What3Words submitting takedown requests against Tweets [pdf] - <AUTHOR> https://www.owenboswarva.com/misc/W3W_Twitter_20191007.pdf <comment><USER3> I can understand why someone would want to run WhatFreeWords if What3Words is already a standard: it's dumb to pay for 238-lines-of-Python-as-a-service. The added latency alone is ridiculous.

My question is, why would anyone commit to What3Words as a standard? There are much simpler ways to map geographic data to three-word combinations.

One obvious way, dividing things up into rough "squares" of approximately even size, has the added benefit that shared or alphabetically proximal words would indicate geographical proximity: with What3Words, wounds.client.face is feet away from to jumped.storm.nest, but hundreds of miles from wounds.client.fact.

If you don't think that's useful, then perhaps it's useful to use one of the other word lists which are on many computers, to share space, such as the PGP Word List[1] or the word list from RFC 1760[2]. One of the touted benefits of What3Words is that it is algorithmic and therefore doesn't require a large mapping file, so it's appropriate for systems where storage comes at a premium. Yet they used a more complicated algorithm and didn't reuse an existing word list?

It seems like their algorithm design was basically driven to try to make it hard to reverse engineer, and it didn't even achieve that. The only reason I can see why this became anything resembling a standard is that some people _really want_ to pay for services.

[1] [https://en.wikipedia.org/wiki/PGP_word_list](https://en.wikipedia.org/wiki/PGP_word_list)

[2] [https://tools.ietf.org/html/rfc1760](https://tools.ietf.org/html/rfc1760)

<comment><USER4> W3W is a nasty rent-seeking operation. They have invented a flawed solution looking for a problem and are using lots and lots of dubious PR to try and get it mainstream so they can then start charging for the use of their stupid algorithm.

Their PR attempts are absolutely pathetic but sadly seem to work on the masses. Their most frequent angle is someone contacting emergency services but somehow can't figure out his location, and W3W comes along and magically saves the day. The problem is that if I need a phone app & GPS signal to figure out my W3W, why can't I just use the GPS coordinates directly?

<comment><USER3> While I agree that W3W is a nasty rent-seeking operation, I do think that in broad strokes the location-as-words concept could be useful.

> The problem is that if I need a phone app & GPS signal to figure out my W3W, > why can't I just use the GPS coordinates directly?

Think about verbal/handwritten transmission and mental/handwritten storage. It's not easy to transcribe "41.022755, -73.913102" or remember it. "medium.axed.hobby" is much easier. Copy/paste doesn't always work well on phones, and doesn't work at all across devices.

<comment><USER4> There are other open standards such as Plus Codes, but I actually disagree that (what it looks like to me) a hash-based system (which is more or less what W3W is) is better than a numeric system like GPS coordinates.

41, -73 (removed all decimals from your example location) still gives me the general location that it's somewhere in New York. My understanding is that removing a word from W3W completely invalidates it as it's like a hash.

Incomplete GPS coordinates can be augmented by other information. W3W doesn't look like it can, if your phone cuts out before you said the last word of your W3W to the emergency dispatcher you're screwed. If your phone cuts out before you said the last few decimals of the GPS coordinates the dispatcher still has a chance of finding you.

<comment><USER5> The purpose of W3W not having nearby locations have similar words is because of transmission errors. They're pushing it in the UK at the moment having got several emergency services on board, and in that context if you say to, say, Norfolk Police call handlers that you're at bamboo cheese elephant and that shows up as somewhere in the middle of the Pacific they know they got a transmission error pretty much instantly and can ask for clarification. Although it'd be nice maybe to have soundalike tools in the search so it can say "hang on maybe they meant this place".

Two conflicting needs really - as it stands, W3W is incredibly good for simple transmission by voice, but it's awful for giving you clues to geographic proximity.

<comment><USER3> I wrote a short Python script which cross-references the W3W word list with a homophones list[1], and found this:

        census,senses
        choral,coral
        clairvoyance,clairvoyants
        collard,collared
        confectionary,confectionery
        disburse,disperse
        epic,epoch
        equivalence,equivalents
        hurdle,hurtle
        incidence,incidents
        incite,insight
        incompetence,incompetents
        independence,independents
        innocence,innocents
        instance,instants
        intense,intents
        lightening,lightning
        ordinance,ordnance
        overdo,overdue
        parse,pass
        pokey,poky
        precedence,precedents,presidents
        purest,purist
        recede,reseed
        sari,sorry
        senses,census
        variance,variants
        verses,versus

Those aren't sound-alikes, they're straight-up homophones. If we cross- referenced against a list which contained sound-alikes, I'm sure we'd end up with a much larger list of collisions.

EDIT: This is the script:

        with open('word_data.txt') as f:
            words = set(l.strip() for l in f.readlines())

        with open('homophones.txt') as f:
            for l in f.readlines():
                l = l.strip()
                homophone_group = (h.strip('*') for h in l.split())
                filtered_homophone_group = tuple(h for h in homophone_group if h in words)
                if len(filtered_homophone_group) > 1:
                    print(','.join(filtered_homophone_group))

The `strip('*')` bit is needed because my copy/paste into homophones.txt pulled in some asterices(sp?) and I didn't want to go through and fix them manually.

[1] [http://homophonelist.com/homophones- list/](http://homophonelist.com/homophones-list/)

</comment></comment></comment></comment></comment></comment><comment><USER6> If you're issuing takedown notices and threatening litigation over IP that can be completely contained in a 2MB JavaScript file, you've got serious problems as a company. They're obviously a one-trick-pony that's on their last legs... This is the only thing we'll hear about them until a small notice somewhere in a year or so that they've gone bankrupt.

</comment><comment><USER7> Here is the context: [https://twitter.com/owenboswarva/status/1173127802717114368](https://twitter.com/owenboswarva/status/1173127802717114368)

TL;DR: A UK based startup "invented" a way to represent a lat/lng with three words. They patented it. Someone created whatfreewords.org, a clean room reimplementation and open sourced it. W3W's lawyers appears to be going to great lengths to ensure nobody finds out that it exists.

<comment><USER8> I see the whatfreewords web api is down, I was wondering if their re- implementation actually manages to map the same words to coordinates - <USER2> assume not, which seems... problematic. Then w3w one.nice.spot would be in one place on the globe, but the same three words would map to a different place with whatfreewords. I could imagine some users being confused.

<comment><USER9> It maps to the same spots, otherwise it would be pointless.

You can use the live demo (using the JS library) at [https://whatfreewords.org/demo/](https://whatfreewords.org/demo/)

The API is down because our new generously-provided hosting does not support executing arbitrary code on the server. Without this provider the site would have been taken down again already, so we are grateful for what we've got.

<comment><USER8> That makes sense, I see that the two implementations do agree on coordinates for the same words, which is very slick. I am trying to imagine how reverse- engineering would make that possible? I suppose it means that W3W used some known word list, and in patterns that could be pulled out of their results?

</comment></comment></comment></comment><comment><USER10> I got one of these takedown notices. It's totally inappropriate, but I'm not going to waste time fighting it. The maddening thing is I didn't even link to the code; I linked to their FAQ, the document that explains why their clean room implementation is non-infringing. [https://whatfreewords.org/faq.html](https://whatfreewords.org/faq.html)

They're abusing the DMCA to shut down discussion.

</comment><comment><USER11> Thanks, I did not know about this alternative to W3W.

It's nice when people produce free ads for a competing service, though doing it using DMCA takedowns is a bit weird. Be sure not to delete directions of people using your concept on Twitter, it would make it a bit dangerous to use!

<comment><USER12> I'm amazed that in what, nearly twenty years (maybe more), people are still learning about the Streisand Effect first-hand.

</comment></comment><comment><USER13> What3Words is free to use for individuals. People complaining of "rent- seeking" must believe that every SAAS should be free. Even if you think that the amount of code and effort involved was less than Google search or Bitcoin, why shouldn't they derive revenue from their good and useful idea?

</comment><comment><USER14> To any HN moderator, could you share the reason why whatfreewords' comment in this thread is [dead]?

<comment><USER9> Probably just because we're connecting over Tor.

</comment></comment><comment><USER15> Jeez, What3Words is such a scummy company.

<comment><USER16> I'm really sorry to hear that, though it was kind of obvious given the way they were trying to monetize it.

If they had open-sourced it and tried to make some money off of being associated with it, the idea could perhaps have taken off. It's a reasonably clever and catchy idea, but not nearly valuable enough to make real money off of. It's exactly the kind of thing Google throws out for free to see if it catches on.

<comment><USER17> I'm not sure if you're referring to it, but Google actually DID throw out something very similar for free: Plus Codes ([https://plus.codes/](https://plus.codes/))

There are still problems with the idea of large tech companies deciding on an addressing system for the whole world (the entire concept of tech colonialism, for example), but Plus Codes are an undeniably better implementation and also freely usable.</comment></comment></comment>


Squeezed Out in India, Students Turn to United States - <AUTHOR> http://www.nytimes.com/2011/10/14/world/asia/squeezed-out-in-india-students-turn-to-united-states.html?hp

<comment><USER2> It's a net loss for the US if a middle class Indian high school student comes to the US on a scholarship (American scholarship), graduates and is then sent back by the US immigration system (shortage of visas etc.).

This story was was strange because I had a strong positive and negative feeling while reading it. Positive because I thought wow, India is really making it big with this coming generation of awesome students (I'm not Indian), and negative because I felt sorry for the kids. They seem to be under a lot of pressure and stress.

</comment><comment><USER3> Pity no one wants to discuss this. HN readers would've jumped on if this Was a story about Indians getting H1B visas or Indian community in Edison, NJ

Bring on some nice visual analytics on Indian students in US.</comment>


Ubuntu 17.10 corrupting Lenovo BIOS - <AUTHOR> https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1734147 <comment><USER2> Looks like UEFI is still defective by design if ROM can be modified without the express intention of the user.

</comment><comment><USER3> Have they found a root cause yet? Really nasty bug.</comment>


Encrypted Self Destructing Messages - <AUTHOR> http://cryptext.me/

<comment><USER2> BTW, the links to message are serial number represented by hex. It is pretty easy to view other message simply by enumerating backwards.

Random ids will be open to everybody, but at least will be little difficult to brute-force.

</comment><comment><USER3> The fact that you can't see the subject (or the sender) when you receive the notification can be a problem (is it spam or a friend?). But I really love the UI.

</comment><comment><USER2> If you are the author/developer, can you point to an about page ? or may be you can explain what encryption you use.

Just thinking about how can I use this.

</comment><comment> dj-wonk Interesting. Who made this?</comment>


Ethereum breaks new record by reaching $1,000 for the first time - <AUTHOR> https://techcrunch.com/2018/01/04/ethereum-breaks-new-record-by-reaching-1000-for-the-first-time/ <comment><AUTHOR> I feel a little guilty about posting these non-stories. But I want to use this to pose a real question: Crypto is clearly being being driven by a bubble mentality.

Is that:

a) Bad - because it will all crash and undermine the concept.

b) Not bad but irrational - the technologies that actually serve a purpose will rise from the ashes when needed.

c) Not bad AND rational: - Maybe the "store of value" use case is a real one (driven by distrust of government etc.) - If one believes that some currency will at some point become a significant store of world wealth in the future, you should pay a huge amount for it now (what if you happened to know where a lot of oil was, before it was used for transport) - "irrational" pricing is not forecastable. E.g. Amazon was super over valued in 1999 (by any metric at the time). But it was STILL an amazing long term buy. So it was, in reality, very under valued.

Not sure. but would love thoughts!

<comment><USER2> I think it's something that will be forcibly turned into a good thing by the SEC. They have a mandate to reign this sort of thing in and ensure the right balance of innovation in capital markets versus cutting down on fraud and overhype - it's exactly what they did during the excesses of the junk bond era.

Here's an article about it on Hackernoon:

[https://medium.com/@seiso_matt/investor-liability-for- icos-c...](https://medium.com/@seiso_matt/investor-liability-for-icos-could- be-downturn-catalyst-e902ffdb9eeb)</comment></comment>


Firefox Can Now Get Push Notifications from Your Favorite Sites - <AUTHOR> https://blog.mozilla.org/blog/2016/01/25/firefox-can-now-get-push-notifications-from-your-favorite-sites/ <comment><USER3> I love the contrast between the motivation statements on Firefox pages vs Chrome pages about the topic. Shows that Mozilla _does_ remember their values, even though we like to bitch about them:

Firefox[0]:

\</comment><comment></comment><comment>

 _Have you ever wished that a website could notify you when something important happened, even if you didn't have the site open? Maybe you've got an incoming WebRTC call, an instant message, or a financial update. Perhaps your city just declared an emergency snow plowing schedule.

Sometimes you just want to know when something happens.

That's what Web Push does. It's available now in Firefox 44._

Further down, they have "What about privacy?" section.

Chrome[1]:

\</comment><comment></comment><comment>

 _If you ask a room of developers what mobile device features are missing from the web, push notifications are always high on the list.

Push notifications allow your users to opt-in to timely updates from sites they love and allow you to effectively re-engage them with customized, engaging content._

Thank you, Mozilla.

[0] [https://hacks.mozilla.org/2016/01/web-push-arrives-in- firefo...](https://hacks.mozilla.org/2016/01/web-push-arrives-in-firefox-44/)

[1] [https://developers.google.com/web/updates/2015/03/push- notif...](https://developers.google.com/web/updates/2015/03/push- notifications-on-the-open-web)

<comment><USER4> Yes, thank you, Mozilla for the hypocritical statement. It changes so much about the result!

I wouldn't say "we like to bitch about them", as Panorama, Thunderbird and FirefoxOS were an important part of my technological ecosystem. These points were dealt with much hypocrisy (they're dead but not dead, we just know it because of leaks...), which permanently stained my opinion of Mozilla.

<comment><USER5> _Panorama, Thunderbird and FirefoxOS were an important part of my technological ecosystem_

They weren't an important part, or achieving being a part at all, of the ecosystem of the rest of the world, though. Not sure why you think continuing to pour resources into them after they were clearly lost causes is somehow a good idea, let alone it makes Mozilla hypocritical. Aside from the "me me me me it's all about me" syndrome that oozes from your statement.

On the contrary, Web Push is an important feature needed for parity with native apps, so Firefox supporting them is a great result.

<comment><USER4> Thunderbird has an estimated ~30 million users, and it's just about "me"?

Also, you deliberately deflect the point. The problem was not so much that they killed these projects, but the way they did it. They kept Thunderbird underfunded for a while before pulling the plug via an internal mail. They could have done it in a much nicer and transparent way.

Probably the best is to go back reading how well Pocket furthered Mozilla's mission and helped the web.

<comment><USER5> _They kept Thunderbird underfunded for a while before pulling the plug via an internal mail._

Not sure what "underfunded" means here. Thunderbird works. Email isn't evolving like the web is, so what point is there for Mozilla to throw resources at it? The announcement was to a public blog, but shared with the core contributors via email first. I think that's actually nicer than finding out through Twitter like some other companies do. Your arguments just have no merit whatsoever but apparently you're upset that your pet (and niche) programs don't receive the attention you believe they deserve.

Typical attitude in open source software: the more free something is, the more entitled people feel about it.

What this has to do with Push Notifications is anybodies guess.

<comment><USER6> > Thunderbird works. Email isn't evolving like the web is, so what point is > there for Mozilla to throw resources at it?

Not related to the topic at hand, but I couldn't resist commenting on this point. Actually, what people really wanted out of Thunderbird for _a very very very long time_ was calendaring that would work well with MS Exchange. Not some chat integration or other features people weren't really looking forward to in their email client.

People have managed and do manage with different solutions on the Lightning backend (which was integrated into Thunderbird main) like DavMail gateway, Exchange Provider (now maintained by Ericsson) and so on, but they're still not complete solutions for inviting people, accept/tentatively accept/decline invitations, have acceptance show up for other people properly (like Outlook would), etc. This is one area that could improve a lot and really make people using Thunderbird in an MS Exchange environment (which is at least a few hundred thousand, if not more) quit hanging on to Outlook or Outlook Web Access for "that one thing" that Thunderbird is not adequate for. All this desire does not mean that it's trivial in any way to implement these features, but there are many Thunderbird users who would value such a thing a lot. If that doesn't answer "what point is there for Mozilla to throw resources at it?", then nothing else can.

Another area of improvement is search. When Gloda (the global database and search) was introduced, it was a _terrific feature_ that could look across all emails. I still use it, but sadly, it continues to be highly limited in how one can filter the search results and find the needle in the haystack, and things have not gotten much better with time, in my experience.

Yes, Outlook won in the enterprise. But there was no reason not to continue working on a really good alternative with so many users behind it.

As I've said before, if there were a way to donate to Mozilla and have a say in where that donation (or most of it) goes, I'd definitely be voting for Thunderbird to have my share. I'd like to believe many Thunderbird fans would too.

</comment></comment></comment></comment></comment></comment><comment><USER7> Of particular note, this also works on Android Chrome. So a site can send push notifications much like an app can. The Facebook mobile site uses it, so I've been able to remove the Facebook app entirely from my phone.

I really wish Apple would implement this as well, as it would remove the requirement for a number of apps that are just thinly wrapped webviews. Sadly, I don't think Apple's business model will allow it...

<comment><USER8> Apple rolled their own, non-standard Push workalike at [https://developer.apple.com/notifications/safari-push- notifi...](https://developer.apple.com/notifications/safari-push- notifications/) which is available to members of the $99/yr Mac Developer Program.

<comment><USER7> ...on desktop only. Which, in a way, make it even _more_ glaring that they haven't done it on mobile.

<comment><USER9> It does make you raise an eyebrow and wonder if they're holding back Safari (which all iOS users have to use in one way or another) to keep people using the app store and giving Apple their 30%.

<comment><USER10> It is a shame, but not surprising, that they are both holding back Safari mobile AND other browsers from rolling their own full browser (chrome)

</comment></comment></comment></comment></comment><comment><USER11> Is there any short explanation how this works under the hood?

Does the browser maintain an open connection (like a Websocket) for each subscription, or there are some brokers, or if it can use OS facilities (like GCM/APN on mobile) when available, etc etc.

In particular, I'm curious of privacy implications. When I subscribe - <USER2> site knows of me (say, if that's a direct connections, I'm not sure I want to tell every site out there when I'm online), or if any third parties are involved - what they know and do (say, what's about sender and receiver authentication)?

From what I saw (but really not sure I got it right), it seems that I have to trust browser vendor and maintain a live connection to some Mozilla server, that'd listen for events (POSTs from sites) and aggregate them for me. But I'm not sure I understood it correctly.

I'll surely investigate this properly, but reading standards is tough, and end-user introductions written by marketing people are virtually useless. So I wonder if there's a short reading to get the overall picture quick, but still see all the important details.

<comment><USER8> I believe my article on Hacks ([https://hacks.mozilla.org/2016/01/web-push- arrives-in-firefo...](https://hacks.mozilla.org/2016/01/web-push-arrives-in- firefox-44/)), linked from the marketing article, answers all of those questions at a high level and points to docs with more detail.

In short, there's a single, persistent websocket connection between you and a broker service run by your browser vendor. Each subscription has a unique, anonymous URL on that service that gets provided to the website. To prevent abuse, there are throttles / quotas / limits imposed on push messages that do not show user-visible notifications.

The source to Mozilla's broker, autopush, is at [https://github.com/mozilla- services/autopush](https://github.com/mozilla-services/autopush). We recently rewrote it from Go into Python, which we now run with PyPy in production.

<comment><USER12> > We recently rewrote it from Go into Python

I am used to porting things the other direction; can I ask why you moved to Python for this service?

<comment><USER13> Ben Bangert has given a presentation about this that was discussed here: [https://news.ycombinator.com/item?id=10402307](https://news.ycombinator.com/item?id=10402307)

The above links to the slides only, here is a video of the talk: [https://www.youtube.com/watch?v=_F2peRzJzhU](https://www.youtube.com/watch?v=_F2peRzJzhU)

</comment></comment></comment></comment><comment><USER8> More developer-oriented information at [https://hacks.mozilla.org/2016/01/web- push-arrives-in-firefo...](https://hacks.mozilla.org/2016/01/web-push-arrives- in-firefox-44/)

I'd also highly recommend checking out the examples at [https://serviceworke.rs/](https://serviceworke.rs/)

</comment><comment><USER14> This is a HUGE game changer, so excited. The number one feature request year over year has been around push notifications. It's a really big pain point for a lot of people in media trying to spam users. They block all of the high bandwith offsite resources they try to shove down peoples throats and the scripts to shut down those scripts. Finally, companies can just trick you into accepting notifications and the problem is solved.

This is great for the acerage user too. Social networks are notorious for making it difficult to engage or get updates about your friends. So this will finally eliminate the friction around realtime relationship status changes and well informed election posts

<comment><USER15> Unfortunately you can click on the notification in Firefox and immediately kill all further notifications from the spammers. Hopefully other implementations will be more friendly to spammers and hide the 'make it stop' button deep in a sub-sub menu under an elusive Settings app.

</comment></comment><comment><USER16> RSS readers seem like such a good idea, but they've hardly caught on outside of tech groups. They weren't intuitive enough for most people to use, and we didn't want another interface that we had to check. We also didn't want it to fill up our inboxes with notifications when we didn't have time to read.

IMO, that's why Facebook continues to work well. You see updates from the people and the sites you want, and it's not at all overwhelming. There's no backlog of notifications to stress you out.

Done right, I think browser notifications could be the solution we're looking for. I look forward to seeing different implementations. There are already plugins for major CMSs.

<comment><USER17> Publishers can't serve effectively serve ads through RSS. Ads have to be rolled into the post body and if the feedreader caches images, you can't track impressions.

A way around it is to serve a preview of the article and require readers to read the rest on the publisher's website, but at that point you might as well just use Twitter.

<comment><USER18> > A way around it is to serve a preview of the article and require readers to > read the rest on the publisher's website, but at that point you might as > well just use Twitter.

Don't say that. Reading Twitter isn't early as efficient as reading my RSS reader. I dread everyone moving to Twitter.

Also RSS is open and Twitter is not (one reason there are better RSS readers).

</comment></comment></comment><comment><USER19> For anyone who would like a demo and real-world example, my company put together a website to let you subscribe to Web Push notifications for trending Hacker News stories: [https://hackernews.onesignal.com/](https://hackernews.onesignal.com/)

<comment><USER20> so chrome supports the notifications but only if you are currently on the page? is that right?

<comment><USER19> No. Chrome has supported notifications even when you have no browser windows open since Chrome 42, released mid 2015. [https://developers.google.com/web/fundamentals/getting- start...](https://developers.google.com/web/fundamentals/getting-started/push- notifications/?hl=en)

<comment><USER20> Is this page out of date or are those two other features related to the push api that arent supported by chrome unrelated to what firefox just released? [https://developer.mozilla.org/en- US/docs/Web/API/Push_API](https://developer.mozilla.org/en- US/docs/Web/API/Push_API)

<comment><USER19> It's not out of date. Chrome does not yet support Message Payloads in the public release, here's their description for it on chromestatus.com: [https://www.chromestatus.com/feature/5746279325892608](https://www.chromestatus.com/feature/5746279325892608)

The workaround for now is to have the service worker fetch the payload from an API endpoint that the sender implements themselves.

</comment></comment></comment></comment></comment><comment><USER21> I use this feature selectively in Safari now, and am glad to see it in Firefox. Eventually I'm sure I'll run into the problem of getting duplicate notifications from the same sites. I wonder what the solution for that will be... running only one browser at a time is not an option. Maybe I'll have to keep track of and choose just one browser per site for allowing notifications.

Why have two browsers open at once? So that I can be logged into Google services simultaneously with two different accounts (personal and work). Off topic, but would be glad to know if there's another way to do that.

<comment><USER22> Most Google apps supports a way to have multiple Google accounts active, typically by adding /u/[numeric index of a specific Google account]. Gmail for example:

[https://mail.google.com/mail/u/2/#inbox](https://mail.google.com/mail/u/2/#inbox)

The "u/2" part indicates that this is the gmail view for the third (counting 0) user

For Google Apps for work, if you go to mail.google.com/a/example.com, it will let you log in separately to an example.com account and then redirect to a url like the one above.

<comment><USER23> > Most Google apps supports a way to have multiple Google accounts active, > typically by adding /u/[numeric index of a specific Google account]

FWIW: instead of manually entering the numeric index, you can enter the full email address instead. so you can enter /email@example.com or /firstname.lastname@example.com. This is handy because the numeric index depends on the order in which you logged into (added) the accounts and I don't want to have to remember that!

</comment></comment></comment><comment> nevi-me I've been using Push Notifications on my site for a few months now [0]. Having gone through the detail on this announcement, I'm a bit confused and would like some clarity.

In Chrome & Chrome for Android, I have to use GCM to let the device know that there's a new message. The service worker then pings the server to find what the notifications are, before displaying them. Firefox supports sending payloads.

How can I distinguish between endpoints registered from FF, so I can send payloads directly without going via GCM?

Thanks

[0] [https://movinggauteng.co.za](https://movinggauteng.co.za). Users need to log in via social media, and then grant permissions for notifications by clicking on the crossed out bell at the top of the page.

</comment><comment><USER24> Anyone know of websites that have enabled the push notification feature?

<comment><USER25> Facebook supports it, I believe. And maybe Gmail, though that one could be Chrome-only.

<comment><USER26> Facebook Messenger too ([http://www.messenger.com/](http://www.messenger.com/)), although you have to thankfully enable it in the settings.

</comment></comment></comment><comment><USER27> We at Pushcrew also announced support for Firefox push notifications [https://pushcrew.com/blog/firefox-website-push- notifications...](https://pushcrew.com/blog/firefox-website-push- notifications/)

We think it's a game changer too whereby, unlike email spam, users can opt into what information they want and really have much greater control. With Firefox, Chrome and Safari, browser push notifications are getting so much exciting.

</comment><comment><USER28> This sounds like it will as annoying as the Safari "Download Our App" API. Please tell me I'm wrong.

</comment><comment><USER29> anybody know if fastmail is planning to support this? that would be cool (even cooler if it could be set up on a per-folder basis) would be nice having a biff equivalent working in the browser without having to code something using IMAP...

</comment><comment><USER30> Does anyone actually intentionally subscribe to these? I can think of few things more annoying than getting blogspam "notifications" on my laptop.

<comment><USER19> Yep, I find them to be really useful from Facebook and I can't wait until Slack implements them.

One of the nice features of Web Push notifications is that they each have an unsubscribe button on the notification itself. So once you don't want to get them from a website anymore, the block button is immediately available.

<comment><USER31> Your response surprises me, I subscribed to the notifications for less than a day before I unsubscribed. If you don't mind me asking, how many a day do you get and why do you like getting the notifications?

<comment><USER19> Overall I get about 3 to 4 notifications from Facebook per day, so the quantity isn't too high. It also helps me avoid the habit of frequently loading Facebook to check for new notifications when there usually aren't any.

<comment><USER31> Thanks for the perspective, checking for notifications could be even more of a distraction in some cases!

<comment> nevi-me I have a few users on [https://movinggauteng.co.za](https://movinggauteng.co.za) using web notifications for transit updates. I'm intentionally not sending many for now, because I'm still working on a way for commuters to choose when to get updates.

<comment><USER31> This seems like a great use of notifications unlike so many apps where they exist mainly to promote compulsively habitual usage.

</comment></comment></comment></comment></comment></comment></comment><comment><USER32> So does this mean I'll get even more of those annoying messages about adding notifications like in Safari?

</comment><comment><USER33> Somebody make this into a WordPress plugin, so people can subscribe to category notifications without the need for RSS + Mailchimp. Make millions of bloggers happy.

</comment><comment><USER34> I'm confused why it depends on a centralized relay. If it has to maintain a connection anyways it could just as well be a standard like favicon.ico.

</comment><comment><USER35> Excellent - I've been looking for a replacement for active desktop channels since 2002.

</comment><comment><USER36> I can't believe how excited I am about this.

My only apprehension is will the big vendors not push to their competition? Like will GMail push to IE, Firefox, and Safari and vice versa?

</comment><comment><USER37> I can't find a menu to see all push subscriptions in firefox. Going to each individual page to unsubscribe sounds like a pain.

EDIT: about:permissions does the trick

</comment><comment><USER38> Could you use this on someone's Twitter? I have a bear of a time knowing when new content is posted.

<comment><USER39> That's up to Twitter to implement it.

</comment></comment><comment><USER40> Sounds like Web slices, which Microsoft just killed off: [https://en.m.wikipedia.org/wiki/Web_Slice](https://en.m.wikipedia.org/wiki/Web_Slice)

</comment><comment><USER41> Meanwhile, I sit here with the firefox usage pegged at 50%, and no way to tell which tab is killing the CPU. There's a 9-year-old bug open, requesting this feature. Now, before the fanboys jump in and say "it's open source, why don't you do it?", I'll admit that my hacking skillz are not enough to dive into Firefox source.

<comment><USER42> There's been a CPU profiler in the debugging tools for over a year, and before that there was one in the addon repository with documentation on the mozilla wiki.

Could be easier (like Chrome's task manager) but it's not as hard as you seem to think it is.

P.S. Chrome's task manager isn't accurate anymore because now a bunch of work is offloaded from the per-page processes to special catch-all processes like the 'GPU Process'. So this is actually a harder problem to solve than it seems at first glance...

<comment><USER43> There is also about:performance, though I'm not sure whether that has made its way to release yet.</comment></comment></comment>


BlackBerry details patent deal with Android maker BLU - <AUTHOR> http://www.reuters.com/article/us-blackberry-patents/blackberry-details-patent-deal-with-android-maker-blu-idUSKBN1CH1GE <comment><AUTHOR> Techmeme summary: _Reuters: BlackBerry signs patent licensing deal with low- end Android handset maker BLU and ends its litigation against the company_</comment>


The Secret Lives of Tumblr Teens - <AUTHOR> https://newrepublic.com/article/129002/secret-lives-tumblr-teens <comment><USER2> Previously: [https://news.ycombinator.com/item?id=11133663](https://news.ycombinator.com/item?id=11133663)

<comment><USER3> Yes, I remember this was posted recently. I thought the wait period for dupes was a year?

<comment><USER4> It used to be something like that. It now appears to be based on the number of votes as well as the amount of time.

</comment></comment></comment><comment><USER5> > In early 2014, when she was 16, some Tumblr users dug up posts Miller had > written when she was 13 in which she used the word "nigga." Screenshots of > the old posts went viral. At one point, according to Miller, she had 9,500 > concurrent visitors on her blog and she received over 2,000 angry messages, > some of them telling her to kill herself.

If you're telling a child to go kill themselves, because of something they said when they were 13 years old, and didn't understand a complicated issue from halfway around the world...

<comment><USER6> ...you should kill yourself? Maybe most of the messages were from 13 year olds.

</comment></comment><comment><USER7> What I just _don 't_ get is how these teens who were supposedly so internet and media savvy and established huge followings based on "being honest" or somesuch couldn't see that deliberately posting low-quality content which was fundamentally dishonest (the opposite of what they'd been doing) was just as certainly going to hurt them. ...and that thousands of teenagers are apparently involved in this kind of thing, it's probably safe to call it "widespread".

Clearly there's a lapse here, but I'm uncertain if it's an ethics problem or simply an educational problem (we didn't teach them not to deliberately poop into the internet).

<comment><USER8> > supposedly

This is the reason. Kids and teens are not anything savvy in reality, and specifically are no more internet savvy than anyone else.

<comment><USER9> Umm...pardon me? I'm pretty sure kids under 20 are far, incomparably, even, more internet-savvy than the previous generations.

Just because there's a small percentage of 20-50-somethings who actually understand or use it, doesn't mean there's not a huge percentage of 7-year- olds who understand technology infinitely better than their parents. This is the norm, not an exception.

Proof? Let's take something super-recent - Microsoft's ludicrous failure with 'Tay.' The lack of 4chan/reddit-proofing indicates how wildly out of touch the previous generation is with the internet of the current generation. It's sad.

<comment><USER8> First off it was a 16 year old. I have more experience using the internet than they have experience living. Extend that out to 25 year olds and I have more experience dealing with desktop computers in general than they have living.

No, people under 20 do not have the most experience online. That 7 year old doesn't understand anything about what they're using, it has been made so that they don't have to. People mistake no fear of using something as experience and knowledge of that thing.

That 7 year old doesn't understand shit, they're just not scared of braking it and having to pay for a replacement. The majority of teens fall in to this as well.

We don't mistake the almost ubiquitous use of cars in the US as an indicator that the US population is 'car savvy,' so why do we do it with computers, cell phones and the internet when in reality you need to know just as much about how they work as how your car does in order to use it?

Simple use is not understanding.

And Tay is a better example of the failure of American society to raise people than anything else. Microsoft didn't have these problems in Japan or China.

And honestly, you want to talk about outliers and than use 4chan users as some example of 'the current generation?' Hell 4chan users themselves are not some coherent group.

<comment><USER10> > We don't mistake the almost ubiquitous use of cars in the US as an indicator > that the US population is 'car savvy,' so why do we do it with computers, > cell phones and the internet when in reality you need to know just as much > about how they work as how your car does in order to use it?

That may be true from the perspective of understanding the technical workings of the internet, but it's orthogonal to the discussion of understanding internet culture.

"Internet savvy" in this context means savvy with media and savvy with modern social networks, not with the OSI model of networking.

<comment><USER8> > "Internet savvy" in this context means savvy with media and savvy with > modern social networks

But they're not, they do not have 'shrewdness and practical knowledge' of social networks or how the internet works they're just not scared of them.

</comment></comment></comment></comment></comment></comment><comment><USER11> And those are just the secret lives someone would attach their name to: [http://abdlstoryforum.info/forums/index.php/topic,6486.msg63...](http://abdlstoryforum.info/forums/index.php/topic,6486.msg63620.html#msg63620) .

</comment><comment><USER12> In Internet time, this article is ancient.</comment>


The "Upp" fuel cell charger. A completely pointless product - <AUTHOR> https://www.youtube.com/watch?v=y48wCuC3KcA <comment><USER2> This is not so bad as most seem to think. Consider deep deep north with no sun, no wind and -40C. Pre-charged lithiums are dead too, unless you keep them warm in your trouser pocket.

At this moment however, peltier element ( [https://youtu.be/R1A5qc872Ks](https://youtu.be/R1A5qc872Ks) ) makes more sense, mostly because you can use the wasted energy to boil rice or warm up your hut.</comment>


Choose your next programming laptop - <AUTHOR> http://www.lappylist.com/laptops/best-programming-laptops/

<comment><USER2> I recently bought a new gaming laptop after shopping around for quite some time. I was glad to see that for my budget mine is listed as the best. I guess we're on the same page. I'll be sure to take a look at this the next time I'm in the market for a new laptop.</comment>


FastMRI Open Source AI Research Tools from Facebook and NYU School of Medicine - <AUTHOR> https://code.fb.com/ai-research/fastmri/ <comment><USER2> "We hope that the release of this landmark data set, the largest-ever collection of fully sampled MRI raw data, will provide researchers with the tools necessary to achieve even greater acceleration factors"</comment>


Lies, damn lies, and front-end tracking - <AUTHOR> http://alexeymk.com/2020/07/14/lies-damn-list-and-front-end-tracking.html <comment><USER2> >The less JavaScript (especially third-party) you have on your landing pages, the better. It's a better customer experience, and it improves your page's conversion and quality score.

Really wish I read this more. And not just for the landing page.

<comment><USER3> I'm surprised we haven't run into this before now. JS performance on android has been stagnant for a while now, yet we still see the same awful JS-heavy applications.

This doesn't bode well for the end of Moore's law. That is Moore's law in the performance sense, i.e. guaranteed future single-core performance increases [even if small], not Moore's law as in the the doubling transistor density.

<comment><USER4> Companies that keep their JS footprint small will have faster-loading pages, and that translates to non-trivial increase in profits. Sadly, people running businesses don't understand this, and tech teams certainly aren't going to voluntarily make their jobs harder without word coming down from above. So do your company a favor - educate those in charge about how much page load time matters.

<comment><USER5> Unfortunately, Amazon S3 and Akamai CDNs will come to their rescue in still making their pages load faster. As a plebeian, all my efforts at keeping my pages light will go in vain as I simply can't afford the CDN infrastructure of these tech giants.

<comment><USER6> Don't today's bloated, slow-loading pages already use these CDNs?

</comment></comment></comment></comment></comment><comment><USER7> > inform Google/Facebook via their server-side APIs when feasible, instead of > trying to load a pixel

I was wondering when this was going to be the norm.

Can't block third parties for privacy if the first party talks to them behind the scenes.

(If I understand what this means)

<comment><USER8> I imagine that the vast majority of users of Facebook SDKs are not actually motivated to inform Facebook about anything. They're using the SDK's to enable login, likes, etc. If this moved to the server side, they might only inform Facebook about actions that involve Facebook.

edit: for the specific case of conversion tracking as mentioned in the article, I would hope that only referred by Facebook/Google would be reported.

<comment><USER9> A good portion of the SDK usage in mobile apps is not nefarious. They're embedding it for advertising conversion tracking which would respect the "limit ad tracking" setting in your device's settings.

The problem is that beyond whatever functionality the developer of the app intended to use the SDK for, it also does its own thing of stalking the user even if the app doesn't end up using any SDK features at all.

<comment><USER8> Exactly my point. The third-party app is not nefarious, but the SDK is. A server side API would have a better chance of doing the useful bits without the nefarious parts.

I doubt many competent server operators would be willing to run Facebook- supplied _binaries_ on their precious servers, especially given Facebook's track record of SDK crashes. (Not to mention PCI requirements, etc.)

</comment></comment></comment></comment><comment><USER10> We ran into the same exact issue at my previous employer. It's scary how similar it was to your situation given we also moved our site over to Next.js and we were a competitor to Opendoor. It also wasn't the first time I've run into bad metrics in a legacy app making it appear to convert better than a new version.

</comment><comment><USER11> Sshhhh. So many people will lose so many bullshit jobs if this gets discussed widely. There are entire tertiary industries built on top of front-end tracking and most people with a modicum of analytical ability know it's turtles all the way down.

<comment><USER12> What do you mean by "turtles"?

<comment><USER11> A turn of phrase:

[https://en.m.wikiquote.org/wiki/Turtles_all_the_way_down](https://en.m.wikiquote.org/wiki/Turtles_all_the_way_down)

In this context, I'm referring to the "trust us, it works" attitude that people who sell/provide analytics on front-end tracking use to justify their effort/expense. Based on experience, when you point out obvious problems doing analytics with JS, they keep repeating the mantra "but you _need_ front-end analytics" infinitely.

</comment></comment></comment><comment><USER13> The headline, the problem and the solutions are all different things.

\- Front end tracking did not lie, the people tracking it were not aware. If opendoor was spending on Ads, the marketing team would be the first to see a disparity between the clicks on an ad network and pageviews on their end.

\- As such this is also a reason why you need to check your server hit logs with your Analytics.

\- Where is the author is right it Frontend numbers being incorrect largely due to blockers

\- His understanding of bounces is also incorrect. Bounce is when there is no second "interaction event", many marketing folks fake-fix the bounce rate, by sending a scroll event as an interaction event.

\- I always tell people that analytics numbers are "signals", not "metrics", they are not accurate enough to be called "metrics"

<comment><USER14> If these numbers were significantly changed by a server side page view, I'd bet their page view wasn't firing any earlier than the top or bottom of the body tag, or maybe even on window ready. Anyone that's spent any real time outside of dropping in a snippet understands the implications of users navigating before hits fire, and it sounds like the team just didn't have that experience.

Like you, I also work to make sure people understand that client side data is not necessarily accurate, but still refer to it as metrics and KPIs, just with the caviot that we should bank on consistancy over accuracy, keeping our analysis geared towards behavior and trends versus most business people's immediate desire to take it to an operational/business intelligence type place.

</comment></comment><comment><USER15> I don't think this is an issue with the on-site analytics, but with the quality of the traffic and website performance. If you make sure that:

1) Your site loads in under 3-4 seconds for any user.

2) The user is interested enough to wait 3-4 seconds until the page loads.

Then most issues will be solved.

The problem with ads in many cases is that the traffic they send is of very low quality or just bots. In the end you already know from your ads provider how many users they say they sent and you should always use that when calculating ad conversion rate.

Also note that using Cloudflare will count as bounced users who never actually even tried to load your page (bots, crawlers, scrapers, all HTTP requests).

<comment><USER16> It's amazing that 3-4 seconds is considered a reasonable target in 2020 when 8 seconds was a target on freaking dialup. It's like having a Ferrari and considering outrunning a horse a success.

<comment><USER17> No one thinks that's a reasonable target. That's insane. I don't know who that person is or what he's in charge of, but that's the fastest way to being a dead company.

100 ms max on backend processing, 500 ms max on first time to interaction. Client connection speeds matter, obviously. 3-4 seconds is get your fired ass out of here in my world.

<comment><USER15> 3-4 seconds includes the DNS resolving, downloading HTML, CSS, JS, media, parsing them, creating the DOM, layout, calculating styles, rendering, etc. It's very hard even for a static imageless site to load in under 1 second for low-end mobile device.

That being said, for good UX the target should definitely be under 1 second to interactice, but even on desktop, if your users can't wait 3 seconds after they click the ad, they are not actually interested at all in your product.

People are also used with waiting a bit after they change sites/applications when they initiate the transition, so transition feels faster than it is. It starts feeling slow when you are already on the blank page, having time to look at the loading spinner.

I'm not saying slow is good, but I highly doubt that you can make any site have 500ms TTI for any user (they could easily have 150ms ping to your closest server). I assume that TTI means having access to all website functionality, not some simplified placeholder UI.

<comment><USER17> If users are used to waiting, it's because people like you have trained them to be. You list all the things that go into rendering a usable UI as though we don't all know that. Users probably don't, and that sounds like a lot. It sounds like the kind of excuse for shitty load times that PMs use when people do complain about slow websites.

And you can doubly tell how much of a PM you are by assuming that everyone is accessing your product by ad and how much you don't care if they are interested after 3-4 seconds. That's a lot of money you're leaving on the table.

Low-end mobile devices are not the right metric for TTI.

Most people don't realize how fast the web can be because they don't bother to benchmark until they are well into the tooling choices and feature development and maybe someone somewhere decides to complain about speed.

A functional Pyramid app with dynamic templates using Mako, and some db queries via SQLAlchemy can fully load in under 100ms.

The bottom line is that speed is a feature. It's not just one feature; it's your most important feature if you want users. It's more important than developer productivity; it's more important than any other feature. You don't know this because you work in a b2b/enterprise space where users don't have a choice. Their managers make the choice. But if you ever work directly on consumer products you'll find this out really quickly. The difference between ~.5 sec TTI and 4 sec TTI is millions of revenue per minute in eCommerce.

But even though it's b2b doesn't mean it has to be bad and suck people's time away from them. You have the option to learn something and change your priorities. But you won't.

<comment><USER15> Wow, a personal attack based on assumptions.

I just want to say that I'm not a PM and I don't even work in a corporation. I have worked my entire career focusing on performance (learned programming for and during algorithmic contests were every millisecond really matters, made open-source contributions that vastly improved performance, worked in the gaming space where even users care a lot about performance, and working in the analytics space, where I created a high performance, lightweight alternative to some heavy and data demanding alternatives).

I respect your opinion, but my comment was based on experience, knowledge of human behavior and analytics and A/B tests ran on millions of users. I do agree that it might differ from product to product, but in the majority of cases you just get to a point where it is "fast enough", users no longer notice and spending more time on optimizations takes too much effort for the benefits it brings.

</comment></comment></comment></comment></comment></comment><comment><USER18> Wouldn't the B variant show higher session count? If your A/B testing tool doesn't detect imbalances in cohort size I would imagine you have a bigger problem, since it's easy to accidentally measure the A and B groups differently.

<comment><USER19> Important takeaway is they rewrote their website from scratch before even having the A/B testing. Probably one of the best arguments I've ever seen against writing bloated website code. We now know that software can hit a point where it's so slow, that it produces false metrics about its own slowness. Imagine how many people are still out there, who didn't write website B, and are thinking, oh my bounce rate is fine, I don't need to invest money in performance, since the numbers are telling me people don't care. Folks who trust numbers at face value, don't always know what they don't know.

<comment><AUTHOR> author here

> We explicitly only changed the infra which served our landing pages, and > kept the content - the HTML/CSS/JS - identical. Once the new infra was shown > to work, we would begin to experiment with the website itself.

\- [http://alexeymk.com/2020/07/14/lies-damn-list-and-front- end-...](http://alexeymk.com/2020/07/14/lies-damn-list-and-front-end- tracking.html#fn:1)

</comment></comment></comment><comment><USER20> Although interesting story, it seems the main issue was that the author never sanitized their analytics in the first place and blindly relied on data that was never confirmed before. I've seen this as a quite common phenomenon. No piece of software does magic and they all require certain certain conditions to work as expected. In client JavaScript, these conditions are simply harder to grasp but they can be studied.

</comment><comment><USER21> There's a fourth reason not to do this that isn't mentioned in the article: _tracking is unethical_. Don't do it.

<comment><USER22> Parker Thomson, aka StartupLJackson, had a great view on this. Would you rather see a ton of ads that are completely irrelevant to you, or see ads that you actually need?

Tracking that makes your life better is useful. If Opendoor knows you are looking for a new house in Arizona, and they can show you just the right house before it's sold to someone else, isn't that fantastic?

<comment><USER23> Honestly? I'd rather see more ads that are irrelevant. Ads are already an attempt at manipulation. I would feel better knowing that everyone else is seeing the same shit I'm seeing. That I'm not being pandered to. That there are things that are valuable to others that I have no personal value in.

That's part of living in a diverse world.

I don't know about you, but I don't want a myopic world for myself. The perfect ad targeting system removes my agency; decides what I want and can afford on my behalf; makes my world significantly smaller.

<comment><USER14> And I'd rather see more search results that aren't tuned to me. Down with algorithms! Down with personalization!

I'm surprised how much hate there is on HN - the entire future of technology feels like it's heavy on data, personalization, and prediction, but a lot of comments read like a parent or grandparent that was targeted and is loading up their shotgun.

The technology isn't the enemy, some of the use is. And in some cases, we need legislation to catch up, like it gas started to for things like loot boxes / gambling in kid's games.

</comment></comment></comment></comment><comment><USER24> Can someone explain to me why third party JS has such a big impact on load time? I thought browsers deprioritize third party JS and load it after all first party assests have been downloaded and the site has been rendered. If that's the case why does third party JS still have such a big impact on page performance?

<comment><USER25> You can (usually accidentally) end up with a render blocking script tag. In this article example it was client-side optimizely.

The parsing and execution of third-party javascript is definitely non-trivial if you profile it, especially on lower end devices.

Finally, browser download priority requires async and defer attributes on scripts (usually), or other clever ways of deferring loading.

<comment><USER24> > You can (usually accidentally) end up with a render blocking script tag. In > this article example it was client-side optimizely.

This makes sense for a tool like Optimizely which has to block rendering.

> The parsing and execution of third-party javascript is definitely non- > trivial if you profile it, especially on lower end devices.

Given that this is supposed to happen after the page has already loaded, does this matter? If the thing you are optimizing for is page load time, and it takes a few 100ms after the page has already loaded to run the JS, does that actually negatively impact the user experience?

> Finally, browser download priority requires async and defer attributes on > scripts (usually), or other clever ways of deferring loading.

When you add third party JS, shouldn't this be taken care of for you? Scripts for adding third party JS should already make use of async and defer as needed. What's a case where you would need to actually think about async and defer when making use of third party JS?

<comment><USER25> This type of thing usually ends up being "death by a thousand cuts". async + defer help out, but they do still incur parsing and evaluation (iirc, before document onload event) overhead. If you delay loading until you're sure the page is interactice, you'll end up loading third-party pretty late (which impacts metrics, and usually isn't out of the box supported).

On a standard product-ey site with retargeting ads, user tracking, etc. this third-party slowdown is significant.

All of this is exacerbated on lower-end devices, and non-WiFi Internet.

</comment></comment></comment></comment><comment><USER26> *damned

<comment><USER27> And the manager peeked in, not peaked in.

<comment><AUTHOR> Thanks! Updated on both fronts.</comment></comment></comment>


These Zen Buddhist Koans Will Open Your Mind - <AUTHOR> http://www.huffingtonpost.com/entry/zen-buddhism-koan_us_563251dce4b0631799115f3c <comment><USER2> If you haven't seen hacker koans, they're fun to read through. Sure they're largely parody, but some of the popular ones feel like proper koans.</comment>


As promised, Kim Dotcom starts payouts for Mega vulnerability reward program - <AUTHOR> http://thenextweb.com/insider/2013/02/10/as-promised-kim-dotcom-starts-payouts-for-mega-vulnerability-reward-program-seven-bugs-fixed-in-first-week/ <comment><USER2> I really think Dotcom is making all of the right moves here. I remember reading a multitude of comments from people on various sites saying that he would rip people off with his "vulnerability reward program" but here we are, Dotcom is putting his money where his mouth is and paying out the money. Mega is definitely a rising force and once the kinks are ironed out, Hollywood should be very scared.

<comment><USER3> wait, how much money did he pay out to whom? what would be the point of not listing who is being paid nor what they're being paid except for deception?

<comment><USER2> Does it matter how much money he paid out and to who? Things are getting fixed by the looks of it. Do Google or Facebook release a list of names and how much they paid for their bounty programs? (I did a search, but couldn't find anything, so maybe they do). If Dotcom were to try and rip someone off, sites like Techcrunch would foam at the mouth to release a story like that. Everyone loves to hate Dotcom, the insinuation in your comment about deception proves this very fact (unless you have evidence that proves he is being deceptive and hiding the information for nefarious reasons?).

<comment><USER4> > Do Google or Facebook release a list of names and how much they paid for > their bounty programs?

Names, yes; $, no.

[1]: [https://www.google.com/about/appsecurity/hall-of- fame/reward...](https://www.google.com/about/appsecurity/hall-of-fame/reward/) [2]: <https://www.facebook.com/whitehat/>

<comment><USER5> $, yes. One of the Indians who was gifted by google: [http://www.sandeepkamble.com/skl337/2012/12/28/vulnerability...](http://www.sandeepkamble.com/skl337/2012/12/28/vulnerability- report-activities-gift/)

</comment></comment></comment></comment></comment><comment><USER6> OK, I take it back. He paid out, not that he would have ever read my original comment (or even this one), but I owe Kim an apology.

</comment><comment><USER7> Good on Kim for paying them out.

</comment><comment><USER8> I'm like 99% sure they intentionally left a few 'low-risk' vulnerabilities which they knew people would uncover (and be rewarded for) to entice the big boys of security probing to roll up their sleeves and get to work looking for the really big ones.

In the long run, they're paying a reasonable amount of money for an army of security consultants to give the service a once-over. Smart!

<comment><USER9> Why would you intentionally leave in potential vulnerabilities, if you hypothetically have the option to release bug free code and boast about it.

<comment><USER10> You never have the option of releasing bug-free code. So if they released code with bugs, called it bug-free, and boasted about it, someone would come along, prove them wrong, and embarrass them.

<comment><USER11> They wouldn't boast about it directly, simply having a bug bounty where no bugs were found/reported would do the boasting for them.

<comment><USER6> The publicity wouldn't be as effective. However, I can't see them doing this.</comment></comment></comment></comment></comment>


Can killing cookies save journalism? - <AUTHOR> https://www.wired.com/story/can-killing-cookies-save-journalism/ <comment><USER2> > With Ster's new ad server, advertisers are blind—they receive no information > on the user. Instead, they get information about what the user is looking > at. Pages and videos are tagged based on their content. Instead of targeting > a certain type of customer, advertisers target customers reading a certain > type of article or watching a certain type of show.

For normal targeted advertising, is page content taken into account as well, or is it simply the user?</comment>


Senator Wyden lays out "digital freedom" agenda at CES - <AUTHOR> http://arstechnica.com/tech-policy/2013/01/senator-wyden-lays-out-digital-freedom-agenda-at-ces/ <comment><USER2> _The CISPA cybersecurity bill received strong support from both parties in the House, and Wyden said today that he was one of only a few Democrats in the Senate who opposed it._

CISPA is a "tell" that says "I oppose cybersecurity legislation without considering what it says". CISPA did not enable "government snoops" to access personal information. It enabled the government to share incident and attack data with private companies, and created a mechanism by which large service providers could share incident data with the government.

I like Wyden! I just wish he wouldn't make comments like this that make it seem like he's demagoguing. Any schmuck could figure out that there's a lot of very loud people on the Internet that will cheer on opposition to regulation of any sort. I'd like to think Wyden isn't just that!

<comment><USER3> Excuse me, what?

CISPA is the opposite -- it is a tell that supporters support governmental oversight of private data in the name of 'cybersecurity'. There are a lot of loud people on the internet that cheered in its opposition, but there was a majority support before that fact -- something that Wyden is using to distinguish himself: he was against before the backlash.

<comment><USER2> I think you haven't read CISPA. That's not what CISPA does.

</comment></comment></comment><comment><USER4> SOPA should be a wake up call in an additional way.

 _> Government's main role in technology should be to stop incumbent companies who try to "hotwire" the system, said Wyden. "Not infrequently, they seek out special help from the government—while claiming they want a marketplace that doesn't favor government intervention."_

Incumbent companies are hotwiring the system all the time, at the federal, state, and local levels. We stopped SOPA because it was brought to our collective attention and we cared enough to take action. The thing is, SOPA was just business as usual for companies -- they had done the same in many different ways before, so our reaction surprised them. We should take notice that this is happening all the time and we're just not paying enough attention.</comment>


Why fast pedaling makes cyclists more efficient - <AUTHOR> http://www.active.com/cycling/Articles/Why_fast_pedaling_makes_cyclists_more_efficient.htm

<comment><USER2> This has been pretty common knowledge for a while.

A lower cadence yields increased raw muscle power, but legs will also tire much faster.

This is why you see pros, who race for 6 hours at a time, with cadences > 90rpm (Lance Armstrong is known for a super-fast cadence of 105rpm). Yes, they could technically go _faster_ with a lower cadence, but their legs will fry way sooner.

A higher cadence is sort of a happy medium.</comment>


SPP users outraged at Google killing Slide without compensation - <AUTHOR> http://techcrunch.com/2011/08/27/superpoke-pets-outrage/

<comment><USER2> More evidence that Google is tone deaf. They lack compassion and understanding for their users and community, and they abuse their power. This a precursor to grand evil - lack of compassion plus grand intentions. Slide? G+ names? What other examples?</comment>