Visually stunning math concepts which are easy to explain - <AUTHOR> http://math.stackexchange.com/questions/733754/visually-stunning-math-concepts-which-are-easy-to-explain <comment><USER2> For those who are hungry for more, Lucas Vieira Barbosa (LucasVB) has made a lot of great such illustrations for Wikipedia over the years:

[http://en.wikipedia.org/wiki/User:LucasVB/Gallery](http://en.wikipedia.org/wiki/User:LucasVB/Gallery)

<comment><USER3> Lucas also has an interesting blog: [http://1ucasvb.tumblr.com/](http://1ucasvb.tumblr.com/)

And Matt Henderson has some good animations too: [http://blog.matthen.com/](http://blog.matthen.com/)

</comment></comment><comment><USER4> I wish my teacher showed me stuff like that in high school instead of just scary numbers. While I do understand that eventually you need to get down to the numbers, my brain seems to pick up the overall concept much faster seeing nice visual representations like those.

<comment><USER5> It's not just your brain. It's everyone's brain. Human reasoning is fundamentally geometric. What happens when you see people who apparently are able to understand "just scary numbers" is that they are building in their own head these same images. They've had previous exposure to such images and know how to build their own. But in the end, everyone ends up reasoning with drawings.

<comment><USER6> That doesn't conform very well to my understanding or experience. Citation?

<comment><USER7> I too believe that math is most easily understood geometrically. I've suspected this since highschool, when I personally derived many of these gifs during trig class.

I don't have anything more than anecdotes to support this hypothesis, but it shouldn't be surprising given that an entire brain lobe (occipital) is devoted to visual processing [1]. And remember how our first introduction to numbers was "the number line"? The reals are isomorphic to a line, but _defining_ the reals as a line isn't feasible since a line doesn't differentiate the rationals from the reals (or anything in between). But on the other hand, showing kids a line is easier to grok than defining numbers as "an ordered field", isn't it? Also consider that Newton invented calculus using infinitesimals, which made sense to him spatially but didn't find rigorous footing until Weierstrass [2]. Additionally, the Greeks used to refer to finding a figure's area as "quadrature" [3], i.e. finding the area of an equivalent square. If not universal, I'd say geometric interpretations were at least pretty widespread.

[1] [http://en.wikipedia.org/wiki/Occipital_lobe](http://en.wikipedia.org/wiki/Occipital_lobe)

[2] [http://en.wikipedia.org/wiki/(%CE%B5,_%CE%B4)-definition_of_...](http://en.wikipedia.org/wiki/\(%CE%B5,_%CE%B4\)-definition_of_limit)

[3] [http://en.wikipedia.org/wiki/Quadrature_(mathematics)](http://en.wikipedia.org/wiki/Quadrature_\(mathematics\))

<comment><USER6> _" If not universal, I'd say geometric interpretations were at least pretty widespread."_

I'd have had no objection to that. Clearly, _many_ people _do_ learn visually and clearly many people are good at manipulating mental imagery. Support them! Just be careful you're not ignoring those that don't (or at least know that that's what you're doing). If you're going to make a case that there _are no such people_ (or a negligible number) then _that_ needs support.

The story here about imagination seems highly relevant (along with the broader point): [http://lesswrong.com/lw/dr/generalizing_from_one_example](http://lesswrong.com/lw/dr/generalizing_from_one_example)

<comment><USER7> I'm familiar with the typical-mind-fallacy posts and glad to see a LW reference on HN. Just the other day, I read Eliezer's article on Algernon's Law [1]. It's tangentially related. Incidentally, it precedes LW by a decade! His thesis sounds reasonable to me. But I thought MBTI test sounded reasonable too, which I learned doesn't have any empirical backing. So my intuitions may be less than reliable. meh.

> _According to Galton, people incapable of forming images were > overrepresented in math and science. I 've since heard that this idea has > been challenged, but I can't access the study._

So yes, I guess some lack a visual imagination. But I've seen several people enlightened by diagrams, and never seen anyone enlightened via plug-&-chug formulas. So I'd be surprised if a visual imagination did'n confer some kind of advantage in math. I highly doubt that a visual imagination confers a disadvantage, given that Euler had photographic memory. But I concede that the null hypothesis is certainly likely. Yvain says he can't access Galton's study. After a few minutes Googling, I gave up too after I hit a paywal.

[1] [http://web.archive.org/web/200102021712/http://sysopmind.com...](http://web.archive.org/web/200102021712/http://sysopmind.com/algernon.html)

<comment><USER6> _" But I've seen several people enlightened by diagrams, and never seen anyone enlightened via plug-&-chug formulas."_

I've personally experienced being enlightened by both, with respect to different things. I probably lean more toward the visual, but don't expect everyone does (without more, carefully gathered, evidence).

 _" I highly doubt that a visual imagination confers a disadvantage"_

That would surprise me as well, assuming nothing was sacrificed for that visual imagination (and even then I expect a visual imagination to be more useful than many things).

<comment><USER7> I'm sorry to dredge up this thread again, but this boggles my mind.

/u/Someone contests that visualizing things like the Monster Group, M-Theory, or 7 Touching Cylinders is practically impossible [1]. I agree. To reason about the Monster Group, I imagine even professional mathematicians manipulate symbols with functions, operations, et al. But, to quote Eliezer, "Does this person [Ph.D economist] really understand expected utility, on a gut level? Or have they just been trained to perform certain algebra tricks?" [2]

Clearly, the economist does not understand his craft. Were he able to visualize the _substance_ rather than merely Plug & Chug the _symbols_ [3], then surely he wouldn't have bought the lotto ticket. And since symbols are mere abstractions (lossy compressions) of the substance, Plug & Chugging the symbols will rarely trump visualizing the substance. Therefore, I suspect my inability to visualize the Monster Group reflects the limitations of my brain rather than an intrinsic disadvantage of visualization. I.e. I would prefer visualization of the Monster Group to Plug & Chug if only I were smart enough.

(Disclaimer: I have no idea what the Monster Group is. But I do remember seeing an old youtube clip about visualizing 11 dimensions. I still don't get it. If you're interested, [4])

> _I 've personally experienced being enlightened by both_

The way I see things, visualization is necessary. However! Here you are saying enlightenment _is_ possible without visualization... So please share with me, exactly how were you enlightened without visualization? Can you give examples? Does it just happen, like that theory about how savants can crunch numbers without knowing what they're doing on a conscious level? Is it akin to weighting parameters according to how strongly they affect a function's output, like in neural networks? Am I missing something that's totally obvious to you, like how some philosophers argued that imagination didn't exist?

[1] [https://news.ycombinator.com/item?id=7549869](https://news.ycombinator.com/item?id=7549869)

[2] [http://lesswrong.com/lw/gv/outside_the_laboratory/](http://lesswrong.com/lw/gv/outside_the_laboratory/)

[3] [http://lesswrong.com/lw/nv/replace_the_symbol_with_the_subst...](http://lesswrong.com/lw/nv/replace_the_symbol_with_the_substance/)

[4] [http://www.youtube.com/watch?v=JkxieS-6WuA#aid=P-eR3HseAzw](http://www.youtube.com/watch?v=JkxieS-6WuA#aid=P-eR3HseAzw)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I'm surprised that nobody posted the visual proof for the countability of the rational numbers:

[https://en.wikipedia.org/wiki/File:Diagonal_argument.svg](https://en.wikipedia.org/wiki/File:Diagonal_argument.svg)

<comment><USER9> In my point-set topology class we used the diagonal argument as the root of a proof for the following question:

Suppose a submarine is moving in a straight line at a constant speed in the plane such that at each hour the submarine is at a lattice point. Suppose at each hour you can explode one depth charge at a lattice point that will kill the submarine if it is there. You do not know where the submarine is nor do you know where or when it started. Prove that you can explode depth charges in such a way that you will be guaranteed to eventually kill the submarine.

If there's interest, I'll post my solution. My proof actually gives an overview of what order to bomb points in, but I have no idea what it would look like if you plotted out, say, the first 100 or 1000 points. I'd be curious to see someone implement it.

<comment><USER10> I'm interested. What's the solution?

<comment><USER11> The set of all possible submarine routes is countable (velocity vector + position at time 0). Let's assume we have an enumeration of that set. Now it's easy to bomb them all. At time 1 we bomb the point where submarine 1 is at time 1, at time 2 we bomb the point where submarine 2 is at time 2, and so on.

<comment><USER9> Yep, this is how the proof works!

<comment><USER12> How does that use the diagonal argument? If the diagonal argument could be used it would be to prove that the number of submarine routes isn't countable.

Edit: just looked at the SVG called "Diagonal Argument.svg". That's not what I know as the diagonal argument ([https://en.wikipedia.org/wiki/Cantor%27s_diagonal_argument](https://en.wikipedia.org/wiki/Cantor%27s_diagonal_argument), [http://mathworld.wolfram.com/CantorDiagonalMethod.html](http://mathworld.wolfram.com/CantorDiagonalMethod.html))

</comment></comment></comment></comment></comment></comment><comment><USER13> I've often seen hypercubes pictured or described like this: [http://en.wikipedia.org/wiki/File:Hypercube.svg](http://en.wikipedia.org/wiki/File:Hypercube.svg)

...which doesn't really explain much. Then I saw this animation of a rotating hypercube and suddenly it made so much more sense: [http://en.wikipedia.org/wiki/File:Tesseract.gif](http://en.wikipedia.org/wiki/File:Tesseract.gif)

The takeaway for me was that, in that static depiction, the inner cube is a cube, and the outer cube is a cube, and each of the six (apparent) truncated pyramids is _also_ a cube, just a visually distorted one. There are eight cubes in the hypercube and each shares a face with six others, just as the six squares in a cube each share an edge with four others. You could have told me all of that and I wouldn't have understood it, but after seeing the animation I was able to work it out for myself.

</comment><comment><USER14> While the most up-voted Pythagoras theorem proof [1] might be fun to see, it is rather the proof of the spectacular failure of our education - that nobody remembers anything taught in our school. The similarity of right triangles in a circle is proven using Pythagoras theorem in the first place!

Thankfully a better proof is present [2] which depends on distributive property and algebra.

1\. [http://math.stackexchange.com/a/733765/141120](http://math.stackexchange.com/a/733765/141120) 2\. [http://math.stackexchange.com/a/734887/141120](http://math.stackexchange.com/a/734887/141120)

</comment><comment><USER15> This animated gif of the Fourier transformation from the time domain to the frequency domain (from the original post on stackexchange.com) is just stunning:

[http://math.stackexchange.com/a/738048](http://math.stackexchange.com/a/738048)

 _Where_ were these when I was in school?

<comment><USER16> Help me understand why? I feel like I understood everything this GIF was trying to communicate, but also no closer to understanding how the transform itself works.

<comment><USER17> I agree. I understand time and frequency domains reasonably well, but I still do not have a clue _how_ Fourier transformation gets me from one to the another. How do the elements in the animation correspond to the terms in eg this equation [http://www.texpaste.com/n/v6sjue00](http://www.texpaste.com/n/v6sjue00) (which is the Wikipedia definition for discrete Fourier transformation)? I don't even understand what the equation itself is supposed to represent, last time I checked a sum produced a single number, how does that represent a function in frequency domain? I guess the subscript k has some significance, _but the animation does not help a single bit here_

<comment><USER18> k is the output index (the "bin" in the frequency domain), or the notch in the rotated space in that graphic. Every output frequency coefficient contains a full sum of the input function, hence a direct translation of that formula is O(n^2) -- which is why the FFT, with O(nlogn) complexity is so important.

The graphic doesn't really help show how the analysis itself happens, it just presents the result, which is a series of waves that add up to f. The actual process of obtaining a frequency coefficient from a time-domain function is easy to describe: multiply the function by a (co)sine wave with a particular frequency and sum together the result. But it's not very intuitive why that works until you consider that one period of a sine wave sums to zero. By multiplying the sine with the function, you perturb the shape of the sine with just the amount of energy that the function contains at that given frequency. So that instead of summing to zero, the sum measures "how much" of that particular wave is present. That's Fourier analysis.

Fourier synthesis is more easily visualized (I think anyway). Simply multiply a sine wave at each frequency by the corresponding coefficient derived above, and sum those weighted waveforms together elementwise to recover your function.

<comment><USER17> > But it's not very intuitive why that works until you consider that one > period of a sine wave sums to zero. By multiplying the sine with the > function, you perturb the shape of the sine with just the amount of energy > that the function contains at that given frequency. So that instead of > summing to zero, the sum measures "how much" of that particular wave is > present. That's Fourier analysis

Thank you. This really helped.

Based on that explanation, wouldn't the formula be more like: [http://www.texpaste.com/n/nphm1fgp](http://www.texpaste.com/n/nphm1fgp) ? I suppose there is some further magic which allows for phase differences or something.

<comment><USER18> Right, you need both sine and cosine parts, hence e^ix, in order to fully describe the function. Unless the function is completely odd (or even), in which case the transform really is equivalent to `x[n] * sin(2 _pi_ k*x/N)` (or cos). To see why imagine analyzing a function W that is just a plain cosine wave (any frequency and amplitude). If we only use the sine part of the Fourier transform, F(W) is indistinguishable from F(-W). In fact both are zero everywhere.

Transforms that use only sines or cosines (like the DCT) provide a complete basis by increasing in frequency by only a half cycle (pi) rather than by integer cycles (2pi). Essentially trading half a transform of sines and half a transform of cosines for one transform of half-cosines (or sines).

</comment></comment></comment></comment></comment></comment><comment><USER19> I love these. I posted several on my blog a few years ago.

Six Visual Proofs: [http://www.billthelizard.com/2009/07/six-visual- proofs_25.ht...](http://www.billthelizard.com/2009/07/six-visual- proofs_25.html)

Visualization of (X + 1)^2: [http://www.billthelizard.com/2009/12/math- visualization-x-1-...](http://www.billthelizard.com/2009/12/math- visualization-x-1-2.html)

</comment><comment><USER20> Trinomial cube: [https://www.google.com/search?q=binomial+cube&source=lnms&tb...](https://www.google.com/search?q=binomial+cube&source=lnms&tbm=isch&sa=X&ei=Ih9CU8rKCcrkyAGggIHgDg&ved=0CAYQ_AUoAQ&biw=1197&bih=937#q=trinomial%20cube&revid=1326263989&tbm=isch&imgdii=_)

</comment><comment><USER21> Animated / interactive Bezier curves: [http://www.jasondavies.com/animated- bezier/](http://www.jasondavies.com/animated-bezier/)

</comment><comment><USER22> I remember the example that explains how to derive the area of a circle from several years ago, but there is also an analogue for the surface area of a sphere provided you know the volume...

The volume is

      4/3*pi*radius^3

the surface can be broken up into lots of spherical triangles. The vertices of each of these triangles is joined to the sphere's centre to form a load of tetrahedrons. As the number of these triangles increases and their size decreases without limit, their total volume will asymptotically approach the volume of the sphere. The volume of a tetrahedron is

      1/3*base*height.

      sum(tetrahedron_volume)=volume_of_sphere=4/3*pi*radius^3

The tetrahedrons are flattened to end up as triangular columns with equal height (1/3 of the sphere's radius). The resulting shape should be a column with height 1/3 the radius of the sphere whose cross-sectional area is equal to the sphere's surface area. The height is

      1/3*r ...

      (4/3*pi*radius^3)/(1/3*r)=4*pi*radius^2

EDIT: bloomin' asterisks, I should have remembered.

</comment><comment><USER23> Another site that explains Mathematical concepts Intuitively. Trigonometry: [http://betterexplained.com/articles/intuitive- trigonometry/](http://betterexplained.com/articles/intuitive-trigonometry/) Other Topics: [http://betterexplained.com/archives/](http://betterexplained.com/archives/)

<comment><USER23> One more link [http://world.mathigon.org/](http://world.mathigon.org/)

</comment></comment><comment> alok-g Here is a great book along these lines. Not always visual, but always (and often unexpectedly) simple.

[http://www.amazon.com/Q-E-D-Beauty-Mathematical-Proof- Wooden...](http://www.amazon.com/Q-E-D-Beauty-Mathematical-Proof- Wooden/dp/0802714315/)

</comment><comment><USER24> I've found these videos to be fairly interesting.

[https://www.youtube.com/watch?v=yJZP_-40KVw&list=PLN0wPs8UzD...](https://www.youtube.com/watch?v=yJZP_-40KVw&list=PLN0wPs8UzDMjy1-Ynp2ShLO2xTrhzJiGy)

</comment><comment><USER25> How about a quick explanation of radians?

[http://24.media.tumblr.com/dd1b123f13f5578e11b04d7579df1fce/...](http://24.media.tumblr.com/dd1b123f13f5578e11b04d7579df1fce/tumblr_mzn47kFZqE1qk3kdro1_500.gif)

</comment><comment><USER26> This page just underlines my complete mathematical illiteracy. I don't really understand any of it. I would like to get a basic grounding in math, but it seems like so wide a field I have no idea where to start.

<comment><USER27> [https://projecteuler.net/](https://projecteuler.net/) is really a great place to start. Solving the first problem with any level of efficiency means understanding Summation. I didn't even know what that was until I was staring at the programmatic solution to the problem and trying to figure out why it worked mathematically.

Teaching yourself math is far more difficult than teaching yourself programming, but it is possible.

</comment></comment><comment><USER28> Here's one for the integral of y=x^2: [http://www.mathedpage.org/proof/integrating/](http://www.mathedpage.org/proof/integrating/)

</comment><comment><USER29> Really neat representations. I've learned a lot of new stuff tonight from the original post, thanks for sharing! My favorite so far: Gibbs Phenomenon.

</comment><comment><USER30> I just posted a visualization of multiplication of the integers modulo n [http://math.stackexchange.com/questions/733754/visually- stun...](http://math.stackexchange.com/questions/733754/visually-stunning- math-concepts-which-are-easy-to-explain/743542#743542) to this question.

This visualization makes it easy to notice the factors of n and the symmetry of multiplication.

</comment><comment><USER31> Kind of a meta question but is all the latex markup on that page supposed to be styled or do people just write it out like that out of habit

<comment><USER32> I had this problem too, Turns out I have the HTTPS Everywhere plugin for chrome so the page loaded over HTTPS, so mathjax wasn't allowed to load as it was loading from a plain HTTP server

<comment><USER31> Aha, I'm also using HTTPS Everywhere. Thanks.

</comment></comment></comment><comment><USER33> This may have already been posted in another thread, but it doesn't appear to have been posted here. But this is a great visualization for the Pythagorean Theorem.

[http://i.imgur.com/W8VJp.gif](http://i.imgur.com/W8VJp.gif)

Fun for kids, also, when they are learning about it.

</comment><comment><USER34> Personally, I can always use some music to actually get _stunnned_ :)

[http://www.youtube.com/watch?v=kkGeOWYOFoA](http://www.youtube.com/watch?v=kkGeOWYOFoA)

</comment><comment><USER35> The Fourier transform .gif was gorgeous. Anyone know of a similar one for Laplace transforms? (I'm still having trouble building up intuition for the Laplace transform.)

</comment><comment><USER36> Would love to see a similar post for CS Core Concepts (think OOP, Data Structure & Algorithms etc). Anyone know of such a url? Thanks in advance.

</comment><comment><USER37> Very nice! My personal favorite is "The sum of the exterior angles of any convex polygon will always add up to 360∘".

</comment><comment><USER38> The reason why you understand this better then numbers might be because you are more visual orientated.

</comment><comment><USER39> Anybody up to visualizations about quaternions?

<comment><USER40> [http://acko.net/blog/animate-your-way-to-glory- pt2/](http://acko.net/blog/animate-your-way-to-glory-pt2/)

Check out under "Blowing up the Death Star". You'll need a decent graphic card that works well with WebGL though.

<comment><USER39> That's quite good, thank you very much! It's clear a huge amount of effort went into creating it.

</comment></comment></comment><comment><USER41> Very interesting and easy-to-understand presentations. Thanks for sharing!

</comment><comment><USER42> The last one on the page at the moment. Is this what I think it is? LOL. [http://i.imgur.com/8m47tuJ.png](http://i.imgur.com/8m47tuJ.png)

<comment><USER43> If you thought it was tacky and sophomoric the answer is "yes."

</comment></comment><comment><USER43> The topology answer is a great example of the problem some mathematicians have communicating ideas to lay people.</comment>


Microsoft: We Won't Build Own Windows Phones - <AUTHOR> http://www.informationweek.com/news/windows/microsoft_news/240002635 <comment><USER2> Of course not, it will be manufactured by Foxconn.</comment>


California is on the verge of water abundance - <AUTHOR> http://waterfx.co/central-valley/solar-desalination

<comment><USER2> This article completely ignores the key problem: distribution (transportation).

Your source material is the ocean. Your consumers are well inland. In California, for example, you'd have to build a complete Eastbound set of pipelines and distribution mechanisms... and do it across the coastal mountains. Or, transport by roads, resulting in both added pollution and fatal damage to your cost model.

Now, there would be localized useful cases, such as farms in the Watsonville corridor and coastal municipal water districts, but there is no economy of scale.

The most direct application would be a pipeline leading from the desalination plant to the nearest point that you could feed water _into_ a major aquifer, replenishing it.

<comment><USER3> Solar desalination is a form of "distributed generation" \- it bypasses the need for large scale transportation by generating (reusing) water locally. The source water can be the ocean if that is the local resource. Inland, the source water is irrigation drainage (water leftover after irrigation). In other locations the source water is brackish groundwater, wastewater, process water or any other local impaired water source that can be converted to freshwater using solar energy. In essence, desalination is a form of reuse - every user of water can be a re-user.

A good analog for this is rooftop solar, another form of distributed generation. Transporting electricity is bypassed by generating solar energy locally (i.e. at your home). Scale is achieved by having thousands of small generators instead of a small number of large power producers that distribute electricity over long distances.

Net metering takes this concept further by leveraging the existing grid to enhance distributed resources. Excess solar energy is distributed back to the grid - users become providers. The same is true for water - large water users (like farmers) who are connected to the water grid can reuse and generate excess water that is redistributed through the existing water grid.

</comment></comment><comment><USER3> "We do not need to live with insufficient water – this is a temporary condition that is curable, just like a treatable disease. Using clean energy to produce clean water is like a vaccine, preventing and even reversing the spread of water scarcity."</comment>


Ask HN: Is it ok to steal a website's design/branding? - <AUTHOR> Those aren't trademarked are they? Can one use the same colour scheme, font, gradients, etc without legal consequences? <comment><USER2> It's complicated. More details in [https://en.wikipedia.org/wiki/Look_and_feel](https://en.wikipedia.org/wiki/Look_and_feel)

</comment><comment><USER3> They're copyrighted. (And you don't have to file for a copyright to have one.)

Go ahead and reuse fonts and gradients and design something inspired by someone else's website. But don't copy their design in a recognizable way. The latter is both unethical and (in most places) illegal.

</comment><comment><USER4> Depends on jurisdiction, and possibly the design, i.e. if it's very artistic it may be protected, if it's a standard theme with a few colors changed it may not be.

</comment><comment><USER5> Are they in the same industry as you / direct competition? Be careful with this...as the last thing you want is a law suit

</comment><comment><USER6> You can't copy distinctive branding, but there's no way to copyright a color scheme or page layout.

</comment><comment><USER7> Maybe you can just buy a Bootstrap theme?</comment>


MailTrackerBlocker – email tracker and spy pixel blocker plugin for Apple Mail - <AUTHOR> https://apparition47.github.io/MailTrackerBlocker/ <comment><USER2> This plugin is awesome but one thing I've noticed lately is several financial institutions use tracking pixels to verify e-mail addresses and if you don't open an e-mail in a way that loads the pixel once every so often, they drop you from paperless statements.

I've run into this with Capital One and Discover. Every year I have to log in and click "yes I want paperless statements" and then 11 statements later I get one in the mail with a message about "we miss you, you're not opening our e-mails so here's a paper statement unless you tell us you want e-statements and you open our e-mails." Never mind that I log into the mobile apps and web- based account management systems multiple times per month...

<comment><USER3> Just making sure but do you ever click through on an email link or do you just use it as a notification and then go and log in? I'm curious if they just need to be looking at click + open events or if that wouldn't even help in this scenario.

<comment><USER4> Note, of course, that the former increases your risk of accidentally visiting a phishing site.

I kind of wish banks didn't put links in their email.

</comment></comment></comment><comment><USER5> Doesn't Mail do this by default by not loading remote images?

<comment><USER6> Note that apple has a bug, and has had it for years and years.

If you have it turned off it won't load remote images...

EXCEPT: if you forward an email - it will load them all, all of them. This is especially troublesome if you want to forward a phishing email to IT.

(thank you little snitch. also I am not using the latest catalina apple mail)

<comment><USER7> You can bypass this by doing "forward as attachment", which you should be doing anyway, since it preserves the headers.

<comment><USER8> Thanks for posting this.

Your friendly email inspector who needs to explain this x times a day.

</comment></comment></comment></comment><comment><USER9> Many email providers have dealt with this by proxying all external image links in emails through their own services.

See Gmail: [https://support.google.com/mail/answer/145919?p=display_imag...](https://support.google.com/mail/answer/145919?p=display_images)

See Fastmail: [https://fastmail.blog/2014/09/16/better-security-and- privacy...](https://fastmail.blog/2014/09/16/better-security-and-privacy- through-image-proxying/)

Although, I'm not sure if these protections extend to those using third party email clients with these services.

<comment><USER2> > I'm not sure if these protections extend to those using third party email > clients with these services

In Fastmail's case, those protections don't extend. I've tested this and Fastmail rewrites the image URLs when viewing through their webmail client but passes the message unmodified when fetching via IMAP.

I understand why they'd do this but I'd love to have a setting that says to do this privacy rewrite when using an external client.

<comment><USER9> Thanks for clarifying. Might be worth shooting them a message to ask for this feature. They've always been good about fixing bugs and at least responding to requests, even if they decide not to pursue it.

</comment></comment></comment><comment><USER10> Is it possible to port this to iOS?

<comment><USER11> Im pretty sure plugins aren't supported for mail on iOS, but fusion of macos mail and ios mail in future w/ catalyst apps might allow it.

otherwise, you can just disable external image loading</comment></comment>


Multimodal Recurrent Neural Networks that describe images with sentences - <AUTHOR> https://github.com/karpathy/neuraltalk <comment><USER2> previous discussion: [https://news.ycombinator.com/item?id=8632209](https://news.ycombinator.com/item?id=8632209)

The Stanford page for this project also has the paper this work is based on:

[http://cs.stanford.edu/people/karpathy/deepimagesent/](http://cs.stanford.edu/people/karpathy/deepimagesent/)</comment>


Hijacking airplanes with an Android phone - <AUTHOR> http://net-security.org/secworld.php?id=14733 <comment><USER2> I used to make avionics for a living and I don't even understand what this man is talking about. (I don't think he does too) That seems to be just an ACARS sniffer.

ACARS and ADS-b has nothing do to with aircraft control systems. You don't need an android app to intercept satellite communication and even if you 'root' the ACARS computer, it is not connected to the systems that could control the airplane.

Also: to pass DO-254 at level A you must have physical switches for flight/computer functionality, that said, no software can engage autopilot or change AP behavior, you need physical switches to do that. They are NOT similar to keyboard buttons, those switches actually interfere at the hardware level.

<comment><USER3> I concur.

I used to work on interfaces to all the computers on the latest 747 and the 787 and there is no wireless way to talk to any of the computers or sensors that have any input to controlling the airplane.

I am not making this up.

On the 747-400 I was on a group whose computer got input from all the 70+ computers on the airplane. It was all wired.

On the 787 I worked on a database during the development of the airplane that tracked all the information that flowed between computers. Nothing came to any computer that controlled the airplane that was not by wire or fiber optics.

I also dealt with ACARS. It is a read-only system on the airplane. It gets information from other computers and transmits it via satellite to the ground.

<comment><USER4> "I used to work on interfaces to all the computers on the latest 747 and the 787 and there is no wireless way to talk to any of the computers or sensors that have any input to controlling the airplane."

Don't they get weather data from somewhere? And if the pilot thought there was a thunderstorm or heavy turbulence in some direction, wouldn't they fly the plane through what appeared to be the clearest route on their own? (And does the autopilot not take weather into account?)

<comment><USER5> "Don't they get weather data from somewhere?"

Yes, most (if not all) modern airliners have a radar dish in the nose of the aircraft. If you wanted to mess with this, you'd have to spoof radar echoes. Not something you can do from an android phone for sure.

"And does the autopilot not take weather into account?"

No, not in the slightest. Pilots adjust autopilot settings to account for weather. It is not automatic.

</comment></comment></comment></comment><comment><USER6> Welcome to the security conference lifecycle.

Step 1) What's something important? (SCADA / Smart Grid / Air Traffic Control)

Step 2) How likely is someone to catch me on the details? (Low)

Step 3) How dramatic can I make this sound?

Step 4) Press Release / Slide Show / Simulation

Step 5) Enjoy sugar hit of popularity.

Step 6) Get asked about vuln / exploit / PoC

Step 7) Fffuuuuuuuuu... Look! Jazz hands!

Step 8) Go to Step 1.

If you work for a boutique security consultancy, interleave elements of panhandling to various customers, clueless managers beating their chests and claiming expertise, and the occasional Congresscritter / Talking Head interview.

It is frustrating that this kind of noise drowns out the signal of actual, thoughtful research or reasonable disclosure. It is the hacker equivalent of security theater where Sensational New Discoveries (TM) distract from hard work and serious issues.

<comment><USER7> This is more true than not true (my friend Chris likes to call these talks "look at this debug port debugging!"). Some caveats, though:

* Some of these talks are real. For instance, bodega ATMs could in fact be jackpotted. You really could open up most of the hotel room locks.

* Some of these talks involve genuinely interesting technical challenges. For instance, anything involving custom RF work. Or the tolling systems, which also had hardware cryptography. You can appreciate these talks just for technical walkthrough.

* In almost every instance, talks like these target industry verticals where there is little to no attention given to software security. A different kind of software developer works on the firmware for a utility smart meter. There is value in forcibly plugging them in to software security.

As an owner/operator of an established boutique security company, I'd push back a little on the panhandling dig. First, the giant security companies are just as bad about that. Second, not every boutique firm traffics in "look at this debug port debugging" talks. I don't see a lot of BS Stach and Liu talks either. For that matter, n runs has a good reputation too.

<comment><USER6> "Look at this debug port" is spot on, and relevant in the case of the bodega ATM. It's a WinCE single board computer behind a pathetic lock. Pointing out the silliness of the design is relevant. The theatrics that followed? Not so much.

I think it is fair to say not all boutiques play the sensationalist card. The ones that actually refuse to do this presentation clown cycle suffer some damage and have to work harder, because the showy ones grab mindshare while.

I also agree, the big ones do it, too, but it is harder to pick out against the slow lumbering noises as they rumble from one puppy mill PCIDSS gig to the next.

<comment><USER7> I liked Barnaby Jack's presentation, but I have a bias for people who came up at eEye.

I think there's room every year for 1-2 theatrical security presentations --- not that I want to give them! --- and that demonstrating that it's easy to jackpot an ATM or pop open a hotel room door is a perfectly valid bit of theater.

I also think some topics become theatrical without sacrificing technical value. For instance, Nate Lawson, Peter Ferrie and I picked a fight with Joanna Rutkowska a few years ago. There was a lot of drama. But the drama was about the accuracy of HPET timers, the AGP GART, and whether we could probe the branch translation buffers to detect hypercalls. I don't think it should have mattered if we got on stage in clown suits and shot nerf guns at the audience; if you're giving a talk about address remapping chipsets, I think it's all fair game. (In fairness: Rutkowska did not agree about the value of the drama.)

I agree that the theater gets tiresome, and, in particular, I think if you're going to shoot for theater, you'd better be right. Your exploit should work. It should work in the real world. It should be repeatable. The problem with the hype cycle here isn't that "taking an airplane down with an Android app" is a bogus topic. It's that you don't believe it's actually possible.

</comment></comment></comment></comment><comment><USER8> It's an interesting concept, but.

ADS-B, this is just automating a couple of things, firstly the classic mode-c transponder. Secondly things like weather information and other such, which is often read out on good old analogue radio such as AWOS.

Messing around with that wouldn't be any different from people just SQUARKing fake data.

I suppose there could be opportunity for security exploits on the digital device listening, but the airline industry is very legally enforced at applying updates.

With regards to ACARS I have no idea, as a PPL my rust bucket has nothing that fancy. I suppose there could be buffer overflow type things, or a flaw in the encryption.

However I still feel that this is a little bit sensationalist, as it stands you could create chaos as it just VHF radio and voices.

<comment><USER9> There's a huge difference between an old-style transponder and ADS-B in terms of spoofability. To make a transponder position show up on radar, you need to actually put a transponder there. You can spoof altitude to an extent, and you can potentially spoof being farther away by delaying your echo, but you can't spoof the radial at all. And you can't spoof being _closer_ than you really are, which means you can't e.g. falsely trigger a TCAS system.

ADS-B is a simple broadcast of coordinates. Spoofing a position there is just a matter of broadcasting coordinates that aren't where you actually are.

<comment><USER8> True, but given the way the ATC or TCAS receivers work, they really care about the history of the echos.

They are looking for a vector. It would be theoretically possible to create a ghost, give it a speed and heading to make people avoid it. But I'm not sure what it would achieve. Maybe I'm not being creative enough.

Thing is though, why would that be any different to "FY holding London NDB UFY 60 descending 40." on the radio. If you then dropped off the radio completely a massive poostorm would happen as ATC tried to figure out who that transmission came from. Whilst ATC have to try and find the plane that thinks it's got full service in class-a space (non pilots this is the busy bits of sky where you have to get permission from guys on the ground) they would divert away from that area.

I'm not aware of a TCAS system which doesn't alert the pilot to the fact it is changing the autopilot heading. If this happened in busy controlled airspace, it would have to be with acknowledgement from ATC or the pilot would at worse do a near miss to avoid a phantom that wasn't there, he certainly wouldn't hit one that was to avoid a ghost which ground wasn't warning him of.

If you're over the north atlantic and the TCAS wants to change heading or attitude, it will alert the meatbag AFAIK.

<comment><USER9> History is a good point, but does TCAS really care? I thought it was a fairly simple device in that regard. It has only vague directional sensing.

As for twiddling the autopilot and acknowledgement with ATC, I'm not aware that either is the case. TCAS simply informs the pilot, and current systems never advise any horizontal maneuvers, only climb/descend, because their ability to detect horizontal position is fairly crap. A TCAS advisory takes precedence over ATC commands and is expected to be obeyed immediately unless there's an obvious immediate danger to doing so. You never inform ATC of the TCAS alert and ask what to do, you always obey the machine, then tell ATC what's going on when you have time. If ATC notices the impending collision and gives you instructions that contradict the TCAS's instructions, you follow TCAS and ignore ATC.

</comment></comment></comment></comment><comment><USER10> Predicted TSA response: ban Android phones. (I'm only being half sarcastic.)

<comment><USER11> Predicted TSA response: ban iPhones.

I have a very, _very_ low opinion of the TSA.

<comment><USER12> Unless you put it in a one quart ziplock baggie. Then it's cool.

<comment><USER13> And they'll sell you a "safer" iphone on the other side for $900!

<comment><USER14> Jokes apart, does someone know if the same thing could be done by an iPhone?

</comment></comment></comment></comment></comment><comment><USER15> I'm doubtful. I believe you could easily spoof ADS-B and ACARS messages, but I'm not sure how that gives you control. The best I can think of is that you could spoof other airplanes nearby, and trigger TCAS (collision avoidance) to automatically move in the opposite direction. There is no way the pilot's would notice this, though.

The only other option is, as another commenter mentioned, a buffer overflow, or similar, that would allow the ACARS receiver to load a program in the FMS. In normal operation, FMS programs are not controllable remotely.

<comment><USER16> "...would _not_ notice..." this? you're missing a "not"? (and have an extra apostrophe!)

<comment><USER15> You are right :)

</comment></comment></comment><comment><USER17> Slides are here [http://conference.hitb.org/hitbsecconf2013ams/materials/D1T1...](http://conference.hitb.org/hitbsecconf2013ams/materials/D1T1%20-%20Hugo%20Teso%20-%20Aircraft%20Hacking%20-%20Practical%20Aero%20Series.pdf)

</comment><comment><USER18> I'm not an expert, all my knowledge about ADS-B is what I gained while writing dump1090[1].

The vulnerability of ADS-B, as I understand it, is the ability to mimic that there is a collision with another aircraft, since it is _trivial_ , as far as I can tell, to send a message impersonating another aircraft. There is no cryptography of authentication whatsoever in ADS-B, you just write the aircraft ICAO address into a field.

So if I simulate aircrafts in collision route, I think the system will tell the pilot to climb or the reverse, depending on the condition. Maybe this can be used to create troubles...

[1] <http://github.com/antirez/dump1090>

<comment><USER2> You are correct, but modern receivers will actually use the transmitter like a "NDB" and will detect that the incoming position is not the same as the stated in those messages, ignoring them.

The same thing happens with sudden changes in GPS messages that are completely out of alignment with the inertial system, they will be ignored. (unless you somehow are capable of knowing exactly where the plane is and gradually hack the GPS messages)

ILS systems are maybe the most dangerous and prone to hacking, but keep in mind that those frequencies are under surveillance and police is dispatched within seconds of a clandestine transmission on those frequencies. Again, here the gps and inertial is also used to guarantee nothing completely wrong is accepted as valid ILS sources.

<comment><USER19> How are ILS frequencies policed? Does the airport have receivers in multiple locations which automatically detect a failure, and notify someone in the tower?

<comment><USER2> Exactly. Because the ILS range is short, it becomes easy to pin point location. Those protections are embedded in the ILS system itself

</comment></comment></comment></comment><comment><USER20> I find the skepticism here a little surprising. These are unencrypted, trivially spoofable protocols that haven't been exposed to attack before--of course there are going to be buffer overflow bugs and unexpected, exploitable connections between vulnerable components and critical systems (if they're not already the same machine).

Video of spoofing ADS-B: [http://www.youtube.com/watch?feature=player_embedded&v=N...](http://www.youtube.com/watch?feature=player_embedded&v=NSLqRXyxiBo)

(I believe if you spoof ADS-B it means you can generate TCAS warnings, which pilots are trained to prioritize over ATC commands due to earlier incidents where TCAS was correct and ATC was wrong: [http://en.wikipedia.org/wiki/%C3%9Cberlingen_mid- air_collisi...](http://en.wikipedia.org/wiki/%C3%9Cberlingen_mid- air_collision) )

<comment><USER21> They issue isn't can they be spoofed? It is can you crash a plane remotely? Or even can you force a plane to go somewhere? The answer to both is basically no. You can confuse the heck out of the pilot, and possibly make them do some maneuvering until they ignore the system (and send the police after you).

Realistically the idea of putting encryption on ADS is one of the stupider ideas ever. I mean can you imagine a crash caused because someone didn't update their CA list, and thus it rejected a the signature of another plane?

Anyways, you could just jam the whole ADS-B system for your region. The system is protected by aggressive action against rogue transmitters.

Also the "with an android phone" part is disingenuous, as you'll need a fair amount of equipment.

</comment></comment><comment><USER22> From the linked article and the slide deck, I've determined that the only thing exploited was the simulator software, which was running on a machine that the group already had full access on. There's no avionics being used in this. They're 'simulating' a set up with commercial PCs and training software. They're using the two communications standards, ADS-B and ACARS to communicate to a 'box' that they already had control over and already hooked into.

There is no exploit here.

If you want more detail about why this would never land, I've wrote about it here: [http://zapistan.net/blog/2013/4/11/fear-mongering-the- friend...](http://zapistan.net/blog/2013/4/11/fear-mongering-the-friendly- skies)

</comment><comment><USER23> "In real life, the range would be limited depending on the antennas used (if going directly for the plane), or global (if misusing one of the two big ACARS players such as SITA or ARINC)"

It seems to me that the article has a lot of "in real life" caveats. Theres a lot of elements that have to be in place in order for an attack like this to work, beginning with the fact that the attacker would need a powerful, very specific transmitter for the ACARS frequencies.

The way I see it this look more of a publicity stunt than anything else.

<comment><USER24> I have done long haul 2.4ghz wireless links before with directional antennas (60+ miles).

36K feet is 6NM vertical. I have an antenna in my car, and enough power with the car running to reach a large aircraft audience. This doesn't even take into account if I have the transmitter and a lithium ion battery in my luggage (I've travelled across the world with Pelican cases loaded with AV and IT kit; no one asks, and they've only been opened by the TSA twice).

TL;DR Unauthenticated, unencrypted radio protocols are vulnerable, that's all.

<comment><USER25> abd-s works on 1080Mhz which should further improve range.

Rough back of the envelope calculations give a range of about 300nm for an aircraft at 37000ft

<comment><USER24> Your radio horizon if you're a ground attacker will be limited by your antenna height. Attacked with powerful transmitted in Class B airspace at a busy airport? You're gonna have a bad time.

</comment></comment></comment></comment><comment><USER26> Can anyone point to knowledgable commentary from a pilot with current experience with these systems?

I'm rather doubtful that the actions presented in this article can be done in that manner.

<comment><USER27> Airline pilot here, with experience with both systems, but not technical knowledge of the inner parts or how much they are capable. I have to leave right now, I´ll be expanding this comment a bit latter.

By now just tell you that both systems are capable of creating great troubles if they can be accessed as easily as he claims (and I think they are).

</comment></comment><comment><USER28> In the ATC system planes don't actually get routed electronically. Controllers give verbal clearances and tell pilots where traffic is.

This sounds more like spoofing an SMS from the airline's dispatch.

Sort of makes sense simulator would have ability to load scenarios without pilot acknowledgement, has no bearing on whether it would work in an Boeing or Airbus.

The ATC system is pretty vulnerable to DOS though.

<comment><USER20> TCAS is a completely automated system. When your TCAS issues a Resolution Advisory, pilots are expected to do the following:

* Shall respond immediately and manoeuver as indicated, unless doing so would jeopardize the safety of the airplane

* Shall follow the RA even if there is a conflict between the RA and an Air Traffic Control (ATC) instruction to manoeuver

([http://www.eurocontrol.int/msa/gallery/content/public/docume...](http://www.eurocontrol.int/msa/gallery/content/public/documents/Doc9863_ACAS_Controller_Training_chp6_1.pdf))

<comment><USER29> But TCAS is preempted by GPWS and stall warnings, so the damage is limited to cases where you are flying at altitude directly under another airliner and you can spoof an RA for the plane above to descend into the plane below. The statistical likelihood of this configuration _and_ a malicious attacker that can spoof TCAS is probably so low as to not cause much worry.

(Also, despite procedures, airline pilots are not automatons. They may be able to insert their brain into the loop to avoid disaster, despite the opposite happening from time to time.)

</comment></comment></comment><comment><USER30> Someone's about to be put on the no fly list.

</comment><comment><USER31> The ADSB is the "secondary radar" part, and radar reflection is the "primary".

To to create a "fake aircraft", one would have to "fake the primary" also.

<http://en.wikipedia.org/wiki/Secondary_surveillance_radar>

<comment><USER32> No you wouldn't have to "fake" the primary radar return.

Civilian Air Traffic Controllers in the US, Australia and numerous other countries only have Secondary Radar.

It used to be the running joke when I learnt to fly. "How is a Cessna 150 like a Stealth Fighter?" "With the transponder turned off.. neither will show on secondary radar"

The US Air Force, NORAD and NATO still maintain primary Air Defense radar. Especially in the US, a business jet or airliner without a functioning and active transponder is likely to get intercepted by a F-16 and escorted to land at the nearest suitable airport.

</comment></comment><comment><USER33> It probably fell off the list the first time around because the title seems like it "must be linkbait," so many resisted clicking on it until it's high up on the front page. Then you start reading and realize it's about as far from linkbait as you can get! Amazing work by Hugo Teso, and also going the extra mile to show the PoC on Android is exactly the right method to get this problem noticed and increase the chances it will be worked on.

I think talks like these are the absolute best way to light a fire under vendors (or an industry) to get these issues addressed. In this case we're no doubt talking about a very expensive remediation process. It also makes you wonder how bad the security will be for the next-gen GPS based systems.

I do worry the protections are not strong enough for researchers who give these talks, especially in areas like national security. It's a brave thing that Teso did going public with these vulnerabilities, and I sincerely hope we aren't reading about harassment coming his way in the future.

</comment><comment><USER34> Not entirely on topic, but I also remember seeing something a few years ago about how you could actually telnet (sic) into some airliner flight control computers if you were able to splice into the physical cables (which run under the floors). Something about not using ssh because it messed up the prompts... Will have to find it.

<comment><USER3> You're mistaken.

I worked on the 787 and a derivative of the 747. They use protocols defined by ARINC (google it) that are only used in the airplane industry. Stuff like telnet need not apply.

</comment></comment><comment><USER35> I do believe that the reaction to this will be to double down on the banning/shutting off electronic devices.

</comment><comment><USER36> Just thinking out loud...

How about a simple hardware device covertly attached to the plane's flaps and rudders... Then using a smart phone to control that hardware device, thus mechanically overriding the onboard aircraft control system and giving an attacker a degree of control over the plane.

How hard is it to get access to a plane to install something like this? Is it possible for a plane to pass an inspection with this device installed?

I imagine the motors that control the flaps are powerful, but even being able to lock them up would be useful. Lets say the plane rolls 10 degrees. We can then trigger the device that physically jams the motor, locking the flap in that position.

This could be like some small gel that expands and hardens.

<comment><USER37> Good luck getting onto a commercial apron and installing that with nobody - not even the pilots who perform the preflight inspection or the before takeoff checklist - noticing.

</comment></comment><comment><USER38> Meanwhile, millions (billions?) of dollars, hours of time, and degredations of privacy and dignity all go into trying to reduce the chance of someone being able to sneak a Toothpaste Bomb (over 3oz!) onto a plane.

You are only as secure as your weakest point.

</comment><comment><USER39> Article fails to mention you would need a HUGE transmitter, not just your phone. They wouldn't let you get enough transmitter on to the plane to do it. And from the ground you would have to have a strong directional transmitter with enough siting capabilities to keep the plane in line of site for hundreds of miles.

That's not something most people have access to, and in most places someone would notice that you put up a 30 foot parabolic with auto-aligning mounts on your house.

<comment><USER20> That's not true. [http://www.cumulus-soaring.com/newsletter/2008-05/Mitre- ADS-...](http://www.cumulus-soaring.com/newsletter/2008-05/Mitre-ADS-B- Transmitter.jpg)

You also don't need to be on the plane. A typical ADS-B transmitter can be picked up pretty easily from over 100 miles away--I can broadcast to every aircraft over Los Angeles from my backyard if I want.

I don't know about ACARS, but I would imagine it's similar.

<comment><USER39> You have to be the signal stronger than the tower. And you need enough channels to talk to all those planes.

<comment><USER20> Are you talking about ACARS? Because neither of those is true for ADS-B.

</comment></comment></comment></comment><comment><USER40> This reminds me the movie "Independence Day" in which scientist uploads a "virus" to alien spacecraft and disable communications between mothership and alien spacecrafts.

</comment><comment><USER41> "Teso has not shared too many details about the tools he used to effect the attack, as the vulnerabilities have yet to be fixed."

"has not shared" but then what is the security and methods by which he keeps the info private within his own computing environment? A motivated attacker could certainly take the initiative to get the info from him. Either by physical break in, phishing or some other devious method.

</comment><comment><USER20> It looks like he's using my drone ground control software mavelous as a front- end to control the simulated target aircraft: <https://github.com/wiseman/mavelous>

</comment><comment><USER42> Between the TSA groping you at the terminal and now the scary possibility of ne'er do wells initiating shenanigans from their smartphones in mid-air, it's enough to make me never want to fly again.

</comment><comment><USER43> Someday soon someone will make a similar app to hack self driving cars.

</comment><comment><USER44> Who cares? Mobile phones must be turned off during the flight.

<comment><USER45> Not on the flights I've been on recently. As long as it's in airplane mode you're fine.

Also you think somebody doing something illegal like this is going to listen to any rule that involves turning your phone off? If anything they'll just be discreet about it.

<comment><USER44> Man, sarcasme.

</comment></comment></comment><comment><USER46> I love the polite, hoity-toity tone of the euphemisms used for some of the more horrible functions: "Please go here", "Visit ground", "Kiss off", "Be punckish"

</comment><comment><USER47> Is there anything that makes this unique to an Android phone vs a bog-standard laptop with wireless?

</comment><comment><USER48> The irony here is that there may be a reason after all for people to turn of their electronics!

</comment><comment><USER49> Meanwhile, back at home, the TSA are doing a sterling job fondling someone's privates....

</comment><comment><USER50> Great, now an excuse for the TSA to not allow us to have electronics on board.

</comment><comment><USER51> So in reality this is just link bait? He can't crash a plane with his phone?

</comment><comment><USER52> My Nexus 4 arrives this week... :)

</comment><comment><USER53> It's too late you guys, I already got the account name.</comment>


Tell HN: Launched my first real start-up (Commerical video hosting) - <AUTHOR>

I launched my latest start-up, http://www.sproutvideo.com , on last monday. It's a discount commercial video hosting platform. I built the service in a little under three weeks because it needed to get done ASAP.
Back Story:
A little over 5 months ago, I left my job at Motionbox.com. Motionbox ended up getting bought by SnapFish who had no interest in keeping any of the pro users (people hosting commercial content). So, in order to not screw over those customers, and to make a bit of money, I decided to build a comparable service and migrate over all of the users. We just started migrating users on last monday and things seem to be going well. We have about 150 users as of today.
So, if any of you need cheap commercial video hosting, you know where to go! <comment><USER2> This is great. I have a contract next month with a local company looking to build a video site in their niche (elementary education tools). I'll be using this for sure :)

Do you guys have an API?

<comment><AUTHOR> Thanks! Unfortunately, I haven't had time to write an API yet. I'm the only developer, so I focused on the features that needed to be there right away for users to be able to use our service. I had just about 2 weeks to pull this together and still have a fulltime job. Almost none of them needed an API.

Building an API, however, is very high up on my list of things to do though. What kind of things would you like to see in an API? I think we have another, very large, customer who needs an API too so I'll try to get something set up ASAP.

<comment><USER2> I guess for now:

\- a way to directly upload a video from a file select field ([http://code.google.com/apis/youtube/2.0/developers_guide_pro...](http://code.google.com/apis/youtube/2.0/developers_guide_protocol.html#Browser_based_uploading))

\- a unique identifier for the video I can then store in my database with other metadata (which user uploaded it, when, etc). If you want to expose other metadata on the video like compressed size, number of views, etc that'd be great but not yet necessary

\- a standardized way to embed the videos based on the unique id (above)

</comment></comment></comment><comment><USER3> You need to put an example embedded video prominently on your page. Does your player rule? Great!

Does it suck? I don't know. What I _DO_ know is I wouldn't become a paying member just to find out.

<comment><AUTHOR> Yes, I completely agree. We DO need a player on the homepage.

Like I noted, however, this was a real rush job. We needed a minimum set of features so that we could migrate users and I really only had time to focus on that as opposed to the marketing material. Once we start marketing the site to new users, we will hopefully have a good intro video to show off the player.

</comment></comment><comment><AUTHOR> clickable link: <http://www.sproutvideo.com></comment>


Show HN: A New, Clean Geolocation API - jonathan-kosgei https://ipdata.co <comment><AUTHOR> > Get the following datapoints from any IP address;

Again :-( I just wonder if people will ever stop making assumptions about others given their IP address or hair colours and divide the Internet on these slippery grounds. The only legitimate and valid way to determine the client's location automatically is the browser or the OS geolocation API, and for the language it is the HTTP_ACCEPT_LANGUAGE header. The fact I have contacted your server from an IP address assigned to a Chinese ISP neither means I'm in China nor that I speak Chinese.

<comment><USER2> Believe it or not, you make up about 0.000001%[1] of the internet users. There is no saying in what this can be applied, it doesn't have to be for language or anything like that. It doesn't even have to be anything customer facing, and if it's just some stats you will probably probably just be a bit of noise.

Don't get me wrong. I totally agree that this thing is definitely not accurate(it thinks i'm 1300mi away) but it's good enough to get a general idea.

[1] made up number to get my point across

<comment><USER3> Yes, and you've made up a number that reinforces your point. A number that, if wrong, could negate your point.

Many more people are using VPNs these days. It's still not a large percentage, to be sure, but people are indeed doing it. Hell, I'm on my company VPN right now, and this site mis-identified my location because our VPN is set up to route most addresses in AWS's address space through the VPN (and ipdata.co appears to be hosted on AWS).

Then you have stuff like people on planes (usually this is all routed through a single PoP somewhere), people on mobile data who are roaming internationally (often proxied through one of the home carrier's PoPs), etc.

I think using IP geolocation is a decent first-order approximation, and is useful if there are no other ways to get that information, but it _must_ always be treated as unreliable.

<comment><USER4> I agree that IP geolocation is a good approximation. It is never accurate up to street level.

Meanwhile, there is API to detect VPN, so that we can aware that the geolocation is good up to the server physical location.

[https://www.ip2location.com/ip2proxy-web- service](https://www.ip2location.com/ip2proxy-web-service)

<comment> jonathan-kosgei Our API now supports detecting Tor nodes [https://api.ipdata.co/18.104.22.168](https://api.ipdata.co/22.214.171.124)

</comment></comment></comment></comment></comment><comment><USER5> Tangential but I find it funny that such a simple service has libraries for so many different languages. Is one simple HTTP call and JSON deserialization that hard? Personally I'd be more concerned about bringing yet another 3rd party module (leftpad, security, maintenance) than doing GET + JSON.parse but maybe convenience is what's most important.

<comment><USER6> One of the first things people tend to look at for an API is whether or not there's a library that makes integration as easy as possible. One HTTP call and JSON deserialization is often more thought and effort than people want to put in.

<comment> jonathan-kosgei Right, this is why we have multiple copy-pasteable examples in different languages. To make it as straight forward and quick as possible to get started.

</comment></comment></comment><comment><USER7> It would be cool if your examples (or really your entire website) was a git repo so people could easily report issues. Examples:

1\. Your GO examples don't quite follow Go standard style "resp_body" instead of just "body", "resp", or "respBody"

2\. Instead of "Error Codes" it should probably be "Status Codes" since the first "Error Code" is actually "200 OK"

<comment> jonathan-kosgei On 2, thanks for catching that, changing that right now. On 1 atm we have a Python repo [https://github.com/ipdata/python](https://github.com/ipdata/python) which I know isn't exactly what you're looking for. Thanks for reporting this. The right avenue to handle something like this would be sending an email to Support. Be assured we'll be quick to respond and work through whatever you need.

Made the change.

</comment></comment><comment><USER8> Great looking site, and good luck. My IP data was pretty much bang on, something I haven't seen before.

However, I was just looking at your Python SDK: [https://github.com/ipdata/python/blob/master/ipdata/ipdata.p...](https://github.com/ipdata/python/blob/master/ipdata/ipdata.py#L20)

What are you thinking. Never do this in a library. Also it looks a bit amaterish, as it's your only currently supported library I'd fix it up a bit - don't add .pyc/dist files to git, make it pep8, remove sys.exit() in a library (!!!) etc.

<comment> jonathan-kosgei You're absolutely right! Not sure how/why that got in there in the first place. I'm fixing a new release right now. I'm also going to have the repo/package cleaned up.

Pushed a new release: [https://pypi.python.org/pypi/ipdata/2.6](https://pypi.python.org/pypi/ipdata/2.6)

<comment><USER3> Calling 'print' from within a library is pretty bad form too... responses and errors should always be returned as data that can be inspected programmatically. In this case it's even worse, as the code will just return None on error, and you don't know why.

<comment><USER8> ^ This. Never call print from a library, what if I'm using a script to pipe stdout somewhere. Just throw a custom GeolocationException or something, with some useful data about what went wrong. In this specific case though, just don't bother catching the exception. It's not useful and it indicates something is terribly wrong.

<comment> jonathan-kosgei Fixed [https://github.com/ipdata/python/blob/master/ipdata/ipdata.p...](https://github.com/ipdata/python/blob/master/ipdata/ipdata.py) will add enhancements when I can.

</comment></comment></comment></comment></comment><comment><USER9> I host my own instance of [https://freegeoip.net](https://freegeoip.net). Any advantages this would have over that?

<comment> jonathan-kosgei Hi Kasbah, :) Several.

\- The Global infrastructure backing ipdata.co is pretty impressive, 4 data centers in the US, 1 in Canada, 2 in Europe and 1 each in Mumbai, Sydney and Seoul.

\- We offer more datapoints, I tried to build this around the most common use cases for Geolocation, one of which is showing your users the right currency. This is something we provide, that is, the currency ISO code and symbol.

\- I think our API is pretty darn fast :)

Your pros;

You offer more data formats, csv and xml whereas we only offer JSON.

You offer a pretty high free tier but I think there's definitely tonnes of people who derive a lot of value from ipdata :)

<comment><USER10> 1) freegeoip is locally hosted - unlimited queries

2) OK.

3) freegeoip is faster and locally hosted - no network latency

The entire thing runs as a one command docker instance - database updates are automatically managed

<comment> jonathan-kosgei I don't mean to take anything away from freegeoip, this is basically the self- hosted vs external API debate that I've already responded to here. In short, there're cases where each solution shines more than the other.

</comment></comment></comment></comment><comment><USER11> I wonder if you can change the pricing plans and language around them a little. What happens if I'm going along happily on the 2500/day plan and suddenly I get hit with a traffic spike and need 20,000/day for 3 days until things calm down? If you're going to use pricing buckets like this it probably needs to also come with an automated way to bump the plan if needed.

Someone else in the thread suggested Maxmind as an alternative. Their prices seem to be several times higher than yours. Can you double your prices? It seems really cheap. Too cheap?

Also, the location identified for me was off by 60 miles.

On your Documentation page you've used 188.8.131.52 as an example IP address. And 188.8.131.52, and 18.104.22.168... I'd rather see you use the IPv4 address blocks reserved for documentation by RFC 5737 [0]. That's what they're for! Unfortunately, they probably don't have any actual data associated with them so the examples would need to be fabricated...hmm.

And it looks like actually using one of those results in some output that does not conform to the format on your documentation page, so you'd best also add documentation about error handling.

[0]: [https://tools.ietf.org/html/rfc5737](https://tools.ietf.org/html/rfc5737)

<comment><USER12> You can download the Maxmind database locally. I don't see the option for that from IpData. That's worth the price increase for me.

Having a web API is great for low- or mid-volume applications, but adding 10ms per user for an HTTPS call would still be like 1000x slower than hitting a local DB.

<comment><USER13> Just cache the responses so that only the first time a new IP connects it needs to be looked up (until cache fills)

Integrating maxmind is a bit of a pain and it's a massive database. Not well suited to use cases like single purpose or ephemeral containers.

You'll probably end up storing the maxmind db in a separate node on your local network, anyway. So you still have a latency issue (although lower, obviously). More importantly you now need to maintain an extra box per replicated cluster. It could make sense to outsource that management if the latency between your data center and ipdata is acceptable. Such low latency is easily achievable if ipdata has BGP anycast on servers in the same cloud region as your app.

<comment><USER14> It's a 100mb db. You load it in-memory (mmap) on every webserver.

<comment><USER13> I consider 100mb to be quite large. That could easily double memory consumption of an application. Most http services are light but widely replicated. Adding 100mb of memory usage to each replica is certainly a tradeoff.

<comment><USER14> Assuming mmap 100mb will happen only once in each web-server.

<comment><USER13> What exactly do you mean by web server? Generally you will have at least one server process wherever you do the maxmind lookup, which could be at the LB/proxy (Nginx) or app server (node, python, go, etc).

Nowadays these services are often heavily decoupled and therefore built to be as lightweight as possible. Think about small single purpose containers. Adding 100mb of memory requirements per instance could be quite expensive, depending which existing process is calling maxmind.

<comment><USER15> are you passing the original ip addresses to all these containers? Why don't you just decode the ip to location at the edge of your network (typically load balancer) and add a header with location?

<comment><USER13> That's the best way to do it of course. But then you're adding 100mb to each instance in your load balancing layer.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Looks very cool and I'm going to give the free tier a try on a project. But this concerns me:

> Can I update my card details?

> Yes. Send an email to firstname.lastname@example.com. Your request will be processed > within 24hrs.

What is your process there? You're not asking people to send credit card information via email, right?

<comment> jonathan-kosgei Definitely not! :) We'd send you a unique link to a page where you can update your details. We'd never expose your credit card information in that manner.

<comment><USER17> Good to hear, but I'd still be a bit concerned that the wording above might lead some inexperienced/not-security-conscious person to send you their details via email outright.

<comment> jonathan-kosgei Good point, I think there's another way we could do it. Let me fix that.

<comment><USER16> You actually have good language right on your /faq.html page that should address this.

>Yes, send an email to firstname.lastname@example.com requesting the change. You will receive a link from where you'll be able to securely update your details.

<comment> jonathan-kosgei Fixed the front page.

</comment></comment></comment></comment></comment></comment><comment><USER18> I wonder what the source of the data is? Also, local queries are a must for most web apps... Otherwise latency is just too high.

<comment> jonathan-kosgei Please see my reply to mywittyname, basically, there are certain situations where being able to take advantage of our globally distributed infrastructure is the best call and I 100% agree that there are situations where using a local db is simply the best (only) call.

</comment></comment><comment><USER19> How do you compare to Maxmind in regards of data quality?

<comment><USER20> I can't speak for anyone else, but it's got me pegged 571 miles from my actual location. Not even close enough for an ICBM.

<comment> jonathan-kosgei I'm going to paste my reply to dewski above, Unfortunately, it's never going to be a 100%. If it's not able to pin you exactly it'll place your location as the center of the population. If you could send me your location and ip address at jonathan at ipdata dot co. I can keep tabs on this and see if accuracy improves.

</comment></comment></comment><comment><USER21> Congrats on the launch and the HN coverage @jonathan-kosgei! Looks very similar to my service, [https://ipinfo.io](https://ipinfo.io):

        $ curl ipinfo.io/22.214.171.124
        {
          "ip": "184.108.40.206",
          "hostname": "google-public-dns-a.google.com",
          "city": "Mountain View",
          "region": "California",
          "country": "US",
          "loc": "37.3860,-122.0840",
          "org": "AS15169 Google LLC",
          "postal": "94035",
          "phone": "650"
        }

It also started as a simple geolocation API when I first launched it over 3 years ago. Since then we've built many custom data sets and expanded to more products, including IP to company details, carrier detection, reverse IP hosting data and more. See [https://ipinfo.io/products](https://ipinfo.io/products). We've been lucky enough to signup customers like Dell, Tesla, eBay, TripAdvisor, Plesk and others. Happy to chat and share notes at some point!

<comment><USER22> where do you guys get all this ip-to-location data from?

</comment></comment><comment><USER23> How accurate can you get with an IP address? I seems like it could act as a fallback if the geolocation web api is blocked.

I have a side project[0] that uses the geolocation api to post to Slack and seems to be pretty accurate, even on mobile. Maybe I'll try this as a fallback.

[0]: [https://github.com/styfle/geoslack](https://github.com/styfle/geoslack)

<comment><USER21> Here's a guide on doing exactly that - falling back to IP geolocation when browser geolocation is blocked (or unavailable): [https://ipinfo.io/developers/replacing- getcurrentposition](https://ipinfo.io/developers/replacing-getcurrentposition)

</comment></comment><comment> jonathan-kosgei Just a few reasons why to use Ipdata;

1\. Currency Data - The user's country's Currency ISO code and symbol are returned in the API output.

2\. Phone Code Data - The user's country's Calling code is returned as well.

3\. Global Footprint - Endpoints in 10 locations globally. 4 on both US coasts, 1 in Canada, 2 in Europe, 1 each in Mumbai, Seoul and Sydney. This ensures you get pretty low latencies wherever your app is hosted and wherever your end users are located.

4\. Solid Infrastructure - The infrastructure backing Ipdata is pretty impressive, and built to scale to a substantial amount of traffic - in the hundreds of millions.

5\. A free tier of 1500 requests daily (45 000/month) with no signup or credit card needed.

6\. Examples in multiple languages on the Docs page at [https://ipdata.co/docs.html](https://ipdata.co/docs.html), to make integrating with your site absolutely painless.

7\. Regularly updated data - we check for changes daily and regularly update our data.

Coming soon; VPN/Proxy and Tor exit node data.

</comment><comment><USER24> > Up to 1500 free requests daily with no credit card or signup required

Neat. I'll make an updated express-geoip using this today or tomorrow.

<comment> jonathan-kosgei Awesome! Ping me at jonathan at ipdata dot co if you'd like to discuss anything!

</comment></comment><comment><USER25> I have added a JavaScript Library. [https://github.com/thomasconner/ipdata-js- library](https://github.com/thomasconner/ipdata-js-library)

<comment> jonathan-kosgei Too cool! Ping me at jonathan at ipdata dot co and I'll set you up with free api keys for this! :) We can also talk about adding including some examples on the docs page.

</comment></comment><comment><USER26> > We regularly update our data, with checks for changes in IP address > allocations made everyday.

`everyday` is an adjective, in this case you should use `every day` as two separate words.

<comment> jonathan-kosgei Fixed! Appreciate the feedback :)

</comment></comment><comment> jonathan-kosgei Our API now supports Tor Exit Node detection: [https://api.ipdata.co/18.104.22.168](https://api.ipdata.co/22.214.171.124), you can also try it against a current list of Tor Nodes here [https://check.torproject.org/cgi- bin/TorBulkExitList.py?ip=1...](https://check.torproject.org/cgi- bin/TorBulkExitList.py?ip=18.104.22.168)

</comment><comment><USER27> You should include the free plan on the pricing page.

<comment> jonathan-kosgei That's probably what's causing the confusion, thanks. Adding that right now..

</comment></comment><comment><USER28> I tried "curl ipdata.co" and got a 301 page. It'd be great to get the same json back that's shown on the webpage.

<comment> jonathan-kosgei The API endpoint is [https://api.ipdata.co](https://api.ipdata.co) try "curl [https://api.ipdata.co"](https://api.ipdata.co")

</comment></comment><comment><USER29> please explain your data source model. How do you integrate the RIR data, the NIR data, BGP and RTT location/estimation data to arrive at the geoid of where any given IP is. How do you handle multi=national ASN or cellular ASN using IPs across borders? (disclosure: I work in a regional internet registry)

<comment> jonathan-kosgei We aggregate our data from multiple existing sources. I'm going to add a Data section to our site explaining this in more detail.

</comment></comment><comment><USER30> FYI, tried to contact you but the contact form is broken and is raising a 405 error.

<comment> jonathan-kosgei Please send an email to jonathan at ipdata dot co or support at ipdata dot co

</comment></comment><comment><USER5> Very nice service. Using unicode emoji for flags would be better than pngs IMO.

<comment> jonathan-kosgei That's a very intriguing idea. I'm definitely going to look into the mechanics of this. I don't know if it'd make it possible to have them in different sizes, but thanks for this! I'm definitely going to look into adding a field with this.

<comment><USER5> Well they are characters so they are in different sizes by design (like vector graphics).

For the reference here you have one with description how they are generated: [https://emojipedia.org/flag-for-united-states/](https://emojipedia.org/flag- for-united-states/)

<comment> jonathan-kosgei Thanks, will check it out.

</comment></comment></comment></comment><comment><USER31> Are you able to flag an IP address as an IP coming from a VPN?

<comment><USER32> The folks at [http://getipintel.net/](http://getipintel.net/) can give you some decent information about wether an IP looks spammy or not.

> Given an IP address, the system will return a probabilistic value (between a > value of 0 and 1) of how likely the IP is a VPN / proxy / hosting / bad IP. > A value of 1 means that IP is explicitly banned (a web host, VPN, or TOR > node) by our dynamic lists.

We've been using it for a while and are pretty happy.

<comment><USER31> Will check this out - thank you.

</comment></comment></comment><comment><USER33> "Lantency based routing" \- typo on landing page?

<comment> jonathan-kosgei Thanks! Fixing that right now.

</comment></comment><comment><USER34> In my case it was off by 24 miles. That's the furthest off I've ever seen a Geolocation API be. The best are within a couple of hundred feet.

</comment><comment><AUTHOR> By the way, it would be nice to also include ISO 3166-2 state code (e.g. US-AL for Alabama, AU-TAS for Tasmania, TZ-26 for Manyara etc).

<comment> jonathan-kosgei That sounds like a great idea, I'll consider adding this, is there a specific use case for this format?

</comment></comment><comment><USER35> "Free IP Geolocation API" vs. "Choose Your Pricing Plan"

What Geo IP service would people suggest instead?

<comment> jonathan-kosgei I think the freemium model is pretty common in Saas. And I think a free tier of 45 000 requests a month, 1500 per day is pretty generous. Anything running as a hobby app/side project would run pretty well within that tier. Most users making more than 1500 requests a day have no issue paying.

<comment><USER35> I think 1500 per day is practically useless unless for a very small side project. My old blog got many more daily unique visitors, but YMMV.

[edit] Aside from that, I personally would not do business with someone describing his own offer as "pretty generous", but that's just me.

</comment></comment></comment><comment><USER36> Do you support GeoJSON formatted output?

<comment> jonathan-kosgei Hi, I'm not sure our data would fit this format but at the moment it's not supported.

</comment></comment><comment><USER37> Just to let you know: Google+ link on webpage is not doing anything, as it simply links to "#".

<comment> jonathan-kosgei We actually haven't setup our Google+ presence yet.

</comment></comment><comment><USER38> Anybody has heard about FOAM? It seems a similar use case.

</comment><comment><USER39> Design looks great!

<comment> jonathan-kosgei Thanks!

</comment></comment><comment><USER40> Lantency spelling on link, just heads up

<comment> jonathan-kosgei Thanks! Fixing that right now.

<comment> jonathan-kosgei Fixed.

</comment></comment></comment><comment><USER41> What about adding zipcode?

<comment> jonathan-kosgei There's a "postal" field in the API output containing the postal code.</comment></comment>


We're Going Full Stack - <AUTHOR> http://seatgeek.com/blog/product/were-going-full-stack-introducing-columbus

<comment><USER2> would it be possible to warn non-US users that you service is limited to one single country?

you know where someone is connecting from, so the sign up form could be a little intelligent and say 'hey, this service is most likely useless for you'.

a .com address does not help the international audience to determine if your service is global or limited to a single country.

</comment><comment><USER3> Very nice!

Note to self: they got the data; they added a value; they presented it nicely and neatly. Good data mining business model.

Note to jack7890: as it comes to events, there are two factors that play a role here: time (you got that in the calendar view) and place (just partially in the "theatre view"). I have two ideas for improvement. How about showing events in the calendar and color code the distance (e.g. red close, blue far away)? Alternatively, you could show a 2D map, user in the center, events spread on the map and color code the time (e.g. red - soon, blue - far in the future). You can have user put zip code or get it by IP (might be not accurate for mobile devices, though).

<comment><AUTHOR> Zeratul, great feedback, thanks. The proximity issue is critical and tricky, and we haven't solved it yet. Really like your suggestions; I'm going to play around with prototyping them.

</comment></comment><comment><USER4> This has happened to me twice in the last two days for some pretty amazing bands, by the time I found out tickets were gone, this would be pretty awesome.

</comment><comment><USER5> Looking good, already made me aware of an upcoming Bruins game in Jersey. Google Calendar integration might be interesting...

</comment><comment><USER6> Some really good recommendations. Still, I wish I could change the maximum distance for shows away from me, or see how far away shows are on the main screen. I live in MA, and I'm seeing concerts in New Jersey.

</comment><comment><USER7> The dialog to "Tell Columbus more about you" never loaded for me with Firefox.

<comment><AUTHOR> Hmmm, Windows or OS X? I haven't had any problems or other bug reports. If you don't mind emailing the details to email@example.com, I'd be endlessly grateful.

<comment><USER7> I sent some details and a few screenshots for you.

</comment></comment></comment><comment><USER8> Does "full stack" mean "one-stop shop" or "jack-of-all-trades?"</comment>


Facebook investors look for exits - <AUTHOR> http://www.reuters.com/article/2011/04/27/us-facebook-shares-idUSTRE73Q8L720110427 <comment><USER2> Looks like somebody is trying to cash in their chips before the casino burns down.

Facebook is so massively overvalued that the only thing smart people _can_ do is consider this period being close to the high water mark and get ready to get out while the getting is good. I don't think the swelling dot com bubble will be anything like the one at the turn of the century, particularly in the sense that I don't think many of these overvalued companies will actually fold, but I think it's safe to say that how ever it turns out, some folks are going to lose a warchest full of capital investment by the time this is done.

<comment><USER3> I don't think facebook is overvalued. The bubble aspect of the current situation is due to the increased allocation of capital into the tech industry because of big successes such as Facebook, Groupon, LinkedIn, etc. The worry is that this infusion of capital will result in 'bad' companies getting funded.

Considering how many startups are being founded by MBAs these days (MBAs will always follow the money), you have to wonder if they are all really creating something worthy of their sky high valuations.

<comment><USER4> Curious to see if you know of any specific examples of recently founded companies that are:

1) Founded by just MBA's 2) Raised a lot (relative I guess) of money 3) don't pass your definition "creating something worth"

</comment></comment></comment><comment><USER5> I'm not surprised by this. One of the things about the non-bubble bubble is that its driven by 'qualified' investors who, in theory, are better able to evaluate such deals on their own.

That FB has apparently reached an equilibrium somewhere shy of 50% of Google's valuation is a good thing for reigning in speculation.

But as a company that has seen a lot of second market type of motion, I have to wonder if this makes an IPO a real non-deal. Perhaps Facebook might simply shift from private to public without offering any (or only a token amount) of equity since they will already have a big chunk of equity in the hands of non- insider investors.

I agree with the quote that says the company is already priced for perfect execution, if you buy in now its hard to believe your return would out perform the market.

</comment><comment><USER6> 1) If you believe FB will be worth $140+ billion in a few years, but you want money now/have a fund coming due it might make sense to sell at $70 billion.

2) If you believe FB will be worth $140+ billion in a few years, and can afford to wait it might make sense to buy at $70 billion.

</comment><comment><USER7> Facebook has more traffic than porn but has been less profitable than Java. WTF?

</comment><comment><USER8> So if $1 billion in shares trade hands at x valuation, does that prove Facebook is in fact worth >= $33 billion? I find it difficult to believe the value of FB shares is anything other than what people are paying for it when a whole billion dollars worth of shares trade hands.

We could argue the semantics of 'worth' again ( <http://news.ycombinator.com/item?id=1719975> ) and whether the long term value is way off base to its current value, but the evidence is overwhelming that FB is currently worth tens of billions of dollars.

<comment><USER9> By this logic, there was a point in time in Amsterdam when some tulip bulbs were "worth" more than large houses. You are technically correct that facebook is _currently_ worth tens of billions of dollars, but is that real, lasting value or is it a transient inflation of price caused by lots of people investing with very imperfect knowledge of the company and the market? An IPO _might_ reveal the truth.

<comment><USER8> By that logic, only sustaining value for some period of x days would allow you to say the value of something is y. That doesn't seem accurate to me. How many days is x?

<comment><USER9> I don't think it's schedule-driven, I think it's event driven. In particular, I think that there are two events that value must survive in order to be demonstrated real:

1: End of severe information asymmetries (going from private to public--i.e. an IPO--will typically do this).

2: A crisis of confidence. A crisis of confidence can temporarily depress the market valuation of something with real value, but the fundamental underlying strengths will drive the price will recover as the crisis abates; inflated value will not recover in this manner after a crisis of confidence because the crisis will have served to expose the fundamental underlying weakness.

</comment></comment></comment></comment><comment><USER10> in at 50B valuation or less, several months later - out at 70B. With such a good deal, it would be very unreasonable to wait for 100B, 200B or whatever, if any, in the future. Especially if one thinks that initial swell of valuation typical for the days right after IPO has already happened without the actual IPO taking place.

</comment><comment><USER11> I wonder how many shares of Facebook are available to be bought in any market. If the shares are indirectly rationed by Facebook through their approval of any shares being sold, wouldn't this create an artificial limited supply of Facebook shares?

<comment><USER8> My guess is they have right of first refusal for any ex-employees selling shares. So the ex-employees would have to sell to someone sanctioned by Facebook, or the ex-employees could force Facebook to buy the shares back from them if they found a willing buyer that Facebook didn't approve. With current employees, Facebook probably has a lot more control over who they can sell to. (It may be limited to people who already own shares)

</comment></comment><comment><USER12> Google has something like a $170B market cap on the open market. Facebook at $70B doesn't seem so insane in that context does it?

<comment><USER13> Google had $30 billion in revenues in 2010. Facebook has an estimated $2 billion. 15x the revenue, but only 2.4x market cap.

Google also had a reported $8 billion in profits, and it's been suggested that Facebook's profits are meager.

Google also operates in a segment of the industry that is much less fad- driven.

<comment><USER14> Why do people get excited about profits of a company that never pays dividends? Is it about preservation of capital? Or a hope to see a trickle down effect of dividend payments at some point?

<comment><USER3> The retained profits (much of which go to productive activities such as R&D) add to the value of the company. Theoretically, the market should see this and then revalue shares accordingly.

</comment></comment></comment></comment><comment><USER15> The savvy investors probably don't have enough confidence in Facebook to IPO. Zuckerberg is still being sued by more than 2 parties in court. And time's running out for trendy startups to IPO and steal as much of grandma and grandpa's pension funds (what's left of it) before the stock market and the dollar collapses. Although maybe if Obama was re-elected Mark would have a chance to get those court cases thrown out.

<comment><USER16> The last Obama related comment seems like an unnecessary jab and offtopic.</comment></comment>


Bitcoin Just Had Its Biggest Drop in a Month - <AUTHOR> https://www.bloomberg.com/news/articles/2017-10-18/bitcoin-dips-most-in-month-on-oversight-fear-that-s-not-a-lot <comment><USER2> Back up to ~$5,600.

But if you don't like the price, just wait a minute.

</comment><comment><USER3> Personally, I hope it drops so it validates my decision to not buy it when it was worth pennies... gahh!</comment>