Internet Users of All Kinds Should Be Concerned by a New Copyright Office Report - <AUTHOR> https://www.eff.org/deeplinks/2020/06/internet-users-all-kinds-should-be-concerned-new-copyright-offices-report <comment><USER2> In December 2019, the Register of Copyrights (Karyn Temple) announced leaving the Copyright Office to join the _Motion Picture Association_ , effective January 3, 2020.

[https://www.copyright.gov/newsnet/2019/791.html](https://www.copyright.gov/newsnet/2019/791.html)

See [https://en.wikipedia.org/wiki/Revolving_door_(politics)](https://en.wikipedia.org/wiki/Revolving_door_\(politics\))

</comment><comment><USER3> We need strict liability for false DMCA notices plus automatic award of attorney fees in a successful 512(f) case. Would fix 95% of the abuse.

<comment><USER4> I wonder if a system like this could work to prevent abuse:

\- Alleged copyright owners pay $X to file a DMCA notice

\- Accused copyright infringers pay $Y to file a counter-notice

\- Funds are held in escrow

\- If the accused doesn't file a counter-notice within 10 days the copyright owner gets their $X back

\- If a counter-notice _is_ filed and the alleged copyright owner doesn't file suit within 90 days, no matter the reason, the accused infringer gets their $Y back.

\- The pool of remaining funds is first used to offset the website's cost of credit card transactions for collecting filing fees and then any additional funds go to the Library of Congress.

<comment><USER3> In what circumstances would escrowed money be forfeited?

If the escrowed money doesn't go to the parties, then there's no incentive from either side to consider the other side's escrow when determining their actions. Or worse - someone could file a suit and dismiss it later just to force escrow to be paid out. I think you need a lot more details on what happens in each scenario here.

<comment><USER5> The circumstances where the escrow IS NOT returned would be the forfeitures. You have to read between the lines since the comment only specifies when escrow IS returned.

So, alleged copyright owner loses escrow when a counter claim is filed. The accused loses escrow when a lawsuit is filed.

This detail isn't as important as the overall result. Those who engage in mass DMCA abuse will directly lose money as a result.

<comment><USER6> > The accused loses escrow when a lawsuit is filed.

So all the alleged copyright owner needs to do to deprive the accused of $Y is file a lawsuit (which could be completely lacking in merit)? That is arguably worse than the status quo, unless $Y is trivially small, in which case it lacks meaning to begin with.

<comment><USER7> If the plaintiff's case lacks merit, the defendant will get $Y back when the plaintiff loses, plus other fees, and the plaintiff who wasted everyone's time pays all of those costs and potentially punitive damages or sanctions if it was a really egregious abuse of the takedown process.

</comment></comment></comment></comment></comment></comment><comment><USER8> As a forum of tech employees, the EFF is probably the closest we have to an advocacy group. Donate money, donate time.

</comment><comment><USER3> [https://www.judiciary.senate.gov/meetings/is-the-dmcas- notic...](https://www.judiciary.senate.gov/meetings/is-the-dmcas-notice-and- takedown-system-working-in-the-21st-century)

There's a hearing going on in the Senate today in two hours (linked in the article), if anyone wants to watch the livestream.

<comment><USER9> The hearing just started.

Tiller's opening remarks do not leave me with much hope. It's basically "copyright owners are suffering!" and there's no reference to DMCA abuse...

<comment><USER10> That's because DMCA abuse is broadly a myth.

<comment><USER3> Amazon testified in 2016 that over 50% of DMCA notices received for Kindle Direct were bogus:

> So with Kindle Direct publishing, authors routinely try to climb to the top > spot in their category or the top of their browse note, as Amazon would call > it, by issuing bogus notices against higher ranking titles. And this for us > actually accounts for more than half of the takedown notices that we > receive.

[https://www.copyright.gov/policy/section512/public- roundtabl...](https://www.copyright.gov/policy/section512/public- roundtable/transcript_05-13-2016.pdf)

</comment></comment></comment></comment><comment><USER11> Full report:

[https://www.copyright.gov/policy/section512/section-512-full...](https://www.copyright.gov/policy/section512/section-512-full- report.pdf)

Related:

U.S. Copyright Office Says It's Time to Update the DMCA—Mostly in Favor of Rightsholders

[https://news.ycombinator.com/item?id=23278611](https://news.ycombinator.com/item?id=23278611)

[https://gizmodo.com/u-s-copyright-office-says-its-time-to- up...](https://gizmodo.com/u-s-copyright-office-says-its-time-to-update-the- dmca-1843608938)

</comment><comment><USER12> Can someone post a shorter summary of what this would mean?

<comment><USER2> The Copyright Office "forgot" about the public interest. Basically, they represent the copyright owners. The best part is how they second guess courts.

Try at least skimming the article, though.

</comment></comment><comment><USER13> Would this drive more people towards censorship resistant networks like I2P and see the rise of more piracy?</comment>


Diagram suggests Iran working on nuclear bomb much more powerful than Hiroshima - <AUTHOR> http://www.washingtonpost.com/business/ap-exclusive-diagram-suggests-iran-working-on-nuclear-bomb-much-more-powerful-than-hiroshima/2012/11/27/5a5110e8-38ad-11e2-9258-ac7c78d5c680_story.html?tid=socialss <comment><USER2> This article stinks of some kind of manipulation. The diagram was _leaked by officials from a country critical of Iran's atomic program_ , but just didn't want to be mentioned. Hmmm... I wonder who that might be?

This also strikes me as someone in the US defense establishment planting a "causus belli", like the "WMD" of the Iraq War, or the testimony about Iraqi Army soldiers dumping Kuwaiti baby incubators for the Gulf War. An Iran War would guarantee profitability for defense contractors for 25 years.

</comment><comment><USER3> Or it could be the power output of their own version of the Z-machine, which everyone should be copying if they're serious about fusion research. Let's hope we don't see such bullshit as pre-emptive strikes again. Their clerics and officials already said that nuclear weapons were against their beliefs. The Pentagon and CIA should learn to keep their shit to themselves.

</comment><comment><USER4> Here is the diagram: [http://cdn.theguardian.tv/brightcove/poster/2012/9/28/120928...](http://cdn.theguardian.tv/brightcove/poster/2012/9/28/120928NetanyahuUNGA2_6718560.jpg)</comment>


Yes, Amazon Echo Is an Ad Machine - <AUTHOR> https://gizmodo.com/yes-your-amazon-echo-is-an-ad-machine-1821712916 <comment><USER2> If you're concerned about the future of voice assistant technology, I'd encourage you to contribute to Free voice assistant projects like Jasper or Mycroft. With enough support, locally-hosted Free voice assistants could be a credible alternative to cloud-based proprietary products.

[https://jasperproject.github.io/](https://jasperproject.github.io/)

[https://github.com/MycroftAI/](https://github.com/MycroftAI/)

Lots of related projects could also use your help. You don't need to be an AI genius - every FOSS project can benefit from help with debugging, cleaning up code and writing documentation. Mozilla Open Voice just want you to read a few sentences to help build their training corpus.

[https://voice.mozilla.org/](https://voice.mozilla.org/)

[https://github.com/mozilla/DeepSpeech](https://github.com/mozilla/DeepSpeech)

[https://opennlp.apache.org/](https://opennlp.apache.org/)

[http://www.nltk.org/](http://www.nltk.org/)

<comment><USER3> It's unfortunate that there aren't any high quality projects for the other way around - text to speech.

By high quality I mean something as good as Tacotron 2 [1]. However, I have no illusions of Google ever releasing code or trained models.

Someone will likely re-implement it from the paper, but it's unlikely to be anywhere near as good as those samples, due to worse tuning and lack of a good training set[2].

This effect can be seen if you compare Baidu's samples [3] for Deep Voice 3 with those from an implementation by a third party [4].

[1]: [https://google.github.io/tacotron/publications/tacotron2/ind...](https://google.github.io/tacotron/publications/tacotron2/index.html)

[2]: Common voice, for example, will not work well, since you want lots of data from a single speaker for good results. See for example, how samples get progressively worse when increasing the number of speakers in training data[3].

[3]: [http://research.baidu.com/deep-voice-3-2000-speaker- neural-t...](http://research.baidu.com/deep-voice-3-2000-speaker-neural-text- speech/)

[4]: [https://r9y9.github.io/deepvoice3_pytorch/](https://r9y9.github.io/deepvoice3_pytorch/)

<comment><USER2> I don't think it's an insurmountable challenge.

Tacotron 2 was trained on 24 hours of single-speaker transcribed audio, which is comparable to the freely-available LJ Speech Dataset. We know that it's feasible to train using unaligned transcribed speech, which broadens the opportunities to reuse an existing corpus. (Aside: does anyone know the legal status of training a DL model on copyrighted content?) Tacotron 2 was trained on a 32 GPU cluster, which is large but not absurdly so; we are seeing drastic performance increases in low-precision compute, which should hopefully start to trickle down as Volta reaches the market.

Expertise is a bigger challenge at this stage, although that is progressively changing. A huge number of developers are taking a serious interest in deep learning, so hopefully we'll start to see more active contributors to DL FOSS projects. The teams at DeepMind and Baidu Research are clearly highly skilled but relatively small, which suggests that their efforts could be replicated by a small but determined team of FOSS developers.

<comment><USER4> >Aside: does anyone know the legal status of training a DL model on copyrighted content?

How would anyone know that it happened?

<comment><USER5> Not a legal opinion:

Seems like it would fit under Fair Use in USA but wouldn't be allowed under UK's Fair Dealing; I can't comment on other jurisdictions.

</comment></comment></comment></comment></comment><comment><USER6> I'm surprised anyone wouldn't think so.

TVs are the same. And phones. And most web sites. And buses, walls, taxies, public transportation stops, bridges over roads etc etc.

One has to work hard to defend against the ad onslaught these days.

<comment><USER7> The whole POINT of Echo is to always listen and direct your consumer pattern to Amazon and other approved affiliates.

To me it represents pure evil and I don't see how you could defend against it. Except for not buying into this stupid shit.

<comment><USER8> >> "always listen"

This is somewhat correct but misleading. It's always listening for the "wake word" \-- alexa or echo -- and then it processes your request. But it's not sending all conversations up to amazon. Just your alexa requests.

<comment><USER9> Not yet at least. Once attitudes towards privacy change further towards continual surveillance they'll be the first to flip the switch and turn it on.

<comment><USER10> Well currently they'd have to completely rebuild the hardware.

This person gave a very good explanation here:

[https://np.reddit.com/r/Showerthoughts/comments/7m91u9/if_go...](https://np.reddit.com/r/Showerthoughts/comments/7m91u9/if_google_devices_only_start_listening_once_you/drsdxe1/)

<comment><USER11> These devices will get replaced every few years anyway. Having to send out new hardware to customers is absolutely no problem for Amazon.

<comment><USER12> Then by that point privacy as a selling point apple will have the homepod for sale?

I have a bunch, and you only really use them for about 5 things, with the most useful thing being music.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> During my PhD I ran simulations and experiments with robots + humans to explore the effect and possibility of it. The scariest part is, a small amount of companies might now be able to effect with just one update how a huge amount of people think/behave. The reason why Alexa is more powerful than normal advertisement is, people create a social connection to Alexa. Which is needed for "trusted" influence like recommendations from a friend.

My thesis in case someone is interested: [https://ir.canterbury.ac.nz/handle/10092/13598](https://ir.canterbury.ac.nz/handle/10092/13598)

<comment><USER14> If we've learned anything about advertisers in the past, is they WILL get greedy, and start exploiting human brain in more and more ways. Eventually it reaches uncanny valley, and more and more people start noticing how messed up and over the top advertising has gotten and find ways around them or to avoid them, or in the end, neglect them.

Of course, this assumes people still 'own' their devices, at that..

<comment><USER13> Yes they will exploit it. But I think the real problem is, when you don't know if what you see/hear is advertisement. Like seeing a news paper article which is actually advertisement. Or a blogger who says a phone/shoes/etc. is the best she/he every tried. While it's actually bought advertisement.

</comment></comment></comment><comment><USER15> A website that makes 100+ requests of which 30 get blocked warns me about ads. This is hilarious.

<comment><USER16> The difference is that Gizmodo is "upfront" about it.

For amazon to say, "Use _____ to remove that stain," and allow my company to put in a $0.35 per request bid to fill it in with "Jeremy's Awesome Cleaning Sauce," seems inherently more wrong.

<comment><USER17> Is it? If it identifies itself as an advertisement, I see no distinction.

<comment><USER18> But according to the article, it doesn't. In the example of buying toothpaste, Alexa just says "I can search for a brand, like Colgate". It doesn't indicate whether Colgate paid for that placement.

</comment></comment></comment></comment><comment> Digital-Citizen Amazon Echo might be "an ad machine" but that article is a good example of business-minded misdirection: using a relatively minor problem -- persistent advertising -- to deflect attention away from a much greater problem -- persistent spying -- where businesses are the main beneficiaries of the misdirection.

The real problem with Echo is that it's an always-on microphone connected to a networked computer that runs proprietary software (see [https://www.gnu.org/proprietary/](https://www.gnu.org/proprietary/) for how proprietary software is often malware). Users have no software freedom to inspect what the software on the Echo does, change the Echo's software to make the Echo do something different, or share the Echo software (whether modified or not) to help their community. Even if Echo's software comes with some form of user controls, those controls are implemented with proprietary software, software users cannot trust. No matter how technical and willing a user is to improve their Echo device to meet their needs, the permission to do so is purposefully missing. Amazon does not respect a user's software freedom. Therefore there's no good reason to trust the Echo. For all we know Echo is now or at some later time will relay whatever is within mic range to someplace else, thus presenting a constant threat to one's privacy.

Nobody needs Echo; it does nothing users weren't perfectly fine to do another way by visiting a website to place orders. But one should reconsider doing business with Amazon at all (see [https://stallman.org/amazon.html](https://stallman.org/amazon.html) for details).

<comment><USER19> I think there's a huge benefit to talking about the ad problem here. One of the reasons it is hard for linking/quoting Stallman to actually get you anywhere in discussion is that the Stallman view is one of absolute philosophy. "This is philosophically wrong" is not something the average consumer cares about, just like privacy invasion is a ghost nobody cares about until they _see its effects_. Things like convenience and things being free are very visible, noticeable traits, and the counter to those arguments need to also be visible.

Advertising is a very _visible_ effect of both privacy-invasive systems and proprietary software. People _care_ about how ads affect them because they can see it.

<comment> Digital-Citizen I've found that linking to Stallman's articles tends to promote discussion wherein those who object to his articles don't provide specifics against his arguments to back up their own objections. Those pages are loaded with specific consequences; if you haven't spent time reading them you should.

Also, the case of what the "average consumer cares about" (almost invariably an evidenceless case which serves to benefit a business) is often pitched but always shown to be wrong. As Glenn Greenwald points out very clearly in [https://www.youtube.com/watch?v=IOksJKfapVM](https://www.youtube.com/watch?v=IOksJKfapVM) (around 28m30s) he has challenged the notion that privacy is vague or somehow unimportant, or that anyone doesn't care. In fact, he demonstrates how people who say something like what you assert, "They don't actually mean it. At all. And the proof of it is they do all sorts of things to safeguard their own privacy; I mean we all have things to hide. There are things that everyone in this room would be willing to have their spouse or their best friend or their physician or their lawyer or their psychiatrist know but would be mortified to have anyone else know. The people who say they don't value privacy, they put and use locks on their bedroom and bathroom door, they put passwords on their email and social media accounts, they do all sorts of things there's a place they can go in the world to think and reason and explore without the judgmental eyes of other people being cast upon them. This is really critical to human freedom.".

Greenwald challenges people who pitch a line quite comparable to what you said to take him up on his offer to divulge all of one's credentials to everything they have (no exceptions, all accounts should be included) by emailing them to an account he maintains. He asks them for this info and tells them explicitly, "I just want to be able to troll through what you're doing online and publish under your name...". A perfectly reasonable request for anyone who wants to insist people don't care about privacy. The results of his request: "To this day, not a single person has taken me up on this offer.". That whole talk is worth hearing and reflecting on.

People do value their own privacy even if they hold immature evaluations of the importance of privacy or don't know enough about how computers work to think through the consequences of their tech-related choices. People need to learn about the cost of "things being free" and hold mature discussions of important issues of our day which certainly include how everyday technology affects one's privacy (and the privacy of anyone who goes to their house within range of that Echo always-on mic; it's not just about your choice for yourself in your home). People need to learn about the inherent value of privacy as well as the notion that some degree of privacy is not easily regained when lost, so one should not trade privacy away for convenience (not that I agree with you that Amazon Echo is convenient; even on its own merits it has already failed to distinguish between its owner and people on TV demonstrating the device causing lots of unwanted orders. This clear exposure of a security problem is hardly convenient). We do that work, in part, with discussions like these, not by downplaying the importance of privacy but by teaching people the very practical outcomes you inchoately chastise Stallman for presenting.

</comment></comment></comment><comment><USER20> Mozilla recently released open source speech recognition model [1]. What minimal and reasonably cheap device could be used to run it? There could be or already is an open source project that could replace devices like Echo.

[1] [https://blog.mozilla.org/blog/2017/11/29/announcing-the- init...](https://blog.mozilla.org/blog/2017/11/29/announcing-the-initial- release-of-mozillas-open-source-speech-recognition-model-and-voice-dataset/)

<comment><USER21> I imagine something similar to an Echo could be thrown together on a raspberry pi or something similar.

<comment><USER8> Kinda. The issue is the microphone. It's a specialized piece of hardware that uses a microphone array and also has wake word logic built in. There are only a couple companies that sell this and they don't sell one offs. But maybe in the future.

<comment><USER22> Wake word logic is not the hard part, you can do it in software relatively cheaply (cmusphinx/pocketsphinx handles wake word type logic in realtime with relatively low cpu requirements) Microphone quality is an issue, but there's stuff out there, it's just a matter of finding a good one. One popular one is the playstation eye camera, as it's really freaking cheap and is designed for speech input at medium distances, but it's not omnidirectional like the echo/google home mini kind of thing is.

</comment></comment></comment></comment><comment><USER19> Starting with my pet peeves with home automation software... I started writing my own. Then it became the start of an assistant. Now I also run it in my car (I'm implementing navigation, and reading about CAN interfaces). The one thing, hilariously, not implemented yet, is voice recognition, but the whole system's designed to account for it. I'm hoping some of the open source projects for voice like Mozilla's will lead to something I feel comfortable implementing here.

I personally strongly recommend people look to put the "personal" back in personal assistant. Build something that does what you need it to, you'd be surprised how easy it can be, and how educational doing it is. I've learned a ton of stuff I didn't know just implementing basic features.

<comment><USER23> Any idea where to start

<comment><USER19> I started with a code sample of ten or so lines of Visual Basic .NET code that could allegedly turn on my Insteon light switch. Then I made it control my other Insteon devices. Then I started adding email notifications. Then I figured out a command line interface made it easy for me to add new commands/features quickly and that I could also then pipe things like input from an app or voice to that interface.

It kind of grew organically. I don't think when I started if I planned to build what I've put together so far, I would have ever started, because it sounds daunting, especially given my level of experience when I started.

Do one thing. Then do something else. :)

As a sidebar, if you want the general knowledge type queries, Wolfram Alpha's API is incredible for this. They have a "spoken" API which presents the result of your query as a single text-string, ready to be output to a text-to-speech client. I think adding the ability to use Wolfram Alpha was all of a couple lines of code tops to my existing project. And of course, it's free for way more queries a month than you'd ever run on a personal use project.

<comment><USER23> Thanks. I might start with simplifying my dev workflow, the perhaps some appliances

</comment></comment></comment></comment><comment><USER24> Amazon may want to tread carefully here.

Previously their business model was simply to create a fast-lane into Amazon ordering (e.g. "Alexa order me some toilet paper"), but if what the article says is true they're going to ruin normal searching by only giving you product results (Q: "alexa how do I remove a wine stain?" A: "buy Dr. Bubbles Super cleaner"). If Echo is going to give me bad results for questions I'd just stop using it for that.

I'll use whatever personal assistant gives me the highest quality results. If your business model inherently degrades the quality, then your business model is self-destructive.

<comment><USER25> I don't think their strategy of sell em cheap and get a echo into every home will actually save them here as the barrier to switching to a competitor is very low. Coupled with the fact that I get the impression that no one uses their echo for anything other than asking about the weather.

<comment><USER16> That and you can have multiple timers running. When cooking I use that. When leaving the house, I ask the weather for the day. When planning a weekend trip, I get the weather a for the weekend at where ever.

</comment></comment></comment><comment><USER26> When rich people had manservants, it wouldn't be uncommon for them to discreetly get a cut from vendors for recommending their services. Corporate- provided electronic manservants will be no different: they will serve themselves before they serve you.

Obviously the simplest solution is credible open-source alternatives; or there is always that pesky thing, the legislative process.

</comment><comment><USER27> Only relevant sentence in article

"Proctor & Gamble as well as Clorox are reportedly in talks for major advertising deals that would allow Alexa to suggest products for you to buy."

</comment><comment><USER28> This seems vastly overstated. I've never even bought something with my Alexa, let alone heard an ad from it.

</comment><comment><USER29> Preface: I work for Mycroft, mentioned earlier in the thread. We're the open source alternative to the Amazon Alexa and Google home. This makes us customizable, privacy-minded, and neutral.

The thing with the current voice assistants is that they store every. single. piece. of voice snippets they hear. Those recordings sit on their servers. At the end of the day, these corporations have a purpose other than creating a voice technology--they have very specific ways to pay the bills. Amazon is an e-commerce platform. Google lives off AdWords. To think they won't utilize the data they're collecting.. doesn't sound like a strategic decision they'd make.

For those looking for a voice assistant that represents them--and not the corporation behind it, is Mycroft. A way to democratize voice and AI.

Nonetheless, we're in the process of making our second device and if you're interested, you can get updates on it in the link below! We'd love for you to join our community and help us create an open voice assistant. Head to [https://mycroft.ai](https://mycroft.ai) :)

[https://mycroft.ai/kickstarter- mark-2/?utm_source=ActiveCamp...](https://mycroft.ai/kickstarter- mark-2/?utm_source=ActiveCampaign&utm_medium=email&utm_content=Something+Big+is+Coming&utm_campaign=Teaser+Email+%231+%7C+Something+Big+is+Coming)

</comment><comment><USER30> With a 120 million Alexa devices in market of course big brands are trying to figure out how to reach those audiences. If you're P&G and you're selling products through Amazon of course you'd ask how your brand can better leverage the Alexa platform. That doesn't mean Amazon is going to do anything about it.

IMO Amazon can't afford to squander their voice lead by tarnishing the Alexa brand with poorly implemented ads.

</comment><comment><USER31> Amazon got me on their Kindle, which is also an Ad device...I posted a rant about my experience years ago: [http://colabopad.blogspot.com/2013/12/do-not- buy-amazon-kind...](http://colabopad.blogspot.com/2013/12/do-not-buy-amazon- kindle-fire.html)

<comment><USER32> Their e-readers are great. I have a Paperwhite and leave it in airplane mode and the ads stopped. I push content to it through Calibre.

</comment></comment><comment><USER33> I bought one of these because it was on sale and seemed like it might be fun, but since setting it up I've hardly ever used it. It's voice recognition is pretty amazing but I'm just much more likely to google on my phone or desktop if I want to know something.

<comment><USER34> I've found the search on the Echo is so bad it's almost invariably a waste of time since I end up taking my phone out and doing the search there anyway. But as the world's most expensive and convenient egg timer and lightswitch, it's a very helpful device. I can just tell alexa to set timers when I'm cooking, holler at it to turn the lights off when I leave, etc.

</comment></comment><comment><USER35> source: [https://www.cnbc.com/2018/01/02/amazon-alexa-is-opening- up-t...](https://www.cnbc.com/2018/01/02/amazon-alexa-is-opening-up-to-more- sponsored-product-ads.html)

</comment><comment><USER36> If my Echo ever replies with an ad, it goes directly into the trash.

</comment><comment><USER37> There's a certain irony to Gizmodo now going "Don't buy this!" after having it hyped as the "most innovative thing from Amazon" when it got released.

<comment><USER38> Well, the article probably isn't meant to convey opinion or information; it's goal is to drive ad views. Any opinions you read in it are incidental, and selected for maximum clicks.

</comment></comment><comment><USER39> I feel like it's a corporate surveillance device. Same goes for similar products by different manufacturers.

<comment><USER40> Do you include your phone?

I'm torn in the thought. At face value, I can't but agree. However, I also enable crash reporting in many applications. Have for years. Firefox gets usage stats. At some point, I have to wonder why I trust one group of people and not another. More, have the groups I trust changed out from under me?

<comment><USER41> Sometimes you just believe that one company will do better with your information than others. I think I can trust Google to keep my information safe, but I know that they're going to datamine it to hell and back to get the most ad revenue out of me. I think I can trust Mozilla with my FireFox usage habits as well. I can't say the same for most other companies.

I also have a robot vacuum cleaner, but I don't connect it to my network. Too much potential information can be gleaned from a floor plan and the obstacles around the house. You'll never get me to install one of those telemetry devices in the OBD port on my car for any company. I don't care how much money it will save me on my phone or insurance plan.

Is it all rational? Of course not. My personal policy concerning my personal data is a mish-mash of contradictions, because it's fatiguing to be on the offensive 100% of the time. For example, getting a Nest thermostat is something that I want, but I don't want it phoning home to cloud servers. It's heating/cooling data about my house. That's probably some of the most innocuous data you could have about someone, yet if it isn't self-hosted, I don't want it. Yet Maps has tons of location data on me, Gmail holds my emails, and I have plenty of conversations over Hangouts.

Contradictions all the way down.

<comment><USER42> I'm currently trying to cut Google, Facebook and the other gargantuan major players out of my online life, and move to smaller, more specialized providers. If nothing else, it gives me a bit of peace of mind that my online assets are not all in one basket. If you're 100% Google, what are you going to do if the big G decides to suspend your account? If all your social life is though FB (or other big social network), what happens if they suspend your account?

My FB usage is now scaled down to basically just an event RSVP service with a few token page subscriptions for bands and venues. I've removed all photos and videos, cleared out all profile information, set visibility on everything to "just me" or "friends only", and I've untagged myself from everything I was ever tagged in. Yes, I know FB is probably keeping a lot (all?) of that in their archives for an indeterminate period of time, maybe the EU "right to be forgotten" can help with that.

I've replaced Google search with Startpage and I've migrated my email, calendar and contacts from GMail/GCalendar to a paid hosting/email provider, with my own personal domain name.

My phone is still running stock Android 7, but I've significantly cut down the amounts of apps installed, I much prefer to use web versions in Firefox with a decent lineup of privacy-protecting and tracking-inhibiting extensions. Some mobile web sites are really shitty about forcing their apps on you, but I'd rather just do without them. Obviously on the desktop, Firefox with the appropriate extensions is the browser of choice.

I refuse to get any "smart" devices, they're not welcome in my home. I'm working on replacing my Chromecasts, if nothing else I'll just use my laptop and an HDMI cable. For music in my kitchen/bathroom/basement, I've got a decent BT speaker instead.

Kicking the Google/FB/whatever dependency is _hard_.

<comment><USER43> It makes you wonder how people managed to survive at all 20 years ago!

<comment><USER42> Probably with a lot less stress.

</comment></comment></comment></comment></comment></comment><comment><USER44> Back in the day when google was growing, there were similar alarms about tracking and personalized ads. People didn't care, I doubt they would care with devices like echo too.

<comment><USER45> I think the difference here is you can 100% ignore ads on Google. At this point my brain doesn't even see sponsored ads as I immediately look at the first organic result.

If you consume your content through audio then you're forced into listening to the ad / sponsored answer.

<comment><USER46> > At this point my brain doesn't even see sponsored ads

"I'm not affected by ads" is just a lie we tell ourselves. Why aren't you just blocking them? Around these parts it's basically digital hygiene.

<comment><USER45> I do block them with ublock origin and have been for years.

For some unknown reason I thought adwords ads came through and I just happened to subconsciously ignore them, but having just Googled for something now, I see they are not even there.

Funny how the brain works.</comment></comment></comment></comment>


Video.js v3.0 - Complete rebuild w/ lightweight flash player and CDN. - <AUTHOR> http://videojs.com/?3.0

<comment><USER2> Really nice. I love the lightweight flash fallback.

I'm assuming Level3 hosts the project for free to encourage Video.js users to host their videos with them too?

</comment><comment><USER3> What's the difference between this and mediaelement.js, and why should I choose one over the other?

<comment><USER2> I guess it's important to try both out for yourself, but one notable difference is that while MediaElement depends on jQuery, Video.js is completely library-independent, though you can easily use it with jQuery easily: <http://videojs.com/jquery/>

<comment><AUTHOR> The jquery page hasn't made it into the new site yet, but still true.

VJS also has free CDN hosting, and is pretty easy to skin both HTML5 and Flash using just CSS. MEJS is a pretty decent project though, as are a few of the many other HTML5 video players. So not my place to say which is best, but we're working hard to make Video.js pretty great.

</comment></comment></comment><comment><USER4> Nice. I have been using Video.js for a while now.

</comment><comment><USER5> Awesome work, I'll be keeping this in mind for my next video player needs :)

</comment><comment><USER4> For me the download link does not work in any browser.

<comment><AUTHOR> Sorry, fixed now. Launch fail. :(

<comment><USER4> Thanks.. Works.. All set!</comment></comment></comment>


Program design in the Unix environment (1984) [pdf] - vezzy-fnord http://harmful.cat-v.org/cat-v/unix_prog_design.pdf <comment><AUTHOR> Somewhat off-topic, but now that Uriel is dead, is there any central figure tasking themselves with the future upkeep of cat-v?

<comment><USER2> Yes.

</comment></comment><comment><USER3> "Unix" as we know it is a merger of two traditions - the spartan purism of Research Unix and the rich user experience of PDP-10 OSes (Tenex, ITS, WAITS, etc.). When DEC killed the PDP-10 a lot of the PDP-10 culture jumped to BSD, bringing a few big programs (TeX and Emacs) and a few popular features (command completion) which the Bell folks either wouldn't have thought to add or didn't want.

This is one of many times when Rob Pike has complained about non-Research Unix being "impure" (and also VT100s suck and the Blit is the pinnacle of GUI design). He's right to a point, but an OS that enforced purity wouldn't have had nearly the success Unix has had. Most people don't want pure, they want useful, and purity can help usefulness or get in the way.

</comment><comment><USER4> Wow, they mention 9600 baud being common in 1984, but I remember having a brand new 9600 baud modem around 1991, I guess we were late to the game :)

<comment><USER5> > fast terminal lines

The speeds mentioned in that time and context are more likely for hard-wired terminals rather than for modems.

<comment><USER4> Ahhh yes. That makes sense. Thanks :)

</comment></comment></comment><comment><USER6> It was interesting to see a reference to James Gosling's "UNIX Emacs" paper (reference (3) at the end). I keep getting reminded every once in a while that he did a lot of things before Java.</comment>


Ever Wished Bill Watterson Would Return to the Comics Page? (2014) - <AUTHOR> https://stephanpastis.wordpress.com/2014/06/07/ever-wished-that-calvin-and-hobbes-creator-bill-watterson-would-return-to-the-comics-page-well-he-just-did/ <comment><USER2> The gist of the article is that Watterson was a guest artist on Patsis's Pearls Before Swine comic, and drew some panels on three of the daily strips.

Ironically, the strips reveal why Watterson was so successful, he was an excellent artist in a time when most newspaper comics were illustrated poorly or with idiosyncratic but only functional art. However he really only excelled in the Sunday comics, which gave him room to express his wonderful art; the dailies were much more friendly to the functional art he stood as a counterpart to.

I don't think he has any intention of returning, though. I'm more surprised he hasn't worked on anything at all since then; you'd think the graphic novel format would be more amenable to him because of the control he could have; his comic days seemed to be one fight after another with the powers that be.</comment>


AWS Aurora entry-level pricing cut to $30/mo ($24/mo for reserved) - <AUTHOR> https://aws.amazon.com/about-aws/whats-new/2017/03/amazon-aurora-cuts-entry-level-pricing-in-half-with-support-for-t2-small-instances/ <comment><AUTHOR> Aurora now supports db.t2.small instances which means that you can now try it out for just $30/mo ($0.041/hr x 24 x 30.5) or $24/mo if you opt for a no- upfront-fee 1 year Reserved Instance. A more highly available two instance/Multi-AZ setup would cost you twice as much. This comes on the heels of the previous price drop from $200+/instance to $60/instance when they announced support for db.t2.medium instances in November last year.

Straight up MySQL RDS is still cheaper at approx $25/mo for db.t2.small and $12.50/mo for a db.t2.micro instance (not supported by Aurora). But since Aurora data is stored redundantly and recovery happens automatically, even a single instance setup is probably better that what a lot of people are running now.

AWS claims automated recovery times of 15 mins for a single instance and less than 60 sec for a Multi-AZ configuration[1]. Seems like this entry level Aurora instance should be a no-brainer for anyone running MySQL RDS on a db.t2.small instance in a production-like environment today without high- availibility.

Full pricing list here: [https://aws.amazon.com/rds/aurora/pricing/](https://aws.amazon.com/rds/aurora/pricing/) [1] [https://aws.amazon.com/rds/aurora/faqs/](https://aws.amazon.com/rds/aurora/faqs/)</comment>


How to get cheap foreign labor without breaking the law - <AUTHOR> http://www.youtube.com/watch?v=TCbFEgFajGU <comment><USER2> What's the problem? Would any of you actually want to work for these people? No. So you're better off that they disqualify you.</comment>


Bitcoin Processor BitPay Reduces Staff in Cost-Cutting Effort - <AUTHOR> http://www.coindesk.com/bitcoin-processor-bitpay-reduces-staff-in-cost-cutting-effort& <comment><AUTHOR> I think this is interesting because Bitpay is a high profile company that is quite well funded with about $30 million. But they lost about $1.8 million to a targeted social engineering and identity theft scam at the start of this year</comment>


The Last of the Zoroastrians - <AUTHOR> https://www.theguardian.com/world/2020/aug/06/last-of-the-zoroastrians-parsis-mumbai-india-ancient-religion <comment><USER2> Really wanted to mention here that the Parsi's have contributed so much to the industrial development of India, there are so many of them but here are a few notable ones of the top of my head:

\- Jamsetji Tata - Founder of Tata Group (yes _the_ Tata Group)

\- Ardeshir Burjorji Sorabji Godrej - Founder of Godrej Group.

\- Homi J. Bhabha - Founder of Atomic Energy Establishment

\- Dr. Cyrus S. Poonawalla - Founded Serum Institute of India which is the largest provider of vaccines in the world.

Hope this community is well and prospers.</comment>


Why I'm not enabling Bitcode - <AUTHOR> https://medium.com/@FredericJacobs/why-i-m-not-enabling-bitcode-f35cd8fbfcc5? <comment><USER2> _an adversary could find a vulnerability in the LLVM backend to obtain remote code execution on Apple's Bitcode compilation infrastructure to inject a compiler trojan that would affect every single app on the App Store that was submitted with Bitcode_

I'm not clear on how Bitcode changes this, apart from expanding the already huge attack surface of the app store. Code execution inside app store servers is already game over for end-user privacy, isn't it?

The bit about how Bitcode makes backdoor injection harder is also very hand- wavy, since backdoor injection into fully compiled binaries is a teenaged pastime going back to the late 1980s. About the most you can say here is that Bitcode makes a trivial task trivial-er.

The concern about introducing side-channels into crypto apps seems legitimate (though: if you believe this is a real issue, and I do too, you're also saying "I will never trust Javascript cryptography"). I wouldn't want Signal submitting Bitcode.

<comment><USER3> Are you aware of any side channels introduced by compiler optimizations that weren't present in unoptimized code? Recompiling with -O0 vs -O2 doesn't seem likely to fix your pkcs padding bug. Or hmac strcmp.

<comment><USER4> Very small one, but (taken from [1]): [http://goo.gl/M8XThn](http://goo.gl/M8XThn) vs [http://goo.gl/RZZf1N](http://goo.gl/RZZf1N)

[1] [https://cryptocoding.net/index.php/Coding_rules#Compare_secr...](https://cryptocoding.net/index.php/Coding_rules#Compare_secret_strings_in_constant_time)

<comment><USER3> Interesting. Looks like it affects all version of llvm (at least those that compile).

I guess with LTO the result could be the same, but asking to always inline seems like asking the compiler to fuse operations, and then it sees shortcuts. Dunno.

<comment><USER4> `always_inline` is only there to make -O0 smaller for presentation purposes. It has no impact on -O2.

The trick here is that -march=i386 predates CMOV, and that LLVM specializes code emitting for bool (and _Bool). If the secret bit were an uint32_t, there wouldn't be a branch anymore.

<comment><USER3> Oh! I did not look closely enough to see that this was c++ with bool. Now I am even less worried. :)

<comment><USER4> Yeah, I'm not too worried either.

There is one class of cryptographic code, however, that is entirely unsuitable to distribute in Bitcode---DPA/EM-protected code. EM attacks on middle-end ARM chips have been demonstrated recently [1, 2].

Protecting against these attacks usually involves splitting the computation into 2 or more "shares" (see, for example, [3]); these require strict control of which register each word goes into, and which registers overwrite which. This cannot be enforced in Bitcode---or any other bytecode, for that matter--- and direct assembly must be used.

[1] [https://eprint.iacr.org/2015/561](https://eprint.iacr.org/2015/561)

[2] [http://cr.yp.to/talks/2014.09.25-2/slides- dan+tanja-20140925...](http://cr.yp.to/talks/2014.09.25-2/slides- dan+tanja-20140925-2-4x3.pdf)

[3] [http://keccak.noekeon.org/NoteSideChannelAttacks.pdf](http://keccak.noekeon.org/NoteSideChannelAttacks.pdf)

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I don't think there any additional security issues regarding Apple altering the binaries.

iOS devices are already running a closed source proprietary OS, which can easily set an hardware breakpoint in a binary and then do anything that could be done by modifying the binary itself without leaving traces anywhere (other than timing and cache effects).

Apple even designs and manufactures the CPU so they could even modify the CPU to detect instruction patterns and siphon off private keys without any detectable timing or cache effects at all.

Of course, that doesn't mean that it's all fine, but rather that the system is already completely broken to begin with in this respect.

<comment><USER6> Yeah, this is important.

As much as I'd like to be upset about the lack of binary verifiability throughout the chain, as the article even points out, without jailbreaking it is already impossible. We have no idea what code Apple is telling our devices to run, regardless of the form in which it is submitted to the App Store.

It's a bummer, but rms was right all along.

</comment></comment><comment><USER7> The security implications of new compiler optimizations potentially eliminating security-essential code really interest me. As do the plain old reliability implications of hitting new compiler bugs.

It's going to be really really really Fun with a capital PH when Apple enables some new optimization that contains a subtle bug, and recompiles everybody's apps, and us third parties are left holding the bag trying to figure out why our apps are crashing with no visibility whatsoever into the process.

<comment><USER8> How is this significantly different from shipping java/dalvik/whatever bytecode?

<comment><USER9> The real issue is who gets to sign the code. Formerly, you could sign the code yourself, so the cryptographic "chain of custody" between you and your users would be preserved. Now, since Apple generates the code that users see, you can't check and sign it. Apple can sign it, somebody who has compromised Apple's infrastructure can sign it, but you can't (unless you're the one who compromised their infrastructure). So, basically, this is a giant MITM just waiting to be exploited.

<comment><USER10> Apple already re-signs all apps sent through the App Store. That plus Fairplay encryption makes it unnecessarily difficult for end recipients to verify the chain of custody for the code.

I don't quite get why Xcode couldn't generate both the LLVM bitcode + the fat binary for all architectures, along with any flags. Then Apple could regenerate the same binary (to verify the two match) but use the bitcode for their program analysis tools. Then, the developer's signature could be left intact on the binary and Apple would add an additional signature over the whole thing that indicated it was approved for distribution via the App Store.

<comment><USER11> Because Apple explicitly wants to be able to regenerate binaries from the bitcode, which means that any locally-generated binary is meaningless. The claimed reason for this is to take advantage of new optimizations added to LLVM (which is a perfectly sensible thing to take advantage of), but probably the more useful reason is to take advantage of new microarchitectures that Apple introduces in new devices.

<comment><USER10> Yes, this is the real thing that should be debated -- where does the developer's responsibility end and the App Store's begin?

If I created an app, both distributed internally (say, to my corporate users) and via the App Store, but the App Store version has a bug because they're using a different ARM backend than my Xcode, that will be a real pain to debug.

</comment></comment></comment></comment></comment></comment><comment><USER12> He's right, but he's almost too right: absolutely everything he says is a problem with bitcode applies to normal app store distribution and all other centralized cloud-powered OSes and apps. Therefore I don't see this as a good argument against bitcode -- not using bitcode does not prevent anything he says from occurring since anything that can be done to bitcode can be done to machine code.

(1) Apple has the signing master keys for app store certificates. It would be easy for them to binary-patch your app with anything they want, generate their own signing certificate in your name, and re-sign the app as they push it out to users. Since app store transactions are on a per-customer basis this could be done only for some customers -- such as only residents of a certain country, people whose names are on a list, etc. It's very unlikely that anyone would notice.

(2) It would also be easy for an attacker to do this if they compromised Apple's core infrastructure as described in this article. Then they could generate signing certs in other developers' names and trojanize apps in exactly the same way. A "doomsday hack" that trojanized all Apple devices in the world within hours is not impossible. If they all started, say, DDOSing core BGP and DNS systems at the same time, such an attack could take down the entire Internet.

(3) Apple, since they control the platform and can remotely patch it at any time, needn't bother with trojanizing apps. They could simply trojanize the OS kernel or user-space OS components and accomplish anything a trojanized app accomplishes.

The same also applies, by the way, to Windows and also to Linux if you trust remote code repositories and do not compile everything yourself from verified known-safe source code. It also applies to from-source-compiled OSes and distributions _if you did not painstakingly check every line of code yourself_. Google the "underhanded C contest."

If you run code that is not yours, you are trusting someone else. It's a subset of a larger principle: civilization implies trust. Without trust you cannot have specialization of labor, commerce, or law. Without those there could be no advanced technology or infrastructure, so none of this would matter.

To use an Apple device is to trust Apple, at least insofar as that device and any data you keep on it goes. To use Ubuntu and its repositories implies the same level of trust in Canonical, etc.

The privacy problems of the digital age are not entirely technical in nature and do not have entirely technical solutions. They can only really be solved legislatively and socially.

<comment><USER13> >The same also applies, by the way, to Windows and also to Linux if you trust remote code repositories

Curiously, Google/Android has developers sign the app, and that exact signed package is what's distributed, so _at least_ the app developer can verify that the distributed app is identical to the one shipped to the store.

On the other hand, Amazon/Android signs apps with their own keys, so they suffer from the same issue as Apple.

<comment><USER14> Users don't check the signature of apps that they download, their phone does it for them.

So even if apps are signed by the developer, the app store owner can throw away the signature, modify the app and then sign it with their own key. People downloading and running the app won't see a difference.

<comment><USER13> If a developer downloads the app, they can verify it.

But more to the point, I published an app on the Play Store that actually _verified its own signatures_ (as an anti-piracy measure) and it worked correctly. Not only that, but it used the signature as a key to decrypt some of the assets, so a changed signature would mean the app would completely fail to work.

So it's a solvable problem on Android. But not at all on other ecosystems.

</comment></comment></comment></comment><comment><USER15> Something we're a little worried about (shipping middleware for games on iOS) is the potential difficulty of debugging client issues when we don't (I assume?) have native binary identical libs.

<comment><USER16> Oh shit, I never thought of this. You just make middleware, and not the game themselves? Is this integrated into SpriteKit on iOS or a standalone lib?

<comment><USER15> Just standalone libs. It will be interesting to see how much trouble it causes.

</comment></comment></comment><comment><USER17> There are intellectual property concerns. You are now giving Apple your LLVM IR along with the program symbols. What happens if you have sensitive code in your application that you don't want Apple reverse engineering and having access to?

LLVM bitcode also limits the kind of tamper resistance and obfuscation you can put into your apps. Fairplay offers almost no security if your attacker has a jailbroken device. He can simply dump the decrypted app from memory and reverse enegineer it. If you care about protecting your secrets, or preventing your app from being pirated and redistributed on Chinese app stores, you could at least apply fairly sophisticated obfuscation & integrity checks to the app binary. With LLVM bitcode that all becomes much harder, and applying integrity checks to the app becomes impossible.

Also, Apple doesn't really need the LLVM bitcode of the app to carry out app thinning. All they really need to do is extract the proper architecture from a FAT binary, and send that to the user's device, instead of the entire FAT binary.

It makes me wonder what will they even be using the LLVM bitcode for? Will it become a requirement for all apps submitted to the app store sometime in the future? If so, why?

<comment><USER2> There is nothing that the LLVM ARM backend is going to emit that Apple, or most security consultancies, can't trivially reverse engineer.

<comment><USER17> Reverse engineering machine code is not trivial if it is obfuscated, has its symbols stripped, and has its ObjectiveC metadata obfuscated/encrypted.

LLVM bitcode is much easier to reverse engineer than machine code, and you will be handing Apple all your symbols and metadata as well.

<comment><USER18> Symbols are obfuscated or removed entirely if you choose to build without them; you don't have to hand Apple your .dSYM if you don't want. I'm not sure what other metadata you're referring to.

<comment><USER17> I am referring to ObjectiveC metadata, which programs like IDA Pro can use to identify function names/parameters, which give valuable insights to reverse engineers.

With LLVM bitcode, it doesn't matter if you don't hand over your .dSYM file to Apple, all the symbol information (and more!) is available in the bitcode.

<comment><USER2> There is metadata in a fat binary (or in bitcode) that makes reversing _more convenient_ , but there is none that makes reversing _possible_ ; reversing raw ARM assembly spat out by a normal compiler backend is _always possible_.

It's 2015. Lack of source code is no longer a meaningful obstacle for attackers.

<comment><USER17> I agree, reverse engineering is always possible :) However, reverse engineering with the LLVM bitcode present is much much easier, which is a problem.

Also, if Apple requires apps to be submitted as LLVM bitcode, then certain things like integrity checks and certain useful types of obfuscation will become impossible, making apps much easier to reverse engineer, or to pirate and repackage on another app store.

<comment><USER10> I disagree that LLVM bitcode makes reverse-engineering any easier on iOS. You can do everything in bitcode that you can do in native ARM code. The limitations are already there in terms of code signing, sandboxing, and page protection and bitcode distribution doesn't change any of these OS attributes.

Are you concerned about _Apple_ reversing your code? You can still use arbitrary types (e.g. int64 instead of a pointer) and give them no additional data about the structure of your code. As you pointed out elsewhere, tools like OLLVM perform obfuscation at the bitcode level already.

I'm guessing Apple made this change to make it easier to do program analysis of iOS apps being published. You can certainly find bugs easier in bitcode that has proper type information and clear differentiation between safe and unsafe branches. One of the first steps in program analysis tools is to lift native code to an IR in order to determine its correctness.

With bitcode distribution, Apple has potentially made it easier on themselves to skip the lifting and type recovery steps _for conforming apps_ in order to look for bugs. But unless they start requiring bitcode conform to certain additional standards, you can always transform bitcode to obfuscated bitcode, destroy type information via aliasing, etc.

<comment><USER17> I concede that LLVM bitcode can be obfuscated just like machine code ( with enough effort, and LLVM bugs aside ) . However, you're still losing the ability to self-checksum your code, which in turn means you can't protect against things like piracy or unwanted modification of your binary.

I agree also that Apple probably made this change to better analyze programs being submitted to the app store. That and to recompile programs to use intrinsics more efficiently, as new intrinsics become available.

And finally, while I would not be concerned about Apple reversing my code, certain companies are and have to undertake steps to make that as difficult as possible.

<comment><USER10> Yes, self-checksumming becomes impossible [1].

If you are concerned about anyone reversing your code (Apple or otherwise), you must obfuscate it. Either you work at the ARM level or the bitcode level (watchOS for now), but the basic techniques are the same. Or, you can avoid changing tools by doing source-level transformation.

One of the companies probably impacted by this change is Arxan or other obfuscators. They have to change both front and backend to be LLVM -> LLVM.

[1] Except for the case I mentioned before, where you predict the generated code for known architectures and use that to generate your constants. This still breaks if Apple generates code for a new architecture without your help.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Does anyone know more, or have a link to more info, about the problems with dSYM and bitcode?

</comment><comment><USER20> Aside from the security - Apple made much of write once run anywhere being a terrible idea (e.g. Java, Flash and iOS/Android frameworks) yet now it is a fabulous idea that Apple just thought of

</comment><comment><USER21> Obviously you're welcome to do what you like. But it seems how these things go with Apple is: they introduce it, and it's optional, then they build on it some (still optional), then they say "using this is a _really_ good idea", then they say "a year from now you have to use this". And maybe not a year. So you're free to exercise your choice... for a while.

<comment><USER22> Any example of some other thing that went that way?

And no, the transition to 64 bit or Swift are not that.

<comment><USER21> Java-Objc bridge, requiring Xcode (people used to use Metrowerks and other tools). I don't do this for my day job so there are probably lots of others... something around ARC maybe?

<comment><USER22> OK, I though you meant some kind of evil plan, lockdown etc impossed to people by Apple progressively. That's why I said we should exclude ARC and transition to Swift. I meant in general that we shouldn't count "migration to newer technologies/frameworks" as such a thing.

If you meant, Apple imposing newer stuff to developers, then yes Apple does that.

Though, I'd say most of that is for the platform's good. Even stuff like deprecating Java -- it never got popular for OS X apps as Apple intented, the situation with SUN had changed, and keeping it going forward would be dead weight.

And Metrowerks might be good for early '00s, but not going forward with iOS, and multiple languages, and Storyboards, and all those things.

<comment><USER23> Still, the forced transition is PITA for anyone who has had a successful app on the AppStore for several years. Essentially, you are being forced making a new app every other year, just to have an app, in spite of the fact that the old one(s) work perfectly well and everyone is happy with them. In my book, that is throwing money - it's cost us half the price to keep three other competing platforms afloat.

And I find it disheartening that most developers seem so accepting of unnecessary costs to their time and health. Much like the worker class before the unions - any work conditions go. I for one am pretty tired of years of iOS-update introduced incidents and overtime work to manage new products, while juggling undue maintenance on old products. I also find it disheartening developer companies don't take a good look at costs and demand improvements, instead of accepting a steady trickle of punishment for success.

If it is for the platform's good, I wish the platform ended so we can develop for platforms that deliver better working conditions and less motivated uncertainty, fear, and doubt.</comment></comment></comment></comment></comment>


If there's a price crash in the cryptocurrency, it could hit the tech sector - <AUTHOR> https://www.wsj.com/articles/why-bitcoins-bubble-matters-1507515361?mod=e2tw <comment><USER2> The article compares bitcoin to the internet in 1994. I think that's mostly accurate, except more like 1996 or 1997.

1\. Bitcoin will crash.

2\. The crash will affect Tech which is much weaker than it seems right now.

3\. Bubbles always last longer than you think. Late 2020 sounds like when it will happen. That year is a president election. Also one the books that really Influenced Steve Bannon, "Generations", predicts something called "the crisis of 2020". Most futurists are catastrophically wrong, but that book has some very insightful things about it.</comment>


Ask HN: How to handle IP issues with full-time day job? [1] - alok-g Employee contracts for just about any big tech company includes provisions that automatically makes all types of IP (including inventions and copyrights) developed by the employee belong to the company. This applies even if the work is done completely on the sides and outside work hours.
California specifically has laws that allow employees to claim "inventions" of their own but still under terms that are more favorable to the employer [2]. There's no help for "copyrightable" works [3], which would include software, or even in principle a written plan for developing this software [4].
I certainly have this issue currently preventing me from doing any work to bootstrap while I am still employed. Most people I spoke to at SUS2010 who are working on "side projects" are completely unaware of the issue. Some are ignoring it thinking that it must somehow work out.  Yet, I noted that YC submission form has a question about this.
On the other hand, almost every successful founder I spoke to, either did not have this issue (founded right after school, etc.), or did not do any work before quitting (which they did either before or after securing funding).
Some more details on the subject can be found in this excellent book:  http://www.amazon.com/Intellectual-Property-Open-Source-Protecting/dp/0596517963/
Here are some questions then:
How many people here have or had these issues?
How do/did you deal with this?
Is leaving the day job the only way out?  Or possibly joining another job where you can avoid this issue, as kneath suggested [1]?  Consulting jobs?
[1] Note:  I had posted the same question as a comment to "Ask Tom Preston-Werner" on HN recently (http://news.ycombinator.com/item?id=1804443 and http://news.ycombinator.com/item?id=1805871).  Am now opening to a wider set of readers and responses.
[2] See section 2870(a)(1), and 2872 (burden of proof) here: http://www.leginfo.ca.gov/cgi-bin/displaycode?section=lab&group=02001-03000&file=2870-2872
[3] See:  http://en.wikipedia.org/wiki/Work_for_hire  ("Within the scope of employment" here means not just work you do for the employer, but also anything you do that relates to the "field" of your work)
[4] In fact, even non-copyrightable and non-patentable works (whatever these mean) are included under this by my employment contract.
Reason for edit:  Footnotes used asterisk before instead of [Number], where were misinterpreted by the system. <comment><AUTHOR> "On the other hand, almost every successful founder I spoke to, either did not have this issue (founded right after school, etc.), or did not do any work before quitting (which they did either before or after securing funding)."

That's the "Burn the Ships" idea, but there are plenty of start-ups that were side projects.

I don't think big companies care about your start-up idea at all so don't worry about it too much as long as it's not in direct competition with your employer.

</comment><comment><USER2> Disclaimer - This is a second hand advice. There is a big chance of it being really bad.

From what I have heard from veterans in the industries, the gist comes down to this

 _"If your project does not make enough money, no one would care. If your project is a break through, you would be able to afford legal assistantship to keep the vultures away. (see Facebook)"_

Again, I am not sure if this is how it works in real.

</comment><comment> alok-g Is this question still visible on HN? I cannot see it without going through the list of my own submissions.</comment>


3 mutations that created the Ice Bucket Virus - <AUTHOR> http://blog.99.co/?p=433

<comment><USER2> Interesting post, especially the mention of his father at the end. Sweet touch.

His virality equation piqued my interest, anyone know of sources I should check out in understanding it further?

<comment><USER3> It's an interesting expansion on the concept of the "k factor," a growth- hacking term borrowed from epidemiology.

k = i x c, where i = invites per customer; c = conversion percentage on invites. It is sometimes referred to as the "viral(ity) coefficient." Essentially, k is the growth rate per customer. It is a sort of expected value of new users to be gleaned from each existing user.

The equation in this blog post is slightly more sophisticated. It takes cycle times (the viral "incubation period") into account.

<comment><AUTHOR> Thanks - credit goes to David Skok's original post on virality - forentrepreneurs.com/the-science-behind-viral-marketing/</comment></comment></comment>


Ask HN: Why doesn't Facebook let you filter friends by current city/state? - <AUTHOR> I'm sure it has something to do with money but I can't figure. <comment><USER2> It does, just search "Friends who live in New York" or "Friends who have been to Berlin". I've noticed they disable/enable the feature every few months/years, but overall it still works. It has never worked for me on mobile, though.

I just searched and it returned a list titled "My friends who live in Berlin, Germany (see more)"

</comment><comment><USER3> This is a peculiarly common missing feature of online social networks, including several I've been closely associated with..

My suspicion is that it would tend to reveal the thinness of actual coverage. That outside a few hubs (mostly major costal cities), the social graph is quite sparse.

It might also enable advertisers to bypass paid advertising targeting, or (especially for ad-free networks) attract spam. On Mastodon, sex-worker- friendly nodes spam the hell out of locality-based hashtags to the point that default instance blocking is required, and sex work seems particularly prone to this. Location is secondary only to intent. Excessive legibility can be a vulnerability.

The principle alternatives seem to be local or personal groups, though those are weak substitutes.

</comment><comment><USER4> This function would be one of the last remaining things I'd use on FB (the others being marketplaces & messenger - I disabled the news feed a while back and don't use FB on mobile).

Unfathomable to me. I'd really like to see who of my friends are in a given city so when I go visit said city I can reach out and say hi. Don't really understand it either

</comment><comment><USER5> Privacy is clearly not the issue as that is the antithesis of their business model.

Maybe it has to do with the fear of creating theoretical travel stalkers???

But logically there is no reason not to do it.

Facebook had this available in their early days by city etc...

just like they even showed your friends and their tally by school even.

They removed both filters over 9 years ago.

</comment><comment><USER6> they had what they called "graph search" and i guess it just showed too much of how creepy Facebooks dataset is.

You could e.g. search for female friends of friends that are single and living in X

Here you can see a bit of the UI, but it worked with natural language in the search bar, too: [https://www.facebook.com/notes/facebook-journalists/how- jour...](https://www.facebook.com/notes/facebook-journalists/how-journalists- can-use-facebook-graph-search-for-reporting/543504605661558)</comment>


Nassim Taleb: The UK's coronavirus policy is not scientific - <AUTHOR> https://www.theguardian.com/commentisfree/2020/mar/25/uk-coronavirus-policy-scientific-dominic-cummings <comment><USER2> Takes down, succinctly, both the herd immunity nonsense and the fallacious, economic, let them die position.</comment>


Programmer's Dress Code - Part2 - <AUTHOR> http://www.codethinked.com/post/2007/12/The-Programmer-Dress-Code---Part-Deux.aspx

<comment><USER2> how many folks here have beards, or aspire to have beards? i have one.

<comment><USER3> It really satisfies me to disappear from the public for a week, hacking away at home, and emerge with a new facial hair :-P over the last year I had elvis side-burns, a Saudi goatee, full bear, thin immaculately maintained pimp beard, and today I have a handle-bar porno mustache :-D</comment></comment>


Mercedes-Benz Energy Storage - <AUTHOR> https://www.mercedes-benz.com/en/mercedes-benz-energy/mercedes-benz-your-own-energy-revolution/ <comment><USER2> This is a 115-year-old company, with one of the most valuable brands in the world, a long history of technological innovation, and legendary German engineering, chasing a 15-year-old upstart with less than a tenth of the sales volume.

Even if you think Tesla is over-hyped and over-valued, you've got to hand it to them for really shaping the narrative of automotive innovation.

As for this particular device, it appears to top out at 20kWh. That's pretty small; a gasoline-replacement electric car has a much larger battery. (Tesla sells them up to 100kWh) Then again, 20kWh is enough to cover most days' driving...

<comment><USER3> Legendary German engineering is a myth especially in this day and age . Sure they have an edge on few things as they were the first / had the most experience and the budget to improve on but just look at how they are loosing against the fierce competition from the US and Asia. I am not saying they are bad I am saying they are not that good as people think. They milk the brand but fail to deliver exceptional products.

<comment><USER4> When you buy from a brand with a reputation to lose, you are not buying a guarantee to an exceptional product, you are buying a guarantee to a product that is not exceptionally bad.

When you buy an appliance from an unknown Chinese manufacturer, you _can_ get a solid product, but if you're not careful, you end up with a cheap knock-off that will break in a month. They can get away with it because nobody ever hears of them, nobody knows not to buy from them.

When you buy an appliance from a well-known German manufacturer, you _can_ get a white-labeled product from a Chinese supplier, but most likely it will still be a piece of solid engineering. Otherwise, any incident will be in the news for weeks, and exactly those customers who bought the brand for name- recognition now avoid it for the same reasons.

I suspect that this will change as wages in China rise to a level where build quality no longer dominates the manufacturing cost and some Chinese brands will probably emerge to be seen as high-value internationally.

<comment><USER3> Yeah sure i can agree with that. What I was saying is that there is not any reason for me to buy a product from a german brand unless they are really less expensive, giving me a better deal (more features / warranty).

The only problem with Chinese products is the availability and their IP stealing not really the quality.

</comment></comment></comment></comment><comment><USER5> The brochure mentions that the batteries are built by ACCUMOTIVE GmbH, a subsidiary company of Mercedes Benz.

Apparently, it was founded in 2009, and they only recently began construction of their second plant dedicated to battery production [1].

From their presentation their website, it also looks as if they are vertically fully integrated -- from R&D, to production. That would one-up Tesla (Tesla owns the Gigafactory, but it is operated by Panasonic, using Panasonic technology).

[1] [https://www.accumotive.de/de/aktuelles/daimler-legt- grundste...](https://www.accumotive.de/de/aktuelles/daimler-legt-grundstein- fuer-eine-der-groessten-und-modernsten-batteriefabriken-der-welt/)

<comment><USER6> The cynic in my thinks that they are releasing a battery pack because they are not producing as many electric cars as they thought they would and are trying to get rid of a surplus in capacity.

</comment></comment><comment><USER7> I just want any battery system to be installed for 7kWh for under $5000 in Australia.

I had hoped when the Powerwall 2 came out that you would be able to pick up the first version for that but alas.

I really do think that the above 7kWh for $5k installed is the sweet spot. At that point its a no brainer purchase for anyone with over 3kw of solar panels.

For me, with the stupidly high electricity prices in Australia (some of the highest in the world) at that point it would save me money in 3-5 years, and I am not the only one thinking like this. Among my friends and colleagues every single one has said at that price point they will pull the trigger and buy one. Even better if they are modular and can be upgraded again at a later date with additional storage.

</comment><comment> King-Aaron Clever of Mercedes to get on board with battery technology.

I don't know if I'd have it mounted on my living room wall like they have in the pictures though.

<comment><USER8> Don't be silly, that's just the garage entrée.

From 2018 all US Smarts are electric only.

Very excited about the coming years.

<comment> King-Aaron Smart Cars are disgusting to drive though, I wouldn't be too excited :P

(*I will edit that though, and say that I am pretty eager to see how the technology is going to evolve as more governments mandate a faster roll-out of consumer electric vehicles. Exciting times indeed.)

<comment><USER9> "Smart" cars are made for congested, with very little space to park European cities...

<comment><USER10> Did you try to park in San Francisco? Besides you can park smart perpendicular to the curb and it still fits!

</comment></comment></comment></comment></comment><comment><USER11> So doesn't MB own part of Tesla? (Edit: yes) I wonder what the overlap is here.

And I wonder if the Spanish Gov would ever let this in...

[1] [https://en.wikipedia.org/wiki/Tesla,_Inc.#History](https://en.wikipedia.org/wiki/Tesla,_Inc.#History) "On May 19, 2009, Germany's Daimler AG, maker of Mercedes-Benz, acquired an equity stake of less than 10% of Tesla for a reported US$50 million,"

<comment><USER12> They sold the stake.

Toyota sold too.

<comment><USER11> Thanks, I didn't know that!

</comment></comment></comment><comment><USER13> The max power supply capability is 4.6 kW. To consume 18 kWh of energy, it will take about 4 hours.

So I guess the use is more or less for car battery charging, and backup power for homes.

However, I wish there was a pure DC lighting and Fan systems in homes, so that inverter costs can be reduced.

<comment><USER14> OTOH it's pretty rare that I have a load of 4.6kW in my flat at any given time. Event 1kW seems a lot as a constant load - that would require me to run the hoover, washing maschine or the stove at full power and I rarely do that for hours on end. I haven't run the numbers, but I would guesstimate that 18kWh of electric energy get me a days worth or even longer.

<comment><USER13> Usually it should. In India, it will definitely last a day, if not more.

In western countrues, heating or cooling loads should itself be a substantial amount.

</comment></comment></comment><comment><USER15> Even if this was less expensive, could store more energy I would still purchase the home battery from Tesla if I had to make the descision.

It's so obvious that this would probably never happen without Elon and Tesla leading the way. So sad to see so many large companies with so much potential just being copycats.

<comment><USER16> It's not sad at all. It's exciting! The fact that the big companies are copying Tesla will only speed up adoption. It's further validation that Tesla is on the right path.

<comment><USER15> Yes of course, but they are simply trying to take the market from Tesla with a product that is essentially the same as theirs.

I understand that this is always going to happen but it's a bit disheartening since Mercedes is such a big company that could do some very cool stuff themselves. It seems that many big corporations just becomes copycats after a while doing what everyone else is doing.

</comment></comment></comment><comment><USER17> automobile manufacturers are basically a herd, one of the leaders Mercedes Benz now is following Tesla, expect others to follow soon.

atleast for next 2 decades there is no such thing as excess battery capacity. this will help improve electric cars and solar adoption across the globe.

</comment><comment><USER18> Is this thing only for cars, or can you use it as a general battery for other things in the house?

</comment><comment><USER19> It looks like a rubbish bin.

<comment><USER20> I agree and why does the stock image show it on the interior of the home next to the dinner table? Wouldn't you install this in your garage or a closet somewhere, not as a dining room accent?

<comment><USER21> Maybe they want to emphasize the safety and the design of the battery? To me, the ad says "this device is so safe and beautiful you don't want to hide it in your garage"

But most of all, the photo tells us about the target audience: This is not a product for tinkerers to replace the lead acid batteries of their home made photovoltaic systems; this is a product for the upper middle class to showcase how modern/sustainable/whatever their home is.

<comment><USER13> Or the inherent thinking of marketing departments in companies like MB, where every product is meant for upper-middle class and higher target audience.

</comment></comment></comment></comment><comment><USER22> Elon-envy.

</comment><comment><USER23> the color of the site is weird. I tried to increase screen brightness :D

</comment><comment><USER24> Looks like a trash bin, haha.

</comment><comment><USER25> This is the ultimate in conspicuous consumption and virtue signalling. DIY powerwall makers make similar units using free cells because the ROI takes so long for anything other than free cells. You can be certain that the MB badge is going to cost you a lot on top of whatever the internals of the system cost.</comment>


Launching Rainbow Payments Technology in Beta - <AUTHOR> http://amonnyesigye.blogspot.com/2017/04/launching-rainbow-payments-technology.html <comment><USER2> Everything about this, from the blogspot-hosted press release to the description of the underlying technology, looks sketchy as hell:

> Rainbow payments are served over 'https', this protects users data as its > streamed over the network and avoid any interference. User pages may use > 'http' over time , but this does not in any way make the connection insure, > due to a strong cloud security.</comment>


Ask HN: Livestreaming Research and Projects - <AUTHOR> Hey HN,
I'm a graduate student working on some interesting ML work, and I was thinking about livestreaming my research and some of the interesting projects I build.
Some projects I'm working on include bioinspired ML algorithms and a biological compiler. Do you think this is the kind of thing folks would find interesting? Are there any people who've done this in the past? <comment><USER2> Between nothing and live streaming, there's youtube videos. My intuition is that eight minute stories are probably more watchable than two hours of raw footage. Good luck.</comment>


Hotel-room hacks: Picking the lock - <AUTHOR> http://www.economist.com/blogs/gulliver/2012/08/hotel-room-hacks <comment><USER2> > The hacker did not explain the flaw to the company in advance of revealing > it to the public, a decision he told Forbes was because he saw "no path to > mitigate this from Onity's side." To fix the problem, the locks' entire > circuitboard has to be replaced—and on millions of locks, that's a process > that could take a long time.

That seems like rather an asshole move on his part. I understand the argument for disclosing security flaws to force a reluctant vendor to deal with them, but in this case he didn't even give them a chance.

<comment><USER3> I've covered this a number of times. Simply put, I felt that the best route for hotel owners and customers (who I care about, unlike J. Random Vendor) was to make them aware of the vulnerability and make them aware that they've had a horribly insecure product on their doors for nearly 20 years. Given how ridiculously simple the vulnerabilities are, I'd put money on many others having discovered them in the past, almost definitely using them for malicious purposes. In addition, there's absolutely no way that Onity did not know about this themselves -- it would not have required digging, but been _immediately_ obvious from the design of the system.

The route I took may not have been pretty, but it will get the issue fixed in a timely fashion, I believe, and hopefully alert people to the fact that we need real security processes in place around such things; not having your equipment audited in the case of a security product is simply not acceptable. Not now, and not in 1993.

<comment><USER4> Just out of curiosity, how much more secure would a lock be if the hotel asked the patron to have a smartphone app instaled and to enter a personal PIN upon checkin.

When you get to your room, swipe your NFC enabled phone over the lock, then it asks for your pin (on the phone) to unlock the door.

The activity would need to allow you to swipe the NFC over the lock, which will auto-launch the app and prompt for pin to be a smooth user experience.

If you have to find the app and launch it and maybe make another click, to get to the PIN prompt, it would be too cumbersome to users to be a good experience.

<comment><USER3> It really depends on the implementation. There are a lot of ways this can all be done securely (from magstripes -- ignoring the ease of copying -- to chip cards or NFC with smartphones or ...), but at the end of the day, it comes down to the implementation. With some slightly different choices, Onity's system could've been rock solid, but they dropped the ball.

<comment><USER4> can you expand on what would have made it rock solid?

<comment><USER3> Well, from what I know of its failures:

\- Use an industry-standard (for the time) crypto algorithm for cards, and use the biggest key size possible. As it stands, they use a (horrible) proprietary algorithm and 32-bit keys.

\- Make the lock know which door it's actually for and encode a list of acceptable lists along with the code key values on the card. This prevents a card from one door from opening another door. Not a huge security issue, but it happens more often than you'd think.

\- Use secure, authenticated protocols for programming the lock. This is really the critical part; unauthenticated, raw memory reads/writes are just not OK.

<comment><USER5> You were planning to do a Reddit AMA on reversing in General.

Did that ever happen? Have you written anything on that?

<comment><USER3> I did indeed -- [http://www.reddit.com/r/IAmA/comments/yeiac/iama_reverse_eng...](http://www.reddit.com/r/IAmA/comments/yeiac/iama_reverse_engineer_who_broke_millions_of_hotel/)

It went better than I could've ever imagined; it was topping the front page for a while! Seriously awesome experience.

<comment><USER6> And I thought it went very well--it answered all the questions that I was going to ask you via email.

Thanks for doing it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I once worked with Cody (daeken) when he was reverse engineering the Emotiv EPOC headset, he's definitely top notch. It turns out he does other things: <http://demoseen.com/portfolio/>

</comment><comment><USER8> Are hotel room locks really that big a target? If you're in the room, set the deadbolt. When you leave, take your valuables.

The easiest way into a hotel room is social engineering via the housekeeping staff.

<comment><USER3> The deadbolt doesn't do anything with this, for what it's worth. The deadbolt on Onity locks is software-controlled; that is, there's a privacy switch that's triggered when you throw the deadbolt, and it checks the value of that when you put in a card. If you use a card with the 'privacy override' flag, or you use the Portable Programmer (or my opening device), the lock opens regardless of whether or not you use the deadbolt, as it's disengaged by the lock mechanism when you turn the handle.

<comment><USER9> I think he is referring to a manually operated dead bolt or those latches at the top of the door. The locks that can only be set and unset from inside of the room.

<comment><USER3> Latches will work, but 99.9% of doors with Onity locks will only have the deadbolt inside the Onity lock, which is vulnerable to the problem I detailed above. Just something to keep in mind.

<comment><USER10> No no you're missing the point I think. Nearly every hotel room has a big old manual separate bolt set up higher and away from key based locking system. Slides open maybe 2 inches etc. Twice in my life the hotel person has given my room to someone else by mistake (I travel a lot for work). That is, I'll be in there, twice late at night, and someone else puts in a key and it works. After the first time I always set that manual bolt no matter what - just in case. Not that I think there's any real merit to the original point that kicked off this particular thread.

<comment><USER11> I think you're missing the point - Onity locks don't usually have this "big old manual separate bolt" as they're sold as "deadbolt inclusive".

<comment><USER10> It's pretty rare to not see them (can't remember when i haven't) due to the reason I list.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Real engineered solution - without new hardware: If this thing is not reprogrammable, and only has an EPROM - do some real enginerering and calculate the ADDITION of bits to set to disable the exploit. Thats the one I would be working on if I worked for Onity.

alternativly, take a mechanical approach to the problem - if you can live without the connector for servicing the lock.

1) De-solder the connector on the board and cut the traces/pads off the board - it won't stop everyone, but enough that have read of the exploit and try to follow through on it without applying any more critical thinking will be thwarted.

2) epoxy over the connector (they kind of did this with the security screw fix, but not really)

3) leave the connector, but add so much resistance between the connector and uP that you have to use a special interface cable to talk to the uP. no one will be able to tell until they pull the lock apart that its not stock.

<comment><USER13> Hotels can't even get their internet right. Shit is outsourced to some service company who can't fix on-site problems with their routers, and you just get a shrug of the shoulders from hotel maintenance personnel. How in the unholy fuck do you think a Ramada Inn is going to roll out hundreds of modded door locks?

<comment><USER14> They don't mod the locks, they call up Onity and say "send us 600 new locks that are not flawed." Onity replies "Sorry, no." Then they fight in court for the next 10 years over whether Onity owes the hotel replacement locks.

Assuming the hotel wins, Onity sends a team in to replace the locks (a relatively simple and already solved problem - that is how the original locks were installed). Then Onity sends the hotel the bill for the replacement service and the hotel says "Sorry, no." Then everybody fights in court over the retrofit bill for another 10 years.

</comment></comment></comment><comment><USER15> Previous discussion here: <http://news.ycombinator.com/item?id=4281722>

</comment><comment><USER16> What can people do about it? barricade their hotel door? No, this is much more of help to people looking to get to other people and now they just got an extra option. This really opened a market.

If you really care about hotel customers you would be on the company side that made all these locks, because they really need help. Yes they screwed up, they deserve punishment but do the customers have to be the victim?

</comment><comment><USER17> Nothing is secure. I don't see how the electronic lock is any less secure than the glass used on most house windows. It's like saying glass manufacturers aren't making glass secure enough to protect home owners from intruders when someone can throw a piece of brick and smash it.

<comment><USER18> Crappy comparison. Glass is installed for aesthetics, not security. Locks are installed specifically to keep people out. Windows are a known and accepted security hole that often have additional security measures attached to them.

<comment><USER17> How about glass in general? Glass in police vehicles, glass in a police station, court house... Glass isn't a purely aesthetic material, it has many uses.

</comment></comment></comment><comment><USER19> >"I would like to point out that the '$30 microprocessor' in 2012 would have needed a refrigerator size computer 20 years ago when the Onity system was designed. Twenty years from now all of our current 'state of the art' security will be hackable with nothing more powerful than a 2032 edition pocket calculator."

Just read this comment on the site - perhaps a bit exaggerated, but I think a valid point nonetheless. Of course, Onity should have done something about the flaw.

<comment><USER3> Hah, I didn't see that comment on the story. It's funny, but it's completely untrue. The chip may have cost you $5 (rather than the $0.05 it costs now), but a PIC from 1993 -- when Onity released the HT locks, and they actually used for the locks themselves -- would've opened them just as well as a modern PIC/AVR/Propeller.

If someone didn't know about and exploit this flaw in 1998 (5 years later), I'd be downright flabbergasted. It's just way, way, way too simple.

</comment></comment><comment><USER20> the code and paper: <https://github.com/daeken/LockResearch>

<comment><USER3> Mind changing it over to <http://daeken.com/blackhat-paper> please? I keep failing to keep the git repo up to date (been way too busy).</comment></comment>


Adding a new statement to Python - <AUTHOR> http://eli.thegreenplace.net/2010/06/30/python-internals-adding-a-new-statement-to-python/

<comment><USER2> I would have liked to see how easy it is to add a new statement to pypy for comparison's sake.

<comment><USER3> It's going to have all these same steps, but they'll mostly be in python. I'll try to write a tutorial on this at some point.

</comment></comment><comment><USER4> Very useful post I think. Not to depreciate Python the language, but it might be interesting to compare "adding a new statement to Python" with "adding a new statement to Lisp". Especially for people struggling to grasp Lisp's benefits.

<comment><USER5> Here, adding a 'unless' statement:

        (defmacro unless [expr & body] `(if ~expr nil (do ~@body)))

Taken from: [http://stackoverflow.com/questions/2977882/defining- clojure-...](http://stackoverflow.com/questions/2977882/defining-clojure- macro-syntax)

Macro in Lisp are essentially functions taking code as argument and returning code, but they are executed at compile-time.

Edit: replaced with the correct version, sorry for the error.

<comment><USER6> According to that question's answer and comments, that definition is buggy (making it not quite a fair comparison). Here is a less buggy, more flexible version, taken from a comment:

      (defmacro unless [expr & body] `(if ~expr nil (do ~@body)))

</comment></comment></comment><comment><AUTHOR> I was reminded of this by the post on the goto statement -- having used the AST module recently in a limited capacity[1], I was really impressed by how easy it was to use. There's a good pycon talk for those interested specifically in this part of the process[2], and you can also see the full grammar[3].

[1] [http://blueprintforge.com/blog/2012/02/27/static- modificatio...](http://blueprintforge.com/blog/2012/02/27/static-modification- of-python-with-python-the-ast-module/)

[2] [http://blip.tv/pycon-us- videos-2009-2010-2011/pycon-2011-wha...](http://blip.tv/pycon-us- videos-2009-2010-2011/pycon-2011-what-would-you-do-with-an-ast-4898264)

[3] <http://docs.python.org/library/ast.html#abstract-grammar>

</comment><comment><USER7> Here's my original paper on the topic in case folks are interested:

[http://tomlee.co/wp-content/uploads/2008/12/python- language-...](http://tomlee.co/wp-content/uploads/2008/12/python-language- internals.pdf)

</comment><comment><USER8> How well do you know the Sutras?

Special cases aren't special enough to break the rules. ... There should be one-- and preferably only one --obvious way to do it.

<comment><USER9> Did you even try to read the linked article :) ?

Here's the second section:

A language-advocacy digression

\</comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>

This article doesn't attempt to suggest the addition of an until statement to Python. Although I think such a statement would make some code clearer, and this article displays how easy it is to add, I completely respect Python's philosophy of minimalism. All I'm trying to do here, really, is gain some insight into the inner workings of Python.

<comment><USER8> point taken</comment></comment>


Walking man in CSS - <AUTHOR> http://andrew-hoyer.com/experiments/walking/

<comment><USER2> Very nice! But it consumes mucho CPU...

</comment><comment><USER3> That is very creative</comment>


One Family, Many Revolutions - <AUTHOR> https://www.nytimes.com/2017/07/22/technology/one-family-many-revolutions-from-black-panthers-to-silicon-valley-to-trump.html <comment><USER2> Is there a non-paywall version, I've actually turned off adblock a long time ago so that I could help pay the people I follow but NYTimes doesnt seem to allow that. Just a big fan of Ben Horowitz, having read his book and what to know a bit more.

<comment><USER3> archive.is your friend

[http://archive.is/TjNTF](http://archive.is/TjNTF)</comment></comment>


Underwater Photography and Ocean Exploration - <AUTHOR> http://coldwater.science <comment><USER2> These are fantastic pictures. Wow.</comment>


Ford's police SUVs will heat up to 133 degrees to burn the germs away - <AUTHOR> https://www.cnn.com/2020/05/27/business/ford-police-suv-disinfecting/index.html <comment><USER2> The article states that funding was insufficient to detect people or animals in the vehicle. There is no safety kill switch in the back. People will die in these.</comment>


Cory Doctorow: Techno-optimism - <AUTHOR> http://www.locusmag.com/Perspectives/2011/05/cory-doctorow-techno-optimism/

<comment><USER2> What I find strange about the article is how it seems to talk mainly about webapps (do not count on Facebook respecting your privacy) but takes Ubuntu as an example. I think it is perfectly fine to use MS Office installed on Mac OSX to write secret letters. Just maybe encrypt the files before sending them via email. I don't quite see the point of using Ubuntu and LibreOffice instead from a security standpoint.

That said, it makes sense that the encryption software should _not_ be proprietary and closed source.</comment>


Privacy first. The list of solutions for paranoid people. - <AUTHOR> http://www.evernote.com/shard/s4/sh/b5185666-d7c7-4a61-828d-0443c5dd93ac/a4dc6c46c60ba3a7e891d6cfb9fb7587

<comment><USER2> Is mega taken seriously? I thought there was a security hole found not long after they launched.

How about Tarsnap for online backups... [http://www.tarsnap.com](http://www.tarsnap.com)

<comment><USER3> Tarsnap is a backup service, not a file synchronization service.

</comment></comment><comment><USER4> This almost reads as a joke - if this person is paranoid, why is their list hosted on a "cloud" service?</comment>