The Google that never was: how the search giant killed a 2007 redesign - <AUTHOR> http://www.theverge.com/2012/3/12/2863705/google-redesign-2007-kanna-killed-strawman

<comment><USER2> It looks like the slides call it "Kennedy", not "Kanna", for whatever reason.

In any case, don't miss the last slide, where there's a chart suggesting a quantitative comparison of two shades of blue:

[http://www.theverge.com/2012/3/12/2863672/google-kanna- and-s...](http://www.theverge.com/2012/3/12/2863672/google-kanna-and-strawman- redesign#3116603)

I presume this is a self-aware reference to the "testing shades of blue" story that designer Douglas Bowman brought to wide attention three years ago, in his Google farewell blog post:

<http://stopdesign.com/archive/2009/03/20/goodbye-google.html>

</comment><comment><USER3> Gmail looks a lot like yahoo mail does. Just personally, I like the white space heavy design better. Less visual clutter

</comment><comment><USER4> Did anyone else look at the Design Porn slide [1] and think "Windows Metro!"?

[1] [http://www.theverge.com/2012/3/12/2863672/google-kanna- and-s...](http://www.theverge.com/2012/3/12/2863672/google-kanna-and-strawman- redesign#3116577)

</comment><comment><USER5> Gmail was better before. They are experiencing some problem with their lab and video chat plugin.

<comment><USER6> Also just being generally slow lately.</comment></comment>


Understanding the Economics of Uber - <AUTHOR> http://talkingpointsmemo.com/edblog/understanding-the-economics-of-uber/#

<comment><USER2> This is a good piece.

I have seen some anecdotal evidence of unsustainability of the business model - e.g. a trip from my neck of the woods to LAX is priced as $114 on Blacklane.com, $110 on Limos.com and $149-197 for Uber Black (so that the comparison is apples-to-apples) - but was never able to articulate it into a longer-term business model problem.

The car service companies do operate at lower-cost structure, and probably don't mind using Uber to fill some spare capacity, but arranging for a trip in advance via a cheap aggregator (not sure what Blacklane or Limos.com charge) will always net the consumer a discount.</comment>


Ask HN: How are you handling US sales tax? - <AUTHOR> Hi, I'm looking to start selling a physical product in the US.  However, it looks like being compliant with the US sales tax laws since the Wayfair verdict is a pain.  Even using something like Amazon FBA doesn't help here.  What are others doing?<p>Thanks! <comment><USER2> If you're just starting out, I'd register and collect sales tax in the state where you have a physical presence. You would only collect and remit sales tax in that state. As you grow your business, you may need to consider economic nexus thresholds to determine if you have nexus in additional states based on revenue or order volume [1].

You may have different sales tax obligations if you decide to sell on a marketplace such as Amazon. FBA sellers may have additional nexuses based on where Amazon is storing your products in fulfillment centers [2]. Marketplace facilitator laws are taking effect where the marketplace may collect and remit sales tax on your behalf in specific states, but you may still be obligated to report sales tax [3].

All of this can get complicated fast. As always, it's a good idea to talk to a CPA or tax professional first.

[1]: [https://blog.taxjar.com/economic-nexus- laws/](https://blog.taxjar.com/economic-nexus-laws/) [2]: [https://blog.taxjar.com/find-amazon-fba-sales-tax- nexus/](https://blog.taxjar.com/find-amazon-fba-sales-tax-nexus/) [3]: [https://blog.taxjar.com/sales-tax-by-state-marketplace- facil...](https://blog.taxjar.com/sales-tax-by-state-marketplace-facilitator- laws-explained/)</comment>


How we made $20,000 on Snapchat and got into Y Combinator - <AUTHOR> https://medium.com/@kmx411/how-to-make-20-000-on-snapchat-and-get-into-y-combinator-2513a7ee371d#.z3l2tu2dz <comment><USER2> Is it ok to go around publicly saying "we got into YC" when it's just a fellowship?</comment>


Coincidence? Beijing Apple Store phone# references Tiananmen Sq. date (6-4-1989) - <AUTHOR> http://www.apple.com.cn/retail/sanlitun/

<comment><USER2> Looking at the bottome of the page I see that Apple have a toll free number 400-666-8800, I take it we're supposed to wonder if that 666 is a coincidence as well?

Saying that, if Steve Jobs was the devil it would explain a lot.

<comment><USER3> Coincidently, the retail price of the Apple I was $666.66.

</comment></comment><comment><USER4> Of course it is; it's just our minds looking for patterns.

</comment><comment><USER5> Well, if it isn't a coincidence, someone's certainly going to get in trouble if we keep shouting about it.

Also I could see this thread getting HN blocked over there too.

<comment><AUTHOR> True enough, though I doubt it's going to be through HN that the Chinese government finds out about it. It's already been noticed on some Chinese- language blogs: [http://chinese.winandmac.com/hotgossip/apple-store-china- mai...](http://chinese.winandmac.com/hotgossip/apple-store-china-mainland/) (this one's from Hong Kong)

</comment></comment><comment><USER2> They use a different date format in China

[http://en.wikipedia.org/wiki/Date_and_time_notation_in_the_R...](http://en.wikipedia.org/wiki/Date_and_time_notation_in_the_Republic_of_China)

It probably wouldn't be recognized by most people as the date of the Tiananmen Sq date (to be honest, to me it looks like 6 April 1989, so it's only signifgant if you write dates the way you write dates)

<comment><USER6> That doesn't necessarily mean it's just a coincidence, though. The phone number may very well have been chosen by an American. Apple is big on central management, after all.

<comment><USER2> Or it was the next number assigned by some computer like most phone numbers, which seems far, far more likely.

</comment></comment></comment><comment><USER7> It will be interesting to find out what modern Chinese people know and think of Tiananmen Sq. events.

<comment><USER8> I've had several international student friends from China. One of them, when they first arrived, gobble up all the information that was censored in China. E.g. taiwan, tiananmen, tibet, etc. And now hates the Communist party to the guts. Then there is another one who said Tiananmen was unfortunate... but it was "necessary"; That one also praised Jiang Zemin on modernising the economy, and told me to focus on that instead.

</comment></comment><comment><USER9> In other non-news the Chinese takeaway on Main Street, Kent has 5-4-1970</comment>


Show HN: Covet – I launched an iOS app that displays luxury real estate listings - <AUTHOR> https://covetrealestate.app <comment><USER2> Wow.

I just hopped over to "show HN" for pretty much the first time ever, and this happened to be the first entry I opened up.

I've got a tiny little app I made that I was planning on posting sometime, but it is _nothing_ compared to Covet app.

Eric. This is a pretty impressive looking accomplishment for a single person.

Maybe I'm totally mis-calibrated on what a single individual can do, but this looks great!

I'm an android user, so cannot actually check out the app, but the landing page looks</comment>


Show HN: Launching Googalytics, my Google Analytics app for Windows 8 - <AUTHOR> http://leoncullens.nl/post/2013/10/15/Launching-Googalytics-premium-app-for-Windows-8-RT.aspx

<comment><USER2> Looks great! The design is super clean. Are you worried about using google's trademark in your name at all?

<comment><AUTHOR> Thanks a lot! I really like that you mention the design, because one of my goals was to create on of the best looking Windows 8 apps. I'm not there yet, but I'll try :)

I'm not too worried about the Google trademark, we'll see how it goes!</comment></comment>


Why The Flow Of Innovation Has Reversed - <AUTHOR> http://www.unionsquareventures.com/2008/09/why_the_flow_of.html

<comment><USER2> _The vector of innovation has changed. It used to be that innovation started with NASA, flowed to the military, then to the enterprise, and finally to the consumer. Today, it is the reverse. All of the most interesting stuff is being built first for consumers and is tricking back to the enterprise._

The basic premise of the article is wrong. NASA specifically, may not play as large a role as it once did, but (most) innovation is still very much a top- down process. Even twitter (which I've seen hailed as innovative again and again) is just a hack on SMS, which of course was not developed by consumers.

He also seems to be implying that web 2ish "social engineering" has outpaced electrical engineering as a means of innovation, which is at best a confusion between the application layer and underlying technology stack.

<comment><USER3> I agree. I wouldn't consider Twitter or Facebook or craigslist innovative. They are really simple technologies (ignoring the software scaling challenges) that have been marketed extremely effectively.

They all are dependent much more on the innovation of others (the cell companies, ISPs, open source software). I haven't heard of many technologies developed at Facebook or Twitter that are being used by NASA or other traditional giants, while I have heard of the converse.

<comment><USER4> _I agree. I wouldn't consider Twitter or Facebook or craigslist innovative. They are really simple technologies (ignoring the software scaling challenges) that have been marketed extremely effectively._

I don't understand why you don't think that's innovative. The definition of innovative is to introduce something _as though_ it was new (<http://www.merriam-webster.com/dictionary/innovate>), which is a far cry from invention. Innovation isn't about creating new things, it's about taking established things and making them appeal to people in a new way.

<comment><USER5> From wikipedia - "Invention that gets out in to the world is innovation."

In that sense, a real innovation is something that is well understood, and tested for its benefit. The thing about craigslist, twitter, facebook, wikipedia, etc is that the real reason that they are so valuable is only a matter of speculation at this point. They are only the beginning of the experiment - not the final output.

You can take a circuit level innovation, and re-apply it in several contexts. You can't take the magic of craigslist or facebook and incur the same value in another situation.. all you can do is speculate on why it worked, and be another iteration of a highly distributed experiment.

What the author is calling innovation, is really just leveraging off the reduced costs of infrastructure to test new tools on consumers. When someone formalizes why the 'social engineering' approaches work, predictably, against this data set, they will then be able to improve, and re-apply with more certainty in the market. That's innovation. I'm not sure how rigorous 'social engineering' is at present, but maybe 'social experimenters' is a better name.

</comment></comment></comment></comment><comment><USER6> Computers simply got cheaper. You don't have to be NASA or General Dynamics to afford them.

</comment><comment><USER7> I think the author may be equivocating on innovation. Anyone would have to agree that the kinds of innovations that NASA was/is responsible for (whether directly or through funding subcontractors) were of a fundamentally different kind and scale than current .com/Web 2.0 innovations. Twitter isn't an X-15; Google is great, but it's no Moon landing.

The kinds of innovations we seem to think we are seeing today are clever tricks compared to the kind of R&D that went into NASA's frankly glorious history of innovation. The resources and incredible intellectual capital that had to be (and still has to be) invested in a new launch vehicle, satellite, or manned craft is just orders of magnitude higher than what is required for innovation of the internet-startup kind.

None of this should be seen to denigrate the innovations that are minting millionaires and billionaires today. Indeed, the truly wondrous thing is that a mere clever trick can make you for life. Unless I'm missing something (and I'm not, at least here), this is the very reason that ycombinator and Hacker News exist at all; You can fund significant innovation that may earn $10^6-$10^9 for $10^4.

For a contemporary example of the difference between these two kinds of innovation, just look at SpaceX. Elon Musk made his money the clever trick way (low initial capital + clever trick + hard work + wonder of the internet) and is now engaged in the "old school" way of making money with innovation (high capital + lots of Ph.Ds + hard work of 100s to 1000s of people + rigorous design, construction, and testing).

</comment><comment><USER8> > The vector of innovation has changed. It used to be that innovation started > with NASA, flowed to the military, then to the enterprise, and finally to > the consumer.

Huh? NASA didn't produce much innovation. Bell Labs did. Edison did. GE did. Heck, even GM and Ford had their day. NASA - not so much.

Even if we restrict ourselves to innovation by govt organizations, NASA is behind at least two of the national labs.

</comment><comment><USER9> For the consumer adopting a new technology is an individual decision which is increasingly becoming monetarily inexpensive requiring mostly a time investment. For the enterprise a change in technology is an organization decision that will impact internal processes that could cause changes to the way hundreds or thousands work leading to a large expense. Because of this cost difference the consumer will be more likely to experiment with new technologies than the enterprise, also, since changes in consumer technology is driven by many individual decisions not a organization decision the changes will occur faster. Currently, this change in the flow of innovation is focused on information technologies. Over time as the cost of other technologies (biotech, custom manufacturing, ...) fall I would expect to see a similar result.

</comment><comment><USER10> Most of the comments here seem to be focussed on the supply side. The big change that this article hints at is on the demand side.

Back in the late 50's NASA and ARPA were two of the biggest customers for computer innovation. Now _we_ are (where we is Internet users in general, not HN readers).

</comment><comment><USER11> I think the nature of innovation has changed a little, too.

I used to work at NASA's TDRSS installation and innovation and new ideas are not really their thing. Maintaining their amazing uptime is, though.

</comment><comment><USER12> America Invents and Japan Innovates.</comment>


Spain wants open source on school laptops - <AUTHOR> http://www.unixmen.com/news-today/212-socialist-party-in-spain-wants-open-source-on-school-laptops <comment><USER2> The article _actually_ says that they're going to go with Windows and Office unless various groups (Socialist Party, Free Software fans) can kick up enough fuss about it.</comment>


Ask YC: Version control hosting site for private projects? - <AUTHOR>

Does anyone know of a good project hosting site? Has anyone used cvsdude, svnrepository etc?  Do you have any good/bad experiences with any of the sites?<p>edit : Should have said something about requirements. I need subversion and  something with >1gb storage and reasonable bandwidth. Trac is also required.

<comment><USER2> Sign up at Assembla.com. It's free up to 500MB. Assembla also gives you Trac and a whole bunch of project management features.

I'm using Assembla for a .NET project with Tortoise as the client GUI.

<comment><AUTHOR> looks interesting.

</comment></comment><comment><USER3> I use <http://www.devjavu.com/> Subversion and Trac hosting.

</comment><comment><USER4> The guy behind svnrepository.com is also behind railsplayground.com. The $5/mo plan at railsplayground gives you a web host AND a free svnrepository account (1GB storage, unlimited repositories, unlimited trac instances, https access, use your own domain..). That might be the best value.

<comment><AUTHOR> looks like an excellent plan. any experience in terms of reliability?

<comment><USER4> Rock solid. I've always had access to my svn repository and it's always speedy using it. I've been using them for about 8 months now.

For svnrepository, the control panel doesn't look that great, though =/. But you really won't use it that often, only once in a while to setup new repositories and trac instances (and users).

<comment><AUTHOR> Thanks for the info. One note of concern : I dont see their terms of service etc ?

</comment></comment></comment></comment><comment><USER5> I am using webfaction with excellent results. You can easily setup a SVN repo and a trac instance. I believe their basic plan starts for $7.50/mo. And if you want, you can install other apps.

</comment><comment><USER6> I've been using unfuddle. They rock.

<comment><USER7> I love unfuddle. I find their UI to be so much cleaner than Trac, and the customer service is great. I usually get a response to any problems in under an hour.

</comment></comment><comment><USER8> Any reason you're using Subversion instead of a distributed system like mercurial or git?

<comment><AUTHOR> Primarily because I am used to subversion (the repo is already in subversion on my home machine). Secondly I am not sure whether I will find hosts for mercurial or git?

<comment><USER8> If subversion is already working ok then I guess there's no pressing reason to switch, but if you want to try something new, git (<http://git.or.cz/course/svn.html>) seems pretty cool so far (been using it for about a week). You can put the repository anywhere you want (e.g. your home directory) so you should be able to run it on any host. The fastest/easiest/recommended way is to just run it locally.

<comment><USER9> Darcs is also a very interesting option. Have you tried it? I've been using it for one week after a few years using SVN and it seems like a very viable option.

</comment></comment></comment></comment><comment><USER10> most hosts now have svn support, I use dreamhost.com

<comment><AUTHOR> uhmm .. didnt know that ! thannks !

<comment><USER11> my short experience with SVN on dreamhost was that it was _very_ slow and a bit flakey.

<comment><USER12> it's slow if you are on a shared hosting package...otherwise it runs very well

</comment></comment></comment></comment><comment><USER13> We use cvsdude.com

<comment><USER14> I use it too. The web UI is kind of brutal but I don't have to go there much. It works, I'm happy with it.</comment></comment>


Devaamo Hack Day with Jolla and Friends - <AUTHOR> http://devaamo.fi/jolla.html

<comment><AUTHOR> Talks about Mer, Nemo and Jolla Mobile.</comment>


1 Billionth Scale Ion Model Of Star Trek Enterprise - <AUTHOR> http://www.nerdesque.com/2010/03/09/ion-enterprise/

<comment><AUTHOR> This micrograph was featured in the 2003 EIPBN Micrograph Contest. The Grand Prize however was won by a micrograph of a thermally actuated serpentine MEMS device: [http://www.zyvexlabs.com/EIPBNuG/2003MicroGraph.html#GrandPr...](http://www.zyvexlabs.com/EIPBNuG/2003MicroGraph.html#GrandPrize)

Here's the contest page listing finalists from past years: <http://www.zyvexlabs.com/EIPBNuG/uGraph.html>

</comment><comment><USER2> By my math, 8.8 µm * 1e9 = 8.8 km. Wikipedia says the Enterprise is about 650 m long (thank god I had to check), so I assume they meant to say a 1:1e8 model.

<comment><USER3> James Theodore Kirk wouldn't even know that.

<comment><USER4> Come on... Tiberius

</comment></comment></comment><comment><USER5> Welcome to the high tech era, where "Mine is smaller than yours" is usually something to brag about.</comment>


Neil deGrasse Tyson Doesn't Think Elon Musk's SpaceX Will Put People On Mars - <AUTHOR> http://www.businessinsider.com/neil-degrasse-tyson-elon-musk-spacex-2013-8

<comment><USER2> Yeah, I don't think he's right on this one, and I think Elon Musk, or someone will prove him wrong.

Earlier this year, the opportunity was made available to make a ONE WAY trip to mars. Thousands upon thousands of people signed up, essentially willing to give their lives.

I don't know how much risk there is to the business if people are willing to go to extremes to be a part of what you're trying to do. Nevermind their progress on rocket propulsion.

There are (crazy?) people willing to stay in an enclosed space for 2 years (? Don't know how much time it takes to mars on a space shuttle) for a trip to a place they can't come back from. Elon just has to give them the chance. I think he can do that at least, in <10 years

<comment><USER3> Just because thousands of people would volunteer to go doesn't mean someone will pay for the trip.

</comment></comment><comment><USER4> Exactly because it's dangerous, private enterprise would be a better fit: large organizations (esp. governmental) are highly risk-averse...

</comment><comment><AUTHOR> I'm wondering why he thinks governments are inherently better suited to execute frontier-like missions. Is it because of the incentive structure? Isn't a government in a sense something like a big company or am I being naive here?</comment>


Ask HN: How has having a criminal history affected your career? - <AUTHOR> Throwaway account. However I wanted to get a feeling for how any of you have dealt with your criminal history (if you have one) and how it had affected your career.
When I was 18 I was arrested for being a stupid kid and was initially charged with armed robbery. When I was arrested, I was facing 15 year sentence w/ a mandatory 5. The charges were ultimately reduced to grand theft where I was subsequently assigned probation for 4 years and a couple hundred community service hours.
I got extremely lucky, finished my community service hours within 7 months, landed a job (was a requirement, although it took nearly ~70 job applications to get one) and was able to get off probation by the end of the first year by representing myself in court for an appeal of my probation.
The experience really shattered my life (especially  immediately right after getting arrested) but threw me full force into programming since I had so much free time (couldn't leave the county, had regular checkups by my PO, and was literally just fearful of law enforcement in general).
It's been 10 years since, and I'm happy to say that I've been extremely lucky that I haven't (to my knowledge) been denied a job because of my past. Although it has come up nearly every time I've landed a job. I've been able to get around it by just talking to them about the situation.
This post is inspired by the recent 70millionjobs launch [https://news.ycombinator.com/item?id=14911467].
To me, support DURING the after math of being arrested, would have been a lot more beneficial to my overall wellbeing. When on probation or parole the system literally feels like you're setup to fail, and requires a state of organization and perseverance I've never required in my life before it. <comment><USER2> Reading stories like these really make me glad that I wasn't caught for stupid shit I did as a kid. It does make me worry about any future children I have though, with more and more stuff becoming a crime and the authorities penchant for punishment farther than rehabilitation it means they may not be as lucky as I was.

</comment><comment><USER3> I've heard anecdotally that Google denied a dude for a misdemeanor. Can anyone else confirm or deny that?</comment>


MStream Express – A selfhosted music streaming server for Windows - <AUTHOR> https://github.com/IrosTheBeggar/mStream/releases/tag/v3.0.4 <comment><AUTHOR> Hey there,

I'm the developer behind mStream. I've tried a bunch of self-hosted software out and I created mStream Express to solve a few common problems. The first is that most self-hosted software has dependencies. You can't just download and run it. mStream Express comes with all dependencies bundled in the exe so you can get run it without installing anything else.

Additionally mStream Express comes with a GUI management tool. You can do all your configuration without having to touch the command line or a text editor. This makes the bar to entry much lower than most.

And finally, mStream runs on windows. A lot of solutions I tried just didn't work on Windows. I made Windows support a priority since it's not uncommon for users to have their music collections on a windows PC.

Let me know if you have any questions</comment>


Reddit has no idea how their front page works - <AUTHOR> http://technotes.iangreenleaf.com/posts/reddit-has-no-idea-how-their-front-page-works.html <comment><USER2> So much FUD... Of course no single person fully understands every little detail in a complex system. This is why humans work together to build stuff and why we use contracts and abstractions to avoid dealing with complexity.

Nobody is controlling you via algorithms unless you're so weak you can't possibly think about anything other than what Netflix suggests you watch next.

Oh my, "suggestions"! The conspiracy is right there in the title! :O</comment>


Predictive policing lacks accuracy tests - <AUTHOR> https://www.muckrock.com/news/archives/2019/nov/05/predictive-policing-lacks-accuracy-tests/ <comment><USER2> not only does it lack accuracy tests, it has been studied in the past, for example by RAND¹ and there's no evidence that it works at all.

more importantly, it should be noted that these are essentially unproven systems that are being beta tested on largely minority groups. That something like this is happening in a country with a rule of law and at least in theory constitutional safeguards is reprehensible.

[1][https://link.springer.com/article/10.1007/s11292-016-9272-0?...](https://link.springer.com/article/10.1007/s11292-016-9272-0?wt_mc=Affiliate.CommissionJunction.3.EPR1089.DeepLink)

<comment><USER3> The study you link is of a very different kind of system: creating a list of people considered likely to be victims of homicide or violent crime, and trying to intercede.

PredPol, the system in the article, does _not_ do that. PredPol is primarily about mapping crime in space, and trying to predict which regions of space are most likely to have future crime. It doesn't focus on individuals in any way.

The people behind PredPol did run a randomized controlled field trial with LAPD and claim to have found reductions in crime by directing patrols to predicted hotspots [1]. Hotspots policing studies generally have found reductions in crime when directing patrols to hotspots, or conducting targeted interventions (like improving street lighting, talking to local businesses, etc.). But I should note that running a good, well-controlled experiment of something like policing is _very_ hard, so the quality of the evidence is not exactly astounding.

 _However,_ there are indeed constitutional implications, as you note. For example, if a model says an area is a "high crime area", police may be able to use that as part of the justification for stop-and-frisk, reducing the need for any individual suspicion or reason to search you. And, of course, there are fairness problems: high-crime areas tend to be poor and minority areas, and hotspots policing may harm trust in police (if they harass the residents for petty offenses) and either lead to overpolicing or underreporting of offenses.

I have a fairly thorough review of the literature on my website [2].

[1] [https://www.tandfonline.com/doi/abs/10.1080/01621459.2015.10...](https://www.tandfonline.com/doi/abs/10.1080/01621459.2015.1077710)

[2] [https://www.refsmmat.com/notebooks/predictive- policing.html](https://www.refsmmat.com/notebooks/predictive-policing.html)

</comment></comment><comment><USER4> It's pretty well known that increased policing doesn't decrease crime. These are the same tactics in new clothes used to target PoC. Even if the ML is _working properly_ the biased nature of the existing justice system is going to cause it to target PoC disproportionately.

<comment><USER5> _target PoC disproportionately._

But what would be the purpose of it? Are you saying LAPD wants to put all black people in cages and then enjoy life in a city made exclusively of white (and chinese and indians)?

Or they simply enjoy being dickheads and stop-and-frisking people?

<comment><USER4> I don't know what the purpose is. I can't speak to the intentions of anybody involved, but the data are pretty clear. PoC are disproportionately stopped- and-frisked, they're disproportionately brought to court for minor offenses, disproportionately killed by police, and disproportionately sentenced, relative to white defendants.

The why is an interesting thing to pursue, but I haven't seen a satisfactory explanation of why. The what and how are more clear, though.

</comment></comment></comment><comment><USER6> 'We have demonstrated that predictive policing of drug crimes results in increasingly disproportionate policing of historically over‐policed communities. Over‐policing imposes real costs on these communities. Increased police scrutiny and surveillance have been linked to worsening mental and physical health;and, in the extreme, additional police contact will create additional opportunities for police violence in over‐policed areas.'

[https://rss.onlinelibrary.wiley.com/doi/full/10.1111/j.1740-...](https://rss.onlinelibrary.wiley.com/doi/full/10.1111/j.1740-9713.2016.00960.x)

<comment><USER5> _Increased police scrutiny and surveillance have been linked to worsening mental and physical health_

I find it surprising. I would be happy to see more police in where I live. In my layman's mind police, pretty much by definition, prevents and deters crime. They may not be perfect in that, but in most cases they're fine.

<comment><USER7> > In my layman's mind police, pretty much by definition, prevents and deters > crime.

That would be the case if police were adequately trained and equipped. However US police forces on average (!!) are trained only for not even 9 months (per [https://www.snopes.com/fact-check/police-training- killings-u...](https://www.snopes.com/fact-check/police-training-killings-usa- nordic/)), which means that there are likely cases in which only weeks of training were given. German police, in contrast, train for two and a half / three years (per [https://de.wikipedia.org/wiki/Polizeiausbildung_in_Deutschla...](https://de.wikipedia.org/wiki/Polizeiausbildung_in_Deutschland)).

That, combined with a lack of hiring standards (e.g. [https://www.portlandmercury.com/blogtown/2019/06/19/26671582...](https://www.portlandmercury.com/blogtown/2019/06/19/26671582/portland- police-lower-officer-hiring-standards-to-address-poor-recruitment-rates)) leads to the perception of police being nothing more than paid thugs with a uniform. The massive availability of guns as well as former military equipment in police hands doesn't help either, quite to the contrary. When I have an easy sledgehammer (=a tank and a gun), I'll shoot first and ask questions later.

When it comes to "overpolicing", you also have to note that it's way easier to arrest someone dealing/smoking cannabis on the street (mostly poor PoC) compared to arresting a rich white banker who is snorting cocaine on his desk.

</comment></comment></comment><comment><USER8> Why would they call it PredPol? Don't they get that this could be just as easily interpreted as "Predatory Policing," which is quite likely more accurate?

</comment><comment><USER9> I don't understand why this isn't obvious. Predictive analysis works if you have correct set of data. DOJ is biased towards African Americans, their data is skewed + you can't really predict what someone could do.we are humans and not rule following robots.

</comment><comment><USER10> Unless you are very careful, machine learning is the process of projecting the biases of yesterday into the predictions of today.

</comment><comment><USER11> The alternative to a rule driven machine is human decision makers whose emotions will play a role, sooner or later. (Prejudice and favouritism is just two emotions that are bad in this case)

With a rule driven machine, the rules and be reviewed for any direct form of prejudice and favouritism.

<comment><AUTHOR> We've already had rule-driven frameworks: three strikes and mandatory minimums, the latter of which resulted in huge sentences for non-violent drug offenses – particularly those involving crack, a drug more prevalent in black communities, and for which the threshold to trigger a mandatory sentence was 1/100th that of powder cocaine: [https://www.aclu.org/other/cracks- system-20-years-unjust-fed...](https://www.aclu.org/other/cracks- system-20-years-unjust-federal-crack-cocaine-law)

<comment><USER5> That's something I never managed to understand: if I'm a black person, and I know that current laws will unfairly publish me for drugs possession, and I know that police tenderly loves to search me at any opportunity... Doesn't it mean that I should stay as far as I can from crack and beg all my friends and relatives to do the same?

<comment><AUTHOR> You could say that for any crime or malady of society, that it's confusing to you why millions of fellow citizens have chosen something you've found easy and obvious to avoid yourself. That doesn't address or excuse why one variation is vastly disproportionately punished.

<comment><USER5> I understand your point, but it's not about "any crime", it's about a very specific variation of a crime. Imagine DUI having a much more severe punishment and zero tolerance limits if the driver was caught between 10pm and 11pm. Now, it's 10:30pm and you've just had half a pint of beer. You need to drive back home. What do you do? Heck, you wait half an hour! Will it decrease total DUI? No. But 10pm to 11pm will be the safest time in the streets.

Poisoning your spouse now leads to a mandatory death penalty? Good. Now you'll just strangle her.

A gang is defined as 5 people or more? Excellent. All robberies are now performed by strictly no more than 4.99 people.

Crack is being cracked down upon? Fantastic. We'll smoke weed/tobacco/soap/whatever.

When there is an alternative, not using it is just dumb.</comment></comment></comment></comment></comment>


The Problem With Client-Side Analytics - <AUTHOR> http://spider.io/blog/2011/10/the-problem-with-client-side-analytics/

<comment><USER2> ...wut?

That's ridiculous. What evidence is there that there are groups of nefarious hackers out there spoofing analytics data on people's websites? I don't think there is a need for this solution because the problem doesn't exist. If I wanted to mess with someone's websites, there are much better ways than injecting some false data into their Google Analytics.

<comment><USER3> It's a problem of information asymmetry in the online (display) advertising industry, not a problem with hackers. Because advertisers don't know how many pageviews/visitors a website has, advertising agencies often have to make purchasing decisions based on numbers from Comscore, Quantcast, Google Analytics etc. Clearly, if the website owner can spoof his analytic data, he can sell his inventory at higher rates.

<comment><USER4> ...but not for long, because his CTR will be down on the floor.

This feels to me like a clever solution for a problem that doesn't exist.

<comment><USER3> Sure, that's why I wrote "online (display) advertising", which often has its cost measured in CPM, not in CPC, so CTR doesn't matter. This shows advantages of CPC ads over traditional display advertising and partially explains the success of Google.

I do not have technical ability to judge whether his solution can really solve this problem, however the problem does exist, though not widespread, and who can solve it will have a great chance to earn a lot of money. AFAIK advertising agencies pretty much trust the data from the like of Comsore. It's not that they don't know the data is not really accurate, it's that they don't have anything else. How much does Comscore sell its packages? I don't know, but I'm sure it's not cheap and online advertisers/marketers still have to buy them.

</comment></comment></comment></comment><comment><USER5> Our company has its own internal analytics system and, while their approach could technically work to prevent spoofing, there's other, simpler ways. The first is simple deduplication of received events. This will carve out a large portion of invalid requests, particularly if you have thresholds of time for how frequently a received event is considered valid. The second is to calculate the quartiles and outliers. This allows you to remove all but the most sophisticated spoofing and is good practice to remove ill-behaved browsers and filter out things like malware detection tools that duplicate browser requests if they haven't seen the site before. There's many operations you can do to determine the validity of data received, however who knows how much of this is actually done by analytics providers. We've built our own internal analytics system (and expose it to customers) because existing solutions weren't robust enough for our needs. The biggest lesson has been that trying to get higher than about 98% accuracy on delivered events actually lowered the accuracy of events and using calculations on the backend was more reliable, but requires specific knowledge of the type of events.

</comment><comment><USER6> First, that's not a "digital signature", it's a MAC. It's the secret-suffix SHA1 MAC, to be precise.

Second, the secret-suffix SHA1 MAC isn't secure. Its insecurity is the reason we have HMAC.

This seems to me to be the kind of thing you'd want to get right if the whole value proposition of your solution was "verifying URLs with cryptography".

</comment><comment><USER7> 1\. Considering most client-side analytics are based on IP address, you will require a large number of IPs.

2\. It should not be terribly hard to filter out known open proxies or sessions with a specific nefarious pattern.

Overall, I think this post addresses a problem that doesn't quite exist yet; and if/when it does, it can be addresses in many ways.

<comment><USER8> You wouldn't spoof it with an open proxy. This wouldn't be organized crime trying to screw up your A/B testing. This would be individual consumer advocates and reactionaries with a GreaseMonkey script that intentionally sent back wrong numbers or dupes.

And they'd be doing it because of a principle like "these companies don't tell us that they gather and make money off this consumer data. If they won't admit it up front, let's just not give the data to them."

Go ahead, tell me that won't happen at least a few times in the next 5-10 years.

</comment></comment><comment><USER9> We noticed this problem at Yahoo! (I worked on the web performance analytics). Approximately 2% (note, that's 2% of 200 million daily) of our beacons were "fake". Now there are two reasons for fake beacons.

1\. (Most common) many small sites seem to really like the design of various Yahoo! pages, so they copy the code verbatim, and change the content, but they leave the beaconing code in there, so you end up with fake beacons.

2\. (Less common) individuals trying to break the system. We would see various patterns including XSS attempts in the beacon variables, and also in the user agent string. We'd see absurd values (eg: load time of 1 week, or 20ms or -3s, or bandwidth of 4Tbps).

It's completely possible to stop all fake requests, provided you have control over the web servers that serve pages as well as the servers that receive beacons. It's costly though. Requiring you to not just sign part of the request, but also add a nonce to ensure that the request came from a server you control (avoid replays). Also throw in rate limiting for added effect (hey, if you're random sampling, then randomly dropping beacons works in your favour ;)).

It doesn't stop there though, post processing and statistical analysis of the data can take you further.

It gets harder when you're a service provider providing an analytics service to customers where you do not have access or control over their web servers.

At my new startup (lognormal.com) we try to mitigate the effect of fake beacons the best that we can.

</comment><comment><USER10> Well.. I can see that a problem for 0.5% of business's... maybe... I think he is over thinking this, most business do not need that kind of protection

There are better ways to "hack" a company that spoofing their websites analytic lol, people that got that large number of ips have better (worst) things to do than that..

Also how the f would you know they are ab testing something..

</comment><comment><USER11> Rather than signing requests for the (largish) javascript file (which would benefit most from being cached), it would make more sense for the signed- timestamp key to be passed as one parameter via the image grab. Or am I missing something?

</comment><comment><USER12> Totally off topic but there is a bug in the PHP code example:

echo "<script src=\"[http://example.com/analytics.js?ts=$ts&r=$r&ds=$ts\&...](http://example.com/analytics.js?ts=$ts&r=$r&ds=$ts\\></script>);

should be:

echo "<script src=\"[http://example.com/analytics.js?ts=$ts&r=$r&ds=$ds\&...](http://example.com/analytics.js?ts=$ts&r=$r&ds=$ds\\></script>);

</comment><comment><USER13> In before solution waiting for a... oh, too late. It _is_ a problem. However, signing resources means no HTTP caching of the most expensive resource we generate. That is not practical where I work. Guess the cache can be programmed to do the signing.

There are trade-offs just like every other CAPTCHA-class problem out there. Isn't that what you are after: an automated human detector?

</comment><comment><USER14> This is a solution looking for a problem.

I know my Google Analytics aren't 100% correct, but I don't think people are spoofing them. The differences lie more in people who click through faster than GA can load (which can be easily possible on those still on 56k), or have "privacy blockers" in their ad block to remove GA altogether.

</comment><comment><USER15> One of the problems with client side analytics is they don't give you the whole picture i.e 4xx and 5xx errors are missing from them</comment>


Amazon EC2 Dedicated Instances - <AUTHOR> http://aws.typepad.com/aws/2011/03/amazon-ec2-dedicated-instances.html

<comment><USER2> There are some features which read, essentially, "Check this box if you're an enterprise." This is one of them -- it addresses a very narrow slice of security concerns of the sort that people with a checklist need to address and most of us are (by implication) OK with ignoring. You should generally expect checking boxes like this to be very expensive, because anyone who checks it is not primarily motivated by money. (Similarly, Amazon isn't implementing this so they can get $10 per hour. That is absence of whee. Whee is landing the kind of client who requires this sort of thing to consider EC2 as an option. Their needs laugh in the general direction of $70k a year.)

See also: compliance, auditing, etc, etc.

<comment><USER3> Some people actually need the performance guarantees, too. I've heard a lot of people whine about the unpredictable performance of I/O caused by shared tenancy, specifically people running decent sized cassandra/hbase installations or multiple database hosts. If you're willing to pay for a higher guaranteed minimum baseline, you could be in this market without a butthead ISO 9000 checklist.

<comment><USER4> But Amazon can, and still will put multiple (of your) instances onto the same box. So performance is still not as predictable as a dedicated machine.

</comment></comment></comment><comment><USER5> I understand a fractional machine being wasted, but I'm a little confused as to the pricing. $10/hour => $10 x 24 x 30 = $7200/month?

I understand its useful if your running thousands of instances but I don't see the value in it as a public service. Wouldn't it be much cheaper for small clients to simply take your business elsewhere where you can get high-end servers in the $2000 range?

<comment><USER6> This looks like a fixed cost _per region_ , rather than a cost per instance. If so, it might actually end up being quite cost-efficient.

 _"we add a $10/hour charge whenever you have at least one Dedicated Instance running in a Region. When figured as a per-instance cost, this charge will asymptotically approach $0 (per instance) for customers that run hundreds or thousands of instances"_

</comment></comment><comment><USER7> Really exciting. By far my biggest hope for EC2 is scriptable on demand dedicated hardware. I even flirted with the idea of launching a company the did just this.

The pricing seems designed to make it a feature only usable by really big customers though, which seems like a big mistake that hopefully they can do something about. Maybe by adjusting their server configs or something.

Still keep getting impressed by the AWS team.

<comment><USER8> I believe Softlayer offers an API where you can script some aspects of ordering and managing machines. I haven't spent much time on it though, but I suspect it isn't scriptable in the sense that EC2 stuff is.

<comment><USER4> You can order and provision (with hardware config, OS installation/image) via their API.

I just find that the time to provision is much slower than EC2 (10-20 minutes vs. 1-5 minutes).

</comment></comment></comment><comment><USER9> The pricing model seems like it could be a big win for heroku, phpfog, and anyone else arbitraging EC2. Edit: My reasoning is that currently EC2 performance sucks and is reliably inconsistent, and if you can spend a fixed price to ensure that you're actually getting what you're paying for, as an ec2 arbitrator, your clients are going to be a lot more satisfied

Edit 2: Ah i see, i misunderstood

<comment><USER10> I think you're misunderstanding the pricing model. AWS is charging $10 per hour on top of the regular per instance charges, because if you have a small number of instances they may have to dedicate entire machines to your small instances. As you increase the number of dedicated instances they can put more of your instances on your dedicated machines, recovering the wasted resources.

Heroku and other multitenant PaaS services have no reason to use dedicated instances... customers concerned about running on multitenant platforms wouldn't even consider them in the first place.

</comment></comment><comment><USER11> My main concern with AWS is still EBS and the network latency. While this would prevent others on the same box from starving you of resources, EBS could still be affected by a neighboring box hammering the network.

</comment><comment><USER12> The biggest advantage to this (other than security) is that you won't need to share I/O or CPU time with other people, resulting in much more consistent and predictable performance across the board.

Now, if only they could provide EBS this way...

<comment><USER13> But you have to share it with yourself once you launch multiple instances, which you will if you are paying $10/hour.

</comment></comment><comment><USER14> I don't see how this makes sense for Amazon.

The $10/hr charge seems to be a flat rate no matter how many dedicated instances you have in the region. Thus I can start 10000 "small" instances and pay pennies per hour + $10/10000. Surely a small instance does not cover the cost of an entire physical machine.

This seems like an economical way to DoS EC2

<comment><USER15> I'm pretty sure the $10/hr ensures no-one _else's_ VMs run on the hardware your VM is running on. If you spin up 10 small instances, I think they'd happily put them all on the same hardware, just like that might have done anyway, and pocket the $10/hr for no cost to Amazon (except the minor administrative cost associated with getting that all right).

<comment><USER16> Sounds like this might reduce redundancy - if all your instances tend to be on the same machine, a single failure could take them all out...

<comment><AUTHOR> It doesn't work like that. There's some intelligence built in to the instance placement algorithm to guard against this.

</comment></comment></comment></comment><comment><USER17> It sounds to me like they are saying they really don't want to sell these Dedicated Instances.

</comment><comment><USER18> 10$ / hour is HUGE

<comment><USER19> That's $86,700 per year, not cheap to say the least. Is that kind of setup good enough for some level of PCI compliance? I think they still require that your servers are physically secure.

<comment><USER20> Yes Amazon has PCI compliance now, well the parts they need. The physical security is fine too, their datacentres are well secured. So this type of workload is possible.

</comment></comment></comment><comment><USER21> What about IPv6?</comment>


NSec – a modern cryptographic library for .Net Core based on libsodium - <AUTHOR> https://nsec.rocks/ <comment><USER2> There probably is an opening for a language that has built in cryptography.

<comment><USER3> .NET has built in crypto [https://docs.microsoft.com/en- us/dotnet/api/system.security....](https://docs.microsoft.com/en- us/dotnet/api/system.security.cryptography)</comment></comment>


How Much Tax Do We Really Pay - <AUTHOR> http://www.nowandfutures.com/taxes.html <comment><USER2> The article forgot to mention that the well well well above average pays waaaay less than the numbers mentioned due to their access to complex, yet legal tax schemes.</comment>


OneSocialWeb: We're Ahead Of Diaspora In The Creation Of An 'Open Facebook' - <AUTHOR> http://techcrunch.com/2010/05/13/onesocialweb-were-ahead-of-diaspora-in-the-creation-of-an-open-facebook/ <comment><USER2> Honestly, I am dumbfounded at all the money and publicity that is getting thrown at Diaspora when they haven't really accomplished anything yet.

I don't think OneSocialWeb will succeed, either. What will likely happen is Facebook will adjust their course or a slightly different Facebook clone will come out with sensible customer-focused privacy policies (like Mint or Wesabe had) and ways to get your data out if you want to leave.

<comment><USER3> Absolutely. I'm actually kind of surprised at how relatively inept Google is in the social networking field. They have Orkut, but it's pretty much a flop in the US. I mention it in another comment, but they have pretty much the perfect platform in Wave for building a serious distributed social network, but instead bill it as being a glorified email replacement. And Buzz? Is it even worth talking about?

<comment><USER4> Me too, but I'm starting to wonder if they're holding off because they don't want to be the subject of antitrust complaints.

<comment><USER5> Might as well give all those high paid lawyers something to do.

</comment></comment></comment></comment><comment><USER6> What I said in comments on the other story (<http://news.ycombinator.org/item?id=1344138>):

"When I last thought about it, I became convinced that we don't need an single _implementation_ , we need _standards_ for multiple implementations to interact. Stuff like RSS, OpenId, OAuth, etc. It's a lot less glamorous to work to these, and to try to push them forward, but it's a lot more useful."

<comment><USER7> After Diaspora works, it should be easy enough to standardize its protocol. Fixing a non-working, prematurely-standardized protocol is likely to cost more.

<comment><USER6> Based on other experiences that's "if", not "after".

But no, it's not easy, unless things like OAuth and OpenId implementations are easy to you, which puts you in a very select group.

What about all the other distributed social media experiments, which have been around longer, done more, and are working with established protocols? I still think that this is the real way forward.

</comment></comment></comment><comment><USER8> OneSocialWeb, Diaspora et all are solving the wrong problem but are getting attention because of the general grumblings about Facebook. The issue causing the most Facebook user dissent is privacy. Open protocols do little to address this; having your whole social graph (think embarrassing pics) sitting on any server out of your control, whoever the owner, is the problem.

What is needed is a system that guarantees privacy by storing your social graph is such a way that it cannot be data-mined, sold, leaked, or linked by other websites. One way to do this is to have all data on the server be encrypted where the key only resides on the client side.

OneSocialWeb does nothing to solve the privacy problem.

<comment><USER9> I think Diaspora may have this one covered:

<http://www.joindiaspora.com/project.html>

"Distributed Encrypted Backups"

<comment><USER8> That's a 'backup', that has nothing to do with all social content on the servers being unreadable to anyone but those in the graph.

</comment></comment></comment><comment><USER3> I haven't read too much on the technical side of things about this yet, but TechCrunch's quick rundown sounds a lot like what I was arguing Wave had the potential to become when it launched a year ago.

If you stepped back from Wave and stopped looking at it as fancified email and instead as an extensible platform for arbitrary data, it seemed blindingly obvious to me that the next step would be to build it out into a full fledged social networking service. The fact that both projects are built on top of XMPP definitely strikes me as interesting, as well.

I've always been a little dumbfounded that the part of Wave everybody talked about was the collaborative text editing type stuff in the I/O demo, when if you read any deeper, it should have been clear that that stuff was just a UX tech demo and that the important part was the underlying technology. OneSocialWeb sounds a lot like somebody is building a similar technology specifically in the direction I thought Wave would go.

</comment><comment><USER10> Committee. I don't have any grounds for this, but I get the feeling that this is a very typically European project. The website and the fact that it's backed by Vodafone set off my bells. These kinds of projects by states or big corporations usually never launch, but are instead drowning in bureaucracy.

I might be wrong, but this fact alone makes me think Diaspora are doing the right thing in finding their own path.

It doesn't matter a lot to me though, I'm certain that we will build an open social network soon, whether OneSocialWeb, Diaspora or something else.

</comment><comment><USER11> When that spreadsheet of Facebook alternatives was posted the other day, this one ticked the most boxes. Taking a look at their site though, I was greeted by talk of protocols and invited to 'get code'. I know its just early days, but this isn't how you get people using your social network. I want to jump right in. This... is not what I want.

<comment><USER12> Yeah, it would be nice if they had an open server that allowed you to sign up and check it out. There's nothing stopping anybody from setting one up though.

</comment></comment><comment><USER13> The money makes things interesting even though they've made nothing yet. Imagine how things change from a momentum standpoint if they work on the 10 or 15k they planned to this summer and use the rest of the money to get people like Chris Messina and Caterina Fake working on the project

</comment><comment><USER14> OneSocialWeb is ahead, but their solution is geek-oriented, complex, and ugly. Any solution that's not mom-oriented, simple, and pretty just won't catch on.

</comment><comment><USER15> Why do these folks complain about publicity - it is an initiative of Vodafone for goodness sake, the worlds _largest_ mobile phone operator.

</comment><comment><USER9> Well get them to hop on Kickstart, see what happens

</comment><comment><USER16> No one needs yet another facebook or yet another microsoft.

</comment><comment><USER17> Why not just use a vpn?</comment>


WSJ [Andy Kessler] – Cancer Screening by Grail - <AUTHOR> https://www.wsj.com/articles/cancer-screening-leaps-forward-11593973586 <comment><AUTHOR> Ungated full-text via archive.is [1]

> So Illumina spun out a new company named Grail in Menlo Park, Calif., to do > what's known as Circulating Cell-free Genome Atlas studies. [2]

[1] [http://archive.is/Jdbs7](http://archive.is/Jdbs7)

[2] [https://en.wikipedia.org/wiki/Liquid_biopsy#Types](https://en.wikipedia.org/wiki/Liquid_biopsy#Types)</comment>


Udemy CEO, Eren Bali's Story - <AUTHOR> http://www.udemy.com/blog/democratize-learning-eren-bali/

<comment><USER3> I've personally met one of the founders, and it was a damn shame how difficult it was for him to get a Visa to continue growing the company in the US.

We always hear this crap from politicians about how we have to help the "job creators" in the US. Well, Udemy's founders are a shining example of job creators that could use congress's help. Maybe they'll get the memo and finally do something about allowing the world's brightest to start and grow companies here in the US...

</comment><comment><USER4> Very inspiring story. It shows the power of Internet, bringing people together all over the world and giving them a chance to learn and improve wherever they are. In the past only a few percent of the world population had access to good learning tools and teachers.

I honestly believe the world will be a lot more interesting place in 20 years. A new generation or two with access to good quality learning tools on any topic.

</comment><comment><USER5> Wow - great story. This is yet another great American success story - <USER2> still congress can't get our immigration policy figured out. Congrats to Eren and the udemy team...if only congress could get their act together...

</comment><comment><USER6> I have worked with Eren professionally before Udemy was founded at another startup. I was happy to work with him when I did and wish him great success on changing the face of education.

</comment><comment><USER7> To me, the visa story shows just how resilient Eren has been in the face of failing external factors -- in this case, the immigration system. Udemy has a lot going for it.

</comment><comment><USER8> Hey Udemy, please forward this to every member of Congress. Perhaps with a poster that says, "It's the immigrants, stupid."

<comment><USER9> Good luck trying to get Congress to do anything actionable, especially when it comes to education. Any sort of education reform is going to come directly through the internet.

</comment></comment><comment><USER10> Wow, a CEO with a Math Olympiad medal and $12 million bucks. Udemy is going places.</comment>


Replacing JavaScript: How eBay made a web app 50x faster by using WebAssembly - <AUTHOR> https://www.techrepublic.com/article/replacing-javascript-with-webassembly-how-ebay-made-a-web-app-50x-faster-by-switching-programming-languages/ <comment><USER2> Yet for me, eBay's _login page_ takes a full 8-10 seconds to load.

</comment><comment><USER3> eBay's blog post. It's a bar code reader: [https://www.ebayinc.com/stories/blogs/tech/webassembly-at- eb...](https://www.ebayinc.com/stories/blogs/tech/webassembly-at-ebay-a-real- world-use-case/)</comment>


Without language, numbers make no sense - <AUTHOR> http://www.newscientist.com/article/dn20095-without-language-numbers-make-no-sense.html

<comment><USER2> Wait a minute... so... not being taught to count things has an impact on your ability to count things? Whodathunk? :-)

<comment><AUTHOR> I don't think that's an entirely fair representation of the content.

even so, how would you design an experiment to see if language facility affects numeracy facility? And perhaps the place to start is: how would you try to phrase a meaningful question?

I've followed your submissions and replies here on HN for some time, and would be interested in your take on these questions.

<comment><USER2> It is a fair representation... the article states:

 _Spaepen's experiments did not reveal which component of language is crucial to developing an accurate number sense. However, she suspects that it is the "count list" – the familiar sequence of numbers that every speaking child learns early on._

 _Children learn this count list well before they actually understand that "four" refers to four objects rather than three or six, says Michael Frank at Stanford University in California._

So, being taught to count helps with counting more accurately (duh).

I'm not arguing against the thesis of this study, mind you. I believe that language is of fundamental importance to thinking, and certainly, if you're never taught the word-concepts for numbers and counting, you are unlikely to be good at counting things.

However, to prove conclusively that accurate counting emerges out of language (rather than out of being taught how to count), someone would have to devise a method of teaching counting that does not involve language and test that against the normal way. The experiment described in this article proves little. Of course, such an experiment is effectively impossible today, but just because we can't do it (yet) doesn't mean we should accept poor substitutes...</comment></comment></comment>


I implemented fast parallel reduction on the GPU with WebGL - <AUTHOR> https://mikolalysenko.github.io/regl/www/gallery/reduction.js.html <comment><AUTHOR> Hi guys. For the purpose of demonstrating the GPGPU capabilities of the WebGL framework regl([https://github.com/mikolalysenko/regl](https://github.com/mikolalysenko/regl)), I implemented this parallel reduction algorithm on the GPU. Even if I run it on my silly integrated graphics card, the GPU is like four times faster than the CPU.

Yet the implementation is just a simple full-screen shader that is run for a couple of passes. You can see the source code here: [https://github.com/mikolalysenko/regl/blob/gh- pages/example/...](https://github.com/mikolalysenko/regl/blob/gh- pages/example/reduction.js)

In case you are not familiar with parallel reduction, I will explain it here: given some elements x0, x1, x2,..., and a binary operator 'op', the parallel reduction becomes 'op(x0, op(x1, op(x2,...) ))'. For example, given the elements 4, 2, 4, 1, and the operator '+', the parallel reduction will be 11, which is just the sum of the elements.

So parallel reduction can for instance be used to compute the maximum, sum, or minimum of a list of elements. It is a very important component for many parallel algorithms. These kinds of parallel algorithms on the GPU is what makes Google's TensorFlow library so fast.</comment>


Encrypted backups for Android. - <AUTHOR> http://www.whispersys.com/flashback.html

<comment><USER2> Moxie, I don't have an Android at present, but you are on my list for when I switch over.</comment>


Apple v. Samsung: Verdit Reached - <AUTHOR> http://live.theverge.com/apple-samsung-verdict-live/

<comment><USER2> Less than 3 days to go threw all those questions. These guys must be geniuses!</comment>


Chocolate 3D Printer Now Available to Purchase - <AUTHOR> http://laughingsquid.com/choc-creator-the-chocolate-3d-printer-is-now-available-to-purchase/

<comment><USER3> We need a whole new terminology - CPP for Calories Per Pixel? CPI - <USER2> Per Inch</comment>


Don't believe everything you read (2013) - <AUTHOR> http://x-surface.tumblr.com/post/41282771026/x-surface-dont-believe-everything-you-read/

<comment><USER2> Why do you call out Rob Crossley without posting any of his responses? It sounds like he was really rude based on your description yet I have no way of telling whether he was just calling you out after he felt your email was fake.

<comment><USER3> Further, that section seems to imply that Crossley was convinced from the beginning that the story was fake.

"...he accused me of being 18 years old with no job, right off the bat..."

It's interesting that he calls out Crossley as unprofessional when Crossley seems to have done his job rather well. I know we like to equate "professionalism" with "politeness," but it's not Crossley's job to be polite to people---especially people he suspects of deliberately wasting his time.

</comment></comment><comment><USER4> Ryan Holiday's book Trust Me, I'm Lying is a good account of the state of blogs and online journalism today. After reading that book, things like this don't surprise me any longer.</comment>


Tesla Driver Banned from Highway After Being Caught in the Passenger Seat - <AUTHOR> https://jalopnik.com/tesla-driver-banned-from-highway-after-being-caught-in-1825622869 <comment><USER2> Please change link to the BBC story[0] this Jalopnik article links to, as this is riddled with errors.

 _" Note that this took place in England, so the left-hand side is the driver side"_

No, in UK we _drive_ on the left, the driver side is the _right_ of the car.

He was not banned from the M1, but banned from _driving_ for 18 months. ie he got his driving licence suspended.

Neither does one pay the Crown _Prosecution_ (a clue to their role) Services (also CPS is Crown Prosecution Service singular) one's fine.

That's enough proof reading :)

[0] [http://www.bbc.com/news/uk-england-beds-bucks- herts-43934504](http://www.bbc.com/news/uk-england-beds-bucks-herts-43934504)

</comment><comment><USER3> That's just one of the reasons why some intermediate levels of autonomous driving are scary.

Drivers get a false sense of safety and stop paying attention. This case is just one extreme example, but I'm sure that many of the drivers that stay in their seat are just as absent as this guy.

</comment><comment><USER4> Seems like a huge oversight that Tesla didn't make autopilot conditional on sensing a person in the driver's seat.

<comment><USER5> I really don't understand why the only response to a driver being hands-off is a "reminder". It should immediately start decelerating and moving to the side of the road, coming to a complete stop if safe to do so, "limping" if not.

<comment><USER6> The M1 is a motorway. That means there's normally 3 lanes (but I think 4 here) and a hard shoulder, traffic travelling at 70 mph (if they're obeying the speed limit), and no stopping allowed.

I agree the reminder needs to be stronger, but it's not possible to safely slow or stop on English motorways.

Here's the road on Google maps: [https://firstname.lastname@example.com,-0.4119246,3a,75y,1...](https://firstname.lastname@example.com,-0.4119246,3a,75y,153.53h,82.3t/data=!3m7!1e1!3m5!1sgPB5G_IYr01h3DA- CFrMAg!2e0!6s%2F%2Fgeo1.ggpht.com%2Fcbk%3Fpanoid%3DgPB5G_IYr01h3DA- CFrMAg%26output%3Dthumbnail%26cb_client%3Dmaps_sv.tactile.gps%26thumb%3D2%26w%3D203%26h%3D100%26yaw%3D102.82819%26pitch%3D0%26thumbfov%3D100!7i13312!8i6656)

I don't know which direction he was travelling.

<comment><USER5> > but it's not possible to safely slow or stop on English motorways.

Bullshit. Never broken down? It's perfectly possibly in the worst possible circumstances to safely pull over to the hard-shoulder.

Smart motorway? The left lane becomes hard shoulder with several miles of lane-closed warnings for other motorists.

Random dual-carriageway with no hard shoulder? Limp-home speed under control is far safe than inattentive driver at motorway speeds. Worst case, stopped in the left (or any!) lane is better than having the driver in the passenger seat.

Jeez!

Feel free to check back in when you pass the driving test.

<comment><USER6> He hasn't broken down though. That law exists because it's dangerous to stop on the hard shoulder.

Rule 264: You MUST NOT drive on the hard shoulder except in an emergency or if directed to do so by the police, traffic officers in uniform or by signs.

Rule 270: You MUST NOT stop on the carriageway, hard shoulder, slip road, central reservation or verge except in an emergency, or when told to do so by the police, traffic officers in uniform, an emergency sign or by flashing red light signals. Do not stop on the hard shoulder to either make or receive mobile phone calls.

<comment><USER7> does "Driver assumed not to be in control of vehicle" count as an emergency?

(I'd agree with the general point though that a system that can't handle driving alone is also going to have difficulties to stop safely, which in many cases is probably the harder problem)

</comment></comment></comment></comment></comment></comment><comment><USER8> Looks like the legend of the Cruise Control RV[1] has become real.

[1][https://www.snopes.com/fact-check/cruise- uncontrol/](https://www.snopes.com/fact-check/cruise-uncontrol/)

</comment><comment><USER9> _A Tesla engineer who testified in the court case reiterated that autopilot is intended to assist a "fully attentive driver"_

...which has a hard time being "fully attentive" when the car (mostly) drives itself. On the other hand, given the recent head-on-into-a-divider incident, I'd say using it has become worse than manually driving since you now have to correct it when it surprises you by suddenly steering into obstacles.

<comment><USER10> The Tesla in the recent accident you reference did not "suddenly steer into" the divider. As other owners have since shown, the car centered itself between what it interpreted as lane markers marking a lane but which were actually two outside markers diverging as the highway split.

Edit: while the end result of both "steered into" and "failed to avoid" an obstacle are the same, the method is very different. If a car suddenly steers into an obstacle, an attentive driver might not be able to react quickly enough to avoid it, whereas driving straight into something the car fails to see is very unlikely with an attentive driver.

<comment><USER11> You're splitting hairs on the definition of "suddenly". It only took a couple seconds for the Tesla to go off the main road's path and drive straight into the divider.

<comment><USER9> There's a video of someone reproducing this (and not crashing) on YouTube --- he managed to stop the car in time, but still came awfully close to the divider, and this is someone who was likely paying a lot more attention at the time than the typical autopilot user.

To have to fight the autopilot and correct the wrong decisions it sometimes makes is what makes it scarier than manual driving, since in the latter case you don't have to fight where the car goes --- unless the steering/suspension is defective or the road is very uneven, it will go in a straight line with no driver input.

</comment></comment></comment></comment><comment><USER12> What the hell is banned form the highway? They should simply take away his license.

<comment><USER8> Yea, seems like a pretty severe under-reaction to only ban him from that specific highway. And for only 18 months at that. An 18 month license suspension seems more reasonable.

<comment><USER13> He was indeed banned for 18 months - the article must have misinterpreted the story. Here's a BBC News article covering it [http://www.bbc.co.uk/news/uk- england-beds-bucks-herts-439345...](http://www.bbc.co.uk/news/uk-england-beds- bucks-herts-43934504)

</comment></comment></comment><comment><USER14> Why is it called "auto-pilot"? It should be "auto- __CO __pilot "

<comment><USER15> Or even better, active lane control/assist, but of course Tesla is all about marketing to the hilt. If the "Gigafactory" were being honest it would be, "Panasonic with a Tesla sicker."

<comment><USER16> Yeah, all those lies from Tesla about rewriting the code for the robots at the Gigafactory, and Grohmann shipping a big automated thing to the Gigafactory, they've confused everyone into thinking that all of the IP isn't Panasonic.

And the teardown guy who was raving about how awesome Tesla's part of the battery pack was, he must be in on it.

</comment></comment></comment><comment><USER17> In perhaps a decade, lawmakers will mandate real time telemetry and remote emergency autopilot.</comment>


Supreme Court Agrees to Hear Case That Could End Texas' Grip on Patent Cases - <AUTHOR> https://www.eff.org/deeplinks/2016/12/supreme-court-agrees-hear-case-could-end-texas-grip-patent-cases <comment><USER2> Thank you, EFF</comment>


Ask HN: Theory to explain celeb salaries? - <AUTHOR>

They don't cure cancer, or give to the world a scientific breakthrough... Just wondering if there's an explanation for why are millions poured into celeb salaries (news time, gossip time, MLB/FIFA/OIC stadiums, music concerts, etc) <comment><USER2> If everyone that is watching a soccer match pays an additional $1 to see Lionel Messi playing instead of me, he deserves a few millions dollars a year.

Two more well written explanations:

Mind The Gap: [http://paulgraham.com/gap.html](http://paulgraham.com/gap.html)

Hitting the High Notes: [http://www.joelonsoftware.com/articles/HighNotes.html](http://www.joelonsoftware.com/articles/HighNotes.html)

<comment><AUTHOR> Yes, but why do people use their money on panem et circenses (bread and circuses) and stay ignorant?

</comment></comment><comment><AUTHOR> Maybe by Social choice theory? [http://en.wikipedia.org/wiki/Social_choice_theory](http://en.wikipedia.org/wiki/Social_choice_theory)</comment>


Percentage of top grossing US films by decade that depict killing  - <AUTHOR> http://blog.jgc.org/2010/08/percentage-of-top-grossing-us-films-by.html

<comment><USER13> Wow, I got it totally wrong. When I read this in my RSS, I read "firms" instead of films and I was wondering what all these businesses were doing portraying killing.

Then when I read the title correctly on HN, I remembered the graph going downward and thought it was weird that films were showing less killing. I clicked through and was surprised to see that the x-axis was _descending_ chronological order.

So now that I finally get the graph, let me throw out a WAG: with the end of the military draft, the almost complete departure of workers from agriculture, and increasing safety in society, violence of any form and especially death is _not a real part of most peoples' lives_. It is therefore fair game for fantasy and storytelling because there is little negative emotional experience attached to it, but there _is_ a high degree of novelty.

<comment><USER14> I was expecting the graph to descend chronologically myself. It seemed to me that every other movie that I remember from 80s and early 90s were slasher films (Krueger, 13th, Critters, Steven King movies). Now, its romantic comedies left and right.

... or maybe I just got married.

</comment></comment><comment><USER15> As martijn points out in the comments, no conclusions can be drawn without data about the pool of all movies.

If it makes you feel better about the world, _actual_ murders per capita is not significantly higher now than it was in the 1960's; I guess we've all figured out that life lessons don't come from blockbuster movies --- just fun explosions.

<comment><USER16> > actual murders per capita is not significantly higher now than it was in the > 1960's

As of 2010, US murder rates are significantly higher than they were in 1960. <http://en.wikipedia.org/wiki/Crime_in_the_United_States>

Violent crime increased significantly in the 60s, 70s and 80s, peaking about 1990. Since then they've dropped somewhat, but we're still at somewhere around 1975 levels.

<comment><USER17> The actual article you linked to says, "Overall, the crime rate in the U.S. was the same in 2004 as in 1969, with the homicide rate being roughly the same as in 1966." As the subject is the homicide rate, that seems the most relevant datum.

<comment><USER18> The largest difference between 1960 and now is reported sexual crimes. Unfortunately they are so under reported it's hard to compare different time periods.

Edit: _The year 2005 was overall the safest year in the past thirty years._

PS: You can get an idea based on the % of serial rapist victims that report at a later date, but that's extremely unreliable.

<comment><USER16> 30 years from 2005 is 1975....

1969, let alone 1975, was considerably more violent than 1960.

Go to [http://bjs.ojp.usdoj.gov/dataonline/Search/Crime/State/State...](http://bjs.ojp.usdoj.gov/dataonline/Search/Crime/State/StatebyState.cfm) select all states and violent crime rates and the push "get table".

You'll see that the murder rate in 1960 was 5.1. By 1969, it had jumped to 7.3. By 75 it was 9.6. It peaked at 10.2 in 1980 with a lesser peak at 9.8 in 1991.

By 2005 the murder had dropped to 5.6. (FWIW, 2004 was 5.5) 2008 was 5.4, which is still above 1960's 5.1

<comment><USER18> Above the rate for the year 1960, but not the rate for the decade 1960's. Still, 5.1 vs. 5.4 for such a rare and random event is not particularly meaningful. Also you need to adjust the numbers to compare the same thing. EX: If you compare manslaughter between 1961 and now a similar drunk driving accident would have a different outcome.

PS: I work with these numbers all the time. Murder is for lack of a better term the least reactive crime type, compared to say assault it far less influence by things like age, education, and gender etc.

<comment><USER16> > Above the rate for the year 1960, but not the rate for the decade 1960's.

My point is that the rates were changing so much during the 60s and 70s that speaking of averages loses too much information. 1960 and 1969 were very different as far as violence in the US is concerned.

> 5.1 vs. 5.4 for such a rare and random event is not particularly meaningful.

It's frequent enough to be statistically significant. We're not talking about the difference between 1 and 2 incidents in a population of 1M, we're talking about 10k incidents in a population of 180M.

The advantage of talking about murder (which includes manslaughter) as opposed to rape and drunk driving is that reporting isn't a big problem - the only argument is over the circumstance of death.

<comment><USER18> Do you really think the probability of someone that caused a fatal accident with a low BAC being charged with manslaughter was the same in 1960 and 2005?

As to being significant looking at different crime rates you tend to see similar trends but the "peak" year is often different. You can try to interpret it to mean something, but the reality is your looking at an imprecise estimate of an imprecise estimates of a highly random event it's really vary random after the first digit.

      1991 Forcible rape 106,593
      1992 Forcible rape 109,062
      1991 Robbery 687,732
      1992 Robbery 672,478

Now look at which crimes rates up vs down from 1992 to 1993 etc.

<comment><USER16> > but the reality is your looking at an imprecise estimate of an imprecise > estimates of a highly random event it's really vary random after the first > digit.

Your assertion would be more convincing if your anecdote was had variance in the second position. Instead, it has variance in the third position (1065 and 1090) and less than half a unit in the second position (6877 and 6725)

The murder/manslaughter numbers are varying by 4-6x as much. (5.1 to 5.3/5.4)

<comment><USER18> My point was, you can ask questions like: Which was the peek year for crime? Why did rape not follow that trend? etc etc.

      Downward trend: - 2.2%
      1991 Robbery 687,732
      1992 Robbery 672,478

      Upward trend: + 2.3%
      1991 Forcible rape 106,593
      1992 Forcible rape 109,062

Edit: By second digit I was talking about % change, (1065 and 1090) = 2.3% change as is 90 and 92.07. Clearly saying 98 to 99 is a change in the second digit where 100 and 109 is a change in the third is missing something.

However, X + 2% vs Y - 2% does not necessarily mean anything. If you want to understand people you need to look beyond any single year to find cause and effect.

PS: A heatwave can significantly change a city's crime rate, but on it's own there is no meaningful long term effect. Average things out over months and years and you can start to see meaning emerge from chaos.

<comment><USER16> > My point was, you can ask questions like: Which was the peek year for crime? > Why did rape not follow that trend?

"What was the peak year for crime" assumes a definition of crime, a way to aggregate rape, murder, etc. While we can agree on one, that agreement isn't binding on others. That's why I didn't claim that there was a peak crime year.

That said, averaging the 60s doesn't make sense as there was too much change.

Demographics alone tell us that different kinds of crime will peak a different times.

> By second digit I was talking about % change,

Since I was talking about to 5.1 to 5.4, the 98/99 comparison isn't especially relevant.

> A heatwave can significantly change a city's crime rate, but on it's own > there is no meaningful long term effect.

You're assuming that weather doesn't have trends or long term effects. I'd argue that the dust bowl did. Urban heat-islands cause persistent heatwaves. (Yes, that's artificial climate, but ....)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> What is there to conclude, other than that people are more tolerant of killing being portrayed in films? After 1980, there's an inverse correlation between the frequency of murder or violent crime in the US and depiction of killing in film - the former goes down while the latter continues to increase. (<http://www.disastercenter.com/crime/uscrime.htm>)

</comment><comment><USER20> It's a silly and misleading graph.

<http://en.wikipedia.org/wiki/Motion_Picture_Production_Code>

Alternatively watch something like Howard Hughes's Hell's Angels (1930)

<comment><USER21> It is lots of fun reading through the pre-Code movie synopses:

<http://en.wikipedia.org/wiki/Baby_Face_(film)>

Sex and violence are not some kind of radical new idea. The shape of the OP's graph is almost certainly caused by the censors of the mid-20th century.

</comment></comment><comment><USER22> The lesson taught in almost every movie is that your problems are only permanently solved by the death of your action antagonist. Even kids' movies have this lesson, e.g. A Bug's Life where the bad-guy grasshopper is eaten by a bird. There are few movies where the action antagonist does not die, and these invariably involve morally ambiguous lead characters (e.g. The Dark Knight).

It's shame that more conciliatory outcomes are not considered. And you wonder about youth violence, but if this is the message taught by every film what do you expect?

P.S. counter examples please!

<comment><USER23> > And you wonder about youth violence, but if this is the message taught by > every film what do you expect?

The facts don't bear this out, despite how often it's repeated. Real world violence is not proportional to violence in movies (or video games for that matter).

</comment></comment><comment><USER24> I think this gets at the distance between US culture, as it were, and the realities of violence. War is not the only source of violence. But it is a big one, which affects the entire culture pretty significantly.

So the 70s correspond to Vietnam. And the 40s correspond to WWII. Today, we also have wars. But we are somehow increasingly disconnected from the realities of what that means.

Anyway, it's a nice chart. But if you ever watch old movies right after WWII (in the 40s, early 50s), you can almost feel the trepidation around anything but those undervalued, safe moral environments. In some ways, it's a more mature audience / understanding -- it's more focused. But because a lot of the country has seen real horrors, it seems like now they crave some kind of careful normalcy (which doesn't have much violence). Perhaps the 70s also had that incentive. A lot of social change and some violence in the late 60s might've prompted it. Or, alternatively, people actually might've believed in non-violence for a while, and that might've stimulated other subjects.

I don't know. But obviously, according to the chart, it's a self-perpetuating phenomenon. So this can be explained by saying that US culture (perhaps increasingly in the form of high grossing films), left to its own status quo momentum, gradually disconnects us from the realities of violence.

<comment><USER25> I tend to think modern US blockbusters, are heavily influenced by special effects rather than characters, which usually means killing lots of stuff.

</comment></comment><comment><USER26> So more lenient movie moral codes wrt censorship and larger budgets for action, combined with a growing expertise in stunts and fight choreography, and a growing movie industry eager to entice audiences into theatres with blockbuster escapist theatre, result in a greater percentage?

There, I drew my own conclusion. Provided the data is true.

</comment><comment><USER27> my brain wants very badly for the data to flow chronologically from left to right, rather than its current arrangement.

</comment><comment><USER28> _If you enjoyed this blog post, you might enjoy my travel book for people interested in science and technology: The Geek Atlas_

Is that a boilerplate footer for every blog post? Because I didn't really see the connection between gore in movies and the book :)

</comment><comment><USER29> So, killing animals that can't "speak" doesn't count? That's odd, I'd pay good money to see people slaughtering those obnoxious anthropomorphic CG animals Hollywood is so in love with.

</comment><comment><USER30> It would be interesting to see if a similar curve exists for movies depicting sex (not necessarily nudity).

</comment><comment><USER31> Big budgets mean big ticket sales. They also mean action. Thus, killing.

<comment><USER32> Let's look at the top 10 (I will use US sales): Avatar (2009) - Yep, Titanic (1997)- Yep, The Dark Knight (2008) - Yep, Star Wars: Episode IV - A New Hope (1977) - Yep, Shrek 2 (2004) - Nope, E.T.: The Extra-Terrestrial (1982) - Nope, Star Wars: Episode I - The Phantom Menace (1999) - Yep, Pirates of the Caribbean: Dead Man's Chest (2006) - Yep, Spider-Man (2002) - Yep, Transformers: Revenge of the Fallen (2009) - <USER12>

So 9 for 10

<comment><USER33> I count 8:

      Avatar (2009) - <USER12>
      Titanic (1997) - <USER12>
      The Dark Knight (2008) - <USER12>
      Star Wars: Episode IV - A New Hope (1977) - <USER12>
      Shrek 2 (2004) - <USER8>
      E.T.: The Extra-Terrestrial (1982) - <USER8>
      Star Wars: Episode I - The Phantom Menace (1999) - <USER12>
      Pirates of the Caribbean: Dead Man's Chest (2006) - <USER12>
      Spider-Man (2002) - <USER12>
      Transformers: Revenge of the Fallen (2009) - <USER12>

<comment><USER34> Shrek 2 might be borderline. The giant gingerbread man bites it, and while he is depicted as a moron, he does speak.

<comment><USER32> yeah, I switched Shrek from yes to no and forgot to update the count - I am a little iffy on the sentientence of the Giant Gingerbread Man.

<comment><USER32> I have been reminded that the fairy godmother gets blown up. So 9 for 10.

So, it looks like the top US grossers only 1 was made without showing someone being killed.

</comment></comment></comment></comment></comment></comment><comment><USER35> Can similar percentages be calculated for cursing, sex, blasphemy, atomic- mutated monsters? (At least one of those probably peaked in the late 50s.)

</comment><comment><USER36> Could some correlation be with average age of movie-goers?

</comment><comment><USER37> How did the author know which depict killing?

</comment><comment><USER38> What will happen after 100%?

<comment><USER39> Erasure of social media presences?

<comment><USER29> What does that mean? Scoble massacred in 3D?

<comment><USER39> Not only killing somebody, but canceling their Facebook account. As if they never existed.

<comment><USER29> I absolutely hate Facebook and the idiots who have made it popular. It sounds like I may not exist.</comment></comment></comment></comment></comment>


Ask HN: Does your company have an open source release policy? - <AUTHOR> I'm working with some fairly new technology (k8s). There's a lot of simple things that can be done with a few minutes work. I've already got a blanket signoff to contribute to upstream repos, but today I found something that would work best if I release a new repo. I'd like to do it from a corporate perspective, because I think it would be good citizenship, however, we don't have a general policy for how public releases are managed.
Does your company have a general open source release policy? Does it include different patterns for contributing to an existing project, vs creating a new project? What about small vs. large projects; i.e. a small module for common use (leftpad) vs a larger project expecting a community (tools like Envoy, Kubernetes)
If there's examples of open source policies we could simply adopt, that'd be great, too. <comment><USER2> My company has this complicated release process for open source software. You have to have a technical review and then a legal review of the package and then it has to go to committee to be signed off. The software can then be released on a specific channel that I've never ever seen someone mention on the Internet.

I'm pretty sure the public release committee would explode if you described pushing commits to a public repo.

For legal reasons I doubt this will change anytime in the near future.

</comment><comment><USER3> Doesn't exactly answer the question as stated, and you seem to not be on the same boat - but I'd like to contribute a flipside story for anybody interested:

I tried to get one together at my last job - got all the way through legal approval and okayed by engineering heads and team leads. But - nothing ever got released as an open source project.

Maybe i didn't push enough, but I also sensed there were invisible obstacles in the way.

For anyone in the same boat - push for it!

</comment><comment><USER4> Our company does. It's a mix of technical review by relevant peers plus a dedicated review committee (mostly looking for good docs and company internals). Then we send it off to legal which is a quick turnaround.

It's a pretty new process and we only have one project out there ([https://github.com/rallyhealth/szl](https://github.com/rallyhealth/szl)), but there's a few projects in review.

With this post, I'm actually thinking the next submission should be our OSS review process and guidelines :)

</comment><comment><USER5> Google's policy: [https://opensource.google.com/docs/](https://opensource.google.com/docs/)</comment>


Anatomy of Wikipedia SOPA Blackout - <AUTHOR>

The blackout on Wikipedia only affects browsers with JavaScript enabled.
The blackout banner is loaded by this script, http://meta.wikimedia.org/w/index.php?title=Special:BannerLoader&banner=blackout
This script create an #mw-sopaOverlay element which fills the viewport.
The page's usual content is not removed. Instead, the #content element and others are hidden by this CSS which is inserted by the blackout script.

    <style id="mw-sopa-blackout">
    #mw-page-base, #mw-head-base, #content,
    #mw-head, #mw-panel, #footer { display: none; }
    </style>
 A user stylesheet can reverse this, for example, https://gist.github.com/1631181
The "edit" links have been removed for normal users. Attempting to edit any page results in the message,

    The action you have requested is limited to users
    in one of the groups: Stewards, staff.
 <comment><USER2> Just paste this into your address bar:

javascript:$('#mw-page-base, #mw-head-base, #content, #mw-head, #mw-panel, #footer').show();$('#mw-sopaOverlay').hide()

Built thanks to this wonderful analysis by tantalor.

</comment><comment><USER3> You can also hit escape just as the page loads, if you're really lazy :)

</comment><comment><USER4> Just disable JavaScript! ;)

<comment><AUTHOR> Aye, the ScriptNo Chrome extension[1] does a good job.

I configured it to "default allow" and then blacklisted "en.wikipedia.org".

[1] [https://chrome.google.com/webstore/detail/oiigbmnaadbkfbmpbf...](https://chrome.google.com/webstore/detail/oiigbmnaadbkfbmpbfijlflahbdbdgdf)</comment></comment>


Systemd-cryptsetup: Booting with encrypted root partition fails instantly - <AUTHOR> https://github.com/systemd/systemd/issues/6381 <comment><USER2> I wonder how elaborate their automated tests are, it is also quite interesting that the provided fix did not introduce any new tests to the codebase for the reported case.

<comment><USER3> Poettering does mention that the tests do not cover LUKS boots, and I would hope they will be adding some in the near future, but I also understand that the priority would be fix first, automated tests second (hopefully), since this is already out in the wild and in need of a fix.

Agreed, though, that full-disk encryption is common (and important) enough that it should merit good automated regression testing, especially simple "does it still boot?" tests.

<comment><USER4> I was actually amazed they don't test this scenario (I was one of first affected by this bug on all my systems about a week ago).

LUKS encryption is probably THE most common setup for newer desktop linux installations, so I was amazed they didn't test this, but just rather plain ol' unencrypted setups.

<comment><USER5> Does any popular distro enable it by default?

<comment><USER6> That's the wrong question, it does not matter what the default value in the distro installer partitioning step is. What matters is that LUKS (often labelled as full-disk encryption or similar) is easily available at install time, and consequently enjoys popular adoption and use.

</comment></comment></comment></comment></comment><comment><USER7> Looks like one of the people on the thread is using Gentoo, which is one of the few distributions that offers a choice between systemd and openrc.

I currently use LUKS for full disk encryption (including /boot) on Gentoo (openrc) with Grub doing the luks unlocking (my initrd has to unlock the encrypted partition too/again, but I just have a key saved within the initrd so I don't have to type the password twice).

<comment><USER8> What do you think is the benefit of encrypting /boot? I can't imagine having anything sensible on there.

<comment><USER9> I would imagine it's more about making sure no one ELSE can drop a payload in there... e.g. a backdoor'ed kernel.

<comment><USER10> Secure Boot should be able to defend against that if you take the time to set it up (you'd need to enroll your own key in the system firmware and then sign your kernel with that key).

<comment><USER7> That is my eventual goal. I want to re-enable Secure Boot, sign my Grub EFI and place my CA (and only my CA; getting rid of the default ones) in the UEFI/BIOS settings. I think you can also embed Grub with a key to verify the kernel. (You can also just compile a kernel with UEFI Stub support, digitally sign it and have that boot directly without Grub, but I'm not sure if you can use luks that way as you still need the initrd to unlock the disk).

This would mean that if your laptop gets stolen, and you have a strong password and disable booting from other devices, the thief/fencer would need to find a way to reset the UEFI before they could install Windows on it and resell it. It's probably still possible, but it makes it much more difficult and they may just have to end up parting out the laptop and tossing the motherboard.

</comment></comment></comment></comment></comment><comment><USER11> Two distros referenced on this thread are Gentoo and Arch - both are rolling- release tinkerer's distros, and it has been noted that the feature in question has been out of scope for QA by the systemd project as of late. The community quickly found and shared workarounds and the bug will get fixed. I was bitten by this bug, but I'm not sweating it.

</comment><comment><USER10> Curious to see this making the front page of HN - what's so special about this bug?

<comment><USER12> Probably the historical animosity around systemd from those that feel it has scope creeped into places it doesn't belong.

<comment><USER5> I don't know where they got that idea. This was almost always in scope by design, if not yet in implementation (at the time)</comment></comment></comment>


Js-joda – Immutable date and time library for JavaScript - <AUTHOR> https://github.com/js-joda/js-joda <comment><USER2> This is inspired by both Threeten [1] and Joda-Time [2], which are well- engineered Java libraries for date/time concepts.

I have often wished for that API to be available in other environments, so this is definitely a welcome addition to JS.

Note that the authors of the library are confused -- Threeten-(backport) and Joda-Time are different libraries with different behaviors, and one isn't an "aka." for another. However, Joda-Time's author went on to develop Threeten based on lessons learned, and this library purports to be a JS port of Threeten-Backport.

[1] [https://github.com/ThreeTen/threetenbp](https://github.com/ThreeTen/threetenbp)

[2] [http://www.joda.org/joda-time/](http://www.joda.org/joda-time/)

<comment><AUTHOR> I started using JS-Joda because I've had a good experience with Noda Time [1], which started a a port of Joda-Time to .NET

[1] [http://nodatime.org/](http://nodatime.org/)</comment></comment>