Mastodon and the challenges of abuse in a federated system - <AUTHOR> https://nolanlawson.com/2018/08/31/mastodon-and-the-challenges-of-abuse-in-a-federated-system/ <comment><USER3> I don't think the problem is federation. The problem is media where participants have nothing at stake, so that abusers can't be made to pay the costs of their abuse. Changing this isn't incompatible with anonymity - <USER2> example you could require anonymous participants to post bonds in a cryptocurrency. But e-mail spam, for example, would never have been a problem if the recipient of an e-mail could push a button and destroy $1 of the sender's money. Getting the incentives right for a social network is undoubtedly harder, but you can't even start until people have something to lose.

<comment><USER4> Yeah, Bill Gates proposed that solution to spam. Another one is having people register with proven credentials of their legal name and physical address.

Yet Hacker News isn't using these.

Because shadow banning, for example, works. Having someone's voice lost while they don't know about it (keep living in their bubble) _works_.

The lesson here: don't assume that your solution is the only solution.

Usenet, e-mail, and forums have taught us already that the solution to this problem is advanced, silent filtering (which have been innovated in the anti- spam arms race [1]) essentially akin to shadow banning. The enforcement of law also tends to help.

[1] RBLs, Bayesian filtering, and the already mentioned shadow banning

<comment><USER5> > Because shadow banning, for example, works. Having someone's voice lost > while they don't know about it (keep living in their bubble) works.

Shadow banning is evil and intransparent. It may work, but at what cost?

<comment><USER6> It is interesting for me that shadow banning can be evil (or not). Shadow banning is comparable to who hears bad words and ignores them, replying only with instinctive filler replies ("yeah", "hmm", "so?" and so on). Of course as a moderation measure shadow banning is a lot broader and more systematic than filler replies, but unless moderators do not disclose that shadow banning is in effect (without disclosing subjects), it doesn't seem to be a subject of moral judgement or whatever because any user can always choose to ignore you exactly in that fashion.

<comment><USER7> I don't think that's a fair comparison; the one choosing to shadow ban another isn't simply choosing to ignore the target, they are choosing to disallow others from hearing what the target has to say, and in a way that does not allow the target an opportunity to change and improve themselves.

<comment><USER4> E2E silent ignore does not work in online conversations where multiple people participate ("online group communication") because it meddles with the context since others do not participate. Try it for yourself: join an active IRC channel and ignore the first few people who chat. You won't be able to understand the conversation anymore. Spam filters work on 1:1 communication, targeted specifically at you. Shadow bans work on 1:1 communication _and_ group communication if they're centralised or server-side. Its more akin to (SMTP) tarpits [1].

[1] [https://en.wikipedia.org/wiki/Tarpit_(networking)](https://en.wikipedia.org/wiki/Tarpit_\(networking\))

<comment><USER7> I've been using the IRC method since the early 90s; it works fine. Sure, there's some appearance of discontinuity but that's a feature, and allows one to personally guage whether the choice to exclude was a good one, without having to be exposed to the comments of the one ignored.

Shadowbans aren't akin to SMTP tarpits insofar as the target of force is less likely to be a bot. Behind the silence is a human being who is trying to engage others.

<comment><USER4> I've been using IRC since the early 90s as well, and it doesn't work "fine" when you ignore active members of a community who get quoted and such.

SMTP tarpits are like shadow bans because the perpetrator isn't informed about the ban/tarpit, and its meant to slow them down by wasting their time in their bubble that they are getting "work" done.

<comment><USER7> If they're active members of the community that are regularly quoted then banning them is unlikely to be the best course of action; I prefer to publicly announce that I'm ignoring someone, and perhaps why, before I do. Banning active and valuable community members should, at least, be public and transparent, lest the community react negatively.

SMTP tarpits are more likely to involve a perpetrator who is operating a bot, and less likely a perpetrator who is personally engaged in the conversation and community.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> This was the first test of federation's claim that bad actors can be dealt with by instance-banning. They failed the test and without this key innovation performing to spec I no longer have faith that Mastadon is any more than a technically complicated open source Twitter.

IMO once the account was verified as Wheaton's the entire federation should have blacklisted every instance harboring a false accuser until they demonstrated they can be a functioning member of the fediverse.

Of course, there are better ideas in this thread such as removing the social proofing mechanisms which fuel tweet/toot abuse in the first place. But if we're just speaking in the nouns and verbs that are part of Mastodon's sales pitch they had a tool to address this and demonstrated they can't wield it.

<comment><USER9> > This was the first test of federation's claim that bad actors can be dealt > with by instance-banning. They failed the test and without this key > innovation performing to spec I no longer have faith that Mastadon is any > more than a technically complicated open source Twitter.

It should have been clear to any person applying basic analysis from the very beginning that decentralization enables abusers. The parallels to and example provided by email is simply too strong.

Decentralized moderation, where a group of essentially unconnected moderators work independently on a problem, have no ability to coordinate or shift load. Centralized moderation systems have both of these abilities, as well as often financial incentives to keep working.

The article hits it right on one point: this is a basic structural problem.

What the article misses is that it assumes there are good solutions while remaining decentralized. There's a reason the approach email settled on was, effectively, centralization.

<comment><USER10> How is email 'effectively' centralized? There are tons of providers, you can even host it yourself. The only thing that _might_ be somewhat centralized are spam filtering algorithmns that are shared, but many aren't.

<comment> loup-vaillant > _How is email 'effectively' centralized?_

By having big provider turn up the spam detector for small actors. It's currently common to have a perfectly set up mail server, with verification and reputation and longevity… and still have Gmail flags the emails that come from it as spam.

Also, forget about sending email from home. Email sent from residential IPs are instantly deleted, and not even sent to the spam folder, by big providers (Hotmail makes it an explicit policy, and bounce the email right back). You have to at least relay the damn mail through a non-residential IP.

<comment><USER11> > Also, forget about sending email from home. Email sent from residential IPs > are instantly deleted....

Sorry, but this hasn't been my experience at all. I see this claim all the time, and, obviously, ymmv, but I've been using residential IPs for ~10 years with no issues.

<comment> loup-vaillant Noted. Of course, the provider must know the IP is residential in the first place. From [https://help.yahoo.com/kb/SLN26154.html](https://help.yahoo.com/kb/SLN26154.html)

> _553 5.7.1 [BL21] Connections not accepted from IP addresses on Spamhaus > PBL_

> _Dynamic or residential IP addresses as determined by Spamhaus PBL (Error: > 553 5.7.1 [BL21])_

> _The Spamhaus PBL is a DNSBL database of end-user IP address ranges which > should not be delivering unauthenticated SMTP email to any Internet mail > server except those provided for specifically by an ISP for that customer 's > use. The PBL helps networks enforce their Acceptable Use Policy for dynamic > and non-MTA customer IP ranges._

\---

I guess you're lucky enough that your IP adress has not been tagged as "residential" by Spamhaus.

</comment></comment></comment></comment></comment></comment><comment><USER12> > In mastodon.cloud's case, it appears the moderator got 60 reports overnight, > which was so much trouble that they decided to evict Wil Wheaton from the > instance rather than deal with the deluge.

In my opinion, what's missing are tools for instance operators to ignore problematic accounts. Unless there's huge churn, 60 reports per day would quickly become just a few. And this would also help hugely with the spam issue. And instance operators could share blocklists, just as for email spam.

Given all I've read so far about Mastodon, the only viable solution seems to be running single-user instances. That way, all blocking can only be user- specific. Instance operators can't (obviously) be forced to delete users' accounts. And if that's currently too technical for most users, then it needs to be streamlined and simplified.

Edit: spelling

</comment><comment><USER13> My analysis of abuse in social media: it's an unavoidable side-product of buzz mechanics. Buzz exists in social media because the ad-based company that invented it needed a slot-machine-like mechanism to keep users addicted (has already been discussed here recently). As such, for me the root of both buzz and abuse are features like shared global news-feed and real-time trending topics (or network-wide search by some popularity-like criterion in general).

Abuse mostly works in medium to large groups and it crucially depends on dehumanization of the target. Afaik a classical way to unspring abuse IRL is to organize small isolated confrontations, exactly the opposite of doing an epic moral speech in front of the crowd because one cannot have reasonable and logical arguments in a big group. So in the end a global search ranked by recent popularity is exactly the opposite of what is needed for peacemaking: any heated argument will attract more and more bystanders and there is no way to reverse the steam.

So what solution? My guess is that only whitelisting makes sense and with a granularity lower than instances. One could also provide tools for instance moderators to make a particular thread private to isolate it. We should also not provide any popularity based ranking, leaving that to specific structures dedicated to it, with their own rules and a well-defined editorial policy (like hacker news or other). Of course we cannot just stop people from ranking things by popularity, we have to actually make it impossible. One way for that is that links really be directed: retooting something should not inform the target, making the retoot-count a hard edge-reversal problem (which would require full network crawling). We could even make crawling harder by a small rate limiting or proof a work in the query protocol (eg just making the query expensive for the client).

Does this sound sensible? edit: actually i somewhat just expanded on this comment below: [https://news.ycombinator.com/item?id=17895159](https://news.ycombinator.com/item?id=17895159)

<comment><USER14> Yes but I think there are two problems with your ideas, at least when it comes to Twitter:

> organize small isolated confrontations, exactly the opposite of doing an > epic moral speech in front of the crowd because one cannot have reasonable > and logical arguments in a big group.

That won't work. Open any Trump tweet and click on any person whether he/she is for or against president. You will see never-ending stream of tweets back and forth at each other, one party tries to convince other that Trump cheated on his wife, meanwhile other tries to convince that Clinton had her server hacked. Eventually such stream boils down to competition of who is more aggressive, rude and provocative against each other. Many such conversations ends with Hitler being injected, but of course no party will ever see the other side. I literally monitored 3 such streams of women wasting 10 days of their lives going after each other with frequency of one tweet per 45 minutes.

Your idea to break it down and sort of "mediate" between two people that honestly are not interested in even hearing what the other side has to say, but are only engaged to vent off and blindly cheer whatever cool aid they been already sold on long time ago (i.e. that Trump is incredible president, not a con man, or Clinton is amazing women, not a crook) won't work.

Second and finally:

> My guess is that only whitelisting makes sense and with a granularity lower > than instances.

Twitter has signed off its death sentence when it went public. Its a tectonic shift within your organization when you move from serving users for the good sake of the whole system, into serving stockholders that only spend 15 minutes with you, once a year at the end of financial period and will only look into one-page accounting statements of profits and loss.

While twitter users and even owners may want the most happy, prosperous and healthy environment in which everyone thrives and enjoy spending their evening reading and responding to tweets, the truth is the only people Twitter answers to is stockholders who only wants to squeeze as many ads into your timeline as possible. I'll say it even more: if Twitter starts fixing its feeds and doing further account purges, they will get sued by stockholders because obviously less users on platform equals to less ads-engagement. And its irrelevant whether you engaged with trollbots or real genuine people; it only matters you seen (and hopefully clicked) on ads.

Does this sound about right?

<comment><USER13> Yeah, not sure. For the first point, actually i don't really care: eg the action i would like to take is simply to ignore the whole thread for myself (and thus in a sensible distributed system where people might make their policy depend on mine because they trust me, it would also lower the rank of this thread and in the end isolate it in some limbo). And after some time, one can hope that a long-term effect of discouraging abuse, shitstorm and humor/meme buzz will educate users and make "interesting" uses take over (eg these people will either get off this particular network or stop participating in flame wars because there are less of them and that there is no social reward on the network).

And for the second point, i completely agree with you: there is no way that twitter makes the right thing. But i was mainly talking about what "a hypothetical well-run probably federated or even fully distributed social network" (possibly mastodon but not restricted to it).

<comment><USER14> > And after some time, one can hope that [...] because there are less of them > and that there is no social reward on the network).

That's a wishful thinking! One could say the same about first color TV when first comedy serial was aired; that eventually people will stop wasting their time watching silly shows (point given you cant argue with TV-set) and eventually move on to be more productive etc.

To the contrary I don't think we seen a mountain top just yet; still I meet people who don't know what Twitter is; their path to being daily engaged and being dragged into trollbots' wars is probably few years down the road.

<comment><USER15> Eh, I've met a few people who had only heard of the name and wondered what it was all about. When I showed them how to sign up and look for hashtags, they quickly gave up between the flame wars and the bad ui.

I don't think Twitter is going to reach anywhere near the ubiquity of tv or movies for entertainment. Most tv shows and movies don't have a good chance of making you feel angry, frustrated, or depressed after watching them

</comment></comment></comment></comment></comment><comment><USER16> I have trouble seeing how decentralized services like Mastodon really improve on Twitter.

With regards to harassment, Twitter suffers from the moderator-to-user ratio pointed out in the article but ultimately decentralization must deal with whack-a-mole on bad faith instances (plus all the other issues described).

I fear that this sort of system also has the potential to drive people even further in to social echo chambers where terrible ideas and behaviors can flourish in harmful ways.

<comment><USER17> 'echo chamber' should be nominated for some sort of worst-buzzword of the century award.

There's nothing wrong with people organising and debating issues among like minded peers. The dysfunction of twitter isn't rooted in 'echo chambers', but in the lack of grouping, which results in a Hobbesian war of all against all.

The Facebook marketing idea of a global digital village without borders is a nice vision for a corporate brochure, but no way to actually organise human communities.

Alex Pentland did interesting work on social networks and ironically enough it was precisely hyper-permissive and connected networks that produced bad outcomes and echoing because the opportunity to copy and descend into permanent agitation is largest in systems that have no barriers or idiosyncrasies. A barrier free system is a group-thinking sytem by design because it works _too fast_

It's easy to see why this is profitable for the people who run the platforms, but it is of questionable social value.

<comment><USER18> _> There's nothing wrong with people organising and debating issues among like minded peers._

That's half - and the less important half - of what an echo chamber is. That by itself is fine. It's when joined with the other half of "echoing so loudly" that any dissenting views can't be expressed and are drowned out. The group only hears what they want to hear, never having their ideas challenged. No matter how terrible the idea is they only tolerate other people who support their idea. It isn't just discussing things with like minded peers, it's actively silencing anyone who doesn't agree and not having any debate on the subject.

HN is an opt-out echo chamber. Dissenting views are flagged or greyed off the page for nobody to read, except for the people who turn ShowDead "ON" and opt out of the echo chamber. In return for seeing dissenting opinions they see a lot more spam, a lot more vile posts, a lot more noise. In many ways people would say that makes the experience worse, but I wouldn't have it any other way. If HN didn't have a ShowDead option I wouldn't continue to be here.

<comment><USER19> Yeah, there's a big difference between telling people to stop talking about the Xbox in a Dreamcast forum and banning anyone who doesn't think that Jet Grind Radio isn't the best Dreamcast game.

One is proper curation of the discussion forum. The other is building an echo chamber.

<comment><USER17> The issue is that the latter is also a strawman, because that's not exactly common. That's also the problem with the initial response. Hackernews, by this detrimental definition of 'echo-chamber', is not one. People debate diverse viewpoints here, the only thing that is demanded of them is that they do so in civil manner and good faith.

That's not an echo-chamber in the bad sense of the term, that's the basis for productive discussion.

<comment><USER19> It was a ridiculous example to show that you can have a curated discussion forum that doesn't lead to an echo chamber. I took it to an absurd length to make it quite obvious that it was what it was and chose a topic light enough so that there's no need to actually debate the merit of the issue raised by the example. Basically whether or not Jet Grind Radio is the best Dreamcast game is a dumb point to argue, but we can agree that a forum that enforced that opinion would just create an echo chamber of people who really like that game. And that that's bad curation.

Essentially, agreeing with the guy I responded to that an echo chamber requires silencing dissenting opinions without any hope of discussion.

I wasn't passing judgment on whether or not HackerNews is or is not an echo chamber.

</comment></comment></comment></comment></comment></comment><comment><USER20> I never used social media, because of privacy concerns, and because I'm somewhat of a veteran, having started with Fidonet, and continued later with Usenet.

These problem are nothing new, they existed back then already, they were only less severe, because not many people were using those services back then, and the broad audience did know nothing about them.

Having already experienced such things on a small level, I was too sceptical to use social media, and I was right.

But I started using Mastodon about a year ago, assuming that a distributed, censorship resistant network would do something better.

Boy, was I wrong. After the Wil Wheaton incident, I deleted all of my Mastodon accounts, and this will surely be my last experiment with social media.

I have a Threema account, that only my friends and relatives know, and I have my own blogs, that'll be enough.

I survided without social media before, and I'll continue to do so.

<comment><USER21> Don't you consider Hacker News to be social media? All the links are sourced and ranked from the community, plus all the comments.

<comment><USER22> It sort of is, but it benefits a lot from the (virtually) unlimited number of characters you can use. It's possible to express complex and nuanced points on HN, which is impossible on Twitter by the nature of their decision to cap everyone to tiny messages.

The Twitter length limit is a great growth hack because you ensure nobody can excel, so everyone feels they can tweet just as well as anyone else can. But is atrocious if your goal is to promote debate and intelligent discussion. It's a medium explicitly designed to prevent any kind of complex conversation - big surprise how it turns out.

HN has its own set of problems of course: like most discussion forum software it confuses "I disagree with your view" with "I disagree with how you expressed your view", so people routinely downvote well reasoned and polite posts that simply cause them cognitive dissonance or that they find inconveniently true. It'd be better to explicitly separate the two, but I never saw any forums that did so.

But it's at least got the basics right: the screen space is devoted to high density text.

</comment></comment></comment><comment><USER23> Email spam has not been a problem since we figured out Bayesian filtering. I understand why Twitter and Facebook don't offer that as a tool to it's users, because we'd all filter out the advertising that they live off of. Why couldn't Mastedon offer it? Will Wheaton opens a Mastodon account, messages he doesn't want to see start flooding in, he clicks "this is spam" on each one, and after a day or two he no longer sees the messages he doesn't want to see. The trolls, starved of attention, move on. Am I missing something?

<comment><USER24> > Email spam has not been a problem since we figured out Bayesian filtering.

My understanding is, this is not because Bayesian filtering solved the spam problem forever. It's because Bayesian filtering solved the spam problem for long enough for Gmail to dominate email.

Google had a ton of data and they were already using it to recommend ads, so they were well-positioned to use it to make the best spam filter. Unlike the things that came before, you could rely on Gmail's filtering. You didn't have to sort your spam folder _ever_. This was a clear advantage bringing even more people to Gmail.

Now the thing discouraging email spammers isn't any given filter, it's the fact that Google owns email and the cost of messing with Google is too high.

(I am not saying that this, in particular, makes Google evil. Another way to look at it is, Google saved email as a usable medium, by centralizing it.)

<comment><USER25> > Unlike the things that came before, you could rely on Gmail's filtering. You > didn't have to sort your spam folder _ever_.

Was this ever true? It's certainly not true now. Gmail correctly filters almost all spam I receive. And, it also incorrectly filters a healthy amount of legitimate mail, so you still have to check your spam folder. It will even filter mail from Google.

<comment><USER24> I check my spam folder out of curiosity once in a while, and there is nothing in there I would miss. Like some of it is "legitimate" but it's still just bulk drivel, nothing that obligates me in particular to read it.

Right now, I see mail from Google in my filter. Because it's automated dumb shit where Google Photos wants me to look at my photos from a year ago, and I already told Gmail that was spam, and it believed me.

If I miss an e-mail because it was caught in my spam filter, that's the sender's problem, as opposed to pre-Gmail, when it was my problem.

It seems to me that I haven't _had_ to re-train my spam filter by rescuing important ham messages from the spam folder in a decade. Perhaps your experience is different.

<comment><USER25> > Perhaps your experience is different.

Very much so. For example, earlier this year I sent email to a company inquiring about an opening. Their response went straight to spam.

</comment></comment></comment></comment></comment><comment><USER26> The linked webpage in the article detailing Wil Wheaton's account of the incident is a thought-provoking read of online mob behavior. [http://wilwheaton.net/2018/08/the-world-is-a-terrible- place-...](http://wilwheaton.net/2018/08/the-world-is-a-terrible-place-right- now-and-thats-largely-because-it-is-what-we-make-it/)

<comment><USER27> It's also incredibly biased towards Wil (no surprise, as he wrote it).

In reality, Wil himself was the harasser and abuser, and the reports against him were completely justified. He got bofa'd and in response started reporting other users for even the slightest provocation. And it wasn't just reporting other users; he was specifically reporting a bunch of trans women, which really puts him in a poor light considering the fiasco with his Twitter blocklist that he put a ton of LGBT people on and pretty much ruined the lives of a bunch of independent trans artists who suddenly lost their source of income.

Now it's certainly possible that a group of people decided to mob him with reports, but personally I think it's pretty likely that those 60 reports overnight were all legitimate reactions to his campaign of abuse against other people.

<comment><USER28> Maybe, but why should we believe this version of the story rather than the other one? Do you have a source?

<comment><USER29> Wil does admit to some of it: "And for what it's worth, the part of me that wants to apologize to the people who ended up [the blocklist] by mistake is overwhelmed by the part of me who was attacked really viciously by a lot of those people and feels like maybe blocking them wasn't such a bad idea, after all."

That directly supports the narrative that he publicly blocklisted some innocent people, hasn't apologised and is being mobbed for it.

<comment><USER27> I love how he says "by mistake" as if he didn't personally add a bunch of people to his blocklist deliberately simply because he was mildly annoyed by them.

Hey Wil, when you personally are responsible for taking away the livelihood of a bunch of marginalized people, you don't get to complain about being "attacked really viciously" by your victims.

</comment></comment></comment></comment></comment><comment><USER30> I wonder if the solution involves partitioning the social graph to allow accounts to coexist?

Instead of trying to censor accounts, because I'm going to assume accounts aren't used purely for offensive content — that's the easy case — but rather the account is generating 'mixed' content.

Bans are a primitive form of isolating a part of the graph. Particularly if they extend to commenting/replying to that account's posts.

The false abuse reports similarly should carry an extremely high cost to the submitter. If an abuse report is flagged maybe the account is no longer trusted ever to report a post again. Maybe an abuse report should actually have to carry some monetary value (like hashcash).

<comment><USER31> The problem is not that multiple communities can't coexist. That isn't the problem. Unboxing videos and workout videos coexist peacefully on Youtube.

The problem is when a mob of people decides they want to attack someone (or a group of people) and does everything they can to harass them.

Offering the mob their own place isn't going to help at all when all they want to do is destroy someone elses.

</comment></comment><comment><USER32> It's frustrating to see a viable-enough-it-gets-talked-about Twitter- alternative but apparently no equivalent Facebook-alternative.

I believe this is related because it seems like the Twitter model by itself breeds a wide-range of inherently bad and ugly behavior. A platform for celebrities pretty much would have to. Moreover, an "everyone sees everyone by default" approach seems hard to moderate.

I treat Facebook as a combination blog and forum. It works for me. Effectively, I have the tools to do my own moderation. A federated version of this seems much more manageable.

<comment><USER33> While I would argue that the best alternative to Facebook is nothing, it is interesting that there is no "Internet community creation kit" which would just be a blog+forum software integrated so that one section of the forum is dedicated to comments on the blog posts while other sections allow users, not just site editors, to create threads.

<comment><USER25> Is that not just a forum? phpBB has been around for a while.

<comment><USER33> Forums lack the integration to the blog (main site) comments. Even modern forums like nodeBB only offer hacky solutions for that.

<comment><USER34> I think Talkyard does what you have in mind: [https://www.talkyard.io](https://www.talkyard.io) — it's both community/forum software, and blog comments: [https://www.talkyard.io/blog- comments](https://www.talkyard.io/blog-comments), and the blog comments are placed in a blog-post-discussions category in the forum. The same login & @username_mentions work both in the blog comments and in the forum. (I'm developing Talkyard & it's open source beta software.)

I'm looking to create a PWA mobile app, meaning, people will get one's community as its own icon on their mobile phone.

(Any thoughts/feedback?)

</comment></comment></comment></comment></comment><comment><USER35> > As a moderator working on a volunteer basis, it can also be hard to muster > the willpower to respond to a report in a timely manner.

When I see the word "volunteer" in a response to a sensible critique of FLOSS software, I rankly speculate that a deep design flaw has manifested itself as a social problem.

It appears I am right in this case.

Are there known cases where I would be wrong?

<comment><USER36> Wikipedia?

I agree with you in general though. I think Wikipedia would be the exception.

<comment><USER37> Wikipedia quickly gets political. Even in technical articles, there is an incentive to impose one's own perspective for his field as the "authoritative" version. An important part of contributors, it turns out, are academics working in the field that more often than not are deeply vested in their version.

This is a great system for an encyclopedia that must find the best approximation of the truth, but I wouldn't call it "incentive free". Similar incentives in the social world (pushing out people that don't conform to the moderator's world view) could be disastrous.

</comment></comment></comment><comment><USER38> It has just occurred to me that this centralized vs federated/decentralized discussion is similar to the monolith vs micro-services discussion.

Centralized/monolith means everyone follows the same rule regardless of they like it or not, and there's single point of failure.

Federated/decentralized/micro-services means every federation/team is free to have their own rules as long as they have consistent API contracts with other nodes/services. But it's harder to have consistent quality control process as the effort is distributed.

If you see it from this angle, it might be easier to analyze and understand pros and cons of each approach. Maybe people who like monolith will also like centralized services?

</comment><comment><USER39> Lack of a batch delete function made me chuckle a bit, This alone and a select all on page feature would seem to take the sting out of the late night or impromptu delete a bunch of f u comments from a cat post events. Why would that feature not be a priority?

<comment><USER40> Fun fact: reddit doesn't have batch delete for subreddit moderators. Using the interface reddit provides, you have to individually click "remove" on every single comment.

Reddit also doesn't have a built-in button to ban a user while you're looking at the offending post or comment; you have to go to a separate "ban users" page, and copy/paste the username to ban.

The official mobile app, so far as I can tell, doesn't have ban functionality _at all_. You can only approve/remove/mark spam and lock threads.

Moderator communities have worked around this, somewhat, with browser extensions that provide mass-remove and inline ban functionality, but they're only a partial solution. The mass-remove in the mod toolbox extension, for example, isn't always able to get everything, because reddit itself only partially loads busy comment threads, and the extension can only remove comments that are actually on the page. So you have to remember to force-load the whole thread and sometimes click through the "we don't care that you wanted all the comments, click to another page to see the rest" links.

The mod toolbox extension (/r/toolbox) also adds some pretty essential things like macros for common messages that need to be sent to users, shared notes all the moderators of a subreddit can see, etc.

<comment><USER39> Is this intentional to prevent mass censorship?

<comment><USER40> The simpler explanation, and the one consistent with history, is that reddit does not prioritize the use case of moderators. If the goal was to be an absolutely unmoderated free-for-all, they wouldn't provide half-assed mod functionality, they'd provide zero mod functionality.

Especially given that AutoModerator exists and can be set up to automatically remove posts or comments based on particular key words or even regex, and odes it so fast that not even the various "view removed reddit" services can show you what was there.

<comment><AUTHOR> One of the possibly fortuitous aspects of Mastodon is that admins tend to be devs, hence their needs prioritised.

Automoderator, like RES, is a third-party addition to Reddit.

<comment><USER40> AutoModerator _started_ as a third-party feature. Now it's built in to reddit (and IIRC the developer was hired, or at least collaborated with, on the integration).

</comment></comment></comment></comment></comment></comment><comment><USER41> It's a mod failure and a tool failure. If you get 60 bullshit reports about a user, ones that aren't even debatable, you should be able to send out replies as a mod to their mods, and if they aren't heeded, defederate.

There needs to be some sort of federated ticket system or something. Federation is like a treaty, and a treaty is basically nothing but a court.

</comment><comment><USER42> Sure, and these are good points, but they solve a problem far less interesting than the real problem.

Of the (let's guess) 60 people telling Wil to go do one, up to about half[1] might be the shitposting crew taking advantage to troll a not well-liked celebrity, but the rest were people and their friends who were genuinely incensed at his appearance in their graph.

For the latter, you might argue they should block him, but if he's on the same instance then effectively he's come in and sat down in their home. If he's on a remote instance, then there still exists the desire for retributive justice for past wrongs (yes, including perceived).

In this specific case, there was no-one (except the moderator!) sticking up for Wil. The groups that dislike him are small, but genuinely plural. (e.g. 4chan doesn't like him, a number of trans* artists don't like him, some Star Trek geeks...)

Given that he came to the fediverse to escape harassment and trolling on _mainstream_ platforms, I don't think there is a great solution.

So here's two options, instead:

One: Don't join the platform as "Wil Wheaton". If you want to join a community as another face in the crowd, then use an internet handle. Then you can interact as equals.

Pseudonymity is one of the great gifts of the internet.

If you come as a celebrity to link your blog posts and try and talk to fans, then I don't think the fediverse makes any sense. It's too small and people are territorial of the instances they adopt.

Secondly - a more social solution - find some way to calm the people involved. This may involve temporarily suspending instance links, or saying that (as moderator) you need time to discuss this and are working towards an acceptable solution, etc. Don't know what you do next.

Finally - and the point of my rant: Dismiss those you don't understand / greatly simplify social problems at your peril. (Sure is great reading a bunch of trans artists arguing in earnest turned into "abusers" \- nice!)

As humans, we make great changes and build general solutions based on one-off undesirable acts, and if you don't even make an effort to completely understand the problem then you WILL build the wrong solution.

[1] Possibly more than 50%? There were people involved who kept saying they had just joined Mastodon and didn't know how to use it, which is weird.

</comment><comment><USER43> This is relevant in a way: Modern anti-spam and E2E crypto

[https://moderncrypto.org/mail- archive/messaging/2014/000780....](https://moderncrypto.org/mail- archive/messaging/2014/000780.html)

</comment><comment><USER44> Decentralization definitely makes a hard problem, that twitter has barely been able to solve on a monolithic system, harder. I wonder if Mastodon could take techniques from things like BitTorrent that do a decent job of determining an individual node's contribution in a decentralized way, like maybe a way for instances to pass hints to one another. For instance if someone is being banned/moderates frequently on other federates instances that might be a hint to block their content. Obviously there's an opportunity for someone to control many instances and manipulate the system.

I love the idea of Mastodon and I'm hoping people smarter than me find solutions for these problems.

</comment><comment><USER45> You need to have good, immediate abuse-banning tools.

So if Wil Wheaton says "look at my new movie" and you get 60 abuse reports about it, there should be an one-click tool that says "Everyone who reported this as abuse gets suspended and all the reports are removed from the queue {click}". If Wil Wheaton has 92 people replying "fuck you" to his posts, it should be one click to pull out everyone who wrote "fuck you" to Wil Wheaton and give them a slap.

You can set the level of violence done to whatever you want (maybe a temporary suspension is fine, maybe you just want them to lose abuse-reporting privileges, maybe you want to nuke them from orbit). But it should be one click to deal with mobbing. "Mark all these accounts as mob participants". Etc.

All this stuff is, frankly, EASY, you just have to think through the dynamics and have an understanding of social media. EVERY tool you give users, including the "report abuse" tool, can and will be abused, and therefore you need tools to deal with abuse of every tool.

Tools obviously won't help with BAD moderation. If your moderator hates Wil Wheaton and likes Nazis, they can take that side. But it will at least make moderation (good or bad) fast and efficient, which gives you the chance of hiring enough good moderators to provide overall good moderation. (Hint: if you have multiple moderators, you need tools to review your moderators....)

You should have all sorts of counters to record stats about abuse - how many problems you get from each other instance, ratios of problems/good content, that sort of thing. It should be easy to notice that you've gotten 5 mobbing attacks today from foobar.mastodon so maybe that entire instance needs a little timeout. And so on.

</comment><comment><USER35> How _is_ abused handled in Mastodon?

From the article it is implied that Mastodon couples "moderator" with "instance admin" and leaves it at that.

<comment><AUTHOR> Poorly. That's topic of active current discussion.

</comment></comment><comment><USER46> Does anyone regularly use mastodon as their social network of choice? I've registered and looked around but it seems so.. boring. How did you kick-start your social graph to the point where it became interesting? With twitter, instagram and facebook I had actual in-life acquaintances using the network. With mastodon, I'd have to go seeking content pretty aggressively.

<comment><USER47> I had been using Mastodon for over a year until 2 months ago.

When I joined, it felt like a good way to meet people who share interests and learn about new ideas.

You kick-start your social graph by looking at the fediverse feed and following people who are cool and interesting. You also can find good discussions by commenting on their tweets (I'm not calling them toots).

I left because it eventually became the same drama you find on Twitter.

Anger becomes a hobby, and negativity then spreads like cancer.

People ruin other people's reputation and lives within a community (or real world if they can) all because of a single second of their life that may or may not have happened.

It is very sad and alarming that people are blind with unguided rage that they do not know how to direct positively.

In the end, Mastodon will be a good community, but not for everybody, and it is not an open or welcoming community.

<comment><USER46> Sounds like it's not for me then. I find little in the fediverse feed which appeals to me, and hashtag searches for topics which interest me turn up small clusters of unconnected, non-conversational toots going out into the void.

</comment></comment></comment><comment><USER48> this sounds like a scare piece of "news." A possible competitor to twitter etc.

<comment><USER12> Well, it _is_ frightening.

</comment></comment><comment><USER49> So I'm just going to drop this idea for all you Eager Internet Entrepreneurs here on HN:

influencers.social, a Mastodon instance for Verified Social Media Influencers.

If you have a Twitter/Instagram/Facebook/etc account with 5x10^6 or more followers, and a thousand dollars per month, then you can join our elite site and know that you are in the hands of our team of moderators, who are on the job 24/7\. We use sentiment analysis to catch the abuse before you even see it! Why trust your social media presence to the underpaid minons of the other commercial sites, or to a volunteer running their site as a side project, when you can be a Verified Social Influencer?

Juggle the numbers as you see fit. Pick a better name while you're at it. Decide for yourself if you feel like passing any improved moderation tools back to the codebase of whichever ActivityPub-based social site you fork off of.

<comment><USER24> This sounds like satire, but I don't get the joke.</comment></comment>


How I Got a 27% Return Buying Wine - <AUTHOR> https://www.humblebuck.com/blog/2017/4/14/how-i-got-a-27-return-buying-wine <comment><USER2> Not really the right term IMHO. Instead of calling a return which implies ROI, it's a discount. If you did sell it at the higher price and notwithstanding taxes, overhead of inventory management, other costs and your make 27% then it's ROI.

Isn't that how it always works at Costco? If you buy in bulk - you save.

<comment><AUTHOR> I agree, if you buy in bulk you save. And I agree typically, people associate return/ROI lingo with investment. However, I think it's useful to think this way to compare ways to utilize your excess money. I find it helps people think about where they can do this in their lives outside of the normal Costco run.

</comment></comment><comment><USER3> If I were to make a list of tat post from hacker news this would be on it.

<comment><AUTHOR> Man I wish I knew what tat stood for...</comment></comment>


X86 assembler in Bash (2001) - <AUTHOR> http://lists.gnu.org/archive/html/bug-bash/2001-02/msg00054.html <comment><USER2> It warms my heart to see such a brilliant hack. It's especially impressive that this doesn't use any external tools like sed.

If you scroll to the bottom, you can see how it works. Each x86 instruction is actually a shell function, and the input to the the assembler is itself a shell script. Each line of the input script basically tells the assembler which bytes to output. There is some fun stuff for dealing with variable- length x86 jump instructions, but otherwise that's the basic idea.

The new Mill CPU architecture actually uses a similar idea in their assembler. Each of their instructions is a C++ function. To assemble Mill software, the first step is to run the "assembly language" through a C++ compiler. The resulting program emits the appropriate Mill machine code when it runs. This is an interesting approach, since it turns the assembler into a reusable piece of software.

Another side-benefit of this technique is that it gives the assembler a super- powerful macro language. In this case, the macro language is basically bash shell. So you want to emit 100 add instructions? Just put the instructions inside a bash `for` loop!

<comment><USER3> Warms my heart too, but what interests me most about this story is that I recall assemblers being written this way as a sort of a standard technique in the 70's and 80's, and it seems to have been a lost art, now recovered (or, at least in 2001) .. I remember some Tandem (or perhaps Wang?) machines used the shell to emit assembly instructions, and in the days of MIPS as a hardware manufacturer (RISCOS pizzabox) there were such assemblers, very rudimentary, for the boot console, so you could emit code to start the machines ..

{Hmm .. what is the term for this, it occurs so often I'm sure there must be a description of it, where new, old stuff becomes new and interesting again?}

<comment><USER4> > and in the days of MIPS as a hardware manufacturer (RISCOS pizzabox)

I was very confused there for a moment - I'd never heard of RISC OS pizza box in any other context than the Acorn / ARM machines. In case anyone else is similarly confused: This is RISC/os the Unix for MIPS based systems.

<comment><USER3> Right, sorry for the confusion, and thanks for clearing that up.

</comment></comment></comment></comment><comment><USER5> Related, aaa, by Henry Spencer[1]: [http://doc.cat-v.org/henry_spencer/amazing_awk_assembler/](http://doc.cat-v.org/henry_spencer/amazing_awk_assembler/)

       "aaa" (the Amazing Awk Assembler) is a primitive assembler written entirely
       in awk and sed.  It was done for fun, to establish whether it was possible.
       It is; it works.

Also, awf, also by Henry Spencer: [http://doc.cat-v.org/henry_spencer/awf/](http://doc.cat-v.org/henry_spencer/awf/)

        This is awf, the Amazingly Workable Formatter -- a "nroff -man" or
        (subset) "nroff -ms" clone written entirely in (old) awk.

[1] [http://en.wikipedia.org/wiki/Henry_Spencer](http://en.wikipedia.org/wiki/Henry_Spencer)

</comment><comment><USER6> On a similar topic, FORTH assemblers are interesting. You write FORTH code like:

        : RDTSC
           RDTSC
           EAX PUSH
           EDX PUSH
        ;CODE

which compiles to a wrapper that runs the rdtsc instruction and pushes the result (2 x 32 bit words) onto the FORTH stack.

Which reminds me, I must finish this one: [http://git.annexia.org/?p=jonesforth.git;a=blob;f=jonesforth...](http://git.annexia.org/?p=jonesforth.git;a=blob;f=jonesforth.f;h=5c1309574ae1165195a43250c19c822ab8681671;hb=HEAD#l1627)

<comment><USER7> [Edit: yes the code above seems to be valid for the author's non-standard "jonesforth" implementation of Forth. ;CODE is defined in the ANS Forth standard to mean something very different.]

Sorry for the nit-picking, but the code you give is most likely wrong. Assembler code in Forth is enclosed in CODE...END-CODE . ;CODE is used to attach machine-code run-time semantics to words created with CREATE [1].

      CODE RDTSC  ( -- d )
           RDTSC
           EAX PUSH
           EDX PUSH
      END-CODE

Here RDTSC and PUSH are not compiled but executed immediately to output the corresponding machine code to the current definition (which also uses the name RDTSC albeit in a different vocabulary).

You can generate machine code by invoking the Assembler's words from Forth words (a "word" is what you call "functions" in other languages), which can be used as a simple macro facility or as a facility to dynamically generate machine code, do automatic register allocation etc.

       ALSO ASSEMBLER
       : my-macro      RDTSC     EAX PUSH     EDX PUSH ;
       CODE RDTSC   my-macro  END-CODE

BTW for those interested, this is the source of the x86 assembler, written in Forth, that ships with GNU forth [2]. The amd64 version [3] even supports SSE. When writing assembler code in Gforth, the non-standard ABI-CODE facility [4] is preferable over CODE..END-CODE, BTW.

[1] [http://www.forth200x.org/documents/forth13-1.pdf](http://www.forth200x.org/documents/forth13-1.pdf)

[2] [http://git.savannah.gnu.org/cgit/gforth.git/tree/arch/386/as...](http://git.savannah.gnu.org/cgit/gforth.git/tree/arch/386/asm.fs)

[3] [http://git.savannah.gnu.org/cgit/gforth.git/tree/arch/amd64/...](http://git.savannah.gnu.org/cgit/gforth.git/tree/arch/amd64/asm.fs)

[4] [http://www.complang.tuwien.ac.at/anton/euroforth/ef10/papers...](http://www.complang.tuwien.ac.at/anton/euroforth/ef10/papers/ertl.pdf)

</comment></comment><comment><USER8> "shasm doesn't use eval."

</comment><comment><USER9> Reminds me of TempleOS [0]

[0] [http://www.templeos.org/](http://www.templeos.org/)

<comment><USER10> so hardcore, so did the name

</comment></comment><comment><USER11> neat, but i'll stick to nasm, thanks.

</comment><comment><USER12> I am impressed.</comment>


Just Say No To Google: Internal Microsoft Email - <AUTHOR> http://no2google.wordpress.com/2007/06/24/life-at-google-the-microsoftie-perspective/ <comment><USER3> The "google doesn't offer a career path" point didn't necessarily sound as bad as they were probably assuming: given the choice between moving in to management if you're good at coding, or being paid more to do what you presumably enjoy, I know a lot of people who would prefer the latter.

Not a cut-and-dried issue I know, but I suspect it betrays a certain set of assumptions if not a mentality.

<comment><USER4> I understood "google doesn't offer a career path" to mean that there's no structure in place to help you advance to more valuable positions, not necessarily from coder to management. "Developer to Technical Architect" is one example given.

The problem with the traditional corporate structure isn't that advancement is bad, it's that there's often a mistaken assumption that the only thing more valuable than an individual contributor is a manager of individual contributors.

In the end I think this one is a wash. It's hard to see how you could do it both ways, and there are advantages to each. Google's ad hoc style seems to allow freedom to grow in whatever direction you want, and Google will decide later on if it's worth a promotion (to SDE II etc). The author seems to envision a system where the company has specific needs, and will support an employee with training and mentoring until he fits those needs.

</comment></comment><comment><USER5> Say NO to Google. Say NO to Microsoft. Say YES to your startup.

</comment><comment> patrickg-zill Astroturf? Only real post on a freshly minted blog. No information to substantiate who this person is.

</comment><comment><USER6> It reads more like a balanced review to me. jkush did you actually read all of it?

<comment><USER7> I think he lifted the title from the blog itself.

<comment><USER6> my bad

</comment></comment></comment><comment><USER8> The rest of the story has emerged, from the guy who wrote the email (and notably didn't publish it himself). From <http://www.phatbits.com/?p=3>

" The responses are my personal impressions, communicated to my Microsoft recruiter in the context of a private 1:1 conversation. A few days after I sent my response to the recruiter, I saw an anonymized version floating around and being discussed inside Microsoft. I hadn't realized at the time that I wrote it that it would be distributed widely within Microsoft so that was a bit of a shock. "

</comment><comment><USER7> See also: <http://www.aaronsw.com/weblog/googlife>

<comment><USER4> I like this reply:

 _I don't know what I should and shouldn't say because of the NDA, but it's probably okay to say I'm married to a Googler. He hasn't been there too long, but the only problem we've had so far is that he never seems to want to come home!

Seriously, though, I've seen a lot of articles that might be labeled "sour grapes" about Google lately. (Not to imply that yours is one of them - <USER2> made an effort to support your conclusions and it does sound as though you know some unhappy people, which is unfortunate.) The thing is, I've seen my husband go through jobs at other corporations. I've waited up for him on the nights when he was forced to work overtime on a doomed project. I've been there for him while he struggled under the tyranny of dangerously ignorant management. I've seen him waste weeks of his time because of thoughtless and fruitless penny-pinching. He started out so bright, so full of energy and zest for what he does, and over time I watched that energy and passion wilt under buzzing florescent lights in suffocating cubicles.

Corporate life in general is terribly depressing. I personally hate it and work independently. I love what I do and at least this way no one can take my enthusiasm away from me.

But that's exactly why I think what Google is doing is terribly important. More companies need to be that way. They need to be families who treat their employees like children - they take care of them. They reward them for their hard work. They encourage them to be creative, because they know (and you know, too) that it only takes one good idea to make a million dollars. Or a billion. Or an empire.

I'll say this: my husband has never been happier. For that, I'm exceedingly grateful to Google. They've given him something that he deserves, that everyone deserves. I wish it were more widely available. I wish we all could be free to be children, to feel like it's okay to laugh, to look forward to waking up, to nurture the bright and crazy ideas that wander through your head. That really doesn't sound like a bad world to me._</comment></comment>


Wt: A C++ web toolkit  - <AUTHOR> http://www.webtoolkit.eu

<comment><USER2> In light of the recent articles criticizing C++, it is actually nice to see a framework which uses C++ without being ugly or scary. Perhaps Wt is a good example of people using a "Subset" of C++ to good effect.

The framework, code and the website itself look very nice. If I ever have to use C++ to develop web apps, I will definitely evaluate this framework.

+1

<comment><USER3> I'm using and liking a subset of C++ myself...

But for web development, it seems like quibbling to even mention all the reasons it generally isn't used in normal web development - lack of portability, need for compiling and the real and _perceived_ danger of a binary that might run on a server you rent from someone else. Then that said, I have worked on C++ web backend stuff but it was kept well away from the realm that Ruby/Python/jsp/asp inhabit for all these reasons.

<comment><USER2> I agree with C++ being a sledgehammer/chainsaw for web development.

However, I was looking at emweb.de, the website of the creators of this toolkit and they seem to be oriented towards web app development for embedded devices.

It does make sense to use C++ embedded devices because:

      * You control the environment completely
      * CPU cycles are not cheap
      * "embedded" developers are already comfortable with C/C++
      * One less "framework" to ship-out/maintain.

edit: formatting

<comment><USER4> I guess it's a testament to how powerful small hardware is getting that C++ is actually an option in the embedded space. I can see some of the greybeard asm programmers having a stroke right now.

<comment><USER5> It is properly targeting the high-end embedded market, since there are only a few places I can imagine that you would want an embedded webserver.

<comment><USER3> Hey, every smart refrigerator needs an embedded web server...

<comment><USER5> But that would be the upscale embedded market - your ordinary remote control, microwave oven, light sensor, etc would not need an embedded web server.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> about a year ago, i made a half-hearted attempt to pick up web programming. i spent some time futzing with rails, but it didn't really appeal to me. none of the other options caught my fancy either. so my attempt just dribbled off into nothing.

but looking at the code on this site actually has me intrigued. i'm already good at c++, and the examples are clear. if i had a burning need to write a web app, this would be the first thing i'd investigate.

<comment><USER7> <http://www.platinumball.net/resume.html> holy crap you have a lot of experience.

<comment><USER6> It is unfortunate that you are the only guy who thinks so. Heh! I am a little too experienced to be comfortable as a buzzword-compliant enterprise-dwelling cubicle drone, but not experienced enough to get into the big-league rockstar companies I'd prefer.

Well, actually, I _did_ get into the big leagues once, when I worked at Be. But the company was dying, so it wasn't a really great time to be there. I still could have made the best of it, but I didn't. I squandered that opportunity pretty badly, and I regret it. I've been trying to claw my way back in ever since.

Seriously though, thanks. That's a very nice thing to hear.

<comment><USER8> You make my resume look like a small shivering Chihuahua.

<comment><USER9> Do not define yourself by a resume. For the last 5 years I have been working without even having one. Consulting with more than 15 companies or so, and being there to launch about 5 of them.

The few times I had to submit a resume was when I did it out of courtesy to the HR folks.

Resumes are for specialists. If you can do most everything with software, don't mind rolling up your sleeves and cleaning house while having a defined job description, then you shouldn't worry about a piece of paper (i.e. "Not everything I am to do for the company could be captured in paper; I am here to write backend code, yes, but I will volunteer to do the system admin, front- end, communication, documentation, in-house training, tech-support, make reports and clean up data, and I am willing and able to source funding, makes sales calls, or even pitch in my own pennies to bootstrap _us_ " ..)

Drop the formality and I might just give you my all.

</comment></comment></comment></comment></comment><comment><USER10> This sounds like GWT with a different choice of statically-typed source language. I wonder if they have ImageBundle magic and a pay-as-you go design too.

</comment><comment><USER11> There's also a Java version (I haven't tried either). <http://www.webtoolkit.eu/jwt#/>

</comment><comment><USER12> very ambitious.

from what i get from the examples (see e.g. hello world [1]) and the wiki, it abstracts away all html, javascript and css. you can stay in C++ if you want.

i can imagine the html interface could work for a desktopy-application on a portable device, where the server is localhost.

but i can't image doing a web20-y app with this. the CSS/JS is hidden away so deep and both are moving targets with current browser affairs.

[1] <http://www.webtoolkit.eu/wt#/src/hello>

</comment><comment><USER13> How is Wt pronounced "Witty"?

<comment><USER14> I think it's a reference to Qt which is pronounced "cutie."

<comment><USER13> Yes... but Qt sounds like cutie when you say it.

Its a huge nitpick, sure- but witty just doesn't make any sense. A person has no chance of correctly pronouncing the name when reading "Wt" for the first time.

<comment><USER15> To be honest, a literate person with English as their first language will almost certainly mispronounce GNU the first time, particularly if they see the logo as well. Not that this in any way actually contradicts your point, admittedly; it's more that I don't really understand the significance of pronounceability in the grand scheme of things.

Clojure, too, for that matter. I got the reference, but thought the j was pronounced as a j the first time I saw it.

</comment></comment></comment></comment><comment><USER16> Yet another C++ web library.

There's, like, one per month on NH.

<comment><USER8> I work in python at my day-to-day but I have to say that python is far more guilty of announcing a _library that does X_ , web or no, than any other language.

<comment><USER4> That's just due to python's batteries-included mentality. Those guys are proud that there's libraries to do damn near anything. If you pick your libraries well, it's astonishing how little python you actually need to write sometimes.

<comment><USER8> I wrote a rather robust screenscraper in 65 lines when I first started at my company.

So yes, I know that the batteries-included mentality is there, I'm just saying that they don't need to announce it constantly on all my news aggregators. I can just google it if/when I need it.

And if you don't google for a library to solve a problem you're working on before you start coding, you're being a little more than silly.

Edit: Woof, somebody went on a code crusade and later found out a library existed methinks from the downvoting. ;)</comment></comment></comment></comment>


What Time Is It When You Try to Pass Through "A Wrinkle in Time"? - <AUTHOR> https://daily.jstor.org/what-time-wrinkle-in-time/ <comment><USER2> This was one of my favorite books growing up, but the linked article is iffy at best. Author doesn't understand the difference between quantum mechanics and general relativity, which should be a nonstarter on HN. Would love to have a better article as a starting point for discussion of this book here.

<comment><USER3> I don't even think quantum mechanics come into play at the mitochondrial level in Wind In The Door.

<comment><USER2> I agree.

I think there is a scene in Wrinkle where Meg uses the fact that atoms are mostly empty space to pass through a solid wall. However, this is really more of a classical view of atomic structure (atoms as hollow balls), rather than QM.

<comment><USER4> "The Transparent Column"

</comment></comment></comment></comment><comment><USER5> It seems like kairos is like Csikszentmihalyi's flow. It's time that passes while you are engaged, active, purposeful -- living rather than waiting.

Perhaps without a willing participant, there can be no kairos; there is only chronos?

Great book, BTW. The most memorable from my childhood.

</comment><comment><USER6> Good article. I have to say, after reading it, I still don't understand the difference between _chronos_ and _kairos_

<comment><USER7> The description of kairos in the article reminded me of what's now commonly called a flow state. Not sure if it's exactly the same idea or not. [https://en.m.wikipedia.org/wiki/Flow_(psychology)](https://en.m.wikipedia.org/wiki/Flow_\(psychology\))

<comment><USER8> I think the concept of "flow" as it relates to Kairos is best described by the classic song, "Row, row, row your boat".

</comment></comment></comment><comment><USER9> One of my favorite fiction book series as a kid.

<comment><USER10> I still fondly remember this book, along with "Stranger from the Depths" as two of the best books I read as a kid.

<comment><USER11> I loved _A Wrinkle in Time_ and my other favorite was _A Wizard of Earthsea_ , which I remember randomly finding in a dusty attic in a summer school when I was 11 years old. Talk about magic.

<comment><USER12> yes. Exactly.

</comment></comment></comment></comment><comment><USER13> This book had such a profound influence on my life and young mind. It basically formed a lot of the values I have and ideas about what is right and what is wrong.</comment>


Ask HN: Computers can see and hear, why can't they smell? - <AUTHOR> My belief is that true intelligence for machines can be achieved once they have the same senses as humans. We have already successfully translated the sense of vision and hearing to computers. How can we do it for smell? Is anyone working on it? <comment><USER2> I think there are some to detect an specific product, but a not a general purpose detector. The relation between the chemical compound and the layman name of the origin is probably as difficult as detecting a cat in a image.

Current state of the art: [https://en.wikipedia.org/wiki/Electronic_nose](https://en.wikipedia.org/wiki/Electronic_nose)</comment>


Convert Curl Syntax to Python Requests - <AUTHOR> https://curl.trillworks.com/ <comment><USER2> Author, here. curlconverter gets about 17k unique users per month. The code generated by this tool is probably in production all over the world.

But the codebase needs maintenance! I hired a junior developer (cf512) to do about 40 hours of dev work last month, but that contract has ended and I'd appreciate more volunteers. All the code is open source.

I see a few bug reports down thread. Please open tickets.

A big thanks to the top contributors, csells and jgroom33. Many others have pitched in over the last five years. Also, big thanks to Daniel Stenberg for writing curl in the first place.

<comment><USER3> Thank you for making this. Wouldn't hacktoberfest tagging help some visibility for contribution?

</comment></comment><comment><AUTHOR> I'm not the author of this tool, but I submitted it to HN because I just stumbled upon it after unsuccessfully trying to transpose a complicated cURL from Chrome devtools into python requests for a good 20 min. This worked instantly. Props to the author - [https://twitter.com/nickc_dev](https://twitter.com/nickc_dev)

<comment><USER4> I've been looking for something like this for a while but I never wanted to spend the time actually searching when I could just spend the time converting it manually. Thanks for submitting this.

</comment></comment><comment><USER5> There's a bit of a hidden feature in Postman that can do this and way more, hit the code button in the right corner and you can convert your web requests to something like a dozen languages: [https://i.imgur.com/0qUV8b9.png](https://i.imgur.com/0qUV8b9.png)

<comment><USER6> Insomnia REST Client converts cURL commands into request sessions too.

<comment><USER7> Paw, too

</comment></comment></comment><comment><USER8> I've also written a tool that converts curl commands to Python Requests or JavaScript XMLHttpRequest code. It is tested with curl commands generated by Safari, Burp Suite, and Charles Proxy. It can also translate raw HTTP requests, so it can be used when you have a packet capture.

The design is modular and separates the frontend (curl) from the backend (Python), so more input and output formats can be added. It tries to be smart about generating "clean" code, so it will, for example, remove the Content- Length header when it can be recomputed from the request content.

[https://ryan.govost.es/http-translator/](https://ryan.govost.es/http- translator/)

It is also open source. Feedback or pull requests are welcome. [https://github.com/rgov/http-translator](https://github.com/rgov/http- translator)

</comment><comment><USER9> Is it all client side?

I wonder how many cookies/secret headers will be pasted by unaware and unknowing users.

</comment><comment><USER10> This is neat, but also seems like a code smell. Do people really need to convert between HTTP request formats/languages much? When I see many independent implementations of an N-to-M mapping, it looks like the perfect use case for a standardized interface, like a DSL.

In fact, can't HAR do this? I'd love to be able to just pass a HAR string to any HTTP client library, and have it execute that. Or call "dump_har()" (or "\--dump-har") on any client, and have it spit out HAR that I can take it to any other client.

<comment><USER11> When reverse engineering or automating an API my workflow will often look like this:

1\. Open browser inspector, watch API requests for one I'm interested in

2\. Right click, "Copy as cURL"

3\. Paste into a text editor, remove some unnecessary headers, re-running the curl command to verify that the headers I removed aren't important

4\. Convert into python requests so that I can play with the parameters

<comment><USER12> 100% this. I do a lot of small automations against various API's (or sometimes against systems that don't API's at all) and have used this same workflow many times.

Also handy because even well documented API's don't have examples in every language, but most do have examples in curl. So you can easily take those example curl's and dump them out to something programatic in your language.

</comment></comment></comment><comment><USER13> Postman also has the ability to import a curl command (from chrome dev tool) and then export to many programming languages.

</comment><comment><USER14> I made a similar library! [https://github.com/northisup/curlit](https://github.com/northisup/curlit) (sorry for the poor documentation!)

</comment><comment><USER15> OK, I'm not going to lie. I didn't even know you could copy requests from the network tab into curl (or fetch/ powershell/ etc.) like that. Embarrassing! :) Seems pretty useful!

<comment><USER16> One of my favorite parts is it grabs the cookie as well.

</comment></comment><comment><USER17> This is especially handy on Windows, where Chrome failed to even produce proper cURL commands in CMD format [1].

[1]: [https://bugs.chromium.org/p/chromium/issues/detail?id=658956](https://bugs.chromium.org/p/chromium/issues/detail?id=658956)

[2]: [https://bugs.chromium.org/p/chromium/issues/detail?id=798498](https://bugs.chromium.org/p/chromium/issues/detail?id=798498)

</comment><comment><USER18> Here is a similar site that translates curl to Go:

[https://mholt.github.io/curl-to-go/](https://mholt.github.io/curl-to-go/)

</comment><comment><USER19> Paw, which many people love, has a neat and similar feature: you can get extensions that convert the request you build in the app to any format: curl, python, etc.

It's very handy.

[https://paw.cloud/docs/getting-started/code- generator](https://paw.cloud/docs/getting-started/code-generator)

</comment><comment><USER20> The "uncurl" library[1] does something similar and can be used in the terminal. I've found it extremely useful.

[1]: [https://github.com/spulec/uncurl](https://github.com/spulec/uncurl)

</comment><comment><USER21> I wrote a subroutine macos python to do the opposite.

On macos, requests is not included (although it can be installed with a little effort), but curl was there.

Note that you can easily automate interacting with a web page using the developer menus in safari and firefox.

monitor the network requests, then for the request you're interested in, use "copy as cURL'. You can copy/paste that to invoke curl in the same way the web page used it.

(sometime I have to use --cookie-jar /tmp/cook --cookie /tmp/cook)

</comment><comment><USER22> Oh wow, not just Python - quire a wide array of languages are supported. Very nice, this will be handy for prototyping things.

</comment><comment><USER23> reminds me of a little clojure macro i wrote to demonstrate "power" of macros in lisp: [https://gist.github.com/keymone/d7725767dc0425a7bcf9](https://gist.github.com/keymone/d7725767dc0425a7bcf9), obviously not feature-complete but sufficed for the demonstration

</comment><comment><USER24> For those interested in integrating such a feature on their website.

An helper for building API request, for example, there is this great open source project: [https://github.com/Kong/apiembed/](https://github.com/Kong/apiembed/)

It supports a dozen of language.

</comment><comment><USER25> The capability to convert a network request from one format to another is the main reason I use Postman, which has a great implementation of this and a ton of tools and languages it can do it in. This looks great as well

</comment><comment><USER26> This tool is incredibly useful, I use it at least once a week. Its incredibly useful to explore a site with network in devtools then be able to quickly turn it into a python prototype! Amazing work :)

</comment><comment><USER27> Great tool, would be nice to also have a chrome extension for the same that augments dev-tools to reduce one extra step of copy/paste.

</comment><comment><USER28> Failed entirely to work on my first attempt with:

        curl -XHEAD https://google.com

It is just flat out wrong on:

        curl -X HEAD https://google.com

In that it does a GET request:

        import requests

        response = requests.get('https://google.com/')

Clever idea, but my first totally valid example failed (it does OPTIONS, GET, POST, PUT, PATCH successfully)

<comment><USER29> In case the creator of this tool doesn't read this thread, you can report the issues on GitHub: [https://github.com/NickCarneiro/curlconverter/issues](https://github.com/NickCarneiro/curlconverter/issues)

<comment><USER30> Even if the creator of a tool does read the thread, discussions like these are not the place to report bugs.

</comment></comment></comment><comment><USER31> I independently used this tool a couple days ago. Helped save me a lot of debug time!

</comment><comment><USER32> oh hey, I wrote the `Go` support for this tool.

<comment><USER2> How could I forget, PR #100.

Fyi, Go received about 1200 conversions last month. Thanks!

</comment></comment><comment><USER33> hey... that's super handy. thx!

</comment><comment><USER34> this is one of the most useful little tools on good's green earth. I used to work for a scraping company and I used it all day every day - load a page with inspector open, find your request, right click copy as curl, paste into trillworks and boom you have the request you want to automate (modulo fiddling with cookies). A+ bang/line of code

</comment><comment><USER35> Failed for this one

        Curl -vLkXPOST https://www.google.com

<comment><USER36> Because that's not a "curl" command. It's a "Curl" command.

<comment><USER32> Also it works if you split out the flags.

</comment></comment></comment><comment><USER37> I feel like going the other way would be more useful.

<comment><USER38> I thought the same thing at first, but the site actually gives an indication of why this would be useful. The developer tools in at least some browsers can export a request as a curl command. So I can thus easily get the code to reproduce any request I see in my browser. That would have been useful a few times in the past, and more useful than the inverse.</comment></comment>


Google's history shows that people did not believe good idea to start with - <AUTHOR> http://joshuaspodek.com/four-counterproductive-myths-about-entrepreneurship-part-ia

<comment><USER2> Reminds me of the old adage which partly reads "...if your ideas are any good, you'll have to ram them down people's throats."

</comment><comment><USER3> From Bessemer Venture Partners site:

> Cowan's college friend rented her garage to Sergey and Larry for their first > year. In 1999 and 2000 she tried to introduce Cowan to "these two really > smart Stanford students writing a search engine". Students? A new search > engine? In the most important moment ever for Bessemer's anti-portfolio, > Cowan asked her, "How can I get out of this house without going anywhere > near your garage?" <

<http://www.bvp.com/portfolio/antiportfolio.aspx>

</comment><comment><USER4> This was around the time that we all were pretty convinced that search, at best, was really boring.

</comment><comment><USER5> All ideas are not believed at first, not even by the people that think them. That's just nature of things. We need first fully form it ourselves and then present it coherently, prove it to ourselves and others.</comment>


The Secret History of Silicon Valley - Steve Blank (Gave the same talk to Twitter) - <AUTHOR> http://www.youtube.com/watch?v=hFSPHfZQpIQ

<comment><AUTHOR> This is a pretty famous talk, it was also given when I attended CIKM '08. He is a really interesting speaker.

Plus his book is a great read for all startups: Four Steps to the Epiphany. If you don't own it, you should check it out:

[http://www.google.com/products/catalog?q=four+steps+to+the+e...](http://www.google.com/products/catalog?q=four+steps+to+the+epiphany&oe=utf-8&cid=11637306425095726563&sa=title#ps- sellers)</comment>


Ask HN: How can I sell a service to your startup? - <AUTHOR>

I'd like to provide a fairly simple service for your startup's office environment. It involves providing a nice yet simple perk to your employees, but not something a founder would want to spend much time worrying about. Nothing fancy, nor expensive, but something almost any employee would like to have around.
My question: what's the best way to approach founders/office managers to provide this service? I'm in NYC but basically have no network here.
How do you like to be approached about these things? Assume that once you actually hear about the service, you wouldn't find it annoying or useless.
a) Cold call/email
b) I introduce myself at a meetup and within a few minutes mention my offering
c) Showing up to your office to drop-off a free sample and some information
d) None - I only deal with people I know well
e) Other
I'm not really a sales guy. But I am genuine and don't give a shyster/hustler vibe at all. Curious about which approach to take. <comment><USER2> Just a quick rundown from my perspective as a founder. Don't consider any of this the final word, of course.

Above all, if I like it, see the benefit and have the money for it, it doesn't matter how you approach. Be straight up about describing it and the benefit to increase the chances of this happening.

a) Cold call/email -- call will probably go to voicemail and I might not get back to you. Email will be read and I will reply with a "no, thanks" or with interest (please note I am not at all behind on my e-mail like some people are.) I much prefer text-primary e-mails to "newsletter" type e-mails that seek to educate me before describing the product. I really like it when someone's e-mail says that they won't e-mail again if I don't respond, but it doesn't influence my decision.

b) Yes, if you meet me you should obviously describe what you do. I will want to hear more and probably make suggestions even if I am not interested.

c) Sample will work really well if it's something people want. Information without a sample has a chance of getting binned. Putting a very visible offer on the information would get more attention from me.

d) Bad idea. You don't know enough people to make this go. You need feedback from strangers.

e1) Look for partners complementary to your business. For example, if you do fresh flowers, get in with an office cleaning company who would sell your flowers as an add-on. They'd get a cut in exchange for you not having to sell.

e2) Also, despite what I said about annoying "educational" newsletters, you should definitely do that on your website/e-mail signup on your website. Some people will definitely find you, even if it's a new product category without a popular search term yet.

e3) Please promote yourself on Hacker News. What is this product/service? Tell us about it, and leave a way to contact you.

</comment><comment><USER3> "nice simple perk" ?

As @redspark says: "Give us more details!"

It is notoriously difficult to assess the value of a "perk". So this perk costs me $10 / employee / week ? At first blush that seems "cheap" but how much time is it taking away? How much tangible productivity gain does it give us? Do the employee's really want it? Will they use / partake after the novelty has worn off? Like after 2 weeks???

So answer your question ... "Make the effort to find out our HR person's name and details. Send her the information and business case, after a reasonable delay follow-up. Don't get upset when she tells you that it's so 'ho hum'"

</comment><comment><USER4> Are you worried that if you tell HN what you are selling, everyone is going to want it and swamp you with sales?

Tell us what it is and we can give you better information.

</comment><comment><USER5> I'll add a slightly different take: know your audience. We get so many people contacting us assuming they have something we need, when in fact it's not even remotely relevant. It's a total time waster and really annoying.

Do a little research ahead of time and find out if the company is even in a position to want your perk. And each time you find a happy customer, ask them for the name of 3 other folks worth contacting...

</comment><comment><USER6> If you show up the office, I promise I will never buy anything from you, ever. If you cold call, I may lie to you, and then hang up, and have Google Voice block your number.

If you pitch me at a meetup, and it's not meetup-related stuff, you're an asshole, and ruining meetups.

If you send an email, though, I may read it, esp. if it comes recommended from someone I trust.

</comment><comment><USER7> A && B && C && E (get in touch through social media).</comment>


Where Have All the Hackers Gone? - <AUTHOR> http://strydehax.blogspot.com/2010/03/where-have-all-hackers-gone.html <comment><USER2> His example is a poor one. The phone system was far from open and the hacking that Woz was doing against it was very much illegal.

Instead, the availability of these types of devices (iPhone, Smartphones) has increased the level of technical knowledge in every day society. For example, there are more people that know how to jailbreak an iPhone than there are hackers. For some non-technical people, this very technical process has become something commonplace.

The reports from DARPA and the US Air Force are suspect in their relevance to this discussion. There are several factors that could weigh upon their low projections: military recruitment rate is down in the US and there is general displeasure with the government.

Also, computer science has become ubiquitous in several fields. For example, all of the majors at my engineering university are required to take some form of computer science. Creating tools and solving problems with software has become an everyday part of any engineers' tool belt. Perhaps the hackers are migrating to domain specific areas?

And, finally, that doesn't mean we should be complacent. It is still (and always will be) our charge to engage younger generations in the fulfillment and excitement that comes from solving tough problems.

<comment><USER3> A fair number of programmers I respect have broken the law.

Sometimes the law is an ass, and needs to be broken.

And sometimes you're just so damn curious you have to figure out how it works, and you break it for the rush of both solving the problem and sticking it to the man.

Most people outgrow the latter, but I would think twice about the credentials of any programmer that did not do things of questionable legality growing up.

Curiosity is to be encouraged.

<comment><USER4> A lot of the early hacking was before there were laws against it.

</comment></comment></comment><comment><USER5> They're still there, and they're always there. Consumer devices are always available since the age of tinkering is easier.

Tinkering people don't represent the majority of device users. If they want to learn and tinker, there are ways (e.g. Linux).

<comment><USER6> Exactly. I assume telephone was in the nearly every house in US in seventies, but not everyone became Woz and Jobs. Now computers are in the every home, and phones are in everyone's pocket. Should we expect everyone to become a hacker all of the sudden? I'd argue that now we have a lot lot more hackers than 40 years ago—and just the number of them makes them "invisible".

</comment></comment><comment><USER7> I'm fairly sure I've mentioned it with respect to the high school webcam controversy before, but I think it bears repeating: read Little Brother by Cory Doctorow. I can't say much about it that wikipedia doesn't without giving things away, but I assure you that you won't be disappointed; way too relevant...

<comment><USER8> Read it online:

[http://craphound.com/littlebrother/Cory_Doctorow_- _Little_Br...](http://craphound.com/littlebrother/Cory_Doctorow_- _Little_Brother.htm)

</comment></comment><comment><USER6> Again… Was US phone system open when Jobs and Woz were hacking it? If not, why is this example there.

      And most importantly, your attempts to delve into the
      mysteries of how the device functions will be punished.

Grab the SDK and delve into the mysteries.

<comment><USER9> Once upon a time, the POTS system used something called 'in-band signaling'. An example of that was really old coin telephones, where the devices would send certain tones to tell the operator which coins you had deposited. John Draper (aka Capt Crunch) exploited this in-band signaling to access the toll network, and make long distance calls as tho he had trunk signaling and origination. I assume that anything Woz was doing was similar to this. Bell Labs responded by moving the toll signaling out-of-band. Out of all this, and for other more important reasons, was born SS7.

edit: from the wiki article on SS7 ...

 _SS5 and earlier systems used in-band signaling, in which the call-setup information was sent by playing special multi-frequency tones into the telephone lines, known as bearer channels in the parlance of the telecom industry. This led to security problems with blue boxes. Modern designs of telephone equipment that implement out-of-band signaling protocols explicitly keep the end-user's audio path—the so-called speech path—separate from the signaling phase to eliminate the possibility that end users may introduce tones that would be mistaken for those used for signaling._

</comment></comment><comment><USER10> The Kindle runs on Linux, so the issue is more: Why did they screw up the GPL (< version 3) to allow an open-source operating system to run on a jailed device?

<comment><USER11> In 1989, why would jailed devices be a concern for Stallman? Copyleft was still a novel and uncertain idea, used only on a few GNU projects; if the GPL's smashing popularity since '89 is a screw up, may God grant us a success!

</comment></comment><comment><USER12> If you're going to convince me that the sky is falling, you need to show me bits of falling sky. Arguing why it makes sense that the sky is falling is not the same thing and also not convincing.

</comment><comment><USER13> I mean, I totally hear the point about the importance of a "computer defense department", especially in the context of the recent shots fired between google and china... But to conflate explicitly-installed software that allows admins to watch peoples' screens and monitor their activity with the existence and everyday use of devices like the iphone and kindle seems like a stretch. I think if anything, the case with this school will bring more attention to the issue -- and with any luck -- greater understanding.

</comment><comment><USER14> _Devices like the Amazon Kindle and Apple iPhone are jailed against any unauthorized consumer use, guarded by strict but unproven new federal laws against jailbreaking them._

What laws is he referring to? DCMA?

</comment><comment><USER15> >the inherent advantage that this generation of tinkers gave America

I think he meant to write: "the inherent advantage that this generation of tinker _er_ s gave America"

<comment><USER8> On the contrary:

[http://www.google.com/search?hl=en&q=%22a%20person%20who...](http://www.google.com/search?hl=en&q=%22a%20person%20who%20enjoys%20fixing%20and%20experimenting%20with%20machines%20and%20their%20parts%22)

</comment></comment><comment><USER16> All the hackers are busy trying to use iPhone jailbreak tools to gain root access on a MacBook. They are _very_ confused and so am I.

</comment><comment><USER17> doo doo doo. doo doo doo.</comment>