USER12> I sometimes think that it would be nice to know the theme in advance to know if you want to spend two days on this.

The idea behind the theme revelation is to prevent cheating, but then again there is no cheating protection beyond a code of honor anyway. I've seen tons of games in LD that only barely fulfilled the theme.

</comment><comment><USER13> So when they say "game", do they really mean "video game"?

This is a semantic shift that leaves me uncomfortable.

<comment><USER14> Actually, there's nothing in the rules that limits the competition to video games; I wouldn't be surprised if people had created print & play physical games for previous LDs.

<comment><USER9> People have in fact done so.</comment></comment></comment>


Using NeuralNets to make smooth character animations - <AUTHOR> https://techcrunch.com/2017/05/01/this-neural-network-could-make-animations-in-games-a-little-less-awkward/ <comment><USER2> What I'm really curious about is the latency of it. Having smooth and accurate animations makes for a very rich experience, but in most games having your character react instantly to your commands is more valuable. Even if it's a 100ms delay in order to accomplish this, it might still be too much especially for fast, action packed games. I know in the Witcher 3 they reduced some of the complexity in animations to make them react quicker. What this does sound amazing for though is NPCs.

<comment><USER3> Exactly this. The character control in some games (eg GTA 4 and 5) feels laggy and imprecise because stopping, turning, reversing takes a lot of time. Yes, it is "natural", "realistic" and it looks nice if you're watching someone play, but playing yourself it feels like steering an oil tanker :)

<comment><USER4> I, on the contrary, like some inertia in movement because, as you've mentioned, it is more realistic. Sure, it get some time to get used to (especially if you had played Quake style shooters for a while), but I like inertial movement more than weightless ragdolls.

</comment></comment></comment><comment><USER5> This is amazing. It should even be possible to have characters traverse obstacles differently depending on their in-game skill level.

Imagine this system used to implement rock climbing. The player is simply pressing the "W" key to go up, but depending on their character's skill level the speed and manner in which traversal occurs could be very different.

I really hope Bethesda is paying attention to this, because open world games could use it more than anything. In Skyrim you climb mountains by mashing the jump button. Far from ideal, and tends to break immersion.

The tech could even be used to power melee animations some day, perhaps entire fighting styles.

<comment><USER6> Fully agreed. While Skyrim Horse Physics™ was entertaining in its own way, something like the OP would be a huge leap forward for immersion.

It would likely have secondary effects of easing the burden on animators, allowing them to concentrate on more important aspects of the game, like facial interactions.

(Looking at you, BioWare.)

<comment><USER5> That's a good point. I suspect neural nets would be suitable for near-perfect lip syncing animations that aren't too expensive.

We can already synthesize the speech itself to the point it sounds real, although it's very computationally intensive at present. Infusing the speech with emotion remains very difficult. Some day voice actors will probably just license their likeness along with a sample of emotive recordings.

After that, one of the few remaining holy grails is generative dialog for NPCs that's both believable, dynamic in relation to the game world, and don't sound like glorified ELIZA bot output.

Neural nets can probably be used for level design today. One use case might be creating an entire urban environment complete with residential interiors, where the artists don't have to slave over each individual apartment for it to be believable. Imagine playing a war game where the levels look like there's actually people living there.

<comment><USER6> Speaking of emotive, synthesized speech: [https://lyrebird.ai/demo](https://lyrebird.ai/demo)

Clearly early days, but still, the promise is there.

</comment></comment></comment></comment><comment><USER7> Ah yes with the breaking of spring the annual SIGGRAPH paper flood begins

<comment><USER8> A glorious time indeed

</comment></comment><comment><USER9> The results are amazing. I am do not have a trained eye around animation, but it looks no different than motion capture.

So far, correct me if I am wrong, the state of the art prior to this would be something like Unity's Mecanim, where you define a state machine for animation transitions, which would interpolate animations to save you work.

<comment><USER10> You can do both 1D and 2D blendspaces in Unreal, so you end up with something like this: [https://80.lv/wp- content/uploads/2016/05/walktorund2.gif](https://80.lv/wp- content/uploads/2016/05/walktorund2.gif)

Very handy for character locomotion, but only gets you so far. I'm not sure how applicable offline processing is to this though, since if you have a large number of different types of obstacles to be traversed, you'd have to bake >= that number of animations, and your animation state machine would be enormous. The end goal might be to do that in real time, but I don't think anyone is going to seriously suggest running a neural net to calculate animation positions while the game is running. Maybe if you had some smarts in the level designer you could determine the potential pool of animations needed based on placed geometry, and build the animations at packaging time along with the state machine.

<comment><USER9> Well, the expensive part is to train the network. After that it should not be as expensive, depending on the size.

If that is still not enough, they can also try to look at ways of producing a "good enough" effect with a smaller network.

Then, it can also be limited to only some characters, the ones that you are more likely to pay attention to.

Now, the MS Kinect does some intense processing behind the scenes (random forests) to capture your motion in real time. Yet you can still run games with decent performance. I think a neural network to adjust animations is not too dissimilar in terms of performance cost.

</comment></comment></comment><comment><USER11> Source paper is here:

[http://theorangeduck.com/media/uploads/other_stuff/phasefunc...](http://theorangeduck.com/media/uploads/other_stuff/phasefunction.pdf)

</comment><comment><USER12> One of the references used throughout the paper is this:

[http://www.gameanim.com/2016/05/03/motion-matching- ubisofts-...](http://www.gameanim.com/2016/05/03/motion-matching-ubisofts- honor/)

I would always trust actual concrete implementation rather than a research project though... unless they have source and demo available.</comment>


Ask HN: Can you recommend a mouse? - <AUTHOR>

I'm looking to buy a new mouse. I've been wholly unsatisfied with any mouse produced in the last 10 years. To date, the best mouse I've ever used is a Dell OW770 that I got with a computer in 2003.
There must be something that satisfies:
 - <USER2>
 - No extra buttons (just left, right and middle on the scroll wheel)
 - Feedback on the scroll wheel (i.e. not "smooth" scrolling)
 - <USER3>
 - Decent size and weight (not an "ergonomic" design, just something nice to hold)
Can anyone recommend something? I'm willing to spend about £50 for a mouse that really satisfies me. <comment><USER4> I love this one: <http://h30094.www3.hp.com/product/sku/2545791> I bought several of them. But it has no scrollwheel (I don't like them).

</comment><comment><USER5> I use a Logitech Marble Mouse.</comment>


Ask HN: How do you find a technical cofounder with little experience? - <AUTHOR> I have an idea for a web app/business that I would love to build. However, few of the people around me through both high school and college have been entrepreneurial or technologically savvy. I haven't had the chance to gain any experience or contacts in the start-up industry yet either.
Here on HN there is a general distrust of business people and for the most part rightly so. The general advice given every time that someone asks about finding a technical cofounder is either: "learn to code" or "find someone you know". I have exhausted every "contact" I have, gone to some meets, and even emailed some other schools. No Dice. I have tried to learn to code. I took two Udacity courses, minored in CS, and generally tried become a web developer. However I feel that even though I can read and understand the code well enough, I don't know it well enough to deal with the architecture or maintain an entire codebase myself. Sure I could take a few years to become a full developer, but honestly I am a better business person than I am a developer. I don't really have the time before I graduate to do so either.
I am 20 years old and go to a business university on the east coast. It is a good school, but not an elite liberal arts school. The people in my CS department that I talked to aren't particularly entrepreneurial. In addition very few people have the necessary skills (full web stack, primarily code in Python(optional), some experience in creating chats and analytics).
I have researched my idea thoroughly. I have the market, the business model, the validation. I have contacts that I have been trying to cultivate with investors, I have the marketing strategy worked out. I have been reading up on design so that I could craft a basic design for my app. I have read everything that I could get my hands on (HN included) to learn about entrepreneurialism, technology, and start-ups.
I am not an "idea" guy, but a true business guy. To everything I have read on here about being a good non-technical cofounder, I find myself nodding my head in approval.
And yet I cannot show any of this to anyone because I can't find a technical entrepreneur to show it to! It is hard for me to elaborate on every aspect of myself, but suffice it to say that I am very passionate about entrepreneurialism.
Can you help HN?
Edit: Here's my email in case you want to contact me: firstname.lastname@example.com <comment><USER2> "This makes it hard to just go visit my CS department and hope to find even a shred of entrepreneurial spirit."

Why? They're people over there in the CS department. Real ones, with goals and ambition just like you. If you really have a great idea then there'll be people who'll listen and want to be part of it. This sort of anti-CS prejudice isn't going to help you find a co-founder.

"In addition very few people have the necessary skills (full web stack, primarily code in Python(optional), some experience in creating chats and analytics)."

You're the business guy, you admit you don't have the technical skills, yet you're trying to dictate the choice of tools? Why is that? Non-technical founders have no more place picking the language your software is written in than your developers would have coming up with your business's marketing strategy.

<comment><AUTHOR> I didn't mean to imply that CS students aren't entrepreneurial. I just meant that when I talk with the CS students in MY school they aren't entrepreneurial.

Also I only added the "Python(optional)" because that is what I have learned so it would be easier to work with someone who uses it as well.

I have nothing but respect for CS students. Poor phrasing on my part.

</comment></comment><comment><USER3> How to find? Go to meetups, hang out at engineering clubs at your school, post fliers or find other appropriate means of putting it out there that you are looking for a cofounder. You don't want someone who is going to "learn on the job" if you want a chance at making this successful. So finding CS students at your school won't be that useful unless you can find someone who's published some web sites or apps before. Look for someone with proven ability to start AND finish projects (non-school ones).

Outside of school, attend meetups. Learn to code, but not to build it yourself, but to have an excuse to be around developers. That's a reason to be at meetups. There are also meetups specifically for people who are looking for cofounders.

You can also post online (as you did here), to find co-founders, or on things like craigslist in the jobs section.

Other options are to outsource on e-lance or something like that. People offshore can build stuff pretty cheap, but the quality is terrible once you want to scale or maintain it. That shouldn't matter too much because if that becomes an issue, that means you're succeeding.

<comment><AUTHOR> Thanks for the advice. I am going through those steps. I emailed a bunch of CS departments and am going to meetups (can't do too many because school takes a lot of my time).

I am really big on the quality and detail of the product so outsourcing is a last resort.

</comment></comment><comment><USER4> As a fellow "business" guy whose recently broken out of the "stereotype" this is what I can offer:

nobody cares about your idea. They care about your execution.

Most business guys get a bad rep because they think they have a genius idea and expect programmers to make it happen. They don't appreciate or even recognize the amount of difficulties and problems that have to be solved to come anywhere close to a usable product.

Focus on what you can bring to the table. My current focus is mainly about identifying first the market and marketing strategy (and testing it) then about helping the developer come up with a minimum viable product (as in what functions are truly necessary to our potential users that can allow us to better get an idea of our market).

If you can convince a technical co-founder that you can EXECUTE on an idea (with their help) then you'll start gaining some traction. Until then you're just another guy with an idea whose asking someone else to do all the work (this might not be true but by default it's what others will assume unless you explicitly explain what you bring to the table).

<comment><AUTHOR> Unfortunately the character limit on HN made me cut that paragraph out.

I have researched my idea thoroughly. I have the market, the business model, the validation. I have contacts that I have been trying to cultivate with investors, I have the marketing strategy worked out. I have been reading up on design so that I could craft a basic design for my app. I have read everything that I could get my hands on (HN included) to learn about entrepreneurialism, technology, and start-ups.

<comment><USER5> Why the most important word of an early stage startup validation is missing here? "Customers". The only thing that matters of your whole paragraph is "validation". Explain this better, somehow I feel that it isn't exactly validating the idea with customers.

The main thing a non-tech founder can bring to the table is customer development. Focus on that, as they are practical things. Don't try so hard to be the "self-taught MBA guy". Just do your customer development very well. If a tech co-founder trust that you know your customers, than you have chance to attract a very good one.

<comment><AUTHOR> I'm in that rut where customers say "Interesting idea, show me how well it works" and the technical guys say "Show me customers that are onboard before I build the thing".

I get what you are saying though. Obviously having a product to show customers will be huge in acquiring them.

<comment><USER5> You make it sounds like a chicken and egg problem, but it isn't. Customer "saying" "insteresting idea" is not customer development. I have no idea what your business is, but I pretty sure you can validate it without code. There are lots of ways to do that. For an example, check this thread <https://news.ycombinator.com/item?id=5424206> Look how much validation they got! And - except for the demo, which isn't the core thing of their landing page - there is no code in there. Actually, we don't even know if the founder can code or if they are just "idea guys" (ok, you can assume they aren't, but nothing there prove they aren't).

There are dozens of examples of MVP that don't use any code out there, just google it. "Concierge MVPs", "Fake it before you make it" MVPs, find a strategy for your own. Just find something stronger than "I talked to a few customer and they told me is an interestgin idea and want me to show them how it works".

<comment><AUTHOR> You are right. However since my product is a social consumer-facing product, it is harder to validate without having something to show users (and honestly the marketing will be more important here). The customer portion of my app/business comes from the data gathered and it is hard to show how useful that data is without some real examples (and no I'm not gathering this data maliciously).

I will look into making a page like those "Fake it before you make it" MVPs.

<comment><USER5> A google result with good examples: [http://kontrary.com/2012/05/03/how-to- fake-it-until-you-make...](http://kontrary.com/2012/05/03/how-to-fake-it- until-you-make-it/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Read this, or if you already have, read it again. <http://www.paulgraham.com/relres.html>

Done? Good.

Start coding today. Seriously. Today.

You need to find and talk to people one-on-one about what you want to accomplish. Go crash an upper division computer science class tomorrow morning, and look for students that "get it" – the kind that engage the professor, ask and answer questions. After class, pick one of them and talk to them about what you're building.

Search for _new_ posts like "Show HN: ..." these are generally technical people that can deliver. Figure out if they have technical chops or just do launch pages.

Bonus: Get a t-shirt made that says, "Co-Founder Seeking Co-Founder" and walk around campus. Or stand somewhere.

Repeat this every day between now and Friday. If it doesn't work, I'll give you a full refund.

<comment><AUTHOR> Noted thanks!

<comment><USER6> How did it go? I'm curious to hear what did (and didn't) work.

<comment><AUTHOR> I'll let you know. Send me an email so I know who to update.

</comment></comment></comment></comment><comment><USER7> My cofounder spent an entire year with this exact problem. He worked with one developer who dropped off the face of the earth, payed a designer for work, and otherwise busted his ass for an entire year after graduating undergrad. He worked at a pool while his peers went to work for the likes of McKinsey and Goldman.

Now, I and another technical cofounder are working with him. We also have designers and a potential new technical employee.

You are still in school. You have time.

</comment><comment><USER8> I have had the opposite problem and I have yet to find a solution. However, I am looking for a superb UI/UX guy to take over the world with. Even with a 5+ year successful business, it is hard to find that right match of skill, personality, ambition, etc.

Until that point, I continue to 1099 out the UI/UX to solid people.

</comment><comment><USER9> An option could be to pay for a developer in the beginning of the project and slowly start transitioning them into a co-founder if there's mutual interest. I've seen this type of relationship work well in the past. But obviously you need to be a rich non-technical person.

<comment><AUTHOR> As a student, I can assure you I'm not rich ;)

<comment><USER9> Well okay not rich, but enough to pay a student developer at your school $20-30/hr or so.

<comment><AUTHOR> Yeah I get what you mean. I have some savings, but this isn't a long-term solution.

<comment><USER9> It's not a long term solution, but gets you progress. If you're looking for a technical co-founder they'll want to see that you can execute. You can even start building on your own :)

<comment><AUTHOR> I'll see what I can do thanks!

</comment></comment></comment></comment></comment></comment><comment><USER10> what school do you go to?</comment>


Deep Learning at x.ai - <AUTHOR> https://x.ai/deep-learning-at-x-ai/ <comment><USER2> From my understanding, they ran word2vec [1] on their email dataset. Anyone can run word2vec on any dataset with a single desktop machine. What I don't get is why word2vec is not mentioned?

Edit: the mentioned algorithm is t-SNE -- which seems to be another algorithm for dimension reduction. I don't know how it compares to word2vec

[1] for instance, [https://www.tensorflow.org/versions/r0.7/tutorials/word2vec/...](https://www.tensorflow.org/versions/r0.7/tutorials/word2vec/index.html)

[2] [https://lvdmaaten.github.io/tsne/](https://lvdmaaten.github.io/tsne/)

<comment><USER3> word2vec is an algorithm to produce meaningful "word embeddings", which is a vector representation in a usually high-dimensional space. t-SNE is a dimensionality-reduction algorithm. Both can be used together, as they serve different purposes.

<comment><USER2> One could argue that Word embeddings are also dimensionality-reduction techniques: Words live in an infinite dimensional space, and the embeddings is a finite-dimensional projection of this infinte dimensional space.

<comment><USER4> I think of word vectors in the opposite light. Words stored in a dictionary have 1-dimension (their index), making comparisons more or less random. Word vectors augment the information you have about a word by continually examining the context that the word appears in a corpus of text.

</comment></comment></comment></comment><comment><USER4> > A RNN makes predictions based on sequential data. When a RNN is trained on > sequences of words, it learns to represent each word as a high dimensional > vector which encodes the model's understanding of that word. By projecting > these high dimensional vectors into a two dimensional space, it's possible > to visualize their relationships and glean insights into the concepts that > the model has learned.

It sounds like what's being visualized are the probability vectors that the model creates, which are usually a value for each possible class (noun, verb, etc. in this case). If this is the case, I don't see how the t-sne visualization is much more useful than a confusion matrix. Typically prior to training, words are translated from dictionary indexes into word embeddings (high dimensional vectors, where dimension is >> than the number of classes) that let you compare them and do vector algebra like "king + queen - woman = man". You can visualize the word embeddings, and color code them by class after training to see if there are any sorts of patterns in your word embeddings.

> The RNN learned all of this semantic understanding without a human ever > having to code a definition of concepts like nouns, verbs, universities, > cities, meetings, or social media. This is the power of deep learning > algorithms.

Was this an unsupervised approach? If so, that seems a little unusual for Part of Speech Tagging (POS tagging). I suppose the author could mean that the model was used to label Out of Vocabulary (OOV) words, aka words that never appeared in the training set. Labeling OOV data points is sort of the general benefit of machine learning, and I'm not sure can be attributed solely to Deep Learning. The main benefit I've gleaned from Deep Learning is that it automates the feature engineering phase of the machine learning pipeline.

There are lots of good resources for RNNs, LSTMs, Word Embeddings and t-sne out there from Stanford, NYU, Theano, TensorFlow, and the like. Here's a blog post that gives some background if you're interested: [http://colah.github.io/posts/2014-07-NLP-RNNs- Representation...](http://colah.github.io/posts/2014-07-NLP-RNNs- Representations/)

<comment><USER5> Hello. This is Adam. I trained the model and made the visualization. Thanks for your comments.

This model is not a POS tagger. The model was trained to predict the next word in the email given the preceding words. So in that sense, it's similar to the word2vec models discussed in the link you shared. However for this work I used a recurrent neural network to learn a language model of the emails in our database.

After training, I extracted the learned word vectors from the model (they are the weights that connect the input layer which uses a one-hot-encoding of vocab words to the embedding layer). I then used the t-SNE algorithm to reduce the dimensionality of the learned word vectors and then plotted them in 2 dimensions. The colors representing the parts of speech were added after the fact to show that the model had learned to distinguish between nouns, verbs, etc.

<comment><USER6> How does the recurrent neural network technique compare to the CBOW technique in word2vec? CBOW would've been the first thing I tried.

<comment><USER5> I agree that's an interesting comparison to make but I'm not sure of the answer. The original purpose of this work was not to generate word vectors but rather to evaluate whether we have enough data to start using deep learning algorithms. That an RNN trained on our data was able to learn word vectors with a significant amount of structure seems like a positive sign. But I don't know how the quality of these word vectors would compare to vectors generated by more standard word2vec algorithms.

<comment><USER7> There are tons of ways to evaluate word vector quality! Word analogy tasks, word similarity tasks, contextual prediction tasks, etc.

This link contains a bunch of relevant evaluation datasets and benchmarks obtained using word2vec, GloVe, etc. You can evaluate your RNN-learned vectors and compare them to a traditionally trained word2vec-trained vectors. Link here: [http://www.bigdatalab.ac.cn/benchmark/bm/Domain?domain=Word%...](http://www.bigdatalab.ac.cn/benchmark/bm/Domain?domain=Word%20Representation)

For more background on evaluating word vectors check out these pretty great lecture notes from Socher's NLP class: [http://cs224d.stanford.edu/lecture_notes/LectureNotes2.pdf](http://cs224d.stanford.edu/lecture_notes/LectureNotes2.pdf)

Also, here's the original papers from a few years ago that introduced many of these datasets and evaluation standards:

[https://papers.nips.cc/paper/5021-distributed- representation...](https://papers.nips.cc/paper/5021-distributed- representations-of-words-and-phrases-and-their-compositionality.pdf)

[http://www.cs.cmu.edu/~mfaruqui/papers/acl14-vecdemo.pdf](http://www.cs.cmu.edu/~mfaruqui/papers/acl14-vecdemo.pdf)

</comment></comment></comment></comment></comment><comment><USER8> This article is the ML equivalent of Hello World.

<comment><USER9> Hello World is not trivial if you are writing it in java.

<comment><USER10> Not a great analogy. It's still one line of code; just a very stupid one line of code. [System.out.println("Hello World"))]

<comment><USER11> It's not even a stupid line of code - it's just a line of code which happens to namespace things which most other languages don't.

System is a global object which handles various pieces of the runtime system. One variable on this object is `out` (of type PrintStream) which represents stdout. The `println` method of PrintStream actually does the work.

I get why this seems overly verbose in comparison to Python and similar languages, but I don't think it's stupid. It's just emphasizing explicitness and uniformity over brevity.

</comment></comment></comment></comment><comment><USER12> This seems like a poor attempt at getting free press.

<comment><USER13> If that's the case then it worked and I applaud their effort. I would have liked to hear about how they're using neural networks in system. I wrote a good-enough system that can handle similar things with scheduling meetings but it's an expert system, not neural net so I'm curious how they use them if at all.

<comment><USER14> Marcos here, ds at x.ai ... happy to answer that question in person. If you are around NYC, feel free to pass by our offices for a coffee/chat :-)

<comment><USER13> Ha, I'd love to but unlikely I'll be around NYC any time soon.</comment></comment></comment></comment>


Divided Attention Disorder? Log off and read a book - <AUTHOR> http://www.bbc.co.uk/news/world-12406677

<comment><USER2> Good line: There was a time when I browsed - or lived as we used to call it - my life in just one tab.</comment>


Russian Hacker Selling 1.5 Million Facebook Accounts - <AUTHOR> http://mashable.com/2010/04/23/hacker-facebook/ <comment><USER2> Why are they suggesting using a browser 9 months out of date?

</comment><comment><USER3> Hmm... so this is why Facebook asked me to change my password due to a failed attempt from a "computer" ostensibly in the "United Kingdom" and I thought it was just a jealous ex-girlfriend... :-)

</comment><comment><USER4> * It's also advisable to ensure that your social networking passwords are all different and to generate difficult passwords that include numbers, capital letters and special characters, if at all possible.*

I'm inclined to think that Mashable's _target_ audience involves non-technies, individuals who would find that sort of password recommendation very insightful, but in the end, would never come up with a password that complex on their own. And if they _are_ talking to techies, who (I would hope) put some thought into their passwords, thanks for the tip chief.

<comment><USER5> If one can buy 1000 ID's for $25-$45, actual password strength is probably much less important than using different passwords for different sites. Why bother running a password library or brute force program when you can just purchase the ids/passwords for so cheap?

<comment><USER6> The point being made here is that you shouldn't use the same password for everything. It wouldn't be hard for the purchasers of these lists to determine if some of the users data is also valid on another websites (for example - Paypal).

</comment></comment></comment><comment><USER7> If he was a smart hacker he would have generated the accounts himself.

<comment><USER8> Those accounts don't come with trusted real world connections. I'd imagine playing it right people buying these accounts would get really high conversion rates on offers they try and push through them, given that people are likely to trust friends with accounts that have been used properly before and aren't just accounts with 5000 random friends that don't actually know the person (there seems to be a market for those as well).

</comment></comment><comment><USER9> And in related news, Facebook selling 400 million Facebook accounts

</comment><comment><USER10> Quick, mass-suicide -> suicidemachine.org and let people make some real friends. :)</comment>


Sozi 19.11 beta is available for testers and translators - <AUTHOR> https://github.com/senshu/Sozi/releases/ <comment><AUTHOR> Sozi is a tool that creates animated presentations from SVG documents. Read more at [https://sozi.baierouge.fr/](https://sozi.baierouge.fr/)

I need your help to test Sozi 19.11 and update the translations.</comment>


About Environment Variables - <AUTHOR> http://www.modrails.com/documentation/Users%20guide%20Apache.html#about_environment_variables

<comment><USER2> Don't forget you can specify environment variables when you start a new process from bash,

      > APXS2=/usr/sbin/apxs2 ruby -e 'p ENV["APXS2"]'
      "/usr/sbin/apxs2"

</comment><comment><USER3>
        The PATH environment [...] is a *comma-separated* list

It's a _colon_ -separated list.

Apart from that, nice overview of Env vars.

<comment><AUTHOR> Doh, typo. Fixing that. :)

</comment></comment><comment><USER4> I've found this process unreliable enough (is it set in the Apache user env, or httpd.conf? Why isn't it getting passed through to Passenger?) that I just put everything into a /usr/local/my-app.yml file, and explicitly load it in application.rb.

<http://railscasts.com/episodes/85-yaml-configuration-revised>

<comment><USER5> This is why I've never been a big fan of using environment variables for app configuration. It seems like a clean enough abstraction, but when you start investigating the differences between distributions, applications, and even different packages of the same application, it can get pretty unwieldy. Everyone I raise this argument with replies with something along the lines of, "It's easy if you do it <this way>!" Where <this way> is some prescribed method that works in their environment. Change one aspect of their stack, and that method no longer works. It's a failure of portability that drives me crazy. I don't like marrying myself to a specific platform to that degree.</comment></comment>


Algebraic Structures for Untyped Racket - <AUTHOR> https://github.com/dedbox/racket-algebraic <comment><USER2> looks like you can only specify the names of the constructors and not their contents, as in `(data Maybe (Nothing Just))`, so there's nothing stopping a user from doing `(Nothing 1 2 3)` or `(Just)`. interesting choice!

also since people reading this might be interested, i made something similar for Python a while ago: [https://github.com/lubieowoce/sumtype](https://github.com/lubieowoce/sumtype)

</comment><comment><USER3> Proper documentation link: [https://docs.racket- lang.org/algebraic/index.html](https://docs.racket- lang.org/algebraic/index.html)</comment>


Irony: Sitemaps.org doesn't have sitemap.xml - <AUTHOR> http://www.sitemaps.org/sitemap.xml

<comment><USER2> Maybe they don't need one? This is a page that is easily crawled and is in the top 3 for searches for "sitemap" on Google.

If it ain't broke...

</comment><comment><USER3> There's no requirement for the sitemap to be at /sitemap.xml, or even to be named "sitemap.xml". They may have one, but since the norm is to submit them directly to a search engine (thanks for nothing, Google), sitemaps aren't typically automatically discoverable.

</comment><comment><USER4> It's not that ironic. Sitemaps are an "easy way for webmasters to inform search engines about pages on their sites." Hardly a requirement for a simple site.

</comment><comment><USER5> There is also no robots.txt - <http://www.sitemaps.org/robots.txt>

</comment><comment><USER6> Who said that sitemap.xml is always in that location? If it is not specified in robots.txt then they don't want you to know about it in case it exists.

</comment><comment><USER7> _snort_

</comment><comment><USER8> bummer

</comment><comment><USER9> Irony: HTML5 Boilerplate site does not use HTML5 Boilerplate or HTML5 in general. (nav, header, footer, etc...)

<comment><USER10> yeah it does..

<https://twitter.com/#!/h5bp/status/55022617471623168> (this is actually directed to you)

<comment><USER9> If you're going to take the time to dig through twitter for that you should at least post my responses:

<https://twitter.com/#!/bcardarella/status/55023955676905472> <https://twitter.com/#!/bcardarella/status/55024200456474626>

The point of HTML5 is semantically better elements. div#header is not the preferable HTML5 element. Neither is div#footer.

html5boilerplate.com should be dog fooding. It's not.

<comment><USER10> The 2nd tweet you reference is incorrect, view the source of h5bp.com and you'll clearly see that it's using HTML5 Boilerplate

Also, if you take a look at h5bp you'll notice <header> and <footer> elements in index.html

[https://github.com/paulirish/html5-boilerplate/blob/master/i...](https://github.com/paulirish/html5-boilerplate/blob/master/index.html)

<comment><USER9> That's the boilerplate. I'm talking about the actual site.

<comment><USER11> boilerplate is what you start with, not what you publish

what's the big deal</comment></comment></comment></comment></comment></comment>


Sulia - interesting concept; odd name - <AUTHOR> http://sulia.com/

<comment><USER2> What a useless site. Since I don't use Twitter nor Facebook, I can't log in. Since I can't log in, I can't see what it's actually about. I can't even view the list of the categories it touts so highly!</comment>


People interview people - <AUTHOR> http://www.peopleized.com/ New website where people interview each other to promote their websites and blogs. <comment><USER2> This is a great site for getting exposure online. It lets people interview others about their projects online, be they bloggers or otherwise! It has been a huge hit since its recent release.

<comment><USER3> Great site, awesome idea!</comment></comment>


IBM Tech Uses Hard Drives to Predict Earthquakes - <AUTHOR> http://www.pcmag.com/article2/0,2817,2371337,00.asp

<comment><AUTHOR> Link to the patent: [http://patft.uspto.gov/netacgi/nph- Parser?Sect1=PTO1&Sec...](http://patft.uspto.gov/netacgi/nph- Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=1&u=/netahtml/PTO/srchnum.htm&r=1&f=G&l=50&s1=7,693,663.PN.&OS=PN/7,693,663&RS=PN/7,693,663)</comment>


Reflections on Being CEO of a SaaS Business - <AUTHOR> http://www.tawheedkader.com/2016/01/reflections-on-being-ceo-of-a-saas-business-through-year-4-and-5-20m-of-capital-raised-triple-digit-revenue-growth/ <comment><USER2> I'm struggling not to find the writing style boastful or arrogant. I can't put my finger on why I get that vibe, but I do, and it's off-putting. Thoughts?

<comment><USER3> It's possible and I'm sorry if it does come off that way. When I write, it is a tough balance between being showing humility and taking the tone of "here's what I've learned and I might be wrong" vs. "HERE IS WHAT I'VE LEARNED"

<comment><USER2> Fair enough!</comment></comment></comment>


Show HN: Automatic access to certificates from any ACME-based CA - <AUTHOR> https://godoc.org/golang.org/x/crypto/acme/autocert <comment><USER2> Does this package only support HTTPs domain validation? Would be nice if it would help with DNS based validation as well.

I'm using github.com/hlandau/acme/acmeapi at the moment, but the API isn't documented well. Their command line client is better, but library is more convenient when you have custom storage for certs.

Also a question for someone who has it running in production. What is the best way to handle TOS updates? Do you just setup some notifications when this happens or accept automatically? I'm not sure how often this happens, but the last update was this month.

<comment><AUTHOR> sorry, wrong click. my reply is above.

</comment></comment><comment><AUTHOR> This package currently supports TLS-SNI challenges. Nice thing about the package is it has no dependencies outside of Go standard packages.

I would accept TOS automatically, but it package makes you do so explicitly. I believe TOS changes are very infrequent.</comment>


California AG Files Extortion Charges Against MugShots.com - <AUTHOR> http://www.sacbee.com/news/politics-government/capitol-alert/article211255899.html <comment><USER2> A bit broader than only mugshots, but that easy access on the alleged criminal past of everyone is something I absolutely despise in the US.

How can anyone get a real second chance if everyone looks down at them on their previous mistakes?

The worst one for me is the Megan's law map that anyone can go check out online. Most of the time those people already paid their dues to society after spending multiple years in prison, they should also have the right to start a second life without constant shaming from their neighbors.

This is the consequence of a society that is extremely bad at rehabilitating ex-offenders and that sees them as rotten people that need to be forever segregated.

<comment><USER3> I would much rather rehabilitate, but since that's not happening and there are high recitivism rates, I do want to know who lives near me or where I might want to live.

In the instances where you damage your community through a crime, it's OK to lose some right to privacy. I could see the case for getting removed if you do successfully rehabilitate though.

<comment><USER2> It is a chicken and egg problem. By shaming the person, they will be unable to ever find a job again, date anyone again, live normally again. You push those people to the fringe and the most probable outcome is for those people to fall into criminal activities again.

As an anecdote, in my previous job I met a programmer at a Meetup and the guy had exactly the required skills. HR refused to even initiate an interview because he apparently had a "small criminal case" 15 years before that was found with one of those deep background check tools.

<comment><USER4> convicted bank robber here, it is difficult sometimes. California is making good progress though, as long as you don't want a government job or a job that requires a state license.

</comment></comment></comment></comment><comment><USER5> So, MugShots.com posts mug shots, which are a matter of public record, but will remove them for a small fee. That's extortion.

But, the government posts judicial proceedings, which are a matter of public record, but for minor crimes will expunge the record for a small fee. That's a perfectly legal government function.

These two situations seem a bit too close for such disparate legal outcomes.

<comment><USER6> Q: When does a fee become extortion vs covering the cost to execute?

<comment><USER7> I have mugshots on that site for charges that were DROPPED. I HAVE PROOF OF INNOCENCE. I even have my paperwork stating that the charges WILL NOT BE REFILED. I emailed the administrators at mugshots.com and they refused to remove them without first paying a fee. This is exploitative. They now won't even allow me to pay the fee since I "threatened" them (with a lawsuit).

Don't feel bad for these guys.

<comment><USER8> It's good when people share their personal experiences like this here.

People too often take a "tough on crime" attitude but don't realize the millions of people affected by overzealous police or burdened by justice system digital trails who haven't even been convicted of anything. That's not just.

Turning a blind eye just means more pent up anger and less trust in the justice system. It just seems un-American that people can't move on with their lives and accomplish their full potential.

</comment></comment></comment></comment><comment><USER9> Honestly not sure how you could describe this scheme as anything _but_ extortion. As far as I can tell it seems to be their primary revenue stream, along with ads for services that promise to 'erase' your arrest records...

<comment><USER10> Since the mugshot is a matter of public record, I think it's plausible to describe this scheme as free press, although with wholly odious content.

<comment><USER11> What kind of extortion could you _not_ describe as free speech?

<comment><USER12> You can extort someone by threatening to reveal something, even if revealing that would not be criminal in and of itself.

I feel that the distinction here is mainly that the information is already published -- they're not threatening any action if there's no payment.

If they contacted people before posting their mugshots and demanded payment to not publish, then it would be cut and dry.

<comment><USER13> They're publishing for the sole purpose of getting people to pay them to take them down. I fail to see how that's any different than asking them first, except that now paying becomes that much more urgent.

</comment></comment></comment></comment></comment><comment><USER14> The court will make the final decision, but wow it really does seem like extortion. The stories in the article are brutal.

The free press argument isn't relevant. If the a local paper called you up and said "hey we are going to publish this negative article about a bar fight you started _unless you pay us $500_ ", that would also be extortion. Remove "unless you pay us" and it's totally legal.

If MugPhotos.com launches and just publishes mugshots but doesn't charge to remove them, it would also _not_ be extortion.

FindLaw: "Most states define extortion as the gaining of property or money by almost any kind of force, or threat of 1) violence, 2) property damage, 3) harm to reputation, or 4) unfavorable government action."

IANAL etc.

<comment><USER10> The difference is:

Merely publishing a mugshot is not "harm to reputation". If it were, then it'd be extrajudicial punishment when the government does it, no?

<comment><USER14> It's the "gaining money by threat" part that makes it a plausibly successful charge. What they do is publishing it in a way likely to lead to more publicity, more harm to reputation unless you pay them.

Take the Letterman extortion case. Letterman had a relationship with a staffer. Another staffer threatened to disclose to the press _unless Letterman paid him_. That staffer was convicted.

[https://en.wikipedia.org/wiki/Joe_Halderman](https://en.wikipedia.org/wiki/Joe_Halderman)

Disclosing to press/public and harming reputation is not extortion. And harming reputation with true facts is totally legal. You can even go to a (trashy) paper and get paid for your story.

Threatening to disclose and/or publicize unless payment is made _is extortion_.

IANAL and building a case is probably more complicated than I understand.

<comment><USER10> Yeah, I think you've basically hit the nail(s) on the head here.

But it also seems at least partly designed to obscure the fact that parts of pre-trial confinement are tantamount to extrajudicial punishment.

</comment></comment></comment></comment><comment><USER15> Morality aside... what I'm curious about is, what gives California any jurisdiction over a company registered in another country, and operators residing in other states?

<comment><USER16> Given the examples in the article, they are clearly doing "business" in the state, and doing harm on citizens of the state. If they fail to show up in California court to defend themselves, that would lead to another charge. The state could make extradition requests, or arrest them if they ever show up in the state. It's possible that federal charges could be filed.

<comment><USER17> If the operators are careful never to travel to California, does it end there? Would a California judge order ISPs to block particular sites? Could payment providers be forced to stop paying?

<comment><USER18> The state of California has extradition agreements with other US states. The article says that the owners of the site are living in other states in the US. So they will simply say to those states, "Hey, these people have been convicted of a crime in our state. Please collect them and send them to us." The other state will likely comply per their agreement.

</comment></comment></comment></comment><comment><USER10> I find this very hard to understand - doesn't freedom of the press ensure that I can post whatever media (in the public domain) that I like? If I were posting public domain photos of a city park, and running a market wherein people were able to pay to have them removed, is that the same thing?

If not, this seems like an implicit assumption that a mugshot is a form of punishment / humiliation. And if that's so, isn't _that_ the injustice here?

<comment><USER19> I'm sure it will be an interesting case, wouldn't be surprised if it goes all the way to the Supreme Court.

However -- there are clear laws making it illegal to demand money to not speak/publish information (i.e. blackmail). I expect the defense will argue that they are not publishing the information, they are merely amplifying it by making items of public record more available.

<comment><USER10> This seems to be distinct from blackmail in a clear cut way though - in this case the information is already published, and the market is for removing it. In other words, it isn't a secret at the time of the transaction.

<comment><USER19> Here's a really interesting article on the topic: [https://www.washingtonpost.com/news/volokh- conspiracy/wp/201...](https://www.washingtonpost.com/news/volokh- conspiracy/wp/2017/07/06/it-is-actually-difficult-to-define- blackmail/?utm_term=.db9992a7008f)

Note that in the DC statute discussed in the article, it refers to "publicizing an asserted fact". One could argue that repeating the fact that the mug shot exists in a different forum is an act of publicizing. In this day and age, publication is increasingly a matter of degree -- everyone's a publisher, if you count Twitter and Facebook. It would still be blackmail, I think, if you threatened to take someone's tweet and put it on the front page of the NY Times unless you receive a lifetime supply of M&M's and Diet Coke ...

<comment><USER10> > It would still be blackmail, I think, if you threatened to take someone's > tweet and put it on the front page of the NY Times unless you receive a > lifetime supply of M&M's and Diet Coke ...

Haha... wow, such a good synopsis of the state of media today.

Yeah, this is a good argument. It also suggests, though, that criminally relevant distinctions between blackmail and publication are strained.

</comment></comment></comment></comment></comment><comment><USER6> I'm surprised mugshots are other such aren't sealed until after a conviction. Is there a particular legal precedent for this?

Heck, even a speeding ticket isn't shared by the DMV until _after_ you plea guilty or are convincted. You have a long period of appeals until that time.

<comment><USER10> > I'm surprised mugshots are other such aren't sealed until after a > conviction.

That sounds closer and closer to secret arrest. The public has a right to know who the government has arrested and why.

By sealing them until after conviction, it makes it sound like the mugshot is punishment. It isn't. It's a public record to check the government against secretly arresting people (or intentionally arresting the wrong people).

<comment><USER20> If you don't think having your face posted on the internet even prior to conviction, with all this entails, is punishment, then I admire the reality distortion field that lets you see the world that way.

Speaking as someone who grew up in a sane country. (Norway).

<comment><USER10> I think you are correct, but that's just part of the problem that we've been convinced to attribute guilt even in the absence of proof, on the state's say- so alone.

We need instead to presume that everybody who is arrested (and whose mugshot is posted) is innocent unless compelling evidence, based on sworn testimony, is presented.

I don't see how adding secrecy is a solution to extrajudicial punishment.

</comment></comment></comment></comment><comment><USER21> Great. I hope they can call it n thousand counts of extortion and effectively get a life without parole sentence.

</comment><comment><USER19> Here's a fascinating article on the crime of blackmail, which addresses a lot of the questions that have been brought up on this thread: [https://www.washingtonpost.com/news/volokh- conspiracy/wp/201...](https://www.washingtonpost.com/news/volokh- conspiracy/wp/2017/07/06/it-is-actually-difficult-to-define- blackmail/?utm_term=.db9992a7008f)

</comment><comment><USER22> A problem of scale as well as prerogative.

There is only one government with mugshots. And for small crimes you can pay a small fee to remove.

There can be an UNLIMITED number of "Mugshot" extortion sites spring up like weeds. Each setting their own extortion rates. And for no purpose other than private enrichment.

</comment><comment><USER23> While it may not be a logical thing, legally speaking, I'm glad that I can agree with Sacto on this.

While it's all piblic record, the friction of having to go to the dept of justice seems like a fair balance btwn openness and privacy.

</comment><comment><USER24> If I create the same web site without the option of paying to have a mugshot taken down, is that legal? In general I think extortion should be defined as threatening to do something illegal unless paid.

<comment><USER25> > If I create the same web site without the option of paying to have a mugshot > taken down, is that legal?

Yes. From TFA:

"Photos of criminal suspects taken by law enforcement agencies are public records and are generally releasable under state open records laws. Publishing them is not a crime, but Becerra said Mugshots.com broke the law in demanding a fee for their removal."

> In general I think extortion should be defined as threatening to do > something illegal unless paid.

Nah, threats/coercion are enough. Think of this as blackmail.

<comment><USER26> Does this still apply in cases where the suspect has been found not guilty / charges dropped?

</comment></comment></comment><comment><USER12> The case for this being extortion feels very weak to me. The records are public record, so they are available to anyone who asks for them. They have already been published on the website, so the request for payment does not carry any threat.

It feels like the real problem here is that many things that are designated as public records have previously been practically inaccessible. We're in an age where it is getting easier to make things like that more accessible and searchable, so we have to reconsider the laws designating various things as public record. Mugshots, in particular, seem to be an ideal case for not being public record at all -- it's not clear how the public benefits from these being accessible.

</comment><comment><USER27> Sort of like collecting my "identity" information, putting it at risk of being taken and asking me to pay a fee to prevent unauthorized people from accessing it.

</comment><comment><USER28> Can someone illustrate how the misdeeds of these awful people makes the crime of money laundering?

<comment><USER29> Presumably, they are accused of doing something in moving money around to conceal it's illegal origin (the fact that the removal is a separate, not overtly connected site may be part of this if it reflects a deeper subterfuge where there is an attempt to pretend they are separate, unrelated businesses.)

Unfortunately, there are no links i can find to the actual criminal filing, which would presumably have some details as to the factual allegations supporting the identified charges.

</comment></comment><comment><USER30> "extortion and money laundering charges against the owners of a website that publishes mugshot photos and charges a fee to remove them."

Isn't that blackmail, not extortion?

</comment><comment><USER31> A better solution would be for upstanding citizens do do a "civic duty / national service" of getting arrested and going through the experience, so that everyone mug shots are together, and everyone understands what sort of violence the State perpetrates on their behalf.</comment>


Ask HN: 6 months later, which projects have switched from OpenSSL to LibreSSL? - <AUTHOR>

<comment><USER2> Better yet, which projects have abandoned any project derived from OpenSSL and switched to something else, like gnutls or NSS?

OpenSSL has a rather painfully error-prone programming interface (as in, it's easy to make mistakes that result in serious security holes), and an obnoxious license that's incompatible with one of the most popular FOSS licenses. LibreSSL can't fix the latter, and has a very limited ability to fix the former.

</comment><comment><USER3> no comment on this, but... to anyone who is using LibreSSL, make sure to patch to 2.1.2:

[http://www.cvedetails.com/cve/CVE-2014-9424/](http://www.cvedetails.com/cve/CVE-2014-9424/)</comment>


Ask HN: Is there a Redis alternative that uses disk? - <AUTHOR> Just need a key/val get/set.
Redis stores everything in memory. It uses the disk for snapshots, but what about using the disk when there's not enough memory for storage? (memory is expensive)
Postgres works except it doesn't reclaim disk space without a vacuum full (which requires a lock) so if you're doing a lot of deletes, Postgres is impractical. <comment><USER2> Just set `vm-enabled yes` in your redis config and it will use virtual memory (aka disk) to store the actual values, while keeping as many keys as it can in-memory to ensure fast lookups.

[https://redis.io/topics/virtual-memory](https://redis.io/topics/virtual- memory)</comment>