Move Fast and Fix Things - <AUTHOR> http://githubengineering.com/move-fast/ <comment><USER2> I'll highlight something I've learned in both succeeding and failing at this metric: When rewriting something, you should generally strive for a _drop-in_ replacement that does the same thing, in some cases, even matching bug-for- bug, or, as in the article, taking a _very close look_ at the new vs. the old bugs.

It's tempting to throw away the old thing and write a brand new bright shiny thing with a new API and a new data models and generally NEW ALL THE THINGS!, but that is a high-risk approach that is usually without correspondingly high payoffs. The closer you can get to drop-in replacement, the happier you will be. You can then separate the risks of deployment vs. the new shiny features/bug fixes you want to deploy, and since risks tend to multiply rather than add, anything you can do to cut risks into two halves is still almost always a big win even if the "total risk" is still in some sense the same.

Took me a lot of years to learn this. (Currently paying for the fact that I just sorta failed to do a correct drop-in replacement because I was drop-in replacing a system with no test coverage, official semantics, or even necessarily agreement by all consumers what it was and how it works, let alone how it _should_ work.)

<comment><USER3> You can break this down even more.

As we speak, I'm "replacing" old code by just _writing a wrapper around it_ with the new API it should have.

 _Then_ I'll rewrite it without the wrapper, bug-for-bug.

And _then_ I'll actually fix the bugs.

<comment><USER4> There's a simpler method than this that provides even _more_ surety, used by e.g. LibreSSL:

1\. Start writing your new implementation (or heavily refactoring your old implementation, whichever), but in parallel, for each legacy function you remove, write an equivalent "legacy wrapper" function that implements the _old_ API (and ABI; you have to return the same structs and all) in terms of the _new_ API.

2\. As you develop the new code, continue to run the _old code 's_ tests. (This shouldn't require any work; as far as the tests can tell, the codebase containing all of {the new code, what's left of the old code, and the legacy wrapper} presents exactly the same ABI as the old codebase.) The old tests should still all pass, at every step.

3\. Once you're finished developing the new code, and all the old code's tests are passing, rewrite the tests in terms of the new API.

4\. Split off all the legacy-wrapper code into a new, second library project; give it the new "core" library as a dependency. Copy all the _old_ tests—from a commit before you rewrote them—into this project, too. This wrapper library can now be consumed in place of the original legacy library. Keeping this wrapper library up-to-date acts to ensure that your new code _remains_ ABI- compatible; the old tests are now _regression-tests_ on whether a change to the new "core" library breaks the legacy-ABI-wrapper library.

5\. Document and release your new core as a separate, new library, and encourage devs to adopt it in place of the legacy library; release the legacy- wrapper (with its new-core dependency) as the next major version of the _old_ library.

When all-or-nearly-all downstream devs have transitioned from the legacy wrapper to the new core, you can stop supporting/updating the legacy wrapper and stop worrying about your updates breaking it. You're free!

In LibreSSL, if you're wondering, the "new core" from above is called libtls, and the "legacy wrapper" from above is called libssl—which is, of course, the same linker name as OpenSSL's library, with a new major version.

<comment><USER5> This is a textbook example of 'How to Kill an OSS project'

#1, #4, and #5 are completely unnecessary.

If it's desirable to 'kill with fire' the old codebase, you could always create a fork and merge the breaking changes on the next major release.

Creating a second library is a terrible idea for 2 reasons...

You lose the legacy source control history which is (arguably) more valuable than the current source because it can be used to research solutions to old problems.

You split the community which is devastating to the culture and survivability of an OSS project. Even something as a simple name change will have massive negative impacts on the level of contributions. Only the most popular and actively developed projects can get away with forking the community.

LibreSSL will likely survive because everything in the world that requires crypto uses OpenSSL. Even then, that was the absolutely _wrong_ way to go about things.

The only solid justification for a rename and complete rewrite, is if there are license/copyright issues.

<comment><USER4> > You lose the legacy source control history which is (arguably) more valuable > than the current source because it can be used to research solutions to old > problems.

No reason for that. Both projects—the wrapper and the new core—can branch off the original. Create a commit that removes one half of the files on one side, and the other half of the files on the other, and make each new commit "master" of its repo, and now you've got two projects with one ancestor. Project mitosis.

> You split the community

How so? I'm presuming a scenario here where either 1. you were the sole maintainer for the old code, and it's become such a Big Ball of Mud that nothing's getting done; or 2. the maintainer of the old code is someone else who is really, really bad at their job, and you're "forking to replace" with community buy-in (OpenSSL, Node.js leading to the io.js fork, gcc circa 1997 with the egcs fork, MySQL leading to MariaDB, etc.).

In both scenarios, development of the old code has already basically _slowed to a halt_. There _is_ no active community contributing to it; or if there is, it is with great disgust and trepidation, mostly just engineers at large companies that have to fix upstream bugs to get their own code working (i.e. "I'm doing it because they pay me.") There are a lot of privately-maintained forks internal to companies, too, sharing around patches the upstream just won't accept for some reason. The ecosystem around the project is _unhealthy_ †.

When you release the new legacy wrapper, it _replaces_ the old library—the legacy wrapper is now the only supported "release" of the old library. It's there as a stopgap for Enterprise Clients with effectively-dead projects which have ossified around the old library's ABI, so these projects can continue to be kept current with security updates et al. It's _not_ there for anyone to choose as a target for their new project! No new features will ever be added to the wrapper. It's a permanent Long-Term Support release, with (elegant, automatic) backporting of security updates, and that's it. Nobody starting a project would decide to build on it any more than they'd build on e.g. Apache 1.3, or Ubuntu 12.04.

> Even something as a simple name change will have massive negative impacts on > the level of contributions.

Names are IP, obviously (so if you're a third party, you _have to_ rename the project), but they're more than that—names are associated in our brains with reflexes and conventions for how we build things.

The reason Perl 6, Python 3, etc. have so much trouble with adoption is that people come into them expecting to be able to reuse the muscle-memory of the APIs of Perl 5/Python 2. They'd have been _much_ better off marketed as completely new languages, that happened to be package-ecosystem-compatible with the previous language, like Elixir is to Erlang or Clojure is to Java.

If these releases were accompanied by their creators saying "Python/Perl is dead, long live _____!" then there'd have been a _much_ more dramatic switchover to the new APIs. Managers understand "the upstream is dead and we have to switch" much more easily than they understand "the upstream has a new somewhat-incompatible major version with some great benefits."

One good example: there's a reason Swift wasn't released as "Objective-C 3.0". As it is, ObjC is "obviously dead" (even though Apple hasn't said anything to that effect!) and Swift is "the thing everyone will be using from here on, so we'd better move over to it." In a parallel reality, we'd have this very slow shift from ObjC2 to ObjC3 that would never fully complete.

\---

† If the ecosystem were healthy, obviously you don't need the legacy wrapper. As you say, just release the new library as the new major version of the old library—or call the new library "foo2", as many projects have done—and tell people to switch, and they will.

It's easy to find healthy projects like this when you live close enough to the cutting-edge that all your downstream consumers are still in active development, possibly pre-1.0 development. The Node, Elixir, Go and Rust communities look a lot like this right now; any project can just "restart" and that doesn't trouble anybody. Everyone rewrites bits and pieces of their code all the time to track their upstreams' fresh-new-hotness APIs. That's a lot of what people _mean_ when they talk about using a "hip new language": the fact that they won't have to deal with stupid APIs for very long, because stupid APIs get _replaced_.

But imagine trying to do the same thing to, say, C#, or Java, or any other language with Enterprise barnacles. Imagine trying to tell people consuming Java's DateTime library that "the version of DateTime in Java 9 is now JodaTime, and everyone has to rewrite their date-handling code to use the JodaTime API." While the end results would probably have 10x fewer bugs, because JodaTime is an excellent API whose UX makes the pertinent questions obvious and gives devs the right intuitions... a rewrite like that just ain't gonna happen. Java 9 needs a DateTime that looks and acts like DateTime.

</comment></comment></comment></comment></comment><comment><USER6> The strategy of proxying real usage to a second code path is incredibly effective. For months before the relaunch of theguardian.com, we ran traffic to the old site against the new stack to understand how it could be expected to perform in the real world. Later of course we moved real users, as incrementally as we possibly could.

The hardest risk to mitigate is that users just won't like your new thing. But taking bugs and performance bottlenecks out of the picture ahead of time certainly ups your chances.

<comment><USER7> Out of curiosity - when you've done this type of proxy test, what do you do about write operations? Do you proxy to a test DB, or do you have your code neatly factored to avoid writing on the test path (I guess most code I've worked on that needed a rewrite also wasn't neatly factored :) ).

</comment></comment><comment><USER8> This is tangential, but given the increasing functionality and maturity of libgit2, I wonder if it would yet be feasible to replace the Git command-line program with a new one based on libgit2, and written to be as portable as libgit2. Then there would be just one Git implementation, across the command line, GUIs, and web-based services like GitHub. Also, the new CLI could run natively on Windows, without MSYS.

<comment><USER9> That is my dream. Right now, many Windows GUIs (SmartGit/SourceTree) use 'git.exe' to manage the actual Git repositories.

If libgit2 is fully mature, I can imagine more GUIs/tools will be built to manage/analyze the git repositories.

<comment><USER10> I believe github windows client is going that route [https://github.com/blog/1127-github-for- windows](https://github.com/blog/1127-github-for-windows).

I also remember some blog post going into sync/async details of git.exe vs libgit2 stuff. Will try to google it.

<comment><USER11> This is the article you speak of: [http://githubengineering.com/git- concurrency-in-github-deskt...](http://githubengineering.com/git-concurrency- in-github-desktop/)

The AsyncReaderWriterLock mentioned in blog does not directly show up in Google, but it appears to be based on the one in this blog post: [http://blogs.msdn.com/b/pfxteam/archive/2012/02/12/building-...](http://blogs.msdn.com/b/pfxteam/archive/2012/02/12/building- async-coordination-primitives-part-7-asyncreaderwriterlock.aspx)

</comment></comment></comment></comment><comment><USER12> How does Scientist work with code that produces side effects? In the example, presumably both the new and old each create a merge commit. Maybe these two merge commits are done in in-memory copies of the repo so that the test result can just be discarded, but what about in the general case where a function produces an output file or some other external effect?

<comment><USER13> I would think that the operation would either (a) have to be pure or (b) be executed in two different environments. I think going for (a) is the easier approach. If you produce an output file, make a pure operation that generates the contents, then write it as a subsequent operation. Now you can test the contents against each other, but only actually write one of them.

Basically, create an intermediary object that represents your state change and test those. Then "commit" the change from control and discard the one from the experiment.

</comment></comment><comment><USER14> I am trying to understand why the new merge method needed to be tested online via experiment. Both correctness and performance of the new merge method could have been tested offline working with snapshots (backups) of repos. Could a github engineer shed more light here?

<comment><USER15> Author here. 5 years ago I would have agreed with you and logged e.g. 10 million merge requests to replay them offline. But one thing I've found over the years (which may seem obvious in retrospect) is that staging environment are not identical to production. Particularly not when it comes to finding sneaky bugs and performance regressions -- the code doesn't run on the same exact environment it will run when it is deployed (it has different input behaviors, and most importantly, it has different load and performance characteristics).

The question then becomes "why would you run these experiments offline when you can run them online?". So we simply do. I personally feel it's a game changer.

<comment><USER16> > why would you run these experiments offline when you can run them online?

It probably doesn't apply in this case, but many bugs cannot be replicated in the production environment. At least, you don't want to break things in production to see if your software does the right thing in adverse scenarios.

<comment><USER17> Some would say that's a really good strategy. Keeps you on your toes...

[http://techblog.netflix.com/2012/07/chaos-monkey-released- in...](http://techblog.netflix.com/2012/07/chaos-monkey-released-into- wild.html)

</comment></comment></comment></comment><comment><USER18> Seems like the biggest takeaway is "have good tooling and instrumentation". I'm working with a complicated legacy production system, trying to rebuild pieces of it, and we have little or no instrumentation. Even _introducing_ such tooling is a potentially breaking change to production systems. Ach schade.

</comment><comment><USER19> Very cool. I like this parallel execution of the original version and the update with comparisons between the two. They use a ruby package developed in house that has been made open source, Scientist. Does anyone know if there is an similar type package for python (preferably 2.7) development? It seems like an interesting area in between unit tests and A/B tests.

</comment><comment><USER20> > Finally, we removed the old implementation — which frankly is the most > gratifying part of this whole process.

On average, I get much more satisfaction from removing code than I do from adding new code. Admittedly, on occasion I'm very satisfied with new code, but on average, it's the removing that wins my heart.

<comment><USER21> I've long been dreaming of adding the following tagline to my resume: "Fixing bugs by removing code since 2006"

</comment></comment><comment><USER22> TIL that github used to merge files differently than git because it used its own merge implementation based on git's code, to make it work on bare repos. Showcases a benefit of open formats and open source, showcases a downside as well (I'd never guess it might merge differently.)

It's a good thing nobody contributes to my github repos since noone had the chance to run into the issue...

</comment><comment><USER23> I wish they would add the ability to fast-forward merge from pull requests. I know many large projects (including Django) accept pull requests but don't merge them on Github simply because of the mess it makes of the history.

<comment><USER24> In my team's projects, code review in PRs made a mess of the history (certain devs in particular :P). We switched to a squash merge based workflow to address it, git reflow is our particular poison: [https://github.com/reenhanced/gitreflow](https://github.com/reenhanced/gitreflow)

</comment></comment><comment><USER25> This is inspiring reading. One may not actually need the ability to deploy 60 times a day in order to refactor and experiment this effectively, but it's clearly a culture that will keep velocity high for the long-term.

<comment><USER26> In the pursuit to get-things-done, we forget fundamentals and more often than not its the sound fundamentals that come in handy when your product has grown beyond your 1 or 2 member original tech team.

</comment></comment><comment><USER27> For operations that don't have any side effects, I can definitely see how you could use the Science library.

I'm curious though if there are any strategies folks use for experiments that do have side effects like updating a database or modifying files on disk.

<comment><USER28> The first thing to do is to try to minimize the scope of mutating operations: e.g, decompose a monolithic read-write operation into independent load, transform, and store. You can then easily test as much as possible (the load and the store) side-by-side. The parts that must have side effects are still hard, but at least there are fewer of them. (One variant of this would be to build your code such that you can always intercept side-effects, and then block the new code's side effects and compare with the old code)

The next thing is to try to take advantage of idempotence (and, by extension, try to make as many of your mutating operations idempotent as possible): there's nothing completely risk free, but you can at least verify idempotence for either ordering of new and old code, and if you're factored right, you can run both paths on the same input and verify they have the same side-effects and output.

Finally, making the observation that the new code must in general be backwards-compatible with the old code, and both versions need to be able to run concurrently (because this situation will always exist during deployment): in the worst case, you can always start with a limited deployment of the new path, which limits the amount of damage done if the new code is bad.

</comment></comment><comment><USER29> Github sounds like a great place to work.

</comment><comment><USER30> Wow, strange that people weren't reporting these merge issues when they were clearly impacting people.

<comment><USER25> My read of the article implies that they were running the new method on the side, and comparing the results to the old method that was still running in production. They got to 100% before they actually pulled the lever on what customers would use.

Edit: Ah, I see - talking about the Git bugs, not the differences . I'm actually not surprised that "256 (or a multiple) merge conflicts" was never noticed (or at least root-caused and fixed) by the entire git community.

Wonderful ability to use a large userbase as a giant fuzzer.

<comment><USER31> I think OP was talking about the issue in git itself that caused merges with mod 256 conflicts to go though and be committed, including all the merge error markers.

This happened on their live system (and would have happened on the command line for local git users), so OP (and incidentally, me too) was wondering how that wasn't noticed and wasn't causing support issues (it probably was which might have been another reason for this refactoring)

<comment><USER32> I think it is a combination of two things:

\- the mod-256 conflict bug is exceedingly rare. Keep in mind that this is mod-256 individual hunk conflicts in a _single file_. Most files in a merge with conflicts have a handful of hunks. Over all of the testing at GitHub, only a single merge triggered this bug, and it was on a long repetitive file with automated changes.

\- the failure case was to quietly accept the merge. The result was obviously bogus, but didn't look any different than a user accidentally checking in the merge conflict markers. So if it was happening, I'd suspect that it went undiscovered either because the merge results were never used (e.g., it was a test-merge to feed the PR "Merge" button status) or the users simply scratched their head and fixed it.

</comment></comment></comment></comment><comment><USER33> Nothing really to contribute or ask, other than to say that I really enjoyed the writeup. Although I have nothing coming up that would use the code, the new library sounds really neat. Kudos!

</comment><comment><USER34> Very interesting, definitely gonna try this out as I have seen similar use- cases.

Any change Github is at anytime going to show the specific merge-conflicts for a PR that cannot be merged?

</comment><comment><USER35> Humans will always reverberate around truths like this.

The emphasis shift on breaking vs fixing looks like a good example of how fashion trends in tech create artificial struggles that help new people understand the "boundaries" of $things.

Fashion's like a tool for teaching via discussion

Edit: I'm just commenting on what I percieve as a fashionable title not the article.

</comment><comment><USER36> When running with Scientist enabled, doesn't that mean you will add both the runtime of the old/new implementation instead of just one implementation?

I could see this begin ok in most cases where speed is not a concern, but I wonder what we can do if we do care about speed?

<comment><USER37> We could go look at the implementation/documentation of Scientist to confirm, but nothing says the comparison has to be happening on the response thread. You _could_ fork a new thread to run the unused implementation without impacting response time, as long as you have the server capacity.

</comment></comment><comment><USER38> Does anyone know what an "O(n) issue" is? I can think of a few possible meanings in the usage here, but I've never heard it before and they all seem wrong.

<comment><USER39> Using a linked-list where the actual access pattern is random and an hash table is more suitable would be the most obvious, especially since this is C code.

Similar things includes C-style string functions like strlen() and so on that require iterating over an unknown length array. Caching (or better avoiding!) this work can save a lot of computing time. Example from libgit2: [https://github.com/libgit2/libgit2/commit/7132150ddf7a883c1f...](https://github.com/libgit2/libgit2/commit/7132150ddf7a883c1f12a89c2518c1a07c0dc94c)

In fact C-style string is a rich source of O(n) performance issues. And git is full of strings like filenames.

<comment><USER38> To me, I would have called that an "O(n^2)" (or whatever the proper non-linear order is) issue. The issue isn't that the algorithm is O(n), but that it's not O(n) when it could be! The other interpretations by andrewaylett and daveguy seem to be more accurate (and also agrees with my own thinking). But I could also see it being used for "the asymptotic complexity was hiding a huge constant".

Have you heard your interpretation used in the wild?</comment></comment></comment>


The Uber Game: Can you make it in the gig economy? - <AUTHOR> https://ig.ft.com/uber-game/ <comment><USER2> It really annoyed me that the game forced me to make errors. I don't oversleep and I have a generous dataplan that doesn't force me to buy "unlimited." I also didn't get a choice to stay in Sac. The feeling of "this is hard" was lost and was replaced by "this is not a useful demonstration."

<comment><USER3> Whether intentionally or unintentionally you're demonstrating the concept of privilege that some people are making efforts to point out.

You want to play the game that you want because you believe yourself to be a rational, intelligent, logical person.

You believe you can win the game.

You don't oversleep, you have a generous data plan.

You can choose.

And you're complaining that the game isn't useful because it doesn't fully allow you to choose.

The type of person that drives for Uber and Lyft in real life don't have the privilege to choose. They are driving for Uber and Lyft.

That's why it's hard.

You may have worked hard to be where you are, you have done it from a kid squatting on the ground to poop in a third world country to being the top earner at a tech company, all by yourself. That's great, that's rare, you deserve whatever accolades you choose to laud yourself with.

Or maybe it's not that dramatic of a distance. Maybe you're a middle-income family that could work to afford college education and you studied and worked hard to afford good sleep and generous data plans.

That initial position is still much better in the distribution model of modern society than many others that can never leave their situation.

What do you choose to do about it?

<comment><USER4> I'm sympathetic to arguments from those pointing out my personal privilege and how it doesn't apply to them. But I take issue with the infantilization of lower middle-class people. Not oversleeping or calculating how much data you're using is not a privilege issue, these things are knowable and predictable. It's offensive to all the working class people who do manage their time and finances to keep their head above water to suggest otherwise.

<comment><USER5> That is really an excellent point... I stopped by an automobile repair shop and they were discussing how to best schedule my repairs given the constraints. Yet they are all blue collar workers, but are in fact very responsible.

</comment></comment></comment></comment><comment><USER6> Ha. Now try it with old-school cabs: "Your passenger opens your door into a lamppost, denting it. You don't have the cash to get it repaired. When you return your cab, your Armenian mobster boss notices it and breaks your kneecaps."

</comment><comment><USER7> I'm not quite sure Uber ever intended for their drivers to be able to own $900,000 homes (that's about what a $4k mortgage would get you with 20% down). To me that smacks of a very rigged game with some sort of agenda behind it.

<comment> FLUX-YOU >To me that smacks of a very rigged game with some sort of agenda behind it.

Total bills would have been much more appropriate, unless Uber drivers themselves are reporting $4k/mo mortgages, in which case loan approvals need some serious regulation.

Regardless, this game is about someone on the edge of financial failure. The only option is selling the house and hoping for some profit to pay for relocation.

<comment><USER8> >>Loan approvals need some serious regulation

There's probably other recent evidence to support this idea...

</comment></comment></comment><comment><USER9> I scored around $1016 after costs were removed. I don't think a $1000/week mortgage is reasonable, if you're an Uber driver on those costs, you need to rethink your entire life.

That being said, if mortgage was actually $1000/month and I still have 3 other weeks, being an Uber driver is suddently not so bad.

<comment><USER10> > if you're an Uber driver on those costs, you need to rethink your entire > life.

...I think that's kind of the point. But don't spend too long rethinking your life, because you need to earn money! _And_ somehow improve your life in your spare time.

</comment></comment><comment><USER11> An interesting "game", i failed but i knew it was rigged from the start, kind of like uber i guess, which i'm sure is the point they're trying to make.

</comment><comment><USER12> Cool game. In conclusion, I'd be better off making minimum wage at McDonald's or similar. Same pay, less risk. Either way my house is going to be repossessed by the bank so I'm fucked.

</comment><comment><USER13> If taxi companies produced marketing material like this and promoted it in cities where they wanted to fight off Uber, they'd probably have a much easier time.

That was entertaining and sickening all at once.

<comment><USER14> Is anyone besides people from HN playing that game?

<comment><USER10> It's in the Financial Times, a major UK newspaper. So I'd wager, yes.

</comment></comment></comment><comment><USER15> "the gig economy" What an awful name to normalise workers with no job working very hard for less than minimum wage.

Corporate masters - be more flexible for us, we'll pay you less too. FT, WSJ etc. "Gig economy, sounds like rock bands! Awesome."

I'm in no way a socialist but FFS, "gig economy?" Seriously?

<comment><USER16> I agree but when I look around at the nontechnical world (at least from my vantage point of artists and hippies) this is exactly what it has become. When you can't find work other than what you don't like, a lot seem to choose becoming an Uber/Lyft driver.

</comment></comment><comment><USER17> I got annoyed becaused it forced me to go to SF every day after the first one. What was the point of giving me a choice on day 1? I made more money in my hometown.

</comment><comment><USER14> Well, wasn't the whole idea of Uber and the "gig economy" to not have professional drivers, but just people doing it in their spare time _if they already have the means to_?

<comment><USER18> It obviously stopped being that in many markets really quickly.

But then, when it comes down to it, the "gig economy" was just SF speak for "A shitty part-time job."

<comment><USER19> Well, using "gig" to denote a job is ironically self-deprecating to begin with, since it is jazz musicians' slang for a relatively cool and exciting temporary engagement: a musical performance somewhere. Whereas in the ironic context, it refers to some mundane job.

</comment></comment></comment><comment><USER20> That was a pretty tough game, I only beat out 17% of players. Loved the aesthetics too.

I think it did a good job of putting me in the driver's seat, forcing me to make some tough decisions.

But what happens after week 1? Do you go right back into the grind and work 7 days a week, 52 weeks a year? Brutal.

</comment><comment><USER21> Pretty sure the earnings awarded by the game are overly optimistic, and certainly didn't include Uber fees. Based on trying to earn a living between gigs driving for Uber in LA. Also, expenses are higher than just fuel and incidental damage.

</comment><comment><USER22> As a Lyft driver, I can confirm that this is way too real

</comment><comment><USER23> The reality of today's gig economy is that everyone is living on the brink of a failure.

One major disaster (healthcare, job loss, natural disasters, recession, divorce) is all it takes for this American dream to turn into a nightmare.

</comment><comment><USER24> "You are deactivated for 4 hours. You use that time to buy a phone mount and charging cables for $25 and make your way to San Francisco."

Pardon? I picked Sacramento for a reason, buddy.

</comment><comment><USER14> How is it worse having the option of being an Uber driver versus not having that option?

<comment><USER25> Because Uber leads people into thinking they'll make good money. It's like asking whether it's worse to have the option of being scammed or not having that option.

<comment><USER14> Ok, you have a point.

</comment></comment></comment><comment><USER26> a $1000 mortgage payment? where can i find that in the bay?

<comment><USER27> I think they mean $1000/week, which makes more sense considering the character has two children. But who would get approved for a $4.3k/month mortgage on a single earner getting paid less than minimum wage?

<comment><USER28> Somebody who loses his or her job after having got the mortgage could be in this situation.</comment></comment></comment>


Kogan Violating GPL - <AUTHOR> http://forum.xda-developers.com/showthread.php?p=46737250 Kogan refuse to supply source code for GPL licensed software running on Kogan branded Android devices. <comment><USER2> Noted a few other things:

Their manual/documentations has no mentioning of BSD licensed software. While its possible that bsd license is included in paper form with the devices with reference to each software package, it is unlikely. As such, 99% sure that Kogan is violating BSD licensed software too.

Kogan is aware that they are using open source software ([http://www.kogan.com/uk/newsroom/kogan- releases-119-android-...](http://www.kogan.com/uk/newsroom/kogan- releases-119-android-tablet-55/)), as is indicated by their press releases. As such, if an infringement is found, it likely to be seen as intentionally and willingly regarding that product.

Otherwise, it seems as a common misunderstanding by Kogan in _how_ one provide source code to users. Its not very complicated, but hand waving users towards Google is not enough. Had the kernel been gplv3, then they could just given the user a link, but since the kernel is gplv2, the options are either a written offer for minimum 3 years or to include the source code alongside the binaries. GPLv3 changed the license text regarding source distribution because they did not want to still live in 1990s.

Kernel drivers however are a separate issue as the primary author of the kernel (Linus) has given explicit permission to produce "some form" of drivers without having to follow the license. For most people, that is enough safety against lawsuits, even if copyright do not care who is the primary author, and gives equal copyright rights to each author of a project.

<comment><USER3> So if I'm reading you right, they are in full compliance of the improved GPL terms that don't apply in this case.

Meaning their noncompliance is an accident of history, not a violation of the spirit of the license.

In that case, I don't see why anyone should care.

</comment></comment><comment><USER4> This could be a bit more subtle than it might first appear. Most countries have in their copyright something that allows an entity that has a lawfully made and lawfully obtained physical object that they obtained from someone else to resell that particular object without violating copyright.

This is why used bookstores can exist legally.

This is also why when you buy a Samsung TV from Best Buy, and want the GPL code, you have to ask Samsung rather than Best Buy. Best Buy did distribute the TV (and thus the binary software contained therein) to you, but since that distribution did not require permission of the copyright owner Best Buy has no GPL obligation.

Note that this works for Best Buy because they are essentially receiving copies of the software and then just passing those copies through to their customers, in a one to one manner. If Best Buy were modifying the code in the TV, of if they were copying the code into other TVs (say copying the code from a high end TV model to a lower end model to enable premium features), then they would no longer be operating in a one to one pass through fashion, and would need permission of the copyright owner--and then WOULD have GPL obligations and you would turn to Best Buy for the code to your television.

Now suppose some OEM makes a generic TV platform. It consists of the guts of the TV (display, power supply, electronics, and firmware), ready to be put in to a case. A company like Kogan or Best Buy that wants a house brand TV can buy the guts from the OEM, put it into a case they have someone else make for them that has their name on it, and sell it as their own.

Suppose also that the firmware consists of a minimal Linux system, configured to automatically start a shell running as user 'tv' after boot, and the startup scripts for the 'tv' user start a minimal X server, and then run ~/tvapp, which just puts up a minimal TV GUI that lets you change channels and adjust the volume.

The company buying these and rebranding them (who I shall call "the store") as their own writes their own version of tvapp that puts up a full featured GUI that allows for control of all the TV features (or they license a full featured tvapp from someone else and just replace the graphics and modify the text so it looks like it is theirs).

If the OEM that made the generic TV guts was careful, all modifications the store makes consist of just replacing ~/tvapp. They do not do anything that would create a derivative work of any of the open source code that the OEM used, and that code is just passed through from the OEM to the consumer one to one with no copying, and the net result is that the store does not end up with any obligation to provide anyone with copies of the source to the open source code in their TV.

Applying this to the present case, the big question then is just what is Kogan doing to produce their branded phones and tablets and TVs? Are they dealing with an OEM like the hypothetical one I described above, and just adding user mode applications to a generic system that is being treated as a black box? If so, then they in fact not be violating any licenses, and it would be the OEM that people need to turn to for their copies of the source.

On the other hand, if they were doing something like getting generic devices from one OEM, and taking firmware that got from a contractor, and installing copies of that firmware into the OEM devices, and the contractor used open source in that firmware, then Kogan would be responsible for providing the source code. In this case, they are making copies, not just passing on copies they received one for one to their customers.

Based on a quick (and perhaps imperfect) read of the article, I was not able to tell which of the above best describes what Kogan is doing. Do we know?

<comment><USER4> (Adding this as a self-reply rather than incorporating it into the above, because it is not directly relevant but interesting enough to maybe be worth discussing)

Suppose Kogan does in fact fall into the case where they are just modifying separate user applications and are just passing the GPL binaries they receive from the OEM on to their customers unmodified one to one, and so in fact do not have a GPL obligation (since they are not doing anything that requires permission of the copyright owner).

So you track down that OEM (which could be hard...) and ask for the source.

The OEM was smart when they decided to use GPL software. They read and understood the license, and learned that they basically have two choices when it comes to providing source.

1\. When they distribute GPL binaries to someone, they can accompany the binaries with the corresponding source, or

2\. The can distribute the binaries without source, but make the source available to anyone who asks.

Being sensible, they do not want to deal with the hassle that option #2 can be, and go with #1. Every single TV guts box they ship to a Best Buy or a Kogan is accompanied by a CD-ROM containing the complete source for every bit of software in the TV.

This completely satisfies the OEMs GPL requirement to provide source. They can legitimately tell you to go talk to Best Buy or Kogan or whoever's name is one front of your TV.

The end result is that you end up with a bunch of GPL code sitting in your living room--and NOBODY is obligated to provide you with a copy of the source code!

<comment><USER4> (Might as well add one more interesting little copyright twist that might have some interesting consequences for free software, and that has been almost completely overlooked)

In the US, there is a very interesting thing in copyright called the termination right. It probably won't have much affect on software (it is mostly a music and book thing), but there is a remote chance it could be significant in some cases.

The termination right was meant to address the situation where you have a young artist who produces a great work when they are early enough in their career that they are unknown and have almost no bargaining power, and the artist ends up making very little money from the work--it is the music company or book publishers that signs them that ends up making a ton of money.

What the termination right does, basically, is 35 years after the artist signed away their copyrights to the music company or book publisher, the artist is given a window in which they can take back the copyright. They can then negotiate a new deal with the publishers, with much better terms now that they are an established artist instead of an unknown kid.

You might expect publishers would be smart, and include in their contracts with new young artists that the artist agrees not to invoke the termination right when it vests. Congress was smart enough to realize that publishers would do that, and so made it so that you cannot contract away your termination right.

As I said, this is generally irrelevant for software. First, termination rights do not apply to works for hire. Almost all closed source software is written as a work for hire, I suspect. So, as amusing as it would be for some retired COBOL programmer to reclaim copyright on some major bank's ancient but still in service mainframe software, it probably is not going to happen.

Second, not much software survives 35 years. Even if something does not officially get replaced or retired, over 35 years it will usually accumulate enough piecemeal rewrites that nothing is left of the original--not even as a derivative work.

Still, with open source, we now have a lot of code in wide use that was NOT work for hire. Could there be fragments of open source projects that actually make it through 35 years intact, and make the termination right actually relevant?

<comment><USER2> Correct. The termination clauses has an interesting - if somewhat unlikely - effect on software.

FLOSS software which depend on the ability to distribute new copies could have their license terminated after the 35 years, given that said software still existed in large enough volume to qualify for copyright status. The first thing I can think of would be the TCP/IP stack that was created in BSD, that if terminated could cause some serious problems for Apple and other OS that depend on that code.

</comment></comment></comment></comment><comment><USER5> no fucking shit.

Kogan is as shady as they come, they rebrand cheap chinese hardware with their own firmware, rebrand hardware with a Kogan sticker and once you restore it you're back to the manufacturers firmware.

They do have to abide by Australian consumer laws though, which is always a plus.

</comment><comment><USER6> Didn't have much better luck with HTC.

"Hey, you only have the source for Android 1.5 for this phone on your website - can you please provide me the source for the Android 1.6 binaries you released."

"The only source available is that on our website."

"Okay, but under the terms of the GPL (which covers some of the code released as part of that binary), you must provide source code on request. You have the binary on your site and no associated source code. Please either provide the source code or a direct link to where it exists on your website."

"We only provide the source code on our website. Stop contacting us and have a nice day."

I mean, they did make an effort in releasing _most_ of the source code, so they're by no means at the level of this company, however they're still in violation.

Cool story bro, I know. Just really irked me.

</comment><comment><USER7> Sorry for the naievety, but it's not just modules that are inserted into the kernel that provide the support that they need (I am not a systems/kernel programmer)? And in that case, could they license the modules separately?

<comment><USER8> Sort of a grey area, but given that binary drivers exist for video cards they could at least cite a precedent.

<comment><USER9> I don't know about how this is done currently, but isn't that the reason why those drivers often don't ship installed but have to be installed by user request?</comment></comment></comment>


Password haystacks - <AUTHOR> http://twit.tv/sn303

<comment><AUTHOR> since there is some talk and analysis on the leaked passwords on pastebin.com and I was revisiting how I choose passwords. I currently generate them with keepassx for every account and basically have no way to remember them.

I found password haystacks to be quite interesting and would love to hear what you think about them.

<https://www.grc.com/haystack.htm></comment>


Why Schrems Is Wrong - <AUTHOR> https://blog.zoller.lu/2020/07/why-schrems-is-wrong-from-luxembourg.html <comment><AUTHOR> By now you should know about the EUJC ruling on the Privacy Shield. I am going to keep this one short and sweet - I believe the judgment to be more far- reaching than NOYB is explaining on their website. The reasoning is very simple.</comment>


Django contact form with simple honeypot - <AUTHOR> https://github.com/rdavl/django-contacts

<comment><USER2> just linking it to a github page where no other info is on there about it isn't helpful .</comment>


Everything I Know About Star Wars Despite Not Seeing It - <AUTHOR> http://www.wired.com/2015/09/ive-never-seen-star-wars/?mbid=social_twitter <comment><USER2> New Star Wars films will be more diverse.

Originally Lucas wanted Luke and Leia to both become Jedis, but the script writer he hired for The Empire Strikes Back changed it so Leia became leader of the rebellion and had a romance with Han Solo.

The Cinematic versions got changed in the VHS and DVD versions, for example Han Solo shot first when Greedo was sitting across the table from him. There were more scenes added and special effects got an upgrade. So you don't see the original cinematic versions but modified versions of them.

Also Clones don't live very long, so Clone Troopers lived for like 30 years and replaced with recruits. Storm Troopers were not clones but recruits. You never see the faces under the Storm Trooper armor. It is why they wore the armor on the first Death Star to sneak around.</comment>


The Effect of State Marijuana Legalizations - <AUTHOR> http://www.cato.org/publications/policy-analysis/dose-reality-effect-state-marijuana-legalizations <comment><USER3> _> The absence of significant adverse consequences is especially striking given the sometimes dire predictions made by legalization opponents._

No kidding - let me just quote Kofi Annan's excellent essay on the subject (published a couple of months before the UN failed to course correct at UNGASS 2016):

 _" Nowhere is this divorce between rhetoric and reality more evident than in the formulation of global drug policies, where too often emotions and ideology rather than evidence have prevailed."_

[http://www.spiegel.de/international/world/kofi-annan-on- why-...](http://www.spiegel.de/international/world/kofi-annan-on-why-drug- bans-are-ineffective-a-1078402.html)

<comment><USER4> Your quote nails my sentiment on the matter of drug legalisation.

The conversation shown here within HN is fascinating, from an outliers perspective.

The benefits and effects of the legalisation of Marijuana I would assume, have been well documented by now though the quantity of these reports, I would assume to be small in number. Surely it's a benefit if the number of these reports and articles were increased.

Surely the reports from Canberra (Australia, where plant ownership is legalised) and Amsterdam are quite numerous? And they would back the sentiment shown in this article?

The argument about the 'divorce between rhetoric and reality' around drug policy has enough merit to renew the conversation on drug legalisation by it's self.

Once that conversation begins, the number of reports and articles such as this will increase and potential arguments about a single report being either biased or anecdotal will be minimised as the scientific method is leveraged.

The conversation should steered towards why drug policy is inaccurate and what we need to do to have laws and systems changed, socially and politically, to cater for more evidence based studies on drug use.

Edit:

A TED talk on the topic that I found interesting.

[https://www.ted.com/talks/ethan_nadelmann_why_we_need_to_end...](https://www.ted.com/talks/ethan_nadelmann_why_we_need_to_end_the_war_on_drugs?language=en)

Disclaimer: occasionally I like to smoke weed. So by the sentiment of everyone here, I'm probably biased and my arguments should be subjected to criticism and be entirely disregarded as lacking merit.

(see what I did there? ;-D)

<comment><USER5> you failed to read the one paragraph conclusion.

both pro and cons arguments were wrong. absolutely nothing relevant has changed.

crime didnt go up nor down. neither did taxes. etc. nada.

also, ted is only relevant to rich pot heads ;)

<comment><USER6> That's partially because it has not been legalized in a non-nearly- exclusively-caucasian state yet. Meaning it hasn't been legalized in a state where there are many marijuana arrests.

I'm not exageratting... I've never met a caucasian person who's been arrested for marijuana posession. _Never_. And yet here in NYC alone, on the order of 50,000 people (almost exclusively of color) are arrested every year for marijuana possession. This gives them a record. This means they can't get jobs or take financial aid.

This Cato report, quite frankly, is a painfully long bore that ignores the dynamics at play that make Colorado, Washington, Oregon and Alaska uniquely atypical test-beds.

<comment><USER7> The Cato report unfortunately did not go into arrests. It may seem like stating the obvious, but from what I see, that's one area where there legalization _has_ been significant impact. Even in states like Colorado which are less racially diverse than some, arrests have decreased a lot and court filings have plummeted. (See: [http://cdpsdocs.state.co.us/ors/docs/reports/2016-SB13-283-R...](http://cdpsdocs.state.co.us/ors/docs/reports/2016-SB13-283-Rpt.pdf))

A policy which has no significant impact, except to stop law enforcement from wasting time on trivialities, is fine by me.

</comment></comment></comment></comment></comment><comment><USER8> I would express the same sentiment about illegal immigrants. This is to all the people who support Donald Trump's rhetoric about deporting all 11 million undocumented immigrants. These people fled the drug gangs and violence that our war on drugs helped create (think fleeing ISIS) and came to work jobs no one else would take and make a better life for their family. Yes technically they broke a law.

If you're going to argue that we as a country of laws should deport them all back, then I hope you and your family never smoked pot because you broke a law. And since we are a nation of laws - including minimum sentencing laws which the prison industrial complex loves - how would you like it if they looked for you and put you in jail for a victimless crime? Drop your double standard. The Mexican immigrant is better than the potsmoker because they fled violence, wanted to make a better life for their family AND helped do the jobs no one else would. The potsmoker chose to smoke and helped no one except the drug dealers.

Plus we did that already, and it was a disaster: [https://en.wikipedia.org/wiki/Mexican_Repatriation](https://en.wikipedia.org/wiki/Mexican_Repatriation) \-- an estimated 1.2 million US citizens were deported. Plus until 1965, immigration was unrestricted from Mexico and Canada so many of the 11 million broke a law by staying, but not by coming.

You have heard all these myths. The fact is, immigrants have higher labor participation, lower crime rate than the native born population. Especially the illegal immigrants who are afraid of being caught by police and deported. Illegal immigrants do NOT get money from the federal government - if your city pays them take it up with your city. But they pay taxes like everyone else, including sales tax and property taxes. So they pay into the system and get nothing back. You want to deport them all and break up their families so you will end up picking crops, and think this is the way to bring jobs to USA?

<comment><USER9> > came to work jobs no one else would take

This is a particular piece of rhetoric I find distasteful. If there are jobs that are structured such that only an illegal immigrant, who by definition exists outside the normal labor pool and its protections, will take, that job should not exist in that form or at that pay rate. Full stop.

So the fact that jobs that "no one else would take" exist and are being taken by illegal immigrants _isn 't a good thing_. If you're in favor of expanded immigration, making that claim doesn't help your case. It substantiates the case that anti-immigration proponents have always made, which is that immigrants take the bottom out of the labor market and help keep salaries down.

After all, if nobody would take a job doing some particularly onerous job at a pittance per hour, then the employer would _have_ to pay more, or automate, or find a more efficient way of doing the job. Refusing to do these jobs is the _correct_ response when they are clearly undercompensated.

There are lots of people in the legal labor market who do terribly unpleasant, physically strenuous, or frankly dangerous jobs, but they typically (outside of illegal or exploitative markets) do them for reasonable wages. Someone who SCUBA dives in raw sewage or nuclear waste, for instance, is probably going to demand a fair compensation for the unpleasantness of the job. The same should be true with people who work in slaughterhouses or picking strawberries or tarring asphalt roofs. The narrative that "Americans just won't do" certain jobs is one that is created by cheapskate, exploitative employers who don't want to pay the market rate for particularly ugly jobs. Parroting it is water- carrying for these exploitative industries.

<comment><USER10> >> came to work jobs no one else would take

> If there are jobs that are structured such that only an illegal immigrant, > who by definition exists outside the normal labor pool and its protections, > will take

Typically, that statement also refers to jobs that are perfectly legal, but most Americans wouldn't take anyway. For example, many of the experienced people reading this wouldn't drive a cab, deliver pizzas, work as unskilled construction labor, a dishwasher or a janitor if they became unemployed. They'd continue to look for their next IT job. And they'd be choosy about that - not selling computers at Best Buy, for example.

(I'm not putting down those jobs; personally I respect any work.)

<comment><USER11> I've done almost all of those things before (general maintenance rather than construction, and I've never driven a cab) -- including retail sales at an electronics chain (Radio Shack before Best Buy was the thing) -- and would again if I didn't have better prospects elsewhere (with my experience and expectations of the future labor market, I don't expect to need to do any of those things again, but that's a different thing than being unwilling to consider it if there was a need.)

I suspect that's not all that uncommon here (well, maybe not having done as many of the less-skilled jobs you talk about, but not being unwilling if it was genuinely the best prospect.)

<comment><USER12> I have a feeling you are more like the average person here.

When the economy goes into a recession, or our current line of work is down sized; we take a chit job.

Only the elite can wait around until something palatable opens up.

My problem with people so desperate for money, is they come here illegailly, or just happen to somehow get some bogus paperwork by the federal government, and will do practically any job.

A large swath of American employers know they can use these people, treat them poorly, and make a better ROI in their particuliar business venture.

Construction trades--love them. It's gotten so bad, if I took my general contractor's licence out of non-op status, I honest don't know if I could be competitive without hiring the people who will work for minimum wage, or less.

("How do these workers manage to live on the U.S., if you pay them so little? They have different cultural norms than the average American. They see nothing wrong with bunk beds, and four, or more to a residential bedroom. Maybe the average American should get used to living like this; that's another debate.)

So basically, my gripe is certain employers are thrilled they can get away with underpaying their employees. If they do it shroudly, they can live the American Dream--nice house, happy wife, a bunch of spoiled kids.

There are so many business that use this business model.

I have very wealthy neighbors in Marin County. Yes, that liberal enclave north of San Francisco. Literally every landscaper on this block doesn't speak English, nor do most of the plumbers, and handymen. The DINK's like to gab, and a lot of the talk is just how cheap they get their jobs done. My next store neighbor literally brings two low wage helpers to Home Depot in her Mercedes. Their job is to follow her around, in her high heals, and carry her stuff to the car. Then they spend the rest of the day at her disposal. (I'm glad they are doing this job.)

In the end, it makes chit jobs hard to find when Americans are layed off, or fired.

Before we had this huge sector of society that will literally do anything, for practically noting; chit jobs were better. That was in the 80's, and 90's. By the 2000's it was over. They were here, and spoiled the low wage job sector even further.

That's where the anger comes in. It has nothing to do about Trumps claims of "Rapists--and sometimes, good citizens", etc.

<comment><USER11> > My problem with people so desperate for money, is they come here illegailly, > or just happen to somehow get some bogus paperwork by the federal > government, and will do practically any job.

Why have a problem with those people? To me, that makes about as much sense having a problem with the relative economic success of the United States, which is why the US has been (until the recent economic crisis) an attractive place for such people to seek to go.

Why not, instead, have a problem with the features of the system in the US that fail to address (or actively make worse) the social costs of such desperation, including, but not limited to:

(1) a legal immigration system with, in most immigrant visa categories, hard per-country numerical limits which are not aligned with demand, creating the incentive for illegal immigration (simply eliminating per country limits in most visa categories and assigning available slots from one global pool would vastly reduce illegal immigration; removing hard numerical limits and charging fees to mitigate the social costs of excess immigration beyond existing caps would reduce it even further _and_ allow surplus immigration demand to be a source of public revenue rather than a cost hole.)

(2) poor enforcement of labor rules, both where it comes to enforcing who-can- legally-work requirements, but also wage, hour, tax, and benefit rules (without poor enforcement on both sides of this equation, the _effect_ of illegal immigration on wages and working conditions would be far less, and the _draw_ for illegal immigrants would be far less.)

</comment></comment></comment></comment></comment></comment><comment><USER13> This is really interesting in light of the current political discussions:

"Until 1913 marijuana was legal throughout the United States under both state and federal law. Beginning with California in 1913 and Utah in 1914, however, states began outlawing marijuana, and by 1930, 30 states had adopted marijuana prohibition. Those state-level prohibitions stemmed largely from anti- immigrant sentiment and in particular racial prejudice against Mexican migrant workers, who were often associated with use of the drug. Prohibition advocates attributed terrible crimes to marijuana and the Mexicans who smoked it, creating a stigma around marijuana and its purported "vices.""

One century later, the prejudices haven't changed.

<comment><USER14> J. Edgar Hoover worked hard to demonize it and to make it a federal crime in the '30s with the aid of such laughable propaganda as Reefer Madness. It helped him justify the growth in power and scope of the FBI. (I hope it's not yet a crime to publicly say that the federal government or any of its agencies would use propaganda to promote their agenda....)

<comment><USER15> You may be thinking of Harry Anslinger and the Federal Bureau of Narcotics. He was mainly responsible for the racially motivated propaganda campaign against marijuana in the 1930's.

<comment><USER14> I think you're right. This reminded me of the classic Wild Man Fischer song, "I'm Working for the Federal Bureau of Narcotics."

[http://www.youtube.com/watch?v=Obn3mb_wQjs](http://www.youtube.com/watch?v=Obn3mb_wQjs)

</comment></comment></comment></comment><comment><USER16> The medical community in California is supportive of legalization:

 _California doctors' lobbying group formally backs marijuana legalization_

[http://www.sacbee.com/news/state/california/california- weed/...](http://www.sacbee.com/news/state/california/california- weed/article57799473.html)

 _After backing Gavin Newsom, California nurses group gets behind pot legalization_

[http://www.sacbee.com/news/politics-government/capitol- alert...](http://www.sacbee.com/news/politics-government/capitol- alert/article104553351.html)

</comment><comment><USER17> Hooray for the scientific type approach of trying drug policies and studying the results. I'm ambivalent about marijuana legalisation and the results look fairly neutral but there are other policies like prescribing heroin like drugs to addicts so as to cut out the pushers, thefts and deaths through bad drugs that could probably save thousands of lives. I hope those get some experimentation and testing too.

There's a small scale experiment here [http://health.spectator.co.uk/the-case- for-prescription-hero...](http://health.spectator.co.uk/the-case-for- prescription-heroin/)

Excerpt:

>Inspector Michael Lofts studied 142 heroin and cocaine addicts in the area, and he found there was a 93 per cent drop in theft and burglary. 'You could see them transform in front of your own eyes,' Lofts told a newspaper, amazed. 'They came in in outrageous condition, stealing daily to pay for illegal drugs; and became, most of them, very amiable, reasonable law-abiding people.' He said elsewhere: 'Since the clinics opened, the street heroin dealer has slowly but surely abandoned the streets of Warrington and Widnes.'

<comment><USER18> You might find reports about just this from Switzerland. Zurich started as early as 1994 with a program, which provides clean drugs, and safe places to take them, to proven addicts.

It's been quite a success and the program is now nation-wide and backed by laws.

</comment></comment><comment><USER19> Maybe it was buried in there but what I didn't see is a graph showing the amount of money spent on dealing with marijuana related crimes that is now going to other crimes.

They pointed out crime didn't go down. Fine. All that could mean is that the police etc focused on other crimes instead of the mostly victim-less marijuana crimes from when it used to be illegal.

Even if expenditures on crime don't change the fact that whatever money that was being spent catching, processing, and incarcerating marijuana users and dealers can now be spent on something else seems like a huge win

<comment><USER20> I suspect that police forces would be loath to unbundle any statistics about marijuana-related crimes because they are going to resist any potential budget cuts from that, and correspondingly, it will take a while for any savings to materialized because of organization resistance.

</comment></comment><comment><USER21> A contrasting report: [http://www.rmhidta.org/html/2016%20FINAL%20Legalization%20of...](http://www.rmhidta.org/html/2016%20FINAL%20Legalization%20of%20Marijuana%20in%20Colorado%20The%20Impact.pdf)

There are indeed significant changes in some marijuana-related statistics. The Cato institute report has selected indicators that are relatively stable and do not show these effects. It does not discuss the limitations of the data, discuss data sources that were considered but not used, or include illustrative anecdotes. It can be summarized as "we carefully picked these graphs that didn't show anything, and we still can't rule out any effects of legalization".

<comment><USER22> Looks like this report deliberately chosen negative stats and use of non zero y axis in some graphs made me cringe as well.

<comment><USER21> Right, they clearly set out to prove that marijuana should not have been legalized. But from my perspective, the lack of convincing statistics is more convincing than the Cato report's lack of any effect at all.

</comment></comment></comment><comment><USER23> So, half the hn crowd see this report as a partisan biased attempt to push legalization, and the other half see it as a partisan biased attempt to suppress legalization...

<comment><USER24> Given the Cato Institute is a libertarian policy think tank, I'm not sure how the second group would maintain that idea.

</comment></comment><comment><USER25> I like this, an honest analysis.

One major argument about crime I didn't see addressed was the revenues going to organised criminal gangs before and after.

I'm also not sure about the paper's claim that advocates claim a fall in crime, in general, from Cannabis legalisation. I can see the argument that decriminalising and medicalising heroin addiction may decrease various forms of crime, particulary acquisitive crime. But with cannabis?

<comment><USER26> Many people get ground in the gears of the criminal justice system in the U.S. with charges of marijuana possession. In my state, sharing with a friend can get you hit with a possession with intent to sell or deliver charge, which is a felony.

A felony conviction almost guarantees you'll do time. You will go to jail. You will probably lose your job and have trouble getting a new one. Life changes in significant ways. But in jail, you will have met people, and those people may have opportunities for you. Some people decide that since they already have a criminal record after that first conviction, they might as well take risks to get by.

Let me be clear about this. I'm not saying marijuana criminalizes people. I'm saying outlawing marijuana criminalizes people. And it's easy for me to believe that legalizing marijuana is likely to result in an overall fall in the rates of incidence of other types of crime.

<comment><USER25> Oh sure, I agree wholeheartedly. I was just a bit concerned about the 'pro- legalisation' claims they examined. Specifically they look at the claim that decriminalising MJ would reduce crime (presumably other than possession/intent etc related to MJ). It seemed a bit straw-man ish.

Yes, what you describe is a travesty and needs to be writ large - <USER2> may not change much _but it does reduce the number of people who get their lives ruined by the state for no good reason_

</comment></comment></comment><comment><USER27> Interesting! I'm from California but haven't lived there in ten years and I thought marijuana was already legal there. Turns out that it's only _medicinal use of marijuana_ that is legal (2010), but there is a ballot proposition for wider legalization on the upcoming November, 2016 elections.

[https://ballotpedia.org/California_Proposition_64,_Marijuana...](https://ballotpedia.org/California_Proposition_64,_Marijuana_Legalization_\(2016\))

<comment><USER28> California's medical use law is a little special, though, in that it has language allowing usage if it will alleviate suffering from any condition in any way. Everyone has something, however small, so it ends up being a de facto legalization with a hoop to jump through.

That said, I fully expect the upcoming initiative to result in recreational legalization. It was a near miss on the last shot a few years back, and the political climate is significantly friendlier now.

</comment></comment><comment><USER29> tldr; "The data so far provide little support for the strong claims about legalization made by either opponents or supporters."

<comment><USER30> As long as you ignore the whole tax revenue part.

<comment><USER31> Exactly. By skipping over the huge $$$ profits this article reveals itself to be pretty disingenuous.

<comment><USER32> I think we shouldn't base our arguments for legalization on tax revenues. I hope the tax revenue will go down as more states (I hope) will legalize.

I oppose the use of sin taxes to fund our government. I hope most people would agree with me on that.

<comment><USER11> I actually think that taxes functioning as user fees on things with significant social costs is the ideal policy approach to internalize the externalities at play.

<comment><USER32> OK so let's start with a "jackass tax". People who act like jackasses and end up in the emergency room for things like "hold my beer and watch how quickly I'm going to climb this tree". Then progress on to people who have children. Children cost a lot of money to the society.

We can't even agree on cap and trade which is so watered down that it essentially gives polluters a free pass. Can we really have a serious discussion about 'user fees on things with significant social costs"?

Maybe we ought to disincentivize marijuana use. I agree. I don't know what to do with that money. However, I strongly believe that we should not take that money and use it for anything beneficial to the society or to the tax collector. Doing so will mean we will no longer disincentivize what we said we'd disincentivize. It just becomes a tax on a minority.

</comment></comment></comment></comment></comment></comment><comment><USER33> I would have been nice to see the trends compared to states without any legalisation, but other than that it's a good analysis.

</comment><comment><USER34> I don't see any statistics on arrests for marijuana possession and sale. Of course, legalization must reduce arrests for possession. But comparison with property crime would be interesting. And I presume that there will be long- term social and economic benefits of keeping people out of the criminal- justice system.

</comment><comment><USER35> I wish they would have shown comparisons to other states that didn't legalize as opposed to trying to draw conclusions based on the same states prior performance. In some of these cases where legalization didn't cause significant increases, how does this compare nationally?

</comment><comment><USER36> The effect on local businesses has been very positive in my area (southern Oregon). I'm not sure about the government. Honestly I don't think they would allocate the money in the best way. We have a state employee retirement program that is in the red billions of dollars, I suspect that is where the money will go to first.

</comment><comment><USER37> Are traffic accidents categorized under 'crime'? Didn't we read here recently about the rise in fatal collisions due to impaired drivers? How does that factor into the analysis?

<comment><USER38> The stat is not for 'impaired' drivers. Due to the testing procedure used, which lacks accuracy in the time domain, the stat is: 'has used cannabis this month.'

More people are able to use cannabis when it is legal, so this number would be expected to increase.

</comment></comment><comment><USER39> Thanks for sharing, very interesting stuff. The more unbiased studies we have like this the better.

<comment><USER40> I wouldn't refer to the Cato Institute as anything but biased, as it's a neo- con libertarian think tank funded by the Koch Brothers but this particular study is fascinating simply because it IS a neo-con libertarian think tank funded by the Koch Brothers.

<comment><USER41> Neo-con libertarian? What evidence do you have to support the claim that Cato is neo-con?

Wikipedia cites Cato as being critical of neo-con foreign policy and the Iraq War.

[https://en.wikipedia.org/wiki/Cato_Institute#Libertarianism....](https://en.wikipedia.org/wiki/Cato_Institute#Libertarianism.2C_classical_liberalism.2C_and_conservatism)

[https://en.wikipedia.org/wiki/Cato_Institute#On_foreign_poli...](https://en.wikipedia.org/wiki/Cato_Institute#On_foreign_policy)

Do you know what neo-con means? Serious question

<comment><USER42> I'm not terribly surprised that someone would think "neo-con" and "libertarian" were near synonyms. A lot of people seem to have it in their head that libertarians are just hardcore conservatives (and for some reason think neo-con just means an extremely conservative person).

</comment></comment></comment></comment><comment><USER10> Know your source: Cato is an advocate for libertarianism, at least as envisioned by its funders, founded in part by Charles Koch, and still heavily funded and controlled by him (and I think by his brother).

I don't mean that in a partisan way; you might love them, hate them, or not care one way or the other, but it's always useful to know who is talking.

<comment><USER43> Libertarianism, as envisioned by the Koch brothers, is AMAZING when you're rich. You simply remove all government functions that protect the poor from the wealthy, and re-create feudal Europe. What's not to love???

<comment><USER44> I have to ask: have you ever looked at the Koch brothers' actual views?

Because I have a hard time reconciling your strawman description with [http://www.thedailybeast.com/articles/2015/01/13/koch- bros-t...](http://www.thedailybeast.com/articles/2015/01/13/koch-bros-to- bankroll-prison-reform.html) as just one example. Or [http://www.washingtonpost.com/sf/national/2015/08/15/clemenc...](http://www.washingtonpost.com/sf/national/2015/08/15/clemency- the-issue-that-obama-and-the-koch-brothers-actually-agree-on/) or [http://cjonline.com/news/2015-10-15/forfeiture-reform- aligns...](http://cjonline.com/news/2015-10-15/forfeiture-reform-aligns-likes- billionaire-charles-koch-aclu) for that matter. Those are not rich people problems they're trying to address there... In fact, I would argue that in the area of criminal justice they are _precisely_ trying to do more to protect the poor from the wealthy.

Now I agree that on some issues they do want to remove government functions that I would prefer remained in place. But that's not the sum total of what they're doing, and while I disagree with them rather strongly on a lot of their views and preferred policies I agree with them quite strongly on some others. As does the ACLU, and our current president, for that matter.

<comment><USER10> There are equally strong objections to their attempt to dominate the political system by spending billions of dollars, from the local to the national level on an extensive range of elections and organizations.[0] At one point, they were planning to spend approximately as much as the Republican Party on this election cycle (they don't seem to like Trump, so maybe they backed off a little, but I don't know).[1]

Why should two voters have so much more influence than 310 million others? It's anti-democratic.

I also think this the parent post presents an overly-moderated depiction of their views - but I'm too busy to look it up myself right now.[0] Certainly the existence of a few things I agree with among their extensive activities wouldn't mean much.

[0] Wikipedia, which I wouldn't put much faith in:

[https://en.wikipedia.org/wiki/Political_activities_of_the_Ko...](https://en.wikipedia.org/wiki/Political_activities_of_the_Koch_brothers)

and: [https://en.wikipedia.org/wiki/File:A_Maze_of_Money.png](https://en.wikipedia.org/wiki/File:A_Maze_of_Money.png)

[1] [http://www.usatoday.com/story/news/politics/2015/01/26/koch-...](http://www.usatoday.com/story/news/politics/2015/01/26/koch- brothers-network-announces-889-million-budget-for-next-two-years/22363809/)

<comment><USER44> > Why should two voters have so much more influence than 310 million others?

Our political funding system is broken, I agree. So is our general electoral system: elections are _way_ too long, which makes them more expensive, of course.

> I also think this the parent post presents an overly-moderated depiction of > their views

By no means am I saying that everything, or most of, or a large part of, what the Koch brothers do or think is good. I'm just saying that the claim that all their political activity is guided by the basic principle "let's see how much we can screw poor people" is a caricature, and not a terribly accurate one, and providing one simple counterexample.

I'm not asking you, or anyone else, to like them personally, the sum total of their activities, or any particular activities. All I'm asking for is that we don't jump from "these people are doing a bunch of stuff I disagree with" to "these people are pure evil, so anything they do must be evil, hence anything they are involved in is evil by association and must be fought against". Unfortunately, this last bit of reasoning is far too common in politics recently, all across the political spectrum. Just like the related "This organization is good, so whatever it does must be good" line of reasoning that seems to be so common... and usually indicates that the organization should be terminated before it does some serious harm. :(

<comment><USER10> I agree, caricatures and knee-jerk reactions are not useful and not informative. It prevents finding common ground, which is essential to democracies moving forward (a good thing - I want my fellow citizens, even those who disagree, to have a say).

</comment></comment></comment></comment></comment></comment><comment><USER45> New rule suggestion. You must argue at least one flaw in the study or article before pointing out the source may be biased.

<comment><USER46> Why? Many of the flaws that jump out at me are not so significant that they would be worthy of concern on their own and I appreciated other people clarifying the group's affiliations(I probably wouldn't have been curious enough to go back and read a bit more otherwise).

Though honestly if this is a scientific study it is very strange that they omitted their methodology entirely(how did they select the data, how did they compare the statistics before and after, how did they account for confounding factors, etc). That is pretty fundamental to this kind of analysis and in its absence I would be hesitant to put much faith in even their weak conclusions.

The graphs themselves are definitely interesting though and I would not at all be surprised if they were on the right track.

<comment><USER47> If they jump out at you, it should be trivial to argue them, right?

Thus the rule is no real obstruction to dialogue.

Lack of methodology is a valid argument, as opposed to just pointing out the funding. Why not contact them about it? Or perhaps they have used some base sources, which could be made available to make their argument even stronger when exposed.

</comment></comment></comment><comment><USER48> it would of been nice is they contrasted the "no rise in serious crime" with the number of drug related arrests.

for me the biggest reason to have gange legal is it frees policing resources up from processing fairly ridiculous prosecutions of people dealing in what is basically just plant material.

so while it is nice to see there is no real impact on "other crime" the fact they missed the impact of freeing up resources directly related to weed is a major ommission.

and also.

god damn you americans pay a lot for it. $250 an ounce. that's ridiculous. like more than three times the price I used to pay as a teenager for prime amsterdam skunk.

<comment> saiya-jin prime amsterdam stuff in official coffee shops is pretty expensive these days. it's also so powerful that unless you are regular die hard pothead, it might be too much to handle and enjoy.

<comment><USER48> [http://www.amsterdamcannabis.co.uk/amsterdam-coffee- shops/](http://www.amsterdamcannabis.co.uk/amsterdam-coffee-shops/) The general prices range from about €6,- (£5.13) to €11,- (£9.41) for a gram of weed or hash.

->28.3495 grams in an ounce

Prices in the coffee shops range from about €168/$188 to €280/$340 an ounce.

So yeah - gotta agree with that "pretty expensive" in the same way US at $250 an ounce is expensive.

iirc we used to pay around $50 for a half ounce of green (Been a decade or two since I bought any though), or 9 ounces of resin was $325

I was in Egypt a month ago or so and they were trying their luck at $25 a gram.

I wonder how long until wholesale prices pop up in the commodities indices :p

</comment></comment></comment><comment><USER49> Turns out both sides were right, but also wrong, so they basically cancel each other out.

</comment><comment><USER50> Someone was telling me recently that all the cheap heroin influx into the country from Mexico was the result of drug cartels losing market to marijuana and needing to come up with a cheap competitor substitute. Not sure if that was accurate or not but sort of sounds intuitive in an economic sense.

I'm still surprised how marijuana posts are so frequently pushed in HN. My take is that the effect is negative, I've seen just a ton more brazen usage out in public once this thing hit with a bunch of phony Dr prescriptions given to perfectly healthy people. It's all a ruse in my book, you're either growing in virtue or backsliding. At best drug use is suboptimal for a thriving philo- generative culture to borrow Daniel Hannan's phrase.

<comment><USER51> Public usage can and should be managed locally as another topic though don't you think?

As far as recreational use, fundamentally, should it be the responsibility of the government to tell you what you can and can't ingest?

I don't think it is. I think sin taxes are stupid too. But I do understand drug usage is a concern and suboptimal for a lot of people. I don't smoke nor have I ever tried it, except for one cigar.

I'm asthmatic and I didn't like people smoking cigarettes in public places because smoking sections back in the day weren't contained. Now - smoking is generally considered uncool and it's hard to do in most public places. I've been to smoke free cities which is their right and I think that's how it should be.

Whatever side you're on - the evidence doesn't back up all the claims to keep it criminal.

<comment><USER52> > sin taxes are stupid too

They do work for health benefits though. Tax on tabacco for example does limit the number of people who smoke, which does in turn limit the number of people with cancer and public spending on helping them.

Same for sugary drinks tax and obesity.

<comment><USER53> Actually reducing tobacco use can increase public spending on health. Lung cancer tends to take people out pretty quickly, while those who live longer run up higher costs.

(that said, I tend to be "pro sin tax")

<comment><USER47> Lung cancer caused by smoking took about a generation to show up in the statistics. That's very much the converse of "takes people out pretty quickly".

That said, most drugs that are schedule I have much more immediate side effects.

<comment><USER53> That's not what I meant by "takes people out quickly." I mean that once someone gets symptoms of lung cancer and needs health care as a result, they die more quickly than someone who is starting to see the symptoms of old age and needs health care for that.

I.e. someone who dies at age 60 from lung cancer is less cost to the system than someone who live to 95 and dies of "natural causes."

That's not saying lung cancer is good, but it is saying that reducing health care costs is not a good reason to try to reduce smoking.</comment></comment></comment></comment></comment></comment>


21-year-old Woman Loses Eyesight After Staring at Her Smartphone Game for Days - <AUTHOR> http://mashable.com/2017/10/09/china-honour-of-kings-blind <comment><USER2> After, but not because of. It was a blood clot. Can happen to anyone at any time.</comment>


Nvidia halts self-driving tests in wake of Uber accident - <AUTHOR> https://www.reuters.com/article/us-autos-selfdriving-nvidia/nvidia-halts-self-driving-tests-in-wake-of-uber-accident-idUSKBN1H32E0 <comment><USER2> Doesn't uber use nvidia? If so, this doesn't bode well for nvidia, it implies a link between the crash and nvidia's piece of the rig.

<comment><USER3> This is exactly why they're doing this.

Not too long ago, Nvidia was bragging with "Level 5" [1] self-driving hardware, even though at the time the company still didn't have a proper answer for _why_ its hardware can be classified as Level 5, and not just Level 4 (just being X times better than the previous generation is obviously not enough).

Since then, I saw they've pulled back their targets a bit [2], and are claiming Level 4 around 2021, and Level 5 in 2025+, which even surprised me that they thought it's going to take that long (longer than most techies would have expected, for sure). And that was _before_ the Uber accident and having to stop this testing. My guess is the Uber accident pushed the Level 5 arrival by another few years at least.

I've also said not too long ago that companies like Nvidia and most car makers are all in too much of a hurry to "one-up" each other and be the "first with Level 5", which only made me _more_ suspicious about their capabilities.

It was starting to feel like 2011/2012 all over again when carriers were claiming "4G" wireless capability, even though some were still on HSDPA+ or weak WiMax speeds. Of course they did. What mattered most was to _claim_ that they have that tech, not that they actually had it. It's no different this time, especially with all the deregulation being given to the self-driving car companies on a silver platter.

My point is I never believed these cars makers were anywhere close to Level 5, just like I never believed Tesla when it was making its Autopilot sound so much more advanced than it really was. These companies have exactly the kind of incentive that would get them to lie/be misleading about how good their tech actually is.

[1] - [https://nvidianews.nvidia.com/news/nvidia-announces- world-s-...](https://nvidianews.nvidia.com/news/nvidia-announces-world-s- first-ai-computer-to-make-robotaxis-a-reality)

[2] - [https://blogs.nvidia.com/blog/2018/01/25/whats-difference- le...](https://blogs.nvidia.com/blog/2018/01/25/whats-difference- level-2-level-5-autonomy/)</comment></comment>


Concerns about Kubernetes Community newcomers - <AUTHOR> https://groups.google.com/d/msg/kubernetes-dev/k58OyLT4wAU/JT7c50AfBAAJ <comment><USER2> Out of curiosity what actually happened?</comment>


Notepad++ v7.8.9: Stand with Hong Kong - <AUTHOR> https://notepad-plus-plus.org/news/v789-stand-with-hong-kong/ <comment><AUTHOR> First thanks. And not like NBA and Disney I guess. Purely from the heart. Still it is a surprise. Given it is always the 2nd thing to download in windows (the first is chrome, sorry edge), I feel very very grateful to this.

From the fallen.</comment>