Ex-Professor Says Dismissed Racketeering Case Is Still 'Devastating' - <AUTHOR> https://www.nytimes.com/2017/04/09/business/joy-laskar-georgia-tech-racketeering-case.html <comment><USER2> The original story explains how this was likely a jealous colleague at GT, who called in the state guns to get revenge. The prosecutor's extreme delay and then "accidentally" losing the case on a "miscalculation" of statue of limitations was because they had no case and were too embarrassed to admit it.

If there were justice here, charges would be brought against whoever in the university demanded this malicious false prosecution.

<comment><USER3> Fortunately academia is populated by self-less souls searching for absolute truths only.

I always wonder why the jealousy is so strong in those circles, it's not as if there is much at stake other than reputation and ego. I've seen quite a few examples of this in real life by now and it's much worse than industry in some ways.

<comment><USER4> "Academic politics are so vicious precisely because the stakes are so small."

[1] [http://quoteinvestigator.com/2013/08/18/acad- politics/](http://quoteinvestigator.com/2013/08/18/acad-politics/)

</comment></comment></comment><comment><USER5> > _For one thing, a state grand jury didn't indict him on racketeering charges > until late December 2014, more than four and a half years after the raids on > Dr. Laskar's home and office in May 2010._

The delay in indictment aside, it appears they've been holding his personal devices hostage for nearly seven years now.

> _He had previously remained silent to avoid antagonizing prosecutors, who > still hold family items with sentimental value, like a laptop with the only > copies of childhood photographs of Dr. Laskar's three daughters and an > unfinished novel by his wife._

Theoretically, not speaking up offers the prosecutors more incentive to retain possession, especially if they know that's the reason for the silence.

Device seizure without prompt imaging and return of the hardware is bullshit in all but the most grievous cases (e.g. terrorism).

While many people who have been through extended litigation or criminal proceedings just want it to end, it seems like this guy was railroaded pretty hard.

Does he have cause to sue the state, university, or both?

<comment><USER6> > Device seizure without prompt imaging and return of the hardware is bullshit > in all but the most grievous cases (e.g. terrorism).

I don't think grievousness alone should be enough. Refusal to return the devices should also be predicated on some sort of substantiated belief that returning the devices would lead to some sort of harm. Possibly the case in your terrorism example; clearly not, here.

</comment></comment><comment><USER7> > He started chip companies on the side, which Georgia Tech encouraged, eager > to see successful university spinoffs that had showered riches and prestige > on Stanford, the Massachusetts Institute of Technology and other top > computer engineering schools.

And now there will be no more academics at Georgia Tech working to spinoff companies that shower riches on their benefactor universities. The bureaucracy strikes again and kills innovation.

<comment><USER8> That's probably necessary in public universities.

In my region, there are two institutions with leadership that let power and influence in these areas get to their heads. First, there's private RPI, where the president is basically looting the school for a decade, but the board does nothing. Then look at the sad tale of SUNY Poly, where its president did some pretty amazing things along with some... other things that would have been survivable in a private environment but a death sentence in the public sector.

Unless you're a political person with the ability to stay at "arms length" with campaign funds and PACs, you cannot work for government entities and be safely involved with any significant business activity that is potentially related to your public employment. Even if you're able to do so, any misstep, greedy mistake, illegal act, or other screw up will be exponentially more dangerous.

Linkage:

RPI: [https://news.vice.com/article/americas-highest-paid- college-...](https://news.vice.com/article/americas-highest-paid-college- president-is-dragging-her-school-into-crippling-debt)

SUNY Poly: [https://mobile.nytimes.com/2016/09/23/nyregion/physicist- in-...](https://mobile.nytimes.com/2016/09/23/nyregion/physicist-in-albany- corruption-case-was-a-geek-with-big-goals.html)

<comment><USER9> UC Berkeley seems to handle this process just fine.

<comment><USER10> Could you or someone possibly elaborate on this? Why does UC Berkeley have so much better luck with startups and spin-off companies/technologies when compared to other public institutions?

<comment><USER9> It has an institutional culture (in the bureaucracy) of nurturing those startups. In particular, it has a very clear and permissive procedure for transferring work to private companies (see [1], under Outgoing MTA). You tell the university what materials (including IP) you want to use in your company, and the university negotiates a direct quid pro quo.

The Georgia Tech process, by contrast, seems totally ad hoc and amateur. "You can take stuff for free up to a point, as long as you agree to certain investment agreements with the university, and if you step over one of our unclear lines we will slap you down."

[1] [http://ipira.berkeley.edu/material-transfer- agreements](http://ipira.berkeley.edu/material-transfer-agreements)

</comment></comment></comment></comment></comment><comment> fake-name > He had previously remained silent to avoid antagonizing prosecutors, who > still hold family items with sentimental value, like a laptop with the only > copies of childhood photographs of Dr. Laskar's three daughters and an > unfinished novel by his wife.

Like, what the fuck? Why do prosecutors have such broad control over something that should be held by a independent party?

The justice system is so fucked.

<comment><USER11> There should be a right to copies of one's seized electronics' contents if not returned in a reasonable period.

Also, what is the justification for keeping them after the case was dismissed?

</comment></comment><comment><USER12> > "This wouldn't have happened at M.I.T. or Carnegie Mellon," said Dr. > Ricketts, "... they would basically have handled it internally."

[https://en.wikipedia.org/wiki/Aaron_Swartz](https://en.wikipedia.org/wiki/Aaron_Swartz)

"On January 6, 2011, Swartz was arrested by MIT police on state breaking-and- entering charges, ... download academic journal articles systematically from JSTOR using a guest user account issued to him by MIT."

It was handled and concluded in a very un-internal way.

<comment><USER13> Totally different situation.

<comment><USER14> Yes, because Aaron was not faculty.

</comment></comment></comment><comment><USER15> > Last October, a judge tossed out the state's case before a trial, ruling > that the five-year statute of limitations had expired on the misdeeds that > it had accused Dr. Laskar of committing.

The way it ended didn't help. It would have been better if it were thrown out because it was obviously BS, or if it went to trial and he were exonerated.

</comment><comment><USER16> Glad to see this finally got dismissed. I was a Ph.D student in the department when this happened and it caused a lot of discontent among the faculty. Perhaps related, GT's royalty agreement is quite a bit less generous than other schools known for their entrepreneurship, such as Stanford and MIT. This and issues like Prof. Laskar's have had a negative impact on the rate at which companies are started at the school.

<comment><USER17> Paging George Burdell

</comment></comment><comment><USER18> A state prosecutor missing the statute of limitations seems like a crass professional misstep that should see them sanctioned.

</comment><comment><USER19> Regardless of his guilt or innocence, the way this was investigated, prosecuted and litigated by the state would not make me feel comfortable investing in Georgia. This is a pretty sad story for Atlanta and its ambition of becoming a center of technological innovation.

</comment><comment><USER20> Does anyone have a pointer to the details of this case that can be read?

</comment><comment><USER21> He was. Try reading the article.

He got off on statute of limitations.

<comment><USER3> No, he was never convicted. If you would please read the bloody title it says 'Dismissed Racketeering Case'.

No case, no conviction.

A direct citation from the article linked:

"Last October, a judge tossed out the state's case before a trial"

<comment><USER21> If you would read the judge's writing you'd notice he got off on a technicality: statute of limitations. No-one not named Laskar disputes he took that money. And he was, exactly as I said up post, charged with theft of the $50k.

eg: [http://joylaskarstory.com/wp- content/uploads/2013/05/Laskar....](http://joylaskarstory.com/wp- content/uploads/2013/05/Laskar.-Order-for-dismissal.pdf)

<comment><USER3> I read that and my comment stands.

Whether you get off on the statute of limitations or not does not matter, what matters is that there is no conviction, so you're simply _wrong_ but for some reason you can't seem to move past that bit.

The rest of the case was not decided on its merits so you can't make statements like the ones you made and not everybody that is charged with something is guilty of it.

You will notice the very careful wording of that document including bits such as 'alleged', 'purportedly' and 'can'.

In other words, had the case gone forward there is always a chance that there would be a conviction, but since it did not we will simply never know.

But the judge leaves ample room for a case that would have been decided in the defendants favor on other grounds than the one chosen, which is that they simply waited too long.

And now it is up to you to decide why they waited that long.

Also, you keep claiming that he stole $50k, but the judge - rightly, in my opinion - writes that that's not what he did. Let me cite the article you linked:

"The question before the Court is what constituted the _alleged_ thefts: the taking of the chips or the taking of Georgia Tech's money? Defendant's technology was built from from microchips, not bank notes. What he _purportedly_ stole from Georgia Tech was the microchips he (through Georgia Tech) ordered from CMP.

Those chips rightfully belonged to Georgia Tech because Georgia Tech ultimately, paid for them.

However, the University's payment for the merchandise is a collateral consequence of the Defendant's _alleged_ theft, and a measure of the value of the goods Defendant _allegedly_ stole. The Payment is not, however the 'theft' that _allegedly_ occurred in this case."

In laymans terms that reads: The court decides that the theft _if there was one_ was the chips, not the money and that the date when that happened is now so far in the past that the case is dead crucially, without deciding whether or not a theft _actually_ took place.

Since this whole case seems to have started with jealousy and people smearing the defendant it is particularly ugly that you continue to write blatant un- truths.

<comment><USER22> It's quite strange how people are both arguing that the prosecutor is blind to justice (he was falsely accused, because he was not convicted, this is wrong!) but also not blind when counting the particulars of associated circumstances. I'm reminded of Aaron Hernandez being acquitted of murders, but convicted of the murder of a witness to cover up the deaths. At some point you have to rationalize that the law is not always correct and that goes both ways (for the innocent and the guilty). I never found the "they weren't convicted" argument much more weighty than the "they were convicted". He was probably guilty, they just couldn't get their case together.

<comment><USER3> > He was probably guilty, they just couldn't get their case together.

That's why there is such a thing as a statute of limitations. If you can't get your case together in an X amount of time that is the equivalent of not having a case.

So, given that he wasn't convicted, _not_ guilty. You can't say that he probably was guilty and not say that about every other person that ever got acquitted, which is nonsense. So that claim simply does not hold up.

I agree with you that the law (or rather, justice) isn't correct and that this goes both ways. So if you are already of that opinion then why negate it after that by saying that he probably was guilty?

That's after all what courts are for.

<comment><USER22> > You can't say that he probably was guilty

I can and do, which is not nonsense applied to an infinite amount of theoretical past cases. That's not relevant.

Cases aren't assembled just to get a conviction on 20 specific items ([http://law.justia.com/constitution/us/amendment-05/06-for- th...](http://law.justia.com/constitution/us/amendment-05/06-for-the-same- offence.html)). US justice system is not about truth or even justice, but an amalgamation of concerns and subject to the irregularities of reality (if key witness X has a heart attack and dies, a case Y can fall apart).

I'm not subject to these concerns and limitations (which are both historical and societal, without being strictly law-related). He was probably guilty (in the moral, not legal sense if that's confusing anyone), based on what I have read and seen. That's distinctly different from saying he did something wrong or illegal or should be in jail or that it would be a public good to ignore.

<comment><USER3> > He was probably guilty (in the moral, not legal sense if that's confusing > anyone), based on what I have read and seen.

Did you read or see something different than what I have read and seen?

Or did we read the same stuff but came to completely different conclusions?

Would you feel any different if the case had gone forward, had been decided on its merits and the outcome would have been a 'not guilty' verdict?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> Are you being deliberately obtuse? Dude stole $50k then turned down a follow- on investment, giving Georgia Tech a valid cause and motive to pursue his criminal behavior.

<comment><USER3> I'll give you this to think about: If you stole $50K from some institution do you honestly believe they would then offer you a follow on investment? And then if you turn that 'offer' down that that would give valid cause and motive to pursue for _criminal_ behavior?

That makes absolutely no sense at all.

If you steal from me I don't need further motive to pursue so the whole 'follow on investment' thing is utterly pointless.

And I would never demand to do a follow on investment in a company that I'm alleging stole from me. That's ridiculous.

So either he stole and they should have pursued it there and then or they should have dropped the matter. But to only pursue _after_ he turned them down makes this look like a business deal gone sour and the whole criminal thing just being tacked on as some kind of revenge.

I've had a similar thing happen to me once. A guy - who will remain nameless but he was a German businessman - bought himself in for a small amount in a company I had founded, then when he offered to buy another stake we refused. The next thing we knew we were going to be sued for all kinds of infractions, just a way to up the pressure from his position as a shareholder. This story here has way too many parallels with that story to just believe GT outright.

And in that other story I happen to know exactly what happened. So, either you're going to have to do a lot better to answer those two questions I asked at the top of this comment or you're going to have to admit that it really doesn't make any sense.

To me it simply sounds like GT wanted a larger piece of the action and when they were told to walk they came up with this theft story to up the pressure.

<comment><USER21> Are you seriously claiming people have never let $50k slide as part of a business deal, then when things have gotten acrimonious, pursed every available avenue? Because I've seen it happen (well, more like $30k, but this just used for personal stuff).

And he did steal the $50k -- notice on his website he nowhere refutes that bit. It's blah blah blah GT invested (yes), he was in an incubator (yes), but that doesn't make your GT funds for your academic work into your Sayana funds for your Sayana work. And as mentioned elsewhere, everyone involved: prosecutor, judge, GT, peers at GT, peers at other universities, ie everyone without the last name Laskar, agree he stole at minimum that $50k.

</comment></comment></comment><comment><USER21> Two suggestions on why this happened (from [1])

       Georgia Tech auditors accused Dr. Laskar of stealing as much as $1.5 million
       to benefit Sayana. In the end, the faculty committee determined that Georgia
       Tech had paid for $50,000 worth of chips in 2007 that were sent to a Korean
       chip research institute to satisfy a contractual obligation that Sayana had
       with it.

       Dr. Laskar argues that any chips paid for by Georgia Tech and sent to the
       Korean institute originally served academic purposes. He added that the
       Koreans did not keep the chips, returning them to Georgia Tech after its
       engineers verified that they worked. Dr. Laskar said that this was a common
       practice with other companies at the chip design center and that Sayana had
       the rights to do it because of its licensing deal with Georgia Tech.

       The accusations followed an episode at Georgia Tech two years earlier. The
       university had been caught up in a scandal that received wide publicity in
       Georgia, in which employees were charged with making personal purchases on
       Georgia Tech credit cards, known as procurement cards.

And note that other professors agree "Laskar 'pushed the edges' of what seemed ethical".

Second,

       With Sayana, Dr. Laskar said he didn't take the informal path that faculty
       start-ups at Georgia Tech are encouraged to follow. While he accepted money
       from a start-up incubator financed by Georgia Tech, he declined later rounds
       of funding because it would have involved giving up equity in Sayana,
       allowing the university to install board members and professional managers
       of their choosing. "I'm sure that torqued people," Dr. Laskar said.

The article [1] quotes some university employee saying that this hasn't affected university spin-outs which seems laughable. If Georgia Tech was willing to pursue a rainmaker like this, well, Stanford et al will be happy to have them.

[1] [http://www.nytimes.com/2013/11/17/technology/reaching-for- si...](http://www.nytimes.com/2013/11/17/technology/reaching-for-silicon- valley.html)

<comment><USER3> It's funny how the first round of funding apparently more or less requires you to accept the second otherwise you're 'unethical'. That's just plainly wrong. Either you get to decide round-by-round what the best option for you and your company is or it should simply be one round.

To give a bit of seed capital, wait to see what flies (and thus is very much de-risked) and then to force an additional round requiring dilution and board members that may simply be luggage to haul around should be up to the present day shareholders. The University is playing a dirty game here.

A friend of mine was in a similar situation, first round of funding was peanuts, second round - after substantial input in time, funds and efforts of the founders - on much less good terms (and effectively still peanuts) including board members and so on.

<comment><USER23> These are known as 'pro-rata' rights, which entitle earlier stage investors to participate in later rounds in order to maintain their stake in the company. These are relatively well-established rights that you will likely find in most VC term sheets.

Pro-rata rights are, to some extent, a reward for the risk that the investors take in investing in a very early stage startup. They also ensure that early- stage investors remain invested in your company; without a pro-rata right, the absolute gain of your company exiting at $100M vs $500M is much lower for the investor with a small stake. In a similar vein, the protections protect the investor from being diluted out of any significant stake in your company.

<comment><USER3> Sure, I'm familiar with that. But there is no such thing as a demand that a later round actually takes place.

That's up to the shareholders and if they don't want to raise another round because they don't like the terms then they don't.

It's not an obligation.

<comment><USER23> Ok, yeah, demanding subsequent rounds against founders' wishes is pretty mean. I guess you usually need investor approval to raise further rounds, but this would be taking that right of refusal much farther.</comment></comment></comment></comment></comment>


Node v0.10.21 Stable has critical security fix - <AUTHOR> http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/

<comment><USER2> HTTP Pipelining is designed so a client can send multiple requests without waiting on a response and then the server sends all the responses in order. This is helpful on high latency links since it can combine numerous HTTP requests into fewer packets. The exploit is the client never stops to read and just writes requests nonstop. Meanwhile node's http.Server continually populates a response buffer which is never consumed.

Node uses Stream[1] objects for reading/writing streams of data. The Stream object has a 'needsDrain' boolean which is set once its internal buffer surpasses the highWaterMark (defaults to 16kb). Subsequent writes will return false[2] and code should wait until the 'drain' event is emitted, signaling it's safe to write again[3]. The documentation even warns about this scenario:

> _However, writes will be buffered in memory, so it is best not to do this > excessively. Instead, wait for the drain event before writing more data._

http.Server[4] uses a writeable stream to send responses to a client. Until this patch[5] it was ignoring the needsDrain/highWaterMark status and just writing to the stream. It fills up the buffer of the writeable stream, far beyond the high water mark and eventually runs out of memory.

The patch resolves this by checking when needsDrain is set, then it stops writing and stops reading/parsing incoming data. It then waits until the 'drain' event is fired and then proceeds as normal.

[1] [http://nodejs.org/api/stream.html](http://nodejs.org/api/stream.html)

[2] [http://nodejs.org/api/stream.html#stream_writable_write_chun...](http://nodejs.org/api/stream.html#stream_writable_write_chunk_encoding_callback)

[3] [http://nodejs.org/api/stream.html#stream_event_drain](http://nodejs.org/api/stream.html#stream_event_drain)

[4] [http://nodejs.org/api/http.html#http_class_http_server](http://nodejs.org/api/http.html#http_class_http_server)

[5] [https://github.com/joyent/node/commit/085dd30e93da67362f044a...](https://github.com/joyent/node/commit/085dd30e93da67362f044ad1b3b6b2d997064692)

</comment><comment><USER3> \- No CVE.

\- Distributions weren't contacted prior the release.

\- Everyone can see the diff for the fix in the codebase.

\- There are a PoC as test-case in the code.

\- The release was done in the start of weekend when everyone in America is leaving the office and everyone in Europe is sleeping.

\- A big part of the community is in two conferences right now.

IMHO that was the worst way to provide a security update.

<comment><USER4> The initial report was made publicly, including a proof of concept exploit, and is currently viewable via google cache. The censored issue report is referenced with a metasploit pull request containing code that can be used to exploit.

Given this, I'd say sooner is better than later.

It would be prudent to mention making your load balancer limit the number of requests than can be pipelined down a single connection should resolve any issue.

<comment><USER3> The metasploit exploit was possible only thanks to the release (see the tweets of metasploit maintainer @hdmoore), IMO they could have waited until Monday morning to release it.

</comment></comment></comment><comment><USER5> Apparently, a trivial DoS vulnerability for any Node serving HTTP:

[https://groups.google.com/forum/#!msg/nodejs/NEbweYB0ei0/gWv...](https://groups.google.com/forum/#!msg/nodejs/NEbweYB0ei0/gWvyzCunYjsJ)

The odd thing about non-disclosure in an open source project is: I can diff the code bases before and after the fix.

[https://github.com/joyent/node/issues/6214](https://github.com/joyent/node/issues/6214)

[https://github.com/joyent/node/commit/085dd30e93da67362f044a...](https://github.com/joyent/node/commit/085dd30e93da67362f044ad1b3b6b2d997064692)

And, they have a test script:

[https://github.com/joyent/node/blob/085dd30e93da67362f044ad1...](https://github.com/joyent/node/blob/085dd30e93da67362f044ad1b3b6b2d997064692/test/simple/test- http-pipeline-flood.js)

<comment><USER5> And, now metasploit has two competing modules in the works:

[https://github.com/rapid7/metasploit- framework/pull/2548](https://github.com/rapid7/metasploit-framework/pull/2548)

[https://github.com/rapid7/metasploit- framework/pull/2549](https://github.com/rapid7/metasploit-framework/pull/2549)

</comment></comment><comment><USER6> Node team: you're censoring the original ticket, which is unwise IHMO.

Your approach makes it impossible for an honest sysadmin to quickly find a way to block the attack using a firewall, but your approach doesn't stop an attacker from building an exploit based on the public commit.

Someone will come up with a proof of concept exploit quickly, and post it, probably here.

Please do the right thing: un-censor the GitHub ticket so we can understand what's happening.

<comment><USER3> PoC is in codebase, it was published as a test-case for the fix.

<comment><USER7> Unfortunately that test-case passes against 0.8.25 as well. So I'm not quite convinced it can be used reliably to reproduce the problem.

<comment><USER8> Unsurprising because the new streams API, which is responsible for this bug, was introduced in node 0.10. Try with earlier 0.10 versions instead.

<comment><USER7> Well, in that case lets add confusion about affected versions to the list of things being suboptimal about this whole thing: [http://blog.nodejs.org/2013/10/18/node-v0-8-26-maintenance/](http://blog.nodejs.org/2013/10/18/node-v0-8-26-maintenance/) \- the same warning about the same error and they did backport the fix to 0.8: [https://github.com/joyent/node/commit/653d4db71f569ddc87a0bc...](https://github.com/joyent/node/commit/653d4db71f569ddc87a0bc21f5ecc5ceaf37f932)

<comment><USER8> You're right, that is confusing. I'm not sure how it's exploitable in 0.8.

</comment></comment></comment></comment></comment></comment><comment><USER9> So what they did is: release a new version with security and other changes mixed, on Friday, and didn't provide any details so you can't check if you're vulnerable post-upgrade. They could really handle it a bit better.

<comment><USER10> They did provide plenty detail, just not to the guy on call who has to read the announcement and react quickly.

Meanwhile, they have the changelog and a test PoC for the one looking to exploit it.

</comment></comment><comment><USER11> Making public a critical vulnerability on friday night is not a nice movement.

EDIT: Oh and there's an exploit already.

<comment><USER3> sure, they published a PoC in the code: [https://github.com/joyent/node/blob/085dd30e93da67362f044ad1...](https://github.com/joyent/node/blob/085dd30e93da67362f044ad1b3b6b2d997064692/test/simple/test- http-pipeline-flood.js)

</comment></comment><comment><USER12> > > [https://github.com/joyent/node/commit/085dd30e93da67362f044a...](https://github.com/joyent/node/commit/085dd30e93da67362f044ad1b3b6b2d997064692)

Looks like a flood of concurrent requests will just fill up the memory

<comment><USER13> I was considering using Node.js for a new project, but I quickly backed away from it when I realized it didn't do basic flow control properly.

<comment><USER12> Funny I noticed this on an internal server as well but chucked to an older version. Hoping it "clearly is fixed in latest code, something so glaringly obviously broken, wouldn't be hanging around too long with all the hype surrounding node these days..."

Anyway, I wouldn't stick node out exposed to the outside world. Granted sticking nginx in front presumely won't help with this issue. Just keep feeding a 4GB file to it and it will crash the back-end [EDIT: n.m. I am not sure anymore, someone mentions it is possible to mitigate it that way]

Yikes, this is a bad one. Glad they fixed it. But it leaves me with the same impression I had after finding out how MongoDB used to have unacknowledged writes turned on by default, and people's data was silently getting corrupted.

<comment><USER14> _Granted sticking nginx in front presumely won 't help with this issue. Just keep feeding a 4GB file to it and it will crash the back-end._

Why does that happen? nginx can't help here?

<comment><USER12> See mathrawka's reply (I haven't test it though)

BTW, I just ran memory of my server into swap with this:

        $ dd if=/dev/zero of=2g bs=1M count=2048

        $ curl -F "2g=@2g" <myresource>

(EDIT: explanation, this creates 2g file then uploads it <myresource> as a file upload -- multipart mime. @ sign just insert the named file data into the form)

<comment><USER15> And that is why you should never blindly use bodyParser middleware in production...

[http://andrewkelley.me/post/do-not-use-bodyparser-with- expre...](http://andrewkelley.me/post/do-not-use-bodyparser-with-express- js.html)

</comment></comment></comment></comment></comment></comment><comment><USER16> Proof of concept exploit: [https://github.com/joyent/node/blob/master/test/simple/test-...](https://github.com/joyent/node/blob/master/test/simple/test- http-pipeline-flood.js)

<comment><USER3> Your ruby version looks nicer:

[https://gist.github.com/anonymous/7050542](https://gist.github.com/anonymous/7050542)

<comment><USER17> Jesus.

If that's all it takes, I have no idea how this wasn't found much sooner.

<comment><USER18> Probably because it's so simple.

</comment></comment></comment></comment><comment><USER19> Give me the TLDR. Being Friday 9pm on the east coast, do I need to go home right now and upgrade my production servers?

<comment><USER20> Nah. It's a DoS vulnerability, which, in general, you're always vulnerable to. It's just that this one can be done by a single person with relatively low bandwidth.

</comment></comment><comment><USER21> It's not just v0.10.21. There's also an update for v0.8.x too (0.8.26): [http://blog.nodejs.org/2013/10/18/node-v0-8-26-maintenance/](http://blog.nodejs.org/2013/10/18/node-v0-8-26-maintenance/)

</comment><comment><USER12> Would putting node behind a proxy like nginx mitigate it?

<comment><USER15> With these nginx settings, it does mitigate it for me.

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Protocol http;
        proxy_set_header Host $http_host;
        proxy_pass http://127.0.0.1:8000;
        proxy_redirect off;

</comment></comment><comment><USER22> A CVE would be nice.

</comment><comment><USER15> With a pretty default nginx setup as a proxy in front of node, it does not affect earlier versions for me.

</comment><comment><USER23> Someone should benchmark the infamous for its speed node.js again after this (it should be slower)...</comment>


Clarification on Jobs' Apple TV UI Rejection - <AUTHOR> http://techcrunch.com/2012/03/24/jobs-apple-tv-margolis/

<comment><USER2> His whole explantation seems to ignore the controversial part of his tweet: "Now there is nobody to say "no" to bad design."

He was clearly referring to "now" and indicates the design is bad.

<comment><USER3> I'm one of the first to call bullshit anytime someone attributes a current Apple issue to the death of Steve Jobs. But to me the controversial part isn't the tweet, it's the firestorm of blog coverage that it generated. As far as I'm concerned this guy just post a quick mini rant as most people are wont to do on Twitter. Then out of nowhere a bunch of desperate bloggers latched on and dialed the sensationalism up to 11.

</comment></comment><comment><USER4> Steve Jobs said yes to the iPod Hi-Fi, the Nano fatty (I was fine with this design but others were not) the Apple TV Take 2 UI (Again widely disliked), and several other small and larger 'missteps' in hind site. The reality is that Apple made many other far better choices which overshadow these errors.

Honestly I don't think in 5 years we are going to have an Apple thats in shambles and we'll point back to the AppleTV3 UI as the turning point.

This was a statement made by a man with some influence that hits on the misinformed fear that Jobs was the only one doing all the management, design and engineering work at Apple.

</comment><comment><USER5> The saddest thing about this episode is that we will probably never, ever, see a complete inside story about the design and making of the iPhone like we got with the story of Macintosh. It _has_ to be epic.

Even little things like <http://www.folklore.org> are fascinating and preserve the history. How will we get the true history of future projects without layer upon layer of analysis, hand-wringing, and legal threats?

<comment><USER6> Apple was also very secretive about the early Macintosh when it was being developed, but time passed and eroded the necessity of the secrecy compared to the entertainment value of the story. Archive.org records show that Folklore started hosting Macintosh stories for the first time around January 26, 2004. The Macintosh 128k was released on January 24, 1984. That means it took 20 years for the early Mac stories to accumulate into the critical mass necessary for Revolution in the Valley to be written. As time passes, we'll probably start hearing the juicy stories of the iPhone's development.

<comment><USER5> Apple was just a different company back then.

When the Mac launched Apple made all the key guys available for interviews. We knew their names, we knew what they worked on. Sure, we didn't get the dirt until long after the fact, but the Mac didn't just drop from the sky with Steve Jobs standing on top of it.

</comment></comment></comment><comment><USER7> I woke up today to friends posting on facebook about getting out of Apple stock "at the top" because of these SJ UI rejection posts. Even if the ui is a mistake (and I'm not sure it is, I haven't played with it yet), Apple has made other missteps in the past 5 years without meaningfully impacting the growth in their share price.

</comment><comment><USER8> Sounds like Margolis backpedaled on his statement once he realized his social repercussions.

<comment><USER9> Definitely why he issued the in depth statement, but I don't think he's backpedaling necessarily. I took a brief look at his Twitter feed and it looked consistent with his opinions.

</comment></comment><comment><USER10> Quoting from tweet always runs the danger of out of context. I suspect the grid in the UI is to prepare for apps on AppleTV in iOS 6, when Apple launches a Thunderbolt Display with built in AppleTV, or what you might call iTV.

</comment><comment><USER11> Sounds like an excuse after they realized that the comment might have an impact on their Apple TV sales, not that they were incredibly large to begin with.

<comment><USER12> Who's "they"? TechCrunch? Or the engineer that hasn't worked at Apple since 2008?

</comment></comment><comment><USER13> It is interesting to watch a giant PR machine go into action. I hope Mr. Margolis' legs are ok.

</comment><comment><USER14> Huh. I am glad I am not the only one who found the new Apple TV GUI terribly ugly.</comment>


Internet industry freaks out over proposed unlimited price hikes on .org domain - <AUTHOR> https://www.theregister.co.uk/2019/04/26/dot_org_price_increases/ <comment><USER2> They are a government granted monopoly they don't have a moral right to maximum profits from the pockets of a captive audience.

Is it time for a decentralized registry wherein a single domain can't be taken down by fiat and nobody can extort you.

[https://namecoin.org/](https://namecoin.org/)</comment>


Ask HN: Best python library for screen scraping/spidering in python 3? - <AUTHOR> <comment><USER2> [https://scrapy.org/](https://scrapy.org/) is one I use all the time.

<comment><AUTHOR> How is its performance compared to like selenium? Can you fake useragent?

<comment><USER2> It's pretty performant. and Yes, you can specify whatever useragent you want.

</comment></comment></comment><comment><USER3> Scrapy. 100%.</comment>


Scientists Back Efforts to Pull CO2 from the Atmosphere - <AUTHOR> https://www.scientificamerican.com/article/scientists-back-efforts-to-pull-co2-from-the-atmosphere/ <comment><USER2> So I guess I was looking up peatbogs, they seem to be a large source, could we turn large areas of the northern continents into peatbogs? Seagrasses or maybe some micro organism I guess could help store it into calcium carbonate? Limestone. So maybe there is a way we could do something like that? I don't know, I just think it's a tall order and will need some engineered process. It's hard to see how.

</comment><comment><USER3> This is good. We don't have a choice. I was absolutely convinced 5 years ago that we must actively take carbon out of the atmosphere and ocean if we are to have any chance as a species. We have to add methane to the list now.

The time for talk and arguments has passed. Its time for action, and lots if it, or we are doomed.

</comment><comment><USER4> The latest UN report on climate change gives us about 2 decades to save earth from irreversible long term damage.

The best thing you can do, is to plant and nurture one or more trees. They are the most easiest, cheapest, natural form of carbon capture that the average Joe can do.</comment>


Serverless Redis - <AUTHOR> https://github.com/seppo0010/redislite

<comment><USER2> Why not just modify the Redis code to modularize the server part, and define a user friendly API? It seems like a waste to re-implement all of the data structures, since they will eventually do exactly the same thing.

This seems like a bad case of NIH syndrome.

<comment><AUTHOR> Maybe the Redis codebase is too closely tied to the fact that the complete db has to be loaded in memory?

<comment><USER3> From the quick glance over the source code, it seems that this implementation has this assumption too. (I may be wrong, though - it is possible I've missed something.)

On the other hand, Redis has "VM" thing, which allows larger-than-memory databases by swapping less frequently used data to disk.

<comment><USER4> Yes, this was my assumption.

</comment></comment></comment></comment><comment><USER5> "It's still under a very early stage, so there is no way to test even a Beta."

</comment><comment><USER6> Looks like an interesting idea, would love to see some no-sql storage bundled with the default rails package. Like redis, and _cough_ memcache _cough_.

</comment><comment><AUTHOR> I would love to use Redis in non-web apps. Sqlite and Tokyo Cabinet are great, but the data structures manipulation of Redis feel much more familiar to coding, even without a data mapper.</comment>


Defense Data Breaches: Pentagon Must Hold Contractors Accountable - <AUTHOR> https://www.bloomberg.com/opinion/articles/2019-04-18/defense-data-breaches-pentagon-must-hold-contractors-accountable <comment><USER2> The Pentagon should move away from giving contractors checklists to complete and start actively pentesting them before clearing them to do work.

"Security through bureaucracy" does not work.

<comment><USER3> This would help, but findings and audit reports aren't enough. You need to revoke clearances for pen testing findings that aren't resolved in a timely manner, or repeated failings. I would also like to see claw backs and penalties for data leakage considering the sensitive nature of the data.

You get what you measure, incentives matter, and all those cliches.</comment></comment>


How to squeeze a PS3 and Xbox 360 into a desktop PC case - <AUTHOR> http://www.extremetech.com/extreme/94949-how-to-squeeze-a-ps3-and-xbox-360-into-a-desktop-pc-case

<comment><USER2> Link to the actual source article: [http://timofiend.blogspot.com/2011/09/hi- there-my-names-timo...](http://timofiend.blogspot.com/2011/09/hi-there-my- names-timofiend-or-tim-as.html)</comment>


Hawk-Eye ball-tracking firm bought by Sony - <AUTHOR> http://www.bbc.co.uk/news/business-12670063

<comment><AUTHOR> If you're unfamiliar with this; Hawk-Eye is the system used in high-level tennis and cricket to do computer-assisted refereeing. They've got a lot of IP for camera-based systems (think Kinect) and there are obvious gaming applications here.

But the really big angle: FIFA are probably going to bring in goal-line cameras, Hawk-Eye are in pole position to provide the systems driving it, and the tie in with the FIFA game franchise (already, I believe, EA Sports' biggest property – even over Madden and Tiger Woods PGA Golf) has to be, well, a thing.</comment>


Law Would Force Patent Trolls To Pay For Failed Lawsuits Against Innovators - <AUTHOR> http://techcrunch.com/2013/02/27/law-would-force-patent-trolls-to-pay-for-failed-lawsuits-against-innovators/

<comment><USER2> In most of Europe it is the general rule applying to all lawsuits that the looser pays part or all of the cost of the winning party's attorney fees. This is very effective in keeping frivolous lawsuits at a minimum. It is sometimes referred to as the English Rule.

Another meassure that keeps the number of law suits down is the obligation for the plaintiff to pay a court fee calculated as a percentage of his claim.

<comment><USER3> But wont this dissuade plaintiffs with few financial means from seeking out justice?

<comment><USER2> Justice is rarely found in courts.

That said, individuals with little financial means may qualify for financial aid for court proceedings (sometimes combined with a reduced court fee).

Also, many standard family insurances and standard business insurances have coverage for legal costs.

Finally, many European countries have a wide range of complaint boards, which have speedy and informal proceedings (sometimes their decisions have binding effect).

<comment><USER4> At least in the US, the courts are one of the few avenue of justice. Everything from desegregation to marriage equality to environmental protection was hashed out in the court system. It is the single means for the little guy to tear down big institutions. The court system is the last place in the country where people use the word "fairness" outside of a punchline.

<comment><USER2> Yes, you have a very interesting history of advancements in interstate trade, civil rights etc. through courts.

In Europe we have had a bit of the same in the rulings of the Court of Justice of the European Union (in areas like free movement of goods, services and people,) and in the rulings from the European Court of Human Rights (in civil rights issues). In continental Europe such advancements have primarily come from legislative bodies, though.

</comment></comment></comment></comment></comment><comment><USER5> Couldn't they think of a more prejudicial title? The bill's substance is "plaintiffs to pay defendants". Plaintiffs are not trolls. Defendants are not innovators. Unsuccessful lawsuits are not frivolous (article's opening paragraph).

And TechCrunch is not journalism.

<comment><USER6> I agree, generally, and I agree that the title is not unbiased. But I think that a lot of the patent plaintiffs _are_ trolls, particularly those that do nothing but buy patents and then sue. And in those cases, the defendants are often _not_ innovators. Some of those patents never should been granted, but that's for another thread.

</comment></comment><comment><USER7> Why don't they require plaintiffs in a patent suits to be actively using the patent in some sort of meaningful way in order to be allowed to file a suit? If they are just holding a patent and do nothing with it they shouldn't be allowed to sue or the patent should expire early.

</comment><comment><USER8> Prior discussion: <http://news.ycombinator.com/item?id=5294202>

</comment><comment><USER9> First nail in the coffin of Patent Trolling?

<comment><USER10> Might be if there was any chance it would pass. The legislature is bought and paid for by the ABA, so unless the average person can be made to understand the issues involved it's never going to get to the president's desk.

</comment></comment><comment><USER11> nice; dear</comment>


AI is not coming for you - <AUTHOR> http://blairreeves.me/2019/04/18/ai-is-not-coming-for-you/ <comment><USER2> I think ML has potential that Blockchain doesn't, but not in all the areas that are being hyped.

I work in the public sector of Denmark, and we're targeted by a lot of the hype. Which is worrisome, because it might actually lead to stupid projects if it becomes a political focus. So far it hasn't though, and blockchain never did, so who knows.

The thing about ML is that all the BI is worse than what we are already doing. Because it's hyped we've naturally done proofs of concepts, with universities and with big tech, and no one has been capable of providing ML based analytics or BI that is even remotely close to what we already do. Because the simple truth is that we have been working with data for four decades. We have full time analysts who do nothing else, and they are simply lightyears ahead of anything ML we've seen, and, they can actually explain their results to our politicians and decision makers.

Where ML does work, and the fact that it does separates it from blockchain, is for recognition. We have a lot of data, often in poor quality, and ML can troll through it faster and with higher quality than our human workers. We had to go through every casefile in a specific area, and identify which ones were missing a specific form. A casefile can be 500 A4 pages long, sometimes scanned in really terrible quality, and we had 500.000 of them. It took 12 people 6 months to do so, simultaneously we did a ML poc. It took 3 months to train the algorithm, but only one employee, and once it was done being trained, it took around five hours with a lot of Azure iron to troll through the data. ML had better results than our human effort and it was obviously way cheaper.

So ML and AI may be a lot of hype, but it's also more than that.

<comment><USER3> The first thing to realize is that AI is not coming for you or me or any other, it's coming for a subset of us. The subset of skills which can be rented out to an employer.

AI and ML are just two things that are comming for that subset. Digitalization is also if not a bigger then at least a huge factor.

The entire ecosystem of companies and people who were involved in supporting the music industry were more or less wiped out over the last 20 years. Leaving a thin layer of really successful people and then a huge group of people who makes no money.

And the more things can be digitalized the more they are subject to pattern analysis which means the subsets of your that make you valuable are also easier to replace.

Ironically a cleaning lady is probably the last person to loos her job because it's really hard to replace, but that just means the supply will increase too.

So sure humans are better at BI but that's based on the assumption that how we do BI is the only way to do BI. I am not so sure it is. We will see.

<comment><USER2> We've seen a couple of examples with BI and analytics, I think you can put them into two categories. Prediction and automation.

Prediction simply isn't good enough. It may work well for google and Facebook, but that's because failure is relatively harmless in advertising. No one dies just because you see a commercial for something you just bought. The failure rate is simply too high for us in the public sector, maybe that'll change, but probably not. I say that because we're severely limiting the access to data these years over privacy concerns. You could probably do some interesting things with medical data, but to get there, you'll need to look at medical data and that's just not happening in the current political climate.

Then there is the automation. IBM wanted to sell us Watson analytics on the premise that it could recognise patterns and build the BI models our dedicated team does. So we let them try, and none of the models they came up with was even remotely useful. I can see this changing, but when? And what will our analytics department look like by then? It's hard to say.

<comment><USER3> Yes but you also have to think about predictions a little more nuanced.

You can make a prediction it might be true but it doesn't mean that you will be successful with it. I wouldn't be surprised is 90% of all BI predictions doesn't actually lead to more successful outcomes also in the public sector also in Denmark (I'm Danish too :) )

</comment></comment></comment></comment><comment><USER4> Maybe it's just me, but it seems to me that the author doesn't have a clue of what he is writing about. For instance, when he mentions the Amazon hiring AI embarrassment, it seem to me like he mixes the very different concepts of bias in machine learning with the everyday concept of bias as prejudice.

If the sample data is representative of the population, then it is unbiased in machine learning terms, even if the population as a whole is prejudiced, or biased, which will be duly reflected in the learned model, which shouldn't surprise anyone with at least a rudimentary knowledge of machine learning.

<comment><USER5> I have the same impression. If AI system figured out that the risk of the car being stolen when someone lives in a certain place is bigger and adjusted fee to be higher, then it means AI worked correctly.

One might claim (I presume author does and this is perfectly ok) that this is a bad thing that there are "bad neighborhoods" and we should fight it, but what does it have to do with proper calculation of insurance fee? Should we expect that AI will apply some "social justice" concepts while calculating insurance price. I am not sure what author proposes.

<comment><USER6> I'm not impressed with the article, but the idea here is that some forms of bias are okay, others are not, and it's up to the people working on the system to build it properly. There are laws about these things and you can't expect some algorithm to know the law automatically and avoid prohibited discrimination without going through the effort to build it in.

It's kind of odd to think this would happen automatically. There is some kind of wishful thinking going on that technology can't have bad effects if you don't have bad intentions.

</comment></comment></comment><comment><USER7> > No one has any idea what "artificial intelligence" even means.

I'll tell you exactly what it means:

It means that the software's own vendor is so uncertain of the actual value of _what_ the product does that they've decided to promote _how_ it does what it does - in other words, implementation details - instead.

<comment><USER8> > promote how it does

And nobody who works there actually knows that, either.

</comment></comment><comment><USER9> Do we all remember "algorithms"? Like, when every company had an "algorithm" as part of the pitch?

Some of them even had the ability to self learn and adjust to new data.

At the end of the day, AIs and MLs are just new labels for slightly more advanced "algorithms". I think everyone would be a bit better off if we tempered our expectations around the technology to "better algorithms".

<comment><USER10> Do we all remember when it was called "AI" in the 70's? To some degree this stuff is just cyclical.

</comment></comment><comment><USER11> I think the term ai has been completely abused. In fact I try to avoid using the word ai if I can help it and use deep learning instead because that's really the whole crux of this new tech.

I think most people, definitely author of the piece, miss the whole core impact of ai. Ai is basically a new way to process and calculate data, a new type of algorithm.

We can now identify objects in pictures using computer vision with deep learning. This was NOT POSSIBLE with the tech before. A computer can now beat a team of human ai players in dota. This was definitely NOT POSSIBLE before.

At the end of the day this is the impact and its not a small impact. It opens a lot of possibilities to what can now be done. To me it's far more impactful blockchain will ever be. To some degree I'm actually quite happy with all the misleading hype because the people who understand and are capable of using the technology are quietly making real differences behind all the smoke and cloud

<comment><USER10> While there have been some good incremental improvements, I think you are overstating the place of deep learning vis a vis everything in machine learning that came before it. The same thing happened to SVMs in the early 2000s, but with much less industry noise. NB I'm not trying to compare the impact of the two, just noting it was also over stated.

After all, deep learning is fundamentally a continuation of much older techniques. And we absolutely could identify objects in pictures, we've been doing that for 40 years now - deep learning techniques have given a very nice jump in accuracy for some tasks but they didn't come out of nowhere.

I agree the whole labelling "AI" is problematic. That is also a many decades old problem though...

<comment><USER12> AI developments are more like battery storage improvements. Just 10% improvements year over year, in hardware, in architecture, in algorithms, in data capturing and labeling ... they've just really started to add up.

But 10% growth YOY compounds very quickly.

<comment><USER10> 10 percent would compound quickly if we were seeing that - I suspect most of the recent acceleration has far more to do with data availability than any technical improvements though.

</comment></comment></comment></comment><comment><USER13> It mentions the blockchain hype mania as well. I happen to currently be the clearinghouse for lots of people's silly blockchain ideas right now. I mostly have no issue with the ones that are basic "chain of hashed blocks" git style ideas, intended to show some simple sequence of integrity, while still requiring trust. I don't get many of those.

But there are so many that try to shoehorn the full trustless model onto an idea that obviously still has a central authority. Argh.

Is there a good resource I can hand to non-technical people that explains why "full blockchain" only makes sense for a handful of use cases?

<comment><USER14> From where I am standing it seems as if any resource to explain anything to non-technical people will fall on deaf ears. The reason for this is money. People aren't looking for the best technical solution for their problem. They don't even have a problem. They are looking for the best way to get their hands on money quickly. If people will hand over cash they will do it. This goes for AI too. Many investors are stupid (naively optimistic if I'm being kind) and people are out to get their money.

<comment><USER15> Repeating my other comment in this thread:

> This is a tired trope, that "business people" are brainless and gullible. > Almost as tired as the "VCs are so dumb they'll throw money at anything-AI" > idea repeated in the article.

> Maybe, just maybe, the people running multi-billion-dollar companies, and > multi-billion-dollar investment funds, are not stupid?

> It would be much more interesting and productive to discuss what they see in > AI and why they feel so much urgency, rather than dismissing them as fools > falling for magic.

VCs only need one big winner out of every ten investments. You are looking at their nine failures and calling them stupid and naive.

<comment><USER16> Experienced VCs are not the only business people who give out money.

<comment><USER15> My problem is with the generalization. The article and some comments in this thread paint all VCs and business people as dummies falling for shiny objects.

I don't think anybody would argue with an article that said _some_ percentage of any population makes stupid decisions for stupid reasons. But then again, nobody would read that article, either.

</comment></comment></comment></comment></comment><comment><USER17> I want to strongly disagree with the conclusion based on 1-off personal anectdota.

Last year my working group within our company secured a major contract; largest for our company for the year. We expected we would have to hire 20+ entry level positions to execute on the contract. While the process was fundamentally based on ML, we knew there would be a large quantity of human labor as well to execute on time.

My colleagues and I, instead of going on a hiring spree, asked the overlords for 3 months of overhead time to develop 'intelligent automation' to reduce the number of new / temporary hires. We were able to make substantial enough gains to not have to bring on any new hires and complete the work, ahead of schedule and way under budget with our existing crew.

It was adjusting our thinking about how we do our work and incorporating ML at multiple levels in our system to intelligently guide our process that allowed us to eliminate 60% of the new positions that previously would have been generated by this work.

100% ML is coming for you.

<comment><USER18> Must not have been 20 entry level tech workers, just 20 unskilled workers. 20 entry level tech workers would be worth 2 senior workers, no management team would ever allow this.

</comment></comment><comment><USER19> I see a lot of similarities between "AI", as understood by business people, and the pursuit of alchemy and the philosophers stone. It seems like a hustle to separate rich dupes from their money by promising them the keys to infinite wealth, immortality, mars colonys, etc. In that respect it is mostly harmless but it can be quite dangerous to the people who take it seriously.

<comment><USER15> This is a tired trope, that "business people" are brainless and gullible. Almost as tired as the "VCs are so dumb they'll throw money at anything-AI" idea repeated in the article.

Maybe, just maybe, the people running multi-billion-dollar companies, and multi-billion-dollar investment funds, are not stupid?

It would be much more interesting and productive to discuss what they see in AI and why they feel so much urgency, rather than dismissing them as fools falling for magic.

<comment><USER20> I can only speak for managers I have met: what they "see" is a promise of cost cutting and an opportunity to tell higher managers that they are ahead of the hype. But never, ever, have I seen one of these people say anything that suggests they have even a vague idea of what AI or ML _is_ or what it can realistically achieve. And I'm not sure they are interested. Because as you say - they aren't _stupid_ \- I just think they are part of a game of BS I don't understand, involving higher managers, investors etc. I don't think it's so much about about producing anything using AI, it's AI for the sake of saying you are using it.

So perhaps not all fools but somewhere between con artist, willfully ignorant and fool.

(Note: this is all from "traditional" industry, I.e the manager at the hammer factory proudly launching initiatives to "use more AI" in the factory. Not tech industry. Not plausible or concrete use of AI)

<comment><USER15> You are repeating the trope, just substituting "stupid" with other deriding terms: BS, con artist, willfully ignorant, fool...

Does it really have to be those things just because you don't understand it? Is it possible those people running multi-billion-dollar organizations just know something you don't, or have a perspective that you don't?

<comment><USER20> Updated my answer: these are middle managers such as division or site managers not the top managers of the billion dollar corporations (who might well have great visions but it's not on them to implement it.). As I clarified, these projcects are always vague initiatives such as "use more ai in our process" or downright marketing stupidity such as "joe, I need you to work _AI_ into the description of our latest hammer model". Again this is old, traditional industry.

<comment><USER15> Sounds like a great opportunity to provide value and charge accordingly.

Baking off-the-shelf anomaly detection into the hammer QA process might seem easy and "not true AI" to us, but it solves their problem. Maybe you can even educate them in the process, and explain the differences between AI, ML, DL, different use cases and methods, libraries, etc. I suspect, though, they won't care because they just want to hit their business goals.

</comment></comment></comment></comment></comment></comment><comment><USER21> The claims in this article that corporations don't do pure research and every project is targeted at revenue generation is false.

I've been in R&D at both Google and IBM TJ Watson on projects that were never even tangentially revenue generating. A company with 80,000 employees can easily afford to let hundreds or even thousands of employees operate on non- product focused research.

In fact on orientation day at IBM we were explicitly told that nothing we do will ever be a product, that there's a firewall between TJ Watson and the rest of IBM and that any products will be rewritten by product teams.

It seems like the author is speculating how things work Not from experience.

</comment><comment><USER22> I don't know what this author is talking about and I'm not sure he does either.

I think his premise is that AI is bad and vague. And its bad because it's bias. But he just picks a few examples with no counter argument and spitballs from there.

AI in my opinion is technology that outperforms humans, often done with learning algorithms instead of explicit rule based algorithms.

Except the AI I have been following is wildly successful in a variety of topics and probably is coming for you. The author is right it could be biased but people are working on these problems and the author is acting as if no progress will ever be made in this relatively young field.

</comment><comment><USER23> >Translation software was once considered by serious people to be "AI" – until it became easy.

Excuse me? Translation is possibly impossible for interesting work, but certainly nothing we're doing now is even trying[0]. What we're doing right now is the equivalent of "translating" road signs and dinner menus.

[0] [https://www.theatlantic.com/technology/archive/2018/01/the-s...](https://www.theatlantic.com/technology/archive/2018/01/the- shallowness-of-google-translate/551570/)

</comment><comment><USER24> Current AI is a marketing term for trained algorithms performing analysis using machine derived statistical models (that's the learning part). The marketing term was created to help companies raise funding, and then taken over by journalists who are tired of eating dirt and write about any possible fear for the clicks revenue. That's where this really took off, in the public media where any idiot can write anything and somewhere an entire sub-culture believes them.

</comment><comment><USER25> So is Machine Learning. It can be dangerous too:

[https://www.usenix.org/conference/usenixsecurity18/presentat...](https://www.usenix.org/conference/usenixsecurity18/presentation/mickens)

James Mickens is awesome BTW.

</comment><comment><USER26> Good piece. In some ways the hype is even worse than OP suggests.

It's not even that the current trend of "machine learning" (ie data processing) is at best a tiny subset of what anyone would consider to be actual intelligence (ability to act rationally in a wide range of situations, including novel ones, ie common sense).

It's that the very idea of "artificial intelligence" is impossible. Terry Winograd, one of the earliest AI researchers in the 60s/70s wrote a great book about this called Computers and Cognition in which he lays out a coherent theory, grounded in philosophy and biology, for why the pursuit of machines that think like humans is doomed to fail. The crux of the argument is that the essence of intelligence/common sense has to do with something other than symbolic representation, ie the kind of thinking one does while playing chess or using language. It has to do with "being-in-the-world", which sounds weird but is a really useful concept from Heidegger.

Winograd gives the example of a man using a hammer to illustrate this. A man using a hammer has no mental model of a hammer while he is pounding in a nail. The hammer simply becomes an extension of his arm. The only time a representation or mental construct of "hammer" becomes relevant is if there is a breakdown, like if the hammer slips. But otherwise, the intelligent act of hammering occurs without any "hammer" objects in the mind of the hammerer.

I'm vastly oversimplifying here, but the book (first published 1985) is quite well argued and frankly persuasive. Highly recommended to all those who seek to separate AI fact from fiction in these buzzy times.

</comment><comment><USER27> '"AI" is not something anyone needs to be worried about. A world mediated by unaccountable corporate software platforms is.'

Perfect

</comment><comment><USER28> A lot of the discussions of how AI is coming for your jobs follows the same reasoning of how automation is/was, even before it was called machine learning.

The data science team at a major bank I used to work for historically had a team that sourced and cleaned the data, then a team who would explore and build the models and then a team who would learn and run the models going forward. In my opinion the final team was the most important and the most tragic for being condensed, they noticed when the models needed to return to the model builders to be adjusted when missing the mark.

The "lost jobs" in this case is that when I was on the team we had to learn the entire bank database structure and source our own data, build the models and then automate them in such ways to "catch" when they were missing the mark.

The team will be further shrunk as the software tools provided have better auto-sql for sourcing the data, automated model building functions, and automated visualizations thus removing even that as a special skills.

<comment><USER29> Like automation, the ideal is that workers who are no longer doing the jobs "AI" (aka automated systems) can now do move on to doing higher level or more interesting work. But I agree that there's often far too much trust that a system can now run itself with little to no checks or humans to tune the system.

</comment></comment><comment><USER30> So long as any form of automation has existed, people have been claiming that the sky is falling and that automation will put people out of work. And in some respects it does, but in the grand scheme of things, quality of life improves and people find work.

In the most simple terms it works like this:

1\. Workers create Automated systems. 2\. Automated systems create wealth. 3\. Wealth creates workers.

And the cycle repeats, ad infinitum.

So long as there are people with money, there will be jobs to be done. Perhaps in the future, AI employers will hire human workers that are trained by AI educators to do human tasks. There may come a time where AI/Robotics are better than humans at every task, and when that day comes, humans will compete on price, and when they're priced out of the market, they'll either merge with the machines or simply be left behind. But that time is many hundreds of years away, and I'm not convinced that machines would even want to stay on Earth. Space is much more conducive to a machine society.

<comment><USER31> Well said. Job creation is not the hard part. Eliminating jobs is. Every time a job becomes automated, the workers eventually find other industries/professions to work in, boost aggregate productivity in those other sectors, and thus end up creating more wealth for society as a whole.

[https://outlookzen.com/2019/01/05/prosperity-comes-from- elim...](https://outlookzen.com/2019/01/05/prosperity-comes-from-eliminating- jobs-not-saving-them/)

<comment><USER32> "Eventually" is the key word.

Lives can be ruined during that eventually, and some don't make it.

<comment><USER30> The same AI that puts people out of work, will be used to make complex tasks simple enough for unskilled workers, as well as training those unskilled workers to be more skilled.

</comment></comment></comment></comment><comment><USER33> Got a recruiting email about a company working in Augmented Reality, remote. Normally I'd ignore recruiting emails, but the idea of sitting at home wearing a hololens sounded too cool to not at least LISTEN to the pitch.

Yah, they're not doing AR. The guy explained it was a marketing gimmick for VCs (though he made it sound nicer than that).

</comment><comment><USER34> The author is uninformed and wrong. The hype wave propagates faster than the utility wave, but if you believe there was no lightning just because you haven't heard the thunder yet you will be sorely mistaken.

Function approximation for classification tasks is slowly but surely "eating the world."

Planning and sequential decision making based on RL are being hybridized with classical control methods for demonstrated utility.

Reasoning, rapid learning, and useful adaptation are being attacked in hundreds of research papers a month.

Remember that technologies don't arrive they go through a phase transition of "That's not real X" to "That's obvious and boring." with almost nothing in the middle.

Whether you want to call all the above "AI" is irrelevant. Tasks which were recently assumed to require humans have been shown to be tractable with other methods.

</comment><comment><USER35> I don't know if I agree with the author's argument that AI is bad only because people are bad. I'm aware that garbage in yields garbage out. But I also find myself squirming at the idea of accomplishing company goals by identifying nonlinear patterns in data with networks. Especially if those goals are modifying user behavior, a la watchtime.

Am I being a paranoid biophysicist? This isn't my field. If I use AI, am I not, by definition, ignoring responsibility? At least with a regular computer program, I understand every step of the algorithm, and can judge if its doing the right thing. But with neural networks I'm just feeding data into a black box and hoping the ends justify the means. I don't actually know what patterns it is finding and utilizing.

</comment><comment><USER36> this article is of course reasonable, but what's depressing is we genuinely have made really incredible strides in machine learning. like enough that it shouldn't be possible to overhype it. of course people manage though.

</comment><comment><USER37> "No one has any idea what "artificial intelligence" even means."

Usually AI refers to solving real-world problems that humans (or smart animals) are good at that aren't easily solved using traditional algorithms such as sorting/searching, graph algorithms, numerical methods, combinatorial optimization, etc..

Sometimes it also refers to a computer opponent in a game, or the algorithms and strategies used by such an opponent.

There is something to the statement though in that AI seems to be a bit of a moving target: once we have a good algorithm (and input data) to solve a problem (e.g. winning at checkers) conclusively, then it may no longer qualify as "AI" \- even if it did for years up to that point!

</comment><comment><USER38> Companies try to replace people with machines every time they think its even half possible. A recent example with Suncor:

"As Suncor Energy prepares to shed 400 jobs to prepare for the implementation of driverless ore-hauling trucks, the union representing workers at the company is publicly condemning the decision."

[https://globalnews.ca/news/4000125/suncor-union-outcry- autom...](https://globalnews.ca/news/4000125/suncor-union-outcry-automation- oilsands-jobs/)

</comment><comment><USER39> I liked the article. It mentions the fallacy of Objectivity by Indirection: "I didn't say that - the system (I designed) said it!"

<comment><USER40> I mean, but we've been doing that with mathematical models for years. I mean, just look at the controversy over books like The Bell Curve or Freakconomics.

</comment></comment><comment><USER41> >But we don't need to "regulate AI." As we've seen, "artificial intelligence" is mostly a constructed catch-all term for lots of different types of technology

The author forgets here that AI is not static. It's a moving target.

The examples of AI that exist today may be easy to brush off, but let's not assume that extends to examples of AI in the future.

In the meantime it is super annoying that simple techniques get marketed as "AI".

</comment><comment><USER42> > And it turns out that racially discriminatory lending and coverage can be > quite profitable – particularly when enabled with technological precision.

this is a troubling statement, is this just the author speaking or is there data to back it up?

<comment><USER36> there's decades of history about the practice of redlining in the US (good term to Google), as well as more recent court cases related to subprime lending.

<comment><USER43> More recently facebook was charged by HUD for allowing people to buy ads and filter out by race, sex, another protected statuses under the fair housing act [https://cdn.theatlantic.com/assets/media/files/hud_v_faceboo...](https://cdn.theatlantic.com/assets/media/files/hud_v_facebook.pdf)

</comment></comment></comment><comment><USER44> "Global, monopolistic platforms like Google, Facebook and Amazon do not pursue "AI" as a science project. Nor do hospitals, insurance companies, banks, airlines or governments. They do so for specific, strategic purposes, which in corporate settings are aimed at generating new revenue. "

Well, many companies will throw some money willy nilly at AI 'because' HBR said to, or consultants are pushing it, or they 'know it's coming' and need to start somewhere.

It might be rational to do some experimenting, but many companies don't have a clue really, they're throwing money at it. FB and G obviously have a clue, but even they have so much money and talent they can afford to experiment whereupon the ROI might be way, way off.

<comment><USER12> I sell AI and ML service-based solutions to large enterprises and if anything they're highly skeptical of AI and ML adding value and are always comparing its ROI to the alternative of basic data management, mastering, out-of-the-box analytics tools.

I'd say they're a lot savvier than anyone in this thread is giving them credit for.</comment></comment>


MySpace Launches Profile 2.0 With Drag And Drop Interface - <AUTHOR> http://www.techcrunch.com/2008/10/26/myspace-launches-profile-20-with-drag-and-drop-interface/ <comment><USER2> Redesign MySpace all you want News Corp. Michael Arrington's profile is proof that people love glitter gifs and that will forever be the bane of your existence.

</comment><comment><USER3> _Just a note - it won't work with IE6._

I'm not a MySpace user, but I am a web developer. This could be very good news indeed.</comment>


Mexican Repatriation - <AUTHOR> http://en.wikipedia.org/wiki/Mexican_Repatriation

<comment><USER2> Can you give some context as to why you have submitted this today?

<comment><AUTHOR> You mean I should have submitted it 80 years ago?</comment></comment>


How To Make a Funny Talk Title Without Using The Word "Weasel" - <AUTHOR> http://steve-yegge.blogspot.com/2007/08/how-to-make-funny-talk-title-without.html he's blagging about branding this time<p>has a link to a video with his speech at OSCOM at the end

<comment><USER2> Wasn't the term "open source software" invented specifically to get away from the word "free" in "free software"? They (companies) recognized that there was a branding problem all along.

<comment><USER3> Yeah it's strange for a group that wanted to be more business savvy than the Free Software guys not to trademark Open Source Software.

</comment></comment><comment><USER4> I've always read and enjoyed Steve's posts, but here he comes off smug (despite the self-depricating jokes) as if he's summoning enlightment for the audience, when the talk is simply obtuse. Is a trademark necessary? Hardly. You can call something 'free' and yet try to charge for it. No one needs to trademark the word 'free' to protect it. In the same way, if some companies are using the 'open source' moniker without releasing their source, it will become quickly evident to the customer.

Could there be a certification based on a set of standards? Sure. What that would look like is a great topic. But simply a lecture on basic marketing concepts is embarrassing and I think when Steve looks back on this video, it will be with a wince. (In his defence, I'm glad no one has had a camera around during any one of my numerous embarrassments.</comment>


Facebook stock falls below $20 for first time in two weeks - <AUTHOR> http://mashable.com/2012/09/26/facebook-stock-below-20/

<comment><USER2> Facebook is down 1.13% as of this post. NASDAQ is down 1.06%.

Facebook is effectively down 0.07% on the day.

This is news?</comment>


Tell dang/HN: <> Title tags shouldn't be escaped twice - <AUTHOR> See for example, the title tag here: https://news.ycombinator.com/item?id=10433793 <comment><USER2> Clickable: [https://news.ycombinator.com/item?id=10433793](https://news.ycombinator.com/item?id=10433793)

</comment><comment><USER3> That could be because of article scrapping returned <. It's safe to encode, as sometime you may get < char.

</comment><comment><AUTHOR> For the record, this has been fixed.</comment>


Memory Consistency Models (2016) - <AUTHOR> https://www.cs.utexas.edu/~bornholt/post/memory-models.html <comment><USER2> > There are, of course, only two hard things in computer science: cache > invalidation, naming things, and off-by-one errors. But there is another > hard problem lurking amongst the tall weeds of computer science: seeing > things in order.

Seeing things in order is a sub problem of cache invalidation. The reason multiprocessor systems have trouble seeing things in order is because of cache. A lot of the memory consistency models can be thought of as specifying when the CPU catches become invalidated.

It's cache invalidation all the way down.

<comment><USER3> Cache invalidation is a sub-problem of cache coherency. But the cache coherency is not the consistency model.

"seeing things in order" is a problem that arises even for uncached accesses. If multiprocessor systems have trouble seeing things in order, it's due of the memory interconnect. Even with an effective cache invalidation you might see things out of order. (e.g. between two data on different cache lines or with uncached accesses)

<comment><USER4> Actually the main reason you see things out of order on a modern CPU are core- local reasons, like store buffering, store forwarding, load buffering, delayed invalidation processing and out of order execution.

If that wasn't the case, memory barriers would be very expensive non-local operations, but they aren't.

The cache and memory subsystem is basically sequentially consistent and the core is the one "causing the problems".

<comment><USER3> > Actually the main reason you see things out of order on a modern CPU are > core-local reasons, like store buffering, store forwarding, load buffering, > delayed invalidation processing and out of order execution.

yes, precisely, since the store buffer is designed to ensure access ordering according to the consistency model. Otherwise there is no guarantee that two accesses with different addresses (potentially targeting different memories) will be performed and visible in the original order. That's why we need to specify the memory consistency model, and design hardware components to satisfy it.

<comment><USER4> The store buffer helps keeps stores in order, sure, but the store buffer is the main reason (on x86) that reordering _happens_. So positioning it as the savior of consistency doesn't seem right.

Store buffer is there for some key reasons apart from consistency: (a) in OoO execution stores must not escape the core until instruction retirement (or else speculative results could become visible), so you need to buffer them and (b) performance.

(a) already implies an ordered buffer, and you also have to keep some notion of ordering to satisfy store forwards correctly.

</comment></comment></comment></comment></comment><comment><USER5> If you like this, you may like [https://www.linuxjournal.com/article/8211](https://www.linuxjournal.com/article/8211) and [https://www.linuxjournal.com/article/8212](https://www.linuxjournal.com/article/8212).

</comment><comment><USER4> The article metions that x86-TSO differs from the basic idea of store buffering:

> Researchers at Cambridge have poured significant effort into formalizing > x86-TSO to make clear the intended behaviors of x86's TSO implementation > (and in particular, where it differs from this notion of store buffering).

Does anyone have an example or litmus test of this difference? My mental model of x86-TSO for the last few years is that is _exactly_ what you'd get for a TSO system with store buffering and store forwarding (it isn't clear if the store forwarding part is included in the "basic" TSO model the author discusses, so that could be the difference).

I'm assuming WB memory, not anything exotic like WC memory, NT stores, etc.

<comment><USER6> I suppose the additional bits are memory barriers and how to recover sequential consistency.

<comment><USER4> Yeah could be, although I thought the author was saying there are parts that are _different_ (e.g,. different allowed orderings in some cases), not just that there are additional features like barriers.</comment></comment></comment>


Willow Garage Selects Eleven Recipients of PR2 Beta Robots - <AUTHOR> http://www.hizook.com/blog/2010/05/04/willow-garage-selects-eleven-recipients-pr2-beta-robots-valued-400000-apiece

<comment><AUTHOR> Today Willow Garage announced that eleven (rather than the original ten anticipated) PR2 Beta robots, with a total value of over $4.4M, will be loaned out to academic and research institutions worldwide to develop a slew of impressive capabilities over the next two years. The recipients include 7 US- based institutions, 3 European, and 1 Asian. The final list is a panoply of robotics specialists: University of Freiburg (Germany), Bosch, Georgia Tech, KU Leuven (Belgium), MIT, Stanford, TU Munich (Germany), UC Berkeley, U Penn, USC, and University of Tokyo (Japan) -- full details can be found in the Willow Garage press release:

[http://www.willowgarage.com/blog/2010/05/04/pr2-beta- program...](http://www.willowgarage.com/blog/2010/05/04/pr2-beta-program- recipients)</comment>


Show HN: Sentence construction game for children based on Google Image Search - <AUTHOR> http://www.seentell.me <comment><AUTHOR> Hello HN,

This is a side-project that I built. Took me around 3 months of evenings/weekends to get it to a decent stage where I could actually put it in front of users.

Happy to answer any questions.

Tech details:

Game is made with the Phaser[0] engine. Phaser has been a slick experience and the game works decently on Android, iOS and desktops. I used a decent TypeScript-Webpack-Phaser template[1] to get started.

Settings page[2] is an SPA, based on Angular 2. That's where the parent/teacher/adult can setup lesson plans by querying for images in Google Image Search and assigning a sentence to the selected image.

Hosting is on Firebase, as a static website.

[0][https://phaser.io/](https://phaser.io/)

[1][https://github.com/rroylance/phaser-npm-webpack- typescript-s...](https://github.com/rroylance/phaser-npm-webpack-typescript- starter-project)

[2][https://seentell.me/settings](https://seentell.me/settings)</comment>


AppSumo: GinzaMetrics (YC S10) — 1 year Starter plan: $17 - <AUTHOR> http://appsumo.com/?ginzametrics

<comment><USER2> This is spam..

<comment><AUTHOR> I have no affiliation with AppSumo or GinzaMetrics. I just thought people might be interested in a great deal from a YC company.

</comment></comment><comment><USER3> How is this vs seomoz?</comment>


Scientists cast doubt on the uncertainty principle (2012) - <AUTHOR> http://www.rdmag.com/news/2012/09/scientists-cast-doubt-uncertainty-principle

<comment><USER2> Wikipedia says there are two separate things called the uncertainty principle and the observer effect. It sounds like this article is about the latter?

</comment><comment><USER3> I used to think I was indecisive, but now I'm just not sure...</comment>


Show HN: My first Rails app - a GroupMe clone - <AUTHOR>

This was the first app I built in rails. I would love some feedback on the code. Especially on how to make the model fat and controller skinny.
http://bit.ly/groupmeclone
https://github.com/burtonic/GroupSMS <comment><USER2> Whould you build a webapp with me if you are open to new ideas? I learn Rails now, to code my startup. I couldnt find a technical cofounder. Business plan, design, front-end development is already ready. I spoke to a VC fund just to see their reaction to my idea they said - wow we would definitly take it. They wait for MVP now. I learn Rails to code it. Sorry I couldn't find your email.

</comment><comment><USER3> I would recommend some more information on the landing page(or an about page) with some more information. I personally would like to know more about a service before signing up to it.

</comment><comment><USER4> I would recommend that you write more descriptive commit messages for one.</comment>


Call center employee performance analysis using Speech Emotion Recognition - <AUTHOR> https://github.com/SuyashMore/MevonAI-Speech-Emotion-Recognition <comment><USER2> Technically interesting, but the suggested application is repulsive. Personal opinion of course.</comment>


Ask HN: API to discover lat/long coordinates from a city name and country - <AUTHOR>

Hi everyone, I have a list of city names say, all the cities in Germany, and I want to get lat/lng coordinates for each one of them.
Is there any API I can use to get this kind of data? Google and Foursquare did not seem to help with that
thanks for your time
UPDATE: you people are amazing, thanks for the responses! <comment><USER2> It's called geocoding. There are several free services who provide API. Here are two of them from the first page of my search results:

[https://geoservices.tamu.edu/Services/Geocode/WebService/](https://geoservices.tamu.edu/Services/Geocode/WebService/)

[http://developer.mapquest.com/web/products/dev- services/geoc...](http://developer.mapquest.com/web/products/dev- services/geocoding-ws)

<comment><AUTHOR> thank you so much!

</comment></comment><comment><USER3> Geonames.org has files containing zip code, city and, lat/lon: [http://download.geonames.org/export/zip/](http://download.geonames.org/export/zip/)

Hope this helps.

<comment><AUTHOR> Sure it helps! Even if this database does not contain every city that I wanna check, it definitely helps.

thank you very much

</comment></comment><comment><USER4> Google's Geocoding API does just that.

Example:

        https://maps.googleapis.com/maps/api/geocode/json?address=Berlin&sensor=false

<comment><AUTHOR> thanks! That is exactly what I was looking for!</comment></comment>


Ask HN: Good Programming Search Engines? - <AUTHOR>

Does anyone have any recommendations regarding a good search engine specifically for programming topics? Ideally one which returns discussions or blog posts, rather than source code, explaining concepts, terms, and potentially discussions programmers have online. All non-programming results would be filtered out.
For example, Google "register" or "auto". These are C Storage Class Specifiers, but nothing relevant to C appears in the first 10 results. They're buried under lots of unrelated content. You can slap "+C" and "-C++" to get more specific, but you can quickly amass a very bloated query string. Copying/pasting programming terms out of a PDF for a quick search becomes cumbersome in some cases too. Google/Bing don't appear to have a filter to blot out all non-programming results.
There are plenty of source code search engines out there:
www.google.com/codesearch
www.koders.com
www.github.com
www.bitbucket.com
...and some community forums which do have great content:
www.stackoverflow.com
www.experts-exchange.com
...but no single centralized "Google for Programming". What search engine(s) do you recommend for programming topics? Do you have any search tips/hints to offer others? <comment><USER2> You may give <http://www.plre.org/> or <http://www.cdiggins.com/search/> a try to see if it helps.

From the second link: "(PLRE.org) is a custom search engine created using the Google co-op service.

The PLRE is designed primarily for researchers, students, language designers, and language implementers who need reputable sources for advanced or esoteric information pertaining to programming languages. This site has a heavy emphasis on advanced topics in programming language theory, but can be useful to find languages with particular features."

</comment><comment><USER3> I have been wanting this for a while too. Google used to be like that back in early 2000s - tech stuff dominated the rankng. Now it's very mainstream stuff.

</comment><comment><USER4> Have you tried duckduckgo?

</comment><comment><USER5> This could be a good start up idea?

<comment><AUTHOR> Possibly (you never know). Actually if you take the idea a bit further, you could create "custom" search engines for various other topics.

For example, a search engine for chef's looking for new food to cook. A search engine for auto-repair for do-it-yourselfers. And of course a programming one. Basically, any major topic or profession.

This could be done by taking a large engine (such as Google) and customizing its queries, filtering out non-relevant stuff. Because currently everything is bunched up together in one giant index. It's not as efficient as it could be.</comment></comment>


Impossible Motion: Best Illusion 2010  - <AUTHOR> http://www.youtube.com/watch?v=fYa0y4ETFVo

<comment><USER2> From the way the balls move I'm guessing there's a strong magnet in the center pillar and the balls have magnetic cores.</comment>