What's Happening with Bitcoin Prices - <AUTHOR> https://medium.com/@kristopolous/heres-what-s-happening-with-bitcoin-a4a11e0f835b <comment><USER2> > Ever wonder why Coinbase takes about a week to "process" the sell?

I've actually always wondered this. What were to happen if the moment I click _Sell_ , the price is $10K but when it's "processed", the price at that time is $1...would the USD I receive be based at time of click or time of processing?

<comment><USER3> There is not one single price, but many offers at different prices and volumes. The exchange doesn't sell or buy bitcoins, they just connect sellers and buyers (and handle the transactions). The price you see is the best current offer for the amount you are selling, I think. Usually, it changes a little, but yeah you are not guarenteed that price. If, at the time your order comes in, nobody wants to sell for $10K, but only $1, that is what you get.

This is why most (all?) exchanges have the option of buying/selling at market price ("best" price, I could imagine there is some protection included though so the order doesn't go through if there is more than X% price difference), or with a limit (where you say "sell X BTC, but I want at least $Y per BTC).

<comment><AUTHOR> They do at least a 0.5% spread + 1.5% fee. So the price listed if you are buying, it's at least 0.5% higher and if you're selling it's at least 0.5% lower. Which means if you're trying to "flip" as in buy low and sell high, you need to see at least a 4.1% or so increase to just break even. Sometimes their spread will be over 1% in both directions.

Btc usually operates in practice on a 0.5% spread or less.

There's a reason why the only name we know from the gold rush is Levi Strauss. The real money is in the facilitators of the rush, not in the prospecting.

</comment></comment></comment><comment><USER4> Anyone speculating about what's going on with Bitcoin without at least mentioning Tether is out of the loop.

<comment><USER5> I'm out of the loop. What's the deal with tether?

<comment><USER6> Issue Tether (it is issued, not mined), trade Tether for Bitcoin, BTC price in Tethers increases, due to stated and believed peg of Tether to USD, BTC raises in USD price due to arbitrage executioners.

More details:

[https://seekingalpha.com/article/4129543-bitcoin-one-way- go-...](https://seekingalpha.com/article/4129543-bitcoin-one-way-go- true#/comment-76992585)

<comment><USER7> Failing to understand how you could peg Tether to the USD and have people believe you. I was under the impression that pegging to a currency is something only a _very_ big player, with close to unlimited resources can achieve, see People's Bank of China, Swiss Bank etc. Among others, you have to defend the currency against speculators and that requires a lot of capital.

Even the Bank of England failed to maintain the peg to the German Deutschmark some years ago. Can someone with more knowledge in the FX market area explain this better?

<comment><USER8> You can peg tether to the usd simply by offering to always exchange one tether for one usd and vice versa, no?

<comment><USER9> The problem is, sonfar they issued north of 800m with no proof of reserves, and no professional audit to support their claims.

<comment><USER7> That s the thing I don't get, how do they "issue" tether? Because if one says they peg it to the dollar then it must follow the dollar's inflation. Otherwise somebody is at a loss because there s more tether value than usd or viceversa, even if they were fully transparent and fair.

Edit

Unless of course tether is not a store of value in any way and just a fancy name for a dollar.

<comment><USER9> The way it works is, i go to exchange a, and tell them hey i have this cryptocurrency and i have enough cash to back it up. People can withdraw money from me using these.

If you do not verify my claims, you think this is a great idea, because now you can transact with usd(t). Formally these exchanges only used cross-coin exchanges.

Now this is not a problem as long as you have _enough_ money to support withdrawals on an ongoing basis. Nobody knows you dont have enough cash to support all issued tokens, because seemingly, everything works nicely. With the recent hype, money keeps flowing. Until a mass withdrawal happens.

<comment><USER7> But why do I want tether in the first place? Why bother switching back and forth at all? I don't see why would I want to hold tether.

Can I buy a can of coke with it directly? What if the coke seller is a bit skeptical of tether and asks for 1.2 tether instead of one usd, just to play safe. Isn t this pressure applied to the exchange rate?

<comment><USER9> You mean, instead of USD? Because most exchanges cannot and does not support withdrawals - they are virtual.

<comment><USER7> But every tether "issued" is basically a dollar printed out of thin air if we're to trust Tether that it has the same value isn't it?

> Because most exchanges cannot and does not support withdrawals - they are > virtual.

Can you elaborate? I'm not familiar with these exchanges, really curious. You mean exchanges accept cash for coins and don't allow withdrawals? :)

<comment><USER10> He means they don't support withdrawals of fiat currencies like USD or EUR. Many crypto exchanges only support withdrawal of crypto currencies.

To allow deposit or withdrawal of fiat, exchanges tend to have to comply with international banking regulations, which requires a great deal of paperwork. As a result, only a few exchanges offer this - examples are Coinbase, Bitstamp, Bitfinex, Kraken.

Before Tether existed, you couldn't buy or sell dollars or Euros on a pure crypto exchange. That's a big limitation.

Among other things, Tether allows you to trade in USD on these crypto-only exchanges.

Basically, one problem Tethers solve is allowing exchanges to operate more completely without regulatory oversight. As such, the limitations in their transparency may be acceptable to many users, who know that they're not operating in a regulated market and are willing to accept some risk for doing that.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> In case someone is wondering about Tether, there has not been new coins for about a week now:

[https://omniexplorer.info/lookupadd.aspx?address=3MbYQMMmSkC...](https://omniexplorer.info/lookupadd.aspx?address=3MbYQMMmSkC3AgWkj9FMo5LsPTW1zBTwXL)

<comment><USER12> Interesting. What happens if, say, Bitfinex runs out?

<comment><USER11> Runs out of what? If you mean Tether. They can keep doing "grant token" as long as they want.

I will be publishing a blog on the market schemes of different token soon as there seem to be a lot of hype.

<comment><USER12> The difference between "new coin" and "grant token" is eluding me here.

<comment><USER11> "Grant token" is the command for generating new token/coin.

<comment><USER12> OK. Maybe i am assuming there have been no new Tether tokens because the "granter" decided not to grant anymore, but it has actually been a market response?

I am wondering... if they can grant new tokens, why havent they? Lack of demand?

<comment><USER11> Maybe market response, maybe due to increase focus from people on the "granter" account. It can be n-number of things.

<comment><USER12> I understand. Thanks. I was assuming things!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Bitcoin succeeding is a very bad thing for the banking cartel. Is it possible that some big powers are ramping it up so they can crash it violently?

<comment><USER9> Every crash is followed by another rise.

The idea is out. Bitcoin may die, but another will thrive.

<comment><USER13> Perhaps, but an epic crash of the most well-known brand, a death spiral in investor confidence and the ensuing media reports would kill not only Bitcoin but potentially any other cryptocurrencies. Legislation could follow to block or at least pigeonhole any other crypocurrencies into a really niche market.

</comment></comment></comment><comment><USER14> [https://99bitcoins.com/obituary-stats/](https://99bitcoins.com/obituary- stats/)

<comment><AUTHOR> Thanks, this is about general markets however. I've been trading BTC since 2011.

Doesn't matter if it's tulip bulbs, baseball cards, bitcoins, houses, or dotcom companies, markets operate on similar principles and talking about the market dynamics doesn't say anything about the asset in question. Cryptocurrency is a viable means of exchange and the technology is great and all but that doesn't change the rules or mechanics of the marketplace. It isn't magic.

<comment><USER14> Personally I inclined to trust Ronnie Moas who likes saying this about BTC:

>>if you try to trade this you WILL get smoked; charts are bullshit and do NOT apply here; stop jumping on and off the train, you look foolish

But at the same time investing only the funds that I can afford to lose.

</comment></comment></comment><comment><USER15> "Ever wonder why Coinbase takes about a week to "process" the sell? Or why when you buy on other exchanges you're debited instantly but when you sell it takes a few days to be credited?"

"It's mostly likely because these institutions don't have the liquidity to actually pay you. The important thing to realize is the exchanges aren't selling the Bitcoins on the open market nor are they transferring anything between wallets when you sell.' "

Anyone here know if this is true?

The article is based on the above assumption. If it is Ian selling my bitcoin NOW. THIS IS THE BIGGEST RISK I HAVE HEARD IN THE CRYPTO WORLD

<comment><USER16> I mean, the exchanges aren't selling, sure, but it is a market... so when you sell your bitcoin someone is putting up cash to buy it. I mean unless I don't understand how these exchanges are functioning.

I have no idea why it takes a few days to process, however. I don't think the fact that it can take a little while to "process" sells is because it's a ponzi scheme though, that seems like a bit of a jump. I mean plain old ACH transfers take a few days, does that mean that ACH is a ponzi scheme?

<comment><AUTHOR> I'm not claiming any of them are. On the contrary, I'm saying there's a risk that some of them could be partially operating like this and if they were, you wouldn't be able to tell.

This is high risk. No kidding.

<comment><USER16> I guess. They could also be inventing the buy side entirely and just taking people's money. They also could be Nigerian princes who just really need my SSN to access their family inheritance.

I still don't think selling "taking a few days" necessarily is evidence that there is a ponzi scheme going on, though.

When I sell equities in my Schwab account, it takes two days to access the cash. I'm pretty certain Schwab isn't running a ponzi scheme.

<comment><AUTHOR> The idea is unlike having coins in a personal wallet, on an exchange you effectively just have a claim card placed with a central authority. It's put trust and centralization back into the system.

The claim card only needs to be satisfied when claims are made. Detaching the claim from the asset and then reattaching when claims are made IS how the exchanges work fundamentally.

Having 100% of the liabilities here is certainly possible but if you had only 20% of them, there'd be effectively no difference unless there's a market panic.

And when/if that happens, I bet that not all 124 or so exchanges have 100% of their liabilities on hand at the same time as the panic.

</comment></comment></comment></comment></comment><comment><USER17> I think the explanation is really simple. A couple of months back numerous non-technical acquaintances began expressing interest in Bitcoin with a number of them going on to purchase it -- completely independent of one another. I doubt my anecdote is particularly unique. There seems to have been a huge influx of "dumb money" on the heels of an exponential increase in media coverage.

There is the possibility that I'm reversing causality here. In other words that the media coverage increased following the increases in bitcoin, rather than the opposite as I'm suggesting. But Google Trends along with the price graph seem to support my suggested causality:

[https://trends.google.com/trends/explore?q=bitcoin](https://trends.google.com/trends/explore?q=bitcoin)

[https://www.coindesk.com/price/](https://www.coindesk.com/price/)

This just seems to be a huge influx of dumb money. If this is true, it's going to lead to some interesting near future volatility. These sort of investors are going to be more inclined to jump ship at what would normally be the tail end of swings. They will see it as ' _the_ crash', race to get out, and create a self fulfilling prophecy. Perhaps offering a great time for investment for anybody who can accurately determine when the double dip decline is bottoming out before a return to normalcy.

<comment><USER18> Pretty much all of the money in Bitcoin was dumb from the get-go. These weren't economists figuring out that something was under-valued or the system could be gamed. It was people gambling back then and that's what's continuing to happen.

Like you, I noticed an increasing amount of fairly oblivious people talking about Bitcoin a while ago in our office and that's the most certain marker of an impending crash, but in terms of there being smart money outside of huge investors in the earlier days of Bitcoin I disagree. Developers that like to gamble are not smart investors.

<comment><USER17> I think there's major inherent value in Bitcoin. Or at least was. I enjoy traveling and it's quite the pain with traditional banking. It ranges from the small things like facing account locks (even after informing the bank you'll be traveling) which take days to clear up, to getting absolutely gouged on access to your money. If you want quick access to your own money then you'll be facing artificially weakened exchange rates, fees on said exchange rate, and then fees on top of fees because fees. To get reasonable access you need to wire money which comes with annoying hassles, paperwork, delays, and then you better hope you're not trying to get access to your money during the weekend or a bank holiday.

And then the banks themselves also face countless rules and regulations which result in more hassles to consumers. Happen to keep depositing just below $x for whatever reason? Welcome to a suspicious activity report (for fear you may be trying to dodge financial accounting reporting regulations) and having all deposited funds confiscated until you spend tens of thousands of dollars proving yourself innocent, because in finance innocent until proven guilty apparently doesn't fly. And that's of course just one example among countless.

The current monetary system is pretty much awful. I thought (and think) Bitcoin is the start of a change to this. In other words that it has inherent value. The limits of that value are now being shown as transactional fees get crazy, but the point of this is that I don't view Bitcoin as an arbitrary commodity. It is a decentralized financial service.

<comment><USER18> I think there is major inherent value in a decentralized currency and I think the technology is neat. There will be more practical value in Bitcoin after the crash when the speculative value has stopped being a factor.

</comment></comment></comment></comment><comment><USER11> As much as I think there _might_ be a crash, so many things are wrong here:

> They don't do technical analysis or are savvy enough to place limit orders.

I agree on limit orders but what is the fascination with TA. Not a day goes about where someone in cryptocurrency uses some kind of chart mumbo jumbo to prove a point.

> Ever wonder why Coinbase takes about a week to "process" the sell?

Simple answer - Settlements. Banks are not very fast. If someone was to refund you now, you don't get the money in a day. They will always say, "money will be credited back to you in 2-4 days".

There are so many additional reasons for this:

1\. Security. The amount of non-technical people going on the exchange is huge. So they don't know if the sell was the right one or not.

2\. KYC - They need to ensure the buyers are following AML laws to ensure they don't get sued later for helping drug dealers.

3\. Volume - The sheer volume of transactions which need to processed, specially with KYC confirmations.

4\. Settlement - They can only pay someone if the buying party has sent the money to them.

5\. Banks - Banks always know who is crediting the money. They might have put extra checks for money coming from Coinbase, not to slow Coinbase down but again to save their asses.

etc.

> Closing shop for a bit

The logic on this is so convoluted. If they keep the public price API is fast because it doesn't need to handle additional requests. It is a simple fetch.

Additionally, if they keep the price API open it is just providing ammunition to detractors.

Have you ever been in a stock market crash? Try that, your broker will freeze up and stop responding. You will have a public price API to know what just hit you.

<comment><AUTHOR> Sure, there's honest and upstanding ways of explaining all of this. But there's also billions of dollars being exchanged on opaque markets every day so there's also the usual suspects that brings with it. In valley units, that's a unicorn startup every hour.

Go check, [https://coinmarketcap.com/currencies/bitcoin/](https://coinmarketcap.com/currencies/bitcoin/) $24.1 billion in the past 24 hours

<comment><USER11> And....your solution is to write an article claiming this is fraud?

So, if I use your logic - there is no disclaimer/disclosure on your holdings ie there is opaque-ness. Hence, you have written this article to try and spread FUD to cause market panic.

There is no room for honest and upstanding way to explain your actions.

<comment><AUTHOR> Sorry if you read it that way. I was interested in talking about risks and what _could_ be happening, not claiming anything as true. It's both within the range of possible and has historical precedence.

</comment></comment></comment></comment><comment><USER19> Take your best guess when Bitcoin will fall of the cliff: [https://twitter.com/BitcoinPlunge](https://twitter.com/BitcoinPlunge)</comment>


Facebook, Instagram and Twitter Provided Data for Surveilling Activists of Color - <AUTHOR> https://www.aclunc.org/blog/facebook-instagram-and-twitter-provided-data-access-surveillance-product-marketed-target <comment><USER2> Yeah this is a misleading title - no part of the data was targeting people based on their demographics, unlike the hordes of ad trackers that are invading our private lives. They were selling a tool. Was the plan to target PoC with that tool? Possibly, but call for these companies to shut down their surveillance seems laughable when there's far more information being given to advertisers. Having worked with people in both adtech and surveillance platforms, the statement just doesn't hold water.

<comment><USER3> If you run a non-profit, you tend to be a little dramatic with your titles because that emotion leads to fund raising and influencing legislatures. I think the line from "Return of the Jedi" about it being true from a certain point of view. It is quite a bit harder in this day with news organizations now using the same tactics to get clicks.

Plus, frankly, most people won't read about the issue or read the article for anything other than the headline put on it, so it generates outrage and postings which leads to funding and legislative action. Not something I like, but its how they work.

</comment></comment><comment><USER4> ACLU says: "The government should not have preferred access to social media speech for surveillance purposes."

However here governmental entities did not have preferred access! They purchased the preferred access that Geofeedia would happily sell to anyone.

If I understand ACLU's position correctly, it would be more fully stated as "The government should _not be allowed to buy_ preferred access to social media speech for surveillance purposes." or perhaps instead or also "Nobody _should be allowed to sell_ preferred access to social media speech for surveillance purposes."

Which is fine as far as wishes go, but on what principles is this "should" grounded?

What kind of freedom from government (mass) surveillance should we expect for actions that are conducted in public (physically public or electronically public)?

I am sympathetic to the ACLU's goals here and am hoping to find better grounding for them, intellectually, politically, and practically.

<comment><USER5> Some additional questions

\- Is a company allowed to sell what an individual willingly provides if the individual agrees to those terms?

\- Should an individual who provided personal information expect the company to keep it private by default or expect capitalism by default?

\- should a company legally be disallowed to promise/advertise security?

\- Is the government allowed to act similarly as any other private company in regards to accessing information?

<comment><USER6> > \- Is the government allowed to act similarly as any other private company > in regards to accessing information?

I'm pretty sure most people would say no to this question (at least, after you gave them some examples). The government is bound by the constitution in ways that private companies are not, for good reason. I'm pretty sure that's the point that the grandparent post was trying to make - that the ACLU should make clear that they are advocating that this is a situation wherein the government _doesn 't_ have preferred access, but they _should_ have restricted access.

<comment><USER5> I think your right, most people would agree they should not. However, if foreign governments can act in this manner while the US government cannot. Doesn't this put the US government at a disadvantage? Are we willing to give up the longterm safety of our nation for the convinient comfort of the privacy from our government now?

In ways, I think yes. But I also believe that this is a very important conversation we have to ask ourselves. Theres nothing stopping the bullies of the world from company owned information except the price the companies put on it.

<comment><USER6> I don't know how that has any bearing on what the post you were responding to said, or on the article in general. There's no need to get into vague generalities about "falling behind" other nations that "get to" use dictatorial methods on their people, there's a specific question here about whether the US government 1.) is allowed to do this based on the powers and restrictions enumerated in the constitution and 2.) should be allowed to do it.

<comment><USER5> 1)

> preamble - Provide for the common defense, promote the general welfare and > secure the blessings of liberty for ourselves and our prosperity.

So far so good. We certainly do need to provide for the common defense, and secure the blessings of liberty.

> 4th ammendment is unreasonable searches and seziures

Its quite reasonable considering every other party is capable of it

> 9th ammendment - individuals have unenumerated rights

This might be a stopper. A person may have the right to control the information they willingly gave away and which they specifically agreed to give up control.

2)

Should the government have a standing military capable of lethal force? Should the government be allowed to setup metal detectors and security guards at the fronts of schools? Should the government be allowed to collect information about their citizens?

Should the government be allowed to purchase information from private companies? Should the government be allowed to purchase weapons from private companies? Should the government be allowed contract security jobs to private companies?

These questions arent that contreversial but certainly interesting

</comment></comment></comment></comment></comment></comment><comment><USER7> pretty clickbaity title... sounds more like they provided data for surveillance in general and the color piece of the title comes from this assertion:

>Social media monitoring is spreading fast and is a powerful example of surveillance technology that can disproportionately impact communities of color.

<comment><USER8> Discovering unethical behavior affecting everyone doesn't concern their audience, they have to throw in some dog whistle words to suggest the in-group is under threat.

</comment></comment><comment><USER9> For those interested in the discussion, there were other threads on this in the past week:

[1] "ACLU exposes Facebook, Twitter for selling surveillance company user data" \-- [https://news.ycombinator.com/item?id=12688548](https://news.ycombinator.com/item?id=12688548)

[2] "US startup Geofeedia 'allowed police to track protesters'" \-- [https://news.ycombinator.com/item?id=12693732](https://news.ycombinator.com/item?id=12693732)</comment>


Hacker News Design Is Ugly - <AUTHOR> https://neil.computer/notes/hacker-news-design-is-ugly/ <comment><USER2> Nope, that's not an improvement. You gotta add hover animations to each news item, fading effects, real time updates of timestamps and likes, thumbnails(because how else can we differentiate between the items?!!1!), and don't forget the ads inbetween to not blow a hole into your budget due to the increase in bandwidth thanks to the innovative responsive frameworks.

This half-assed proposal is not a good solution! /s

</comment><comment><USER3> Idly I wonder how many people will answer as a knee-jerk reaction to the title and not actually read the article and see what it says. I'd guess quite a few ... perhaps this comment will give them pause for thought, and it will become fewer.

</comment><comment><USER4> Excellent satire :)

"Until then, go here and browse some more trends to follow at the cost of authenticity, objectivity, originality, reasoning and fundamental understanding of how to design user interfaces"

</comment><comment><USER5> Sorry. I disagree.

The only thing I'd change is to put the flag|hide|etc as prefix icons so I can get 1 headline per line with minimal vertical spacing. This gives about 60 headlines per page and the highest "headline density". In other words, one headline per line.

I want information, not scenery.

<comment><USER6> Did you miss that this whole article is satire?

<comment><USER5> In fact, I did.

I have been tempted to write a program to fetch the hackernews headlines and eliminate the useless cruft so it hit one of the things I find annoying.

</comment></comment></comment><comment><USER7> I came in here ready to be angry, and am leaving with a smile. Thank you.

</comment><comment><USER8> Pffft! --call that modern design? Where are the badly drawn flat vector style illustrations?

</comment><comment><USER9> Thanks for letting us know, but I'm not sure many people around here agree with you.</comment>


Random Paths via Chiseling - <AUTHOR> https://www.boristhebrave.com/2018/04/28/random-paths-via-chiseling/ <comment><USER2> If these are directed graphs, then the problem/algorithm described is equivalent (unless i'm misunderstanding this explanation) to incremental 2-edge-connectivity and various queries about it.

The best known algorithms are O(mn), and they are _very_ experimental.

See, e.g., various papers you'll find here: [https://dblp.uni- trier.de/pers/hd/g/Georgiadis:Loukas](https://dblp.uni- trier.de/pers/hd/g/Georgiadis:Loukas)

For undirected graphs, this is also very well studied problem , and much easier (O(m+n)).

</comment><comment><USER3> Could you get similar results with the following procedure:

1\. Represent the world as a grid graph where each cell has a bidirectional edge to its orthogonal neighbors.

2\. Randomly weight the edges. The distribution of these weights will affect the texture of the results and is a tunable parameter.

3\. Compute a minimum spanning tree of the graph.

4\. Fill in dead-ends ends of the minimum spanning tree unless the dead end contains a goal endpoint (in other words, prune branches of the minimum spanning tree that do not end in an endpoint).

<comment><USER4> Wouldn't that result in a path quite weighted to the shortest real world actual distance?

<comment><USER3> It is not immediately obvious to me that that would be the case, since the MST is computed without regard to the actual goal endpoints.

<comment><USER4> Ah, I'd missed that bit.

</comment></comment></comment></comment><comment><USER5> This looks really cool! Any chance of showing an animated progression so we can see what each of the steps looks like?

</comment><comment><USER6> Would Union-Find-Delete not be better than DFS? You remove a candidate point and if the all of the vertices you care about are not members of the same set you don't do that? (Assuming a copy of the UFD structure is faster than the DFS.)</comment>


Tor Project Wins Award for Role in Middle East Revolutions - <AUTHOR> http://mashable.com/2011/04/02/tor-free-software-award/

<comment><USER2> Tor really isn't a safe way for dissidents to interact online and pass information. Pretty much all the exit nodes are monitored by governments and intelligence agencies. Press about Tor, social media, and other online tools was a big trend in the world of 2007-2008 elections, and now with all the political unrest in North Africa and other Arab countries. But this press has been generally with little actual content or value. Just rehashing the same idea of "yay savvy internetz politicking" and how hip it awesome it must all be next to pictures of lean, good-looking youth carrying signs with pithy, web 2.0 inspired quotes at rallies.

No actual analysis of how effective Tor is, how easy it is to sniff on, other better alternatives, or anything other than the same empty congratulatory articles and events.

Pretty dissappointing.

<comment><USER3> This is true and I would hope that a real dissident group would be using hidden services.

That being said, I'm 93.2% sure that the USG already has ways to compromise hidden services. Why else would they allow Tor to be exported?</comment></comment>


The Data Analytics Handbook - <AUTHOR> http://www.analyticshandbook.com

<comment><USER2> For some reason the way the page asked for e-mail did not sit right for me.

Maybe because it wanted name, e-mail and reason for downloading, while the payoff for entering all this information seemed rather uncertain.

<comment><USER3> After entering the email it gives you a link to the PDF. Here is the link so you don't have to give up your email. [https://leada.s3.amazonaws.com/handbook/Handbook_Pt1.pdf](https://leada.s3.amazonaws.com/handbook/Handbook_Pt1.pdf)

</comment></comment><comment><USER4> Yes, but what is it?</comment>


F-BOMB creates Backdoors in Corporate Networks for $50 - <AUTHOR> http://www.theverge.com/2012/1/27/2753176/f-bomb-diy-darpa-funded-spy-computer <comment><USER2> So if you have proper Wifi encryption in place then this device is useless?

<comment><USER3> Yeah, but there are plenty of cases where that isn't feasible. Imagine one of these being used to collect passwords, credit card numbers and so on at a coffee shop's wifi network, for example. Also, people are stupid and leave networks unsecured or use WEP when they really ought not to.</comment></comment>


War on PC gamers continues: Ubisoft misled on From Dust DRM - <AUTHOR> http://arstechnica.com/gaming/news/2011/08/ubisoft-lied-about-from-dust-drm-ubis-war-on-pc-gamers-continues.ars

<comment><USER2> Misled? Tell it like it is. They lied.

They may not have meant to. It may have been an internal miscommunication. But that lie stayed on their site until after launch, when people started calling them on it.

There was a rumor they (and/or Steam) were giving refunds, but that turns out to have been false, too.</comment>


Protect yourself from FireSheep with Amazon EC2 + OpenVPN for $0.50 a month - <AUTHOR> http://www.stratumsecurity.com/blog/2010/12/03/shearing-firesheep-with-the-cloud/

<comment><USER2> I'm use my LinkSys router loaded with a Linux firmware to do this at no additional costs.

I wrote up how I did it,

<http://ronnie.me/articles/rdp_over_ssh_with_a_linksys_router>

<comment><USER3> When I read the original article, I thought "Why can't every consumer have this who has home broadband?"

I'm sure comcast would not like it, and the dynamic ip issue.

<comment><USER2> I use the router to solve the dynamic IP issue. It updates to <http://www.dyndns.com> when my IP address changes.

<comment><USER4> That is a great option for people who have a dd-wrt/tomato/etc. compatible wireless device.

The goal of the post was for folks who don't already have a solution setup and to get people familiar with EC2 now that it has a Free Tier and see some of the "not so obvious" things we can do with.

<comment><USER3> The goal of the post was to drive traffic to the blog, and then to the main consultancy site.

Otherwise, the goal of the post was to generate dicussion in places such as HN.

Also, you are referencing the parent comment in response to RDP protocol tunneling only, fyi.

...and your account was created an hour after the original comment.

Just seems strange to create an account and then tell us the goal of the article.

</comment></comment></comment></comment></comment><comment><USER5> It's worth noting that the quoted "$0.50 a month" only applies for the first year, after which it will cost $0.02 an hour or ~$15 a month.

<comment><USER6> Seems like a perfect use case for EC2 on demand. Only run the VPN node when you are on an open wireless network and need the VPN security. Shut it down otherwise.

That would make it harder to run, but it would greatly reduce the cost. I'd pay $0.02 for an hour's worth of security while stopping off at a coffee shop.

<comment><USER7> couldnt attackers then grab your EC2 dashboard cookie and possibly compromise your EC2 instance ?

I mean if you need to login there first via an unsecure session, its not really that much safer

<comment><USER8> Your AWS dashboard would be compromised if you waited until you were on the open wireless network to run the EC2 instance, but attackers would not be able to compromise the EC2 instance. Once the instance has been created you can't change the Key Pair. You also can only download the private key associated with the Key Pair once, which is right when you create it. But of course, an attacker could stop or terminate your instance if he gained access to your AWS dashboard.

<comment><USER9> Not true: the dashboard runs entirely on SSL - which is still encrypted on an open wifi network. Compromising SSL isn't out of the question though, but highly unlikely.

</comment></comment></comment></comment></comment><comment><USER10> Ah, so easy! Only 28 steps filled with remote Linux shell commands, certificate creation, and downloaded software! I'm sure that's exactly what his wife wanted to hear when she asked how to avoid being Firesheeped.

Whatever happened to good old ssh -ND ? Wouldn't that solve 90% of most casual hotspot users' problems ? And I'd be wary suggesting even that one-liner to someone who isn't a techie, which I'm assuming his wife isn't since she asked the question.

<comment><USER11> > Whatever happened to good old ssh -ND ?

YouTube doesn't work.

Also, it's not a one-liner on a Windows client. OpenVPN is really, really easy to use once someone set it up for you. Two clicks and you're connected.

<comment><USER12> Works for me.

ssh as a SOCKS proxy, Firefox uses it, Flash uses it.

about:config set network.proxy.socks_remote_dns to true.

</comment></comment></comment><comment><USER8> I normally just do my tunneling with ssh -D. Is there an advantage of using SSH VPN instead of SSH as a SOCKS proxy?

<comment><USER13> I was wondering the same thing. The post went through all the steps to setup SSH VPN while SSH tunneling works pretty well and requires almost-zero config on the server…

OTOH I saw the value of using PPTP or L2TP-based VPN. It is supported on most systems by default. I set up one for iPhone because you cannot do SSH tunneling on it. On non-*nix systems there is usually no SSH installed by default. I opened my PPTP/L2TP VPN for friends running Windows.

It's also slightly easier to connect to PPTP/L2TP VPN with a single click on the menubar of OS X without installing any additional software.

Otherwise I stick with SSH tunneling with SOCKS proxy.

Could someone explain the benefits of SSH VPN please?

<comment><USER4> SideStep basically automates ssh -D for you and sets up a local SOCKS proxy. However SOCKS proxies (and thus the current version of Sidestep) can only protect TCP traffic that supports SOCKS proxies. For example, you can't tunnel your DNS requests over a proxy (without tinkering with Firefox's about:config).

Also, since ssh -D is not a true VPN tunnel, your machine is exposed to the hostile network (if you don't have a firewall).

If you want complete privacy where ALL of your IP traffic is tunneled out, OpenVPN (or other tunneling layer 3 solution) is the way to go.

<comment><USER13> Thanks for the explanation! There are a few things I don't understand fully, could you please talk a bit more?

"since ssh -D is not a true VPN tunnel, your machine is exposed to the hostile network (if you don't have a firewall)."

I believe on OS X the SOCKS proxy is applied globally, unlike Windows where you have to do per-application settings. So aside from DNS queries, I guess other TCP connections should go through SOCKS? That should cover the major problem of FireSheep.

Also, since on Windows/OS X/iOS there is no default OpenVPN clients, I use PPTP/L2TP/IPSec-based VPN instead because they are available by default. Is there any advantage of OpenVPN over them?

<comment><USER4> For the purpose of defeating FireSheep, ssd -D works just fine.

OpenVPN in the configuration of the blog post utilizes 443/tcp, which is open at most places, while the ports required for PPTP/L2TP/IPSec could be closed.

<comment><USER14> Worst than just "ports" AFAIK: last I checked PPTP required use of either GRE or its own protocol (I can't remember which)--so not TCP nor UDP, and thus more likely to be blocked or simply NATed incorrectly. I don't recall how L2TP works, but I bet it uses a different IP protocol as well. I'm not sure if it's common to use L2TP unless it's tunneled in IPsec these days. IPsec can run over UDP if configured correctly. (I always encountered the UDP transport in the context of NAT-T which has/had its own set of problems. For example, it used to be the case that many IPsec "servers" had a problem with more than a single NAT-T client behind the same NAT. Not sure if that's still the case as this stuff is no longer my job, thankfully.)

</comment></comment></comment></comment></comment></comment><comment><USER15> Better choice than a lot of the VPN services out there. The free services should be presumed to have some sort of ulterior motive to get a look at your traffic (including, potentially, much more nefarious ones than a firesheep user). Even premium services should be considered carefully, you have little way of knowing what amount of tracking or inspection of your packets is going on - and such concentrators make an excellent target for hackers.

<comment><USER3> Do you think Amazon has root access to anything you virtualize on their cloud?

<comment><USER15> Yeah, obviously AWS has access to your traffic and host data if they choose to inspect it, but I wasn't trying to suggest it was a perfect secrecy situation (nor that thats needed). I'm inclined to trust amzn here over most providers, they have a bigger reputation to protect than most VPN hosts, and their scale and focus makes provider level intrusion or consumer focused tracking less likely.

</comment></comment></comment><comment><USER16> Just curious, if you already have decent hosting couldn't you just implement this by installing openvpn on your existing virtual machine (or whatever)? Is there anything which specifically requires EC2?

<comment><USER3> I guess you just have to be careful of bandwidth overage. Don't use it with Netflix too much.

<comment><USER17> The same caveat about bandwidth usage applies to EC2. You have to pay (twice in & out) for EC2 traffic.

</comment></comment></comment><comment><USER18> How to start a SOCKS proxy on localhost:12345 proxying through your account foo on bar.example.com:

      ssh -D 12345 -N -f email@example.com

<comment><USER19> Tip: you can group the flags together like so:

        ssh -fND 12345 email@example.com

Also, the -f flag will cause it to fail if you don't have passwordless auth set up. If you don't have it set to use private/public key pairs, just tunnel like so:

        ssh -ND 12345 email@example.com

<comment><USER18> Nah, -f will prompt for password before backgrounding the process.

</comment></comment></comment><comment><USER20> Why not just setup something like PFsense ( <http://www.pfsense.org/> ) at home with OpenVPN configured?

</comment><comment><USER21> this sounds like a pretty viable business idea, actually. in the past, i've looked for a simple VPN service provider to help secure non-techie friends' laptop work at a starbucks or whatever. couldn't find anything decent. seems like people might be willing to pay some $ for this if it were turned into something commercialized.

<comment><USER22> AlwaysVPN is what I use.

<comment><USER4> Looking at the cost, the EC2 setup is a lot cheaper.

<comment><USER22> Depends on usage. I bought $5 or $10 worth of GB traffic few years ago and I have most of it still left to be used. Even just 1gb is plenty for the occasional browsing at starbucks or at the airport.

</comment></comment></comment></comment><comment><USER23> 28 steps, and he didn't think to create a new AMI to share with the world.

<comment><USER24> With default Ubuntu configuration you just have to enable/install OpenVPN server (1) (server), generate one user certificate (2) (server) and configure NetworkManager profile (3) (client).

All the other steps are just intro to using Linux and/or Amazon EC2 infrastructure or such technicalities as copying files or (unnecessary) configuring time zone.

</comment></comment><comment><USER25> Apologies in advance for being off-topic, but am I the only one who hates people hunched over their laptops while hogging starbucks' chairs for hours . I work in a downtown location and its impossible to have your coffee at starbucks as there is no place to sit. I really wish Starbucks could charge for seating ;-)

</comment><comment><USER26> I just found out a few weeks ago that my ISP, Sonic.net, offers an IPsec VPN endpoint to all of its customers, with no additional fees. I highly recommend them if you're in the SF Bay Area.

Note that while their help page suggests that you use the Cisco client software to connect to their VPN endpoint, the service works just fine with Mac OS X's built-in Cisco IPsec client, as well as with the IPsec client in iOS. Dunno about other platforms, but Sonic.net provides the Cisco client for Windows and GNU/Linux, at least.

<http://www.sonic.net/features/vpn/>

</comment><comment><USER27> To anyone who desires this level of security but doesn't want to have to go through the trouble of a VPN, using SSH tunnels works just as effectively.

Assuming you have access to a remote Linux/BSD box, you can (from Linux) `ssh -D 1025 remote.host.address` then proxy your browser's SOCKS proxy to localhost:1025.

On Windows, using PuTTY, one can simply go into the Tunnel menu, hit the "Dynamic" radio button, type in 1025 and click "add" to achieve the same effect.

<comment><USER4> SideStep does all of this for you. You can forgo the whole OpenVPN section (Steps 12 through 22) if you just want to use SideStep.

</comment></comment><comment><USER28> This looks like a great way to get started with EC2, VPN or no. I've been thinking about it, but one thing still puzzles me. You choose an AMI, but does Amazon effectively create an EBS instance for you and populate it with a copy of the AMI?

I don't see any mention of an EBS instance being created, so I'm not quite sure how you can write to the filesystem at all. I'm sure I'm missing something here, but I'm not quite sure what. Thoughts?

<comment><USER17> You don't need an EBS to run an instance on EC2.

You can just run the instance as normal. It has a root filesystem, you can write to it etc. However if you stop the instance, then all your changes are lost. The EBS is only needed if you actually need disk space.

<comment><USER29> Micros (which are what you get on the free tier) are only available as EBS- backed instances.

<comment><USER24> It's worth noting that 20GB EBS space is provided with free tier. Though all default Ubuntu AMIs use 25GB EBS by default AFAIK.

</comment></comment></comment></comment><comment><USER30> What's a good solution for iPhone/iPad over wireless?

<comment><USER3> iPad has VPN built in, not sure about iPhone.

<comment><USER13> It's the same: L2TP/IPSec, PPTP, Cisco IPSec.

It's annoying though because it is unable to auto-reconnect to VPN after it locks for a few minutes

</comment></comment></comment><comment><USER31> I keep a server up-n-running 24/7 anyway, doing lots of things (file server, UPnP, the whole nine yards), it's on cable Internet with a dynamic DNS. So I installed OpenVPN on it and all my laptops automatically connect to it when they boot up. The server also runs a proxy.

So I've a secure proxy available any time, from anywhere.

<comment><USER32> How's your latency? An advantage of connecting to an EC2 instance seems to be that you're getting your traffic onto the backbone without eating a "last mile" roundtrip to your house.

EC2 scenario:

coffee shop -> backbone -> EC2 -> backbone -> remote site (probably hosted somewhere close to your EC2 instance, especially if a CDN is in use)

Home scenario:

coffee shop -> backbone -> cable provider -> home -> cable provider -> backbone -> remote server

</comment></comment><comment><USER33> Good timing - I just had this thought "in the shower" a day or two ago. I wouldn't utilize a VPN enough to make some of the more traditional providers cost-effective, so something along these lines is probably Just Right.

</comment><comment><USER34> 28 steps??</comment>


Ask HN: Is it ethical to take a job offer from an investor's startup? - <AUTHOR>

You work for company A, where Mr. X is an investor. Mr. X also sits on the board at company B. You haven't met at all.<p>Company B makes you a job offer. Should you have any qualms about accepting it? <comment><USER2> I don't see any ethical issue here, but if there are hard feelings involved (like you're leaving his investment high and dry), he could make things difficult for you at company B. I suggest talking to your new boss at company B, asking them the same question, and if appropriate for an introduction to the investor. Mr. X will likely want to know why you're leaving company A (is there something wrong with his investment?) and will appreciate that you're checking with him about ethical concerns.</comment>


Python 3: Ten years later - <AUTHOR> https://archive.fosdem.org/2018/schedule/event/python3/ <comment><USER2> I think Python 3 primarily showed that breaking backwards incompatibility across an entire ecosystem is worse than one could have predicted. Even today Python 2 is far from dead.

On the other hand the core development team "outsourced" many of the issues that people actually want to have solved to the community like packaging and distribution.

Python's biggest downfall is a highly academic approach with slow release cycles which makes large feature development hard and detached from the real world. Python 3's unicode model is completely outdated but was supposed to be the big feature of the version. While that was happening however the rest of the world started moving over to UTF-8. There was no feedback loop that could have enabled Python to be UTF-8 based. It was released and then decisions were locked in.

Similar things happened in asyncio. New versions of it only land with every major version of the language which meant that a lot of asyncio only became really useful with 3.6 and 3.7 which was years after it was initially created.

I have very high hopes that the new leadership of the language will be able to tackle some of these problems. Python 3 is way less backwards incompatible to 2.7 now than it was 10 years ago. The two versions moved closer to each other and today it's pretty easy to support both from a single codebase. With faster iteration we might have been able to cut this time short by 5 years or more

<comment><USER3> > Python 3's unicode model is completely outdated but was supposed to be the > big feature of the version. While that was happening however the rest of the > world started moving over to UTF-8.

I'm not sure what you mean. Are you suggesting that Python use UTF-8 encoded strings internally instead of decoded Unicode codepoints like it does currently?

I've worked on Perl that uses that approach and it's an absolute nightmare. All string operations suddenly must be aware of details of UTF encoding, which complicates even simple things immensely. You get hard-to-find bugs when some code somewhere introduces invalid UTF to a string. The only real benefit you get is slightly smaller memory footprint when dealing mostly with English text.

I much prefer Python's decode-process-encode approach.

<comment><USER4> The python nightmare is purely performance due to its use of the UCS-2 or 4 encoding (wchar_t without surrogate pairs). UTF-8 was ruled out for its inability for direct indexing, but this proved wrong. 4x longer string buffers trash the cache much more than the needed CPU cycles for utf-8 decoding.

perl's problem is that they didn't make room for the original encoding, it's only latin-1 or utf-8 from everything else. so the context needs to store it, like IO, process. and for performance they silently loose the utf-8 flag for 128—255 codepoints.

but all this is still better than the libc/POSIX design failure to use ENV vars, where the encoding is global, not localized. every single string API needs to do a getenv, and its interpretation is action at a distance.

<comment><USER3> > it's only latin-1 or utf-8

There's no other way, is it? You basically have to have the complete string library re-implemented for each supported multi-byte encoding.

<comment><USER4> No. Foreign encodings are internally converted to utf-8 via the Encoding library and IO layers. The string library is only done for latin-1 and utf-8.

The only trouble is that you have to remember the original encoding, if you need that information. It's stored nowhere. E.g. to write to a file in the original encoding you have to open it with the correct IO layer. perl6 got that fixed.

</comment></comment></comment></comment></comment><comment><USER5> Python 3 is worth it just for Unicode handling. As someone using a language that is uses non-ASCII characters, thank you if you're using Python 3 and made your software more internationally compatible.

<comment><USER6> ...or you could just use the unicode type in Python 2; like: all of my Python 2 software handled languages in other character sets correctly (and yes: this was stress tested often as I have had many many users from China and the Middle East). There was absolutely nothing wrong with Python 2 and Unicode, and if anything Python 3 just made a bunch of stuff impossible to do correctly (in particular encodings for filenames) until years later (I think Python 3.4 or something is when they finally got their Unicode shit together; meanwhile, Python 2 worked great).

<comment><USER7> Except doing the right thing by default is important, and the reality is that Python 3 code is way more likely to handle Unicode correctly, which is what we want.

People constantly complain, but honestly changes like Python 3 have to happen - the alternative is just another completely new language taking over instead.

<comment><USER8> I'm less enthused with the defaults than you are. How many people do you think would correctly handle foreign text in this Python 3 exercise:

Write a Python 3 program that takes two arguments, reads a text file named "input.txt", replaces all instances of the first argument in the text with the second argument, and writes the result to "output.txt". For extra credit, add an option to print to stdout.

My bet is very few people would write that program correctly.

<comment><USER3> Ok, I'll bite.

This is the most straightforward way I can think of to implement the program you described. I think this is more or less what someone would come up with after glancing at the Python tutorial:

[https://gist.github.com/avian2/e3968bf933212ee561410b15495e6...](https://gist.github.com/avian2/e3968bf933212ee561410b15495e626f)

What is wrong with it? It works as expected with non-ASCII characters in both command-line arguments and in input.txt (Python 3.5.3 on Linux, LANG=en_US.UTF-8). Yes, it doesn't work if you have a file that's not consistent with your locale, but you can't really blame Python for that.

<comment><USER8> I saved this page from the English Wikipedia as input.txt: [https://en.wikipedia.org/wiki/Shinz%C5%8D_Abe](https://en.wikipedia.org/wiki/Shinz%C5%8D_Abe)

        C:\Users\local\tmp>python --version
        Python 3.7.1

        C:\Users\local\tmp>python foo.py Diet Parliament
        Traceback (most recent call last):
          File "foo.py", line 7, in <module>
            text = f.read()
          File "C:\Users\local\AppData\Local\Programs\Python\Python37-32\lib\encodings\
        cp1252.py", line 23, in decode
            return codecs.charmap_decode(input,self.errors,decoding_table)[0]
        UnicodeDecodeError: 'charmap' codec can't decode byte 0x8d in position 107: char
        acter maps to <undefined>

Imagine I wasn't a developer who has spent dozens of hours on fixing encoding problems in Python. Imagine I'm just some person using some software I've been given and this is what I encounter. Can I actually complete my work? Is this a good user experience?

<comment><USER9> The way I usually put it is that Python 3 shifted its priorities.

Previously, if you were a UNIX-y scripter writing UNIX-y scripts on your UNIX-y OS, the fact that Python just kind of pretended encoding issues would never exist was a help to you. It adopted the same "everything is ASCII, or at most UTF-8 in the ASCII range, and if it isn't I'll break in cryptic ways" approach as most other UNIX-y scripting things.

If you were doing anything other than UNIX-y scripting on your UNIX-y OS, this easily became a huge nightmare in Python 2. Django went through a massive rewrite early in its history precisely because of this, to ensure that encoding/decoding happened at the boundaries and everything you'd work with inside a Django app was already a Unicode string. And I remember what it was like trying to work on the web before that approach, and what the work to fix it was like.

Python 3 decided to make the UNIX-y scripters actually learn what a horrid mess UNIX is with respect to locales and encodings and filesystem paths, in order to free the rest of the Python community from the nightmares inflicted by prioritizing the UNIX-y scripters to the exclusion of everyone else. So yes, you have to do more work. Yes, you have to learn that a file path is actually an opaque bag of bytes that may not be in any actual encoding and thus can never properly decode to a string. Yes, you have to learn to use fsencode() and the surrogateescape handler in order not to blow up your scripts.

But I'm OK with that, because it puts the workload on you when you're using such a system, rather than magically trying to fix it for you at the cost of everyone else's sanity. It also means that you have to learn to write those scripts correctly. Which is more work than what Python 2 required, but not the world-ending apocalyptic horror it's usually presented as (and is, again, mostly the fault of UNIX-y systems doing their old UNIX-y things, not the fault of Python).

<comment><USER8> So, write the program correctly. Show me.

> Python 3 decided to make the UNIX-y scripters actually learn what a horrid > mess UNIX is with respect to locales and encodings and filesystem paths

Show me how much Python 3 improves this. To expand on the program before, make it a directory named 'input' full of files, and a directory named 'output' to put the processed files in. Print each file name as the corresponding file is processed to indicate progress.

I would be applauding Python if it did make the difficulties with this exercise obvious, but it absolutely does not. The file system APIs return strings, but the strings they return may not be valid Unicode. PEP 383 turned the Python 3 str type into a bag of bytes.

Python tries to sweep encodings under the rug. It makes the encoding a default value all over the place and hides conversions everywhere.

I 100% agree that developers need to think about encodings and handle them in their programs. That's exactly why I hate string handling in Python 3: because rather than making you handle the corner cases, it pretends they don't exist, until they're found one by one by your users.

Python 3 encourages developers to write broken string handling code.

<comment><USER9> _So, write the program correctly. Show me._

You just want to fight someone because you're angry, and I don't do that. No matter what someone writes you'll find a way to argue into it being wrong and then prance around declaring "victory".

(I'd also bet that you probably couldn't do it if _I_ were the one who got to set the evaluation criteria, and you also couldn't pass other "challenges" like writing proper HTTP handling -- the person who gets to grade the challenge always "wins", which is why you want to be the person who grades the challenge)

 _PEP 383 turned the Python 3 str type into a bag of bytes_

PEP 383 provided a way to read certain things -- primarily filesystem paths which can be basically _anything_ \-- using an escape mechanism to replace non-decodable bytes with surrogates when decoding to string, which in turn allow losslessly transforming back to the original bag of bytes.

Which is necessary, because there are real filesystems out there that really have paths and names that can never validly decode from any known text encoding. It doesn't turn strings into "bags of bytes"; the resulting str still is an iterable of actual valid Unicode code points.

 _Python tries to sweep encodings under the rug._

As the saying goes, you can't reason someone out of a position they didn't reason their way into, so I won't try here.

 _Python 3 encourages developers to write broken string handling code._

Python 3 no longer tries to cover for the random gibberish that's legal to put in filesystem paths, and makes the developer handle it. Are there lots of developers out there who don't _realize_ that filesystem paths can legally contain undecodable garbage? Sure. That's not Python's problem to solve, though; it gives you the surrogateescape handler, and the fsencode helper, and keeps working on things like PEP 538 and PEP 540 to try to give you tools to work around it. But Python can't magically fix the mess that is UNIX locales and bag-of-bytes paths (nothing can, short of burning UNIX down and starting over), and doesn't try to do it for you.

<comment><USER8> You're right that I'm frustrated. I'm not even upset at anyone in this thead, but from previous discussions. I appologise for carrying that baggage here. Having my morality questioned when I legitimately want to make programs work correctly for foreign languages has left me... emotional on this subject.

Unix has its own problems, but the program avian wrote works correctly on Linux. Most encoding issues I encountered when working with Python 3 were on Windows.

PEP 383 was making the best of a bad situation without breaking the API again. The real mistake was having the functions return strings in 3.0. The operating system APIs should have returned path objects that require an explicit conversion to string with an explicit error handling mechanism.

Python gives you all the tools you need to do this right, but they're easy to unknowingly use in ways that break on corner cases. A well-defined API should guide you towards the correct solution and should make pitfalls obvious.

In any case, I should probably give it a rest. I work hard to make sure my programs do this stuff right, and I suppose that's all I can really do.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> As an outsider who only uses Python when I need a specific tool that's only available through pip: it's still one of my biggest nightmares.

Every single time I need to install something with pip on MacOS there is this hour-long struggle with figuring out how to get the correct version of Python (2.7 vs 3) working with the correct version of pip working with the correct version of the library itself.

I don't know, I guess people who use Python regularly have figured it out, or maybe it's just a MacOS thing. For me, it's just a major PITA even 10 years after release.

<comment> Al-Khwarizmi I use Ubuntu and it's the exact same thing for me, so I don't think it's MacOS-specific. To be honest, the whole versioning quagmire is the main reason why I don't use Python as one of my main languages, but just as an outsider like you. I like the language but I hate wasting my time with that kind of thing. Say what you will about Java, but you can just slap a jar file into a folder and it will work with the latest version, with zero drama.

<comment><USER11> I feel like the fundamental issue is that it simply does not make sense for pip to be able to install or upgrade any Python packages managed by the system package manager, any more than it makes sense for it to upgrade the system- level Python interpreter itself. It should just outright not have the ability to do this.

</comment></comment></comment><comment><USER12> No, IMO. Don't get me wrong, Python 3 is a better language than Python 2. I just don't think it's _that_ much better that it was worth breaking backwards compatibility and stalling the language for several years.

Python 3 did enough to break everyone's existing code, but nowhere near enough to make that worthwhile.

It's common for other language communities to consider the Python 2/3 transition as an example of "what not to do".

<comment><USER13> How hard is it to simply keep one's code up to date? I'm pretty sure there weren't any radically different paradigms introduced in Python 3.

Somehow the world of JavaScript has been able to quickly adapt to a rapidly changing language and the community is hardly fractured along the lines of language. Adopting new language features and browser APIs is just a matter of fact. What's different about Python?

<comment><USER14> JavaScript has been stuck with an ancient version because of browser adoption like IE6.

There's a good reason people wanted to migrate to newer JS and I never heard people say ES6 got something wrong over ES5.

</comment></comment></comment><comment><USER15> Please don't rewrite titles, especially to make them more baity. This is in the site guidelines: "Please use the original title, unless it is misleading or linkbait; don't editorialize."

Titles are by far the strongest influence on discussion, so this rule is much more important than it seems.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

(Submitted title was "Python 3 Is Now 10 Years Old Was It Worth It?".)

<comment><USER16> In the submission form, have the title field auto populated from the URL.

<comment><USER15> You don't have to look at many URLs to see how hard that would be.

Not to mention "unless it misleading or linkbait", which is not something code can take care of.

</comment></comment></comment><comment><USER17> Just one word: typing [1].

Makes life a lot easier.

[1]: [https://docs.python.org/3/library/typing.html](https://docs.python.org/3/library/typing.html)

<comment><USER18> Two words: typing, mypy [1]

The editor support that I get from typing/mypy is fantastic! It feels like writing in a statically typed language. To me this is by far the most important feature of Python3. It's a godsend for larger/complicated code bases.

[1]: [https://github.com/python/mypy](https://github.com/python/mypy)

<comment><USER17> Yes, you are right. I'm also using mypy along with pylint, yapf and isort. Helps keeping my python codes clean

</comment></comment></comment><comment><USER19> I think the conversion would have been faster, especially for people who don't care, if the main distributions collaborated and stopped providing Python 2.x; 99% of software writers would just check out how to write their code in Python 3, or move their code to that version. The other 1% would be people who "knew what they're doing" and custom install whatever version they needed.

Imagine if Ubuntu 14.04 (Trusty) didn't bring Python 2. All devs of relevant stuff would have received a shower of upgrade requests. Maybe 2014 was too early to force this, but I'm sure in 2018 it could have been done with Ubuntu 18.04.

I know this looks like work for the sake of upgrading, without any real benefit for most projects. But I guess it's not wrong either; you just couldn't expect that Qt 3.3 (circa 2004) was distributed 10 years later in Ubuntu 14.04 (Qt is just a library, not a language, but it practically transforms the way you write C++ so it's a valid comparison IMO); however here we are in 2018, 10 years after the release of Python 3, and Python 2 is still the default interpreter in Ubuntu 18.04.

</comment><comment><USER20> Nope.

But it survived, which is the important thing. I thought 3 would kill Python, but it has survived and that is a very good thing.

Anecdotally, non-nerds fins python easier to read than other popular languages. It's become the go-to language for a bunch of domains that reach outside core nerding (data analysis, education, DSL like stuff) and I predict Python will therefore be widely used in 2050, and probably be popular aged 100.

</comment><comment><USER21> It's a good example of why JS hasn't had changes that break existing code, so that's good

</comment><comment><USER22> Python 3 is the open source equivalent of Vista - too much potential, but too much time to realize it, and the world doesn't slow down in the meantime.

I love python. For me, it's damn near perfect in many ways. But it's looking more and more like Perl 6 than what it should have been.

The sooner we get to Python 4 (whatever that ends up being), the better, as we need to move past the v2 or v3 question for developers and users.

</comment><comment><USER23> Python almost became my main language, but I moved to another language when I saw it was stuck at 2.7. Another reason was the lambda's only allowing 1 line instead of the flexible closures in so many other languages. And my expectations for future improvements were very low as the core maintainer looked quite stubborn to me.

<comment><USER24> Pretty much how I ended up doing most of my coding in Groovy. I essentially wanted Python. But Python wasn't a good enough Python. (being honest, other things attracted me to Groovy as well - Java ecosystem etc, but it's interesting to me that in the larger picture, I'm sort of using Groovy as a proxy for a Python without Python's flaws).

</comment></comment><comment><USER25> Yes. And I guess it could have gone worth. On the other hand, I don't expect the community in a mood to embark on Python 4 any time soon, though it would make sense, in terms of version numbers and time passed.

</comment><comment><USER26> Definitely yes, it took some time and had some costs but nowadays python (3) is a much better language. Perhaps it could have been done differently, however it is in the past now.

</comment><comment> dis-sys It worth it, not for the language itself but for teaching everyone a good lesson - don't destroy the backwards compatibility when experimenting your incremental ideas.

</comment><comment><USER27> Random scaremongers. Just look at pypi

</comment><comment><USER28> I wish they spent the effort on making Python 2 faster and removing GIL instead.

<comment><USER29> Why? I teach Python and c++ to A level students. They pick up the basics in a few weeks. C++ is pretty easy. We push our students through the c++ institute exam with few issues.

Choose the right tool for the job. If you need speed, choose c

<comment><USER30> C++ is pretty easy!? Wow, that's an opinion you often don't hear. :-)

<comment><USER31> As in "pretty easy to introduce catastrophic errors with".

<comment><USER32> If you use the right features of C++17 errors are easier to avoid than ever.

The problem is that this elegant subset of C++ is hidden inside ... the rest of C++.

I guess that's the counter example to Python's 2/3 breaking change. C++ just keeps adding new features while retaining all the old ones for backwards compatibility, even if they're awkward in context of the new language.

<comment><USER33> I once read somewhere that C++ would be fine if one just used a sane subset of C++, but the challenge was agreeing on which subset.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> No.

</comment><comment><USER34> There are still idiots on Github using Python 2 for new projects. These are usually academics who don't actually share any love for technology. Their code will never be used by anyone.

<comment><USER35> There has been a pledge by the largest group of Python developers not to mess around with Python 2. So if you want your code to be able to just run forever without any concern for all the new and exciting language ideas being loaded into Python 3 then Python 2 is the logical choice.

<comment><USER12> I've heard of this - people considering Python 2.7 as an "LTS" version of the language, receiving bug fixes but otherwise remaining unchanged for many years.

I wonder, once 2.7 is EOL in a years time, whether the language developers will consider a "3.x LTS" release?</comment></comment></comment>


Why no filtering/interception of web traffic should be allowed... - <AUTHOR>

I am a Time Warner customer in North Texas. I cannot stand their service, but there is really no option. Giving them my money is making me sick because of things like this. Anyone else experience similar trouble?<p>http://www.jeremylujan.com/timewarnersucks.png <comment><USER2> You know, you can turn that off by following the "why am I here?" link.

<comment><AUTHOR> I opted for changing my DNS servers. That really isn't the point though. I believe Verisign was prevented from doing similar things several years ago.</comment></comment>


Ask HN: How much traffic does your tech blog get? - <AUTHOR> For those who have a personal blog related to tech, how much traffic does it receive per month?
If you have any stats related to your to the traffic patterns of your blog, feel free to share.
How much traffic does your blog receive when it makes the front page of HN?
How much traffic does your blog receive when it receives substantial attention on one the tech/programming related subreddits?
How many users as a percentage have adblockers enabled?
Would tech related blogging and including ads from google adsense make money considering tech/programming related content is a sort of niche and also presumably a lot of users have adblockers? <comment><USER2> Here is my experience, [https://twitter.com/FrantzMiccoli/status/476242261102329856](https://twitter.com/FrantzMiccoli/status/476242261102329856) "After 15h on HN front page: 14k views from 4k visitors on my GitHub and 3k visitors to the linked article"

You can see similar figures when traffic comes from some important Reddit subchannels.

I don't have any answers for the rest of your questions.

</comment><comment><USER3> Im about 5000 for the year on my blog - glenware.wordpress.com

But my main reason for having the blog is to record my own technical notes, and if they are of use to others then great

Ive considered writing posts that will attract more traffic - but it always feels like I'm writing clickbait, so keep it as it is

</comment><comment><USER4> > How many users as a percentage have adblockers enabled?

For technical blog? I would guess practically everyone. I'd love if someone answered this.

</comment><comment><USER5> I see about 80-100 visits a week. But I have to deduct some from that number for the referral spam for social buttons.

</comment><comment><USER6> nothing

</comment><comment><USER7> In the 3 years I've had my blog I have gotten about 52K visitors. I didn't get any traction on sites like HN or Reddit but I did have a bunch of referrals from Stackoverflow and Microsoft forums. Unfortunately my site went down about 6 months ago and I haven't been bothered to put it back up. That means no new content in over a year</comment>


DBeaver – Universal SQL Client - <AUTHOR> http://dbeaver.jkiss.org/ <comment><AUTHOR> I have been using it for several months and I think its awesome. Some of the best things for me are:

\- It supports all the databases in existence

\- It is very fast Eclipse based x-platform tool

\- You can keep connection strings and other config in repository so other team members can quickly set up database access.

\- You can search for strings in all stored procedures

\- It has very nice row view, way easier then scrolling horrizontally (switch view with TAB)

\- It can set GUI colors differently for production, test, development etc.

\- You can install it via package managers in a couple of seconds

\- It has its own folder structure so you can keep sql scripts along with the project.

\- Its FOSS.

Awesome tool, highly recommended. See full list of features here: [http://dbeaver.jkiss.org/docs/features/](http://dbeaver.jkiss.org/docs/features/)</comment>


Italy extends lockdown amid hopes of turning corner - <AUTHOR> https://www.bbc.com/news/world-europe-52100153 <comment><USER2> I'm not an epidemiologist, but I have some background in Bayesian problems in biophysics.

Some back of the envelope math for Lombardy, the hardest hit region:

Total population ~ 10M

Total deaths (2020/3/30) = 4773

If one assumes an Infection Fatality Rate of 1% then we would have had 500k cases in the region about two weeks ago. Assuming a doubling of the cases every 5 days, this means that the current actual number of infections stands at 4M and it would take log2(10/4) = 1.3 new doublings to reach saturation: about a week.

Taking instead an IFR of 2% and doubling every 7 weeks, we'd have about 3 weeks left to herd immunity.

Of course one should take into account the fact that at some point this will stop behaving like an exponential and look more like a sigmoid, but herd immunity doesn't need 100% infection, so the orders of magnitude involved should be more or less the same.

This seems to be roughly consistent with what some more authoritative sources are saying for example [0] claims Italy is probably missing 95% of cases.

[0] [https://cmmid.github.io/topics/covid19/severity/global_cfr_e...](https://cmmid.github.io/topics/covid19/severity/global_cfr_estimates.html)

<comment><USER3> I think it's past time to introduce "IANAE".</comment></comment>


PHP 7 at Tumblr - <AUTHOR> https://engineering.tumblr.com/post/152998126990/php-7-at-tumblr <comment><USER2> Another piece to this (for those using MySQL as their backend) is that updates to MySQL can improve things quite significantly as well.

In my work environment I"m the main MySQL user so I had setup a dedicated MySQL 5.5 server a few years ago that I hadn't upgraded to any newer versions since then (hey it wasn't broke right?). But recently I had been looking into upgrading just because it felt like it was time, but earlier this week I was checking out some performance degradation on one of our sites and noticed in my local copy it was actually running quite a bit faster.

Investigating further, it seems that in the newer versions of MySQL (in my case, my local XAMPP was running MariaDB 10.1.x) the performance has improved quite a bit, particularly for the types of queries I was running on this site (which used a number of subqueries and GROUP BY clauses).

Without any sort of application level caching making this single switch from MySQL 5.5 to MariaDB 10.1.19 improved load times from about 3.0 seconds to 1.0 seconds and I'm going to add some application level caching as well to improve things further.

This was all without switching PHP versions on this particular site (which is still using PHP 5.4.45)...just thought I'd share since sometimes the slowness isn't always improved as much just by upgrading PHP (which is something I'd like to do too for this site, but at the moment the framework I'm using on the site isn't ready for PHP 7 so it'd be quite a bit of work to switch it out).

<comment><USER3> Complete list of new features in MySQL 5.7 [0] (in bullet form) would show scores of performance improvements. The performance improvements from 5.5 to 5.6 were significant and 5.7 is much much better.

[0] [http://www.thecompletelistoffeatures.com/](http://www.thecompletelistoffeatures.com/)

<comment><USER4> On the flip side there were severe performance degradations for certain types of queries. Notably Zabbix[0] was affected.

[0]: [https://m.reddit.com/r/zabbix/comments/3txgov/poor_performan...](https://m.reddit.com/r/zabbix/comments/3txgov/poor_performances_with_mysql_57/)

<comment><USER5> It's important to distinguish between cases where it is slower, and cases where query plans change.

MySQL 5.7 changed the cost-model significantly, so while it will be better on most queries, there are cases where two-wrongs-made-a-right; and edge case queries may be slower. To mitigate this (as it was somewhat expected), MySQL 5.7 also introduced new query hints and server-side query rewrite.

(In the case of the link you provided, OP responded later saying 5.7.10 improved performance again.)

</comment></comment></comment></comment><comment> angry-hacker Despite all the negativity about PHP, I sincerely thank all the team behind it. Thanks to PHP and its easy way of start building stuff, I started learning programming.

While I have moved on, not because it's hip to do so, I hope the community keeps rocking. Thank you again and congratulations.

</comment><comment><USER3> A recent post about PHP 7 deployment at DailyMotion [0].

Another one, Taking PHP Seriously [1].

[0] [https://news.ycombinator.com/item?id=12704511](https://news.ycombinator.com/item?id=12704511)

[1] [https://news.ycombinator.com/item?id=12703751](https://news.ycombinator.com/item?id=12703751)

</comment><comment><USER6> Is there anymore major performance improvements left to make to PHP or is everything else just dimishing returns?

No disrespect to the huge amount of work the PHP team has already completed, they should be praised.

Just curious to know if we can expect anymore major performance improvements like we saw from v5 to v7.

EDIT: After further searching, appears PHP 8 will have some sort of JIT (with the hope that it'll continue to bring significant perf improvements. More info at [http://news.php.net/php.internals/95531](http://news.php.net/php.internals/95531)

<comment><USER7> Yes, the next major performance improvements will come from a JIT style machine, similar to what HHVM does.

<comment><USER8> I'm also confused. Php 7 has Opcache, which according to the documentation:

"OPcache improves PHP performance by storing precompiled script bytecode in shared memory, thereby removing the need for PHP to load and parse scripts on each request."

How would JIT features come into play with it?

<comment><USER9> Precompiled here means bytecode, not machine code. OPcache is similar to, say, Python's .pyc files.

</comment></comment></comment></comment><comment><USER10> That's quite a performance improvement. I'm curious if this was directly related to just switching to PHP7, or something under the Tumblr hood, that they improved upon as well. While reviewing their own code.

<comment><USER11> Significant improvement in response times, TPS, and memory usage are pretty universally observed when switching from PHP5.x to PHP7...

[https://www.symfony.fi/entry/symfony-benchmarks- php-56-hhvm-...](https://www.symfony.fi/entry/symfony-benchmarks-php-56-hhvm- and-php-7)

[http://www.zend.com/en/resources/php7_infographic](http://www.zend.com/en/resources/php7_infographic)

[https://techblog.badoo.com/blog/2016/03/14/how-badoo- saved-o...](https://techblog.badoo.com/blog/2016/03/14/how-badoo-saved-one- million-dollars-switching-to-php7/#launch-into-battle-and-the-results)

Edit: A slide deck with some detail on why it's so much better: [http://www.slideshare.net/nikita_ppv/php-7-what-changed- inte...](http://www.slideshare.net/nikita_ppv/php-7-what-changed-internally- php-barcelona-2015)

<comment><USER9> A fun thing about that slide deck: the memory use reduction is actually even better, because allocation overhead isn't counted there.

</comment></comment></comment><comment><USER12> We use the Rackspace Cloud Sites PAAS. They recently released a PHP 7 beta.

For our sites running Bolt - a PHP CMS which makes heavy use of autoloaded classes - we saw a performance improvement between 45 and 55 percent. For Wordpress, it was around 30-40%.

<comment><USER13> Were there major improvements to autoloading in PHP7?

<comment><USER14> It's possible that when switching to PHP7 opcache was enabled by default, whereas it may not have been beforehand. Most likely opcache is responsible for the autoloading improvement.

That said, a faster parser and intepreter would do autoloading faster as well, so it may not be opcache at all and just by virtue that the autoloaded classes are interpreted faster.

</comment></comment></comment><comment><USER15> In addition to latency and cpu usage improvements, we also saw a substantial drop in memory usage for code that allocated a large number of objects. After the initial migration, PHP7 has been very solid in production.

</comment><comment><USER16> I like the performance of php 7 very much. It has/will have an impact on global warming.

The only frustrating thing about it is, that there was so much potential unused for so long. Manh k/mwatts of power for nothing.

</comment><comment><USER17> Wow good for the environment :)

</comment><comment><USER18> I wonder if Wikipedia regrets its switch to HHVM, having in mind that PHP7 is quite the same fast as HHVM is real apps and switching to it would require much less work than to HHVM.

</comment><comment><USER19> > As you can see, the latency dropped to less than half, and the load average > at peak is now lower than it's previous lowest point!

the graph they're referencing shows the peak at higher than the previously lowest load. i guess "peak average" is the key to this.

</comment><comment><USER20> We at www.pricecheck.co.za switched early this year. We were supersized how easy the transition was. We definitely saw a decrease in cpu usage about 20%. Also most of our php-extension(nothing exotic) was also supported already...

</comment><comment><USER21> Sorry for being a bit ignorant, but is there a point to use PHP 7 if you have HHVM?

</comment><comment><USER22> Unrelated question: I couldn't find any HN discussions on, what's Tumblr's future since the Verizon purchase? Yahoo let it be, it seems, has Verizon mentioned it?

</comment><comment><USER23> PHP 7 is the next upgrade from PHP 5? I am very new to PHP and learning from a book which is PHP 5.

<comment><USER24> Try `print false;` and see if you get the result you expect[0]. Because it differs compared to node, perl, python(Yes Yes first char uppercase) and other languages I can not think of.

Also good luck with the param ordering of `array_map` compared to `array_filter` and `array_reduce`. Actually get use to the word array. Because in 2009 the PHP developers did not think array is a important data type that needs a short hand array() vs [], and all their function names `array_` shows this ugliness.

I would advice rather spend your time learning python or javascript. But I acknowledge PHP became a de facto standard with MediaWiki, WordPress, Facebook, dragging the broken language into the 21st century.

[0]: [http://pastebin.com/raw/P6BTmceL](http://pastebin.com/raw/P6BTmceL)

<comment><USER24> For the down voters please see [Petty Issues I have with PHP!](petty); and please reply.

I would really like to talk about this constructively.

[petty]: [https://gist.github.com/Morabaraba/3e93d7d21e16b6eb8266ee1cc...](https://gist.github.com/Morabaraba/3e93d7d21e16b6eb8266ee1ccbdf77f8)

ps. can you not edit your comment anymore... could you ever edit your comment?

<comment><USER25> Once the comment gets to a certain age (an hour?), it's no longer editable.

</comment></comment></comment></comment><comment><USER8> Php 7 for the win!</comment>


Son of Stuxnet Found in the Wild on Systems in Europe - <AUTHOR> http://www.wired.com/threatlevel/2011/10/son-of-stuxnet-in-the-wild/

<comment><USER2> This is big news. It confirms suspicions that the Stuxnet attack on Iran was not going to be a one-time thing. We now know that at least one group has already been running these types of attacks and surveillance all over the world for the past two years (with much more likely planned). In the coming years, this kind of thing is going to be the norm for nations and other organizations with the resources.

</comment><comment><USER3> Joe Weiss spoke about exploits of this sort in the Stanford EE Computer Systems Colloquium on Oct 12, 2011. View the video of the talk and download the slides at <http://ee380.stanford.edu>.

</comment><comment><USER4> Why does the article assume is made by the same people who wrote Stuxnet? Stuxnet source code from an IDA Pro dump is available in GitHub and in torrents.

<comment><USER5> Symantec's write-up has more details and comparison of Stuxnet and Duqu - [http://www.symantec.com/content/en/us/enterprise/media/secur...](http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf)

<comment><USER4> I've skimmed it. My point is that, if the source code of Stuxnet is available on the Internet, anyone could have created Duqu.

<comment><USER6> Try compiling it. You won't get far.

Current binary to C decompilers are not sufficient to reproduce and modify moderately complex software. They just make analysis easier, because it's more like reading pseudocode.

</comment></comment></comment></comment><comment><USER7> What I don't understand is, how does it send the information it gathers back to its operators? I thought that these industrial facilities weren't usually connected to the internet, and that a worm had to get lucky with a thumb drive to get inside.

How do you run that backwards to get data out? Surely not thumb drives again?

<comment><USER8> This malware does not target air-gapped industrial control systems. This is just a remote administration trojan with a keylogging component. The kernel mode driver architecture and hooking method is the same (probably same code) as used in Stuxnet but the malware's purpose is information gathering only, not industrial sabotage.

</comment></comment><comment><USER9> This is probably the longest article I've ever read on the internet - fantastic introduction for me, a person who knows very little about trojans except that the Greeks made a big one years ago.</comment>


Radical Honesty: I Think You're Fat (2007) - <AUTHOR> http://www.esquire.com/news-politics/a26792/honesty0707/ <comment><USER2> It's an interesting idea and an interesting story, but I'm frustrated by what the personal narrative approach does to it. And I'm frustrated that the author didn't take a class or otherwise push Blanton on some deeper questions than "did I do good?"

The standard social norm is "people think some amount, and say less than that". What's being changed is "say less", but an audience that doesn't know that might expect "think more". The comment to the nanny isn't just weird because it's inappropriate, it's unnerving because it raises the question of "if he's willing to say that, what must he be _thinking_?"

So the consequences seem very different between people who are prepped to expect radical honesty, and people who don't. The second group has far more reason to be disturbed than thin-skinned-ness - they think they're talking to someone who's operating way outside normal limits. I'd like to hear Blanton's take on that, though it might well be "screw em".

And, of course, I sort of get the sense that the author was an asshole about the whole thing. Radical honesty is radical, but honesty when things inconvenience you is just "being a jerk". And we get... honesty about sexual urges, honesty about wanting to flake on stories and events, honesty about anger at an editor. There's very little that's confessional here, and quite a lot that's demanding.

</comment><comment><USER3> Radical honesty doesn't have to mean blurting out everything you are thinking. I can tell you the truth without having to explain every way I rationalize how I would process that sentence to you.

For example, if someone asks you "do you like this watch?" and you don't, it's just as truthful to say "no" as it is to say "no because that brand is tacky and it looks out of character for you." Now, if they continue to probe and ask "why," you can answer honestly. But if a simple "no" would suffice for the other party, I don't see how the additional information helps either party.

<comment><USER4> Doesn't that lead to a pretty big loophole that allows lies of omission?

After all, you could just as easily answer "do you like this watch?" with "I like the way its blue colour matches your eyes" or some other true, positive statement that doesn't answer the question as stated.

<comment><USER5> In my opinion, an omission would only constitute a lie if, and only if, the information omitted cannot be safely ignored as irrelevant. Because otherwise the answerer would be omitting information which he personally considers important.

Whenever a person is asked a question, they have at least some idea of both what's relevant to the inquirer (i.e. what's being asked, implicitly or not) as well as what they personally consider relevant (i.e. all that information which might relate to the question). And some thoughts can be safely omitted if they're uninformative.

For instance, it might occur to me when asked about the watch that it looks shitty and tacky. But that thought might occur to me less like an actual opinion and more like an intrusive thought. So it can be safely ignored as completely uninformative to the inquirer, because whatever value it could have to the inquirer later on would be only due to a "broken clock" effect. Because I'd be talking out of my ass.

Now, if there's a loophole, it's only as big as people make it out to be. Because the real difference between honest and dishonest people would remain. And that is, that the former are willing to express their own opinions when asked to do so, whereas the latter would attempt to manipulate their answers, either by omitting information they personally consider relevant or, as you suggest, by attempting to misdirect the inquirer by adding information which they know is irrelevant, but which doesn't appear as such the inquirer.

</comment></comment></comment><comment><USER6> So a guy named Blanton drinks Maker's Mark? That's messed up.

</comment><comment><USER7> As someone who is socially awkward and struggles with the nuances of interpersonal communication, this has a certain appeal. I don't know if I could go whole hog the way the coach in the story does, but removing some of the annoying everyday white lies sounds nice.

</comment><comment><USER8> Sam Harris wrote a good short book on this topic:

[https://www.samharris.org/lying](https://www.samharris.org/lying)

<comment><USER9> This book changed my thinking about lying. One interesting hypothetical raised here is what to do or say when Nazis come to your door asking about the Jews hiding in the attic. To tell the whole truth without omission in such a situation has serious ethical implications.

<comment><USER8> Ronald A. Howard has quite an interesting take on this situation in a conversation with Harris in the appendix. They both talk about lying as self- defence:

> ... The next level is stealing: Needless to say, if I could steal a weapon > from someone who was about to kill me, that would be fine. And if I couldn't > transform the situation as some more enlightened person might—into a real > circumstance of teaching—then I would lie. I would use the minimum > distortion necessary to get the problem to go away.

> At one end of the spectrum, you can be super-optimistic about people. But > let's face it, there are people who are up to no good in all kinds of ways. > I'm not going to abet them in violating other people's right to be left > alone, and I'll do whatever is necessary to avoid that.</comment></comment></comment>


Ask HN: How Does Amazon GO AI Work? - <AUTHOR> OPening this as a discussion thread to understand how Amazon GO AI works. <comment><USER2> There isn't much published, but my hypothesis is:

Very accurate weight sensors on each shelf and a knowledge of which products are on each shelf should provide pretty accurate detection of which products a customer has picked up.

Cameras above shelves recognising simple things like t-shirt color detect _who_ picked up that product.

That's probably good enough for a v1 prototype.

I guess now they combine that with per customer profiles (downrank products I'd never normally buy), and special weighing hardware where products are near identical (eg. Spice racks could have a different weight sensor on each column).

Combine all that with a human review system behind the scenes for resolving ambiguities.

Then remember that most people won't care too much if, out of a large grocery shop of 100 items, they were charged 50c for regular carrots when they picked up organic carrots for 65c.

Finally a simple dispute and refund system for cases which aren't caught by any of the above should keep customers happy.

Remember: Retail theft and shrinkage is about 1%. If you can make your system better than 1% while keeping customers happy, Amazon Go is good to go.

<comment><AUTHOR> It'skept behind the doors but would be interesting to understand from someone who has visited the store.</comment></comment>


How the digital camera transformed our concept of history - <AUTHOR> https://spectrum.ieee.org/tech-history/silicon-revolution/how-the-digital-camera-transformed-our-concept-of-history <comment><USER3> I actually find it interesting to think, in 50 years, how the average person will view "history" visually.

Because for me, history was always linked to visual artifacts -- styles of painting, black and white, jerky films, then styles of film grain and saturation, and so on.

The kind of vivid, "real"-looking photography that comes with cell phones is a very recent thing that it's still all "recent memory" rather than "history".

How would I view events like WWI, or the Civil War, if we could watch them in 1080p? Would they feel "closer"? Will it have the effect of collapsing time? Would we "learn more" from history because we can identify more?

Or will the ubiquity of content make it irrelevant? Will it seem less like history and just more of an extended present that we bother to learn even _less_ from because it just seems the same?

(Sure you could argue that we'll have 360° 30K video with megagamut, and that current photo/video will seem equally quaint, but I don't think that's true. Footage today seems qualitatively real in way that black and white from the 1940's wasn't. I believe there's a threshold of quality we passed that probably started first with digital camcorders, and finished with the advent of 1080p videocameras in cell phones.)

<comment><USER4> There's an old photo taken in 1894 of a Native American girl smiling - <USER2> modern seeming expression makes the photo seem like it was taken yesterday.

It really changes my impression of what the late 1800's were like - it makes me think that they were more like me and less like a stodgy caricature.

[https://mymodernmet.com/smiling-19th-century- photograph/](https://mymodernmet.com/smiling-19th-century-photograph/)

I suspect that modern video will humanize us to posterity.

<comment><USER5> I get the same feeling from that photograph. Amazing how something simple as a smile brings a picture so much closer to us. It feels much more human, I suppose, than the stiff emotionless photos that were common at the time.</comment></comment></comment>