They're Falsely Accused of Shoplifting, but Retailers Demand Penalties - <AUTHOR> https://www.nytimes.com/2018/08/17/business/falsely-accused-of-shoplifting-but-retailers-demand-they-pay.html <comment><USER2>
      Mr. McDonald said that if Ms. Thompson's daughter took
      the groceries without scanning them properly, it was
      by mistake. Video surveillance, reviewed by The New
      York Times, shows her daughter trying to scan and
      rescan groceries at the checkout machine for about 17
      minutes.

I really have a mixed impression of self checkout lanes, as they currently exist. Ten years ago, if you had asked me if they sound like a good idea, I have responded with an emphatic yes.

But experiencing them on perhaps a monthly basis these days, I've developed an overwhelming urge to avoid them at all costs. And not because of incidents as described by this article.

It's reached the point that even when I'm holding a single item, and there are five people with full shoppings carts in front of me, I get annoyed at people who suggest self checkout to me. I know damn well that there's a self checkout lane, and it's my time to waste. I'm waiting in precisely the lane I intend to be in.

Even though I totally agree that working a cash register should very nearly be an anachronistic job at this point, self checkout lanes are a horrid abomination in their modern form. Waiting for these machines to prompt me through the task of ringing my own items up is so far from my own experiences of actually working as a cashier, that I shake my head in dismay nearly every time.

When I used to work register at no less than ten other jobs, I could rip through a collection of 20 or 30 items in a minute or less (as long as barcodes or price tags were legible), and accept payment as fast as you could hand it to me. But self checkout prompts. Stops. Waits. Prompts. Stops. Fails. Back to square one. Prompt. Wait... Wait... Prompt. And so on.

Why is it so bad? Why is it worse than vending machines? So much worse. And restaraunts are trying to pull the same trick. Self service touchscreens leave you sitting at tables, unserved for half an hour, until you walk over to the bar and complain.

The future is hell.

<comment><USER3> The key gem I remember from an UI/UX rant posted here recently[0] is this: computer should wait on humans, not the other way around. This is what I hate about self-checkout machines. The process is infuriatingly slow. I could get out there in 1/10th of the time if the stupid machine wasn't so full of modal dialogs, talking, and if not for the weird delays in processing of the scanned barcode. Just let me scan items as fast as I can pick them up from my basket, and then press a button and pay.

I can't imagine how you can fail so spectacularly at your job as to design the self-checkout experience, so I'm forced to believe that all those issues are there _on purpose_.

\--

[0] - [https://news.ycombinator.com/item?id=17682494](https://news.ycombinator.com/item?id=17682494) -> [https://brandur.org/interfaces](https://brandur.org/interfaces)

<comment><USER4> A few years ago Target changed their self checkout machines to be less infuriating. It doesn't yell at you to place your item in the bagging area and then yell at you for putting an unexpected item in the bagging area. It lets you scan items as fast as you want. When I use some other store's self checkout machines it's a serious step backwards.

<comment><USER5> I've noticed the same thing with Walmart in Canada. It's not a bad experience now.

Although scanning each item individually is still time consuming. Removing that requirement would be awesome.

</comment></comment></comment></comment><comment><USER6> How is this not extortion? Every time I read /r/legaladvice and someone says "Hey I have proof someone stole X should I tell them pay me back or return it or I go to the police" and are shouted down that no, threatening to bring in the police is extortion.

Weird how when a large company wants compensation it's not...

<comment><USER7> Threatening to file a civil suit is not extortion. If it were, it would be pretty much impossible to ever send a cease-and-desist letter.

<comment><USER8> It can be extortion, if it's a SLAPP

[https://en.wikipedia.org/wiki/Strategic_lawsuit_against_publ...](https://en.wikipedia.org/wiki/Strategic_lawsuit_against_public_participation)

<comment><USER7> If SLAPP lawsuits were extortion, they would have already been illegal and anti-SLAPP legislation would not have been necessary. Such legislation is about preventing companies from using lawsuits to suppress free speech.

</comment></comment></comment></comment><comment><USER9> The problem here isn't so much scummy companies like Walmart, which will always exist and make false accusations, but the police who take those accusations and without proof make arrests. They are the truly big part of the problem and need to be reigned in. They know that Walmart and other companies routinely make false reports, have no evidence, yet are more than happy to make the arrest based on nothing. Same with judges. And prosecutors who choose to go ahead with these cases. They are truly the ones to blame for our lack of a functioning legal system that tries to lock up innocent people based on some company's bullshit. Let's not pretend that these parties have to enforce these shitty laws the way they do when there are a billion other more important priorities: they choose to because they enjoy hurting people and fucking up people's lives for their own amusement and advancement. If that isn't sick, I don't know what is. Oh right, Walmart falsely accusing people of shoplifting. That's a good reason not to shop there alone. On the other hand, when a retailer refuses to refund money for a product not even delivered, that's just a civil matter and these same scummy cops won't even take a report. The law clearly does not apply the same to all parties.

</comment><comment><USER10> What's wrong with America? So crazy out of proportion; an alledged $25 theft may result in police officers arrest you in your home, getting handcuffed, forced into "prison" jumpsuit etc. On top of that, stores are allowed to put lawyers on hunting cash from people no matter if they've been proven guilty or not by the justice system. And they don't care, nor need to care?

Where's the sanity and human decency??

<comment><USER11> Inverted totalitarianism at work. Paraphrasing a passage from the Bible, of all books, this one is a good parable of human nature: _From those whom have nothing, all will be taken; to those that have all, more will be given._

People whom can't fight back will be abused if there are incentives of the elite and their functionaries to extract money from these poor... like a legitimized protection racket by a proverbial Sheriff of Nottingham.

</comment></comment><comment><USER12> I feel that part of being a humane society is that we have to accept that there's going to be a certain number of people that take advantage. It will cost the rest of us a bit more.

But I'd rather put up with some cheaters, be they shop lifters, fruadulent insurance claimers, border crossers, etc, than allow draconian policies like those outlined in this story.

Further, compared to white collar crime and all the other ways the rich and powerful are able to "cheat", surely shoplifting is a rounding error.

$0.02 thoughts for a Friday evening.

<comment><USER13> That there are going to be shop lifters, is accepted in the industry. It is called shrinkage. Every year or every 6 weeks, retailers hire inventory audit companies to calculate shrinkage.

Some consulting company like McKinsey might have advised big retailers on how to reduce/recoup the shrinkage. These cease and desist letters, vague laws, etc are product of that effort.

</comment></comment><comment><USER14> Seems similar to the copyright infringement shakedown [https://torrentfreak.com/us-online-piracy-lawsuits-break- rec...](https://torrentfreak.com/us-online-piracy-lawsuits-break-record- numbers-180704/)

I wonder how many other threat letter business models there are.

<comment><USER6> > _In some states, companies have been able to collect more than the value of > the allegedly stolen items, up to $1,000 in some instances._

Seems to set up a perverse set of incentives - might be more profitable to pursue people who steal low ticket items than it is to actually sell them...

<comment><USER15> Not that I completely agree with the extent of the punishment, but if you only ever charge the person the amount you would have made from the sale, and don't provide any other punishment (eg fine on top, conviction, community service etc) then there is little to no incentive for anyone to pay for them.

<comment><USER6> >Not that I completely agree with the extent of the punishment, but if you only ever charge the person the amount you would have made from the sale, and don't provide any other punishment (eg fine on top, conviction, community service etc) then there is little to no incentive for anyone to pay for them.

I totally see where you're coming from, but IMHO fines are paid to governments. _Restitution_ is paid to corporations. Subtle but important difference. It's extremely common in small claims for defendants to be "made whole" (paid for actual, measurable losses). But you're basically asking for emotional damages for theft... if someone stole my laptop all I could sue for is the replacement cost of the laptop and any associated costs (ex: broken car window).

If you want to fine shoplifters, great. Maybe use that money towards various social programs - a lot of shoplifters are IV drug users for example.

But don't just hand the fine money to a corporation that will continue to underpay it's employees to the point their salaries are subsidized by taxpayer money (food stamps).

</comment></comment></comment></comment><comment><USER16> Cannot the court charge wallmart for not showing up to the trial?

They are clearly abusing the justice system. Scaring people into paying, but never showing up to the trial and letting the court dismiss the case.

Showing up would cost them money. It might even lead them to lose the case or award damages, given how little evidence they may have sometimes. The whole procedure is well orchestrated.

</comment><comment><USER17> Seems awfully one-sided. Perhaps there should be automatic reparation in the case of mistaken prosecution, at a level that is at least somewhat punitive. The retailer should feel some incentive to get it right.

<comment><USER9> How about 1% of that year's revenue. Problem fixed. There should never be a false accusation by a merchant. This allows up to 100 of these atrocities before the business goes out of business which is what should happen to corporations that do this. It's amazing how simple solutions are extremely effective.

</comment></comment><comment><USER18> Shockingly, the article says nothing about whether the police or a judge actually investigated or reviewed any purported evidence prior to the issuance of the subject arrest warrants.

</comment><comment><USER19> One of the lessons I took from this article is to never go through self- checkout.

<comment><USER20> Save your receipts.

<comment><USER21> The self-checkouts here have a gate to get out of the store from the self- checkouts. To get out, you scan the barcode on your receipt.

</comment></comment></comment><comment><USER22> It's a amazing that a company selling to consumers dares to use such tactics.. it's bound to back fire and give bad publicity.

I can't believe that scam tactics like this will bring in much money either. Not compared to the cost of fixing the out publicity issues.

</comment><comment><USER23> I've probably shopped at Walmart less than 10 times in my life. It's probably because they aren't conveniently located for me. But also they have so much bad press that I just don't want to be associated with it. At the same time, I also have the feeling that this will never happen to me so I'm indifferent.

That indifference is a bug in our society. It allows this injustice to be farmed out to 3rd party law shops using a system designed by corporate lobbying dollars to harass powerless individuals. Walmart isn't indifferent and they are mildly evil so the world is made worse by their presence.

</comment><comment><USER24> How is this not defamation of character as well as illegal imprisonment for /mistakenly/ claiming someone is guilty of a crime to the point that they become INCARCERATED?

</comment><comment><USER25> Why don't people use their power as consumers and stop shopping there? I have never understood why people let large companies walk all over them. Get organised and get even!

<comment><USER21> Because of home economics and lack of affordable choices - sometimes lack of choices at all. Folks that have some money do make those choices.

If Wal-mart is the cheapest retailer around you and you make $15-$20,000 a year, they are basically your only option for everyday household goods. Even if you are saving $20 per month, that's $20. Or perhaps you get more food that way.

Where I was at in the states, it was the cheapest place. We did have Aldi in some areas, but one couldn't buy everything there and the opening hours weren't great. Some areas didn't have this option either. (You can survive on food at aldi, but aren't going to find underwear and bras there either. Not to mention the lack of name-brand soaps if you had sensitive skin).

</comment></comment><comment><USER26> Sounds like the prime situation for a counter suit.

<comment><USER27> >...Christian Schreiber, a lawyer who filed a lawsuit in California state court against Home Depot over the practice. The suit resulted in a settlement for about 3,500 people...

That's how it's supposed to work. More of that should cause companies to take notice.

</comment></comment><comment> Paul-ish Is there a list of companies that agressively use these laws to go after people?

</comment><comment><USER28> A friend of mine for this extortion letter from Walmart after being let go in the store, it's pure fear tactics

</comment><comment><USER29> DoS attack using the law.

<comment><USER30> The term you're looking for is "barratry".

<comment><USER31> Not really; barratry is more a DoS on the system of justice (it wastes court time), however certainly some barrators could focus exclusively on one private party. Making false complaints to the police is not barratry. Maryland, which is the one of the States explicitly mentioned in the article, has a specific and atypical statutory definition[1].

It is hard to be a barrator in modern systems of justice based on English common law. Defendants of repeated claims by a single claimant can get relief from the courts, even if the claims aren't strictly frivolous.

In common law a barrator is someone who repeatedly brings frivolous actions to court, knowing they are frivolous. There are statutory definitions of barratry as a criminal offence, mainly in several of the States of the U.S.A. The usual requirements for criminal liability apply, and there is usually a threshold value for the number of unlawfully-brought actions, so there is ample opportunity for courts to impose a graduated response.

In most common law jurisdictions, it is essentially impossible to bring a frivolous lawsuit as licensed persons (lawyers of various types, paralegals) will generally not risk professional liability, and court clerks generally have the power to reject proceedings initiated by unlicensed persons if they are manifestly frivolous. In other jurisdictions, lists of ineligible litigants are maintained[2] and updated from time to time by the overall system of justice.

Additionally, most courts usually exercise their power to make a costs order against someone who still somehow manages to progress frivolous litigation, usually on an indemnity basis, which can be sufficiently expensive when the other party or parties has had to hire legal representation that it is strongly dissuasive. Most potential barrators could not afford to reach the threshold of criminal liability, because liability for the costs of the court and defence (and collecting those costs) exceeds their ability to pay.

However, access to relief from the courts is important, so there is generally a mechanism to allow such people to bring cases which have some significant probability of succeeding to court nevertheless.

Unfortunately, civil lawsuits are usually settled out of court, so courts may not see abusive patterns (courts are generally shy to inquire into consensual agreements between adversarial parties) until a defendant refuses favourable on-the-steps-of-the-court settlement offers instead opting to reach a final judgment and a trial on the matter of costs. It's then that a vexatious litigant that casts its net widely (i.e., filing many dubious different courts because it can, thanks to corporate scale or whatever) is most likely to be "discovered" by a court for the first time.

Harassing behaviour by creditors or their collections agents is a different matter, and _threatening_ to bring obviously frivolous proceedings does not typically incur criminal liability -- it's only the act of bringing such proceedings, knowingly and repeatedly, that will reach the threshold of barratry (where that still exists as a specific offence) or its rough equivalents. Most "private prosecutions" are those brought by a public body with the explicit statutory power to do so, where the body is something other than the usual prosecutor.

Finally, it is exceptionally rare that barratry or vexatious litigation could escape the domain of private law. Criminal prosecutions are generally brought by a public authority, and it is exceptionally rare (even in systems where it is even possible) for a private person to bring a criminal prosecution. It usually requires permission from the court or a public authority. (Even in the pre-modern system -- here roughly when professional public prosecutors were granted absolute discretion over bringing any criminal prosecution -- which depending on jurisdiction ranges from the 17th to 20th century, a private prosecutor would still have to seek an indictment, and malicious, frivolous, or vexatious prosecutions would almost inevitably fail to do so). Threatening to report innocent behaviour to police, while harassing and not in the public interest, is not the same as actually engaging in malicious prosecution.

\- --

[1] [https://law.justia.com/codes/maryland/2010/business- occupati...](https://law.justia.com/codes/maryland/2010/business-occupations- and-professions/title-10/subtitle-6/10-604/)

[2] [https://www.gov.uk/guidance/vexatious- litigants](https://www.gov.uk/guidance/vexatious-litigants) \-- all of these judgments are generally easy enough to find online; an example is [https://www.infotextmanuscripts.org/vexatiouslitigant/vex_li...](https://www.infotextmanuscripts.org/vexatiouslitigant/vex_lit_at_gen_oneill_appeal_c.html) \-- not all of them would have been barrators under the common law (before statute superseded barratry and many other common-law offences in England and Wales).</comment></comment></comment>


What is the best font for blog posts? - <AUTHOR>

<comment><USER2> It doesn't matter. Your most dedicated readers are reading you in their feed readers, so they won't see the effects of your stylesheet.

Oh, ok, it depends. What image are you trying to get across? What feelings are you trying to evoke?</comment>


Ask HN: Can you tell me why it's important to pay attention to analytics again? - <AUTHOR>

This is a question re: startups. <comment><USER2> So you can see what's going on?

<comment><AUTHOR> As in which aspects, let's say in your case?

<comment><USER2> As in how long people are staying on each page, which A/B options are converting better, where your users are coming from, what time of day you get the most traffic...</comment></comment></comment>


Researchers expand microchip capability with new 3D inductor technology - <AUTHOR> https://news.illinois.edu/view/6367/805644 <comment><USER2> This is the kind of limit-break science article that makes me come back here for news. Advancements which seem small and relativly progressive, but enable a next-level range of technologies and have immediate applications and potential impact on consumer products in the near future.</comment>


Performance and Usage at Instagram - <AUTHOR> https://engineering.instagram.com/posts/193415561023919/performance-usage-at-instagram/ <comment><USER2> > We saw app-wide impressions across all mobile platforms increase by 0.7%, > and likes increase by 0.4%. This was driven by increases of impressions on > all surfaces – for instance, "Explore Photos" impressions increased over 3%, > and user profile scrolls increased 2.7%.

I'm curious about this: was it A/B tested? Those figures are so small that they could just be seasonal or organic growth, the side effect of other things (events, weather, etc) that lead to increased engagement in general, and so on.

The technical improvements look great, but attributing them directly to increased user engagement seems a little too fuzzy.

<comment><USER3> Yep, these were all A/B tested and the results were statistically significant.

</comment></comment><comment><USER4> Always glad to hear that a big platform uses Django as backend. I wonder if the spec are still the same as the ones listed here? [http://instagram- engineering.tumblr.com/post/13649370142/wha...](http://instagram- engineering.tumblr.com/post/13649370142/what-powers-instagram-hundreds-of- instances)

<comment><USER3> We have a follow up to that post coming soon, stay tuned.

</comment></comment><comment><USER5> OOM errors dropping by 30% when you go from 20 comments to 5 doesn't sound like "a job well done", that's more your initial hint to figure the hell out why 20 comments cause memory issues.

<comment><USER6> I agree. and I'm surprised they made a blog post about this. The details of this seems more embarrassing than it is enlightening.

>Comment bundles are particularly heavy: They contain the comment text itself as well as its id, timestamp, and author metadata (including profile picture). ... Generating profile picture URLs is a CPU-inefficient operation because we must dynamically compute the correct CDN URL. The more comments we load, the more profile picture URLs we need to generate.

Is it loading the entire profile picture with each comment? Not just a small thumbnail?

<comment><USER7> I think it's only loading the URL to the profile photo image, which is stored in the CDN. Calculating the URL is, apparently, the slow factor. Maybe it requires some type of cryptographic operation that results in heavy CPU use?

<comment><USER6> >I think it's only loading the URL to the profile photo image

Sorry, by "it" I should have written "the client." I meant to suggest my question of whether that is where their client OOM errors are coming from.

<comment><USER3> We load a small thumbnail; it's the extra memory allocated to strings that was the main factor that helped when we reduced the # of comments sent down.

</comment></comment></comment></comment></comment><comment><USER8> Why not to use binary protocol? 20kb for just links and captions?

<comment><USER2> JSON is easier (faster) to parse on their client apps.

<comment><USER9> If you are building a new app, I'd really suggest checking out gRPC:

[http://www.grpc.io/](http://www.grpc.io/)

The combination of an HTTP/2 stack w/ protocol buffers and libraries in everything you'd write a mobile app in is a powerful combo, and its a pretty high development velocity environment.

<comment><USER2> gRPC is great, but Instagram's client apps are web-based (using React now), and consuming protobuf in JavaScript is unlikely to be faster (and definitely not as convenient) vs. JSON.

Given the limited resources of a lot of Android devices, an extra unmarshalling step would offset any wire-size reductions.

<comment><USER10> Just to clarify, do you mean that all of their mobile apps are on react-native now? Or just their web apps?</comment></comment></comment></comment></comment>


Facebook, show me your code - <AUTHOR> http://www.facebook.com/?-s

<comment><USER2> Relevant submission: <http://news.ycombinator.com/item?id=3925452></comment>


A Walk In The Cloud: My First Day With Google's Chrome OS - <AUTHOR> http://techcrunch.com/2010/12/10/chrome-os-review/ <comment><USER2> Judging by the comments on that thread I think that it was a pretty safe bet when google scrapped Wave that people were going to be more skeptical of google announcements in the future.

<http://news.ycombinator.com/item?id=1575928>

Of course, free hardware is never bad, I wonder how long it will be before some enterprising character figures out a way to put UNR on it, I've heard Chrome-OS be described as a scaled down Ubuntu so this should not be all that hard.

</comment><comment><USER3> I applied for the chrome netbook the other day through the pilot website and I was surprised there was no "landing page" after you hit submit saying "thank you for applying, etc." It just posted to the same page with no error messages, no nothing. Was it like that for everyone or did my application not go through? Just kinda concerned because there's no confirmation of any kind.

<comment><USER4> There is a thanks-for-applying page; apparently, that's botched up error handling - that text box needs to have < 140 chars.

<comment><USER3> edit: You're right there is a landing page.</comment></comment></comment>


Show HN: Gist Blog - Share gists as reader friendly pages - <AUTHOR> http://gb.sdqali.in

<comment><AUTHOR> May be blog is not the right name for it. This is useful in a situation where you want to write something quickly without going to the lengths of publishing a full blog post and then want to share with someone who is not in to Gists and GitHub.

Also, see [http://gist.io](http://gist.io) where I took the idea from.

Cheers.

</comment><comment><USER2> This is pretty cool, but I don't think a lot of people use gist for blogging.</comment>


Show HN: A Faceted Search Bar Component for Angular - <AUTHOR> https://www.npmjs.com/package/ng-material2-facet-search <comment><USER2> This is a really fascinating concept/layout. A vertical option that fits inside a left column would be awesome.</comment>


Evidence for a limit to human lifespan - <AUTHOR> http://www.nature.com/nature/journal/vaop/ncurrent/full/nature19793.html <comment><AUTHOR> Also a write up by the NYTM: [http://www.nytimes.com/2016/10/06/science/maximum-life- span-...](http://www.nytimes.com/2016/10/06/science/maximum-life-span- study.html)</comment>


Deploying app ENV variables with Rbenv, Passenger and Capistrano - <AUTHOR> http://blog.intercityup.com/deploying-app-env-variables-with-rbenv-passenger-and-capistrano/ <comment><USER2> "Put the secret into your shared/.rbenv-vars file"... and then say goodbye to them! [http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2014-0...](http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=CVE-2014-0130) . I don't think keeping your secrets in a file accessible to the web server is a good idea because of LFI vulns like this.

Some other ideas that I've heard that may be better: store the secrets on a separate "offline" server that only the web server can talk to. Or have the file readable only by root, run a bootstrap script as root that would read the file, drop root privs, and then start the webserver.

<comment><USER3> Ok. What about your database password? I think that your application will always have files that it should read for configuration files or other passwords...

</comment></comment><comment><USER4> I'm going to go ahead and say that most people don't need rvm/rbenv/chruby etc in production.

Ask yourself if you really need multiple versions of ruby in production because if not you can save yourself the headache of setting it up.

<comment><USER3> We use it because we'd like to run multiple apps on one server. This way we can do that. With the added benefit of the .rbenv-vars to specify ENV.</comment></comment>


Spotify desktop app loaded viruses onto users PCs via advertising - <AUTHOR> http://bbc.co.uk/news/technology-12891182

<comment><USER2> I use Spotify on OSX, and interestingly enough some ads get blocked by clicktoflash, which I use in Safari.</comment>


Job: Upgrading Our Self-Serve System - <AUTHOR> http://blog.reddit.com/2013/05/upgrading-our-self-serve-system.html

<comment><AUTHOR> I think the commit for B ends in "be".</comment>


Last.fm Release Source Code IRCCat - <AUTHOR> http://www.last.fm/user/RJ/journal/2007/02/21/350855/ <comment><USER2> Not to be mean but that blog you always link to is very spammy. Please either link directly to the source, or if it's your blog- dude- the whole page is ads until you scroll down! People just don't like it and it won't make you any money- at least not off of news.YC . Even if you're not a native english speaker- try to add some unique content and get rid of most of the ads if you want anyone to take your blog seriously.

<comment><USER3> Fixed. At news.yc we have a plan for linkjacking: the editors just replace the url with the url of the original source.

</comment></comment><comment><USER4> Any chance you could correct the title to last.fm please? Sometimes the little things bug me :)

Its amazing how quickly last.fm responds to their users. Someone asked them to post the source code to this internal tool during their FOWA presentation and by the next day it was up.</comment>


The Not So Dead Sea: Traces of Ancient Bacteria Found in the Lake's Sediments - <AUTHOR> https://www.scientificamerican.com/article/the-not-so-dead-sea-traces-of-ancient-bacteria-found-in-the-lakes-sediments/ <comment><USER2> The extremely salinity of the dead sea also could be a byproduct of those bacteria that lived there in past. Eventually these micro organisms may have died after consuming their primary resource they lived off.</comment>


Android L Preview Now Available On The Nexus 5 And Nexus 7 - <AUTHOR> http://bestpcinfos.com/android-l/

<comment><USER2> is android l is better than android kitkat</comment>


Hacking Two-Factor Authentication - <AUTHOR> http://www.schneier.com/blog/archives/2009/09/hacking_two-fac.html

<comment><USER2> Sure, that works for some things.

But what's _the_ transaction in the case of, say, a secured extranet? Is it requesting tabular data? Downloading a file? Kicking off a workflow?

Or what's _the_ transaction of an online banking session? Checking my balances? Initiating a payment? Transferring funds?

Authenticating much more often than once a session is impractical from a user experience standpoint. People are just not going to enter their PIN & token code a half-dozen times. Security has always required usability trade-offs and authenticating transactions is going to be far too much hassle for most services.

I suppose you could batch transactions and ask for a second log-in before you process them. That would offer a sanity check and mitigate potential damage. But even that would require awfully security-conscious users to accept that process, tolerate the changes it implies in how the service can operate and actually pay attention to the batch to see if something was slipped in -- at which point I wonder how much additional security the transaction batch is truly providing.

</comment><comment><USER3> So the lesson is don't worry so much about authenticating the user, but focus on authenticating the transaction. It would have been a much more useful article if he actually described how (rather than just saying, "do it like the credit card companies").</comment>


1991 – a server-side web framework written in Forth - <AUTHOR> http://www.1-9-9-1.com/ <comment><USER3> That is a masterpiece of Forth programming!

I particularly enjoyed this section from the template renderer which made me think... Return stack manipulation - that's playing with fire. And also - <USER2> Forth is not much higher level than assembly, and gosh, I don't think I could have written that without writing some stack diagrams!

                2dup s" $>" search if               \ Check to see if there's a closing tag $>.
                    2 -                             \ Add the close tag to the search result.
                    nip                             \ Save the end position of $>.
                    dup >r
                    -                               \ Reduce the string to <$ ... $>.
                    evaluate                        \ Run user's code (maybe a bad idea?).
                    r>                              \ Retrieve our saved end position of $>.
                    r> r>                           \ Retrive the addr u from start of loop iter.
                    rot                             \ Bring end $> to stack top.
                    over >r                         \ Store the real string's length.
                    -                               \ Subtract end $> from u to get the pos from top
                    r> swap                         \ that we'd like to strip away. Restore saved u.
                    /string                         \ Drop top of the string until the end of $>.
                    0                               \ Keep looping.

Thanks for the trip down memory lane!

<comment><USER4> I like the (maybe a bad idea?) comment.

<comment><USER5> Its the only distracting comment, the rest tels me what it does, this one tells me how he feels.

<comment><USER6> Documenting potential security issues with your code is rarely a bad idea.

</comment></comment></comment></comment><comment><USER7> This is charming. A microframework in a scant 480 lines of code, plus a postmodern manifesto on historisity -- what's not to love!

I can't wait to read the slew of "Why we switched from <web-framework> to 1991" blog posts.

<comment><USER8> Maybe migrating from bashttpd:

[https://github.com/avleen/bashttpd](https://github.com/avleen/bashttpd)

<comment><USER9> I can see that happening: "the deployment was a piece of cake".

What says the project about security? "Only rudimentary input handling. We would not be running this on a public machine."

What will the hipsters say? "time to market"

<comment><USER10> Do you know what runs HN?

</comment></comment></comment></comment><comment><USER11> > Hence developers working on new projects while still coding in decades-old > text editors. They write the future in the past and are made present in so > doing.

Deep

<comment><USER12> Postmodern. Just like Perl.

</comment></comment><comment><USER13> I really like the commitment to retro aesthetics. Last weekend I made an "imaginary astronomy" web app with nearly pixel-perfect Windows 95 theming. :-) [http://steveasleep.com/keplverse/](http://steveasleep.com/keplverse/)

Forth still seems like a language worth learning, not for practical reasons, but for technohistorical context. Maybe my first project should be a sqlite library?

<comment><USER14> That's a nice one, but why not use MS Sans Serif as a font where available, for maximum effect?

<comment><USER13> Because I'm on a Mac and wouldn't be able to test it. :-D

Patches accepted here: [https://github.com/irskep/keplverse](https://github.com/irskep/keplverse)

I also blogged about the algorithm, if that's of interest: [https://blog.steveasleep.com/using-data-from-the-kepler- miss...](https://blog.steveasleep.com/using-data-from-the-kepler-mission-to- scientifically-imagine-star-systems)

</comment></comment></comment><comment><USER15> Besides the framework itself the website is glorious. Kudos!

</comment><comment><USER16> Cool. Any decent implementation for client side forth in the browser so I can do some good old Asynchronous Forth And staX?

<comment><USER17> I wrote a Forth interpreter for WASM some time ago: [https://github.com/stefano/wasm-forth](https://github.com/stefano/wasm-forth)

It's not production ready and it's missing a good JS interface, but you can use it to run Forth code in the browser with a basic console interface.

</comment></comment><comment><USER18> Forth must be lightning fast albeit single-threaded... has there been any work on a multithreaded Forth? Compiling to BEAM VM might be an option for (not fast) implementation...

<comment><USER19> A naive (ie. threaded[1]) Forth implementation will be slow because the jump between each instruction is a very effective way to defeat branch prediction. Of course this doesn't apply to "real Forth" which is compiled into machine code or even less naive Forths which can do inlining, but there are many hobbyist Forth implementations (because they're so easy to write) where this will still be true.

If you're interested I wrote a naive literate Forth implementation which can do inlining: [http://git.annexia.org/?p=jonesforth.git;a=blob;f=jonesforth...](http://git.annexia.org/?p=jonesforth.git;a=blob;f=jonesforth.S) [http://git.annexia.org/?p=jonesforth.git;a=blob;f=jonesforth...](http://git.annexia.org/?p=jonesforth.git;a=blob;f=jonesforth.f)

[1] "Threaded" in this sense means [https://en.wikipedia.org/wiki/Threaded_code](https://en.wikipedia.org/wiki/Threaded_code) not multithreading.

<comment><USER7> I've always meant to thank you for publishing jonesforth. I learned so much from it. (I can't believe it's been nearly ten years now!)

It's a beautiful example of literate programming. Knuth would be proud, I think!

</comment></comment></comment><comment><USER20> And I thought I was horrible at choosing domain names lol

<comment><USER21> It would have been cool to serve this from the raw ip like [https://188.8.131.52](https://188.8.131.52) :P It's actually responding to pings, seems to be in Malaysia.

</comment></comment><comment><USER22> 1991 - the year punk broke.

</comment><comment><USER23> Nice. I wonder what the threading model is? Process per request? Thread per request? NodeJS style?

<comment><USER24> One process, one HTTP request at a time, buffering excess requests in a queue of up to 255 requests. Here's the main "event loop":

        : start-server { server client }
            begin
                server 255 listen
                server accept-socket to client
                client read-request prepare-response client send-response
            again ;

I think this word's definition should be fairly easy to follow even if you aren't familiar with Forth.

</comment></comment><comment><USER25> Why hasn't someone made a Go and Forth combination yet?

<comment><USER11> What makes you think Go and Forth go well together?

<comment><USER26> Everyone knows you Go Forth and multiply.

<comment><USER27> Strictly speaking, you're meant to GO FORTH AND MULTIPLY.

<comment><USER17> MULTIPLY FORTH GO AND

<comment><USER28> GORTH!

</comment></comment></comment></comment></comment></comment><comment><USER29> Can this recreate trying to figure out a way to host a web server in 1991?

</comment><comment><USER30> Love the note at the end, rings true with me.

</comment><comment><USER26> That's beautiful. Well done!

</comment><comment><USER31> I love postmodern software

<comment><USER12> To stay true to this claim it should've been written in Perl.

<comment><USER32> Even people who love Perl don't love 1991 Perl.

</comment></comment></comment><comment><USER33> cool!</comment>


Inspiration vs. Imitation - <AUTHOR> http://www.jessicahische.is/obsessedwiththeinternet/andbeingresponsivelyinspired/inspiration-vs-imitation-2

<comment><USER2> The article is a bit abstract - it's not clear what the author deems as ripping off. It seems that the author believes that any work from which she (or her fans) can discern resemblance to her own projects is suspect. And, if it's cutting into her wages, it makes sense that she's concerned.

But, that doesn't mean that this blog post will stop this behavior. Nor, should it. And, I would hope that other designers and illustrators don't stop ripping off as much as they should from her and others. I'm not encouraging blatant reproduction of work with no added value (e.g. copy and pasting). But, soft copying of themes, concepts, re-structuring, etc are all useful.

These intellectual transactions are very helpful to our overall intellectual economy; they help us progress. The more they happen, the better we are. There will always be 'elite' (5%) creators, on the forefront of risk and away from convention. And there will always be the other 95%, who compile, aggregate, and reproduce and fill out the space. And, that's okay.

</comment><comment><USER3> Really well-written and extremely pragmatic -- the best way to discourage inadvertent bad behavior is to provide a face-saving way for the genuinely clueless to get on the right path.

</comment><comment><USER4> Jessica is clearly 'inspired' by Bob Staake.

</comment><comment><USER5> Really cool article, I learned a bunch. It's cool that she talks about the role that imitation plays in a creator's growth. A different sphere but reminds me of this rap from the song Dr. Carter.

      Good afternoon Dr. Carter
      I don't know about this one
      His confidence is down, vocab and metaphors needs work
      And he lack respect for the game
      [LW] Uhhhh let me see
      [FN] You think you can save him?

      [Lil Wayne]
      Okay respect is in the heart so that's where I'mma start
      And a lot of heart patients don't make it. But, hey, kid
      Plural, I graduated
      Cause you can get through anything if Magic made it
      And that was called recycling Re: reciting something
      Cause you just like it so you say it just like it
      Some say it's biting but I say it's enlightening</comment>


Is FastMail reliable? - <AUTHOR> <comment><USER2> There's been a couple short downtimes, always documented/well-communicated on their Twitter feed. I think I've only ever been able to not get into my email once... and it was fixed in a few minutes.

And outside of general service reliability, their support team is top notch. I can't say enough about being able to file a ticket on a problem with my email service and hearing back from a real person about it.

Also: [https://www.fastmailstatus.com/](https://www.fastmailstatus.com/)

</comment><comment><USER3> Really happy with its robustness. Able to access in mainland China which is nearly impossible unless using a domestic service. Now if only everyone would move to PGP.

</comment><comment><USER4> Never noticed any downtime over several years as very happy customer.</comment>


Raising the Wreck of the Costa Concordia Live Video - <AUTHOR> http://www.nytimes.com/packages/html/video/live-popout-player.html

<comment><USER2> Related:

[https://news.ycombinator.com/item?id=6389626](https://news.ycombinator.com/item?id=6389626) \- How

[https://news.ycombinator.com/item?id=6389745](https://news.ycombinator.com/item?id=6389745) \- More details and video

[https://news.ycombinator.com/item?id=6392183](https://news.ycombinator.com/item?id=6392183) \- Live stream

[https://news.ycombinator.com/item?id=6392263](https://news.ycombinator.com/item?id=6392263) \- Live stream

[https://news.ycombinator.com/item?id=6392477](https://news.ycombinator.com/item?id=6392477) \- Live stream

[https://news.ycombinator.com/item?id=6392661](https://news.ycombinator.com/item?id=6392661) \- Outline and video</comment>


Having a rough day? Watch the penguins at SeaWorld live - <AUTHOR> http://dsc.discovery.com/tv/frozen-planet/penguin-cam/

<comment><USER2> Awesome! Can't help but smile.</comment>


Real-Time Analytics with Node.js and Socket.io - <AUTHOR> http://markrabey.com/2014/05/05/real-time-analytics-with-node-js-socket-io/?utm_source=nodeweekly&utm_medium=email <comment><USER2> Thanks! I liked the writing, and the article did a great job of clearly explaining a basic socket.io workflow. I would expand on this with an article either on how to use mongoose to store analytics data across sessions or on how to use some visualization library (d3.js?) to plot the data.

<comment><USER3> Thanks, I appreciate the feedback! An update is on the way in the next couple of days I hope.

</comment></comment><comment><USER4> I enjoyed this post too - if you don't mind I plan to link to it from next week's RealTimeWeekly.com. Thanks for writing it!

<comment><USER3> I don't mind at all, please do! Glad you like it.

</comment></comment><comment><USER5> While it's an interesting article, for some reason I cannot select any text in the page in Safari. Strange.

<comment><USER3> As it turns out, the text IS being selected....just with no colour associated to it. Not sure what happened there, but I'll get the fix up ASAP.

</comment></comment><comment><USER6> Small typo:

        mkdir simple-chat && cd realtime-analytics

<comment><USER3> Thanks! Fixed.

</comment></comment><comment><USER7> Thanks for the article! You just pushed me to want to learn Nodejs.

<comment><USER3> Good to hear! I'm still learning a lot my self, but love it so far!</comment></comment>


Accuracy of ML models is lower than the worst of statistical ones for timeseries - <AUTHOR> http://journals.plos.org/plosone/article?id=10.1371/journal.pone.0194889 <comment><AUTHOR> This figure is a good overview of the models performance for this study. [http://journals.plos.org/plosone/article/figure/image?size=l...](http://journals.plos.org/plosone/article/figure/image?size=large&id=10.1371/journal.pone.0194889.g002)</comment>


Ask HN: 6502 or Z80? - <AUTHOR> Pretty self-explanatory, really.
The grandfather of ARM, or the cousin of x86?
Speccy or BBC?
The chip that made the Apple //, or the one behind your terminal?
CP/M, or 1000 BASIC variants?
Which one would you pick? And why?
Oh, and no saying that you pick the 6809. We'd all love a 6809, but they weren't common at the time, and Rochester isn't selling in small quantites now, AFAIK. Besides, it's so much nicer that everyone else would agree with you, which takes the fun out of things. <comment><USER2> 6502, mainly because it was affordable (~$25 in 1975 vs at least $175 for other chips in the day) Thus it truly spurred the home and hobbyist computer revolution.

It also performed quite well for its speed with most instructions completing in 1-3 cycles, many CPUs of higher clock rates weren't as efficient as the 6502.

</comment><comment><USER3> I have to say the 6502 notable because it was introduced at a price point that enabled a whole bunch of new products. otherwise it was a weird little uP with an odd somewhat limiting instruction set.

</comment><comment><USER4> I'd go with the Z80. Otherwise you might end up spending a lot of time figuring out how to do something that could be done with one or two Z80 instructions.

</comment><comment><USER5> Z80. I found it so much easier to program (while hand-assembling using a printed opcode table) back in the 80s. Also, ZX Spectrum all the way ;-)

<comment><USER6> I also got started writing assembly by looking up opcodes in the back of the orange-book which came bundled with my 48k Spectrum. Writing programs on paper, and filling in the offsets for (relative) jumps once complete.

Happily the format of z80 and Intel assembly were very similar, so I didn't find it hard to move to PC-stuff when I arrived at university. (Not a surprise given where the Zilog developers came from.)

Z80 was the first assembly language I wrote in, and even if I mostly just hacked games for infinite lives I had a lot of fun doing so. Cracking protections on tape-based games was a challenge without the internet, but the lessons learned eventually applied to PC-stuff when I discovered +fravia. (Though we don't talk about that kind of thing any more ;)

<comment><AUTHOR> Man, all of us 2000s kids really missed out on this sort of thing. It was hard to get into programming, much less assembler: nobody even knew how.

I eventually picked up a "For Dummies" book that taught be the basics, and worked my way up from there. First Python, then a touch of Ruby, and then some Scheme, and a bit of C. I picked up shell and Unix along the way.

</comment></comment></comment><comment><USER7> > 6502 or Z80?

It really depends on what you want.

The Z80 is more "corporate". There were lots of embedded systems built with a Z80 at the heart. People used it to get a lot of stuff DONE.

6502 is more of a hackable computer. Because it was used in the Apple ][, there were lots of people trying lots of strange experiments. Some were incredibly good, years ahead of their time. There are games in 64K that were more fun than most bloated multi-GB games on consoles today.

This dichotomy exists to this day. (Search "Visual Z80" vs "Visual 6502" and compare the depth of understanding and/or passion.)

<comment><AUTHOR> Yeah, the modern 6502 community is way more active than the Z80 community (which is kept afloat by GG, MS, GB/CGB, and Speccy hackers. OTOH, they have better tools: give me sdcc or WLA DX over cc65 or xa any day (and yes, WLA works with either chip, but it came from the GB/GG community, and those were the first chips it supported)).

I'm thinking of starting with the Z80 if I build an SBC, though: It may not be as cool, or popular, or have as elegant in instruction set, but it's a heck of a lot easier to program (especially for a novice asm programmer like me).

</comment></comment><comment><USER8> Z80. Mainly because there are still some interesting devices that you can have some fun with that still use them: Gameboy & TI-83 calculators.

<comment><USER9> Amstrad and Spectrum personal computers also had Z80 inside.

I remember struggling with LDIR/LDDR instructions with Amsost devpac assembler...

Btw. We called that machine code programming back in the 80s.

<comment><AUTHOR> Really? many commenters here are talking about actually entering raw hex (and calculating branch offsets by hand (!)).

<comment><USER9> In my case the pain pointi was loading the assembler from tape drive for about 5 minutes.

Fortunately the assembler did the offset calculation for me.

If you coded something in basic with some machine code, you had to type a lot of DATA statements in decimal or hex. This was then read and POKE'd in memory and CALLed from basic.

Quite tedious.

<comment><AUTHOR> Yeah, but a lot of people actually didn't have assemblers at the time.

</comment></comment></comment></comment></comment><comment><USER10> I wish I could give 100 votes (as I get downvotes ha) to this ask! I love hearing old "war stories".

<comment><AUTHOR> Thanks. ;-)

</comment></comment><comment><USER11> Don't have any experience with the 6502, but I was able to pick up z80 assembly syntax pretty easily. Very user friendly in my opinion, but I've met people who swear it's terrible and awkward in comparison to their preferred instruction set, so ymmv.

<comment><AUTHOR> Compared to the 6809 or the m68k, it's awkward as all hell. Compared to the 6502, it's still awkward.

Comparing Z80 assembler to 6502 assembler is like comparing CL to Scheme. The Z80 gets some things Right that the 6502 doesn't, but the 6502 does the Right Thing more often, and is very elegant and minimal. However, the Z80 has a ton of useful building blocks that the 6502 sacrifices to keep that elegance.

I prefer Scheme to CL, but I think I like Z80 better than 6502. Go figure...

<comment><USER11> I'm working on likely the last product we'll ever make with z80 based assembly, so hopefully I'll be trying some alternatives in the next year or so. Thanks for the comparison.

<comment><AUTHOR> Huh, really? What's the product?

</comment></comment></comment></comment><comment><USER12> A highly relevant older story and discussion: [https://news.ycombinator.com/item?id=10763274](https://news.ycombinator.com/item?id=10763274).</comment>


The less Americans know about Ukraine's location, the more they want ... - <AUTHOR> http://www.washingtonpost.com/blogs/monkey-cage/wp/2014/04/07/the-less-americans-know-about-ukraines-location-the-more-they-want-u-s-to-intervene/ <comment><USER2> This seems to be a textbook example of the Dunning-Kruger effect: the people who know least are the most willing to take action, because their ignorance blinds them to the impracticality and potential consequences of that action.

[http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect](http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect)

<comment><USER3> Is there a name for when you get progressively more depressed about an issue the more you learn about it?

The Ukraine conflict might very well also qualify for that.

<comment><USER4> The Dunning-Kruger Effect Effect.

</comment></comment></comment><comment><USER5> How did they ask people to locate Ukraine? Some of these points look like somebody accidentally clicked on a random spot of a map. For example, the dot below New Zealand is in the middle of the ocean (approx. -55.000000,176.000000). Some even located it within the US (Florida seems to be a popular guess). Have they found really misinformed people or is this noise in the data?

<comment><USER6> I would bet that the noise comes from people who have no idea just closing their eyes and clicking at random.

Clearly the map wasn't coloured to differentiate bodies of water, considering the clusters in the Black and Caspian seas. (But you'd think people could at least identify the major oceans...)

<comment><USER7> This would correlate with 'I have no idea what I'm doing'

"In general, younger Americans tended to provide more accurate responses than their older counterparts: 27 percent of 18-24 year olds correctly identified Ukraine, compared with 14 percent of 65+ year-olds."

65+ year olds spent a big chunk of their lives in the cold war. Presumably they would know more about the geographical breakup of the Soviet Union than 18-24 year olds who didn't even exist when the Berlin Wall fell.

From a data analysis standpoint, I would say discard the outliers that look like mis-clicks. Based on the groupings you still have people that identified Alaska, Greenland, Canada, India South America, and so on. Irregardless of the colorings or map size, those should not have been chosen.

On another note, a given countries foreign policy always makes a hell of a lot more sense when placed in context on a map. I'm glad I read a lot of National Geographic as a child.

<comment><USER8> No, people who were in primary school before the breakup of the Soviet Union would probably have never seen the Ukraine on a map, since all they would see is a big red area labeled "Soviet Union". I doubt Soviet internal geography & politics were taught regularly. Younger people may not even know that the Soviet Union ever existed, but they have a much better chance of seeing Ukraine on a map in school.

<comment><USER9> > No, people who were in primary school before the breakup of the Soviet Union > would probably have never seen the Ukraine on a map, since all they would > see is a big red area labeled "Soviet Union".

Many of the maps I remember seeing (in school and otherwise) as a kid in the 1980s labelled the constituent republics of the USSR.

</comment></comment></comment></comment></comment><comment><USER10> I see lots of numbers in there, but none relating to a desire for military action, save for the fact they're "95% confident" that people who don't know where Ukraine is are more likely to support military action. _How much_ more likely are they?

</comment><comment><USER11> The map would have been more interesting if the color represented preference for intervention.

<comment><USER12> This. Color is an entire dimension they had available, and they used it to reiterate what we can already see (distance from actual Ukraine) instead of the actual point they are trying to make (clueless about location => wants to intervene)

</comment></comment><comment><USER13> This makes sense, no? With less knowledge about the Ukraine and hence less information about the ties and affinity parts of its population have to Russia, the more aggressive Russia seems. Without that knowledge, you just have to take the prior assumption that Ukraine is just like any other country, no specific link to Russia - and given that, the breach of sovereignty seems more egregious than it is in this specific situation.

</comment><comment><USER14> I don't dispute the conclusion of this study, but this might be a great example of when the choice of map projection used has a significant consequences.

For example, would Greenland have been chosen so many times if a projection were used that didn't make it look so huge?

</comment><comment><USER15> Many replies here try to dispute the methodology and UX in the survey. When it comes to geography, you either know it, or you don't.

The distance from Ukraine for many data points is so big, that you can't possibly write it down to projection/UX.

<comment><USER16> The UX certainly doesn't help! I've been to Russia and Ukraine several times. I can easily point out Ukraine on a normal map but I must admit that single colored map is a bit confusing.

<comment><USER17> Normal maps tell you where Ukraine is :)

</comment></comment></comment><comment><USER18> Russia knows more about Ukraine's geography, so they should occupy it.

</comment><comment><USER19> Reminds me of this video. As an American it makes me sad.

[https://www.youtube.com/watch?v=a0TK_vk- XDM](https://www.youtube.com/watch?v=a0TK_vk-XDM)

<comment><USER20> That was cringe worthy.

</comment></comment><comment><USER21> I suppose it will be big surprise to many people (even some russians) to know, that first capital of ancient Russia was Kiev, current capital of Ukraine ;)

</comment><comment><USER22> So what? Most people in Europe do not know where Washington state is.

Anyway US already intervened in Ukraine several times. I just hope this will not become another Iraq.

<comment><USER23> Do they have strong opinions about European intervention in Washington state?

</comment></comment><comment><USER24> Does anyone spy a link to the data? Some of the numbers make me think they're over-emphasizing the conclusion.

</comment><comment><USER25> More people need to play Risk apparently.

</comment><comment><USER26> Where's the map where they baseline people identifying something in the US (or other map points with higher likely familiarity) correctly as well? That would help clear out some noise.

Secondly. Who cares at this point? Seems like Putin keeps Crimea on the basis of some familiar reasoning that bodes poorly for outcomes here. There is no appetite or willing money for military intervention at scale.

</comment><comment><USER27> Most interesting tidbit for me: "self-identified independents (29 percent correct) outperformed both Democrats (14 percent correct) and Republicans (15 percent correct)"

Edit: Removed inflammatory language about Democrats and Republicans and will let the numbers speak for themselves.

</comment><comment><USER28> Although I find it interesting, what's the point of the article other than "look how most Americans are ignorant about world geography"?

And what do I gain from it?

<comment><USER6> What I always find interesting about "look at how ignorant Americans are" type articles is that they never bother to compare against any other nationality and see if the ignorance is in any way abnormal in a broader context.

Is a "look at how ignorant non-Europeans are about world geography?" going to have a different result? (And I would be quite curious to know how many, say, British or Spaniards can accurately place Ukraine on a map. I have a sneaking suspicion that the number is surprisingly low).

This coming from a non-American, by the way.

<comment><USER15> Coming from a non-American as well:

Assuming ignorance would fall in the same spectrum compared to other nationalities, you don't hear other nationalities confidently stating their opinions about things they know nothing about.

To be fair, I don't have data to back that up, but I can tell you from my personal observations that people usually refrain from commenting or are reasonably educated about the topic.

Why this is important in this case is because it's largely a matter of geo- politics, and if you don't even know where the damn country is, you should not seriously suggest a certain course of action.

<comment><USER29> To be fair, these people were asked for their opinion--it was an opinion survey; it's not like they're walking around volunteering it. Saying they shouldn't say anything when asked is a bit odd.

99.9% of the Americans I talk to every day are refraining from commenting about whether the US should intervene in the Ukraine. But, then, I'm not asking.

<comment><USER15> I didn't think about the "pressure" of the survey, I must admit. Fair point.

However, does the fact that if you don't know where the country in question is located, and out of war|no war, you choose war, not strike you as somewhat weird?

I'd like to think most people would always choose no war over war ESPECIALLY if they're uneducated about the situation.

<comment><USER29> I think when you're 6'6" and 250 lbs of muscle you may be more inclined to step in when someone is threatening a defenseless innocent.

Not that that's what's going on here, but I think that's the image that many Americans have of America's place in the world. It's not especially enlightened, but I don't think the people are warmongers, they probably honestly think it's just the right thing to do and that it would have very little in the way of consequences for anyone. It's the latter part that probably correlates with not knowing much about the world outside America's borders.</comment></comment></comment></comment></comment></comment>


Generator-python-package – yeoman generator to create new python packages - <AUTHOR> https://github.com/heynemann/generator-python-package <comment><USER2> I think the cookiecutter is best for bootstrapping, but nuce job</comment>


Fonts in Use - <AUTHOR> http://fontsinuse.com <comment><USER2> Take away the display of font names until you mouseover an image, and you have a fun game for font nerds! Could probably write that in a few lines of JS and apply with GreaseMonkey.

<comment><USER3> Few lines of CSS: [https://userstyles.org/styles/119979/fonts-in-use- gamify](https://userstyles.org/styles/119979/fonts-in-use-gamify)

<comment><USER4> We already have that built in: click on the "stacked view" icon on the top right.

</comment></comment></comment><comment><USER5> And the greatest source code font of all time is DejaVu (Sans) Mono. It's open-source: [http://dejavu-fonts.org/](http://dejavu-fonts.org/)

<comment><USER6> Ask 100 Programmers what their favourite font is and you get 100 answers :)

I'm a big fan of Proggy (the clean / slashed zero / bold puncutation one) combined with a light color on a dark background I can stuff as much code on my monitor as possible without straining my eyes. That way I believe to better oversee the structure of the code and need to scroll less, but each to his own.

Proggy: [http://www.proggyfonts.net/download/](http://www.proggyfonts.net/download/)

Programming font comparison: [https://s9w.github.io/font_compare/](https://s9w.github.io/font_compare/)

<comment><USER7> I thought everyone just used consolas!

<comment><USER8> Real coders use comic sans.

<comment><USER9> Real coders use Papyrus just as their ancient Egyptian forefathers before them.

EDIT: Free obfuscation security from over-the-shoulder glances for the real coders that code in Wingdings.

<comment><USER8> I would say our Egyptian forefathers used a font more along the lines of Wingdings than papyrus.

</comment></comment></comment></comment></comment></comment><comment><USER10> I've been receiving a weekly email digest of the posts on "Fonts in Use" using ifttt.com for a long time already. Love their site.

<comment><USER11> How'd you set that up? Aka I'd love to copy you as that sounds like the ideal way to view this site.

<comment><USER12> I assume it's using one of the site's RSS feeds.</comment></comment></comment>


Ask HN: What's your greatest non-tech hack? - <AUTHOR>

Of course this is inspired by the question from the application for YC but I'm not applying this year and I'm genuinely interested in sharing and hearing some other great anecdotes.
For me, I think it was when I used social engineering to track down the programmers who designed a very expensive product for a vendor in my industry and then negotiated a price to build the same full featured product for 1/5th of what the vendor charges for a one-off job.  They were freelancing on odesk/elance and I had used the demos that vendors offer of their products to categorize the features and estimate what technologies were involved.  When I talked with the programmer he admitted about how much he was paid for work on their product.
The industry is e-discovery for law firms, btw. <comment><USER2> I had several instances that I thought would make a good example I choose this one because I thought that this would be different and would definitely not be considered a tech hack.

"Before christmas, I was buying gifts for my young cousins and I found out that Toys"R"Us had a policy where they would match any competitor price. I used this to my advantage, I was able to get presents, using my iPhone, that were being retailed at $40.00 for around $8.00. Other shoppers asked me to show them how to do the same. I helped several people free of charge. Toys"R"Us was not fond of it, I just liked helping families out and showing them how much money they were able to save."

</comment><comment><USER3> I didn't apply but this is my non-tech hack...

I went to a large University. GEN ED lecture sizes were ~500 students and the most skipped classes. At the start of each semester, I would stand outside these 101 lectures to hand out fliers so I could find the students who would: 1) attend and never miss a class and 2) take amazing notes. Before finals, I typed, printed and bound the notes and sold/hustled them at the student union. I did 4-5 courses per semester and sold a ridiculous number of them for ~$50 ea. Helped lots of students pass courses they would have otherwise failed.

</comment><comment><USER4> cooking mung beans in a rice-cooker</comment>


Medical Device CEO Catches Stranger After Hours, Prompting Espionage Charges - <AUTHOR> https://www.wsj.com/articles/an-after-hours-company-visit-spurs-espionage-charges-1505813401 <comment><USER2> I'm sure plenty of people will declare his innocence in this current age of "love your neighbor" and "nothing is secret". But really, this kind of stuff is not right.

I briefly worked for Boeing once and they were working on a new fuel boom for the KC-135 Fuel tanker. Spent millions in research and then some idiot takes a bunch of photos of the blueprints and physical hardware and then sells it to someone in China. Thankfully he was busted. A company just trying to make a profit on what they spent millions developing is not inherently evil.

<comment><USER3> And I'm certain that if Boeing were offered similar information from a defector within a Chinese firm, they'd turn it down and report the spy to the proper authorities.

Industrial espionage is as old as industry. It got porcelain and tea out of China and is, in fact, the reason the UK was able to grow tea as early as it was.

It isn't nice, but business isn't nice.

<comment><USER4> Well, we know that AMD at one point did in fact turn someone in to the authorities for attempting to sell them industrial espionage from Intel. I don't think it's as gloomy a picture as you are trying to paint.

<comment><USER3> Gloomy depends on the context. The US got its textile industry due to Samuel Slater stealing the design of the shuttle loom from the UK:

[http://www.brahmsmount.com/blog/american-textile- history/](http://www.brahmsmount.com/blog/american-textile-history/)

I'm not defending industrial espionage, I'm merely pointing out that treating it as a grave and horrible thing is at odds with how important it's been historically.

<comment><USER5> So the benchmark for modern business ethics is a man who made his fortune off the back of slaves in the 1700s?

<comment><USER3> Huh. I wasn't aware industrial espionage caused slavery.

</comment></comment></comment></comment></comment></comment><comment><USER6> > he saw a man he didn't recognize, sitting by himself in front of two open > laptops and a tablet device.

> "Mr. Liu adamantly asserts his innocence and we fully expect he'll be > exonerated after a careful review of the evidence," said Robert Goldstein, > Mr. Liu's defense attorney.

The best-case scenario still seems reasonably illegal here

</comment><comment><USER7>
        >On that evening in late August, Dr. Straface said he introduced himself to Mr. Liu as the CEO and asked who Mr. Liu was and what he was doing in the office.

        >Mr. Liu mumbled at first, then said he was there to visit the company's head of intellectual property and also the sales director for the European division, according to Dr. Straface.

        >"At one point he mentioned that he was here to do business with the CEO, not seeming to realize he was looking at the CEO," Dr. Straface said.

This seems to be pretty damning...

</comment><comment><USER8> We once had a contractor who used _our_ printer to print out a letter to a competitor, offering to sell them our source code. Unfortunately, one of our employees visited our printer at the wrong time (for the contractor)...

<comment><USER9> Hopefully your competitor would have told you anyway. But wow, didn't think this actually happens. Plus, why _print out_ the letter??

<comment><USER8> > Plus, why print out the letter??

This was in the early 90s. We didn't have internet yet.

</comment></comment></comment><comment><USER10> Him declaring innocence provided for a good laugh

> The FBI confiscated "an unusual amount of computer equipment" that Mr. Liu > had brought with him, including the laptops and tablet and also two > smartphones, a smartwatch, a computer thumb drive, two digital video > cameras, several SIM cards and high-capacity storage drives, according to > the affidavit.

<comment><USER11> Is that an unusual amount? That describes my electronics inventory pretty accurately.

<comment><USER12> I would say several SIM cards and large storage drives probably isn't part of everyone's going-around-town bag. The rest doesn't seem TOO out-of-the- ordinary.

For me, someone who occasionally carries two laptops (bulky company-issue, light personal worktop) and a sundry of perboard assemblies that would make the TSA raise an eyebrow. But I think even that might count as 'unusual' if you're talking about the average population. How many peoples' jobs require them to occasionally have 24/7 access to their work computer? How many people carry around devices solely because they vaguely intend to tinker with them at some point, and you never know when you'll have a spare hour?

Probably less than 10%. Also, side-note, as much as I hate the TSA's security theater, I've never actually had problems with bringing things that look like bombs through security. Including a wired belt with a black box covered in electrical tape (compass)...good thing I'm white!

<comment><USER13> I have an SSD (along with a USB SATA enclosure to connect it), a spinning disk, and at least one USB thumb drive in my bag that I bring to work every day (along with my laptop).

This is in part because I switch between working from home and working at the office fairly often, have travel time in between, and need to have access to more VMs than I can fit on my laptop's internal SSD comfortably.

I also may have SIM cards rattling around somewhere; when I travel internationally, I buy a local prepaid SIM, and I may have older SIM cards left over from the last time I replaced one.

<comment><USER14> It's valid for your usecase, but I still agree with your parent comment that your bag's contents are unusual.

</comment></comment></comment></comment></comment><comment><USER15> Fta:

 _The FBI confiscated "an unusual amount of computer equipment" that Mr. Liu had brought with him, including the laptops and tablet and also two smartphones, a smartwatch, a computer thumb drive, two digital video cameras, several SIM cards and high-capacity storage drives, according to the affidavit._

If the guy pleads not-guilty, I wonder how he'd explain why he had that much equipment with him for a business meeting.

<comment><USER16> This often sounds like the kit I travel with, up to three laptops (work main, work task, personal), two phones (work/personal), occasionally a tablet, a portable hardrive, 3-6 thumb drives, plus cables, adapters, dongles, and a power bar or two.

I hope that we're not entering a world where having a bunch of computer equipment automatically makes you suspect.

<comment><USER17> I think the 2 video cameras and several SIM cards is what seems odd about this combo.

</comment></comment></comment><comment><USER18> Modern day robbery

</comment><comment><USER19> Anyone got a non-paywalled link to this story?

<comment><USER20> I've taken to using Blendle to only pay for WSJ articles that I read. Saves me the money of a full subscription, and makes sure quality journalism is funded. Here's the link in case you want to read it, and support journalism: [https://blendle.com/i/the-wall-street-journal/industrial- esp...](https://blendle.com/i/the-wall-street-journal/industrial-espionage- cases-soar-in-u-s/bnl-wallstreetjournal840-20170920-1_7)

<comment><USER21> On blendle, the article is cut short in the middle of a sentence.

<comment><USER22> Even after paying? Can you clarify? It's exactly the kind of service I want.. if I can read the whole article.

<comment><USER21> Yep. Paid with my promo credit, was reading, and arrived at an abrupt, mid sentence stop. There was no UI asking me to pay more.

I requested a refund and gave that as my reason.

</comment></comment></comment></comment></comment><comment><USER23> pw;dr

<comment><USER24> Peter Willis; didn't read?

<comment><USER25> Paywall.

<comment><AUTHOR> Funny, it was definitely not paywalled when I submitted it.

</comment></comment></comment></comment><comment><USER26> I really hope that we can accept turnabout as fair play. At some point, China is going to have technology that America wants and I hope that we can pilfer it.

On the flipside though, industrial espionage is a wealth transfer that reduces inequality. I recently purchased tires for my car - I got some Chinese ones that were 1/2 the price of the other tires and the Chinese tires are shockingly fine. I don't know how they'd get the price and quality without benefiting from industrial espionage.

Perhaps something more ideal would be to opensource everything that's been stolen. It'd encourage companies to take security seriously and it would reduce the value of the stolen property.

Lastly, I kind of wonder how much of this problem is due to companies insisting on removing dependencies from certain people / groups. Think of all the documentation people create 'in case you get hit by a bus tomorrow'. When my grandpa worked, it sounds like it was fine to have undocumented things so long as people knew about it (e.g watch out for that machine, it's sensitive to humidity and here's how to reset it). Now, I'm sure some middle manager would insist that the 'operational knowledge' be documented and stored somewhere that becomes that much more lucrative for a thief.

<comment><USER27> > ... I hope that we can pilfer it.

Steal and steal alike? No thanks.

> I don't know how they'd get the price and quality without benefiting from > industrial espionage.

They engineer their internal economy to keep cheap labor at near starvation levels of subsistence.

> Perhaps something more ideal would be to opensource everything that's been > stolen.

Robin Hood arguments are vapid. Stealing is often costly. Hackers aren't free, although the Chinese government does basically quarantine anyone with any chops.

> Now, I'm sure some middle manager would insist that the 'operational > knowledge' be documented and stored somewhere that becomes that much more > lucrative for a thief.

Actually, all levels of management want information to be there because you don't want to lose enormous sums of money if someone leaves and doesn't document the location of encryption keys before taking a secret job and disappearing into Asia or eastern Europe.

<comment><USER28> > They engineer their internal economy to keep cheap labor at near starvation > levels of subsistence.

The first clause is true enough, the latter seems to be missing a ton of context, given y'know, the _actual famine_ this same government caused two generations ago.

Low wages being a growth engine may not be fair or uniformly beneficial. Compared to the desperation of the cultural revolution it's sort of a paradise. Things are getting better, not worse.</comment></comment></comment>


Yahoo proves that Silicon Valley is no different to Hollywood - <AUTHOR> http://jasonadriaan.com/post/19284168790/yahoo-proves-that-silicon-valley-is-no-different-to

<comment><USER2> Software patents are an "elephant in the room"? Are you serious? The "tech community" is constantly criticizing, forming campaigns[1] and creating petitions[2] against them! _Constantly_.

You are essentially making the erroneous generalization of equating a few big companies and patent trolls with the whole tech community.

Hollywood, on the other hand, is pretty much dominated by the MPAA members, who bought most of the small studios of the area. There's a reason why the Sundance, ACE or South By Southwest aren't in Hollywood.

 _So let's stop writing posts about how Hollywood and the Music industry is outdated, archaic and evil._

No, let's not.

[1]: [https://www.gnu.org/philosophy/fighting-software- patents.htm...](https://www.gnu.org/philosophy/fighting-software- patents.html), <http://en.swpat.org/>, <http://www.ffii.org/>

[2]: [https://www.fsf.org/blogs/community/petition-the-white- house...](https://www.fsf.org/blogs/community/petition-the-white-house-to-end- software-patents)

<comment><USER3> I agree that the tech community is painfully aware of the patent trolls, but for the casual user it may not be as obvious (albeit this blog is aimed at the tech community).

Just look at the coverage that SOPA and PIPA received. I spent about an hour convincing my mom that the poor record companies aren't losing money because of people "stealing" their music, but rather they're not willing to adapt the changing environment.

</comment></comment><comment><USER4> Silicon Valley and Hollywood are not equal... dying businesses are.

<comment><AUTHOR> well put :) too bad yahoo is going to drag us all down with them though.

</comment></comment><comment><USER5> How is anyone surprised that an old company that has run out of steam is trying alternative revenue models that are designed for the benefit of old out of steam companies?

</comment><comment><USER6> This article makes no mention of how Yahoo proved anything. The article claims they (yahoo) have patents as do Amazon and Microsoft among many others, and....?

<comment><USER7> Keep up!

[http://www.wired.com/epicenter/2012/03/opinion-baio-yahoo- pa...](http://www.wired.com/epicenter/2012/03/opinion-baio-yahoo-patent-lie/)

</comment></comment><comment><USER8> Yahoo proves that desperation breeds rather desperate moves. And make no mistake, I think Yahoo has been remarkably resilient in that any number of the gaffes and missteps they have committed could have done them in any number of times (or at least set the machine in motion full speed) yet have still remained at least tenuously in "the game". But this is bad. Very very bad.

Now as to how this makes SV like HWood, I don't see it at all. I worked with a stack of the studios in a past tech life (one I have no love for mind you) and the gap in terms of approach, the manner and the outlook between MPAA/RIAA/Studio management and the lion's share of tech firms is so wide as to be past the horizon line. They are simply totally different in many fundamental ways.

</comment><comment><USER9> "Patent law like Copyright law has become completely impractical in its current form"

While I agree patents for software are impractical (to put it lightly), I don't follow what that has to do with copyright. They're two very different things and I haven't seen many issues with copyright for code (now, copyright extensions by lawmakers/treaties to avoid works hitting the public domain... that's another story).

</comment><comment><USER10> Actually worse. Because software patent is pure shit.</comment>


Facial Recognition Is Accurate, If You're a White Guy - <AUTHOR> https://mobile.nytimes.com/2018/02/09/technology/facial-recognition-race-artificial-intelligence.html <comment><USER2> Can someone who is knowledgable on this subject please comment? I am extremely skeptical of the claim that this problem is as easy to remedy as adding more pictures of people with darker skin tones to the training dataset. Are companies really as dumb as not to have tried that after news stories of this nature have been coming out almost as long as facial recognition has existed?

I am more likely to believe that there is something different about people whose faces are misidentified. Similarly dark furred dogs are usually not used in movies because lighter furred dogs photograph better because of how the light reflects off of them. Perhaps it is as simple as photos of darker skinned people are harder to identify the contours of the face, maybe that is why Apple resorted to adding infrared sensors for their Face ID system. Another possibility is the racial backgrounds of people being misidentified are more androgynous looking and that the AI needs to incorporate other attributes like hair style, makeup and clothing as an additional indicator.</comment>


Avengers movie adds gas engine sound to Audi's e-tron in product placement fail - <AUTHOR> https://electrek.co/2019/04/29/avengers-audi-electric-e-tron-engine-noise-product-placement-fail/ <comment><USER2> They mention laws. It's infuriating that we're legislating in a requirement for noise pollution. The driver is already responsible for not running people down, including deaf people and people listening to music.

<comment><USER3> Silent cars are more dangerous to blind or otherwise impaired people and just general makes it easier for people to notice cars it's a complement to driver awareness.

<comment><USER4> Most of the noise a car makes at residential speeds is tire noise, modern ICE engines are startlingly quiet already.

</comment></comment></comment><comment><USER5> _conspiracy hat_ : I wouldn't have heard or noticed that the amazing, silent Audi e-tron is in the new Avengers movie if they hadn't incorrectly added noise.

</comment><comment><USER6> I don't think it was gas engine sound as much as "Future car sound". I don't think it has an idle sound or anything similar

</comment><comment><USER7> Car should be silent inside and a little noisy outside so that blind and animals can be alerted easily

<comment><USER8> The only sound, that I, the driver of a grey electric car, will tolerate, is the deep bass sounds of the Theme from Jaws.

</comment></comment><comment><USER9> I watched this today and noticed that. Thought it was weird. Presumed it must be a Hybrid. #FAIL</comment>