Bitcoin makes journalists say stupid things - <AUTHOR> https://self-evident.org/?p=993 <comment><USER2> I'm sorry, but I don't see the incentives here. We have on the one hand a number of professional economics writers (e.g. Krugman) who are skeptical or dismissive of Bitcoin. On the other hand, we have a number of bloggers who already own Bitcoins and have a direct financial interest in their appreciation. I think it's pretty clear which side the hacks are on. Arguments such as "this is obviously not Tulip Mania because Bitcoin is not a tulip" only confirm it. (By the way, Tulip Mania involved some pretty sophisticated financial instruments - futures, options, insurance etc. Those 17th century Dutch who invented the stock exchange were actually pretty good at breaking a tulip into a million pieces and selling it repeatedly without its changing location.)

<comment><USER3> Paul Krugman was also skeptical and dismissive of the Internet:

> The growth of the Internet will slow drastically, as the flaw in "Metcalfe's > law" -- which states that the number of potential connections in a network > is proportional to the square of the number of participants -- becomes > apparent: most people have nothing to say to each other! By 2005 or so, it > will become clear that the Internet's impact on the economy has been no > greater than the fax machine's.

> As the rate of technological change in computing slows, the number of jobs > for IT specialists will decelerate, then actually turn down; ten years from > now, the phrase information economy will sound silly.

<comment><USER4> I think it's safe to assume that Krugman is a lot more trustworthy when talking about something that's actually within his realm of expertise; namely, economics.

<comment><USER5> economics boil down to human behavior.

what does it say about a person who is dismissive about the way technology can affect/influence human behavior?

what makes him an expert? is it because he panders to what is the status quo (the ever-present monopoly of sorts)? is it because he engages in thoughtful exploration of ideas and notions with a larger community and helps bring about great discussion? is it because he has a degree? is it because he has done something notable for humanity?

</comment></comment></comment></comment><comment><USER6> I was researching Bitcoins for use in a project I'm working on, so I've been slogging through this and other articles lately with great dismay.

The biggest problem right now with these kinds of articles (this one included) is that while yes, they are dramatic, they are technology-focused. We're not getting a lot of economists writing on Bitcoin. Paul Krugman has written a bit that I think is spot on.

Every article I read seems to compare Bitcoin to other currencies and say it's the same because those currencies are made up too. This is a patently false statement, and why we need more economists involved. Real-world currencies are valued on the GDP and credit-worthiness of the nations that issue the currency. Bitcoin lacks this fundamental property. As it stands, Bitcoin is more like gold or the old tulip craze: it's based on the desire of those involved to have it.

As Paul Krugman indicates, Bitcoin is actually a pretty bad currency. It's difficult to convert to, few places accept it as currency, and worst there's rampant speculation on the fictitious value of the currency. Take the exciting tech out of the picture, and you've got a currency that is about as interesting and useful as the Zimbabwean dollar.

For example, one author writes about how he purchase 92% of a single Bitcoin for $130. One site I found that accepts Bitcoin will send you a free t-shirt if you spend more than 1.5 Bitcoin. So if you spend over $200, they'll send you a $10 t-shirt. What an incentive. And I'm not sure how the site deals with the wildly fluctuating value of the currency.

I know banks and governments don't always manage money well, but there is something to be said for the regulation and support we do get from traditional currencies. If the USD fluctuated like Bitcoin, the US economy would probably collapse.

Needless to say I've decided to just go with plain credit card transactions in our project, and stay away from this volatility and uncertainty.

<comment><USER7>
      We're not getting a lot of economists writing on Bitcoin.

What's the track record of economists vs. computer scientists over the past ten years (or twenty, or fifty)? You don't have liberal sorting algorithms and conservative ones, but you do have liberal and conservative economic theories. This indicates that economics, especially macroeconomics, is more like opinion journalism than science. We need empirical tests. Bitcoin provides one.

Postscript:

Computer science has delivered the goods in a way that economics just hasn't, as even Krugman admits[1]:

      ...the widely accepted proposition that events like those
      of the 1930s could never happen again. But even pessimists
      like me, even those who realized that the age of bank runs
      and liquidity traps was not yet over, failed to realize how
      bad a crisis was waiting to happen...

      What you can criticize economists for – and indeed, what I
      sometimes berate myself for – is failing even to see that
      something like this crisis was a fairly likely event.

Why weren't they able to see this was a likely event? Well, rewind a bit and witness Bernanke writing in 2004 about the "Great Moderation" [2], the ostensible "decline in macroeconomic volatility":

      My view is that improvements in monetary policy, though
      certainly not the only factor, have probably been an
      important source of the Great Moderation. In particular, I
      am not convinced that the decline in macroeconomic
      volatility of the past two decades was primarily the result
      of good luck, as some have argued, though I am sure good
      luck had its part to play as well.

In other words, Bernanke thought the (nonexistent) Great Moderation was the result of improvements in monetary policy. Thereby approving of the monetary policy that inflated the housing bubble, while blithely unaware of the catastrophe that was to unfold. Conclusion: economists aren't so good at predicting economic events or structuring economic systems. Ben thought the system he'd helped build wouldn't fall down. It did. Time for some new ideas, from people who actually do build systems that don't fall down: computer scientists.

[1] [http://krugman.blogs.nytimes.com/2012/03/05/economics-in- the...](http://krugman.blogs.nytimes.com/2012/03/05/economics-in-the-crisis)

[2] [http://www.federalreserve.gov/boarddocs/speeches/2004/200402...](http://www.federalreserve.gov/boarddocs/speeches/2004/20040220/)

<comment><USER8> This is nonsense. "Time for some new ideas, from people who actually grow complex organic systems: animal trainers." "Time for some new ideas, from people who actually keep large masses of people happy: sex workers." "Time for some new ideas, from people who actually clean up others' problems: garbage men." What your argument is missing is that even if top economists aren't great at economics, they might still be better at it than computer scientists. Maybe top economists are bad at economics because _economics is hard_. Not because only idiots do economics.

<comment><USER7> Computer scientists have proven themselves capable of going into completely unrelated areas (advertising, video, audio, hotels, taxis, airplanes, and most notably payments) and completely disrupting the status quo of the "experts".

And those experts were at least operating profitable legacy businesses, so had _some_ empirical proof of their claims (to wit: their products worked, even if not as well as the Valley's).

Now, lo and behold, we have a direct test of open source software vs. Krugmanesque proclamations. Krugman is simply not qualified to evaluate Bitcoin. You think he knows SHA-256 from a hole in the ground? He'll say it won't work just like legacy payment providers thought Paypal wouldn't work. And then he'll start advocating that it be prosecuted once it does threaten him, and then he will lose.

<comment><USER9> You are exhibiting a selective memory that only remembers the successes. Investors in the late 90s pumped money into "computer scientists" only to find that just because something is being done on the Internet doesn't make it automatically profitable. You look at Bitcoin and think it is so obviously Amazon.com, but it could just as easily be Pets.com.

</comment></comment></comment></comment></comment><comment><USER10> I think Bitcoin itself isn't making the media say stupid things. I think the media says stupid things _all the time_ , it just happens that a lot of us, who knew Bitcoin from the beginnings and already have a fair share of knowledge on this subject, can see more clearly how inherently flawed a lot of the information is.

This sudden uprise of awareness and the news coverage that came with it, surely made me even more skeptical about mainstream media, as no one is to be trusted. Financial Times, Bloomberg and all the big ones that have such a tremendous amount of weight behind them, are in the end inseparable from blogspam, as they have the same sensationalistic tendencies and didn't do their homework, at all. It's not easy to digest the phenomena Bitcoin, but at least have the decency towards your followers of not commenting on it until you have established at least a semi-understanding of the matter.

<comment><USER11> This has always worried me about news/media. When ever they cover anything I have the slightest background in, they get something, or everything, about it glaringly and completely wrong. So what else are the getting wrong the rest of the time? My guess has to be everything I suppose.

<comment><USER12> I believe that John C. Dvorak made the same argument on the No Agenda podcast a few weeks back. It has really made me rethink how news is reported. We simply have no way of knowing if what is being reported and explained is correct.

Even in the rare cases where true expects a interviewed we rarely get a completely objective opinion. This, I believe, is either because the journalist are trying to steer the conversation into a direction he or she understands or because it make for more "exciting" news.

It's truly sad that the media believes that it should dumb down content, or make it more "easily available" at the cost of the truth and correctness. I don't think the average media consumers are so dumb that it's necessary and if they are presenting the with incorrect information surely can't be helping the issue.

</comment></comment></comment><comment><USER13> Bitcoin is at the brackish between macroeconomics and cryptography. Macroeconomics, despite every reporter professing to understand it to a T, is immensely complicated, in both its theoretical and empirical aspects. Cryptography is similarly esoteric (and subject to popular Dunning-Krueger effects) within the tech community.

Thus, we see a lot of tech journalists busy making a trash job of nineteenth- century economics while FT Alphaville finds its analyst who made easy work of dynamically-tranches credit products stumped by cryptography 101. It will take time for the theoreticians on either side to get a handle of things, and a good deal of hot air will be expended in the process.

I can't say I'm not excited about this - it's a grassroots experimental verification of a lot of economic theory. But if people are ploughing savings they cannot afford to lose into the currency out of anger against the present economic situation, ideology, or a mis-understanding of economics, that is a problem, and it is irresponsible not to at least try and give fair warning.

</comment><comment><USER14> The interesting thing about the bitcoin community is that they've discovered that nearly everyone else besides themselves and F. A. Hayek is stupid.

<comment><USER15> Can't decide at all if you're being sarcastic or not. Well played sir!

</comment></comment><comment><USER16> Moreso even than being wrong about a lot of things, I've been continuously amazed at how polarized coverage on Bitcoin is.

It's very rarely been approached, by journalists, as "here's an interesting technology. It's a little kooky, but it's getting more popular. I wonder if anything interesting is here?".

Instead, you get either intense fandom or intense vitriol.

<comment><USER17> I suspect that is a function of pandering to their audience. There is an active readership that wants to believe Bitcoin is an escalation in the "drug war", there is a readership that wants to believe that Bitcoin can remove the influence of financial institutions on government. Articles that pander to their targeted readers get a lot of 'shares' and what ever counts as upvotes for them. This in turn is used by the author to represent their own "value" to the agency where they are providing the page views.

I thought the priceonomics coverage was quite good, but I tend to look at it through an economics lens rather than a particular idealism.

</comment></comment><comment><USER18> It's all about incentives: online bloggers and mainstream media types have an incentive to get a story out to keep people coming back to their websites / TV stations. They have no incentive to tell the truth, since no one holds the media responsible.

In crisis situations, the media reports whatever rumor is floating in the air at the time, just to fill the airwaves. Regarding the Bitcoin exchange rate surge since the beginning of the year, the media conflates it with "concerns" over the Cyprus situation, just to make news. Regarding markets in general, the financial media loves to say that the Dow moved down on "worries" over this or that, when in reality the price action usually has nothing to do with that imaginary concern.

Since Bitcoin is difficult to understand for most, it's asking WAY too much of the media to report on it correctly. How often have you seen quotes from "experts" over their concerns that Bitcoin will get "hacked" and become worthless? How often do they refer to "shares" of Bitcoin?

Have you ever seen a mainstream article about Bitcoin network strength increases / decreases?

</comment><comment><USER19> The bitcoin should be renamed the Dunning-Krugerrand.

<comment><USER20> You sir have won the Internet. Well played.

<comment><USER21> Not so fast, that term was coined in a SomethingAwful thread about bitcoins.

</comment></comment></comment><comment> brown9-2 _So there you have it: The government is the people, and to oppose mega-banks is to oppose democracy itself. Pretty sure I read that in the Federalist Papers._

1\. Is "the government is the people" meant to be a criticism?

2\. Interesting that in the quote from Felix Salmon that this is criticizing, Salmon never mentions _mega-banks_ or that the size of the bank is related to their civic responsibility. It's the author of this piece who is inserting a bias against "mega-banks", and assuming that anyone who is pro- the existence of banks in democratic society is also pro-mega-bank.

</comment><comment><USER22> One thing you learn about the press as you have a few experiences as an "insider": they almost never get it right.

Reporters rarely have the time, intelligence, and information to research and write an accurate report on every subject. There is no Bitcoin correspondant for Bloomberg, just an overworked, underpaid English major.

</comment><comment><USER23> So financial journalists have no idea how these things are made, used, or what place they have within transactions, economies, etc. and you expect masses of people to eventually feel comfortable with the stuff?

The fear that is engendered by a non-tangible, value-containing set of bytes of data on a computer in the age of hacker doom-dom is quite likely the extent of what you need to know about its foreseeable viability and should put the current "value rollercoaster" into perspective.

How does the layman NOT lump the early adopters/hype pumpers in with the same crowd vandalizing paypal and credit card companies? So these kids created a currency to reject the system and they think this is the future?

It's like watching some unruly teenagers with a very large potato gun mounted to their friend's back and saying... "This is the future of the postal service. Buy stamps while they're cheap."

It's the emperor's new clothes. That's not a currency. It's barely a digital promise to anonymous posters on 4chan. As long as there isn't anybody with a strong incentive to pull the plug, this thing will continue to eat up every online "watering hole." It's great for silk road, but spare us the hype machine. The only people with incentive are adopters.

They shut that zeek's reqards down in NC and now everyone is hopping on the p2p currency train. Start your own business! Invest in the peoples' coin!

</comment><comment><USER24> Does it make economics professors say stupid things, too? Because the first Felix Salmon callout in this post, the one followed by "blah blah blah", also happened to be Tyler Cowan's "best sentences I read all week".

I guess we can debate whether Tyler Cowan is paid to think --- or, as Moldbug puts it, even _allowed_ to think --- and so on/forth in No True Scotsman style until we've narrowed the conversation to "hackers" who think exactly like we do.

</comment><comment><USER25> Here are a few recent articles I found to be relatively accurate and fair (several of which have already appeared on HN):

[http://blog.priceonomics.com/post/47135650437/are- bitcoins-t...](http://blog.priceonomics.com/post/47135650437/are-bitcoins-the- future)

<https://medium.com/money-banking/2b5ef79482cb>

<https://mises.org/daily/6399/The-Moneyness-of-Bitcoins>

[http://www.forbes.com/sites/timothylee/2013/04/03/four- reaso...](http://www.forbes.com/sites/timothylee/2013/04/03/four-reason-you- shouldnt-buy-bitcoins/)

[http://jpkoning.blogspot.com/2013/04/bitcoins-plunge- protect...](http://jpkoning.blogspot.com/2013/04/bitcoins-plunge-protection- team.html?spref=tw&m=1)

<comment><USER26> This BusinessWeek article is also good: [http://www.businessweek.com/articles/2013-03-28/bitcoin- may-...](http://www.businessweek.com/articles/2013-03-28/bitcoin-may-be-the- global-economys-last-safe-haven)

</comment></comment><comment><USER21> I didn't know horribly-written opinion pieces like this could make it to the top of HN.

<comment> brown9-2 We seem to be in a midst of a bitcoin article bubble.

<comment><USER27> If you could seize 51% of the computer power of HN readers we could make them disappear.

</comment></comment></comment><comment><USER28> I think this has been posted on every bitcoin discussion so far:

[http://www.econlib.org/library/Enc/CompetingMoneySupplies.ht...](http://www.econlib.org/library/Enc/CompetingMoneySupplies.html)

[http://www.econtalk.org/archives/2011/04/andresen_on_bit.htm...](http://www.econtalk.org/archives/2011/04/andresen_on_bit.html)

so here it is again

</comment><comment><USER29> This is true of any remotely complex process or occurrence. The proletariat is dumb, and the news media that caters to them feels compelled to dumb their work down so that it can be read by the most technically-naive person. As a result, the threshold for what constitutes adequate reporting is lowered.

99% of people don't give even a remote shit about Bitcoin, nor are they likely to ever purchase any; and, if they do, they will never pay even a perfunctory thought to the cryptographic and economic implications. Because of this, writers have little incentive to pour effort into considering and/or researching the actual nature of Bitcoin.

If they can get away publishing ill-though out arguments and include outright falsehoods in their writing, why would writers opt to incur more work by attempting to write a thoughtful, correct piece?

If the market will tollerate lazy writing, laziness is what the market will get...

<comment><USER30> It isn't just mainstream journalists though. Frankly, I can't remember another topic on HN about which so many low-quality tech blog articles were promoted to the front page.

</comment></comment><comment><USER31> tldr: some things that people have said about Bitcoin are innacurate, therefore "financial journalists are way over their heads here, their "sources" are useless, and you will learn less than nothing by reading them"

</comment><comment><USER32> "could not be stolen through any amount of force". If bitcoins are practically unstealable/unconfiscatable then that'd be neat, but they aren't. They are stolen in vast quantities all the time by malware. If the government wants your bitcoins badly enough it can run a tank into your house, use force to compel you to tell them your password, torture you etc. You're not screwing the state over, you're giving it an incentive to take a hostile interest in you. Did anyone download the clients anonymously? Not many did. They will know.</comment>


Excision in Datomic - <AUTHOR> http://blog.datomic.com/2013/05/excision.html <comment><USER2> This is (was?) one of the reasons I don't use Datomic.

The other is that it's closed-source, which sadly has not changed. I certainly wouldn't mind paying for commercial usage/support. I can't justify relying on something I have no control over whatsoever when there are so many open source alternatives, however clean and nice I find Datomic's design to be :(

<comment><USER3> Every time datomic is brought up, people always chime in with this whining about it being closed source and I just find it sounds entitled and petty. It makes it seem like with enough people agreeing with you and enough upvotes or whatever, you think the releasers of datomic might reconsider and open source their code.

This is the same person/people that released clojure to the world (as open source). It's not like they're a company with a history of closed proprietary software, they are fully aware of their options, and I'm sure they have their reasons for keeping it closed. Aren't they entitled to do whatever they want with the code they produce without frowny faces all over the comment threads?

<comment><USER4> Yes, we could both compensate people for their work, and have it totally open. It's certainly imaginable; it doesn't violate a law of physics. But that would require collective action, like public subsidy. While people refuse to work towards that, for whatever ideological reasons, then we won't have it both ways.

<comment><USER5> All the code the company I work for writes is AGPL licensed, and we don't need rent-seeking^Wpublic subsidies to get compensated for it. The trick is to get an agreement before the code is written, as well as providing other services around that code.

</comment></comment></comment></comment><comment><USER6> Another 'broken on mobile' site (Aurora on Android here).

The tech might be cool, the site is awful.

Downvoters: I like Datomic, like Stuart, but the site is crap. First visit had lots of artifacts (content was seemingly above the annoying header), cannot reproduce that now. Right now a huge part of the display is a fixed header, the content is 'unzoomable'. There's no way to say anything nice about that sort of stuff.

<http://db.tt/sIstWJhZ>

<comment><USER7> One of the craptastic Blogger templates. I've taken to viewing them through Google Cache, when possible (and when I'm sufficiently motivated to not simply quit the item/site); unfortunately, more and more seem to be excluding themselves from said caching.

[http://webcache.googleusercontent.com/search?q=cache:http%3A...](http://webcache.googleusercontent.com/search?q=cache:http%3A%2F%2Fblog.datomic.com%2F2013%2F05%2Fexcision.html)

<comment><USER6> Hmm. It seems Google Cache doesn't help me here. Now I was able to reproduce the artifacts in the page header, but the huge header itself remains (too much screen space, literally zero value) and the content still fails to allow pinch/zoom to actually read the text in the illustrations.

<http://db.tt/Yz5J6zd4>

</comment></comment></comment><comment><USER8> _It is a key value proposition of Datomic_

Is that a purposeful pun? Because it confused me.</comment>


CES kicks off with no lead women speakers or code of conduct - <AUTHOR> https://www.reuters.com/article/us-tech-ces-misconduct/ces-kicks-off-with-no-lead-women-speakers-or-code-of-conduct-idUSKBN1EU25O <comment><USER2> > "To keynote at CES, the speaker must head (president/CEO level) a large > entity who has name recognition in the industry," said Karen Chupka, who > oversees the event as senior vice president at the Consumer Technology > Association (CTA), in a blog post a month ago. "As upsetting as it is, there > is a limited pool when it comes to women in these positions. We feel your > pain. It bothers us, too. The tech industry and every industry must do > better."

Sounds like CES isn't really doing anything wrong here.

<comment><USER3> They could just relax their rules. I'm sure there are a fair number of non- male VPs or other execs with name recognition that would be pleased to speak at CES. Did they even look?

<comment><AUTHOR> Yeah, there's no excuse for _zero_. That's ridiculous.

Outreach takes effort, but if you're sincere and your organization is truly welcoming, it works. Even when there's a limited pool, you can still make things happen. A handful of candidates tend to be in high demand, but that's fine.

But CES hasn't even adopted a code of conduct! No wonder their numbers are so dire.

</comment></comment></comment><comment><USER4> _> CES made a concerted push to diversify its entire speaker lineup, but ultimately failed to find a high-ranking female executive for an individual keynote address._

And Karen Chupka wrote: _"As upsetting as it is, there is a limited pool when it comes to women in these positions. We feel your pain. It bothers us, too. The tech industry and every industry must do better."_

Now check out this event: [http://www.officeshow.co.uk/](http://www.officeshow.co.uk/) Lots of photos of females on the front page. A majority of female speakers here. I bet the attendees will be mainly female.

Just observations, symptomatic of the problem...

And the problem is _women_ , just as much as anything else. There, I said it.

 _Get out there and do some science, engineering, AND tech._

</comment><comment><USER5> And somehow it will go on. Imagine that.</comment>


Amber Rudd claims "real people" don't care about end-to-end encryption - <AUTHOR> https://arstechnica.co.uk/tech-policy/2017/08/amber-rudd-claims-real-people-dont-care-about-whatsapp-end-to-end-encryption/ <comment><USER2> That's partly true because many don't know about it.

When they realize that middle machines are inserting their tracking software and/or modifying their content people will start to ask questions.

But it's a situation where people don't know they are being protected so theyay not care as much</comment>


For 10 years NASA has been Photoshopping its astronauts into posters - <AUTHOR> http://www.businessinsider.com/nasa-posters-inspired-by-pop-culture-2017-7/#the-poster-for-expedition-16-2007-was-the-first-time-the-crew-went-with-a-pop-culture-homage-inspired-by-the-matrix-1 <comment><USER2> Stupid clickbait. The title continues: "for everything from 'Star Wars' to 'Reservoir Dogs'".

Direct link to source is [https://www.nasa.gov/directorates/heo/sfa/sp/expedition- post...](https://www.nasa.gov/directorates/heo/sfa/sp/expedition- posters-50-59)</comment>


Presidential Candidates on WP - <AUTHOR> http://ma.tt/2011/08/presidential-candidates-on-wp/

<comment><AUTHOR> Who's afraid of the "Big Bad Open Source" now? :)</comment>


New Education Bill to Get More Coding in Classrooms - <AUTHOR> http://blogs.wsj.com/digits/2015/12/10/new-education-bill-to-get-more-coding-in-classrooms/ <comment><USER2> I'm from India and I am not really sure on how CS is taught to primary/middle school students, but I really think creating a new subject in a system that already has too many subjects is just silly.

School students really need to just learn "programming". Students should instead to be taught about programming in a lot (maybe even all) of their classes. Programming in maths and science classes is obvious, but students can be given the option to mess around with electronics to create different sounds in their music classes, or instead of being asked to submit papers/essays in history, they could create an interactive site. Basically, the idea here is they should be able to program for all and any of their classes and the idea of this programming should be to create something, and not solve mundane computer science problems, which they can be tested on at the end of the year.</comment>


"How I discovered an Easter egg in Android's security" - <AUTHOR> https://habr.com/en/post/446790/ <comment><USER2> Love the story. That's quite interesting. Also, I wonder if this thing with hiding stuff in product to pre-selects possible candidate is something that HR does to improve recruitment or something that came from the devs.

</comment><comment><USER3> Wait, the interviewer asked you to "develop a Base64 algorithm", on the phone? That's hardcore.

<comment><USER4> Is it? I guess anyone that read the RFC or saw one implementation can easily reproduce it from the top of their head. Of course some details can be fuzzy and it's not that easy under stress but base64 is definitely not rocket science.

<comment><USER5> As with most coding questions, the important parts are when you start looking at corner or edge cases. Or when you refine your initial implementation.

</comment></comment></comment><comment><USER6> Side note to Andrei: If you care about keeping your email address hidden in the screenshot, don't just blur it. Blurring text is not sufficient for privacy. See for example [https://news.ycombinator.com/item?id=8078747](https://news.ycombinator.com/item?id=8078747)

</comment><comment><USER7> Hi Andrei, first of all, great story! Sorry about your Google interview (if I ran a tech company and interviewed you I'd have hired you in a heartbeat!). You apparently had to deal with a prima donna, egocentric, rank-and-file programmer/interviewer, whose opinions about your value as a potential hire can be summed up as "does the candidate know exactly the same things as me in the very narrow technical sub-niche area in which I work?". You do not want to work for such a person. You want to work with (not for) people with much broader minds (Paul Graham, Joel Spolsky, ?) than that.

Now, that aside, let's talk about what Google is probably doing.

The way to understand it is to understand a very significant problem.

Let's say that I am Netflix, for example. And my goal is to prevent people from pirating all of my great (and costly) video content.

If the content is unencrypted, then it's easy for people to pirate those streams.

But now, what if we encrypt the content using one globally-used encryption method?

Well, if we encrypt it that way, the decryption code must be part of whatever client program is being used... a smart pirate could potentially reverse engineer the client program, and extract (and use) the decryption code. Once that's done then "the cat's out of the bag" proverbially speaking, that is, the same code can be re-used, and all of Netflix's streams can now be pirated by whoever wants to pirate them.

We could encrypt each stream using a standard encryption algorithm, but with a different key each time. This is somewhat better, but that assumes that the key can't be recovered somehow, which is a terrible assumption.

So what's the best solution?

Why not use an obscure, unique encryption algorithm for each stream, and have the client download different decryption code _each time_ , for each stream?

This way, if the code used to decrypt one stream gets leaked to everybody, everybody can't use it to decrypt their custom-encrypted streams!!!

How do you implement this?

On the client side, you implement a virtual machine which is going to do the decryption. Then you send the unique virtual machine code which implements the unique decryption algorithm for the one and only one stream you're going to send!

You do this each and every time, with a different, unique decryption algorithm for each stream.

This, or something like this, is what this code appears to be doing. (It might not be for a video stream, it might be for any data that Google might want to keep encrypted, for any reason... heck if someone really wanted to go crazy they could encrypt nested VM code _inside_ of encrypted nested VM code -- and this could go on to N levels deep! <g>)

(You discovered this by disassembling the code; I figured this out years ago (because I might need this for a future business) by looking at the problem->solution->problem->etc. chain...)

Either way, you don't want to work for that guy at Google.

Take my word for it, you're Google-smart, even if Google doesn't think so.

<comment><USER8> But you still have to send the decryption algorithm, right? It's essentially a funkier key?

<comment><USER9> Yeah, the main difference is that usually these vms can be deliberately written to be nonportable to things like emulators and headless browsers, making it a lot harder to just execute the same code at scale.

</comment></comment></comment><comment><USER10> Awesome read!</comment>


Gran Turismo 5 [US] Release Date Announced - <AUTHOR> http://ps3.ign.com/articles/109/1098188p1.html

<comment><AUTHOR> 300+ screenshots: <http://media.ps3.ign.com/media/857/857126/imgs_1.html>

Visible drivers; car damage (open doors, crunched and torn fenders); breathtaking scenery; visible light from cars (on road, on dust clouds); driver's seat views (dash, steering wheel, rear view mirror, etc.).</comment>


The Content Farm - <AUTHOR> http://thecontentfarm.tumblr.com/

<comment><USER2> For those too lazy to follow the link, it's a satire on Demand Media and their ilk. It's in weblog format.

Entries include: "How to Pay Off Your Credit Card Debt" (Don't confuse debt and debit. Debt is something you owe, debit is something you owei.), "How to Boil Water" (Boiling and broiling are different things. To broil water, put it in your oven and turn it to broil.), and "How to Become President of the United States" (If you're president, you get all the nuclear weapons. Every president gets to destroy one country, so pick yours now.).

My personal favorite is "How to Sob Uncontrollably."</comment>


Ask HN: How to approach a computer vision freelancer - <AUTHOR> My company is working to build a desktop application with an image classification feature at its core.  It will be basic presence absence feature detection (there is/is not a sailboat/windmill/bird in this photo) and we will be looking for fewer than 5 features, everything else in the photos being irrelevant.  The application will need to be able to operate on a local machine without Internet connection.
We would like to hire a freelance to build the model, and develop future iterations if the product is a commercial success.  I am a business operator that has deployed logistics, data analysis, and data visualization software at several mid sized firms but have not outsourced technical work in the past.  How should I go about attracting talent and setting them up for success?
Where should I look to find a quality freelancer? What formats should I specify for the deliverables? What timeline should I expect? What pricing should I expect? What would a good developer expect me to provide in terms and training data? What API parameters would they expect me to specify?
Thank you for your help, in advance. <comment><USER2> This is a useful post. I'm also currently looking for a computer vision resource to provide expertise in a project centered on visually identifying anomalies in video of industrial machines. In other words, watching a robot and firing an alert when he misbehaves or breaks down :-)

Similar to what I believe your approach is, I'm looking for someone comfortable working in iterations. So much of this type of work is experimentation and trial and error.

If you want to connect, hit me up using:

[http://telegram.me/tomgriffin](http://telegram.me/tomgriffin) [http://linkedin.com/in/tomgriffin](http://linkedin.com/in/tomgriffin) [http://facebook.com/tomgriffin](http://facebook.com/tomgriffin)

</comment><comment><USER3> Computer Vision is a highly specialized field. If what you need is an MVP just get some code out of the internet with a run of the mill dataset and create an MVP based on that. That means you don't care about the accuracy, recall, F1, and all the mambo jumbo we do care about and you should if you plan to have a product built around computer vision stuff.

You can even run that kind of stuff using Microsoft and IBMs API out of the cloud for an MVP. If what you need is to test the product idea. Mind you if I were you, I wouldn't even build the product in the first place and do a proper UX work first that will allow you to figure out pretty fast and very cost effective if it makes business sense to pursue computer vision at all.

Now assuming that you have all those angles covered. No, you shouldn't hire a freelancer. This is a piece of technology that is very specialized, very complex and difficult to get right (to fit for purpose) and debug; you either want a contractor company that knows what they are doing and ensure they are skilled in knowledge transfer (the good ones are not cheap). At least if down the road you want your company to be able to build your own team on top of the base technology. Another alternative is to buy a third-party product and deal with the risk of the technology not being fit now or later in a year for your purposes.

Disclaimer: I work for such a contractor type.

<comment><AUTHOR> Thank you for these thoughts!

Using existing software through an API won't work because I need the model to work offline.

The idea of hiring a firm is a good one - how would you answer that same series of questions when approaching a firm rather than a freelancer (cost, time frame, needed training images, technical specifications, etc)?

<comment><USER3> Training images: there is a tension here. You need to know if what you are asking is specialized knowledge (say machine parts) or you can get away with currently available ones. So unless what you need is very general, the answer to that is yes.

Cost: Firms that know what they are doing ain't cheap. It is a simple cost structure issue. Think about it, a single AI guy may cost around 300K year just in salary, so that is a starting point from the cost point of view. They have to make at least enough to cover those costs a year. Now a interesting tidbit that is not known much, not all AI guys live and breath in the United States (aka SV, NY and Boston). Our company is based in Argentina, and we built among other things face recognition software and done research for big names in the states. So if costs are prohibitively, think about shopping off- the-coast, you will be surprised.

Given that you don't have any real target, anyone skilled enough will interview you and figure out pretty fast if you understand what you need. If they push you to give them targets for say accuracy and you cannot back up why you need X or Y, they will know you are not well versed and because of the risk:

1) They pad their cost to deal with your uncertainty.

2) The most professionals will plain refuse to do the project on those terms (I know for a fact because we had rejected many because the clients were not ready to pursue such an endeavour).

Now the most important, there is a lot of smoke out there. Today doing ML work is cool and fancy (so everybody is doing it, right?). Truth is there are not many that know what they are doing, chances are you will end up in a bad spot if you are not very diligent. That is why I suggested first to do the pre- screening UX work first before committing to anything. You will be embarking on the path, only if it really makes sense and you will have spent say 30K to figure out that probably you don't need it, or you need to build something so constrained that you can get away with very rough and trivial tech.

If you go to a firm and ask for a classifier they will probably build you a convolutional neural network or RNN or whatever, sometimes you don't even need that. We had a client a year ago that needed something very specific, they asked us a quite intelligent OCR essentially. We could build it, or retrofit a commercial one, but working with them on the pre-screening we figured out that the use case was actually pretty restricted and because of specific constraints we were able to build in 5 days a solution that is in production to this date (plain old template matching did the trick). They spent 20K up- front, they end up saving 300K+ or even more in the very short run (and have a product out there in 3 weeks instead of 6 months).

How would we do it? In those cases we start with a very small project to figure out what kind of technology we actually need, that may involve UX work or plain ML MVP creation work. Aiming to keep the costs as low as possible with the idea to have something that we can actually test and figure out if that is good enough to be part of the product. Sometimes that involves just incorporate some pre-trained model that you could retrofit, other times it involves scanning for the state of the art and figure out what you need to build in order to achieve the goals. But, in order for that to work, there must be a constraint in time and the understanding that you are diverging toward a solution. It is essentially risk management at its best. I wouldn't trust anyone that doesn't start like that for a brand new Vision based product/feature.

<comment><AUTHOR> This is incredibly helpful. Thank you. I definitely understand the need to have a clear understanding of the software performance, and I have many of those details already nailed down. I absolutely plan on running an MVP project first to see if trivial tech will suffice, and to get a feel for the firm/freelancer that I'm working with. It could be that my project is constrained enough we do not need the same level of sophistication as many models.

I also am entirely willing to push my project offshore, so long as I can communicate with my partner and am confident that they can deliver.

If I wanted to engage your firm, how could I get a hold of them/you for further discussion about my project details?

<comment><USER3> Contact me: federico.lois (at) corvalius.com

</comment></comment></comment></comment></comment><comment><USER4> This sounds like the classic image classification challenge. The next question I would have is: is this on open world or closed world problem? Meaning, what is the world of images that the model will be exposed to in the wild. Will it only be exposed to sailboat/windmill/bird or will it be exposed to sailboat/windmill/bird and every other possible item in the world?

You also want to deploy this on a standard machine w/ or w/o a GPU? That can have implications on inference speed. But there are ways to optimise for that. The absence of a network connection is not a problem.

Also, do you have training data? If not we can probably leverage a pre-trained model for this use case where, in this case we would only need a handful of training examples.

To answer some of your questions:

Where should I look to find a quality freelancer? Not sure.

What formats should I specify for the deliverables? Depends on what tools the developer uses, for example, I would deliver files in TensorFlow export format.

What timeline should I expect? Using a pre-trained model, I could expect to deliver it in about 40 man hours.

What pricing should I expect? Probably about $6000, but that depends on the contractor.

What would a good developer expect me to provide in terms and training data? Using a pre-trained model you would only need a handful of training images. But, of course, the more the better.

What API parameters would they expect me to specify? I can't think of anything.

I have experience building and deploying these vision models. Feel free to reach out to me for more info. It's my username @ gmail.com</comment>


FBI to Congress: Access to encrypted data "must be addressed" [pdf] - <AUTHOR> http://judiciary.house.gov/_cache/files/dfa27f3f-9875-4faa-93c3-de939f4706b2/fbi05.doc.pdf <comment><USER2> Encrypted communication hasn't historically been a serious deterrent for one of the world's premier intelligence services. I like to assume the FBI hires capable detectives, but this recent "crypto frenzy" indicates otherwise.

</comment><comment><USER3> Where in this document does that statement (or one like it) appear? I gave it a quick read but didn't spot it.

<comment><AUTHOR> It's at the bottom of PDF page 3--search for "encryption."

Excerpt:

 _Unfortunately, changing forms of Internet communication and the use of encryption are posing real challenges to the FBI's ability to fulfill its public safety and national security missions. This real and growing gap, which the FBI refers to as "Going Dark," is an area of continuing focus for the FBI; we believe it must be addressed, since the resulting risks are grave both in both traditional criminal matters as well as in national security matters._

<comment><USER3> Ah. In context, it sounds quite a lot less ominous than title of the OP. _Of course_ they have to address it. _How_ is the question.

<comment><USER4> It is well-known that the FBI director's position is that laws should require the use of back-doored encryption. His position is both ominous and one that has been refuted by a preponderance of experts as dangerous and impractical.</comment></comment></comment></comment>


Barclays Bank Using Internet Archive as CDN for JavaScript Files? - <AUTHOR> https://twitter.com/immunda/status/1278783894683336704 <comment><USER2> It's cute but probably just a consequence of a content editor at Barclays who has copy-pasted some old content.

A technical solution could be to add a strict CSP policy but in general the problem is broader and applies to a lot of banks.

The real issue is that banks (and it's not specific to Barclays) are loading JavaScript code from third-parties.

The fact that it is InternetArchive (yet another Internet cache) is not more worrying than GoogleUserContent.com for example.

Otherwise, the "asking money for redemption/forgiveness" part to Barclays is a bit borderline in my opinion.

<comment><USER3> Content editors should not be able to add arbitrary code to a bank's website unless it undergoes review from someone who understands web security. If there is some kind of content editing tool, it should only allow content (not arbitrary scripts) to be edited.

<comment><USER4> Until about a year ago I was working as a FE developer for a major intenrnational bank.

All the processes and knowledge were in place to make sure all considerations were taken with our software with regards to security. But... all that good work and intention goes out the window when the marketing and analysis teams could pretty much, on a whim dump any old JS onto a production page via GTM. During my 18 months there, there were numerous issues (thankfully not security issues - at least that we know of) indroduced via this method inc a full outage of the customer onboarding journey.

<comment><USER5> I see GTM being used (abused?) by marketing teams regularly, but I'm really surprised that a bank with its own development team would allow it.

It is really powerful and sometimes incredibly useful in some scenarios (e.g I once built a schema.org metadata system that scraped the pages on the fly for a site with a broken CMS). Simo Ahava does clever things with it.

But from what I can tell, it seems to be a way of avoiding communication between teams, or a political power grab inside bigger companies - a parallel CMS. And the silly bit is that it's normally not doing much more than could be achieved by copy and pasting a few lines of code into a template.

<comment><USER6> It's a backdoor way for Google to add more tracking.

<comment><USER7> It's a Google backdoor for _your team_ to add more tracking etc.

The important point is that it's a backdoor for marketing (and adtech) teams to get around developer/security requirements. At some point, someone on those teams gets frustrated that their one-line code requests (just load this script! add a gif banner here!) keep falling behind in the backlog. That happens in part because the product team often doesn't care about marketing, and sometimes because developers know that "just one more script!" paves the road to hell. At some point the third-party that's trying to get their business going through your business convinces the marketing team to add GTM, the marketing team says to the dev team "Hey we need GTM to implement THIS script". This time, because the other side has promised them $$$ in terms ROI, the marketing team pushes really hard for it, and eventually a product manager approves the request to get them off their back. The rest, as they say, is history (at retro time, multiple times down the road).

</comment></comment></comment></comment></comment></comment><comment><USER8> "We need to roll-back (JS file) to an earlier version."

"Which one?"

"The one at (archive URL)."

"I'm on it."

<comment><USER9> I'd bet this is exactly what happened, maybe a junior dev or intern took the ticket.

<comment><USER10> No code review in the front-end of a bank?

</comment></comment></comment><comment><USER11> Internet Archive as version control, I love it. There's some good comments in there, one guy determined it had been like this for a month, yikes. Peer review anybody? Or maybe they only have one web dev and he's a junior so the seniors dont inspect it as harshly.

</comment><comment><USER12> It is extremely concerning, because it indicates how quality control is abandoned in search for every lower costs. Embarassing if one considers that most of these issues should be caught by automation before code review even happens.

Such a symptom indicates extremely sloppy development process, and low security culture. It would be interesting to use such fragmentary news to correct stock pricing, with respect to current management and processes.

</comment><comment><USER13> This reminds me of the time I caught my mortgage lender using javascript loaded directly from a github repo on their mortgage application process. I reported it to them and they didn't understand the problem.

<comment><USER14> that's pretty funny but what is the problem with that? direct link, possibility of updating, same possibility of 404 as anything else, CDN and caching included

<comment><USER15> If it's straight up linking a non-versioned file (e.g. live file) it implies the owner of that Github repo has direct access to update and run code in client's browsers. Could start shooting off API requests dumping the contents of cookies/localStorage, set up keylogging, etc. IMO seems like a pretty big security hole.

<comment><USER13> Exactly. Or in this case exfiltrate my entire loan application, which would be a gold mine for identity theft.

</comment></comment></comment></comment><comment><USER16> Anyone from BarclaysUK internal (IT) audit team reading this? I wonder what your scope is when you run audits on your webs... Also.. that vulnerability scanner and pentester.. what kind of reports do they issue that they don't mention this JS source??

<comment><USER17> "Move Fast and Break Things" is not the motto you hope to see your bank adopting...

I had a problem with Natwest online banking where the "random" character entry was the same each time (first, second and third characters) - which reduces the security incredibly.

<comment><USER16> In a French bank 10 years ago, their e-banking system was recording the actual values you typed in, their order in your 6 digit PIN, and your username. The logs were dropped on a share drive so that backup can pick them up. The shared drive was read only to "Everyone".

IT fought hard and long on the risk of this whole 'setup'. They agreed when I reconstructed 5 PINs (I stopped at 5, point was made). CTO was cool about this, insisting "what are the odds of this happening?" COO & CEO had a totally different (more sensible) opinion.

</comment></comment></comment><comment><USER18> The Internet Archive rewrites contents of scripts to inject the archive URLs. A better explanation than OP's clickbait is that someone went to the archive to copy/paste misplaced tracking code.

<comment><USER19> Everyone assumes that is the case yes. That doesn't make the title factually incorrect, though.

<comment><USER18> Based on the replies to the tweet very few have assumed this is the case and no, "using as a CDN" and "accidentally linked to" are not the same thing.

</comment></comment></comment><comment><USER20> From a security standpoint it is not unsafe to reference resources on an untrusted third party so long as you use subresource integrity. [1]

[1] [https://www.w3.org/TR/SRI/](https://www.w3.org/TR/SRI/)

</comment><comment><USER21> Ooh, this reminds me that I saw a file being included straight from github.com on flyporter.com (Canadian regional airline)

Actually, extremely weirdly, they didn't include the "actual" file (the raw version of it) but ... they included the github page in the <script> tag...??

Go through a checkout on flyporter.com (use dates > Aug 31st as they're resuming service then) and you'll see

`<script src="[https://github.com/furf/jquery-ui-touch- punch/blob/master/jq...](https://github.com/furf/jquery-ui-touch- punch/blob/master/jquery.ui.touch-punch.js"></script>`)

in the source code which makes no sense (try that URL in your browser!)

I contacted everyone I could find on LinkedIn who's working as CTO/CIO/etc. there, AND emailed them but never heard back. (this was 9 months ago... the issue is still there)

Isn't this how the British Airways checkout ended up being hacked?

</comment><comment><USER22> A bit off topic but... my bank renewed its web app a couple of years ago and still uses jQuery v1.

I imagine they invested in auditing it and keep using the audited version...

Is this very common?

</comment><comment><USER23> I used to work for a bank. I suspect that they found it near impossible to get $50 for a CDN approved.

</comment><comment><USER24> For sites with a large % of the same people coming back on a daily or weekly basis, there's probably not much to be gained by serving static files from a CDN.

</comment><comment><USER25> putting an executable js file under /content/dam, is pretty much a crime, when you are working with adobe experience manager.

</comment><comment><USER26> Post titles like these always completely overscope the action.

Something more accurate would read "A team at Barclays Bank".

<comment><USER27> While that's true in terms of root cause analysis, the browser doesn't see it that way - all content on barclays.co.uk is equally trusted by the browser, so every other team is impacted by this.

</comment></comment><comment><USER28> It's really annoying how people like him blow these things out of proportion to shame and extort companies.. Seems like he didn't even make a serious attempt to message them.

<comment><USER29> Twitter author here. I didn't make any assertions about the impact of this issue. A respondent to the Tweet said they found this earlier and had already disclosed it to Barclays. I also tried to contact them for another issue and spent over 6 hours on hold before giving up. It's really annoying how people love to moan on HN without context.

<comment><USER30> You did say "Not to mention the scumbaggery of leeching bandwidth from a not- for-profit", which is attributing poor motive and character. Even without that, your general tone is scathing and accusing, over something that is likely a simple mistake by a fairly fresh or unskilled developer.

<comment><USER31> > _" that is likely a simple mistake by a fairly fresh or unskilled > developer."_

I'd assume that for banks all code that goes into production gets audited. More so it is easy to have the code run through some analyzers before submitting it to production where presence of external origin should be detected automatically and raise a flag.

If not it is gross negligence on the bank's side and deserves all the scathing and accusations it can get.

<comment><USER32> No. Being courteous and professional will still get the point across.

</comment></comment></comment></comment></comment><comment><USER33> > Barclays Bank Using Internet Archive as CDN for JavaScript Files

The original title is disingenuous, you're assuming they did this on purpose when they very much likely made an error.

<comment><USER34> It doesn't say 'decided to use' or 'deliberately using', it is 'using', that doesn't connote malintent, that's just the state of things.

<comment><USER35> "using as a CDN" implies a deliberate choice to me. Why not "because it was a convenient way for their developer to include it"? You don't know why. A lot of web developers don't know what CDNs are for too.

<comment><USER36> "because it was a convenient way for their developer to include it" implies it was a deliberate choice also, when there's no way in hell someone didn't do this as a mistake lol.

PLUS, "using as a CDN" is what the site was literally doing, from a functional standpoint. It was pulling that script from Internet Archive, using their upload bandwidth.

<comment><USER35> > "because it was a convenient way for their developer to include it" implies > it was a deliberate choice also

I didn't word it well but that was my point. For the same reason, I wouldn't pick the "CDN" headline as it gives a possibly false narrative too.

> PLUS, "using as a CDN" is what the site was literally doing, from a > functional standpoint. It was pulling that script from Internet Archive, > using their upload bandwidth.

I'd be fine with "using their bandwidth". I don't see how the Internet Archive having a CDN or not is important to the story, and including this fact in the headline makes it sound important.

<comment><USER37> I don't think the author was implying that Barlcay Bank was intentionally using Internet Archive by using the term "CDN".

But, per your suggestion, if the title was something like "Barclays Bank using Internet Archive's bandwidth to load their JS assets" then it's essentially the same thing as saying they're using Internet Archive as a CDN.

A CDN is there to deliver asset files to websites, which is exactly what Internet Archive was doing for Barclay Bank in this case. The author used the term "CDN" to describe the situation or position Internet Archive was in relation to Barclay Bank.

Also using the term "CDN" would make it easier for people to understand what was happening just by reading the title.</comment></comment></comment></comment></comment></comment>