Blockchain study finds zero success rate and vendors don't call back - <AUTHOR> https://www.theregister.co.uk/2018/11/30/blockchain_study_finds_0_per_cent_success_rate/ <comment><USER2> Blockchains make no sense when the "asset" they are tracking have to be imported from the outside world because they lose the trustless property which is the whole point.

For example supply line tracking blockchains. "Look this piece of beef was at place X on time Y with temperature Z, I have a hash and everything". Yes but how do I know that you didn't swap the barcodes or you didn't fiddle with the GPS or the thermometer was working or a million other things ?

Blockchain only makes sense if the asset is internal (i.e it gets created in it) because that makes it publicly auditable and you don't have to trust anyone. Cryptocurrency is the perfect use case and the reason they were invented.

<comment><USER3> I think blockchains can help minimize trust even if it's dealing with assets outside the blockchain.

Let's use your beef example. The beef might come from a farm. It's certified organic. It gets shipped off to a distributor. The distributor sells it to a store. You go to a store and buy it.

In the current system, if the store is a bad actor (e.g. selling beef it claims is organic, when it's actually not) then you don't really have a way of knowing.

However, if the beef was tracked on the blockchain and transferred to you on the blockchain at the point of purchase, then you are no longer relying on just the store telling you it's organic. The claim is verified by chain of custody on the blockchain. So now multiple parties (the farm, distributor, and store) would have to cooperate to dupe you. You can still get defrauded by the store if they completely swap the beef. But, they would STILL have to purchase legitimate beef and transfer it on the blockchain to you. It would be harder to get away with it vs. just changing the label.

That's just one example of where it can minimize trust. But once more assets are tracked on the blockchain, you can start to do REALLY COOL things with them.

For example, imagine using real estate to get decentralized collateral backed loans on MakerDAO.

I can go on and on about this stuff...but it's really cool and we're just getting our feet wet with the technology.

<comment><USER4> Replace the word blockchain with database and describe how your example works any differently. I'll give you a hint: it doesn't. There is nothing in your example that requires the use of a blockchain. If that beef was tracked in a standard database they would _still_ need to buy beef that was "legit" as far as the database is concerned if they wanted to make a legit claim.

Tracking external assets requires trust, period. And that being the case, what advantage does blockchain bring to the solution?

<comment><USER5> "I'll give you a hint: it doesn't"

It surprises me how much anger and claims of authority people that don't like blockchain show. Just be modest and open to potential uses of a technology. Are you a coder? Have you ever used Javascript? If yes then it's creator is a big proponent of blockchains. Take a moment to think about this. Numerous other examples too.

<comment><USER6> Its creator also opposes same sex marriage. Perhaps creating a programming language doesn't mean you're right in all other contexts.

<comment><USER5> you are confusing social with technical

<comment><USER6> I'm not confused. Do you honestly believe that all programming language creators agree on all technical subjects? They can't even agree on curly braces vs whitespace sensitive. And blockchain is a different subject than programming languages, they can't make an argument from authority.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I've been working on DLT / enterprise blockchain technologies since 2014 and have insight into hundreds of projects, a small number of which made it to live production. Here is the bottom line: yes, it's mostly hype, but this technology does have genuine use cases - when you want to build an interparty database-driven application, and cannot find a suitable place to put the database, because of business concerns or regulation. This is fairly niche, perhaps 1% of all interorganizational database applications, but there are certainly cases where it is the right solution. The majority of blockchain projects undertaken still do not make sense, but this is gradually getting better over time.

<comment><USER8> Can you let me know how these "private" blockchains utilize proof of X to determine consensus? E.g. proof of work, or proof of stake, or something else?

The thing I never understood with private blockchain tech is that the "traditional" blockchain (i.e. Bitcoin) relies on proof of work, and the only way this is viable is to have tons of resources working on these proofs so that you don't get a 51% attack (there have even been a bunch of articles about how smaller coins actually are very susceptible to a 51% attack by a decently funded attacker).

For a private blockchain, though, it never made sense to me as to who would serve the role of the miners with sufficient incentive to prevent a nefarious attacker. If on the other hand you are in a system where the participants agree as to how they will trust each other, well then you'd be back to a situation where the byzantine model isn't really necessary and you can just go back to a cryptographically signed ledger a la the Quantum Ledger DB that AWS just announced.

Would really appreciate someone explaining this one to me!

<comment><USER9> A useful term here is "Nakamoto consensus," which I think refers to the proof of X thing you're talking about -- consensus schemes that are resistant to sybil attacks among anonymous validators.

And I think you're right -- adding Nakamoto consensus to private blockchains makes no sense, because by definition they don't have arbitrary validators. And without Nakamoto consensus, "blockchain" is just rebranding of old and boring tech.

<comment><USER10> > rebranding of old and boring tech

A distributed merkle-chain database is still pretty innovative. A good example is git. I think what many private groups want is a "binary git for transaction data". Everybody can review their own copy of the shared chain with signing of new links in the chain.

Now that isn't really a full blockchain, but is a different kind of thing from a central RDMS.

<comment><USER11> That is a blockchain, and provides the validation and history integrity that is core to (and where the name 'blockchain') comes from.

<comment><USER8> Except the issue is that Git, which includes validation and history integrity, was invented in 2005 and predates the publication of the bitcoin whitepaper by 3 years.

The point being that all the hype about "blockchain everywhere" came about because of bitcoin. If people are now starting to refer to just the "hash of blocks with previous blocks" (i.e. the "Timestamp Server" section of the original bitcoin whitepaper) as blockchain withOUT the proof of work/stake part, well then you really are just rebranding old tech as blockchain, because it was the proof of work part that was really the new thing in bitcoin.

<comment><USER12> Can someone correct me if I'm wrong?

Proof of work is required for distributed consensus; without that you need a centralized repository like GitHub or Linus to bless the current state of the database?

<comment><USER13> Well proof of work is used to get consensus and prevent double spend in cryptocurrency though there are other mechanisms being tried like proof of stake.

With Git for code you don't really need consensus - I can have my fork and you can have yours.

<comment><USER14> Unless what you're trying to do is actually achieve and maintain consensus without a single entity controlling the database?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> That's bad. I thought someone would be using a blockchain for some kind of back-end settlement system somewhere, but apparently not.

On the ICO front, the SEC is now cracking down effectively. First they went after the outright frauds, such as the coin backed by nonexistent land and diamonds. They won in court. Then they went after the ones that promised big returns and didn't deliver. The SEC won again. That settled the issue of whether an ICO is a security. It is if it passes the Howey Test.[1]

With the legal ambiguity resolved, the SEC started sending inquiry letters to new ICO proponents with some pointed questions. Many new issuers backed off. Now the SEC has an assembly-line enforcement process running for ICOs; issuers can either buy the tokens back and shut down, register as a real security, or get hammered in court.

List of 934 dead coins.[2]

[1] [https://en.wikipedia.org/wiki/SEC_v._W._J._Howey_Co](https://en.wikipedia.org/wiki/SEC_v._W._J._Howey_Co).

[2] [https://deadcoins.com/](https://deadcoins.com/)

<comment><USER16> > That's bad. I thought someone would be using a blockchain for some kind of > back-end settlement system somewhere, but apparently not.

The problem in that area is not the previous lack of available technology, it is institutional inertia. You don't need a blockchain to speed up settlements, because the technology to do it did exist before. What you need is buy-in from a bunch of old and conservatively run institutions that do not particularly like change.

The primary fallacy of all these blockchain proponents is only seeing problems as technical in nature when they really lie somewhere else. The same applies especially to smart contracts.

<comment><USER17> > The primary fallacy of all these blockchain proponents is only seeing > problems as technical in nature when they really lie somewhere else. The > same applies especially to smart contracts.

This is a great point, especially with smart contracts, the problem of the wet code is massively more complex than that of the dry code.

</comment></comment></comment><comment><USER18> I said this in another thread but I'll say it again here.

I am downright shocked at just how much of a failure this technology has turned out to be. How can this many brilliant people work on an area for this long and produce almost nothing of value?

I suppose it happens in areas of "pathological science" like infinite energy machines, but those are areas where the tech doesn't work and probably violates laws of physics. In this case the tech _does work_ in the general sense but seems to have little to no utility in most cases. When you consider scams and fraud it may even have negative utility.

I'd like to be proven wrong. I keep waiting for that killer cryptocurrency app but it never arrives. Meanwhile the core use case of digital money seems almost abandoned.

It's not even that good anymore for black and grey market commerce. It was in the beginning because the authorities didn't understand it. It was security through obscurity. Now they're developing both expertise and legal frameworks for dealing with it. It's no longer a free-for-all.

I have trouble thinking of another technology that actually works that has attracted this much hype, brains, and investment and then failed this badly to deliver.

It's not like fusion, which has a very clear use case but faces so far insurmountable technical challenges. It's not like nuclear fission power which works, has a clear use, but has downsides.

I think the nearest comparison I can come up with are failed government mega- projects like the US Reagan-era "Star Wars" laser missile defense system, airplane-like space shuttles, or giant planned utopian cities that get built and then sit vacant.

I'm also shocked and a little horrified at just how much fraud there is in this space. I'd expect some, but the sheer volume of fraud is breathtaking. Almost all ICOs seem to be scams. Many exchanges are likely scams. Tether looks like a scam. It makes me disappointed in humanity that there are this many bad actors out there just waiting for a new way to fleece people.

Just... wow. What a waste.

<comment><USER19> If money is the root of all evil, give technologists and futurists the ability to print money they can swindle muggles into pouring their life savings into as a get rich quick scheme or espouse at a pitch about how life changing it is and how much excessive amounts of money they need to get paid to copy paste half the Bitcoin Core or Etherium repo.

You see pretty fast the dissolution of values in the face of potential fortune. Its an ancient aspect of humanity - the first European explorers in the Americas would slaughter whole countries on the whisper of treasure to be had.

<comment><USER18> Good point about the conquistadors. I've always thought that many of them probably did come here with utopian ideals about founding pure societies and bringing the word of God to the natives (in a positive way at least as they thought of it), but once they got a whiff of gold and riches greed took over and pretty soon they were committing genocide.

People really do get weird around lots of money, especially if there's an opportunity to get rich quick. I think some really atavistic predator instincts can kick in.

</comment></comment></comment><comment><USER20> I'm really not surprised. The most interesting thing about your business shouldn't be your choice in data-store.

<comment><USER21> But what about the Emerging CD-ROM Industry? (I want to know more about Bill Gate's goat!)

[https://www.questia.com/magazine/1G1-6501528/microsoft-s- thi...](https://www.questia.com/magazine/1G1-6501528/microsoft-s-third-cd-rom- conference-the-industry)

The 1988 Microsoft CD-ROM Conference held in Seattle in March, attracted about 2,000 industry insiders. The tone and ambience of the conference reflect a definite change in the industry. Most companies were represented not only by top management, but by their marketing personnel. Few blue-jeaned engineers or techies were found in the crowds. CD-ROM appears to have arrived.

FINDING A PATHWAY TO THE FUTURE

In his keynote address, Bill Gates, Microsoft's founder and chairman, reiterated his goat of making computers affordable and attractive enough to be "on every desk, in every home." Gates reported that less than 50,000 CD-ROM drives are currently in the marketplace. These are either in very narrow vertical markets, such as libraries, or are being used by the industry itself. The problem of low drive sales is compounded by the high cost of developing a multimedia product. Gates estimated that it costs $1 million for each disk product, an investment that many companies have been unwilling or unable to make.

The lack of a "rich standard for audio-visual" components of CD-ROM development, and the limited tools available to developers today, are two other important reasons Gates cited for the slow growth of the CD-ROM industry.

<comment><USER22> That actually was a thriving industry for a few years in the 90s.

<comment><USER23> Yeah CD ROMs were fantastic technology. I had a full encyclopedia on my personal computer! And so many great games!

They filled the gap very nicely until broadband spread widely enough to allow the web to destroy any need for them.

</comment></comment></comment></comment><comment><USER24> Not really surprising, to be honest.

I'm really tired of the overused "blockchains are really slow databases" phrase. They're not, and if you're using one as that, you're doing it wrong almost 90% of the time.

Here's a great question to ask yourself if you need a blockchain: Do I need game theoretical enforced security?

There are many networks and protocols that can be improved with such security mechanisms. There are more that can't be improved. Just in another thread, someone asked the question if Tor could be improved with it. There's plenty to experiment with here and figure out what makes a blockchain application great.

The entire idea is that you can incentivize good behavior and disincentivize or punish bad behavior. Consensus comes into play here when deciding, "Was this operation done correctly? If so, do this. If not, do that." This has the ability of enforcing correct operation in decentralized networks. My associates and I have taken to calling these "Decentralized Incentive Networks". Yes, there are many problems that have yet to be solved, but people are working on them. I'm really interested in seeing solutions to the oracle- problem, but I'm unsure if it will ever be solvable.

Even then, a lot of these applications won't be fit for enterprise (or even small business) use. Many of these applications will benefit (and survive) from community adoption and rely on being open source.

Hopefully, when the hype is gone, we will have made some really great technological advancements to peer-to-peer and distributed applications. This is where I think blockchain apps will find their niche.

<comment><USER25> The singular point of blockchain is to establish a paper trail. The singular point of Tor is not to have a paper trail.

Those are literally opposites. Blockchain + Tor would be the sort of complete nonsense the article is talking about.

Blockchain has nothing to do with security. It's not a security technology. It's a _permanence_ technology. It ensures that something is never modified in the absence of a trusted authority which it does _with_ security technology and distributed proof of work.

<comment><USER24> You've completely missed the point. There are people who are using Onion routing with nodes who are economically incentivized to behave in a non- malicious fashion. If caught acting malicious, then your node can be penalized. It's not like you're actively putting all traffic on the blockchain. You're arguing a strawman here.

I'm not going to speak for these projects directly because I know very little about them, but I can speak as to how you would incentivize non-malicious behavior.

<comment><USER25> > You're arguing a strawman here.

You didn't really provide anything to actually talk about. You took two literally opposite techs and slapped them together and then acted like it was obvious what that meant.

Blockchain has no application to Onion routing nodes, either. That, again, would be the sort of thing you _don 't_ want a permanent record to track. Tor is specifically designed for the routing to _not_ be stable and _not_ be known. It is fundamentallly the polar opposite of blockchain.

Blockchain is a public list of immutable data, identical for everyone.

TOR nodes form a private list of ephemeral data, fleeting and ever changing. Unique to everyone.

> If caught acting malicious, then your node can be penalized.

Blockchain literally has nothing to do with this. It has no such capabilities of any kind. Hell, it was literally built so that you _can 't_ have penalties as that's governance.

> I can speak as to how you would incentivize non-malicious behavior.

Blockchain doesn't do this, at all. If anything malicious actors love blockchain because there's largely no capability to recover from a successful attack.

</comment></comment></comment></comment><comment><USER26> I met a blockchain researcher this summer, I was asking her what sort of stuff she was working on and she started talking about supply chains. Like drexlspivey mentioned there are a whole host of problems with relying on data from the real world. My first thought was just... why do you need an immutable ledger for that? Not to throw buzzwords out, but why not just store transaction data in a database that scales well? If you're willing to spend all of these resources on developing some insane database for your supply chain you must have some real trust issues with your suppliers. I've never worked in an industry like that but I feel like being able to trust your suppliers is pretty important, and provided that you do trust them you could just use a conventional database for all of this and save tons of time and effort.

<comment><USER27> We decided a couple decades ago that an 'immutable ledger' would indeed be useful. And you don't have to expend tremendous amounts of time an energy creating such a thing. See Hash Chain[1] at Wikipedia, and notice the second sentence.

1 - [https://en.wikipedia.org/wiki/Hash_chain](https://en.wikipedia.org/wiki/Hash_chain)

</comment></comment><comment><USER28> I used blockchain in a project successfully, but it is not a distributed consensus application. My problem was file sharing. Torrent files send a big list of SHA1 hashes, one for each piece of the file. I replaced that idea with a single block which contains the hash of the next block (as well as two other blocks so verification isn't linear one block to the next). This allows a single block to represent the entire file, allowing you to get blocks from many peers while verifying them. You can just send out a coverage map of what you have, and your peers can calculate what you can verify and send you a random block from that set.

If anyone is interested, [1] and [2] are the project. No one is using it, but it's a peer to peer chat and file sharing system.

1\. [https://party-line.lol](https://party-line.lol) 2\. [https://github.com/tacixat/party-line](https://github.com/tacixat/party-line)

<comment><USER29> If I understand your short description, this sounds more like a Merkle tree[1] than a blockchain.

[1] [https://en.wikipedia.org/wiki/Merkle_tree](https://en.wikipedia.org/wiki/Merkle_tree)

<comment><USER30> Depending on how you define "blockchain", it's either the same thing as a merkle tree or most non-bitcoin things that claim to be using blockchains actually are just using merkle trees.

<comment><USER31> > Depending on how you define "blockchain"

i.e.: Depending on whether the person saying "blockchain" is lying to make a quick buck from the hype-train.

<comment><USER30> Sometimes they're just genuinely unaware of the prior art and think that chained hashing is a new thing.

</comment></comment></comment></comment></comment><comment><USER32> I've spoken to a number of vendors and come across similar findings as well. Though of course, this is just observational on my part and not a detailed investigation or study, but I have been getting much the same impression. There's a lot of unnecessary hype and people jumping on the bandwagon just because it's currently a buzzword. That said, I still have a lot of faith in what Blockchain will eventually be able to achieve. It might just take longer to get there than we thought.

I remember when I was studying computer science in 1999, even though the internet had been out a while and there had been lots of talk about e-commerce no one had really solved the problem particularly well in terms of providing a platform to the average Joe, but by 2005 things were very different and then by 2015 there was no looking back. I think it's going to be the same for Blockchain.

<comment><USER33> > I still have a lot of faith in what Blockchain will eventually be able to > achieve.

What does this even mean? Its a really beautiful solution its just lacking a good problem.

<comment><USER34> [https://hackernoon.com/how-blockchain-technology-could- fix-t...](https://hackernoon.com/how-blockchain-technology-could-fix-the-node- js-ecosystem-bccc60832900)

<comment><USER35> The solution offered is: "But instead of giving full maintenance or full publishing rights to new collaborators, the original developer would give new maintainers or a CI system only signing rights. So they would sign their releases and after a careful review the original author would countersign stating that he checked and approves these changes."

This is 100% equivalent to the maintainer merging a pull request. The other half of the solution is "we need to pay open source maintainers," which doesn't need a blockchain either.

Blockchain doesn't help this scenario at all.

</comment></comment></comment></comment><comment><USER36> I find it a bit odd that this entire article and every comment (so far) doesn't even mention HyperLedger? [0]

The open source private blockchain project championed by IBM, Intel, Cisco, etc...

It's powering CLSNet right now. [1]

[0] [https://en.wikipedia.org/wiki/Hyperledger](https://en.wikipedia.org/wiki/Hyperledger)

[1] [https://www.coindesk.com/goldman-morgan-stanley-go-live- with...](https://www.coindesk.com/goldman-morgan-stanley-go-live-with-cls-ibm- powered-blockchain)

</comment><comment><USER23> My favourite terrible blockchain idea is real estate on the blockchain.

Because presumably that means that if someone guesses or steals my password, they now own my house.

<comment><USER37> > Because presumably that means that if someone guesses or steals my password, > they now own my house.

You'll register your private keys with a PKI. In practice the worst case scenario would be needing to go to the DMV to register your new phone or something.

<comment><USER38> So if government can change my private keys, this is no longer decentralized system. How is it different from current system, where county office has a big database of all the documents?

</comment></comment></comment><comment><USER39> I remember random recruiters talking me into speaking with 4 blockchain companies for remote gigs. I had a hard time understanding the value proposition and asked the founders types of questions like, why is this knowledge base better than stack overflow or why does this rating system work better than other systems? It came down to answer the question because "blockchain blah blah". Not giving the actual value to the consumer. It was more touting what the technology allows rather than real value. The killer app of blockchain is crypto currency at this point IMO. Not much else but I'm rooting for Vitalik as that dude is a genius and I still feel like something amazing will come out of his work. I would guess if you are going to use blockchain for something, make it something that cannot function without it and is one of a kind in being a new thing that people will want, not a clone of an existing tech + blockchain.

</comment><comment><USER40> Related, NIST's answer to do you need a block chain.

[https://imgur.com/a/RlUj9Ed?third_party=1](https://imgur.com/a/RlUj9Ed?third_party=1)

</comment><comment><USER41> I worked on a project called GNU Ring ([https://www.ring.cx](https://www.ring.cx)) and we used a blockchain for the distributed name service (match strings to crypto signatures). By default there is a name server, but if you really, really care about getting tiny more anonymity, you can spend some CPU cycles and run your own name service locally or on a server you own.

It also share the cost of running a distributed database among those who care about privacy while letting those who care less enjoy a simpler stack. A win, win.

<comment><USER42> Does it share the cost, or does it duplicate the cost?

<comment><USER43> It shares it. Each person pays for one node, not all the nodes.

</comment></comment></comment><comment><USER44> This study is clearly flawed because they didn't consider the real use case of blockchain: illegal activity.

Blockchain has truly transformed the fields of child pornography, ransomware, drug markets, and ponzi schemes. Regardless of your opinions of those fields, you simply have to accept that those areas wouldn't be possible to the extent they are now without Blockchain based cryptocurrencies.

<comment><USER45> All that operated just fine before, with WebMoney, Paypal and some turkish mules that would take the prison time to cash it all out.

<comment><USER38> I feel that ransomware at least would not be possible without Bitcoin. Before Bitcoin, there were no safe way to get ransom -- Paypal/Western Union would get blocked real fast, and physical transactions were detected in an old- fashioned way.

</comment></comment></comment><comment><USER17> I find this to be a little short sighted stufy. Perhaps he should ask the citizens of venezuela if it works? Or people paying taxes in bitcoin in Australia?

No doubt, there is a lot of hype. No doubt, a lot of people, including techies, have lost sight of what is important. No doubt, many in the space are impatient, and do not understand that blockchain development, the _real_ blockchain development is more like development of aircraft frames. Slow is smooth, and smooth is fast. No doubt, people are trying to apply it where it is not necessary.

There are, however, a plethora of other use cases. The key though, in my opinion, is _placing all of it under the hood_ , invisible to the user except where it is absolutely needed (ie, hi user! here is your wallet).

The truth is that many businesses already run replicated, distributed databases on replicated, distributed servers, and it is plenty fast since they don't have to worry about solving advanced cryptographic math equations for incentive purposes. However, one problem facing generalized platform blockchains, such as ethereum, is that the current entire concept of business and how its modeled is far behind what a blockchain can deliver to a business and its interested parties. The problem, as I see it, is primarily one of _control_ , and secondly, one of _trust_.. I mentioned the replicated distributed stuff earlier, and I think it safe to say no current business will ever open nodes to outside participants (such as customers, or resellers), or even inside participants (shareholders, employees). Unless shareholders demand it (for instance, to ensure a fair number of shares can ever be created), a completely internalized blockchain is pointless and no more trustworthy to society than what we already have.

Another large problem is obviously power consumption. Every bitcoin maximalist needs to come to the realization that one of the strongest ways the established players will fight a new paradigm is by controlling power costs. For many in the developed world, bitcoin is out of reach, as mining equipment is expensive, and power makes it impossible to turn a profit. The best solution to this is green, _affordable_ energy sources and affordable mining equipment. Proof of Stake is not completely the answer.

Finally, I point to this part of the "study":

> We documented 43 blockchain use-cases through internet searches,

No wonder they got terrible results. Doctors tell patients all of the time to not google your symptoms, it always ends with cancer. Does this mean doctors are a failure?

The established financial systems took a thousand years to formulate into what we know today. Patience is power.

</comment><comment><USER46> Tim Bray made a comment at re:invent this week that most of Amazon's internal work loads rely on DynamoDB and a ledger database that is the pre-cursor to the new QLDB service Amazon released this week.

To qualify this, when Tim used the word 'most' I don't know if he meant "most data stored" or "most DB instances". He also didn't give any percentages, so it very well could be 99% Dynamo and 1% ledger DB. Lastly, Bray didn't include Aurora or Redshift in that list of "most used database at Amazon", but Dr Vogel's keynote alluded to a ton of internal Aurora usage.

So, at least some people are claiming successful usage of blockchain in production. It's just not clear how much. Amazon seems to think there is a future in it, since they just released 2 new blockchain related services this week.

</comment><comment><USER47> Oh Boy!! Another case of pre-determined surveys. CLS has already moved to production on blockchain. De Beers has done the same with Diamonds. Multiple insurance companies including our start-up are leveraging BC for direct claims settlement. Is it really difficult to understand that BC technology is not a hammer and all the use cases are not nails. You are trying to get rid of Big intermediaries, people. They are not going to make it easy. Every interaction between parties is going to be more difficult than the previous until critical mass is attained. But succeed it will and will most likely happen before we die.

</comment><comment><USER5> title: "Where is your distributed ledger technology now?"

Just being rational and before reading the article, you can deduct there is some kind of bias.

"Any claim made for blockchain could be made for databases"

We can deduct here that author has no deep understanding of the technology.

"that's something we can confidently tell you for nothing: no, it isn't"

Author is dismissive and angry (didn't adopt early?)

</comment><comment><USER48> Great level of precision in this measurement.

</comment><comment><USER49> IMO the killer blockchain app is voting. It makes use of the features that are unique to blockchain: censorship resistance, decentralization, and trustless transactions. I've been working on a paper for the last 6 months that details a system that makes use of crypto innovations like zk-snarks and some other novel technologies that lays a blueprint for how to use this tech to provide a voting system that would be beyond any central party's influence and would securely allow for voting from mobile devices and a host of other things that are beyond the capabilities of centralized tech - at least beyond the ability to be done in a manner that anyone would trust.

I've been watching the space since 2010 and can honestly say most projects are solutions in search of a problem.</comment>


The Science Behind How Running Grew Our Revenue by 29% - <AUTHOR> https://medium.com/good-audience/the-science-behind-how-running-grew-our-revenue-by-29-c74df608b10c

<comment><USER2> I am doing the same except I am surfing every day. It works like magic.</comment>


Revolutions happen when things get better [pdf] - <AUTHOR> http://www.louischauvel.org/DAVIES2089714.pdf

<comment><AUTHOR> Excerpts from Davies 1962: [https://plus.google.com/103530621949492999968/posts/3AZannVS...](https://plus.google.com/103530621949492999968/posts/3AZannVS793)

This is interesting because of what we observe right now: even as the global economy continues steadily growing and places like Africa have never been better off, we still observe a great deal of unrest and civil revolution. The Davies paradigm suggests that we observe the unrest _because_ of the growth, and also explain why hellholes like North Korea can persist for so long, which is a bit of a mystery if mere misery & tyranny were why revolutions happened. (The Davies paradigm also undercuts a lot of the moralizing around events like the American & French revolution.)</comment>


The Proven Guide on How to Get on the Instagram Explore Page - <AUTHOR> https://www.growthhustlers.com/instagram-explore-page/ <comment><USER2> Those call to actions are such tacky, spam inducing captions. Mainly used by large aggregate, spam accounts. "TAG A FRIEND WHO WOULD DO THIS,. "FOLLOW MY FRIEND", "DOUBLE TAP IF YOU AGREE". I highly suggest you avoid this practice. Get down to your user level and be genuine. I run a fairly sizable Instagram account for my target market. You have to be thoughtful about what you say, asking specific questions of your users, based on the content you've posted.

You want a lot of followers? It's a grind. Be consistent, provide high quality content, that benefits the end user in some way. Engage with them when they leave comments. Interact with their content if you like it. BE ORIGINAL. Original content wins. Not reposting everyone else's crap. That's how you build a real community, where other businesses will take notice.

</comment><comment><USER3> What's the ROI here? Is there a specific case study showing some impressive return from having a picture get more exposure on Instagram?</comment>


This Twitter bot tricks angry trolls into arguing with it for hours - <AUTHOR> http://www.dailydot.com/unclick/arguebot-twitter-bot-bait-jerks/?fb=ss&prtnr=thrillist <comment><USER2> I think my favorite part of this bot is that the bot replies don't even reference what the troll said. It just spits back a different phrasing of "you're wrong" over and over and over.

</comment><comment><USER3> Based on the conversations I've had on twitter with some left-leaning folks it's pretty unfair to pretend something like this only works on those with conservative beliefs.

</comment><comment><USER4> This is wonderful to hear about! Sarah Nyberg has done such fantastic work with promoting the cause of social justice on Twitter for the past few years. I'm glad she's still doing what she loves and making the world a better place in the process.

<comment><USER5> > I'm glad she's still doing what she loves and making the world a better > place in the process.

In my opinion a bot that insults people isn't going to improve the state of the world. Quite the opposite.

</comment></comment><comment><USER6> There you have it! Your avarage liberal is indistinguishable from a simple markov chain.

<comment><USER7> When you provide someone who has built up a false image of what a liberal is in their head, if you provide them that image they'll more easily accept it as real.</comment></comment>


Hall for Android Watch - <AUTHOR> https://hall.com/blog/introducing-hall-for-android-wear-watch/

<comment><USER2> fyi, the android wear app comes with our android app - [https://play.google.com/store/apps/details?id=com.hall.andro...](https://play.google.com/store/apps/details?id=com.hall.android)</comment>


The richer sex - <AUTHOR> http://www.nytimes.com/2012/04/15/books/review/the-richer-sex-by-liza-mundy.html?_r=2&emc=eta1&pagewanted=print

<comment><USER2> The Japanese situation mentioned is interesting. I wonder if it'll make Japan less xenophobic, and at the same time, help its poorer neighbors financially.</comment>


How A Great Web Team Fired Their Utterly Useless Manager - <AUTHOR> http://gilesbowkett.blogspot.com/2010/10/how-great-web-team-fired-their-utterly.html <comment><USER2> Interesting tactic worth remembering: search the next for prior versions of the target's resume. Or you could otherwise find evidence on the net/Wayback Machine that his submitted resume doesn't match reality.

</comment><comment><USER3> Literally devoid of content. I think Giles sometimes hits the mark, but there was nothing here. Good manager is good, bad manager is bad and gets fired.

</comment><comment><USER4> I was sort of hoping for an article where reason prevails and they actually manage to oust a manager.</comment>


Brown Person on screen? We need subtitles - <AUTHOR> https://twitter.com/sricola/status/1108844108095938560 <comment><USER2> This has happened before: [https://www.youtube.com/watch?v=CN666q3ptAU](https://www.youtube.com/watch?v=CN666q3ptAU)

</comment><comment><USER3> This is actually really interesting. I doubt the person responsible even realized they were doing this. Hope Vox sees this and learns from their mistakes at the very least.

My view on this issue might be kind of lax but a lot of people don't _realize_ they're being racist. Before we call someone out we need to first ask if their mistake can be attributed to ignorance, not ill intent. Put educating before chastising.</comment>


Jeff Bezos' 2017 Letter to Shareholders - <AUTHOR> https://blog.aboutamazon.com/company-news/2017-letter-to-shareholders/ <comment><AUTHOR> This is worth reading, if only for this quote, which rings true with me. "Unrealistic beliefs on scope – often hidden and undiscussed – kill high standards."</comment>


Show HN: Refjar.com – bookmark links and fetch online discussions - <AUTHOR> https://refjar.com <comment><AUTHOR> I build it for myself, as I like to read comments sections a lot, and sometimes I have interesting article and would like to read what people think about it. So now I add it to refjar and it fetches discussions from reddit and HN.

My public bookmarks list: [https://refjar.com/u/mdoliwa/j/bookmarks](https://refjar.com/u/mdoliwa/j/bookmarks)

I'd be very thankful for any feedback about tool/idea.

<comment><USER2> This is very cool, and thanks for sharing!

One question -- how often does your tool re-scan for new discussions, or does it not re-scan?

I see on your public bookmarks, it shows current discussions, it would be cool to see which ones are new since the last time you looked. A further suggestion would be to include a date & star icon on new discussions. Just a thought -- thanks again for sharing!

<comment><AUTHOR> Now it rescans only number of comments. It starts with n = 15 minutes and schedules next scan in n*2 if there were no new comments or n/2 if there were any.

Fetching new discussions after initial scan is in my todo list.

</comment></comment></comment><comment><USER3> There's a very useful service for me here beyond bookmarking. I often want do read something and wonder if there has been a Hacker News or reddit thread about it, but don't necessarily want or need to bookmark it.

Any plans to decouple these? I feel like I remember a chrome extension from ages ago that showed hacker news comments for the current page, but I've searched a couple times and come up dry.

<comment><USER4> I use a very simple Chrome extension which just opens any existing Reddit threads for the current webpage.

[https://github.com/mshafer/chrome-find-on- reddit](https://github.com/mshafer/chrome-find-on-reddit)

</comment></comment><comment><USER5> So far I've used Chrome extension "HN current page search" which finds both HN and Reddit discussions regarding the page you happen to be on (only if you click the extension does it check).

On the other hand once Delicious closed down I've settled in for [https://raindrop.io/](https://raindrop.io/)

</comment><comment><USER6> You can extend it to Twitter too, Arxiv Sanity has a 'Top Hype' section [0].

[0]: [http://arxiv-sanity.com/toptwtr](http://arxiv-sanity.com/toptwtr)

<comment><AUTHOR> Thanks for suggestion.

</comment></comment><comment><USER7> man, last week i created [https://peg.gy](https://peg.gy). similar idea when it comes to rating and tagging but no intention of fetching online discussions. it's just a proof of concept for now.

i even created a similar bookmarklet to drag to the bookmark bar, but "Peg it" instead of "Jar It"

<comment><USER8> Just a heads up that according to the React devtools extension, it looks like Peg.gy is running the development build of React in production. It should be easy to fix: [https://reactjs.org/docs/optimizing-performance.html#use- the...](https://reactjs.org/docs/optimizing-performance.html#use-the- production-build)

<comment><USER7> yea i know. just a PoC for now, hoping to upload a more functional version with user accounts and stuffs in the coming week.

</comment></comment></comment><comment><USER9> Great idea! Do you plan to make it paid at some point - referring to the Sign up and try for free note?

The biggest issue I have with bookmarking (apart from a better interface - which your app addresses) is link rot. I think adding a permalink (maybe by default?) would take this to the next level. Perma.cc has a nice API last time I checked :)

<comment><USER6> [http://pinboard.in/](http://pinboard.in/) offers a paid archiving service. Also Refjar has a somewhat similar interface to Pinboard.

</comment></comment><comment><USER10> It's almost something I would use everyday, but I don't think bookmarks are the right approach. For example, because reddit comments tend to be higher quality than YouTube comments I use AlienTube for YouTube which replaces a YouTube video's comments with reddit threads (if they exist). I'd want a similar thing for just any article, without having to bookmark what I'm reading (or go to a separate site even).

AlienTube chrome extension: [https://chrome.google.com/webstore/detail/alientube-for- yout...](https://chrome.google.com/webstore/detail/alientube-for- youtube/opgodjgjgojjkhlmmhdlojfehcemknnp?hl=en)

<comment><USER11> I am curious, are you also thinking of a different solution to problem that bookmarks are solving (= keeping track of websites you want to keep track of) or just the social part (in your scenario through reddit comments being injected into any website you visit)?

<comment><USER10> Mainly just the social part. I already use a combination of Feedly and IFTTT to save articles of interest.

</comment></comment></comment><comment><USER12> What a wonderful idea. Thanks for sharing.

I especially like the ability to tag items and then search on them. Having a feature to edit tags after the fact, or search on them by entering a tag name as opposed to clicking on an existing tag would be really neat.

Bug report: I got a 500 when trying to empty the trash of 2 items.

<comment><AUTHOR> Thanks, I know this project is a little buggy, I'll work as fast as I can to fix them. Finishing tags edition, and searching like on stackoverflow is one of the things in my "next" board in Trello :)

</comment></comment><comment><USER13> This is awesome, I've wanted a tool that shows the HN/Reddit comments on articles for a while now but never got around to making it -- thanks for creating it!

</comment><comment><USER14> Nice Job there. How much it differs from Flipboard / Pocket ?

<comment><AUTHOR> I used Pocket only, and main way of using it was to discover new things. As I love reading comments it was little annoying to find interesting article and have no information about online discussions about it. Besides that I wanted it to have options to share lists of links by making them public, so my wife could eaisly share her cooking recipies :)

</comment></comment><comment><USER15> I wwas thinking about the same concept a few days ago. thanks a lot for creating this.

Query: How often it rescans the link to check the new comments?

<comment><AUTHOR> Now it rescans only number of comments. It starts with n = 15 minutes and schedules next scan in n*2 if there were no new comments or n/2 if there were any.

Fetching new discussions after initial scan is in my todo list.

</comment></comment><comment><USER16> Great app! In the future, is it possible to follow other people and see the top list of bookmarked links?

This feels like Twitter + Pocket

<comment><AUTHOR> Yep, I'm thinking about doing some aggregate top links and option to subscribe to lists.</comment></comment>


Snap judgments, trolling, and bias are the monsters terrorizing digital culture - <AUTHOR> https://digitalculturist.com/have-we-unleashed-the-monsters-a603325a5a85 <comment><USER2> I remember there was an app presented on Shark Tank that prompted you to "rethink" before you post a comment on social media. Perhaps we need something like that to "encourage good behavior" for all social media applications and commenting platforms.

I didn't remember, but Mark Cuban seems to have invested in it:

[http://www.business2community.com/entertainment/shark- tank-r...](http://www.business2community.com/entertainment/shark-tank-rethink- app-takes-home-100000-mark-cuban-lori-greiner-01663986)</comment>


America's Mumbai - <AUTHOR> https://www.mwi.usma.edu/americas-mumbai/ <comment><USER2> I think where this article really fits this community is in the last two sentences: "We can start now by turning the buildings against attackers who would use them against innocent victim. Doing so will help prevent America's Mumbai."

The article suggests some immediate solutions (quoted below), but this is an idea that has never occurred to me that civil engineers should start thinking about - build structures to make malign use more difficult.

"... a drone without explosives, such as the racing drones that can go from zero to eighty miles per hour in a second, flown straight into an attacker's position, could interrupt an attack."

"...attackers' decision to occupy buildings can be used against them... [using modern fire control systems a] room could be filled with smoke, riot control gas, or even some type of sleeping gas."</comment>


Ask HN: Launching a SaaS startup with free plan first? - <AUTHOR> Hi everybody,
I am excited to launch my startup soon and I was wondering if it makes sense to give out a free plan so people can test it. A free plan with all features enabled that is.
I am planning to offer three pricing plans and I am thinking of three combinations:
1) free (basic features, with trial period which ends automatically), basic (paid, more features), advanced (paid, even more features)
or like above feature sets: 2) basic (paid), advanced (paid), Pro (or a better name, paid)
or 3) free (free forever, basic/limited features), advanced (paid)
Does it make sense to give out all features on the free plan so people can test it and potentially give feedback and/or report bugs? Is it risky to give away everything in the beginning because I could disappoint the people when the testing period is over and they would have to switch to a paid plan?
Would it make it easier to tell the people upfront that the free plan (with all features activated) will only be there for a period of time until the paid plans are ready for use?
I am very excited and I just can't decide which way to go.
The product is ready and I am lookinging forward to launching soon.
You can find more information about my application at https://github.com/triggerfsio/packages
Please note that nothing is officially launched or ready, yet (in case you want to test something). It will be in the coming weeks hopefully. <comment><USER2> If you plan to charge. Start without free. You will validate more assumptions you making this way right upfront. Getting people to signup to a paid service...is what you need to figure out sooner than later.

</comment><comment><USER3> ...free forever until... isn't really free forever.

why not offer free for development. I would offer a paid plan that has the features completed.</comment>


What Is Idempotence? - <AUTHOR> https://lispcast.com/what-is-idempotence/ <comment><USER2> I've been struggling lately with distinguishing between things that are inherently idempotent and things that are made to be using deduplication.

For example, assignment is inherently idempotent. Assign the same thing twice, and the world is still in the same state as before. Calling assign over and over with the same arguments thus results in the same outcome. For example:

a = 10; a = 10;

But, incrementing is not:

a++; a++;

That said, you can dedupe the incrementing operation:

increment(a, id1); increment(a, id1);

Where increment keeps track of if it has already been called for a and id1, and cached the result. Thus subsequent calls dedupe on the cache and return the same result.

In my opinion, these are different. While increment is made idempotent, it requires a deduplication strategy to achieve it. It is not an inherent property of incrementing.

Deduplication is really hard to get right. And it prevents retrying an operation. When someone says, this is safe to retry, its actually saying, you can't retry this, subsequent calls are noop.

Is there a better vocabulary for these two things? I don't like how idempotency is ambiguous and refers to both. I'd like to be able to know if something is idempotent by its design, or if it is through the use of deduplication.

<comment><USER3> Is assignment even truly idempotent? Maybe for mathy systems, but not necessarily for programming languages. It would depend on the implementation of the language, and could, for example, introduce global side effects. It kind of depends on what you consider the "value" of the operation. The return value? The global state?

Even a classic GET request on a REST api, is only idempotent if you ignore the fact that the data changes over time.

I guess what I'm saying is, outside of formal systems, I think it's all deduplication.

<comment><USER4> Assuming you don't count side effects like running out of memory, assignment is definitely idempotent. It is, of course, not immutable. Now, it is completely possible to implement a non-idempotent assignment if you want. For example, if you wrote an assignment function that returned true if the value changed when you assigned it, or false if it didn't, then that would not be idempotent.

And, of course, you could be nit-picky about side effects. For example, a language might implement assignment such that the first time you assign a value, it allocates the memory and the second time it simply overwrites the memory. That's obviously not idempotent. However, you could make similar arguments for a _lot_ of compiler optimisations: they can take an idempotent function and make it not idempotent when viewed from outside the context of the source code.

While there is some value in considering those issues, it's a bit self- defeating as well. You take a useful abstraction and throw it away. I think it makes sense to have conversations like: is this idempotent from the context of the source code? Running out of memory when you assign to a variable that's allocated on the stack is not something anyone normally prepares for (and if you do, then God help you ;-) ). The concept still provides value to the conversation, which is the reason for having words in the first place. You may prefer a different word, but if it's going to be used in every single case I would question the utility of the redefinition.

<comment><USER5> Assignment is not idempotent if you include ordering in the system.

These two operations have different results:

1\. A=5 2\. A=6

vs

1\. A=6 2\. A=5

In such scenarios, whenever an operation is performed, the assignment operator is no longer binary. You also need to include the ordering information (e.g. randomly generated) in the transaction, such as:

ASSIGN(0, A, 6) ASSIGN(1, A, 5)

Then operations are performed in the order depending on the first value in the tuple.

As you can see, idempotency of assignment is only true if it's ordering value is the same.

</comment></comment></comment></comment><comment><USER6> At 13:45 in this interview from 2003, Sergey Brin and Larry Page try to explain idempotence to Terry Gross (NPR's Fresh Air host):

[http://www.npr.org/2003/10/14/167643282/google-founders- larr...](http://www.npr.org/2003/10/14/167643282/google-founders-larry-page- and-sergey-brin-part-2)

(It does not go very well.)

Edit: I can't find a transcript, so I just transcribed that portion of the interview myself, starting at 13:45:

TG: Now I'll tell you, in preparing for this, I decided, let me Google Google, so I typed in "Google" into the Google search, and I came up with a lot of Google things in the regular search, but in the "Are you feeling lucky?" search, I got nothing.

LP: Well you just got Google itself.

TG: Yeah, I just got Google itself. Oh, I see, Google was giving me itself.

LP: Yeah.

TG: Oh.

LP: In computer science, we call that recursion. [laugh].

TG: Oh, you even have a name for it. [laugh]. I didn't quite get that. I kept thinking it was just repeating itself. I didn't realize it was giving me itself. [laugh].

LP: [laugh]

TG: And what's the name for it?

LP: Uh, recursion. It's... kind of... Sergey is giving me a dirty look.

TG: Why?

LP: It's a loose definition. [laugh]

TG: Lighten up Sergey. [laugh]

LP: It's a loose interpretation of... [laugh]... recursion.

TG: Sergey, what's the more literal interpretation?

SB: The technical term is you got itself back.

TG: Right?

SB: There's not really much beyond that. [laugh]

TG: Okay.

SB: Idempotence. How about that.

TG: Say it again.

SB: Idempotence.

TG: What is it?

SB: That's when you uh... [laugh]... Maybe I should stop while I'm ahead...

TG: ...You're just making this up, aren't you...

SB: ...Before I dig a deeper hole. Idempotence is when you do something and you get the original thing back.

TG: Oh, so that's a real word?

LP: It's a mathematical term.

SB: Yeah, yeah, but it's also just as loose an interpretation as Larry's was of recursion.

<comment> cgrand-net Isn't it a fix point rather?

<comment><USER7> By the way, one way to describe idempotence is a function whose range is the fixed points of the function.

Fixed point is very close. Your idea here is that _google_search_lucky(search_string)_ , where _search_string= "google"_ returns itself. Which would be a fixed point.

The rub is that the function _google_search_lucky(search_string)_ would in all likelihood return the URL of a website if it was to return a string (necessary for even the possibility of a fix point), so the proper fix point would be "[https://www.google.com"](https://www.google.com").

If I was trying to map this to mathematical ideas, I'd say the point here is that the function _google_search(search_string, is_lucky)_ with the argument _( "google", is_lucky= true)_ returns the _function_ _google_search(search_string, is_lucky)_ . So it's more like the argument _( "google", is_lucky= true)_ is an identity for the function _google_search(search_string, is_lucky)_.

</comment></comment></comment><comment><USER8> Lately I've been trying hard to not just get idempotence but to get a full CRDT. While established CRDTs like an OR-set are great, simply framing a problem in terms of a max value has been really useful. Also useful are fuse values, where you record the first non zero value. Getting commutativity in addition to idempotence is great.

Examples where this is useful tend to be pretty obvious in hindsight (things like accepting partially reported data, or recording a high water mark), and most people have built systems using these properties but taking a more formal approach has made it easier to identify and confirm that the order of operations doesn't need to be strict and at least once delivery is fine.

</comment><comment><USER9> I wrote a blog with this exact title from the standpoint of a SysAdmin/DevOps Engineer: [https://www.sendthemtomir.com/blog/what-is- idempotence](https://www.sendthemtomir.com/blog/what-is-idempotence)

</comment><comment><USER10> Actually idempotent comes from algebra, in particular from ring theory. An ideal is idempotent if its generator, say it a, multiplied by itself n times, equals the ring identity.

See also [https://en.wikipedia.org/wiki/Idempotent_(ring_theory)](https://en.wikipedia.org/wiki/Idempotent_\(ring_theory\))

The definition of idempotent used in IT, assumes that n=2.

Another concept stolen from Mathematics and misused in IT is Topology.

<comment><USER11> > Actually idempotent comes from algebra, in particular from ring theory. An > ideal is idempotent if its generator, say it a, multiplied by itself n > times, equals the ring identity.

The Wikipedia article you linked to defined it for ring elements rather than for ideals of rings and for n=2. I agree that it is sometimes useful to define it more generally where it is in respect to some integer n, analogous to nilpotence.

You may have encountered this notion first in ring theory which may have led to this impression, but it is by no means an idea originating from this specific context.

For example, another comment points out that in linear algebra, a projection operator is said to have the idempotence property.

</comment></comment><comment><USER12> An analogy from linear algebra might help with the intuition: a projection is idempotent. Projecting a projection still gives you the same output.

</comment><comment> matt-attack I would have thought that pressing an elevator call button is non-idempotent, since it affected something on the backend. It changed state. An elevator button is a POST. I thought POSTs like that that _perform_ an action are non- idempotent.

Where as asking for the current floor is idempotent (i.e. a GET). Do I have this all wrong?

<comment><USER13> I think you have it wrong. As far as I understand, an operation is idempotent if you can perform it any number of times consecutively (without another operation taking place), and have the resulting state be the same. So for the elevator, you can press it 1 time, or 100 times, and it will have the same result of calling the elevator to your floor, so long as no operation (ex. The elevator arriving at your floor) takes place in between button presses.

<comment><USER14> I don't agree. Idempotency in terms of REST (or equivalent) is about the effect on the receiver of the call. Pressing the button each time is definitely not idempotent, because it is a change of state of the button.

The fact that the server may choose to ignore this change in terms of the travel of the elevator is not relevant to the change of state of the button transmitted by it being pressed.

<comment><USER13> So what is an example of a call that is idempotent? Are only requests that don't modify state considered idempotent, by your definition?

<comment><USER15> ...which is weird because in the elevator example, the state _isn 't_ being modified. The effect on the receiver, to use their terminology, is always to set the button to "on" or "called" or whatever you want to name it. Hence, the elevator button example is idempotent.

Quick edit: Someone else below makes a good point - in at least one part of the world, a second button press does act as "cancel". Maybe that's the confusion here?

</comment></comment></comment></comment></comment><comment><USER16> There's a similar property of interest - order independence. That is, doing A, then B has the same final state as doing B, then A. Does that have a cool name?

<comment><USER17> The standard term seems to be 'permutable', for A(B(x)) = B(A(x)).

One can also say these functions commute with respect to composition. This is slightly different from the classical notion of commutativity, since the operator (composition) isn't generally commutative.

<comment><USER16> Ah. That's the right term. Thanks.

This is an important property for database updates.

</comment></comment></comment><comment><USER18> The elevator analogy doesn't work in Vietnam, pressing the button again sometimes cancels the elevator.

</comment><comment><USER19> After reading this I realized I've been conflating indempotence with purity.

<comment><USER8> Referential integrity is the ~synonym for purity that is often used.

<comment><USER20> Referential transparency ;-)

<comment><USER8> Ha. You're right. Man there are too many terms to keep straight. "Replacing a function call with the result of that call does not change the program" is the one I meant.

</comment></comment></comment></comment><comment><USER21> It's impotence for people living in Deutschland</comment>


how can I improve my personal site? - <AUTHOR> http://sahillavingia.com/

<comment><AUTHOR> This was the old version which I recently changed: <http://sahillavingia.com/old/>

</comment><comment><USER2> My opinion: White text on a dark background is really jarring and hard on the eyes.</comment>


Why I'm coding with Mithril - <AUTHOR> I have experience creating a very complex React app to organize a conference. It included registration, authentication, personalized schedules and calendars, news articles, up-to-the-minute updates, a store, physical pass(ID) verification, and a few dashboards for use by clients of my client. Honestly, it was a lovely experience.
Presently, 58% of users of my current client's site arrive via mobile and minified React tops 145kb, which takes a lot of time to deliver and unpack. I serve 1000 new users per week who can't rely on finding React in their browser cache. This is too much overhead. I am a little obsessed with under-one-second loading and 3 second attention spans. Non-minified React is 642kb and that's too much code for me to grok if I want to understand what my application is doing.
Then I found Mithril. It's faster than anything. It's tiny. It does only what it needs to do, no bloat. And it does most of the good stuff that React does. It's also FRP friendly, another current obsession of mine.
It's in the early stages, but it is so small and focused that it can be used anywhere. TODAY. mithril.js is small enough to understand in detail. Beyond the basic documentation is a blog and API docs written as precisely and as focused as the code. It's a testament to its quality that the earliest blog entries are applicable today. I recommend reading them from oldest to newest. They read more like a tutorial than a blog. Post a question to the Google Group and Leo will likely refer you back to a blog post because he's already covered your question.
Another sign that Mithril is of great quality: most public discussion about Mithril revolves around the philosophy and logic of app design, not code errors. When errors are discovered, Leo patches them within hours if not minutes.
Leo got so much right. Most things right. More than any other framework I know. <comment><USER2>
      todo.view = function() {
        return m("html", [
            m("body", [
                m("input"),
                m("button", "Add"),
                m("table", [
                    m("tr", [
                        m("td", [
                            m("input[type=checkbox]")
                        ]),
                        m("td", "task description"),
                    ])
                ])
            ])
        ]);
      };

That's some sample view code right?

The heck is that?

With IDE support being so good why would I ever subject myself to using non- html view code anymore? There is no way I want to do a complex site in that kind of syntax, that's just crazy.

<comment><USER3> Hi, Mithril author here.

> With IDE support being so good why would I ever subject myself to using non- > html view code anymore

As others have mentioned, preference for angled brackets can be solved with tooling. insin's MSX exists precisely to address this very concern, and it's dead simple to setup. As you might have noticed, Mithril's syntax is designed to look like the _other_ language of the web: CSS. In practical terms, what this meant to me was to replace the usage of Emmett CSS-to-HTML expansion macro shortcuts in my text editor w/ a macro shortcut that spits out `m("")` instead. Coupled with simple IDE features like automatic bracket matching, I think you can get a typing experience that is very close to what is familiar to users of productivity tools like Jade/Haml/etc users (and with no preprocessor step required).

The actual reasons for templates to be pure js are slightly more technical: it gives better error reporting, proper scope/closure/variable shadowing rules, turing completeness (for the purposes of refactoring/abstraction, etc), it's friendlier to transpiled language users, it's lintable, it's compressable, it's statically analizable, etc.

Also, in my experience, complex apps tend to get heavier on logic than actual markup (this was actually the first thing my previous boss noticed when I gave him a simple code example when I was showing him the framework)</comment></comment>


Conspiracy videos? Fake news? Enter Wikipedia, the 'good cop' of the Internet - <AUTHOR> https://www.washingtonpost.com/outlook/conspiracy-videos-fake-news-enter-wikipedia-the-good-cop-of-the-internet/2018/04/06/ad1f018a-3835-11e8-8fd2-49fe3c675a89_story.html <comment><USER2> Isn't this what snopes is for?</comment>


Staff-leasing company "steals" my resumé; should I let them get away with it? - <AUTHOR> https://plus.google.com/u/0/109068543568522312611/posts/CkrvXNttPBY

<comment><USER2> There's another side to this story...

There's a staff leasing company promoting its services by showing off the resume of someone who does not work for it. Do the actual contractors have similar skill sets? If so, why aren't they using their resumes?

There's something pretty unethical about marketing one level of talent and delivering a lower level.

</comment><comment><USER3> This is seriously not OK. It's also fraud. The persons in your comments and in this thread saying it's all cool and you are the bad guy for having a problem with it, where the heck did they come from?

<comment><AUTHOR> I actually understand where they're coming from. As xanadohnt said, in the grand scheme of life annoyances, this might seem to be of little consequence. i.e., big picture, this is nothing. But most of us here are programmers; we tend to be proud of our ability to zero in on the small things. :)

</comment></comment><comment><USER4> To all the people commenting about how "this isn't a big deal" you need to keep in mind the big picture.

A future hiring manager might find this copied/stolen resume, and presume that the OP had copied the staff leasing company's "master programmer"'s resume. Instead of the other way 'round!

</comment><comment><AUTHOR> I'm sure others have been in similar (if not exactly the same) situations; what have you done, and how did things turn out?

It's highly likely that my "problem" has one clear course of action; but for someone who's been out-of-it for a while due to the pressures that come with having been out of work for over four months now, I'm not entirely sure how to go about it.

<comment><USER5> Consider whether their abuse of your resume actively harms you some way, be it lowering your repuation or re-directing potential clients to them.

If it does harm you, send them a cease&desist letter, based on your authorship of this text. Ask to remove the text from the website, and suggest further discussion.

Aside of that, consider negotiating some licencing fees for past and (if applicable) future use of the document. They may try to disclaim responsibility, blaming honest mistake of a random employee, but that not necessarily absolves any responsibility.

In any case, ask them to attach credit where it is due -- perhaps link to your personal website?

<comment><AUTHOR> Unless I get access to their clients list/information, and can positively identify clients that joined them largely (or even solely) because of the (relative) strength of my resumé, it'd be kind of hard to prove that their misuse of my brag sheet actively harms me, no?

Mostly, I'm interested in stories of others who've been in similar situations. Also, your suggestion implies enlisting the help of a lawyer; if so, I'd really rather have other options, since I don't have the... er, required financial capacity to do that at the moment. (Plus, is it even worth it to involve lawyers in something like this?)

</comment></comment></comment><comment><USER6> What contact has been made with the company?

Evidently they never expected for the use of your resume to come to light.

They obviously want to use it! Why not drop them a mail and say you've seen that they're using it. Advise them of their 'choices', if they want to continue using it they need to add a disclaimer to confirm they have not hired you, also include details of your (very large) fee for continued use.

Alternatively they can remove it and just pay a reduced fee for the time they have used it so far. After all, they have no affiliation with you - they are just using it as 'artwork' for which you should be paid.

I'd make sure the first contact with them is civil. they'll probably be sneaky & just take it down but you never know, taking the official route & spelling it out for them might produce benefits!

If they don't comply, you can always take it further. You can even say you approached them reasonably!

</comment><comment><AUTHOR> For context, here's an earlier G+ post with a bit more background: [https://plus.google.com/u/0/109068543568522312611/posts/VcrF...](https://plus.google.com/u/0/109068543568522312611/posts/VcrFGfx5gpi)

</comment><comment><USER7> I learned to add a Creative Commons notation & URL to the full license to every copy of my resume I've handed out for years now. It won't prevent spammers, but it does give easy grounds to get stuff like this pulled down.

<comment><AUTHOR> They're not exactly spammers, per se. This company was spun off of one I was part of for a little over a month; that's how they got my resumé. However, I've never been a part of this newer company, and I'm pretty sure the contract I signed with the older one is null and void to begin with.

Also, I'm from the Philippines, where the legal system isn't exactly amenable to small claims such as this. And, in any case, I don't really have the financial means to pursue this in court (not that I want to).

</comment></comment><comment><USER4> On a side note, I wonder how long he'll remain unemployed with his resume on HN's front page? :)

Maybe this cloud has a silver lining? Pardon the cliche. ;)

<comment><AUTHOR> Haha! Well, one can hope, I suppose. Except, this time of the year, the Philippines' hiring scene gets to be pretty sucky. Fogeys like me get to "compete" with boatload after boatload of fresh grads with nothing but two months of Visual Basic experience, an ignorance the impossible, and a hankering for a paycheck (regardless of the number of zeroes). Companies figure they can train these chumps and overwork them, then reap the profits.

The fogeys come in afterwards, to clean up the mess (if we're lucky).

But, while it'd be nice to get offers because of this, I'm more interested in the lessons. Plus, I suppose there's a feeling of betrayal, because, as I mentioned earlier, I _know_ one of the people running the company. (To get this out of the way, there are reasons, which I can't discuss, as to why I can't simply walk up to them and tell them to either pay up or take my resumé down.)

</comment></comment><comment><USER8> Talk about making a mountain out of a mole hill.

Ask them to stop and then get over it. They probably didn't even expect anybody would care because it's just not that big of a deal.

<comment><USER9> This kind of thing can bounce back.

Years ago, a friend called, said they had an opening and would I like to send him my resume. I did. He sent it to his manager.

A week later his manager told him that their contracting agency had already sent him my resume. And that for contractual reasons with that agency he could not consider me.

Now, I'd never even heard of this contracting agency, let alone sent them my resume. But I had dealt with other agencies, and copies of my res were on web sites.

I've always assumed they captured it from the web, or a scuzzy rep fled to a new agency with a long list of resumes on CD.

</comment></comment><comment><USER10> Get over yourself? In the grand scheme of life annoyances, this seems to me to be of little consequence.</comment>


Ask HN: How come Google doesn't allow adsense on cannabis related websites? - <AUTHOR> I tried to apply and was rejected, even though I don't specifically sell any marijuana products (edibles, seeds/clones, or flowers). In addition, I don't even refer anyone to to purchase them.<p>How long until they give in and allow it? I know they will eventually, since they are losing out on lots of $$$. <comment><USER2> Marijuana is still illegal at the federal level. Companies big enough for everyone to know their name have no real choice but to handle things conservatively. If some little guy is doing mj related stuff, the feds may not notice. If BigCo does it, it is pretty much guaranteed to become a horrible shit show.

They are in business to make money, not foment revolution. This is how it works for very big companies.

<comment><USER3> The Feds could easily make the value of your public company tank over night, leading to the shareholders demanding you get the Feds off your back. So they can put pressure that way too... even if the CEO is stupid enough to try it anyway. Don't mess with the Feds they act like the mafia when push comes to shove.

</comment></comment><comment><USER4> Or, make all that $$$ yourself by starting an ad exchange for cannabis-related websites.

Beware: banking will be really hard. You need to accept money from ad buyers, and forward most of it to ad sellers. Most of the ad buyers are doing things that are illegal under federal law, so banks won't deal with them. They might have suitcases full of cash, but it's hard for them or you to turn that into ACH deposits for the ad sellers.

That problem may be solvable, just a heads up that it won't be easy.

<comment><AUTHOR> There already is one that I'm using: [http://www.mantisadnetwork.com/](http://www.mantisadnetwork.com/)

It just doesn't pay that much, honestly. Even they seem to restrict what they show (e.g. haven't seen flowers/edibles sold directly yet).

</comment></comment><comment><USER5> When it's fully legal (not just no longer enforced) in all places Google officially operates from?

</comment><comment><USER6> Prison sucks.

</comment><comment><USER7> Probably the same reason stripe would not let me sell waterpipes using their system. They are spineless/get the fear of being involved "illegal" businesses. Even though all I sold was glass art they just saw bongs which are illegal. They aren't willing to risk their livelihood being involved in potentially illegal business. They make more cash elsewhere so it's not worth it. So cash payments for dayz

<comment><USER8> _They are spineless /get the fear of being involved "illegal" businesses._

I'm inordinately curious why you chose to characterize this as "spineless". Even as someone who is 100% for, and actively campaigns and lobbies his representatives to consider some of the bills in his state's upcoming legislative session-I completely understand why a payment processor wouldn't touch this with a ten mile long pole-given where we stand when it comes to _Federal_ legalization of cannabis.

You can be an activist and stand up for the right to blaze all you want as a company, but if the Federal government and more specifically the IRS decides you've nipped it in the wrong bud (pun probably intended), you and your company are in for a _very_ difficult battle that will almost certainly end up with said company shutting down and one or more of your management team facing Federal indictment.

And even if those people walk away scot free, it absolutely is not worth it unless you have an infinite supply of money for legal fees fighting-of all entities-the judicial behemoth that is the United States Attorney General's office.</comment></comment>


A Technical Perspective on the Apple iPhone Case - <AUTHOR> https://www.eff.org/deeplinks/2016/02/technical-perspective-apple-iphone-case <comment><USER2> Snowden has been tweeting about skepticism being warranted. Especially skepticism of the FBI statements, since law enforcement is allowed under law to lie (at least out of court) and mislead in order to further cases.

Some questions to ask:

\- Has the FBI stated that they do not already have the pin for the device? They did state that the device is locked but I didn't see it stated that they don't already have the pin. So do they? It's not a crazy question. They have a good reason to pretend they don't have it.

\- Has the FBI stated that the device was ever in the physical possession of the suspect during the time since the last backup? Or are we all just assuming this? This information is not going to be given voluntarily.

\- If one FBI agent has provided testimony that he and some Apple engineers could find no feasible alternative, that should be taken as the findings of just that one agent, not the entire government. What about the rest of the FBI? What about the NSA? If these questions aren't asked, the FBI has no reason to answer.

</comment><comment><USER3> Am I missing something here, or is there no reason the FBI couldn't desolder the 5C's Toshiba NAND flash chip, read its encrypted contents, and perform the desired offline brute-force attack themselves?

The key derivation function is known, right?

<comment><USER4> That's been covered by most of the articles on the topic, but not very clearly in this article.

Removing the storage chips from the device would mean breaking a very strong key, perhaps 128-bit AES, which is not a desirable offline brute-force attack.

That strong key is derived from the PIN combined with a unique device ID which cannot feasibly be extracted from the processor. So an offline attack needs to crack full AES, but an online attack by running modified OS code on the device itself means only the weak PIN needs to be attacked (just 10,000 distinct combinations, roughly equivalent to a 13 or 14 bit key).

<comment><USER5> Perhaps the key could be extracted by physically analyzing the chip, e.g. grinding it down and using microscopic tools to detect state?

<comment><USER6> Secure chips that store private keys generally keep them on a part of the silicon die that can't be analyzed like the rest of the chip. Any attempt to open the chip package (take off the black plastic/epoxy covering the die) results in the destruction of the secure region and methods of reading state in semiconductors (using electron microscopy) require you to somehow expose the silicon holding the private key.

<comment><USER7> Apparently this iPhone 5C pre-dates the "Secure Enclave." So the key is somewhere else. Possibly a place vulnerable to a physical readout, possibly not.

</comment></comment></comment></comment></comment><comment><USER8> > This key is generated by combining the user's passcode with a key baked in > to the hardware in a way that is designed to be difficult to extract.

Difficult doesn't necessarily mean impossible: [https://www.technologyreview.com/s/519201/tamper-proof- chips...](https://www.technologyreview.com/s/519201/tamper-proof-chips-with- some-work-might-give-up-their-secrets/)

Is it publicly known how the key is physically stored in the chip and if there is active tamper resistance?

It might be a lot of work to break out the tiny probes and the tunneling microscopes or whatever and get the key that way, but at the current level of terrorist attacks in the US the FBI should be afford the resources for that.

<comment><USER9> AFAIK having to grind off the chip package and probe the chip would apply to the iPhone 6, but the iPhone 5C does not have hardware protection for keys.

<comment><USER10> The 5C does not have a secure enclave, _however_ the 5C still has the device UID burned into hardware.

As I understand it, for an offline attack on the encrypted contents of the flash, you would need that UID.

<comment><USER9> I should have been more specific: The iPhone 5C does require signed system software, and the system software enforces safeguards on key access. In contrast, on the iPhone 6, it may not be the case that an "evil update" of system software could be sufficient to subvert the ways keys that are already stored in the hardware secure enclave are protected, and you would have to try to probe the hardware.

</comment></comment></comment></comment><comment><USER5> Would it be possible to physically "scan" the secure enclave chip to determine the secrets contained therein such as the burned-in unique device key and PIN?

Like, is there some kind of chip microscope or reverse engineering process that can not just look at circuitry, but also detect flash memory state?

UPDATE: answered earlier by tzs: [https://www.technologyreview.com/s/519201/tamper-proof- chips...](https://www.technologyreview.com/s/519201/tamper-proof-chips-with- some-work-might-give-up-their-secrets/) It's expensive, but seems well within reach of governments for targeted investigations.

</comment><comment><USER11> Does anyone know, would other agencies have different capabilities when it came to recovering data on the iPhone in question?

</comment><comment><USER12> This article is silly. We're talking about making some changes to an existing codebase and dumping it on to a device. The remote code-entry thing yes is a little bit complicated I agree but disabling the "wipe on 10 bad tries" function is probably nothing more than commenting out a few lines of code. It would take them a few days to have someone type in 9999 passwords but they'd still get there.

<comment><USER13> Have you ever shipped large complicated software? Even simple changes take a lot of time.

For example the recent error 53 bug, in theory all they had to do was roll back a commit. But it still took weeks to get it out.

<comment><USER12> For publicly-shipped software sure, but we're not talking about that. We're talking about what is effectively a test build on a device that would be in Apple's possession. Different kettle of fish, isn't it?

Edit: Another developer here thinks there's probably a developer soft-switch to disable the 10-strikes feature anyway; if that's true then it's even more trivial?

<comment><USER14> Because if Apple somehow is compelled to create the functionality, but then fucks it up and the device gets wiped, that'll go down just wonderfully. So yeah, they'll just load up a quick build off a development machine and start entering PINs and hope it works!

The creation of this backdoor would likely rank as one of the highest pressure coding events in the security engineering groups lives. Yeah, they'll just whip that up in no time.

Anyone who codes these secure systems would reasonably estimate the perfectly safe removal of all these security features combined with adding an automated PIN entry system, and then lets not forget the creation of a secure environment to isolate this code from any possible misuse... somewhere on the order of _man-years_ to develop, test, document, and deploy. Much can be done in parallel, so it's on the order of a team of 6 - 10 engineers working for at least two to three months straight.

<comment><USER12> 1) Obviously they'd test it on other devices first. Also I would expect the government to waive Apple's liability should things "fuck up". But somehow, I think you underestimate Apple's competency.

2) I agree the automated PIN entry system makes things more difficult and if Apple pointed out that it would be far faster in terms of combined "hacking" \+ development time to just have people do the PIN entry the FBI would probably back down on that request.

3) Oh, you're absolutely right, it would take a great deal of additional effort to secure that code in the leaky sieve that's Apple's internal server infrastructure. I wouldn't want it to end up in the wild like the iOS, OSX and all the pro-app source code did (what, what?)

<comment><USER14> You may recall the PIN counter code was buggy the first time they wrote it. It took a patch release to ensure the counter would be incremented even if power was cut immediately after the invalid result was returned. This is part of what leads me to believe the security system which ensures the counter is incremented is non-trivial and therefore its removal may also be non-trivial due to cross-dependencies.

You really think Tim and Dan are just going to let an engineer whip up a build with these features and sign it willy nilly with their production code-signing key, deploy it to the subject phone, and just start punching out PINs? If Apple hasn't _already_ spent several man-years of engineering time on just investigation and tech support for this particular case I would be shocked.

You claimed creating this build should be easier than a public release. From my perspective it's an order-of-magnitude harder, because it's a new process which must be developed and scrutinized from top to bottom and not a well- oiled machine. I've worked inside Apple, and this is not a negative reflection on the competency of their developers in any way. For Pete's sake, this backdoor isn't getting developed as a late-night hackathon!

Of course we're just throwing speculative arguments past each other so it's not so productive. I think I know what I'm talking about, and so do you, but it doesn't really matter much either way :-/

<comment><USER12> I suspect that like most things the reality is somewhere in the middle.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> The article is heavily biased. It is not balanced in any way. They start with a desired conclusion, and then work backwards to construct the answer to the questions.

<comment><USER16> I also agree with this, though that is to be expected. This whole case is massively problematic because the guy was guilty beyond doubt and in a nasty way. The law should not be punitive though, we want justice not _revenge_. We should not compromise our own standards to pursue potential guilty parties.

      Summary

      EFF supports Apple's stand against creating special software to crack
      their own devices. As the FBI's motion concedes, the All Writs Act requires
      that the technical assistance requested not be "unduly burdensome," but
      as outlined above creating this software would indeed be burdensome,
      risky, and go against modern security engineering practices.

So the FBI says the law suggests it not be "unduly burdensome". The EFF response is that they agree it is burdensome but they did not mention _unduly_ so that won't pass. Then they suggest it is _risky_ and _goes against modern security engineering practices_ both of which are irrelevant to the FBI and the law.

</comment></comment><comment><USER17> What times these are. The EFF is supporting a security-by-partial-obscurity company who loves to control what its customers can do with their own devices just so that the FBI can't set a terrible legal precedent, possibly worldwide. Enemy of our enemy is our friend this time, I suppose.

<comment><USER18> I dunno why you're getting down voted here. There is definitely some major nerd cognitive dissonance going on. The ability to have full control over one's own hardware is supposed to be a core tenant of hacker-dom. Amazing how quickly it's been thrown out in this case.

<comment><USER12> I don't get it either. A black box that prevents you from running your own code on it = bad. A black box that encrypts your data and keeps it away from the evil gubbermint (let's be clear here, that _is_ what the community is saying) = good ? It's confusing.

<comment><USER19> The iPhone has never prevented you from running your own code on it. It shipped with a javascript SDK and then within the year they opened it up to objective-c programs. They charge you $99 a year for the certificate signing service, but it's really no big deal... if you can afford an iPhone you can afford $99 a year. (Hell, I think these days you don't even need to be a paid developer, the free developers can run their code on their phones.)

<comment><USER20> You no longer need to pay $99 to run code on your phone. You pay only if you want to distribute it through AppStore.</comment></comment></comment></comment></comment>