WordPress Security: Seven Ways I Could Hack Into Your WordPress Site - <AUTHOR> http://markmaunder.com/2011/12/08/wordpress-security-ways-hack-wordpress-site/ <comment><USER2> Some more advice for HN users of WP:

1) chmod /var/www/whatever and all subdirectories such that the web server user can read but not write to them. If you need to do uploads or add a plugin, you can do it over SSH. Allowing someone to execute arbitrary code from your website is just asking for pain.

2) Many (but not all!) exploits start in wp-admin. I make mine inaccessible over the public Internet, enforced ny Nginx before any PHP gets the chance to execute. (Options: only accessible over VPN, only accessible through proxy you control, only accessible with a client certificate, etc.)

3) Routine DB/code backups. I'd keep wp-content in a git repo. Add a plugin? Have to add it through repo. Code changes other than through git? Smack yourself for setting permissions wrong, then roll back to a known good version from the repo. Weird links on blog pages? Roll back DB to known good version.

4) Should go without saying, but every blog gets it's own user and own DB, and that user only gets sufficient privileges to manipulate the blog DB.

5) Write a shell script to do an automatic "upgrade all blogs to latest version of WP" since you'll be doing this a lot. If this were totally risk- free I'd put it on an hourly cron job.

<comment> ryan-allen I think point #1 is very important. I do this also:

* All code is owned by a 'code' user, and all files by default are user and group read/write. * The www-data user (who runs the web server) can only write to wp-content/uploads and where ever else the plugins are required to write to * The places www-data can write to have .htaccess files that turn off execution of PHP scripts (so the app itself cannot upload code and run it, if there is a zero day exploit like the timthumb.php).

What this causes though is a bunch of plugins to complain they cannot work due to not enough access, and WP upgrades can't be done through the wp-admin, this tends to upset end users a bit, so I agree #5 is important.

I have a deploy user who is in the code group so I can manage our automated deploys.

Also, by default wp-admin doesn't have any login restrictions so people can brute force it (I think). It's really important to install something like the wp-recapcha plugin so people can't brute force your logins. This is especially important as end users who are creating accounts often choose poor passwords.

I like #2, I don't do this, though I think I'm going to have to!

Generally it comes down to typical system admin best practices. You're running a codebase you didn't write yourself, you have no idea what it's going to do.

EDIT: These permission things are not typically doable if you're running your blog on shared hosting. So shared hosting is generally not particulary safe. I'd recommend anyone without a dedicated sysadmin to use something like <http://page.ly/>, which is managed by smart guys.

<comment><USER3> Stay away from Page.ly unless you like unannounced maintenance during business hours. I've also seen frequent outages they blame on Firehost networking and SAN.

<comment> ryan-allen Ah, well that's unfortunate. Have you got any other managed providers you can recommend?

<comment><USER3> My client decided to move to a VPS, but <http://wpengine.com/> looked promising.

</comment></comment></comment></comment></comment><comment><USER4> When I was doing client work, I would sort out a hacked Wordpress blog at least once a fortnight.

The only thing the users had apparently done wrong was not updated their installation. It was because of this that I started to move clients away from Wordpress. The trouble is that a lot of non-tech clients will not touch their admin panel very often and I have found the older generation don't like the word update. It suggests to them "may break or change theme so I can't find stuff."

I find the idea that - probably - the worlds most popular website platform can frequently ship with security issues demoralising. If you look at all the people involved with Wordpress you would have thought that by now they would have squeezed the issues out of WP and learnt enough to ensure they stay squashed in the future. Maybe I expect a bit too much here.

One of the big selling points of Wordpress is that there is a plugin for anything. However.. how many of these have security issues? It is even worse as non-tech users just assume that as the plugin can be accessed from the their admin panel it must be safe.

It is for these reasons that I do not use Wordpress at all. I think it is an alright platform, not keen on the theming aspect but it is OK. However its incredible popularity makes it the target of hackers and spammers. When working with non-tech clients who may or may not update their website, Wordpress is liability more than anything else.

<comment><USER5>
        One of the big selling points of Wordpress is
        that there is a plugin for anything

Most plugins and themes available are shitty.

I just started a new blog and had to decide: Blogger, Wordpress or Jekyll. I chose Jekyll and I have all the functionality I could need from Wordpress plugins:

The URLs are SEO-friendly by default, Disqus is great for comments, Google Analytics, FeedBurner for RSS stats + email newsletter and I can change the design in any way I want, without limits and without having to spend quality time with Wordpress' codebase.

It's also super fast too, since the content is static and the hosting is free on GitHub Pages. I don't need to care about backing up my articles either, since I always have a full local copy and GitHub is GitHub. I also don't need to care about upgrades.

<comment><USER6> Jekyll is great, but far from accessible for novice or even intermediate users.

Out of curiosity, link to your new blog?

</comment></comment></comment><comment><USER7> The interesting thing about WordPress is that it's one of the few cases where an alternative is vastly more secure while providing similar functionality - namely, any blog software that exports a set of static HTML files.

It's not perfect, since any of the listed breakin methods not directly related to a WordPress vulnerability is still available, and you have to make sure your control panel is actually secured the way you think it is, and if you use a service like Disqus for comments you theoretically gain nothing, since you're just outsourcing your security to someone else's webapp running arbitrary JavaScript in your domain...

But in practice, using static publishing is an _excellent_ compromise: PHP webapps are probably one of the least secure categories of software in existence, especially compared to relatively secure OS services; it's usually easier to update the OS, and all updates come from one place; and the same solution also happens to be vastly better performing if your site is under load.

<comment><USER8> I don't think static site generators are suitable for most WordPress uses - the key feature is to allow non-technical users to easily add content and publish immediately which WP does very well. Teaching them Markdown (or similar) and some CLI is not an option.

</comment></comment><comment><USER9> As a WordPress fanatic, I just want to point out that - other than keeping your WordPress Core, Themes and Plugins up to date (which should be obvious by now) - none of the vectors described are actually WordPress related.

If you have an insecure password, are running exploitable services/software on your server or your host's support is social engineer-able then you're screwed regardless of what you're running.

So can we end this meme, which this post is somewhat fueling, that WordPress is insecure?

<comment><USER2> There are particular ways in which Wordpress exacerbates this situation. For example, let's say one of your $10 an hour freelance authors uses an insecure password. What happens? Content defacement? Much of the time, the answer is _arbitrary code execution_ , because Wordpress has had _copious_ local-to- Wordpress privilege escalation vulnerabilities and, once they're admin, they can upload arbitrary PHP to your web server straight through the site.

Or let's say you allow anybody to sign up and comment on your blog. What's the downside risk, pesky comments? Nope, _arbitrary code execution_ , because anonymous one-off commenters get an admin area and it has had _copious_ local privilege vulnerabilities to turn them into real admins and then it is off to the races.

Then there is the XMLRPC library. Wordpress ships with it on by default. What's the risk of leaving it on? Say it with me, _arbitrary code execution_ , because...

And PHP encourages you to do includes, including (when an edge case gets missed) inclusions of remote files (!), which puts you at risk of...

I mean, I love Wordpress. Never point it at someone you don't want to kill, always treat it like it is loaded, and keep it in a locked case, and you're mostly pretty much safe.

<comment><USER9> I'm not aware of any unpatched vectors to perform arbitrary code execution in WordPress Core. Sure perhaps via a dodgy plugin (and then ok you could run a SQL query directly to change the privilege level of a given user).

XMLRPC ships in an 'off' state in WordPress, and has done for some time now.

You need a copy of Dr dotBen's _"How I learned to stop worrying and love the WordPress"_ , published by WP Engine! ;)

</comment></comment></comment><comment><USER10> Topically enough, I just found out[1] the importance of the themes point. A wordpress theme that had been installed on my wife's blog (not even the one she was actually using) included a file for thumbnail generation[2] which had a security hole found in it in August.

I just noticed that my second link goes to the same website as this article. :)

[1]: <http://davidlynch.org/blog/2011/12/vulnerable/>

[2]: [http://markmaunder.com/2011/08/01/zero-day-vulnerability- in-...](http://markmaunder.com/2011/08/01/zero-day-vulnerability-in-many- wordpress-themes/)

<comment><USER11> TimThumb is widely used not only in WP. Plugins are way more dangerous, themes don't usually include external libraries or complex code/services.

</comment></comment><comment><USER11> 3, 4, 6 and 7 amount to "I'll guess/brute-force your passwords".

1, 2 and 5 amount to "I'll find a (generic) security issue in your software".

So it boils down to

\- keep your software up to date \- use safe passwords</comment>


Show HN: Salary comparison calculator for hundreds of cities worldwide - <AUTHOR> https://teleport.org/salaries/ <comment><USER2> Wolfram Alpha will calculate this out for a more cities, though it isn't as pretty

[http://www.wolframalpha.com/input/?i=relocating+Omaha,+NE+to...](http://www.wolframalpha.com/input/?i=relocating+Omaha,+NE+to+Geneva+$80,000)

<comment><USER3> Doing a relocation from Manchester in UK to Geneva, Wolfram Alpha says the equivalent salary should be lower in Geneva. That's because they substitute London data for Manchester and then calculate based on that. They only seem to have good coverage for US cities. The rest come from a UN cost of living report from 2014.

<comment><USER2> That could definitely be possible. Teleport, however, is missing capitals of US states

</comment></comment></comment><comment><USER4> I've seen a few sites that do this kind of thing, but rarely with such elegance. Good job!

</comment><comment><USER5> Good looking! Potentially very useful . . . And an acquisition target for LinkedIn?</comment>


The Stanford 3D Scanning Repository - <AUTHOR> http://graphics.stanford.edu/data/3Dscanrep/

<comment><USER2> If you enjoy this, you might also enjoy the Smithsonian's 3D image library, with models you can download and print:

[http://3d.si.edu/](http://3d.si.edu/)

</comment><comment><AUTHOR> I'm curious if 3D scanners are cheaper/portable/widely available now ?

<comment><USER3> The cheapest way is possibly to take a lot of photos and create a 3D model using this program: [http://ccwu.me/vsfm/](http://ccwu.me/vsfm/)

It requires a lot of RAM though (on the order of 16 GB for most scenes).

<comment><USER4> I've used a program called PhotoModeler [1] at work, which does the same thing.

You use a consumer camera + a calibration chart to get the specifics about the lens setup on the camera, and then just take a whole heap of photos around the object in question. You add the photos to the program and it asks you to identify common points. This puts them all in 3d perspective and you set a dimension on a known length to scale it.

For mapping large-scale machinery (train stuff) I've managed to get a ~5mm accuracy out of it. That's great when you don't have drawings.

[1]: [http://www.photomodeler.com/index.html](http://www.photomodeler.com/index.html)

<comment><USER5> That would be really cool to play around with. Do you know if it does interiors as well? It doesn't look like it from the website.

</comment></comment></comment></comment><comment><USER6> They have a very high resolution model of Michaelangelo's "David", with over a billion polygons, but it takes special permission to get the data. They don't want people stamping out copies.

<comment><USER7> Why would they care if you made an exact copy of Michaelangelo's David? I imagine that if I had the actual Declaration of Independence on display, I'd be flocked with visitors, but if I had an exact copy, indistinguishable to the human eye, no one would bother to look at it.

Maybe that's their reasoning, but if so it seems a bit overblown.

<comment><USER6> What "original" means in the art world is amusing. It's all about monetization.[1]

Cranking out a copy of Michaelangelo's David as a bronze would be a nice project. Hypermill/Daishin should take that on. Each year they do some insanely elaborate piece of art in metal as a CNC machining demo.[2]

[1] [http://www.artnews.com/2013/06/05/the-degas- debate/](http://www.artnews.com/2013/06/05/the-degas-debate/) [2] [https://www.youtube.com/watch?v=RnIvhlKT7SY](https://www.youtube.com/watch?v=RnIvhlKT7SY)

</comment></comment></comment><comment><USER8> A bit of context: these models are used in countless of computer graphics publications. Try a image search for "Stanford Bunny" for example.</comment>


Ask HN: What are the best Hacker Houses in SF? - <AUTHOR>

<comment><USER2> A few I know of:

Rise: <http://www.risesf.com/>

Chez JJ: <http://chezjj.com/>

The Glint: <http://theglint.com/>

Rainbow Mansion: <http://www.rainbowmansion.com/>

</comment><comment><USER3> What is a Hacker House?</comment>


The Pentagon Is Building a Team of Tech-Savvy Soldiers - <AUTHOR> https://www.wired.com/story/pentagon-dream-team-tech-savvy-soldiers/ <comment><USER2> Never understood the underpaying of highly qualified people in the govt. Making a sacrifice for your country in a high powered / representative position is one thing, but the rank and file? Billions are spent on defense contracts and old software, but when bringing on teams of people to revamp the system, they want these people to take more than a 50% pay cut. D.C. is an expensive place to live as well. If you think something is crucial for the country to advance and survive, don't be cheap about it.

<comment><USER3> Eh, look at it as a filter for true believers. Mercenaries are dangerous, because they have a price.

<comment><USER4> Perhaps a better analogy: let's say you're hiring people with the offer that you'll pay them $2M the first year, then nothing for 20 years. The danger is that the person will quit. So it is more conservative to offer a deal where you pay them nothing for 20 years, then $2M. Then you're pretty sure they'll stay, especially if they're 15 years in.

I think that's probably the best way to understand the salary/pension trade- off. The public sector is geared to be quite risk averse in investments, so it offers back-weighted comp to try to be frugal on training and provide continuity.

There's also basically no other employer that can credibly offer this kind of comp, so the public sector, by offering it, can compete quite well for talent in the space of those interested in that configuration. It's not the only way to run things, but it makes some sense.

<comment><USER5> Do civilian government employees even get a pension plan anymore? I got an offer a few years back from a three letter agency in DC and I'm pretty sure they just had a 401k.

<comment><USER6> I believe so. Federal employees don't pay social security so their only fixed income will come from their government pension.

<comment><USER7> Yes they do. In the old system they didn't, but everyone since ~1984 does (and most of the old-system folks are retired or near retirement now.

[https://www.washingtonpost.com/blogs/federal- eye/post/federa...](https://www.washingtonpost.com/blogs/federal- eye/post/federal-retirement-contributions-questions-and- answers/2012/02/23/gIQArFxsVR_blog.html?noredirect=on&utm_term=.ab44e19f1dda)

<comment><USER6> Right I was talking to a retired, lifelong federal employee who mentioned he didn't pay SS. Since '84 was over 30 years ago I expect the number to flip for those on the new pension scheme, soon.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> As someone who works for the Defense Department I found this article totally unsurprising. This sort of story is common. The question people should be asking is why does it take a 3-star general's blessing in order to get a team functioning computers that are usable for something besides Email and Microsoft Office.

Another major obstacle that isn't touched on in this article is buying things. Typical timeline for purchasing anything through the normal mechanisms is minimum 4 months and 6-9 months isn't uncommon many years. Doesn't really matter how much it costs. So any group that wants to get things done on a reasonable timeline ends up putting a substantial portion of their budget on a contract who's sole purpose is to be a purchasing vehicle that circumvents the usual buying process.

<comment><USER9> I think this article does a wonderful job explaining why the military is built the way it is:

[https://www.joelonsoftware.com/2006/08/08/the-command-and- co...](https://www.joelonsoftware.com/2006/08/08/the-command-and-control- management-method/)

 _If Command and Control is such a bad way to run a team, why does the military use it?_

 _This was explained to me in NCO school. I was in the Israeli paratroopers in 1986. Probably the worst paratrooper they ever had, now that I think back._

 _There are several standing orders for soldiers. Number one: if you are in a mine field, freeze. Makes sense, right? It was drilled into you repeatedly during basic training. Every once in a while the instructor would shout out "Mine!" and everybody had to freeze just so you would get in the habit._

 _Standing order number two: when attacked, run towards your attackers while shooting. The shooting makes them take cover so they can't fire at you. Running towards them causes you to get closer to them, which makes it easier to aim at them, which makes it easier to kill them. This standing order makes a lot of sense, too._

 _OK, now for the Interview Question. What do you do if you're in a minefield, and people start shooting at you?_

 _This is not such a hypothetical situation; it's a really annoying way to get caught in an ambush._

 _The correct answer, it turns out, is that you ignore the minefield, and run towards the attackers while shooting._

 _The rationale behind this is that if you freeze, they'll pick you off one at a time until you're all dead, but if you charge, only some of you will die by running over mines, so for the greater good, that's what you have to do._

 _The trouble is that no rational soldier would charge under such circumstances. Each individual soldier has an enormous incentive to cheat: freeze in place and let the other, more macho soldiers do the charging. It's sort of like a Prisoners' Dilemma._

 _In life or death situations, the military needs to make sure that they can shout orders and soldiers will obey them even if the orders are suicidal. That means soldiers need to be programmed to be obedient in a way which is not really all that important for, say, a software company._

You need a 3 star general's blessing to get computers because the whole military is built around authoritarianism and slavish obedience. It is built on those things because, in war, they are necessary. This has an unfortunate knock-on effect of making every decision take way too long and severely limits the autonomy of everyone in the chain of command, in often ridiculous ways. But if it comes down to being better at developing new tech, and winning a war, the army clearly has priority on the later rather than the former.

<comment><USER10> > the whole military is built around authoritarianism and slavish obedience

This is a huge misconception people have about the military. In fact the core philosophy of command in western militaries is one of enabling people to make their own independent decisions. The military wants nothing less than non- thinking obedient slaves because they know that's how wars are lost.

<comment><USER9> >This is a huge misconception people have about the military.

I just gave you a first hand account of it, and a concrete illustration of it is the current topic of discussion. It's difficult to call what is being clearly demonstrated through multiple channels "a huge misconception". Especially considering this is an Israeli NCO saying this, when the Israelis have a reputation for actually being one of the _most_ individualistic armies in the West.

>In fact the core philosophy of command in western militaries is one of enabling people to make their own independent decisions.

Compared to the earlier forms of warfare, this is absolutely true. A modern NCO has a level of independent from central command that would have utterly flabbergasted officers even a hundred years ago. Heck, Roman centurions were afforded less autonomy to make decisions than we give modernly to srgts.

But in absolute terms, compared to the civilian sector? The military is still an extremely authoritarian place that is utterly slavish to obedience. Because it has to be, men still need to obey their superiors when told to do things they might not want to do. Yes lower and lower ranks are given the freedom to set their own objectives and adapt on the fly to changing circumstances, and compared to the rest of military history that is quite something, but they still are not remotely individualistic or all that autonomous compared to non- military contexts.

I mean why do you suppose we retain the officer/enlisted divide, and still demand both sides keep a cordial but distant relationship? It's because we still need the authoritarian stuff as a backbone, so when an officer says "Jump" an enlisted man jumps rather than trying to argue. The Soviets found this out the hard way after the 1917 revolution, when they tried abolishing the officer corps. as a vestige of elitist authoritarianism and it backfired so horrifically they had to gobble up defecting white army officers just to survive.

<comment><USER10> > I just gave you a first hand account of it

From someone who describes themselves as being very bad at the job! Maybe this was what he was getting wrong?

> when an officer says "Jump" an enlisted man jumps rather than trying to > argue

This is what people get wrong. When an officer says 'jump' the enlisted man actually responds 'tell me what you want me to achieve, sir, then it's my job to decide how I want to make it happen whether that's jumping or something else'.

A junior non-commissioned officer will tell you respectfully but firmly to back well off if you start telling them how to complete a task.

<comment><USER9> >From someone who describes themselves as being very bad at the job! Maybe this was what he was getting wrong?

Perhaps. He was really awful at the whole "military discipline" part of being in the military. Now he's a software developer, so that all worked out for him.

>This is what people get wrong. When an officer says 'jump' the enlisted man actually responds 'tell me what you want me to achieve, sir, then it's my job to decide how I want to make it happen whether that's jumping or something else'.

I personally only have 2nd hand accounts of the interaction from the officer's side, so I may well be getting it wrong.

My physics classes had a few navy guys in them, who were trying to get...something or other, they needed a degree in a hard science to get a promotion. I don't really know what exactly. Anyway, being really interested in ships I talked their ear off about everything whenever they'd let me. And the topic of ordering men around was always treated with a certain...presumption that every word they said would be instantly obeyed without question. Stand here and look over there at the horizon until I say otherwise sailor. Scrape this wall with this scrapper sailor, and then paint it over. Carry this crate below decks, no stopping sailor. Inventory the armory sailor, mop the deck sailor, etc. etc.

</comment></comment></comment></comment></comment></comment><comment><USER11> So I have a hard time believing the 100k price tag. They are not including everything here, which is typical. The government usually doesn't consider overhead costs because to the agency they are fixed. That's a multiple of 2-3. They're certainly depending on some existing developed technology which doesn't sound COTS to me, and I have no idea how much to value that at. Maybe another 100-500k unless it comes from a major prime in which case... 1M or more.

The biggest thing increasing development costs for these kinds of projects is the fact that it is SO hard for development teams to get real understanding and feedback from the actual guys using the equipment. It takes a near act of God in many cases to get as close as they did in this story. That's what gives you an actual usable product at the end of the R&D effort and what saves the most money.

Also I'd work for this team in a heartbeat. Sounds like fun even if I don't believe all their numbers.

<comment><USER12> The $100K is probably just the cost of materials.

</comment></comment><comment><USER13> I really enjoyed this article. The DDS is literally doing the same kind of things that the USDS is doing, but for military applications. Given the fact that the largest portion of our taxes goes towards defense spending, initiatives like create opportunities to allocate resources more efficiently, iterate with agility, and save a ton of money.

When you look at DoD contractors, there is obviously a motivation on their end to have larger contracts with inflated budgets and prolonged timelines - they're businesses. On the flip side, a government agency has none of those motivations - they just want to save lives as quickly and affordably as possible.

I am curious to see if these "lean" organizations will pop up in other parts of the federal/state/local governments. There are so many areas where better UX, logical efficiency, or inner-department communication could make people's lives easier or even save them:

\- In PA you need to sign up for a tax ID separately from filing articles of incorporation. Why can't the Department of State and Department of revenue's system sync up to create a tax ID at the time of incorporation?

\- Philadelphia's transit authority SEPTA has been rolling out a cashless fare system using RFID/NFC. It was supposed to be released in 2013 and still isn't complete. It cost $300 Million for Xerox to build which was twice as much as the initial budget. The kicker is their website used isn't even functional on mobile - it _literally_ uses nested tables for layout. A more efficient way to do this would be to use your phone for everything (using built in NFC) and an app to manage your fares.

<comment><USER14> The largest portion of our taxes does not go to defense spending. It goes to entitlements.

<comment><USER3> Absolutely. 62% of the budget goes to social security, Medicare, and Medicaid. The rest is discretionary spending and a bit more than half of _that_ goes to "defense".

Source: [https://www.thebalance.com/u-s-federal-budget- breakdown-3305...](https://www.thebalance.com/u-s-federal-budget- breakdown-3305789)

<comment><USER15> That's just the federal budget. US taxes & spending include local + state + federal.

Leaving off the other $3.x trillion in taxation & spending, nearly an entire other federal government, paints a very incomplete picture.

The military is 10% of all government spending in the US. Total government spending is around $7.2 trillion for 2018.

</comment></comment></comment></comment><comment><USER16> Love the lead picture -- because, you know, you're obviously not in tech if you're not wearing a t-shirt, hoodie and jeans ensemble in an environment where they would otherwise be out of place.

</comment><comment><USER17> Great story that should trigger some thought in valley tech people.

There are smart people all over the place who are difficult to reach.

</comment><comment><USER18> 3 orders of magnitude difference in cost... I think we're having the wrong conversations about taxes in the US.

</comment><comment><USER19> How to apply?

<comment><USER20> they require a clearance which can take 6 months to a year to complete. most the work is in DC area so being nearby helps.

</comment></comment><comment><USER21> Nice advertisement for the Pentagon, I bet they're looking left and right for people with the right qualifications.

</comment><comment><USER22> > "The Army didn't really know what to do with me," he says. "So they sent me > to Ranger School. I learned how to jump out of planes and carry rifles and > stuff like that."

 _GROAN_ What branch did you go, fuckwit? That's what the Army wanted to do with you.

<comment><USER23> Please don't do this here.</comment></comment>


Cinder: open-source creative C++ - <AUTHOR> http://libcinder.org/ <comment><USER2> There's also openFrameworks: <http://www.openframeworks.cc>

Some major differences:

\- Cinder is more "C++y", i.e. more use of templates, boost, etc... openFrameworks opts for more "C with classes" approach, which makes it resemble processing a bit more.

\- Cinder uses system libs, openFrameworks tends to use third party libs that it wraps into its own API. This puts Cinder closer to the OS on windows/mac, but means that oF has linux support.

From personal view, it seems like more agencies use Cinder while more independant devs use openframeworks, but that really doesn't say anything of the frameworks themselves, more the communities.

<comment><USER3> I was really excited, then I noticed there's no Linux support.

</comment></comment><comment><USER4> So "creative coding" is programming graphics, music, etc., right? Is it just me or is that something of an inappropriate term? To me it brings to mind, you know, creative code, clever programming tricks, perl poetry, and the like. Shouldn't we call this multi-media programming or something more specific?

I've never heard this usage before. Is it common?

<comment><USER2> Very common in the digital arts communities. Basically, it's a signifier of "framework that gets you to pretty/shiny/beepy/pokey the quickest". So, you usually have a VERY stripped down interface of setup/update/render functions that allow you to do an interactive task quickly.

If that seems limiting, that's because it is. The thing to realize is that you're /supposed/ to be limited in the outcome of your program. Usually in creative coding frameworks, you're just trying to make a program that does a single thing, but needs graphics/sound/interactivity. Limiting the interface down to what you need means you can program with the end interactive situation in mind.

This tends to mean creative frameworks eschew quite a bit of software engineering practices in deference to ease/speed, which can cause software developers coming into these frameworks to think they're, well, crap. But, the single use practicality does make it nice versus trying to implement this stuff in something like a full on game engine.

<comment><USER5> I got started with programming back in the 1970s doing "creative coding", although we didn't call it that. It is a very different environment with very different set of standards. I did all sorts of multi-media work and even got into motion picture effects in the late '80s, early '90s.

One thing about these types of projects, mistakes, errors, and even plain old bad practices, things that are anathema in most coding domains, often can produce not only useful, but spectacular results. Especially in things like particle systems; but I've seen really cool moves generated by errors in easing functions in 'tweening code as well.

Sometimes when I'm bored by the results of a carefully planned piece, I've been known to purposefully try and break things a bit.

Edit: These days I play around with Processing quite a bit. I took a look at Cinder a year or so ago, and while it looked cool, it's a _lot_ more work to mess around with. I'd have to get a lot more serious to play around with it. But if I came up with something really cool with Processing, I might very well want to port or rework it with Cinder for the obvious speed and interactivity performance.

</comment></comment></comment><comment><USER6> Having never used Cinder before, why would someone choose it over processing?

<comment><USER7> Amazing demo form one of Cinder's co-authors: <http://roberthodgin.com/cymatic-ferrofluid/>

He says that he started with Processing, so I'm guessing that at some point he felt limited by the performance he could get out of it.

<comment><USER8> Wow! That is some beautiful artwork!

</comment></comment></comment><comment><USER9> not for linux. ;_____;

</comment><comment><USER10> Cinder looks nice but the last time I checked it didn't support OpenGL ES 2.0 shaders. Has that changed?

</comment><comment><USER11> I tried it a few years ago, but I had a hard time getting into it. (Back then, ) its documentation failed past the obvious first examples, which meant that the authors basically assumed you already knew everything about how to write realtime 3d graphics on modern hardware and recent OpenGL versions.

I'd assume that if I already knew all of that, I would've probably made some own code for it before, so wouldn't need Cinder for anything. Compared to Processing, Cinder's entry-barrier is orders of magnitude higher.

Or maybe I'm just too stupid. :-)

</comment><comment><USER12> A word about the website, especially the Hello, Cinder tutorial: Please make the links more visible, thanks :)

</comment><comment><USER13> I love Cinder!</comment>


Rancher's k3os purpose-built to simplify K8s ops in low-resource computing - <AUTHOR> https://k3os.io/ <comment><USER2> I've written up about k3s [https://blog.alexellis.io/tag/k3s](https://blog.alexellis.io/tag/k3s) and am looking forward to trying out k3os too. Very cool that it also caters to ARM!</comment>


Ask HN: How did you find customers for customer development? - <AUTHOR> What is your industry?
What were your primary ways of uncovering potential customers to talk and work through on customer development?
Thanks <comment><USER2> I've found googling, "#{what my customers call themselves to each other} forum", will find online forums where my target customers hangout.

'real estate investor forum', 'developers with depression forum' both find great forums of real estate investors, and depressed engineers.

</comment><comment><USER3> I found where they hang out in person via meetup and industry associations. I've also looked on Reddit.

I think for the first 100 contacts finding them in person is critical.

<comment><AUTHOR> You talked to 100+ for customer discovery?</comment></comment>


Ask HN: How are API developers building beautiful documentation? - <AUTHOR> I'm currently trying to build nice, clean and engaging API documentation for a service I'm working on but have reached a bit of an impasse.  As a backend/architect guy I'm looking at things like https://parse.com/docs/rest https://gocardless.com/docs/api_guide and http://documentcloud.github.com/backbone (for example) and they're beautiful!
Is anyone using a tool or CMS to generate these types of API docs (single page w/scrollspy) or are they built in-house with a designers touch?
Would rather be focusing on content over rolling my own, so any help appreciated! <comment><USER2> Stripe has great docs, which are hand-edited results from Docco.js. <https://stripe.com/docs/api>

Mashery has iodocs <https://github.com/mashery/iodocs>

One thing I particularly like about Backbone's docs is that it has some executable code, which is pretty swank. Similar, but not API docs, but Marijn Haverbeke's book Eloquent Javascript has a built in console that lets you load and test snippets from the book. Cloud9 IDE built with node.js I think also allows embeddable executable snippets in the browser. It'd be cool to see more interactive api docs using similar techniques.

</comment><comment><USER3> For Javascript I use JSDoc3 with a custom template which results in documentation such as this: <http://datatables.net/docs/DataTables/1.9.0/> . Not sure how beautiful one could call it, but I get what I want out of it!

<comment><USER4> Is your template open source?

</comment></comment><comment><USER5> <https://github.com/jeromegn/DocumentUp>

<https://github.com/github/developer.github.com></comment>


The psychiatric drug crisis - <AUTHOR> http://www.newyorker.com/online/blogs/elements/2013/09/psychiatry-prozac-ssri-mental-health-theory-discredited.html <comment><USER3> Good riddance. Psychiatry by and large is a sham field. Physicians who practice it love seeing themselves as artists who are experts in identifying the subtleties of human behavior. That's their way of saying there's very little underlying science guiding their practice.

Many of the diagnoses given are pulled out of thin air and made to justify a patient's admission, or to appease a patient's desire to feel as if they have a treatable illness. I would ask psychiatrists I trained with to explain why a drug worked or why a disease developed. They would do nothing more than give me the same surface-level information we all know: SSRIs block serotonin reuptake, leading to more serotonin in the synaptic cleft that would then cause increased stimulation, and voila, you're not depressed. This is information anyone can attain with a google search. The majority of their knowledge dealt with pharmacological dynamics.

I sat in on a psychiatry conference one afternoon where the docs discussed the treatment of several patients. Never was a scientific article or concept uttered. It was all "well, let's try him on seroquel and olanzapine, let's also throw Paxil in there." It was evident that their treatment protocol was largely one of extremely unsupported trial-and-error based on very, very unique experiences, anecdotes, and preferences each psychiatrist had.

Now, I don't want to discredit the entire field. I do know friends and family who have benefited from psychiatric medications, although that could entirely be due to placebo effect. What needs to happen first is that we need to attain a much deeper understanding of how the brain works on the low and high levels, mechanically and abstractly. Mechanically so that we may develop effective meds, abstractly so that we may learn how to manipulate cognitive processes, like with what we see with CBT, which has worked wonders for many with depression -- no medication involved.

tl;dr: Psychiatry is a very, very loose and abstract field. You can't run any diagnostic tests on patients. It's mostly a field of educated guessing and confirmation bias. We need better mechanical and abstract understanding of the mind before we douse it in chemicals.

<comment><USER4> As a young engineer-type with no exposure to the psych field, I had about the same opinion when I was in my early 20's.

However, a few decades of real life later I've seen first-hand, successes and turnarounds for people who either found themselves in bad situations or were just plain genetically vulnerable. In fact, I'll go as far as saying that counseling or therapy are nothing compared to the difference that the right medication(s) can make in a life. Finding it _is_ hit-or-miss, and there are still people who ultimately can't be helped but there are countless success stories - they just aren't worth reporting, like every time antibiotics work as expected.

<comment><USER5> As a programmer and former EEG tech, all I can do is nod quietly. They could be way more scientific about their medication selection if they wanted to be [1][2] but most psychiatrists are overconfident in their own judgement.

[1] [http://www.ncneurocenter.com/eeg/eeg_reference.html](http://www.ncneurocenter.com/eeg/eeg_reference.html)

[2] [http://en.wikipedia.org/wiki/Quantitative_electroencephalogr...](http://en.wikipedia.org/wiki/Quantitative_electroencephalography)

<comment><USER6> There's a difference between "how about we approach it more appropriately" and kyro's "we shouldn't use this at all until we have a near-complete understanding".

<comment><USER3> I never advocated discontinuing the use of medications. In fact, I acknowledged their efficacy. I'm all for treating the people that cannot function otherwise -- they may have no other choice. I think for millions of others, there are other choices that are not being adequately pursued or encouraged.

</comment></comment></comment></comment></comment><comment><USER7> Fun Fact: Selective Serotonin Reuptake Inhibitors, the class of drugs used to treat depression and anxiety disorders by increasing the availability of serotonin, have a mirror opposite: Tianeptine ([http://en.wikipedia.org/wiki/Tianeptine](http://en.wikipedia.org/wiki/Tianeptine)), which acts as a Selective Serotonin Reuptake Enhancer.

Incredibly, this drug has _also been effective at treating depression_. That's right: two classes of drugs with polar opposite first-order effects are used to treat the same disorder, and both of them apparently work.

<comment><USER8> Both are effective on the same people? Otherwise, it kind of makes sense. If depression is just an imbalance, it may be that there is either too much serotonin or too little.

<comment><USER9> unfortunately, we don't have good data on which drugs are effective on the same people versus on different people. The clinical trials just aren't set up that way, and there hasn't been a concerted effort to gather that information from the general population.

</comment></comment></comment><comment><USER10> The book, "Anatomy of an Epidemic", provides a really comprehensive look at how we ended up in this situation. Some of the keys here:

1) A desire to bring a level of "science" to a part of our physiology we don't understand. The thinking here is that while we do not understand the etiology of depression, we can at minimum begin to use blunt tools to solve problems. The issue as anyone who has studied complex systems understands, is that the feedback loops are so dense, there is no method to understand what is happening.

2) Financialization of treatment – drugs make more money than therapy and other methods. Or to use an HN phrase, drugs are more easily scaled to the population than other methods. The incentives throughout the entire system push people this direction, regardless of the underlying research.

3) Treatment doesn't happen instantly in any case. The issue with much of the research today is that we take a very limited time window to evaluate the efficacy of different treatments. If, instead, we looked at treatment over the life course, the results are often radically different.

This is where startups like Seven Cups of Tea will hopefully play the world. This mental health crisis offers a huge opportunity for disruption and creativity. As a quote in the Stanford alumni magazine said this month: "One hundred years from now, people will look back at the age of giving SSRIs and they will have a reputation that's akin to bloodletting."[1]

[1] [http://alumni.stanford.edu/get/page/magazine/article/?articl...](http://alumni.stanford.edu/get/page/magazine/article/?article_id=64350)

<comment><USER11> >A desire to bring a level of "science" to a part of our physiology we don't understand.

 _Confer:_

[http://thelastpsychiatrist.com/2006/11/massacre_of_the_unico...](http://thelastpsychiatrist.com/2006/11/massacre_of_the_unicorns.html)

[http://thelastpsychiatrist.com/2010/01/the_massacre_of_the_u...](http://thelastpsychiatrist.com/2010/01/the_massacre_of_the_unicorns_i.html)

</comment></comment><comment><USER12> Maybe humans are just...unhappy? By that I mean as a race, we are inherently unstable (see: entire human history) and for a long time we kept it together by forming very tight family and community bonds. We had central, realistic, and tangible goals. We had an invisible friend (religion). As science has systematically stripped all that away (for the better mind you...), nothing has filled those needs. We don't need more facebook and texting, we need human contact.

HAHAHA! Just kidding! Did you see the latest iPhone! It's got moar processors!

<comment> guard-of-terra [http://blog.wilshipley.com/2005/05/on-being- crazy.html](http://blog.wilshipley.com/2005/05/on-being-crazy.html) is a very insightful read on that subject, from a successful but unstable person.

 _Is mankind only so smart because if we get any smarter, we cease to function correctly? Maybe it 's just not evolutionarily advantageous to be smarter than we are; it makes us mopey, and we end up cutting our ears off when we're trying to woo girls, which rarely results in offspring._

<comment><USER13> Disproof : Richard Feynman

<comment><USER14> How many offspring did Feynman have?

<comment><USER13> "Feynman would marry twice more and have two children with his third wife." [http://www-history.mcs.st-and.ac.uk/Biographies/Feynman.html](http://www- history.mcs.st-and.ac.uk/Biographies/Feynman.html)

Anyway, my point is, being smarter is not an excuse for "cutting one's ears off when trying to woo girls" (re:my parent comment) or for otherwise being socially dysfunctional.

</comment></comment></comment></comment></comment><comment><USER15> The article has an interesting argument structure. First it undermines the science behind psychiatric drugs by referring to their discovery as serendipitous. Then it proceeds to point out that there is no good theoretical understanding for how the drugs work, even if there is understanding in what neurotransmitter levels are effective. Then the author proceeds to drop the "not better than placebo" results.

Without knowing any psychiatric science, this narrative nevertheless seems suspicious. First of all, it is entirely irrelevant whether a discovery was made serendipitously or as a result of incremental science, as long as the effect is clear enough to be repeatedly found. This is not true in well understood fields, such as physics, where the theories are mostly not changed every now and then, but in complex fields, such as medicine and social sciences, the fact that something matches pre-existing theory is no evidence per se. The problem is "bumpy" enough that any theory is likely to flatten every bump that is not directly observed, even if that bump would be very useful in practice. This leads to most discoveries of any value being serendipitous. It also leads to incremental research failing to advance rapidly most of the time.

So the lack of theory and serendipitous discovery are not problems in themselves. The finding that psychiatric drugs would not be better than placebos is indeed a problem. It does raise the question, of how the serendipitous discovery was ever made. Did it arise out of spurious correlations, so that when the drug was first discovered there happened to be a big incidental recovery in most treated patients? Then in later retrials people managed to trigger a sufficient placebo effect to get the whole thing going. It does seem a little unlikely, but one would have to examine how the first trials were performed.

</comment><comment><USER16> The discoveries of antidepressants and anxiolytics weren't accidental: testing something and seeing what it does, then finding a purpose for it is not accidental, it's basic science. It's how most chemicals were discovered.

And there's no doubt these medications work in a lot of people (but not all), even though we don't understand how they actually work. Our ancestors did not know what fire was or how it worked, but they did use it because it was useful, the same applies here.

Further development is going to be difficult without a good understanding of how the brain works, though - pharma companies need to focus on finding better ways to probe deeper and more accurately into the brain (and create good simulators for that later on) before developing new drugs.

</comment><comment><USER17> Obscure psychiatric drugs are also ridiculously expensive sometimes. A friend of mine switched from a brand name anti-psychotic to a generic version. He went from paying over $1200 a month to $22 for 30 pills, for something as important as preventing his psychotic episodes.

<comment><USER18> That's just obscene! All that markup over just the label.

I understand that it takes R&D to develop new drugs, but the amount of profit sought by drug companies is stomach churning.

<comment><USER19> >amount of profit sought by drug companies is stomach churning

What's the right amount of profit a company should seek? For reference, following are the latest reported profit margins of several companies:

Eli Lilly: 20.34% AstraZeneca: 13.33% Novartis: 17.33%

Apple: 19.53% Google: 18.11% Microsoft: 24.95%

It's not at all clear to me that drug companies are somehow seeking more profits than other companies (or that they would generally be able to attain them in any case).

<comment><USER20> It's the fact that pharmaceutical companies are involved in the sphere of public health that makes people uneasy about excessive profits, whatever "excessive" means.

It's not only profits: lifestyle drugs, like statins and medication for ED are obviously a source of easy profit, meanwhile research into antibiotics is falling by the wayside.

The fact that the existing antibiotics are becoming useless and there is nothing to replace them is going to be a disaster. There is this current discussion about vaccination skepticism (to use a polite word); one reason that parents omit to vaccinate their children is that no one living has experienced what a genuine measles or polio epidemic is like.

The availability of antibacterials since the 1930s has been a similar miracle. You do not have to die of a severe infection, you can take medication against it. Unless there is investment in research, serious infectious diseases will be back.

<comment><USER21> Statins are a lifestyle drug? Come on.

<comment><USER20> First-line treatment for high cholesterol is still dietary changes and exercise.

</comment></comment></comment></comment></comment></comment><comment><USER22> Medication is only one tool, and often needs to be used in combination with other tools, but people are always looking for the quick fix. Dealing with some of this shit can take hard work over time. Here is a small look at my experiences dealing with depression, PTSD and medication:

[http://dhubris.livejournal.com/14447.html](http://dhubris.livejournal.com/14447.html)

As I said, it works for me, but may not work for you. The study of the brain and how it works physically, electrically, chemically, consciously and emotionally, and all the complex interactions within that is in its infancy in a lot of ways. So yes, if you think there is a lot of stumbling around trying to figure out what works and what doesn't, you're right. Isn't that how most science starts?

</comment><comment><USER23> My ADHD medication Strattera costs $170 a month and since the generic version only saves me $20 causes serious nausea and vomiting I don't have any choice.

And its one of the only medications you can't develop a tolerance for.

Luckily I'm Canadian, working part time at a Canadian university where health insurance covers the costs.

<comment><USER24> For the last 18 years or so I have been taking some form of low cost Ritalin with a co-pay between 15-25 dollars.

This ancient medication that is a generic costs 130 dollars a month and that is the negotiated rate!

The money isn't going to research and it isn't going to manufacturing so where does it go?

<comment><USER25> the cayman islands.

</comment></comment></comment><comment><USER26> This article has its own very naive bias: Thinking that every phenomenon must have a "root cause" \- ie, a simple cause-effect explanation - and that if you don't find the root cause, you can't control the phenomenon.

Take for example serotonin reuptake inhibitors. It's not important to know if a deficiency in serotonin is the "cause" of depression. All we need to know is if increasing the levels of serotonin correlates with an improvement of the condition of the patient better than placebo.

<comment><USER27> From a drug designer's perspective, though, this is a problem. If you don't know why the current drugs work you're going to have a lot of trouble improving them.

<comment><USER26> Yes, but to know "why" (I'd much rather say "how") current drugs work you don't need to know "why" people get certain illnesses - that's my issue with the article.

Their logic is: low serotonin levels aren't the cause of depression - <USER2> raising serotonin levels will not eliminate the cause of depression - so doing that isn't useful. That's a naive (and wrong) logic. Your heart going into fibrillation is not the cause of your heart problems, but treating the fibrillation can save your life - whatever the "cause" of that fibrillation.

<comment><USER27> >Yes, but to know "why" (I'd much rather say "how") current drugs work you don't need to know "why" people get certain illnesses - that's my issue with the article.

Well, that's true. But I think he makes a reasonably compelling argument that we don't in fact know why the current generation of drugs works.

</comment></comment></comment></comment><comment><USER28> I think it's relevant to point out the potent anti-depressant effects many people experience with natural supplements such as sam-e and 5htp. It's unfortunate that these drugs are rarely prescribed (in the U.S.). Few clinical studies have been done on these and there is little economic motivation for drug companies since these are un-patentable substances.

</comment><comment><USER29> Eh, maybe understanding of the brain is ripe for some kind of "scientific revolution." If so, I really hope Ed Boyden and the Synthetic Neurobiology Group are a part of it:

[http://www.ted.com/talks/ed_boyden.html](http://www.ted.com/talks/ed_boyden.html)

The video is a little more optimistic, maybe even risks TED-utopianism... but it still has some really cool ideas, and shows that we have at least figured out a couple of things about brains.

</comment><comment><USER30> "Gary Greenberg is a practicing psychotherapist"

What evidence does Gary Greenberg provide in his writings that would convince a skeptical onlooker that what he does for his patients is helpful?

<comment><USER31> > What evidence does Gary Greenberg provide in his writings that would > convince a skeptical onlooker that what he does for his patients is helpful?

The same question could be asked of any psychologist, psychotherapist or psychiatrist, regardless of their publication record. There are no objective, scientific, rigorous evaluation criteria anywhere in the field, which explain why the mental health field has the reputation it does.

No one asked it of Diederik Stapel, and, in spite of his enviable publication record and fame, he turned out the be a total fraud:

Link: [http://news.sciencemag.org/people-events/2012/11/final- repor...](http://news.sciencemag.org/people-events/2012/11/final-report- stapel-affair-points-bigger-problems-social-psychology)

Quote: " In their exhaustive final report about the fraud affair that rocked social psychology last year, three investigative panels today collectively find fault with the field itself. They paint an image of a "sloppy" research culture in which some scientists don't understand the essentials of statistics, journal-selected article reviewers encourage researchers to leave unwelcome data out of their papers, and even the most prestigious journals print results that are obviously too good to be true."

<comment><USER30> I think you are saying that we can't be sure that the author of the article kindly submitted here really knows what he is talking about.

Diederik Stapel is a disgrace,

[http://retractionwatch.wordpress.com/2013/08/02/measure- by-m...](http://retractionwatch.wordpress.com/2013/08/02/measure-by-measure- diederik-stapel-count-rises-again-to-54/)

but he also hasn't had any influence on the clinical practice of psychiatry in the United States, the main topic of the article.

<comment><USER31> > I think you are saying that we can't be sure that the author of the article > kindly submitted here really knows what he is talking about.

That's true in all intellectual pursuits, and particularly true in science -- there are no truths, only evidence.

> ... but he also hasn't had any influence on the clinical practice of > psychiatry in the United States, the main topic of the article.

He published in the same journals as U.S. researchers and therapists, working to the same standards (or lack thereof) and with the same contempt for science that is a hallmark of the field. It certainly does indict the entire field, or do you think Europe is located on a different planet?

Since you seem to think Holland is located on an alien moon, here's a similar recent scandal involving a Harvard professor:

[http://chronicle.com/article/Marc-Hauser-Resigns- From/128296...](http://chronicle.com/article/Marc-Hauser-Resigns-From/128296/)

Quote: "Marc D. Hauser, the Harvard psychologist found responsible for eight counts of scientific misconduct by the university, has resigned ..."

In scientific fields, such misbehavior isn't tolerated, and exposures of this kind end careers (example Jan Hendrik Schön, [http://en.wikipedia.org/wiki/Sch%C3%B6n_scandal](http://en.wikipedia.org/wiki/Sch%C3%B6n_scandal)). Hauser, on the other hand, is, in his own words, moving on, exploring "some exciting opportunities in the private sector" and that he had been involved in some "extremely interesting and rewarding work focusing on the educational needs of at-risk teenagers."

So this public fraud, this person who holds science and professional responsibility in contempt, is going to be allowed to treat at-risk teenagers? _Only in psychology._

</comment></comment></comment></comment><comment><USER32> I haven't read this entire article, but my experiences with a handful of anti- depressants is that they all are a placebo. Though not for profits. Sell people hope and promise of becoming "normal," and they buy it in the million.

Again this is my own personal experience in taking various anti-depressants for a few years. Overall what helped me was talking to other people and realizing were all nuts (deal with same issues) and yet very normal.

So if your dealing with depression and anxiety and are hiding it, from my experiences please do not. Please talk about it with as many people as possible; realize we are all the same and deal with the same similar issues!

<comment><USER33> I'm sure your anecdotal experience with a handful of drugs is representative of everybody else's experience.

(It's not)

</comment></comment><comment><USER34> Hackers can make huge money in psychology/psychiatry (both prescientific fields). Life logging and it's analysis - quantified self. Positive psychology would be the better angle to play it, unregulated, big money in the self-help culture. Mobile apps are the right medium for it. There was recent doc on it 'Monitor Me' by bbc horizon.

edit: to replyers, it didn't want to post links for everything, so

google 'monitor me bbc horizon youtube', 'quantified self', 'self help industry', 'positive psychology'

<comment><USER35> I'm trying to understand what you're saying, but honestly I have no idea what you just said. Would you clarify your meaning?

edit to reply to your edit: no, you'll have to do _much_ better than that if you want to actually communicate with people and not be ignored or dismissed as crazy. Would you please spend at least 10 minutes typing an explanation of (a) what are you talking about, and (b) why is it valuable?

Maybe I should point out that your edit seems to assume that most people understood part of your original comment. Actually, I think nobody understood any of it. So you'll have to rewrite what you originally said. (One strategy would be to make your comment longer and more thorough, and don't assume that anyone understands what you're saying unless you've explained it thoroughly, even if it seems obvious to you.)

<comment><USER34> OK. I try to see articles and find a positive spin where I can say "hackers could ...". To some people it would be obvious, but to young or non-tech people it might not be, so it could be helpful to them.

As other commenters have said, psychiatry/psychology is an ineffective field and also expensive.

The self-help industry is kind of related to psychology/psyciatry, is unregulated, and a $11 billion a year field.

I gave a mention of a documentary that came out recently about people building apps in this category of self help/health/life monitoring kind of stuff. Some terms to google to find out more are what I typed in the OC.

<comment><USER36> I would pay folding money for this software+usage data - and I am just an affected individual (bipolar for 20 years). I went through a phase of asking for survey information (after they had published their paper article etc.)- no one would give it up.</comment></comment></comment></comment>


Talking to Chromecast with Qt - <AUTHOR> https://plus.google.com/+RichardMooreKDE/posts/MrRH13efmUJ

<comment><USER2> How cool would it be if there were a Chromecast which had HTTP Web APIs available to stream content to it?</comment>


How do you tell real ciphertext from complete random-generated garbage? - <AUTHOR> http://www.quora.com/Cryptography/How-do-you-tell-real-ciphertext-from-complete-random-generated-garbage

<comment><USER2> It's a measure of a cipher's quality that one cannot distinguish an encrypted message from a contentless one. Modern encryption methods don't give a decrypter any exploitable patterns. A method that did reveal patterns should be discarded in favor of one that doesn't -- there are many.</comment>


Show HN: Comet Panels – Custom visualizations for your ML experiments - <AUTHOR> https://www.comet.ml/demo/gallery/view/new#select-panel?gallery-tab=Public <comment><AUTHOR> Hi HN! Really excited to share this with with those of you training ML models. Comet Panels is an easy and free way to build visualizations, widgets and apps in HTML/JS/CSS _on top_ of your ML experiment data and a gallery where you can share your work with the world.

Panels is built on our experiment management platform (100% free for individuals). Essentially as a user you can report all of your metrics, params, assets, data samples etc. Everything stored is also accessible via our JS SDK so it's really easy to fetch data for your panels.

The main idea is that visualizations aren't stale. Every time a new experiments is reported your visualization will update with that additional data.

Docs available here: [https://www.comet.ml/docs/javascript-sdk/getting- started/](https://www.comet.ml/docs/javascript-sdk/getting-started/)

Blogpost with more information: [https://www.comet.ml/site/introducing-panels- custom-visualiz...](https://www.comet.ml/site/introducing-panels-custom- visualizations-for-machine-learning/)

</comment><comment><USER2> Is it like Streamlit with Gallery?

<comment><AUTHOR> Streamlit is awesome but solves a different use case. There's definitely similarities but also a few core differences. 1. Comet Panels reads the experimentation data from our API/Database. Streamlit is much more like Jupyter notebooks where you'd have to setup your own data store and implement logic to update it with new experiment data. This also means that if you pull a visualization from the gallery it should work out of the box as the API is standard among everyone! 2\. Comet Panels is freely hosted so no need to setup a webserver 3\. Comet Panels is natively written in JS/HTML/CSS so you can use any JS library out of the box. Streamlit is written in Python and you might be limited to the built in UI components (or you can build a custom on which is also in JS/HTML/CSS)</comment></comment>


QKarD Quantum Smart Card - <AUTHOR> http://www.lanl.gov/projects/feynman-center/technologies/information-technology-communications/qkard-quantum-smart-card.php <comment><USER2> Looks like there's no actual QKD happening on the QKarD, so, if someone were to replace the "TA does QKD with a satellite" part with a "TA generates a bunch of random bits", nobody would even notice.</comment>


The James Golick Grant for Women in Computology - <AUTHOR> https://jamesgolick.bitmakerlabs.com/

<comment><USER2> this is great, donated</comment>


Horses recognise human emotions - <AUTHOR> http://www.bbc.com/news/science-environment-35522233 <comment><USER2> Of course horses can recognize some human emotions. Most humans, even ones who handle horses, can't read horse emotions well.

Horses are quite expressive, but their body language is alien. Horse facial expressions exist, but involve very quick eye movements, something discovered only about twenty years ago. Most of the bigger horse expressions are in ears, lips, tail, and carriage.

If horses don't get feedback from their humans indicating some understanding on the human side, they often stop trying to communicate. To learn how horses communicate, watch them in an open field for long periods. There are frequent subtle dominance displays. Not kicking, or even ears pinned back; often it's just slightly narrowed eyes and an eye-flick, and one horse will yield space to another. If a horse does that to you, putting hands on hips and giving the horse a hard stare says that you got the message and aren't backing down. Most horses get this. It's a compromise between horse body language and human body language; a pidgin, if you will. Horses recognize eye contact. You're much less likely to be bitten, even by a hostile horse, if you're looking at the horse's eye and they're looking at you.

It's quite possible to "speak horse" that way. "Talking with Horses", by Henry Blake, is useful.

Whether or not a horse understands human to human expressions depends on how much experience they have with humans. It's a second language for horses, after all. Horses that live in herd situations deal mostly with other horses, and may not be that attuned to humans. Ones in stall situations tend to be more people-oriented, by necessity. The parent article was about horses that deal with lots of different people, so they're likely to have figured out human expressions.

</comment><comment><USER3> That would make them the second animal known to do this. ([http://news.nationalgeographic.com/news/2015/02/150212-dogs-...](http://news.nationalgeographic.com/news/2015/02/150212-dogs- human-emotion-happy-angry-animals-science/))

Probably not a coincidence that they're also one of the relatively few domesticated animals ([https://en.wikipedia.org/wiki/List_of_domesticated_animals](https://en.wikipedia.org/wiki/List_of_domesticated_animals)).

<comment><USER4> For a long time I thought of horses as basically cows you can ride. Then I saw a video of a horse playing with a giant ball: [https://www.youtube.com/watch?v=emxI- nRGWBE](https://www.youtube.com/watch?v=emxI-nRGWBE)

It's acting more like a dog than a cow. And there are many other videos of horses playing and doing tricks like dogs can. My opinion of horses greatly improved. Thinking about it, I shouldn't have found it surprising. Horses are herd/pack animals like dogs, so they naturally have social skills, and despite being herbivores they are still mammals, so their body language is at least somewhat similar to humans. And also like dogs, horses have been domesticated to work closely with humans. Most other domesticated animals are either solitary, or not required to work directly with humans. I think any domesticated mammal with both those properties will likely read human emotions. Even though the dog has the advantage of being a carnivore so it is more similar to humans, and being required to work more independently than the horse, putting more selection pressure on its communication skills, the horse still far exceeds popular animals like the cat in its ability to communicate with humans. If the dog is "man's best friend", I think the horse can be "man's second best friend".

<comment><USER5> There are plenty of videos of cows also playing with balls and with others. Not kidding. Look for The Gentle Barn and Dudley the cow, for one example.

<comment><USER4> Dudley looks a little smarter and more active than cows I see locally, but not nearly as much as a horse. Most of his "playing" looks more like scratching/rubbing type behavior, the same as you see with motorized cow brushes.

</comment></comment></comment></comment><comment><USER6> My completely unscientific opinion, coming from my own observations, is that animals are generally much more emphatic than we give them credit for.

<comment><USER7> > animals are generally much more emphatic than we give them credit for.

They're also frequently much more emphatic than people I mostly work with as a programmer. ;-)

No, really: I own two cats now, and I grew up with dogs, cats, horses and goats around and it led me to believe that animals generally do dream, do have emotions and are generally able to understand or feel emotions of others. They also do think, they do try to predict the future, and they do learn on their own, sometimes frighteningly quickly.

But it's convenient to believe otherwise and even people who should know better tend to forget about it during the meals. Just try to imagine how eating a burger would feel with a thought like: "ok, now I'm eating something that was smarter and more emotional than my 2yo niece".

</comment></comment><comment><USER8> For some interesting history on animal behavior check this out. [https://en.m.wikipedia.org/wiki/Clever_Hans](https://en.m.wikipedia.org/wiki/Clever_Hans)

<comment><USER9> _" One person presents the photo while another holds the horse,"_

Indeed. One wonders if the person holding the horse and the person presenting the face photos could see if the photo was of an angry or other face.

<comment><USER10> From the article:

        Experimenters were blind to the stimulus
        in 82% of trials and analyses showed no
        difference in subject responses according
        to this factor (see the electronic supplementary
        material tables SII and SIII).

So, it didn't even matter. Pretty much everyone that would be doing research of this sort is familiar with Clever Hans, so I'm sure they'd be extra careful when designing their experiment.

</comment></comment></comment><comment><USER11> This study should be expanded to include wild horses. Also if they could somehow measure "positive" reactions that would be interesting.

Domesticated horses are generally trained through fear; it is not surprising they react to angry faces. So it might also be interesting to conduct this same test on horses trained only with positive reinforcement techniques.

<comment><USER12> I live in a rural community. I have had many friends and family work with our local light-horse association. I would really appreciate you localizing that comment about trained through fear and reporting it to your local equestrian society. I apologize if you are not from North America and part of a country that allows you do so.</comment></comment>


Show HN: A new decentralized microblogging platform - <AUTHOR> https://github.com/Gargron/mastodon <comment><USER3> Nice! I was preparing myself for a rant against yet another proprietary "decentralized" platform, when I read that this is GNU Social compatible :-). This is great, maybe some more (compatible) competition will do the network good. The current offerings like GNUsocial are not quite as polished as e.g. Facebook and Twitter.

One little suggestion, I can't see anything of your network when I visit the main page. I'm hesitant to sign up for something if I can't see it. Maybe you could add a list of users of the instance / network, public tweets, etc. Or even better, publish a link to a (public) profile, so users can get an idea what it looks like in use.

(If I'd make a federated microblogging / social network site, I would center it around the profile page. I'd make it at first glance less about networking and more about presenting yourself. Like the early Facebook, or MySpace. This way, a user has an incentive to sign up even if no or only few friends are on the network yet. You'd be able to customize your page a lot, leave contact data, write (micro) blog posts, have a wall (guestbook) etc... And almost incidentally you'd be able to use your identity to comment on GNUSocial, use XMPP, OpenID, ....)

<comment><AUTHOR> Here is my profile: [https://mastodon.social/users/Gargron](https://mastodon.social/users/Gargron)

I also made a demo video (linked in the README): [https://www.youtube.com/watch?v=YO1jQ8_rAMU](https://www.youtube.com/watch?v=YO1jQ8_rAMU)

I realize that a public timeline would be a good addition.

<comment><USER4> @daveid, are there instructions on how to get Mastodon running without Docker? Very nice looking app, thanks!

<comment><USER5> It looks like a standard Rails app, so you should just be able to clone the repo and google the rest.

</comment></comment></comment></comment><comment><USER6> Why do we keep building centralized "decentralized" services to replace entrenched centralized providers? What hope of victory is there against the Twitters and Facebooks of the world? They already own that space! They aren't going to be disrupted by Yet Another Twitter Clone.

Disruption means doing something that your competitors are effectively incapable of doing.

<comment><USER7> Their USP, which Facebook and Twitter can never compete with, is self-hosting. Multiple companies could set up, some with ad-free paid options, others funded by advertising. And if you don't like those options, you can host it yourself for you and your family.

I think that's a worthy goal, though I'm not convinced it we'll achieve it because of the amount of money the vested interests can throw at preventing it. But it remains a good idea, even if it never becomes mainstream.

<comment><USER8> _> Multiple companies could set up, some with ad-free paid options, others funded by advertising._

OK. But why _would_ they? What is the raison d'etre for such a company to exist? What is the competitive advantage here for those companies to actually _do_ that? How does this not turn into a hilarious race-to-the-bottom that zeroes out any reason for anybody to do it in the first place?

I am profoundly unconvinced that you're going to ever beat a Twitter or a Facebook and it's not because of "vested interests preventing it", it's because the current options meet the needs and desires of the userbase. The size of the group that cares about self-hosting something like this is within epsilon of zero percent. Because nobody cares, there is no network effect to pull other people.

<comment><USER9> It turns into a utility, like Wikipedia, or OpenStreetMap. Not all that provides value generates profit, hence the need for a different model.

Mind you, Telegram is funded by one wealthy benefactor, and I'd argue its a reasonably large service not attempting to compete for profit against other incumbents.

<comment><USER8> That model still needs _users_ , then. "It's self-hosting" does not provide any kind of user story for, say, me. I have Twitter. Twitter works. This adds nothing to the experience and subtracts about a kerjillion people from the pool.

<comment><USER9> I agree that self-hosting isn't a story, but an underlying feature. You have Twitter. Twitter works. For now. Will it when Disney acquires it? Or some other corporate suitor?

<comment><USER10> Say Twitter gets acquired and subsequently completely fucked up (not that the latter necessarily follows from the former), and there's now a market void.

What're the odds the "winner" of the ensuing fight is the decentralized FOSS platform — that has very real tangible benefits, but ones that are hard to explain to an average user — over the shiny new VC-funded Twitter clone that can throw hundreds of thousands of dollars at user acquisition?

<comment><USER9> I have no idea how to fight the never ending torrent of VC money funding clone after clone after clone.

<comment><USER11> Time. It is only "worth it" for the one VC that wins the winner take all rat race. There can only be so much stupid money in the world before only the smart people are left with any.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> When I read these news I'm always reminded of a certain old project.

There once was a decentralized communication platform that promised to replace email, wikis, forums, article comment services, blogs, microblogs, you name it.

It was technically very advanced: many people could work on the same document at the same time and they would see each other's changes in real time, even if they were working from different federated servers. The history of all changes was accessible as well, in a very user-friendly way (play button and time slider.)

The GUI was not as fast as it could be, but it was cross-platform, user- friendly, and it worked.

I'm talking about Google Wave. It was federated, it was very advanced, and it failed spectacularly. Keep that in mind as you make further predictions.

<comment><USER13> Just my opinion, but I actually would have reported this differently.

Firstly, Wave - the protocol - is still around; its an apache project: [https://incubator.apache.org/wave/](https://incubator.apache.org/wave/) So technically and actually anyone could create their own (free or for-pay) service/instance. There's nothing stopping a couple of kids (or senior employees disgruntled with their current enterprise employer) from scrapping together a new project/venture to start a new social network based on Wave, etc.

The platform didn't fail so much as Google let it die off (at least retired it from their infrastructure, retired it as a product they supported, etc.). As another person here has noted, google creates some cool tech. And, in this case, google either didn't know what to do with this cool tech., or felt they couldn't make money on it, or felt users couldn't adopt it, etc. Or, who knows, maybe it was a technology too far ahead of its time for google to really understand its potential. I myself thought it was a great idea.

</comment></comment><comment><USER14> Looks really interesting and exciting.

Feedback:

\- Strange decision to have several vertical feeds - doesn't seem very convenient. Can there be one stream with several tabs or something like that?

\- It would be cool if there would be reddit-like discovery system, so that you could browse tags, and then sort the posts in the tag by hot/new/top.

Questions:

\- What are your plans for this platform? Is it just a fun side project? Are you planning to compete with twitter?

\- Are you planning to monetize?

<comment><AUTHOR> As the other poster pointed out, I was heavily inspired by TweetDeck which I've been using for 6+ years.

And yes, I agree that's a nice suggestion, user/content discovery is definitely a big area in which this can be improved.

Edit: I realized I forgot to answer the last two questions.

Plans for the project: I'm a realist so I don't think that it will be able to compete with Twitter. However I would like this project to become the go-to option for people who are already inclined to prefer decentralized/self-hosted solutions, and simply be better than the other software in that space.

No, I don't plan to monetize. Mastodon is open-source, licensed under AGLPv3. However I do have a Patreon through which interested people could support me while I work on it.

<comment><USER14> I wish you luck!

It doesnt have to become mainstream to be extremely valuable. If it could become a high quality niche community of geeks and hackers, like HN, it could be very awesome. Maybe it could be to twitter what HN is to reddit?

</comment></comment></comment><comment><USER15> This is great. Good work!

My entire family is currently using Path as a small social network and share a lot there. I'd love to move us to something we can control and where the data (esp. photos) aren't locked away in a proprietary system. Does this (or Gnu Social) support protected accounts, where permission must be given for people to see and follow accounts?

<comment><USER13> That is exactly my same use-case: a private/self-hosted social network only for my family; and I happen to use Gnu Social. To be clear, Gnu Social is _NOT_ the only open source platform that accommodates this use-case. Specific to your question, here's a screenshot of some of the settings for restricting access on gnu social: [http://imgur.com/a/gXy7y](http://imgur.com/a/gXy7y)

As far as mobile clients, my family and I use AndStatus [[http://andstatus.org](http://andstatus.org)] which works awesomely with gnu social, is an extremely lightweight mobile application, gets updated constantly by the dev. team, and also allows you to post to your twitter account.

Good luck!

</comment></comment><comment><AUTHOR> If you don't know anyone you can follow on it yet, you can start with me: firstname.lastname@example.com

Also if you have any questions feel free to ask!

<comment><USER16> One nitpick (I'm sure you've gotten many). If I go to [https://mastodon.social/users/Gargron](https://mastodon.social/users/Gargron) there are no follow buttons. If I'm logged in and I add you to follow, then I can click on your name and get the (un)follow/block buttons, but not from the main user page.

To compare, when I click on aqeel, I get [https://social.aqeeliz.com/aqeel](https://social.aqeeliz.com/aqeel) which has a subscribe button.

</comment></comment><comment><USER17> Some questions:

1\. Is this supposed to be run by me (an individual?) or run for my by somebody else (some existing community?).

2\. Is there any information on what makes this decentralized? How does it "discover" other users?

<comment><USER18> > Is there any information on what makes this decentralized? How does it > "discover" other users?

The README says it is a Gnu Social implementation (previously known as StatusNet). It uses Jabber/XMPP for Message transport, which is decentralised and federated. See also

[https://en.wikipedia.org/wiki/GNU_social](https://en.wikipedia.org/wiki/GNU_social)

<comment><AUTHOR> Mostly correct but it does not use Jabber/XMPP, it uses a set of procotols like Webfinger (account resource discovery), Atom/ActivityStreams, Salmon (remote account notifications) and PubSubHubbub (follower update notifications)

<comment><USER18> Right, sorry. I should have read the Wikipedia article more carefully.

</comment></comment></comment></comment><comment><USER19> Ironically, these decentralized microblogging and social platforms are getting too diverse. We're all trapped in wall-less walled gardens.

<comment><USER20> This is exactly why the W3 is developing a standard called ActivityPub, so that all of these platforms can communicate amongst each other. It shouldn't matter what platform or node you choose to host your social media profile. They should all be able to communicate with everyone else (like email!).

[https://www.w3.org/TR/activitypub/](https://www.w3.org/TR/activitypub/)

<comment><USER19> Now that is good news. At the moment, we have a xkcd/927 situation on our hands.

<comment><AUTHOR> ActivityPub is a successor to ActivityStreams/Salmon which Mastodon and GNU social are currently using. At least with these it's not really a xkcd/927 situation.

<comment><USER19> Diaspora? Pump.io? Patchwork (the SSB thing)?

<comment><USER21> Why do you drop other names? Diaspora is a tool, not a standard. If they are still developing that then they may actually implement to read and share data in the standard as well.

<comment><USER19> However, they haven't done that yet. So they're competing "standards," even if one isn't standardized.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Between playing around on mastodon, and my family's own/private gnu social instance, and matrix.org, i honestly don't know which to give my attention...In any case, it is exciting that there are a few efforts underway that have to do with decentralized communication. Funny how email - and its decentralized-ness - still lives on. I grant you that other platforms might get their attention (sometimes short-lived), but decentralized platforms - <USER2> like email - just don't die...and i think that's great because among other reasons decentralization fends off death.

Kudos to the Mastodon team!

<comment><USER21> "Private" in the meaning of running your own host, or "private" as in "people I don't trust can't access it"? The latter would be quite interesting to me. How to achieve that with gnu social platforms?

<comment><USER13> In my case I actually meant both; I do host my own, and I've locked it down as a private instance only for my family. (I do this partly to play around and learn, but more so for me to teach my kid how to actually use social media _but_ in a safe environment, before letting them loose on the public/uncontrollable silos.)

Here's a screenshot of some of the settings for restricting access on gnu social: [http://imgur.com/a/gXy7y](http://imgur.com/a/gXy7y)

<comment><USER21> It really looks like they thought about that when developing gnu social as well and you can just set checkboxes. That's nice. In that regard I'll probably also set up my own instance. Thanks!

</comment></comment></comment></comment><comment><USER22> So, a couple nitpicks, hopefully of some use:

[https://mastodon.social/users/mnx/updates/11273](https://mastodon.social/users/mnx/updates/11273) (no proper breaking of lines)

[https://mastodon.social/users/mnx/updates/11268](https://mastodon.social/users/mnx/updates/11268) (might want to add overflow:hidden)

When clicking the follow button with no address typed, I get a 404 notification after a couple seconds.

I also got a 422, but I can't reproduce it now.

<comment><AUTHOR> Right, I'll get on fixing the styles for that.

The error messages are a bit close to programmatic at the moment, 404 means user hasn't been found, 422 (unprocessable entity) means validation error (like if you submit empty status or over the character limit). So it's all intended, just the error messages could be humanized a lot.

</comment></comment><comment><USER23> Random poll: Do HNers make distinction between decentralized and federated platforms/systems/networks?

<comment><USER24> Centralized: Facebook, Twitter

Decentralized: xmpp, email, gnu social

Distributed: bittorrent

<comment><USER25> Decentralized & Distributed: Twister

</comment></comment></comment><comment><USER26> The URL is so Rails-ish RESTful

[https://mastodon.social/users/est/updates/11744](https://mastodon.social/users/est/updates/11744)

Maybe it can be simplified like twitter's URL

[https://mastodon.social/est/11744](https://mastodon.social/est/11744)

<comment><USER5> One plus point over the norm is that it's not open to enumeration attacks. At least on the user endpoint and the link you posted.

</comment></comment><comment><USER27> Looking forward to the day when we get a decentralized microblogging platform where clicking iOS/Android app store link and installing the app is all you need to get started. Until then, or until something like Sandstorm takes hold as something you can assume your users have access to, I'm on the fence..

<comment><AUTHOR> I'd love to write an app client for it eventually.

<comment><USER27> Cool! I think the moment I can tell my friends to "go here, install this thing and sign up" something will happen. A lot of people will want to produce content without a 3rd party controlling it!

</comment></comment></comment><comment><USER28> I really enjoy using GNU Social and it is good to see alternative implementations using the same protocol. An option to just use Postgres, and not Postgres + Redis might make installing easier for experimenting with running a node.

<comment><AUTHOR> Mastodon uses redis sorted sets and publish/subscribe for timelines and real- time message delivery respectively. And for background processing. It's not easily replaceable, plus it's a super lightweight dependency and a lot of projects nowadays use redis as well.

</comment></comment><comment><USER29> An alternative that's been out for a while now: [https://github.com/diaspora/diaspora/](https://github.com/diaspora/diaspora/)

</comment><comment><USER30> I still don't quite understand how these decentralized networks work. So there's no "global" stream you can take a look at? Only from people you added? Because from a privacy standpoint I'd think that it would somehow be possible to get access to all available profiles on all instances and create a big platform where you gather all data and keep it forever.

<comment><AUTHOR> Yes, you could do that. It would be like crawling the web and the task would probably require equivalent resources depending on how big the whole known network is.

</comment></comment><comment><USER31> There is also [https://www.writedown.co](https://www.writedown.co) (not gnu compatible)

<comment><USER32> :) I'm also co founder of aris' product.

</comment></comment><comment><USER33> Is there is a dummy password for guest users? I don't want to create a new account and just to audit a service.

Don't you think, email requirement should be optional, at least in the stage of early development.

<comment><USER34> You can use mailinator.com to get a throwaway email account, or use bugmenot.com to make a throwaway <whatever> account

</comment></comment><comment><USER35> Looks good, would love to see this take off! I've been really curious about rails lately - were there any major benefits compared to writing this in PHP?

</comment><comment><USER36> How is spam and abuse handled in this system?

<comment><USER37> That is left as an exercise for the reader.

<comment><USER38> maybe a blockchain of trust with your wallet having more value the more people rank up your content? then you only allow people with a certain wallet value to "interact" with your content ie comment/like/get access to a secondary "paywalled" subsite. initial values are assigned and handed out by core developers/"influencers" ie the rich

maybe a second threshold value that can only interact with each other(they won't be visible to people who set their threshold to above the value that they own) ie the poor can interact with the poor

only the rich can talk to the rich and the poor can only talk to the poor but the poor are allowed to look at the rich and verify that they themselves are indeed poor. the poor can collaborate with each other or incentivise the rich to "pay" them.

trust flows just like centralised social networks because it's easier to do than play whackamole with low value easily created bots/spammers.any bots who abuse these systems and rise to positions of visibility are considered high value bot networks(since they somehow managed to get enough "value" to exist in the system either by using random meme based content generation or other abusive but entertaining tactics for eg r/subredditsimulator ). these bots could then be easily de-valued by users with very high values( the super rich- the core developers/influencers) if they irritate their audiences too much.

<comment><USER34> I don't see why a blockchain or "currency" would be needed. It adds a large administrative overhead (the blockchain, a diverse pool of peers, etc.), is exclusionary as you say, and causes (a weak form of) centralisation. The benefit of a blockchain is having arbitrary adversarial agents reach a global consensus (such as who owns what); but that's much stronger than what's required for blocking spam.

You can make spam expensive by using a proof-of-work system like HashCash ( [https://en.wikipedia.org/wiki/Hashcash](https://en.wikipedia.org/wiki/Hashcash) ), which is the idea that inspired mining. HashCash adds proof-of-work to a message, which is specific to that message. The receiver verifies the proof then discards it. There's no datastructure to maintain, no consensus required, no need to involve anyone other than the sender and receiver, etc.

HashCash didn't catch on for email, since its 'fire and forget' nature prevented senders and receivers from negotiating a non-zero amount of work. Such problems can be avoided in this kind of real-time protocol: just add an extra step to ask the receiver how much work it requires, then do the work, then send the message.

With such a negotiation layer, there's no need for every message to require the same amount of work. You could receive the message without hashcash, and reply with a cost based on how spammy it looks.

Everyone would be free to implement this however they like: give a high cost to everyone; check senders against public blacklists; give a whitelist of 'friends' a lower cost; reduce the cost if we've previously 'liked'/'followed'/etc. the sender; look up the sender in a pagerank/web-of- trust/friend-of-a-friend/etc. database; use a spam filter to score the message content; etc.

</comment></comment></comment></comment><comment><USER39> Why would I use this over Twitter ?

<comment><USER21> Not an author or a big fan, but the answer is quite objective so I can give it as well: (1) If you use a decentralized system you can decide who to give control over your data. (2) Using a software with open standards doesn't enforce you to continue using it if you don't like it anymore, since you can transfer your data elsewhere or delete it. (3) Using a software with open standards means you can interact with people who decided to use another software as long as it implements the same standards.

E.g. FB is handled by the FB company. You can only choose to enter that system or stay away. You can not choose to host your family photos only at another company and still share them on FB. But in a decentralized system you can use a choice of hosters or host them yourself and still share them with other users.

E.g. in most modern contact book and calendar apps you can export your data in open formats and then import them into another tool. Having more contacts doesn't mean anymore you need to stay with the tool you created them in.

E.g. your email client, whether it's Gmail, Outlook, or Thunderbird, can talk to the other email clients and hosters, since email is an open standard. In fact for most cases you don't really care what email program the other person uses.

The disadvantage of both decentralized and open-standards is that they usually require more effort to use. You need to have more skills yourself and take more responsibility. With Twitter, because they want your data, they will make it as easy as possible for your to give it to them. But in that case you need to rely on trusting the Twitter the company with that data for the rest of your life.

<comment><USER13> Well said!!</comment></comment></comment>