Equifax's Maddening Unaccountability - <AUTHOR> https://www.nytimes.com/2017/09/11/opinion/equifax-accountability-security.html <comment><USER2> There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done??

How can they not be liable? How is this not negligence?

<comment><USER3> Common misconception. They actually _do_ need your approval, it's just that that approval is buried in the mountains of legalese you sign whenever you sign up for a bank account, credit card or loan.

<comment><USER4> Yes, but you really have zero choice. Unless you decide that you can live without a cell phone, rental car, credit card, mortgage or bank account the rest of your life.

<comment><USER5> You can do only burner prepaid sims that don't require a name/personal info (which is a bit difficult to find) but your general point is still very valid. You cannot escape the data collection systems in our society without going all Henry David Thoreau.

<comment><USER6> > You cannot escape the data collection systems in our society without going > all Henry David Thoreau.

Or living suspiciously like a drug dealer (without money laundering).

</comment></comment></comment></comment></comment><comment> mark-r The author likens this to automotive safety, but I think a better analogy would be airline safety. When an airplane goes down, an immediate investigation is done by third parties to find the cause. Then remedial steps are drawn up and the entire industry is expected to follow them, not just the company involved in the accident. Data breaches need to be held to this standard.

<comment><USER7> This is a great idea I'm afraid will never happen.

<comment><USER8> I don't know. One airline disaster is arguably less _economically_ destructive than this breach. It could end a $70B company, or lead to a bailout, or ruin credit application processes for years causing the US economy to stumble.

Nothing makes things change faster than disrupting the money flow.

</comment></comment></comment><comment><USER9> You! You didn't pay a small bill 4 years ago because you changed address and a debt collector marked you as naughty. No loan for you! Hahaha! ... Oh, we just leaked all of your information. Ah well, today is a new day, ... dum diddly dum...

<comment><USER10> Fury!

</comment></comment><comment><USER11> The problem is incompetence in our industry. Anyone who has worked long enough knows that technical competency is not rewarded (outside a few rare firms) in software engineering.

<comment><USER12> You're oversimplifying. This has more to do with politics than SE technical competence. Banking software and systems are regulated end to end, because banking systems are literally the backbone of the global economy.

Equifax? Not so much. This exposure hurts consumers, but it doesn't even put a dent in the economy as a whole. That is why these firms are allowed to operate with such shitty security. If they get hacked, whatever, just a few hundred million customers data exposed to identity fraud. It takes a chunk out of Equifax stock but they'll probably survive. What is the incentive for congress to enact laws regulating corporate handling of consumer data?

Put it this way. Who do you think is louder in Washington: consumer advocacy groups or corporate lobbyists?

<comment><USER13> > What is the incentive for congress to enact laws regulating corporate > handling of consumer data?

The already did, it's called the Gramm–Leach–Bliley Act:

> In terms of compliance, the key rules under the Act include The Financial > Privacy Rule which governs the collection and disclosure of customers' > personal financial information by financial institutions. It also applies to > companies, regardless of whether they are financial institutions, who > receive such information. The Safeguards Rule requires all financial > institutions to design, implement and maintain safeguards to protect > customer information. The Safeguards Rule applies not only to financial > institutions that collect information from their own customers, but also to > financial institutions – such as credit reporting agencies, appraisers, and > mortgage brokers – that receive customer information from other financial > institutions.

Note the inclusion of CRAs.

<comment><USER12> GLBA was enacted in the 90s and is a vague set of guidelines for financial and related industries to follow. I'm talking about real system regulation, down to the level of protocols.

</comment></comment></comment></comment><comment><USER3> Now would be a great time to go long EFX in my opinion.

The stock has been slammed while Equifax is being flogged in the court of public opinion, but I doubt this leak will have any lasting financial impact.

Look at the result of the Target and Home Depot breaches: whether you like it or not, the companies are still technically the _victims_ here and no court is going to bankrupt them for data breaches that are more and more becoming the norm.

<comment><USER14> >but I doubt this leak will have any lasting financial impact.

I am going to have to stop you there. As someone who works in the financial sector, I have quite a different view of this situation. Best case scenario (for the organization) is that it is fined directly into bankruptcy and someone like FIS acquires them for pennies on the dollar. I am still waiting for CFPB to drop a nuclear bomb over this issue. There will be new PII regulations around the corner for sure.

I also question the extent of the leak... I keep hearing it was just basic PII, but if someone got a dump of the entire credit history database, a huge range of financial products (e.g. Knowledge-Based Authentication) become entirely compromised.

<comment><USER3> Equifax has an $18B market cap. Can you name one instance of a government imposed fine for improperly stored PII exceeding even $100M?

Furthermore, do you have evidence that the PII was improperly stored, or that Equifax's security practices were lacking in any way? The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that.

<comment><USER15> Having root on a web server shouldn't give you access to 147 million customer records.

<comment><USER3> I'm eagerly awaiting the technical details of the attack. If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well.

I'm wondering if Equifax is using Struts-provided REST for its entire architecture. If that's the case, gaining access to the web server was only the first step. From there the attacker could perform RCE on sensitive services.

<comment><USER16> _If it turns out that their web server has 100% unfettered access to the database then I 'll gladly pick up a pitchfork as well._

You may want to think twice. Try to design an architecture that doesn't have that. If you think it through, you'll realize the best you can do is not to deny access, but to monitor access so that any statistical deviation in requests-per-hour will trigger an alarm. Yet nobody does that, so why should Equifax have been a pioneer in this method?

This is the uncomfortable truth that everyone is obscuring here. There wasn't a solution. Equifax got owned, and they happened to have a trove of data. Everyone now wants to see their heads roll, but you too would find yourself in the same situation if you have an RCE on your servers.

<comment><USER17> > You may want to think twice. Try to design an architecture that doesn't have > that.

We have an architecture like that where I work. It's not that hard. Our web applications have very little direct access to databases; most of it is mediated by services downstream of the web app. That's certainly not a silver bullet, but it makes it impossible to exploit a RCE vuln in the web server in such a way that it lets you have arbitrary access to the database.

<comment><USER18> And let me guess. Those services give the webservers...the data that they ask for?

Once you've compromised a server, learning how to ask for the data you want is not hard. You have access to all the webserver's code, can make full dumps of communications occurring normally in the app, etc.

<comment><USER17> It's different, though. If my web server has direct database access, and it gets compromised, an attacker can go in and directly do "SELECT * FROM users" and get all my data in one go. If the database is behind a restrictive service, and they compromise just the web server, then they have to sit on the web server and pull each user record one at a time. And they might not even be able to, depending on search options -- like they might just be able to do "GET /users/{userId}", and if you don't know the user IDs, you get nothing (our user IDs happen to be randomly-generated 128-bit numbers, so searching through that space would take a while). Even if they _can_ get past that hurdle, the extra traffic it would require to pull down the full database with one request per user would certainly set off alarms, and doing it slowly enough to _not_ set off alarms would just take too long.

Of course, another option would be to use the web server compromise to then jump to the database service and compromise that box as well, but, again, more hurdles to jump means less of a chance of success.

Nothing is perfectly secure, but you can design systems with defense in both breadth and depth, and you can slow down or defeat many attackers that way. It's not about making Fort Knox, it's just about making breaking in more expensive than they can handle.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> We have the technology to manage credit in ways that are vastly more private and secure than a giant, poorly run, insecure personal data repository.

Using strong cryptography, we can build pseudonymous trust graphs where nodes in the graph (cryptographic identities) publish cryptographically auditable trust relationships. Using various graph exploration techniques (e.g. unrolling the trust graph into a trust DAG with known creditors as terminal nodes and calculating path properties to those nodes, using proof-of-burn and non-distributive path combination to disincentivize Sybil attacks on the trust graph, etc.) we can estimate trustworthiness (or, more specifically, creditworthiness) of cryptographic identities rather than legal identities. In the end, you're probably still going to want to link at least one cryptographic with your bank account, but you would have vastly more control over the relationship between privacy and public verifiability of trustworthiness.

If course, just because this is possible doesn't mean it's going to happen. The primary obstacles to an open, secure trust system are that A) it's harder to make people manage their own trust network than it is to spy on them B) trust networks rely on the network effect and C) there's no obvious way to make money off it. Any extant system that resembles what I've described is mostly limited to tech nerds. I'm not sure what it would take to trick/convince the general population to use such a system.

</comment><comment><USER20> PII is the nuclear waste of the internet. Incredibly expensive to store safely, and constantly vulnerable to a catastrophe.

<comment><USER21> And once it leaks, it's damn near impossible to clean up.

<comment><USER22> I feel like it's worth pointing out the the internet was a better place before people started using it for PII.

Credit agencies were about PII before the internet, but internet companies that collect all this PII toxify the internet.

</comment></comment></comment><comment><USER23> So how can I stop using Equifax? Or at the very least how can I find banks or other agencies that don't use Equifax? Is there any way to stop them from hoarding all my data without my explicit consent?

<comment><USER24> To my knowledge you can't stop, per se. If you're savvy you can avoid seeking credit from any institution that pulls Equifax, by asking from what CRA(s) your report will be pulled and simply walking out if they tell you they pull Equifax. This doesn't guarantee that they won't _report_ to Equifax, however, and it certainly doesn't guarantee that Equifax won't come up with the information by other means.

Unfortunately, also, it's safe to assume that Experian and TransUnion operate just as badly as Equifax, so attempting to live an Equifax-free existence probably isn't particularly useful. If Equifax does suffer for this leak, actually, it's a relatively safe bet that they will take security more seriously so as to better protect their interests.

</comment></comment><comment><USER25> Will the SSA (social security administration) office be issuing new numbers?

</comment><comment><USER26> "Most software failures and data breaches aren't inevitable; they are a result of neglect and underinvestment in product reliability and security."

How do we know that Equifax fell into this category? That this was due to negligence? I see a lot of disdain towards Equifax but yet the breach details have not been out yet.

<comment><USER27> The 6.66 billion dollar question.

</comment></comment><comment><USER28> Of all vulnerabilities that created massive amount of personal data leaks this may be the biggest but it is hardly the one caused by the most negligence.

Linkedin using unsalted sha hashes is a lot more maddening. Here you have a vulnerability being disclosed and not enough time to patch your code.

</comment><comment><USER29> Equifax played a slightly different version if this commercial during Monday Night Football a few times, it takes no accountability, but also doubles-down, claims your info might* be on the dark-web(*because they just negligently released it), and offers a "dark-web-scan" service to help find it...

[https://www.youtube.com/watch?v=vjrydnr_pvQ](https://www.youtube.com/watch?v=vjrydnr_pvQ)

<comment><USER12> Experian != Equifax

<comment><USER29> Thanks, that was my mistake I confused the two and didn't even notice before posting. Too late to delete my inaccurate comment(mods?). It certainly makes sense for Experian to advertise this service given their competitors recent leak.

</comment></comment></comment><comment><USER30> >> I'm still dealing with the damage to my credit rating that resulted when I forgot to return a library book and a collection agency was called in (for a paltry sum).

...

>>Zeynep Tufekci (@zeynep), an associate professor at the School of Information and Library Science at the University of North Carolina

You'd think she of all people would know better.

</comment><comment><USER31> Maybe this will finally be the "Three Mile Island Incident of Data" that Maciej Cegłowski talks about? If not, I don't know what will.

[http://idlewords.com/talks/haunted_by_data.htm](http://idlewords.com/talks/haunted_by_data.htm)

<comment><USER32> The 3-mile island of data leaks will happen when the ISP DNS lookups and browser history logs get matched up with the credit data and all the other datasets that are floating around.

</comment></comment><comment><USER33> Naive question from Europe. What's the influence such NYT article may have on the legislators?

</comment><comment><USER34> One more reason to move away from current financial system to bitcoin.

</comment><comment><USER35> That was so satisfying to read, it's rare that I come across a voice angrier than my own in the New York Times of all places. Makes me think there is hope this world won't fall apart after all.

<comment><USER36> Tufekci is a national treasure.

</comment></comment><comment><USER37> Whatever happened at Equifax was disastrous. But I really liked the way that they are containing it. Their CEO released a statement. They launched a specific site for security scans for their user for free. They are communicating it to their customers transparently.

With that I also saw that cyber security is and will be the biggest threats of the next decade. They are many cyber security companies these days but I didn't see a single company moving forward to support the Equifax team to figure out what happened and how it can be prevented. Cyber security companies should have volunteered for the cause.

<comment><USER38> > But I really liked the way that they are containing it.

Please let this be sarcasm...

> They are communicating it to their customers transparently.

They knew well in advance that there was an issue and did not communicate it well. They have 3 higher managers that look to have sold their stock based on the knowledge. There are some reports that they knew up to 3 months ahead of their announcement.

> They launched a specific site for security scans for their user for free.

Things that are wrong with this site:

\- The site screams "phishing" when you look at the URL.

\- Asks for SIX digits of your SSN. If you know the state of the person filling out the form and they were issued their SSN before 2011, you only need to try a few numbers to figure out their whole SSN.

\- Gives random results when you fill out the form

\- You possibly forfeit being able to sue them by filling out the form.

\- When you fill out the form they basically advertise their own product to you.

At this point, as a consumer, it feels like they are doing everything in their power to get away with not being held accountable for not storing this data properly.

8 in 10 US credit card holders have their SSN and possibly other information out there. This means that I'm at high risk to have my identity stolen in the future, not just the next twelve months that Equifax is offering me free Identity Theft Protection.

Last but not least, when you freeze your credit score, they give you a PIN to unfreeze it. But if you were to lose it, you'll only need some identification to get a new PIN and unfreeze it. But they've already released that identification and it's being sold around. So no luck there.

<comment><USER37> I accept my mistake in judging the situation. Thanks a lot for elaborating it. I agree to all your points.

</comment></comment></comment><comment><USER39> I just read about how the hack was done. Shockingly stupidly easy!

1\. They realized that Equifax uses Struts. 2. They modified struts!

and 3. Equifax used the updated code on their servers.

DUUUUUHHHHHH!

<comment><USER28> It is more: \- Critical remote execution bug was discovered in Struts2. \- The vulnerability goes public too quickly. \- Hackers start scanning the Internet \- Equifax is found vulnerable. \- Vulnerability is exploited.

<comment><USER39> $14 billion company cannot convert what the servlet API gives into a method call on a certain object + a bit of reflection to update methods & print them into form elements. Super complicate!

If the $14 billion can't do that then they certainly cannot protect data.

</comment></comment></comment><comment><USER40> _Americans woke up to news of yet another mass breach of their personal data._

Americans woke up to news of yet another mass breach of data about them.

FTFY

<comment><USER41> could you elaborate on what you mean by making this distinction, please?

<comment><USER42> People are being pedantic about the actual meaning of words as opposed to the commonly-understood-and-accepted meaning of words.

It's annoying, because it distracts from the immediate issue and causes confusion.

</comment></comment></comment><comment><USER43> It's a bit funny how it mentions these two things together in the same article:

> Today, almost every piece of software comes with a disclaimer on its user > license that basically says that the product may not work as intended […] > and that's the user's problem. It's a wonder companies don't insert "nyah > nyah nyah nyah" into the tiny-print legalese.

> No software system can be free from bugs […]

<comment><USER44> I read a consistent argument. Expecting perfection is wrong. Expecting consumers to shoulder the vast majority of the costs of that imperfection is also wrong.

<comment><USER45> _Expecting perfection is wrong._

There's 120 millions of lines of code in an A380, and planes don't crash due to software bugs. Why is it wrong to expect perfection in critical infrastructure?

Something went wrong somewhere in software engineering. My HP42s calculator has about 6 insignificant bugs that you need to get out of your way to trigger. Your new cellphone on the other hand, when you turn it on it downloads a gigabyte of updates! That's an outrage.

<comment><USER46> You're comparing a relatively cheap credit report to a $400 million dollar airplane with a 15-25 billion euro program cost. Not to mention aerospace has a 100 years of innovation and has actual lives at stake. The internet, what 30ish years? Not to mention network security is a relatively new concern.

<comment><USER47> With a market cap of $18 billion for Equifax, it seems like they had the resources to get this right. I see the difference as who shoulders the cost. If you pay $400 million for a defective plane, you have one company whose toes you will hold to the fire. If you lose data worth $400 million for 138 million people, you have about $2.89 average per compromised person, so no single person will really go that far out of their way to crucify you, and if one does, they have perhaps tens of thousands of dollars to use in the legal system holding you accountable, not the millions one large wronged party may spend on it. In aggregate economic terms, in actual loss and negligence, I don't see that much difference. If you want to steal a lot, steal a small amount from a large number of people. It looks to me more like a matter of the feasibility of getting away with it.

</comment></comment></comment></comment></comment><comment><USER48> "I'm not unsympathetic to the needs of software developers."

Yes she is. I read this as completely unrealistic expectations from the author. Struts is maintained by one person.

[https://github.com/apache/struts/graphs/contributors](https://github.com/apache/struts/graphs/contributors)

"Most software failures and data breaches aren't inevitable; they are a result of neglect and underinvestment in product reliability and security."

The attack happened in late July. The bug was fixed/reported in early September. It was a zero day. That's not neglect.

<comment><USER49> > _Struts is maintained by one person._

I see nowhere in the op-ed piece where Tufekci mentions Struts or implies that she holds Struts responsible for this. She is clearly laying this at Equifax's feet, and their responsibility in their choice of software and the industry as a whole for actively pushing against better software practices and responsibility.

The section you quoted is followed by:

> _Some number of unexpected errors — bugs — are unavoidable in computer > programs. It would be unreasonable to allow a consumer to sue a software > company every time a program suffered a glitch._

She's laying out a much more nuanced argument than you're given her credit for. You're right in that this seems to be zero-day which are more difficult to defend against, but there are practices (among them, defense in depth, and pen tests) which can limit the attack surface. Also actively looking for known exploit types (rather than specific exploit instances). For example, buffer overflows are a known attack vector in C, so people harden their code against buffer overflows. Deserialization attacks are known in Java, so people harden their code against deserialization attacks. SQL injection attacks are a known exploit type, so people learn to parameterize their SQL queries.

It's clear that this is something you care about and are passionate about. For topics that affect me like this, I consciously take a breath and re-read what I've reacted to, to see if my second (or third) read matches up with my first.

<comment><USER48> She's blaming the software industry and software failure. That's Apache, and Struts.

If she wanted to lay it on Equifax, she might go into the fact that the Chief Information Security Officer at Equifax holds a masters in music,

[https://www.hollywoodlanews.com/equifax-chief-security- offic...](https://www.hollywoodlanews.com/equifax-chief-security-officer/)

The people that actually "do" are Chief Peon of Cube Farms, doing whatever the boss with a music degree tells them is priority.

>You're right in that this seems to be zero-day which are more difficult to defend against

There's no nuance. It is under-reporting the facts to make her hit piece look stronger. It's never the leadership's fault when there's a failure in the US, but they happily take credit when there is success.

>but there are practices

Which don't help at all against a zero-day in a dependency.

<comment><USER49> > _She 's blaming the software industry and software failure. That's Apache, > and Struts._

I interpret her differently:

> _There are technical factors that explain why cybersecurity is so weak, but > the underlying reason is political, and it's pretty simple: Big corporations > have poured large amounts of money into our political system, helping to > create a regulatory environment in which consumers shoulder more and more of > the risk, and companies less and less._

> _This is a general feature of our lopsided world, but software businesses > (and the technology sides of other companies) have acquired perhaps the > greatest degree of impunity. Information technology arrived on the scene > only recently, so it has faced fewer of the kinds of regulations that > consumers and citizens, in more progressive eras, managed to impose on other > industries._

To me, that reads as taking corporate interests and business motives to task, not software practices. Software development (like any other work) is a cost, and businesses need to balance those costs against business revenues. I'd argue who's chosen for C-level positions is a business decision, not a software practice one. If the costs of failure in production due to bugs were higher, businesses would make different decisions in hiring and how much time was dedicated to security and bug fixing. Do you disagree? Testing and quality control is expensive. If we can roll out a feature (or just continue business) spending as little as possible on testing and QA, it can certainly be an understandable decision (whether or not you agree) to do as little QA and testing as possible: you're not providing any new features (which may increase revenues): you're just increasing cost.

> _It 's never the leadership's fault when there's a failure in the US, but > they happily take credit when there is success._

It's not clear to me which leadership you're referring to here. The government? The corporate leadership? Someone else? If the corporate leadership, I think that's entirely the point Tufekci is making.

<comment><USER48> >software businesses (and the technology sides of other companies) have acquired perhaps the greatest degree of impunity.

TIL: No warranty == impunity.

Nobody MADE Equifax use Struts. The source is open to inspection. The bug existed there for 8 years. Let's see how many audits Equifax did on the source code with no warranty.

>If the costs of failure in production due to bugs were higher, businesses would make different decisions in hiring and how much time was dedicated to security and bug fixing. Do you disagree?

If the costs were higher, the one poor guy working on Struts would do a better job? No, I think that guy would probably not write the software. He'd find a different line of work. If he did write it, he would never release it for the world to use for free. Who would do that? "Here's this thing I worked on for over a decade. You can use it for free. Please sue me if you have any issues. Thanks."

<comment><USER49> I'm sorry. I really think we're talking past each other. At this point I'm having a really hard time figuring out what you're trying to say.

I see you equating Struts and software practices with the businesses that use software. I see those as two separate things.

> _Nobody MADE Equifax use Struts._

Yup.

> _The source is open to inspection._

Yup.

> _Let 's see how many audits Equifax did on the source code with no > warranty._

I'm not sure why you're including this. I think they should have done source code audits in accordance with how they weighed the costs/revenues. Do you disagree? I personally tend to lean towards more tests and code analysis, but I understand others weigh this differently.

> _If the costs were higher, the one poor guy working on Struts would do a > better job? No, I think that guy would probably not write the software._

I place the responsibly with the company _using_ Struts in their product, not the Struts dev. I'm not sure how you're getting the impression I (or Zufrekci, for that matter) place this on the Struts dev. I'm responsible for the results of the applications I put into production, including the libraries I choose to use in that application. I don't hold generally hold the devs who wrote those libraries responsible.

Like I said, I think we're talking past each other. I still think you're reading too much into (and too little close reading of) Zufrekci, but I'm not sure how better to express what I'm trying to say. I've now read the piece through 3 times fully and I really don't see her making any of the points you're arguing against.

If you've got specific questions about what I've written, please ask. Otherwise, I'll sign off. Have a good evening!

<comment><USER48> >I place the responsibly

Nobody cares where you, or I, place it. You don't write for the NYTimes. You don't have that sort of sphere of influence.

>with the company using Struts in their product, not the Struts dev.

They don't.

[http://nypost.com/2017/09/08/equifax-blames-giant-breach- on-...](http://nypost.com/2017/09/08/equifax-blames-giant-breach-on-vendor- software-flaw/)

It's very easy to explain to the public. "Those software hacker people did this to you. Look, here he is. He made the faulty software. Burn him at the stake."

Zufrekci is with them, blaming the developer.

Developer licensure, here we come. Illegal to write open source software. Another one of those crazy Richard Stallman predictions that comes true while you guys sleepwalk into the dystopia.

[https://www.gnu.org/philosophy/right-to- read.html](https://www.gnu.org/philosophy/right-to-read.html)

<comment><USER50> Your line of comments is maddening, because you're clearly in total agreement with the article, yet seem to somehow be reading in almost the precise opposite of what its point was.

The author was not blaming the Struts guy. She was blaming Equifax, 100%. She would blame the decision to _use_ Struts and assume the _unavoidable_ risk associated with such a decision, not the development of Struts itself.

Literally every single point made in the article is about _Equifax_ dodging accountability for their choices, and Struts is never mentioned. What on Earth makes you assert with such total certainty that she's blaming the Struts developer?

<comment><USER48> "No software system can be free from bugs (or intruders), and users must be mindful of the risks. But the inherent lack of perfect automotive safety doesn't mean we don't try to make cars safer. Obviously, people should drive more carefully, but seatbelts, airbags and better car design reduce injury enormously, and that has been great for the industry as well as consumers. The software industry should be no different."

Let me translate that:

Software users, like people who use compilers, should need licenses. Obviously, people need to compile more carefully. Software needs the equivalent of seatbelts, airbags, and other government mandated safety standards. Software cannot JUST ship to github with no warranty or guarantees of safety. These licenses which absolve the developer of responsibility cannot continue to be allowed. Those open source developers should not just produce software for free, but they need to accept responsibility for it. They need to pass government mandated, Apple App store style, approval for all software shipped. Including regulations for safety and compliance with other laws like copyright infringement and decency standards.

She's attacking the foundation of the software freedom movement.

<comment><USER50> If I build an airbag in my garage, and Honda shows up tomorrow and puts it in their car, and it fails because I don't know how to make good airbags, I would not be legally liable for those failures. Honda, however, _would_ be. Your analogy does not hold up. You're reading some _very_ specific things into what is a very general statement.

I get why you'd be upset if she was attacking the things you say she is, but she is emphatically _not_ doing that. Every single paragraph in the article is about how _Equifax_ should be liable for _their_ software, which includes liability for the _decision_ to use types of open-source software.

<comment><USER48> >If I build an airbag in my garage, and Honda shows up tomorrow and puts it in their car, and it fails because I don't know how to make good airbags, I would not be legally liable for those failures.

[https://en.wikipedia.org/wiki/Takata_Corporation](https://en.wikipedia.org/wiki/Takata_Corporation)

<comment><USER50> If they have liability, it is assumed as part of their supplier contract with Honda. Open source software does not have this, and nowhere does the author suggest that should be the case -- they _certainly_ do not suggest such an assumption be _implied_ without a license, or _forced_ to be in all OSS licenses, which would be the only way your complaint makes sense.

<comment><USER48> >Open source software does not have this, and nowhere does the author suggest that should be the case

"the underlying reason is political, and it's pretty simple: Big corporations have poured large amounts of money into our political system, helping to create a regulatory environment in which consumers shoulder more and more of the risk, and companies less and less."

The author is suggesting a political solution. Regulation. Laws that say "Your open source license can't exempt you from a, b, c, d."

You could then exempt yourself from lawsuit in your open source license, but that will be automatically void, like a non-compete clause in a California employment contract. Struts would be sued for the breach in her imagined world.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


The Use of Knowledge in Society (1945) - <AUTHOR> https://www.econlib.org/library/Essays/hykKnw.html?chapter_num=1#book-reader <comment><USER2> TLDR: statistics only offer summaries, hiding things that may be very important. But these things can't be seen: you hit a complexity problem if you try to consider absolutely everything.

It's like when the curse of dimentionality meet big O notation, and you throw your hands in the air and give up - or satisfy yourself with simplest solutions, while knowing their limitations.

Note how this applies to all abstractions. They are generally helpful, but as the saying goes, the maps are not the territories.

Except in economics, economist try their hardest to ignore these limitations, even if they go against basic logic. It's hard for a man to understand something when his continuous employment is based on not understanding.

But a minimum wage will increase unemployment. There is no workaround. A price ceiling will cause shortages. There is no workaround. People get elected promising there are workaround, and people get paid by promising to deliver workaround, but it's just smoke and mirrors.

I find it funny when I see on TV they are now going to allow some compensation for organ donors to try to fix the organ shortage problem. Using insights from this paper from 1945 and basic econ, you can already say that it's an increase in the price ceiling, so it will improve shortages.

But there will always be shortages unless a market can exist. People who fight against basic logic will just have a little less blood on their hands. But if they can sleep at night and help politicians deliver fuzzy feeling to their electorate, I guess that's good enough to deserve their wage.

After all, people just want to be reassured that the dirty hands of capitalism won't be touching the beautiful world of love and kindness that medicine is, especially regarding organ donation (cue emotional music with people cuddling)

<comment><USER3> One interesting correlation with what you're saying: in AI programming, there is the concept of a "loss function", which is basically just a number that tells you how well your model is doing at a given task. For example, how well it's predicting the next word in a sentence. The lower the loss, the better the quality.

Or that's what everyone believes. Empirically that doesn't seem true. Just because your loss goes down, quality doesn't necessarily go up. It's a statistical correlation, but it's only a loose correlation at best.

So it's kind of doubly related here: not only is the knowledge a statistical summary, which hides the details of what's happening, but we also don't know a better way to do it. No one knows how to measure quality other than to show some samples to a bunch of humans, or to use the incorrect loss function.

I suppose the point is that it's very easy to _accidentally_ hide such complexities using math. No one intentionally sat down and said "I'm going to come up with a very imprecise loss function that gives a misleading view of how well AI models are doing." It just happened by default. And it seems like that might be related to your point of economists ignoring limitations, for example. The limitations are inherent in the statistical summary.

</comment></comment><comment><USER4> One of the greatest articles of all time. Deeper every time you read it. Planning will always fail at scale, this helps explain why and mitigate</comment>


Show HN: Crsh – A JavaScript based command line shell - <AUTHOR> https://crwi.uk/2020/07/12/crsh.html <comment><USER2> Hey I like it! But is it deno-only or also working on Node.js? The latter would be much _much_ more useful for me.

<comment><AUTHOR> Thanks! It's Deno only I'm afraid. I'm interested in what would make it more useful for you as a Node project (so that I can gather info on the sorts of use cases that would be good).

<comment><USER2> Hi thanks for the response. My use case would be to execute relatively small snippets of shell code/one-liners as part of an asset management pipeline without having to "shell-out" and invoke an external process, mostly at deploy-time, in a portable fashion, such as rendering a static HTML file upon change of dependent data, or rendering an image/icon from a vector format representation, and similar tasks. Requirements for shell control constructs are modest, but piping and redirection should work, as well as limited shell var/macros expansion, and maybe if/then. In Node.js-land, there's the shelljs package which is both an API for (synchronous-only AFAICS) shell-like ops (as in "shelljs.ls('file.???')" and a (very limited) shell syntax parser that could call those funcs from a string ("ls file.???") like yours as far as I can understand, but I guess yours is already more capable then the one shelljs uses. Still, shelljs is used as a dependency by quite a number of high-profile packages.

Node.js is much more useful simply because everything in js-land (asset management tools, web server backends) runs on Node.js rather than deno :)

<comment><AUTHOR> Sorry for the late response.

> execute relatively small snippets of shell code/one-liners as part of an > asset management pipeline without having to "shell-out" and invoke an > external process

This is indeed a small part of the value of my shell, though I wouldn't view it as the primary reason. I'm trying to make a nice experience for an interactive command line shell first, then will think about scripting use cases.

Blurring that line between shell + scripting is my intention, so it would be good to capture your case here at some point.

> Requirements for shell control constructs are modest, but piping and > redirection should work, as well as limited shell var/macros expansion, and > maybe if/then.

I'm struggling to understand one detail of your use case here. Is this a script (stored as some e.g. .js file), or something you'd be executing interactively? If the former, my shell does have as part of its library a suite of tools for executing shell commands (including piping + redirect) from within the Deno runtime. That would make something like the following possible:

const jsFilesInDirectory = await exec('ls | grep .js');

if (jsFilesInDirectory.includes('index.js') {

      // some logic

}

The above is also strikingly similar to shelljs, but my solution differs in a key way: where shelljs is re-implementing many commands, I've developed logic for parsing and evaluating any shell-like "pipe-separated" commands.

In any case, the primary intention of my project is to create an interactive shell, not a scripting language. That said, it would be possible to tease out and reproduce my logic to parse and execute piped commands in Node.js, to allow for a slightly more capable "shelljs" clone.

Hope that helps.

<comment><USER2> Yes, as I looked into your code, I was even tempted (in thought only, eg subconsciously feasability-checking) to fork/rip your shell syntax parser and plug it into shelljs to replace theirs ;)

To clarify, in my use case, the native asset meta-format for declaring assets and their relationships has a "field" where you can put in an external command to prepare the asset (such as minifying, sass compilation). Like in a Makefile.</comment></comment></comment></comment></comment>


Ask HN: What did you do to improve your reading ability? - <AUTHOR> If you had a hard time reading before (during childhood or maybe adulthood), how did you improve and get good at it? <comment><USER2> I've never struggled with reading so I may not have the perspective that somebody else might have, but I think like with most things practice makes perfect.

Reading as much as possible and progressively reading more challenging books should help with reading comprehension and speed.</comment>


Pretty Linux – desktop screenshots from 1999-2001 - <AUTHOR> http://prettylinux.tumblr.com <comment><USER2> how come we all became boring since gnome3 and unity</comment>


Linux Performance: Why You Should Almost Always Add Swap Space - <AUTHOR> https://haydenjames.io/linux-performance-almost-always-add-swap-space/ <comment><USER2> From my Linux desktop experience, I could not disagree more. When my 16GB ThinkPad runs out of memory, the OOM Killer blinks for a fraction of a second to kill the faulty process. If I had a swap partition, disk IO would render the system unusable for hours before the OOM Killer kicks in. Also, I don't want my SSD lifetime be sacrificed for a neglectable amount of better RAM usage -- on the desktop, I either run out of memory quickly (because my code makes mistakes) or I never feel the reach for 16GB of RAM.

On the server the situation is very different, and a few GB Swap on a spinning disc might be a good idea even when having 128GB of RAM.

</comment><comment><USER3> Disagree, on most of my systems I don't even have swap partition anymore. The few times I need it, I can just create a swap file on the fly and have any amount of swap memory.

Performance problems the author describes can be fixed 90% of the time by changing the dirty_background_ratio in the kernel as described here:

[https://linuxmaster.cc/s/improve_performance_and_fix_unrespo...](https://linuxmaster.cc/s/improve_performance_and_fix_unresponsive_systems_under_heavy_diskio_load)</comment>


The First Unix Port (1998) [pdf] - <AUTHOR> http://bitsavers.informatik.uni-stuttgart.de/bits/Interdata/32bit/unix/univWollongong_v6/miller.pdf <comment><USER2> I remember hearing this paper presented at USENIX 1998, in New Orleans.

IIRC, the most interesting part of the presentation was a slide titled "Is UNIX portable?" Miller said, of course it is, I ported it! But then he showed a chart with the number of lines of code in the distribution and the number he had to replace for the Interdata mini, and the proportion was quite large! His punch line was that yes, he had ported UNIX, but it wasn't quite so clear that you could call it portable.

</comment><comment><USER3> I did something similar, porting first V6 then V7 to the Vax some time starting in '79 ... The process started with writing a tar clone in fortran to get the C source off of the tape, luckily I had a C compiler for VMS ...

The result was a Unix that ran VAX native in a VM, each copy ran in a single VMS process ... Then I did V7, much easier the second time around

<comment><USER3> Oh, and that famous comment "you're not expected to understand this" .... Completely obvious about 2 months in when you come at it from the right direction (swapping a process in)

</comment></comment><comment><USER4> People interested in this will really like this:

[http://www.tuhs.org/](http://www.tuhs.org/)

<comment><USER5> Or this : [https://landley.net/history/mirror/](https://landley.net/history/mirror/)

</comment></comment><comment><USER6> Richard Miller is the same gentleman who many years later ported Plan 9 to the Raspberry Pi.

[https://www.youtube.com/watch?v=O7ZELOUIyvw](https://www.youtube.com/watch?v=O7ZELOUIyvw)

</comment><comment><USER7> Another paper disputes Miller's claim to priority: [https://archive.org/details/first-unix- port](https://archive.org/details/first-unix-port)

<comment><USER8> As far as I can tell, the paper you link definitely confirms the essence of what Miller Says.

The end of the link says _" We here at Bell Laboratories were truly dumfounded when this visitor from an unknown school in Australia reported his elegant procedure and remarkable success. Our own people took considerably longer to move UNIX to an Interdata machine, not because they were not as clever but because they had a different objective: a portable Unix rather than a UNIX port. But I think they'd . have blinked before undertaking the heroic effort that Richard Miller did and he did not even have a Unix computer to port from. "_

I cannot see that as any sort of dispute.

<comment><USER7> OK, good point. I probably misread it.</comment></comment></comment>


Ask HN: Ten step, hands-on Ruby programming course - <AUTHOR>

I have absolutely no programming knowledge, and have been wanting to learn RoR to hack at a couple person projects.
There have been some threads on here on learning ruby for the non-programmer, but I haven't been able to get a lot out of them since they seem to require a basic understanding of programming which I don't have.
Wondering if the above appsumo deal would be useful for an absolutely beginner. Any tips would be helpful, thanks guys. <comment><USER2> Ruby isnt the same as RoR.

Ruby is a programming language. Ruby on Rails is a web application framework.

<http://en.wikipedia.org/wiki/Ruby_%28programming_language%29> <http://en.wikipedia.org/wiki/Ruby_on_Rails>

I learned ruby on rails by buying a book from barnes and nobles and following online tutorials. no need to pay for a class.

</comment><comment><AUTHOR> Guess I should have included the link, sorry:

<http://www.appsumo.com/huw-collingbourne-ruby-course/>

<comment><AUTHOR> which book?

</comment></comment><comment><USER3> I'm interested in this opp as well... Curious if anyone else has tried the course they are promoting, or might suggest this as a possible way to learn Ruby for beginners.</comment>


Show HN: A daily aggregator of all junior level jobs - <AUTHOR> Hey Hacker News,
I made a job aggregator for entry-level positions that focus on students, recent grads, and individuals with less than 3 years of experience.
I mostly find dev jobs requiring 3+ years of experience and is a huge pain so I made this.
We recently launched our MVP last month and today we are launching V2 with a category based re-design. We will be adding filtering tags very soon. Please let us know if you have any questions or feedback.
Link: https://entrylevel.io <comment><USER2> Posts without URLs get penalized, so you'd be better off posting this with a link, then adding your text as a first comment in the new thread.

If you repost, email email@example.com when the new submission is up and we can make sure it doesn't get flagged.

</comment><comment><USER3> What are you using for your data sources? Searching for my city (in Europe) it's bringing up a lot of "head of..." level jobs, which are not junior by any stretch of the imagination. :)

<comment><AUTHOR> We are using APIs from Indeed, Remotok, Remotive, Muse, Stack Exchange, and a bunch of other ones. We will look into removing those. Thank you!

</comment></comment><comment><USER4> This seems really helpful especially now! Thanks for sharing.

<comment><AUTHOR> Yeah, no problem!

</comment></comment><comment><USER5> How convenient and helpful! Thanks.

<comment><AUTHOR> Thank you for checking us out!

</comment></comment><comment><USER6> The link brings me back here.

<comment><USER3> are you going to [https://entrylevel.io](https://entrylevel.io) ?</comment></comment>


Show HN: Data science with esoteric programming languages blog - <AUTHOR> https://andrewnc.github.io/blog/blog.html <comment><AUTHOR> Hey HN!

I started blogging back in November. I'm a data science / ML person by day and a programming languages lover by night. I combined those two interests with this blog.

I have several posts you may find interesting, I'd love feedback.

I'm sure there are many errors, so I'm pretty nervous sharing this with the world, but I'm proud of the work and hope you find it useful :)</comment>


Trylipstick - <AUTHOR> http://trylipisck.com <comment><AUTHOR> This was a friday project. Where I drenk a coffe got the idead. Registerd the domain implementd the library and publshed the site in the same day. Very proud of the results for one day. *I putmuch more time since then.... Noticed there are similar services provided by beauty companies after finished implementation :) How can I get this going?</comment>


Critical Behavior from Deep Dynamics: A Hidden Dimension in Natural Language - <AUTHOR> http://arxiv.org/abs/1606.06737v2 <comment><USER2> This seems like a very important paper, basically showing that Markov models with exponential decay of influence of tokens by distance are often a poor model, where as deep neural networks with LSTM (long short term memory) has power law decay of influence decay, which performs better for a variety of sequential data.

BTW, I went to the North American Association of Computational Linguistics conference in April and it seemed like half the papers used LSTM.

Edit: the NAACL 2016 papers are here: [http://aclweb.org/anthology/N/N16/](http://aclweb.org/anthology/N/N16/)

<comment><USER3> > This seems like a very important paper, basically showing that Markov models > with exponential decay of influence of tokens by distance are often a poor > model, where as deep neural networks with LSTM (long short term memory) has > power law decay of influence decay, which performs better for a variety of > sequential data.

As someone outside of this field, it seems to me that this kind of result should have been very obviously foreseeable, hindsight bias and all that of course - but I would never have considered Markov processes to be an adequate predictability model for natural language. Though obviously the formalized results are important.

Could someone with more knowledge comment on what the current working assumptions were prior to this paper and what the consequences would be?

<comment><USER4> > I would never have considered Markov processes to be an adequate > predictability model for natural language.

Would you consider LSTM an adequate model?

<comment><USER5> Personally, no. I think all of these models are essentially trivial and a long way from genuine NLP.

That doesn't mean they're not useful in very narrow domains. But language is pretty much the definition of the ultimate wide domain, and trying to cover it with statistical correlations makes as much sense as word counting Shakespeare to try to generate some new plays.

<comment><USER2> I think you might be pleasantly surprised by recent results using DL and LSTM for building models of natural language. The next advancement I would like to see is handling anaphora resolution (resolving pronouns to previous noun phrases in text, resolving words like 'there' to a place mentioned elsewhere in text, etc.) Progress has been so rapid that I bet I don't have to wait long.

<comment><USER6> Have you seen the results from Dynamic Memory Networks? [0]

The relevant example from the paper:

      I: Jane went to the hallway.
      I: Mary walked to the bathroom.
      I: Sandra went to the garden.
      I: Daniel went back to the garden.
      I: Sandra took the milk there.
      Q: Where is the milk?
      A: garden

Obviously just a toy task, but as you said, progress is rapid!

[0]: [http://arxiv.org/abs/1506.07285](http://arxiv.org/abs/1506.07285)

<comment><USER2> Thanks for the link!

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> > [...] A Hidden Dimension in Natural Language

Mmmh

> [...] We show that in many data sequences — from texts in different > languages to melodies and genomes

Hum, ehrm

> [...] natural languages are poorly approximated by Markov processes.

Alright, alright

> [...] This model class captures the essence of probabilistic context-free > grammars

Ok, ok

> [...] and cosmological inflation

Wat.

Out of nowhere, Creation of the Univerve.

\</comment><comment></comment><comment>-

I'm always baffled by the ability to draw parallels. Did a colleague take at peek at the screen and said, hey I have the same equations?

<comment><USER8> > Did a colleague take at peek at the screen and said, hey I have the same > equations?

This would an interesting thing to try - a computer system that would scan all the papers for math and find parallels. I think we already have something like term indexing for deductive systems?

<comment><USER9> This is theoretically very possible, and I know that at least a few people ([http://ccimi.maths.cam.ac.uk/projects/create-semantic- search...](http://ccimi.maths.cam.ac.uk/projects/create-semantic-search- engine-mathematical-literature/)) are working on it.

<comment><USER8> Very yummy, thanks!

</comment></comment></comment></comment><comment><USER10> I wonder what programming languages look like? I'd guess a lot like natural language?

<comment><USER11> Not quite, but as the paper says:

        Corollary:  No  probabilistic  regular  grammar
        exhibits criticality.

        In the next section, we will show that this statement is
        not true for context-free grammars (CFGs).

That is, there exists CFGs that exhibit criticality. Programming languages are often parsed by CFGs, so it's likely that some programming languages exhibit the same criticality structure as natural languages.

<comment><USER12> I think that means only that programs written in a language described by a CFG _could_ exhibit "criticality", not that they will. "Exhibiting criticality" is a property of a distribution (e.g. a corpus of human-written programs or an algorithm for generating programs), not of a grammar, IIUC.

</comment></comment></comment><comment><USER13> Here's an implemented Markov + word2vec chatbot [http://lexcognition.com/lexi.html](http://lexcognition.com/lexi.html)

<comment><USER14> I am VERY impressed:

\-----

you: tell me something

me: Don't speak for me first time I asked it

you: tell me about your mother

me: just like my mother is on that AK47 diet

you: Tell me about artificial intelligence

me: Okay , maybe not intelligence capabilities, etc

you: ask me something

me: _Points bow_ No one would ask this haha

</comment></comment><comment><USER15> hmm...maybe the way we then encode data digitally is also "wrong" or should I say unnatural.

<comment><USER8> It seems to me that if we humans are the only ones doing this, it is either trivially natural or trivially unnatural based on whether you include or exclude our creations in/out of the natural world.

</comment></comment><comment><USER16> "... which explains why natural languages are poorly approximated by Markov processes."

Is that a joke? It's 2016 and you think you need to explain that a Markov process is a poor approximation of natural language? This has been obvious for computational linguists, and anyone working in the field, from day one.

</comment><comment><USER17>
      The Bach data consists of 5727 notes from Partita No. 2 [11],
      with all notes mapped into a 12-symbol alphabet
      consisting of the 12 half-tones {C, C#, D, D#, E, F, F#, G, G#, A, A#, B}
      with all timing, volume and octave information

discarded.

I was good until the last part.

<comment><USER18> Can you elaborate?</comment></comment>


Cyfly cycling technology - <AUTHOR> http://moeve-bikes.de/en/cyfly/ <comment><AUTHOR> I'm not associated with the company but find this concept interesting. From the website:

 _The mechanical crank drive system for bicycles was invented around 150 years ago and has hardly been improved since. We took the drive system further and developed the cyfly Easy Cycling Technology_

Kind of funny (but not that surprising) is that there seems to be an automotive company involved in the research.

</comment><comment><USER2> I can't find any details about the internal parts of the crank. Do you have a link to a more technical description of the system?

<comment><AUTHOR> Not sure. I just saw the animation which shows roughly all parts: [http://moeve-bikes.de/en](http://moeve-bikes.de/en)

<comment><USER2> Thanks. It's not extremely clear but it's possible to see more details here.</comment></comment></comment>


EU plans to plant 3B trees and expand organic farming - <AUTHOR> https://www.newscientist.com/article/2244115-eu-plans-to-plant-3-billion-trees-and-massively-expand-organic-farming/ <comment><USER2> I wonder why organic farming is so popular. Wikipedia says:

1\. "Researchers at Oxford University analyzed 71 peer-reviewed studies and observed that organic products are sometimes worse for the environment."

2\. "According to a 2012 meta-analysis of 71 studies, nitrogen leaching, nitrous oxide emissions, ammonia emissions, eutrophication potential and acidification potential were higher for organic products"

3\. "The Oxford meta-analysis of 71 studies found that organic farming requires 84% more land for an equivalent amount of harvest"

4\. "there is insufficient evidence to make claims that organic food is safer or healthier than conventional food"

The list goes on: [https://en.wikipedia.org/wiki/Organic_farming](https://en.wikipedia.org/wiki/Organic_farming)

<comment><USER3> A problem is that insecticides and artificial fertilizer (two main things not allowed in organic farming) cause ecological problems in the region where the farm is located, _even if_ organic farming would need more farm land in total and would thus destroy nature elsewhere.

Many crops are better grown in greenhouses, where pests can be kept out or controlled without pesticides, and plants can be grown in stone wool and given exactly the nutrients they need. That should count as organic, but unfortunately doesn't.

<comment><USER4> Organic farming uses pesticides as well. Are they safe for the environment? We don't know because they're organic and therefore must be safe. See links within: [https://theness.com/neurologicablog/index.php/organic- pestic...](https://theness.com/neurologicablog/index.php/organic-pesticides/)

</comment></comment></comment><comment><USER5> > _"The biodiversity strategy is essential for boosting our resilience and > preventing the emergence and spread of future diseases such as zoonoses. > Because by destroying nature at an unprecedented rate, and now with around 1 > million species at risk of extinction within only decades, we literally > threaten our own life, our health and our well-being," he told a press > conference._

This doesnt even make logical sense. As a EU resident i wasn't ever informed of an EU Green Deal etc. Either this isn't happening, or it's being vastly exaggerated. (and in any case organic farming is not about natural biodiversity, it's a frankenstein/zombie policy). If anything i 'd think this is the time to get serious about biotechnology

<comment><AUTHOR> >> _As a EU resident i wasn 't ever informed of an EU Green Deal etc. Either this isn't happening, or it's being vastly exaggerated._

I understand your anger for not being informed or asked. But a lot of countries are trying to reforest and clean the air. [https://en.wikipedia.org/wiki/Reforestation#Implementation](https://en.wikipedia.org/wiki/Reforestation#Implementation)

<comment><USER5> AFAIK, nature is pretty very good at reforesting itself if you leave the land alone. But if you expand organic farming, which doesnt scale, you 're making it worse

</comment></comment></comment><comment><USER6> Just dived in[1], but apparently this isn't so much a plan as a plan to have a plan. In particular it mentions a EU Forest Strategy to be proposed in 2021. You know, it sounds "nice", but here's the pet peeve I have whenever I hear about reforestation efforts nowadays: there's no talk about making sure the trees in the forest are themselves, y'know, biodiverse. It's easy to plant a lot of trees if they're all the same species, clones, etc. but the problem is you end up with a forest that isn't so resilient to either natural disaster nor disease. Entire crops of trees have been wiped out before because the, to put it mildly, economical approach to getting things done quickly meant just planting a lot of the same species of tree.

Well, I guess we'll see next year what their EU Forest Strategy is, I hope they take biodiversity in the flora as seriously as biodiversity in the fauna.

[1] [https://ec.europa.eu/info/sites/info/files/communication- ann...](https://ec.europa.eu/info/sites/info/files/communication-annex-eu- biodiversity-strategy-2030_en.pdf)</comment>


Ask HN: Do animals grasp the concept of solid-liquid-gas? - <AUTHOR> I'm curious if there are specialists out there knowing if animals understand the concept of solid to liquid to gas phase changes?  Is this an "advanced" concept for animals or do they intuit this? <comment><USER2> How would we determine whether an animal understands something? Presumably you could do experiments which test whether they can predict what will happen — eg if a thirsty monkey collects ice, expecting it to melt. (Although you can obtain water by licking ice, so maybe that's not a good example.)

Anyway my prediction would be that many colder-climate animals have some intuitive grasp of the ice to water transition specifically because it's so important to their lives. I would not expect them to understand water to steam since it's not something they're likely to encounter — even those who live near geysers have no reason to know that steam is actually water, they just need to know they should stay away from it. Many animals would understand the relationship between clouds and rain, though.

I wouldn't expect them to understand phase changes in any material other than water, since it's hard to think of examples where phase changes actually occur in animals' natural habitats.

<comment><USER3> > How would we determine whether an animal understands something?

Alison Gopnik's _The Philosophical Baby_ is full of remarkable experiments to determine what babies understand. (At least, I assume it is! I haven't read it - just saw her give a talk about the book and her research when the book came out, and she talked about lots of different experiments.) Stuff like showing babies white and black balls going in a container, then when one is picked out, the babies look longer at it if they're surprised, if it's an unlikely event. They have much better models of probability younger than anyone thought. Or they show them animations of dots shaped like Momma dot and baby dot, and see how the babies react when various things happen to the baby dot.. Totally ingenious. A lot of them, or something similar, could be done with animals; I wonder how much has.

</comment></comment><comment><USER4> My money's on No, because of a slightly related psychological concept: _conservation_.

Conservation is the cognitive understanding of whether or not the amount of a given (inert) solid or liquid will change despite its presentation. For example, human toddlers don't grasp conservation, and will erroneously believe that pouring water from a tall glass into a wide bowl makes more water, since it "looks" bigger in the wider container (e.g. it takes up more visual space in a wider vessel, and therefore must be "more"). No other animals possess this skill either (thank you Wikipedia [0]).

Combine that with the nebulous nature of gas - it's not intuitive to understand that an empty glass is, in fact, full of air - and understanding phase changes become that much more difficult.

It's kind of like how most people won't intuitively understand how discrete phases can break down at higher temperatures and pressures, or the differences between different lattice configurations of the same substance. If it's not something we encounter every day, or aren't taught at an early age, the intuition simply won't be there.

[0][https://en.wikipedia.org/wiki/Conservation_(psychology)](https://en.wikipedia.org/wiki/Conservation_\(psychology\))

</comment><comment><USER5> It's a very interesting question. I guess big apes can, but I have no proof at all. Also, the extension of the question to the ice-water transition in the other comment is interesting too.

Anyway, the first thing that came to me mind was " _Causal understanding of water displacement by a crow_ " [https://www.youtube.com/watch?v=ZerUbHmuY04](https://www.youtube.com/watch?v=ZerUbHmuY04)

</comment><comment><USER6> Even humans grasping the concept of solid-liquid-gas is a very recent historical thing, only happening in the last several hundred years after millions of years of human development.

Therefore, I doubt greatly that animals would ever understand that concept. They might catch a glimmer of the truth, in the ice/water model, but not the whole concept.

<comment><USER7> > Even humans grasping the concept of solid-liquid-gas is a very recent > historical thing, only happening in the last several hundred years

I bet people were heating up ice to melt it to get water way before that...

<comment><USER4> Yes, but did they understand that the change occurring was a physical one, rather than a chemical one? As opposed to cooking other forms of food and beverage save for ice, which would fall under chemical reactions rather than phase transition.

</comment></comment></comment><comment><USER8> FWIW, I've had puppies discover ice in the outside water dish, and work out that if they bring some inside it should go into the inside water dish. I don't think any have figured out why it vanishes then.</comment>


Facebook acquires VR studio behind 'Lone Echo' - <AUTHOR> https://techcrunch.com/2020/06/22/facebook-acquires-vr-studio-behind-lone-echo/ <comment><USER2> Interesting. I've got mixed feelings about this, as Echo VR (multiplayer) is definitely one of my most played VR games. If you have a VR headset, it's definitely something worth checking out.

On one hand, "boo facebook", on the other, hopefully this will give the Ready At Dawn developers a chance to deliver an excellent Lone Echo 2 experience without worrying so much about financial stress.

Again, if you have a chance, Echo Arena and Echo Combat are in my humble opinion, the absolute best VR games on the market today, rivaled only by HL: Alyx. The unique zero-g locomotion is something that needs to be lived to understand. Being able to just grab onto any surface, push yourself off in the direction you want to float, and then mix it up with thrilling ender's-game style gameplay is something so completely amazing (albeit, nauseating to some) that I'm surprised that it is not much more top tier and talked about much more.</comment>


Ask HN: Julian Assange Is Under Arrest. Who Will Continue Wikilens? - sahin-boydas <comment><AUTHOR> Likely someone that knows how to,

SplinterItIntoAThousandPiecesAndScatterItIntoTheWinds

and how this applies to a certain file that has been going about.

</comment><comment><USER2> Wikilens is an old university project by a now Google employee. It already finished when he went to Google.

</comment><comment><USER3> Vladimir will figure something out</comment>


Did HFT 'Quote Stuffing' cause the crash of 5/6/10? - <AUTHOR> http://www.nanex.net/20100506/FlashCrashAnalysis_Intro.html

<comment><USER2> Thats what the analysis at nanex points to. It's basically denial of accurate timely quotes across exchanges. Don't know if was an actual "attack" and weakness in the system or just a random event and weakness in the system.

[http://www.nanex.net/20100506/FlashCrashAnalysis_Part4-1.htm...](http://www.nanex.net/20100506/FlashCrashAnalysis_Part4-1.html)

</comment><comment><USER3> Applying my electrical engineer perspective to the Part 4 graphs, it looks like this scenario may have happened:

1\. Somebody's trading software was issuing quotes based on recent quotes, forming a feedback loop.

2\. The feedback loop was calibrated in a half-assed empirical way by somebody who did not understand control system theory, and did not even know they did not understand it.

3\. The overall system developed a delay somewhere in that feedback loop.

4\. The delay exceeded the phase margin of the system, turning their half- assed negative feedback into positive feedback.

5\. Positive feedback -> oscillation. This triggered massive quote volume, keeping the backlog high and therefore keeping the oscillation going.

6\. The quote volume put loop delay on quotes on other issues, pushing them into negative phase margin, causing the trading software to oscillate with them too.

7\. Avalanche!

The solution is to add a 50 picofarad capacitor between the traders and the stock exchange. ;-)</comment>


Infocom's Unreleased Sequel to Hitchhiker's Guide to the Galaxy - <AUTHOR> http://waxy.org/2008/04/milliways_infocoms_unreleased_sequel_to_hitchhikers_guide_to_the_galax/

<comment><USER2> That was a pretty depressing read. I need my towel...

</comment><comment><USER3> This game inspired me to write YAZI!

[http://web.archive.org/web/20030811081833/scrawlsoft.com/pro...](http://web.archive.org/web/20030811081833/scrawlsoft.com/products/yazi/info.html)

Playing HHGTTG on a Newton was almost self referential.

</comment><comment><USER4> i played the original game, when it was released, on my ibm pc clone. this was long before the internet, so information wasn't as free-flowing back then. i remember hearing a bunch of "reasons" why the sequel wasn't coming out, but nothing like this.

</comment><comment><USER5> You can play the original game here:

<http://www.bbc.co.uk/radio4/hitchhikers/game.shtml>

I wouldn't call it fun though. It's not a sandbox like GTA. You basically have to read the minds of its creators to make progress.

<comment><USER6> What makes the Hitchhiker's game good is the writing. It's kind of like reading a book, only more masochistic. Games over time have learned to scale up the sadism and dial down on the masochism. GTAIV and The Hitchhiker's Guide are probably at exact opposites on this spectrum.

See the next game Douglas Adam scripted, which might be the most masochistic game of all time.

<http://en.wikipedia.org/wiki/Bureaucracy_>(computer_game)</comment></comment>


Mostly Lost: A children's book that teaches programming without a computer - <AUTHOR> http://www.laurenipsum.org/mostly-lost <comment> guard-of-terra Off topic.

But the idea of "summer school" I've picked from the first page is so terrible that it hurt me badly just by reading it.

"Extra classes are how to get ahead, mom said." - Why should a child care about "getting ahead"? Now adults don't get enough of this so we have to torture children too?

Will probably be sad for the rest of the day.

<comment><USER2> This thinking is very common amongst a certain class of parents. Trying talking to parents of children in private school. They are often hyper- competitive; constantly comparing their children against their classmates and forcing them from an early age (primary level) into extra classes to 'get ahead'.

This was once summarized for me by someone in Palo Alto as "it's either Harvard or the gutter".

<comment><USER3> People in the UK will move house to get into the catchment area of a good (free) school. Not just secondary school (ages 11 to 16) but for primary schools too (ages 5 to 10). That's an investment of hundreds of thousands of pounds for something which (at primary school ages) doesn't appear to have much of an evidence base.

I haven't heard anyone saying "It's Harvard or the gutter", but they're similar.

<comment><USER4> I'm intrigued that you didn't anglicise to "... Oxbridge or the gutter". Is Harvard now both as well known as and more prestigious than Oxbridge in the UK?

<comment><USER3> I'm just lazy, that's why I didn't anglicise. I would think that Harvard is as well known as Oxbridge. I'm not sure about the other Ivy League colleges.

</comment></comment></comment></comment></comment><comment><USER3> A nice idea, but I'm not convinced. I'd be interested to see an excerpt that taught an actual programming concept. See also "The Number Demon" (Or devil - ([http://www.amazon.co.uk/Number-Devil-Mathematical- Adventure/...](http://www.amazon.co.uk/Number-Devil-Mathematical- Adventure/dp/0805057706\))) which could have been brilliant but has a few problems.

Still, good luck! Anything that helps teach programming thinking is probably a good thing.

<comment><USER5> Out of curiosity, what were the problems with The Number Devil? I remember reading it when I was younger and felt I had a good grasp on how things were presented.

<comment><USER3> Just my personal opinion: I didn't like the way that names of people and theories were changed to other stuff; and it can feel a bit repetitive with the dialogue. I'm not saying the book is awful, and I know other people will think it's good.

<comment><USER6> I loved that book but you're right. The punny names for things were too cute and did not translate well from the German, despite heroic effort. I gather that they are a bit strained even in the original, eg calling a square root a "radish".

To give the puns in Lauren Ipsum a fighting chance, I hewed closer to Latin roots and avoided homonyms and homophones. We'll see how it goes.

</comment></comment></comment></comment><comment><USER6> Thank you for the response! Some general comments: this book does not try to explain all of computer science. There's already a guy working on _that_ book, and it's taken him 50 years so far. Laurie does learn some programming in the book. Mostly she learns the little things that programmers take for granted, like how to put yourself in the state of mind for debugging.

<comment><USER7> Just thinking about what you wrote; I think that it would be really nice if someone wrote a book for adult programmers about the opposite thing: how to get yourself out of the state of mind for debugging when you go home.

</comment></comment><comment><USER8> This seems like it would teach kids meaningless (to them) terms and concepts they aren't ready to understand yet.

It'd be more interesting if it brought programming challenges into the context of the daily life a child but it seems to just define things as is. For example, the travelling salesman section just defined what a traveling salesman problem is.

</comment><comment><USER9> After a read-through, the writing seems a bit self-consciously clever, the humor seemingly intended to pat the "savvy" adult reader on the back. This chapter anyway doesn't strike me as something particularly useful for educational purposes.

</comment><comment><USER10> I actually did learn to program without a computer. At that (late 80ties) time my country was still a part of USSR, computers were rare and we had none at school. The programming class we had was meant to be taught without a computer, and it included all the necessary concepts, so we learnt about algorithms, variables, loops, etc. Later, when I finally got to use a computer all I needed to find out the particular syntax to use, I could program already. I am not sure though whether my first "real" language did spoil me beyond repair as some claim (because it was BASIC, MSX BASIC) or if does not count, because the first language I did program in was not BASIC but rather some pseudo code.

<comment><USER11> Very early on, not long after that first memorable 3-line BASIC program that printed (!) a sine wave on paper, Dad had me work thru a book on programming - no computer. Every page had an assembler-style command in the corner, and I learned much by "running" the program by hand, flipping hither & yon thru pages whilst scribbling down numbers in "registers" on paper. Don't remember the book's title or the program's function, but it did make a big impression - and was a lot of fun.

</comment></comment><comment><USER12> Interesting read and an interesting idea. When I was through the first read, my comparison for what I had just read was that it reminded me of 'The Phantom Tollbooth.' Thanks for posting and good luck with the project.

<comment><USER13> Yes part phantom tollbooth and patr lewis carroll. With a Dash of Diamond Age- esque Primer. I don't know, but I think my 8 year old daughter might rather like this.

Tempted.

</comment></comment><comment><USER14> Children Finland do not go to school all-year-round. They used to have world- record 3 months summer vacation. Also special 1-week skiing holiday in winter. In addition to regular christmasses and passovers.

<comment> guard-of-terra I believe that all of the ex-USSR has 3 month summer vacations for schools, too.

Plus three smaller week-long vacations during the rest of the year.

<comment><USER15> I can confirm that. Here we have 3+ month of summer holiday(may25-sep1) and 3 holiday periods(more than one week) during the year. Also in Singapore they normally have 3 months summer holiday at university(student in Singapore uni myself)

</comment></comment></comment><comment><USER16> "A little Jargon doesn't look like much. Some people even keep them as pets. But they form packs, and they are very dangerous."

It's probably one of those children's book that grown-ups love. As a child, you might feel a little betrayed once you grow up and learn it's "just about programming".

</comment><comment><USER17> In theory the iPad could be the perfect device to build an app for learning children to write simple programs, however apparently the Apple policy does not allow running an interpreter as part of an application, and technically speaking such an app should allow to visually build simple programs that are interpreted, so I guess, game over, but it is a huge lost opportunity.

<comment><USER18> Apple allows plenty of interpreters -- Lua, Frotz, C64 emulator, BASIC interpreters, etc. They relaxed their policy about a year ago. I doubt they're going to reject an educational app that teaches programming.

</comment></comment><comment><USER19> I have a hard time believing this does what it claims.

<comment><USER20> Agreed.Book seems quite complicated and filled with jargon.

<comment><AUTHOR> I've worked with children, and I've watched them pick up new, nonsense and specialist words faster than I have, and deduce or divine their meaning and usage with amazing accuracy.

Plural of anecdote is not data, but your comment is in contrast to my personal experience.

<comment><USER21> Agreed. My kids (aged 6 and 8) picked up rock climbing jargon from my wife and I (and our friends) rather quickly, and began using it in the proper context. Nothing turns heads like a five year old asking "mommy, did you send that boulder problem?"

<comment><USER22> I've done a little climbing but can't parse it ... so what did the mother do to the boulder problem?

</comment></comment></comment></comment></comment><comment><USER22> In what way does a list of jargon teach programming?

Would you "teach cookery without a cooker" by listing ingredients? Seems very strange.

Also, few of questions on the language:

1) "and there was no one [to] tell her different."

Shouldn't this, typo aside, be "differently"? It's modifying how she was told. I see this usage a lot but it seems wrong to me.

2) ""Gether!" it said."

The others are repetitions of the sounds she makes but not this. Is this some sort of joke that I don't get? 'Gever' or 'get her' doesn't parrot "get there".

3) Along the same lines, some of the words spoken by Argot the dog-mouse are given as if they are onomatapaiea, but not all. He doesn't hamilton the word 'Hamilton' he only says it. This seems quite inconsistent and frankly as if the author is trying just a bit too hard to be like Edward Lear.

4) Does all the jargon also have a programming meaning, I know several of the terms as computing terms but also several more as non-computing terms.

Can you tell I don't like it. I love nonsense poetry and Alice in Wonderland (the original I think has too much prattling on for kids generally however), am a fan of books like Sophie's World, but this doesn't do anything for me. I'm not the target audience though for sure.

</comment><comment><USER23> For children? I'm pretty sure any child I give this to will draw on it and not understand a word of it.

<comment><USER24> Strange creatures saying nonsensical strange words ? They will love it. I know I would have as a child.

<comment><USER4> ... nonsensical words which just happen to be computer jargon? It's been done: <http://www.textfiles.com/humor/COMPUTER/aliceunix.txt>

<comment><USER23> I stand corrected!

</comment></comment></comment></comment><comment><USER25> My dad learned IBM assembler and COBOL from the IRS in 1968. When I, at age 10 in 1970, asked him what he did at his job, he handed me an IBM Principles of Operation (POOP) manual, an IBM green card, and a stack of punched cards with a program encoded thereupon. "Mostly Lost" is OK for today's yute, but I'm sure glad the magical mystery fairy tale school of learning was not in operation when I cut my programming teeth.

</comment><comment><USER26> Is anyone else getting a "Quota Limit" when they click the screen?

</comment><comment><USER27> Children program everyday. Give em a say. Defining yourself is programmatic self-worth: domain naming, contextual reframing, good thoughts.

I love Mostly Lost in name and a potential moral articulation, insofar leading us towards a gray truth - computers obey words, humans do not and words govern everyday. Words force us out onto a (new) page.

Is it psychologically healthy and sane, giving inner voice programmatic say over your domain and system, at any age?</comment>


How do you make money from ads on your site? - <AUTHOR>

<comment><USER2> One thing to try is providing unique, high-value content with properly placed ads that are relevant to the topic being discussed.

<comment><AUTHOR> well, yes, but what method is best? google's adsense, yahoo's publisher network, or selling the ad space yourself?

<comment><USER3> Try all of them... Google, Yahoo, Microsoft, Adbrite. See which one works the best. It doesn't become economical to sell the ads yourself until you get bigger, at which point it is much better to sell the ads yourself.

</comment></comment></comment><comment><AUTHOR> i'm going to launch a free web service, and wondering what method of getting paid for ads is best. i heard adsense is starting to yield diminishing returns these days.</comment>


Show HN: Get Personalized Relocation Tips Before Moving to 15 Countries - <AUTHOR> https://relocate.me/relocation-tips/page-form?hackernews <comment><USER2> I filled in the form and was immediately met with a login form. No thanks and also made a mental note to never visit this site again.

There's zero reason I should need to login to see these tips.

<comment> proto-n Also, you don't even know what kind of tips you are going to get. I kind of understand that the site wants my info for whatever selfish reasons, but it really fails to present what I'm getting in exchange.</comment></comment>


30,000-year-old giant virus 'comes back to life' - <AUTHOR> http://www.bbc.co.uk/news/science-environment-26387276 <comment><USER2> The scientist they interview, Jean-Michel Claverie, has done a lot of work in the large DNA-virus world, along with Didier Raoult. One of his best papers IMO ([http://dx.doi.org/10.1186/gb-2006-7-6-110](http://dx.doi.org/10.1186/gb-2006-7-6-110)) goes into some theories about viruses. Basically, these nucleocytoplasmic large DNA viruses (NCLDVs) look quite a lot like a nucelus in their infected amoeba targets. On some level, going back, who's to say that the nucleus wasn't just some big, DNA virus that stuck around? The parallel to the mitochondria/chloroplast theory is kind of neat to boot. Definitely worth a read.

</comment><comment><USER3> Well this is a potential side-effect of global climate change/warming that I had never considered... And I don't know this for sure, but off the cuff, I'm betting neither have 7,999,999,000 or so of the 8 billion people on the planet.

And I'm not talking about the Godzilla-esque viruses, but the possibly dormant but not dead strains of smallpox, etc.

Great illustration though - we may not have eradicated any viruses on the planet - just on the surface. (Paraphrase the article.)

<comment><USER4> I always wonder where people get these numbers. From what I understand, census bureaus, etc, still only say there are 7.3 billion people on Earth. Where are you getting the other 700,000,000?

<comment><USER5> Perhaps exact figures were not the point of the comment.

</comment></comment></comment><comment><USER6> Sort of an aside, but Radiolab recently had an episode about the relatively new class of giant "as big as bacteria" viruses. This appears to be one of those. I found the episode fascinating.

[http://www.radiolab.org/story/shrink/](http://www.radiolab.org/story/shrink/)

</comment><comment><USER7> Good post. Though it doesn't really make the distinction that these giant viruses are actually very different from normal viruses. They may have actually "reverse-evolved" from bacteria, and may not even be related to regular viruses.

For anyone who listens to podcasts, there is a great Radiolab about their discovery.

</comment><comment><USER2> Might be worth noting that story is from March 2014.

</comment><comment><USER8> Okay this could be a new hollywood introduction to an end of the world scenario. Hopefully we will make it to the end of our days without a zombie outbreak or another end of the world scenario :D

<comment><USER9> Wasn't this the plot of Prometheus more or less?

</comment></comment><comment><USER10> "The Dwarves delved too greedily and too deep. You know what they awoke in the darkness of Khazad-dum... shadow and flame."

<comment><USER11> Tell you what, if the oil companies unearth a Balrog I'll be joining Greenpeace day and date.

<comment><USER12> I'd take one Balrog over what they've _actually_ unearthed.

</comment></comment></comment><comment><USER13> "It comes into the cell, multiplies and finally kills the cell. It is able to kill the amoeba - but it won't infect a human cell."

Haven't there been brain eating amoeba's?

[http://www.webmd.com/brain/brain-eating- amoeba](http://www.webmd.com/brain/brain-eating-amoeba)

</comment><comment><USER14> I think it's amazing because, well, what technology do we have that could "come back to life" in 30,000 years frozen?

Nature showing how diverse and robust some of its work is.

</comment><comment><USER15> Is there any reason to be worried about the ice caps harboring viruses that could potentially wipe us out?

<comment><USER16> Well, since they're practically wiped out and we're not, I'm not too worried.

</comment></comment><comment><USER17> I love it when scientists assure us of our safety.

<comment><USER14> That's not really their job. There might be scientific facts that threaten us and scientific facts that reassure us. To reveal these facts is the job of the scientist.

</comment></comment><comment><USER18> This reminds me of a very recent TV series</comment>


What Comes Next? - <AUTHOR> http://avc.com/a_vc/2014/02/what-comes-next.html

<comment><USER2> This couldn't disgust me more.

> At USV, we don't invest in health care, but we are certainly, and > increasingly, interested in the way networked humans can impact health care. > We don't invest in clean tech either. But we are certainly, and > increasingly, interested in the way networked humans can impact the > environment.

USV might not be aware, but our society really needs better health care and clean tech. This is more important than the need to prove that human networking leads to productivity gains. Human progress has nearly halted. Compare the progress of the 20th century with the progress of the 21st century. It would be great if investors started paying attention to this, and invested accordingly.

<comment><USER3> > better health care and clean tech

Health care? Sure. The US via NIH, CDC, etc. spends a bundle on health care, and a lot of good research has made into practice and helped people.

Clean tech? Sorry, I can't go along with you here. If you mean cleaning up Lake Erie and the Hudson River, okay. If you mean reducing emissions of CO2 in order to 'slow global warming', then I can't agree. To me the claim that CO2 from human activities is a significant cause of warming the planet is so far bad science and, really, a flim-flam, fraud scam 'morality play' to get into boodle bags.

USV shouldn't invest in health care. Why? Because look at the VC firms that do: They commonly have as partners people with good backgrounds in medicine and medical science, lots of MDs and biomedical Ph.D.s. USV does not have such people.</comment></comment>


Public Outcry in Taiwan Kills their version of SOPA - <AUTHOR> http://www.techdirt.com/articles/20130611/00503223401/public-outcry-taiwan-kills-their-version-sopa.shtml

<comment><USER2> This is so weird, +83 pts, but zero comments?</comment>


Apple Rejects Academic App That Detects Net Neutrality Violations - <AUTHOR> https://twitter.com/proffnes/status/953424625651912704 <comment><USER2> 1) Apple rejected an app that sounds like it does a good thing.

2) Developer has made up an interpretation to explain Apple's supposed real, unstated, reasons for rejection, substituting it for the reasons Apple itself explained.

3) Since the app had a good reason for existing, developer's made up theory must be the only possible correct interpretation.

4) QED

Anyone else see a flaw in this logic?

I agree that from the few and highly spun facts we have been given, it seems like Apple could do a better job here communicating back and forth and clarifying the potential issues. But to attribute the rejection to the presence of the words "net neutrality" seems a bit whacky.

<comment><USER3> Well, apple did supposedly say it was 'not appropriate.' So what do you think apple would consider to be 'not appropriate'? I'd guess things like extreme violence, nudity, promotion of racism.

<comment><USER4> From the scant details provided, it looks to me that tgis could be out of context: "iOS operating system doesn't provide access to specific private APIs or other hardware that may affect the results."

My guess is he is trying to access non public apis.

</comment></comment></comment><comment><USER5> There are many reasons that network speed can vary from request to request on a mobile device, right? Detecting some differences, applying statistical tests and then definitively calling it a "net neutrality violation" does not seem to me to be particularly reliable.

So if Apple's point of view is something like "making this available to unsophisticated users will create a lot of drama, much of it probably unjustified," then I have to admit I'm sympathetic.

Net neutrality is a emotionally charged issue right now, and I'd suggest that proponents are best served by being _very confident_ that the abuses they report are actually abuses.

On top of that, wireless networks were are least partially exempted from the Title II rule anyway, so even if it were still in force, iPhone carriers would still not be subject to all its rules.

</comment><comment><USER6> > Recall that shaping is implemented by looking at the contents of your > network traffic to see if it belongs to a given application. We can exploit > this observation to "turn off" shaping as follows: we simply send the same > traffic, but replace the original contents with random strings.

Is this accurate? My understanding was that T-Mobile and others throttle based on the source network since most streams are encrypted, preventing content analysis (which would also require significantly higher processing).

<comment><USER7> Yeah, there are a bunch of different kinds of net neutrality violations and this app only tries to detect some of them. DPI seems increasingly pointless from the ISP's perspective now that everything is encrypted, so detecting DPI is fighting the last war.

</comment></comment><comment><USER8> Apple has come to the forefront as defenders of users privacy, net neutrality and generally having a fairly laissez faire attitude towards the app store (at least as far as games, IAPs, and questionable apps) so this is going to raise questions. If they seem to block more researchers apps this, for me, will requirs sufficient explanation. With the few facts already public I am already pretty disappointed in their handling of this

</comment><comment><USER9> Does anyone have the link to the research paper behind this app?

<comment><AUTHOR> I believe it is this one: [https://david.choffnes.com/pubs/imc095-molavi- kakhkiA.pdf](https://david.choffnes.com/pubs/imc095-molavi-kakhkiA.pdf)

<comment><USER9> Thanks!</comment></comment></comment>


Ask HN: Create a job board for graduates? - <AUTHOR>

Common job boards offer searching by keyword, function title, industry, ... which I believe most graduates are not familiar with. Why not create a job board where graduates can search by their obtained degree instead? The returned results would only contain job offers that require no previous experience as well. <comment><USER2> @naf - as a soon-to-be graduate (though I'm not looking for a job), this sounds like an interesting idea but I would suggest measuring traction/interest by, instead of building a whole new site where employers post jobs, use existing APIs and data sources to bring in jobs and opportunities and do full text searching on jobs to discern which jobs are appropriate for which degrees.

Just a thought before you go out and create YAJB (yet another job board)

</comment><comment><USER3> There's a startup called FirstJob ([http:///www.firstjob.com/](http:///www.firstjob.com/)) targeting the same problem. Worth at least looking at.</comment>


Show HN: Junkie – An extensible deep packet inspector - <AUTHOR> https://github.com/rixed/junkie <comment><AUTHOR> Done a while ago but still maintained and still relevant I think (I don't think there is any other open source DPI that's as close to what you would find in production...)

Would be happy to learn how it could be improved or in what area it could be extended, or how to make it generally more useful.</comment>


Subscription gateway options - <AUTHOR>

Hi,<p>I am  resident of Indian and have an account in Indian Bank. I am planning to launch a saas product which requires recurring payment(typical subscription service). Supported currency will be USD. Please let me know viable payment gateway options. <comment><USER2> Hi. Yes chargify is not really a payment gateway, but will do the job very well if you have different plans: e.g. Basic, Pro, etc. you just setup the prices and redirect the users to the specific pages and there they get billed. Once they pay the amount is transfered into your account. As for PayPal Pro, sorry I have no clue about if it will work with banks from India, but if PayPal accepts your credit card it should work but you have to discuss this with your bank. Hope that helps.

</comment><comment><USER2> Hi. There are so many options out there like paypal recurring billing (using the API or just simple checkout). And here is one good payment gateway very simple to integrate but it's quite expensive if you ask me. <http://chargify.com/>

<comment><AUTHOR> Hi Mariust,

      Couple of things according to my research.

* Paypal recurring comes with only PayPalPro account. Will PayPro account work with Indian Bank Account?

* As far as I understand chargify is not a payment gateway. Correct me if I am wrong.</comment></comment>