Show HN: Drop-In Chat – Chatify your app - <AUTHOR> https://dropinchat.com/

<comment><USER2> WARNING: DO NOT TRY TO CHAT WITH PEOPLE - BAD THINGS WILL HAPPEN - READ BELOW

Uhh, it's possible to inject Javascript into this. There are two people that already did this. One is harmless and alerts "Wufff!" and the other redirects you to pornhub.

[edit] Now there's another that redirects you to lemonparty.

[edit 2] Now there's another that redirects you here. It's fun watching this play out live, with the nice vs. the mean HNers.

<comment><USER3> Maybe not everyone knows this, it's called XSS. There is a good cheat sheet to protect against issues like this from OWASP : [https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_P...](https://www.owasp.org/index.php/XSS_\(Cross_Site_Scripting\)_Prevention_Cheat_Sheet)

Shameless plug: We develop a tool that detects vulnerabilities such as this automatically (even in JavaScript based web apps) - [https://www.netsparker.com/netsparker/](https://www.netsparker.com/netsparker/)

There is also a free community edition which would possibly detect this vulnerability : [https://www.netsparker.com/communityedition/](https://www.netsparker.com/communityedition/)

</comment></comment><comment><USER4> Does anyone know a good open-source version of this type of functionality. I have a client now that wants me to add this to their site but the data cannot go through a third-party company.

My stack is django-based but I am open to any solution that works well.

<comment><USER5> I wrote an open source XMPP-based chat client: [https://conversejs.org](https://conversejs.org)

There is a Django add-on for it as well: [https://pypi.python.org/pypi/django- conversejs](https://pypi.python.org/pypi/django-conversejs)

In the latest unreleased version (0.8), you only have to load converse.min.js and converse.min.css in your HTML.

The 0.8 release should go out within the next few weeks.

</comment></comment><comment><USER6> Very nice, I'll be keeping an eye on this. I'm sure you guys have a million other things to do, but don't forget handling multiple tabs by the same user.

e: Ah, and somebody's already trying to inject javascript. You rascals ;)

<comment><AUTHOR> Thanks for the feedback. Please keep it coming if you think of anything else. We will be prioritizing what to work on.

</comment></comment><comment><USER7> I do need a messaging service for my product! Can it be used in production currently? I'm also curious about whether you provide the video conference api in the future or not? That would be useful!

<comment><AUTHOR> Hi waitingkuo. Thanks for the encouragement. Currently I wouldn't recommend using Drop-In Chat in a production context as the code is too new and not really stable. When we get to the point we think the product is ready for production use we'll make an announcement.

At this point we do not have plans to add video conferencing support.

</comment></comment><comment><USER8> I don't have a use for this right now but it looks like a nice and simple solution.

Not that I necessarily think I would need to but is it possible for the webmaster to get logs of the chats?

<comment><AUTHOR> One of the app authors here. We did this for YC hacks and ran out of time (30 hours). At this point we don't store the chats for anything but we plan on adding that soon. At that point, the admin should be able to search.

Please let us know if we can do anything to improve the app for a possible use case for you.

<comment><USER8> The only thing I can think of right now would be a way to theme it. Just being able to change the colour of the solid bar would be nice.

<comment><AUTHOR> Thanks! We will add CSS styling to the configuration options in the DIC variable. Let us know if you think of anything else.

</comment></comment></comment></comment><comment><AUTHOR> Sorry for the XSS problems. They are fixed now so it is safe to visit and test again if you like. Thanks owenversteeg for warning everyone.

</comment><comment><USER9> This is awesome. I've been searching for a SaaS chat widget like this for years.

Any ideas on pricing?

<comment><AUTHOR> For the time being we are going to keep this completely free to gauge interest. At some point we would likely charge, but at this point don't have solid plans about what the pricing would look like. Sorry I can't be more precise.

</comment></comment><comment><USER10> Is this similar to [http://gochat.us/](http://gochat.us/) ?

</comment><comment><USER11> Hehe built something like this as a small project a while ago for fun...interlude.im

<comment><AUTHOR> Hi, I just checked out interlude. Cool project.

I think the intent of our app is slightly different than yours. Our hope was to allow users of authenticated web applications to chat with one another. Our demo is misleading in this regard as all visitors to dropinchat.com get dropped into a single "chat group" (we din't want users to need to register in order to try it out). We think that apps this product might work well with are enterprise style collaborative applications (where users are already authenticated).

<comment><USER11> Fair enough :) Good luck!

</comment></comment></comment><comment><USER12> Very cool app. Needs a little bit of maturing but a really good first step!

<comment><AUTHOR> Thanks for the encouragement. What we have is certainly just a first step. We will continue to keep making incremental improvements now that YC Hacks is over.

</comment></comment><comment><USER13> What does this use in the backend? Is this xmpp-based? Is it open source?

<comment><AUTHOR> The back end is golang. The client server messaging protocol is BrowserChannel/WebChannel.

[https://code.google.com/p/libevent-browserchannel- server/wik...](https://code.google.com/p/libevent-browserchannel- server/wiki/BrowserChannelProtocol)

We open sourced the BrowserChannel library here:

[https://github.com/samegoal/wc](https://github.com/samegoal/wc)

And have a chat room demo app here:

[https://github.com/samegoal/wcchat](https://github.com/samegoal/wcchat)

The code we used for this particular site isn't Open Source yet. We are still trying to figure out what we want to do with it before we make that decision.

<comment><USER13> Good luck with it. I hope you open source it.

Would you be able to give a rationale on why you chose against xmpp?

<comment><AUTHOR> Hi scrollaway. Thanks for the support.

XMPP seems really great in a context of needing to inter-operate with other servers. However, for our use-case all communication was in a silo of a single site so this was not a major benefit to Drop-In Chat.

Our team wants broad broad browser support (for legacy corporate deployments) and a well-tested client side module. BrowserChannel, which is used for gmail chat, is very widely deployed and well tested.

Maybe I'm missing something, but even if we went with XMPP, wouldn't Drop-In Chat still need a way to stream messages from the server to the client? If so, we would still need to rely on a transport mechanism like websockets/XHR streaming/forever iframes for the in-browser real time message delivery. BrowserChannel/WebChannel bundles up this abstraction nicely and hides all the ugliness of dealing with browser quirks for streaming message delivery.

<comment><USER13> Sure, but BrowserChannel is only relevant on the client. What about the server? Using XMPP would allow for external clients to connect for example.

<comment><AUTHOR> I agree. If at some point dropinchat.com allowed for messaging between networks XMPP support would be great to add. At this point we only allowing for messaging other drop in chat users so no such protocol is needed. My only point was that we didn't "reinvent the wheel" by not using XMPP. Instead we just don't allow cross network messaging yet.

</comment></comment></comment></comment></comment></comment><comment><USER14> Do you guys know about [https://chatango.com](https://chatango.com) ? It's a more mature product, also based on Go backend. Founder here, so please ask any questions.

<comment><AUTHOR> I looked at chatango and I think the intended use case is a bit different than dropinchat. Drop-in chat provides user-to-user instant messaging. As best I can tell, chatango (primarily?) provides broadcast style communication. Is this correct?

<comment><USER14> Chatango is primarily focused on group chats, but you can send private messages as well. Dropinchat.com mentions "chat groups". Are they only for user-to-user messages?

<comment><AUTHOR> At this point dropinchat.com does not support sending messages to more than one user. However, we do plan to add that feature as our team has time.

The documentation on dropinchat.com mentions "groups" as a set of users which are allowed to see one another and message back and forth. Our team thinks this use case might be helpful, for example, for a website administrator to limiting communication between members on a given organizational team or individuals in a certain building, etc.</comment></comment></comment></comment>


Google Labs launches Android app for finding open parking spots - <AUTHOR> http://openspot.googlelabs.com/ <comment><USER3> This is a big hole in existing maps / directions sites. In most big cities (where, as it turns out, many people reside) it's rather an academic exercise to be able to travel to the exact coordinates of your destination, what's important is finding the nearest reasonably priced parking spot. If you don't know the area (which is why you'd be using directions anyway) this can be a significant challenge given the commonplace difficulties of navigating downtown traffic (such as grid-lock, confusing layout, one way streets, etc.)

It's good to see someone at least tackling the problem.

</comment><comment><USER4> I haven't used any of these apps, but being that I live in a high-density area (Hoboken) I know very well how useless this kind of an app would be. Parking in Hoboken (and NYC) consists of the following - circling. Even if you had a realtime stream of all of the metered spots and each meter had some means of determining if it was available or taken, the demand almost always outweighs the supply, so when you really needed this app to work is exactly when it would let you down.

Particular to these apps, do they have an expiration on these spots that are marked empty by the person leaving? After a few false positives I'd be inclined to throw the app away and rely on the circling technique and save the battery life on my phone.

<comment><USER5> > Do they have an expiration on these spots that are marked empty by the > person leaving?

Not exactly. But if you look at the top of the example image they provided there is some indication of how long the empty spot is expected to last.

</comment></comment><comment><USER6> Is this actually a problem? I usually just park my bike at the nearest pole, of which there are always plenty.

<comment><USER7> I wish I could upvote you more... the price we all pay for free (car) parking is incredible and the "driving around until you find a spot"-part of it is actually neglible. Check out "The High Cost of Free Parking" if you're interested in the topic: <http://www.amazon.com/High-Cost-Free- Parking/dp/1884829988>

</comment></comment><comment><USER8> In dense parts of San Francisco where this would be most useful, by the time I'm getting into my car, usually someone is already waiting for the space.

This summer, San Francisco is launching a pilot program with wireless sensors that will also produce a data feed that can be used to find parking:

<http://sfpark.org/how-it-works/data-feed/>

<comment><USER9> Rutgers Winlab is has also been testing a sensor based approach to detecting open parking spots. They're using a sensor on the car to detect open spaces and measure their sizes to see if they're suitable as parking spots. The professor leading the project There is an article that talks about it here: <http://www.technologyreview.com/communications/24497/page1/> and the lead author of a paper explaining it is here, in case anyone is interested in reading about it. The paper title is ParkNet. <http://www.winlab.rutgers.edu/~suhas/>

</comment></comment><comment><USER10> As others point out, this is a typical case of an idea that looks good on paper but in practice is quite useless, since there's no reservation feature. The most annoying thing would be to go to a spot shown as empty and finding it already full. That would result in _more_ gas consumption than today's ad hoc method of finding a space.

<comment><USER3> I think you may be missing some aspects.

First, this is just a trial, they'll get a lot of information about how useful it is and tweak it accordingly.

Second, consider the data generated. A little bit of number crunching will generate a lot of highly useful information that can be used independently. Such as a map of all parking areas in the city along with other metadata such as how often there are spaces available, etc. Think about how this can be used. It can be used to provide better driving directions so that you are directed to nearby parking structures instead of the destination itself, when there isn't parking at the destination. It can also be used to figure out where it's best to park based on factors like general location, time of day, day of week, etc.

</comment></comment><comment><USER11> Darn i thought this was going to use real time satellite imagery and heat mapping software to determine open spots. Alas, it's people powered and I am very lazy and do not care about the next guy finding a spot. If Im pulling out of a spot whoever is behind me gets the spot and I just meander around them and go on my way. Im not going to pull out my IP device, open this app and then mark soon to be vacant spot as open. I would fair to say the majority acts/feels same way as I do.

Hopefully this will develop and they will use the tech I had hope this would be using. It's a start though.

</comment><comment><USER12> This should have been a protocol, like Wave, so that Wuze and TomTom and whatnot can implement it in their GPS apps. Then it would start becoming marginally useful.

</comment><comment><USER13> Are these sort of things only open to US users? many apps I find on the net I scan the QR code and it finds nothing. I'm in Australia, so I assumed Pandora, Last.FM etc were all region specific, but this? I wish it would at least tell me that I'm not eligible rather than just saying nothing was found.

</comment><comment><USER14> I just downloaded it and surprise surprise there are no spots listed at all in San Francisco.

Ok, perhaps that's because the app is new, or maybe there are just no free spots.

However, in a busy and competitive city like SF I really wonder how useful this is going to be. From my own anecdotal evidence living in SF, if I drive by an empty spot downtown during the day, it's usually gone anyway by the time I've circled around the block to come past it again.

 _Don't even get me started about the California laws of not using a cell phone while driving..._

<comment><USER15> Agreed, the current implementation is unlikely to work where it matters - <USER2> dense areas.

Now if they'd find a way to couple this to realtime satellite data...

<comment><USER3> If any company had realtime satellite data over even a handful of major metropolitan areas there would be a lot better uses for that data than finding open parking spaces.

<comment><USER15> Probably, I could also imagine various applications that would turn into instant cash cows - the parking spot problem being one of the most obvious.

I wonder what the barrier is here, as the data very likely exists. The usual terrorist fears? Privacy?

Or is satellite coverage still an "wait a day to get updated image"-affair?

<comment><USER3> The data likely doesn't exist. The Earth is big, there are only a few Earth imagery satellites, they have a narrow field of view for the highest resolution imagery, so they must pick and choose their targets. And, of course, satellite imagery is constrained by local cloud cover.

</comment></comment></comment></comment></comment><comment> Automatt-2 Hopefully I will be wrong about this, but I'm not expecting this to be very helpful. In dense areas of SF, where I live, open parking spaces last less than a minute - sometimes only a few seconds. If where you're parking isn't densely populated, then you don't need the app at all, because you can easily find a space.

</comment><comment><USER16> Another similar app for the iPhone just came out called TakeMySpot. Seems that there's a building market for this space. It'd be nice to see something like this actually catch on.

</comment><comment><USER17> The real problem is that people are driving in densely populated cities (esp. one person per car).

</comment><comment><USER18> Does anyone else find how disgustingly in your face earning "karma points" is?

Game mechanics should be more subtle.

<comment><USER19> I'm more disappointed that they passed on the obvious pun.

<comment><USER20> What pun? The "karma" "mark a" anagram or what?

<comment><USER21> I believe sanj means "Carma".</comment></comment></comment></comment>


New FCC Chair Is Screwing Everything Up as Fast as He Can - <AUTHOR> http://gizmodo.com/trumps-new-fcc-chair-is-screwing-everything-up-as-fast-1791982230 <comment><USER2> The Congress and the President can pass retrograde legislation and issue silly executive orders, but we must not let this game of legal cat and mouse discourage us and distract us from our primary objective: to persuade a majority of Americans to REMOVE TRUMP FROM OFFICE AS QUICKLY AS POSSIBLE.

<comment><USER3> Trump is an ass but what he is doing is within the framework of his power. Of course we should protest and use the courts when he over steps his bounds. Remember he is the legally elected Pesident. If he takes an action that warrants an impeachment then so be it, but it would not be good for the country. He was elected because the large major that dislike him did not do their duty and vote and we have only ourself to blame. Take a look at the voter turn out in the swing states for President Obama vs this election. The deamcrates lost because they played badly.

I refuse to act like one of those that said President Obama was not their president. 2 wrongs do not make a right.

Fight, protest, call and write your congressmen. Do something.

<comment><USER2> I am advocating for removal because Trump is so clearly unfit for this role. The US Constitution provides a number of checks on Presidential power, including at least two ways to remove a President from office. They are both highly political, in the sense that Congressional politicians decide whether to invoke them. That means we must persuade as many Americans as possible that he must be removed. If pressure grows strong enough, the politicians will respond.

Further, I argue that time is of the essence. Remember, the Third Reich consolidated its power relatively quickly after the Germans elected them in 1932. My understanding is that within five months the dictatorship was essentially in place.

<comment><USER3> See the issue here is that a huge number of Americans voted for him and he won the election. Your opinion that he is unfit for office is not held by around half the public. I think he is unfit also but he has not done anything so egregious that he can be removed. No mater how smart we think we are our opinion here is no more valid then those that voted for him. This talk of the Nazis is silly. To start, the courts have already overridden his travel ban and the agency's that have to enforce it implemented the orders of the court. Second his own party is likely to moderate his actions as there already dissent on the imagination issue and budget issues (he was criticized by his own part about his comments on the court ruling). Third he same group of people that voted for him have an absolute independent view and will turn on him like a rabid wolf if he tried to implement any orders that where needed to turn this county into a dictatorship. Forth the military would not follow those orders period (I having served can assure you of that). This is polictical theater in the worse way.

</comment></comment></comment></comment><comment><USER4> This just goes to illustrate what is, outwardly, one of the core values of conservative politicians in the US: trust in the market. The problem is, the market tends to stratify people by means, which goes against the good "Christian" value of generosity -- Christianity, of course, being something that American conservatives hold dear, although selectively as everyone can see.

<comment><USER5> > the market tends to stratify people by means

Could you elaborate on this comment? What are the different stratifications?</comment></comment>


How I served 100k users without breaking the server or a dollar bill - <AUTHOR> http://blogging.alastair.is/how-i-served-100k-users-without-crashing-and-only-spent-0-32/

<comment><USER2> If you have a completely static website (like a blog or portfolio), instead of having an API server on EC2 or Heroku or wherever, you can host your site entirely on Amazon S3. Plus, you can also choose to use CloudFront, which would reduce latency for your global visitors.

I have a tutorial on using Jekyll, the static site generator that I'm sure a lot of you are familiar with: <http://learn.andrewmunsell.com/learn/jekyll-by- example/>

I also go over how to use Amazon S3 and Dropbox for hosting, since Jekyll is pretty versatile (it just spits out HTML).

<comment><USER3> A friend and I have both recently started familiarizing ourselves with Jekyll, and your guide has been fantastic. Thanks for making it.

<comment><USER2> I'm glad it's been helpful!

</comment></comment></comment><comment><USER4> It's worth noting that if you want to fully leverage the scalability of S3, using your domain registrar's HTTP 302 service (using a "URL Redirect" feature at your domain registrar) is likely a bad idea.

ismytwitterpasswordsecure.com resolves to 22.214.171.124, which is some unknown HTTP server at Namecheap, meanwhile www.ismytwitterpasswordsecure.com resolves to a CNAME that causes the browser to directly hit Amazon.

As mentioned by another commenter, the "proper" solution to this which doesn't depend on Namecheap's unknown quality HTTP server serving up redirects, is to use Amazon's DNS hosting and their proprietary aliasing solution: [http://aws.typepad.com/aws/2012/12/root-domain-website- hosti...](http://aws.typepad.com/aws/2012/12/root-domain-website-hosting-for- amazon-s3.html)

</comment><comment><USER5> TL;DR: use Amz S3 to host static content for cheap

<comment><USER6> I'll agree that its simplified, but it almost might be the spark that gets me to use that free account that's dwindling away. Seems pretty simple. Setup static site/DNS/turn off listing in bucket.

Amazon products create insta-fear in me. It seems very overwhelming. I usually just fall back on DigitalOcean/Linode whenever I consider using S3.

<comment><USER7> I used to feel the insta-fear. All those EC2 configuration options, not to mention LBE, and separate services for everything I could manually set up.

But S3 is simple. Big buckets, tons of files in flat order. No magic involved. I've been very happy with it and you can still take your computing needs elsewhere.

<comment><USER8> Ha, thought i was the only one who felt AWS insta-fear. Maybe i should try this just as a learning experiment.

</comment></comment></comment></comment><comment><USER9> I've been afraid to use S3 like this because S3 requests sometimes fail and the client needs to retry after a short delay. S3 libraries do retries under the hood, but web browsers don't - instead the user sees an error message or a broken page. This probably wouldn't happen much on a low-traffic site, but a site getting as many hits as this guy's probably has problems for a non- trivial number of users.

<comment><USER10> Do you have any data on how much is 'non-trivial'? (Not disbelieving you, I'm wondering whether it's trivial for my use case.)

<comment><USER9> Here's a HN comment I bookmarked about this: <https://news.ycombinator.com/item?id=4976893>

That guy was reporting a 2% error rate from one S3 server, but there has been additional discussion on that thread which suggests that error rate is an aberration. Personally, I have no hard data, just the anecdote that when I started developing with S3 I wasn't using retries and that became a problem after approximately a few thousand queries. Unfortunately I've never seen Amazon say what error rate to expect, just that you should be sure to retry on error. I think I'll start logging how often I need to retry so I can get some hard data.

Keep in mind that when you're hosting a site on S3, you have to multiply the error rate by the number of resources you're serving from S3 to get the probability an individual user will have problems. www.ismytwitterpasswordsecure.com serves 4 resources from S3. Assuming a 0.1% error rate, 400 out of the 100,000 users would have had problems.

As another commenter has suggested, you can serve from Cloudfront instead of directly from S3. That will significantly reduce the number of hits which are made to S3.

</comment></comment></comment><comment><USER3> Amazon has a ton of guides on common use cases for their services, one of which is hosting a static website on AWS using Route 53 to handle DNS, S3 for managing files and requests and CloudFront as your CDN.

[http://docs.aws.amazon.com/gettingstarted/latest/swh/website...](http://docs.aws.amazon.com/gettingstarted/latest/swh/website- hosting-intro.html)

</comment><comment><USER11> I'd like to host a static site on S3 with SSL. But AIUI this isn't possible with S3/CloudFront alone because the hostname in the SSL certificate won't match the custom CNAME.

What do most folks do in this situation? Put CloudFlare or Fastly in front of S3?

</comment><comment><USER12> You know any way I could access databases through a static page? I mean, I wanted to have an "open to read, but not write" database to feed contents to a static HTML through javascript, would be neat.

<comment><USER7> Ajax requests are what you're after. Store your data in JSON or plain text files and use your favourite JavaScript framework to retrieve them client- side.

<comment><USER13> Keep a database on your computer, write a quick script that dumps it to json format, and uploads it S3 automatically, and have the javascript hit that file. Run the script every time you change the data.

</comment></comment></comment><comment><USER14> Does anyone have any commentary on using S3 with analytics software (Google or others)?

The process of creating a specific 'www.example.com' bucket just to do the redirects seems to break my analytics software (Piwik) and as a result, it doesn't track referrers properly. That is, anyone who visits by a www.example.com link will have no referrer and just say "Direct Entry" since they hit the redirect then arrived at example.com

</comment><comment><USER15> I was just going to say that I _thought_ that there were implications for mapping the "www" subdomain like this, because S3 didn't support root domains, but that's been changed in the last few months:

[http://aws.typepad.com/aws/2012/12/root-domain-website- hosti...](http://aws.typepad.com/aws/2012/12/root-domain-website-hosting-for- amazon-s3.html)

(and plus, there's redirection)

edit: There are consequences relating to mx records, such as if you want mail service on the domain. From a comment:

> _Just be careful here with doing CNAMEs on root domains. Things like email > will break because the MX records are no longer visible behind the CNAME. > Gmail for example won't send emails to domains with a CNAME as root._

Related article: NPR's apps team had a nice post about how most of their projects are S3 hosted flat files: <http://blog.apps.npr.org/2013/02/14/app- template-redux.html>

<comment><USER4> I don't believe using Amazon's DNS like this will result in a "CNAME on the root domain" (a technically invalid situation in all cases, since a CNAME can't co-exist with other records...), I think it causes Amazon to return an A record which has been computed by being internally aliased within Amazon's DNS system.

Edit: Amazon has actually clarified this point in the comments of the article as well -

'You're completely right about CNAMEs at the domain apex, they do tend to break MX and NS records. When this feature is used with Route 53 ALIAS records, no CNAME will be present - behind the scenes the ALIAS record links directly to the S3 "A" record data.'

</comment></comment><comment><USER16> I really like Amazon's S3 and similar, I just wish Amazon allowed me to set a cap on my account.

I'm aware of billing alerts, and they're quite useful. But I am really paranoid one of my properties is going to get linked to on Reddit, Digg, or similar and then I'll wake up to a $5K bill which I can ill afford.

<comment><AUTHOR> My original, unedited post title (grumble grumble) sort of covered that- I served content to 100k users, but it cost me less than a dollar. S3 is amazingly cheap.

<comment><USER15> Why did the submission title get changed from "How I served 100k users without breaking the server- or a dollar bill." to "Hosting a Website on S3"?

<comment><USER2> The moderators did it.

<comment><USER17> The moderators were heavy-handed, in my opinion. Original title was great. It wasn't misleading or link-baity. Not sure why it was changed.

<comment><USER18> My guess would be because this has already been discussed many times on HN so they felt it was better to just call it what it was.

I'm not saying I agree, just making an observation.

<comment><AUTHOR> Not going to disagree (because, really, it isn't worth it) but I thought my original title brought a little more emphasis to how cheap S3 is- as the OP demonstrated, I'm not sure that's so widely known.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Sure, I'm going to submit my twitter password to some random website (not even served over SSL). Nice try. So that guy now has 100k twitter passwords?

<comment><USER20> honestly, just make up some fake info to see why everyone enjoyed the site.</comment></comment>


Cache coherency primer (2014) - <AUTHOR> https://fgiesen.wordpress.com/2014/07/07/cache-coherency/ <comment><USER2> The moral of the story for software developers is to be aware of false sharing and cache line bouncing when writing multithreaded code.

Seemingly innocent code like this will most likely cause completely unnecessary inter-core traffic (assuming that the compiler has laid out a and b adjacently, and they both fall within the boundaries of a single cache line):

        unsigned a, b;

        void thread_a(void) {
            for (;;) a++;
        }

        void thread_b(void) {
            for (;;) b++;
        }

</comment><comment><USER3> I don't know almost anything about hardware but that was very well written and easy to follow. A pleasure to read.

<comment><USER4> If you are more interested, Appendix C of "Is Parallel Programming Hard, And, If So, What Can You Do About It?" by Paul McKenney ([http://kernel.org/pub/linux/kernel/people/paulmck/perfbook/p...](http://kernel.org/pub/linux/kernel/people/paulmck/perfbook/perfbook.html)) provides a very detailed description as well. It really helped improve my understanding of how memory barriers and atomics work

<comment><USER5> This is also a very good read: [https://lagunita.stanford.edu/c4x/Engineering/CS316/asset/A_...](https://lagunita.stanford.edu/c4x/Engineering/CS316/asset/A_Primer_on_Memory_Consistency_and_Coherence.pdf)

<comment><USER4> Thanks! :) Gonna add this to the list of books I need to read.</comment></comment></comment></comment>


Ask HN: Is there anything like Code Academy for music theory? - <AUTHOR>

I've been playing guitar for about 15 years now and I'd really like to take things to the next level. I'd really like to learn how to read music, more about time signatures, chord and note relations etc etc. I was really impressed with the baby steps approach that Sites like Code Academy take and I was wondering if there is anything similar out there for music. <comment><USER2> <http://www.teoria.com>

Not the same as CodeAcademy, but an extremely useful resource.

<comment><AUTHOR> Thanks for the resource!

</comment></comment><comment><USER3> The answer is immersion. Live and breath music and music theory. It won't come to you overnight but if you have been playing guitar for 15 years, I feel as if you'll keep going for at least another.

</comment><comment><USER4> <http://www.musictheory.net/>

This place has helped me a ton with memorization and theory.

<comment><AUTHOR> Awesome! Can't wait to dig into this a bit.

</comment></comment><comment><USER5> IIRC there are several music theory courses on Coursera. Not sure if they're being offered at the moment though.</comment>


Chicago 28-year-old made $70 million off cash loans, now he's buying slums - <AUTHOR> http://www.chicagobusiness.com/cgi-bin/article.pl?articleId=31483 <comment><USER2> Whatever philosophical complaints you have about the check cashing business, CashNetUSA was a well run, professional business with great technology.

I interviewed at CashNetUSA last year. It was the second most-appealing job I've ever been offered (I interviewed for my current job, the most appealing, at the same time so I didn't end up working there). They had a great tech team, extremely smart and experienced guys. They employed 400 people (mostly call-center reps) and paid well (not sure how they're doing post-bust). They sponsored and hosted meetings for the Chicago Lisp User Group when we were active.

Site in RoR, they programmed their own call center using Asterisk, self- managed Linux infrastructure, quants generating real-time risk assessments for customers to determine individualized rates, etc.

<comment><USER3> I received a call from a recruiter last summer. It was about flying to Chicago to interview with Cash America. They needed a director of IT and had a lot of RoR stuff on hand.

I politely made myself unavailable. Maybe its because I spent a decade, the 90s, building financial apps at large banks and insurance companies. Like so many other IT guys, I know I had a hand in building some of the machinery that has destroyed America and those that trusted it.

But even if you had never worked on the inside of Wall St. firms, you should be able to spot a crack dealer when you see one (what do you think those call center reps were doing?). I don't care if they are using Linux and pay well. There is a reasons usury laws exist. The same reasons drug laws exist...usury and drugs both eat at the bottom of society and destroy it.

<comment><USER4> I'm going to have to completely disagree. Sure these loans are pretty bad, but if you need cash at a moments notice and have no other options it can be better than not having it. As for drug laws, you are very misinformed -- I don't want to get into a long debate, but US drug policy is horrible and in fact harms the bottom of society.

<comment><USER5> _Sure these loans are pretty bad, but if you need cash at a moments notice and have no other options it can be better than not having it_

People who use these services frequently get dependent on them, and not out of necessity. That's a big part of why credit and loan industries have been growing so much for the past decade; people want fast cash once or twice and get stuck in the cycle.

Until recently a company in the debt collection industry I'm very familiar with was giving advances on paychecks to certain employees. The practice was recently stopped when the head of HR left and the result was basically analogous forcing people to get off a drug. It's not like they didn't have income, they just got locked into a cycle of dependency. The kicker: most of the employees in this company who were hooked on the paycheck advances are collectors themselves, dealing all day with other people dependent on debt.

</comment></comment></comment></comment><comment><USER6> I wished the article explained a little better why his business was not shady. From the article, it doesn't sound much different from the paycheck cashing places...

Maybe his new real estate business is more respectable but it was made possible by his previous business.

Can anyone explain why we should look up to him? I understand that there might be a need for "payday loans" but it still looks like exploitation.

<comment><USER7> Payday loans may have a high interest rate, but if the cost of a payday loan is less than the alternatives, then it seems ethical to me. For instance, say a payday loan for $200 costs $30. That's translates into a high interest rate, but it's worth it to you if it helps you avoid a $50 late fee on another bill that's due before your next payday. The trick to running a payday business ethically seems to be fee transparency and not charging excessive fees such that borrowers must borrow an ever-increasing amount. This article about a payday company in LA talks about these issues: <http://www.nytimes.com/2008/11/09/magazine/09nix-t.html>

<comment><USER8> There's a big negative externality with payday loans - or really, any sort of consumer credit - that I wish more people were aware of...

As more people use credit for everyday purchases, fiscally responsible people get priced out of the market. The additional cash on hand drives prices up, because there's always some idiot who's willing to pay more _now_ with a credit card or payday loan than he can afford to pay back later. He crowds out prudent buyers who only purchase goods if they have cash on hand. Eventually, it becomes rational for _everyone_ to pay with money they don't have, because otherwise they're simply priced out of the market and have to do without.

An example might make this more concrete. Say that there is a limited supply of some highly-demanded good - say, cupcakes. In economic equilibrium, the price of a cupcake may be $2, and there is enough supply for 25% of the population to have one. This being a functioning market, the cupcakes go to the people who most deserve to have them, "deserve" being a function both of means (how much money they have to spend, a proxy for how much they've contributed back to the economy) and of desires (what fraction they're willing to part with to get that cupcake).

Now say that one person discovers a payday loan shop. He suddenly has much more cash on hand, because he can get a full advance halfway through the pay period. So he gets a cupcake even though he couldn't normally have afforded one, and then has to pay back more in the future. This is still legit though: maybe he just _really_ wanted that cupcake, and is willing to take the future hit to income to have it now.

Imagine now that 25% of the population has discovered the magic of pre- approved credit offers, and suddenly have _lots_ of cash on hand. They bid up the price of cupcakes to $10, and suddenly these profligate folks get _all_ the cupcakes. The fiscally responsible folks who make a decent income but refuse to go into debt have been completely priced out of the market, so their only choices are to join the debtors, or do without. So the number of debtors grows even more, people start needing to take on debt just to survive, and folks have no intention nor ability of ever paying this back.

This is happening in several areas of our economy _right now_.

There are a limited number of houses. They go to the highest bidder. Therefore, if some idiot pays 0% down on an interest-only options-ARM, he can get more cash on a given income/savings level, and outbid the prudent folks who insist on paying 20% down. This is why it has been essentially impossible to buy a house lately (well, up to 2008) if you have any intention of not being foreclosed upon.

There are a limited number of spots in colleges. There is also massive financial aid available. When families take out loans to send their students to college, they can pay higher prices. Colleges raise their tuition to compensate. It then becomes impossible for people to attend college without taking out loans. (Except for certain elite schools that give outright grants for everyone on financial aid.)

There is a limited amount of food. When large numbers of lower-income people have more immediate cash, thanks to payday loans, grocers can raise their prices accordingly. Other people in the neighborhood are faced with the choice of either taking out loans themselves or going hungry.

I've read a few economic histories that suggest that these debt-inflation cycles hit countries every 80-200 years, and that the end result is necessarily that the money supply spirals out of control. People need to borrow to live, and yet the borrowing fuels further increases in the cost of living. They almost always end in war, which serves as a giant reset button by bankrupting everybody equally. ;-) WW2 was fueled by the debt spiral of Weimar Germany, where they physically couldn't repay their WW1 reparations. The American Revolution was fueled by the Stamp Act ("No taxation without representation"), which was to cover rising indebtness of British war debts. The French revolution was caused the bankruptcy of the French royals.

<comment><USER9> _This is why it has been essentially impossible to buy a house lately (well, up to 2008) if you have any intention of not being foreclosed upon._

It would seem that the market has a way of righting itself over time. The people who would take out loans and drive the prices up eventually run out of credit (it's a financial capacitor, not a perpetual money source), and then they not only have to compete on the higher priced market they created -- they have the burden of the additional interest, as well. They then can not even buy as much as before and are relatively disadvantaged in the market -- pushing prices back down, perhaps even below the origin. This is more or less playing out in the housing market right now -- home prices : income ratios are returning to their post-WW2 origin.

As far as the other points, I feel there are too many counfounding issues (particularly with the warring nations example) to really comment on.

<comment><USER10> _It would seem that the market has a way of righting itself over time._

Yes, but it seems that many people are not going to wait that long.

<comment><USER11> With perfect information, which it lacks.

<comment><USER10> Yes, there is the possibility that it will not even correct itself. The invisible hand may not be there at all!

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> He was an angel investor for a start-up founded by two friends of mine. A very decent guy, with high moral and ethical standards. There can always be an exception to the rule - even in the cash loan business.

<comment><USER13> I'm puzzled how you can claim that he has high ethical standards when he ran a business whose entire model is to rip off poor people.

<comment><USER2> These "poor people" can't get regular bank accounts, so they have no way to cash paychecks. They have no access to traditional credit. The payday loan industry is competitive, so if it could be done cheaper, someone will do it. If it can't be done cheaper, those entrants will fail (too much risk). If poor people with no or bad credit history find another way to get credit, the payday loan industry will dry up. It's business. Live with it.

<comment><USER14> Here is what bothers me about this. How can you not get a regular bank account? Doesn't Bank of America just require an address, plus a deposit? What else is needed? I think it's more fair to say that they don't trust banks, rather than can't get regular bank accounts.

<comment><USER2> _Doesn't Bank of America just require an address, plus a deposit?_

You can get a bad checking account with high monthly fees, check writing fees, ATM fees, etc. I'm pretty sure you have to submit to a credit check or have additional deposits to get a free account.

While these bad checking accounts are probably less expensive overall, it's more difficult to judge the costs, especially for financially unsophisticated customers. One big fat fee from the payday lenders probably seems smaller than N smaller fees where N is unpredictable.

<comment><USER15> Most of those fees can be avoided if they treat the bank like those pay day loan processing places.

<comment><USER3> really? Your sure about that? You try it. Put yourself in a life where you have no bank account, no or bad credit, and try to take the check you just received from "low income job x" and try to find a retail branch of the bank it was written against. If you're real lucky, there is a retail branch near you. When you go in, you will be presented with process barriers the bank uses to keep you from cashing the check. Are these barriers legal? Doesn't matter. You still will be sent out the door without your money...and then you go back to the loan sharks.

<comment><USER16> "Are these barriers legal? Doesn't matter. You still will be sent out the door without your money...and then you go back to the loan sharks."

Wait, you're now arguing that the "loan sharks" are useful and helpful, after denigrating them elsethread?

In any case, I agree that you can cash a check at the bank it is drawn on, _and_ that it can be difficult. Because my newly opened account had an _eight day_ clearing time, I needed to cash my checks and trot over to my bank to deposit cash quite a bit last year (small employer had no direct deposit). It was comical what lengths they went to to try to avoid giving me cash.

"Are you a customer with us? [No.] Oh, I'm sorry." (But I didn't go away).

"Oh, you'll need two IDs." (Okay, here you go).

"Oh, we don't have that much money on hand." (It wasn't very much, especially for a _bank_ ).

"Oh, I'll have to get my manager." (in a vaguely threatening-maybe-you-should- just-leave manner).

"If you open an account with us, we can cash this." (But of course they could even if I didn't).

"We can't give out that much cash. Can you come back tomorrow?" (No).

"I guess we could do a cashier's check for half of that [said doubtfully]. Would you like to open an account with the remainder?"

Etc. The first few times, I was polite and firm, and eventually they recognized me when I came in and I didn't get any hassle. But lots of people wouldn't know that "We can't" doesn't mean they can't.

<comment><USER3> "Wait, you're now arguing that the "loan sharks" are useful and helpful, after denigrating them elsethread?"

They are only useful and helpful in the absence of forcing banks to act like decent members of society. Fix that problem (which is very easy if you focus on corruption between corporations and elected officials) and you remove the need for the loan sharks.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> I'm watching The Merchant of Venice right now, then I pop over here and read an article about a 28 year old Jew from Chicago who made millions of dollars lending people money at an extortionate rate. I'm not saying there's anything wrong with that; I'd do it myself had I but the wherewithal. I just found it funny. Like, you know his friends have to mention it to him occasionally, rib- jab style. Heh.

<comment><USER18> > read an article about a 28 year old Jew

The most salient adjective that you can think of is "Jew" ?

WT* ?

I'm not someone who sees racism and anti-Semitism under every rock and leaf... but, seriously, WT* ?

I, for one, enjoy Hacker News more when commenters use phrases like "28 year old entrepreneur" and "40 year old physicist" and enjoy it less when the phrases are "28 year old Jew" and "40 year old Black".

<comment><USER19> One of the main characters in _The Merchant of Venice_ is Shylock, the Jewish moneylender. That's where Goldstein's Jewishness comes in. PostOnce was just noting the coincidence of having read this article after some Shakespeare. It's not remotely anti-Semitic; calm down.

<comment><USER20> Yet PostOnce found it best to be cautious - it looks like that account was created just to write this post.

<comment><USER17> Well, it seems everyone else sees racism in all things, so I figured I'd better not throw myself under a truck in case I am misinterpreted.

<comment><USER20> That's probably wise.

</comment></comment></comment></comment></comment></comment><comment><USER21> Seeing Woods's law play out is always amusing.

"Whenever the private sector introduces an innovation that makes the poor better off than they would have been without it, or that offers benefits or terms that no one else is prepared to offer them, someone—in the name of helping the poor—will call for curbing or abolishing it."

<http://en.wikipedia.org/wiki/Thomas_Woods#Woods.27s_Law>

<comment><USER22> Where's your proof that it makes the poor better off?

There's _lots_ of research, on the other hand, that because the interest rates are so high, people fall very easily into an endless cycle of debt, using Pay Day Loan B to pay off Pay Day Loan A.

</comment></comment><comment><USER23> Let's do a little research. The trader in the article, David Shorr, lists himself as a CashNetUSA founder on linkedin.

[http://www.linkedin.com/ppl/webprofile?action=vmi&id=659...](http://www.linkedin.com/ppl/webprofile?action=vmi&id=6599295&pvs=pp&authToken=AWoO&authType=name&trk=ppro_viewmore&lnk=vw_pprofile)

He also appears as a manager in some of the SEC documentation.

[http://searchwww.sec.gov/EDGARFSClient/jsp/EDGAR_Query_Resul...](http://searchwww.sec.gov/EDGARFSClient/jsp/EDGAR_Query_Result.jsp?queryString=%22david%20shorr%22&queryForm=1&isAdv=1&numResults=10#topAnchor)

David Shorr is 45 according to pipl.com

While Mr. Goldstein was a founder, he wasn't the only founder, and he had some more senior, connected talent to help him.

<comment><USER24> If you read the whole article, this would be clear:

 _Mr. Goldstein had spent a summer during college at the Chicago Board of Trade interning with David Shorr, one of his mother's patients. Mr. Shorr left the trading floor in 2003 because of an injury and was looking for a new venture. He hit on the payday loan business — "You borrow money at one rate and you lend it out at a higher rate," Mr. Shorr says — and e-mailed Mr. Goldstein to get his thoughts. "Al sent me an e-mail back with bullet points, action items, and I realized my first action item had to be to get him," Mr. Shorr says. He offered Mr. Goldstein a 75% pay cut but also the chance to build a business from scratch. Mr. Goldstein jumped._

<comment><USER23> Reread my comment. I didn't say he wasn't a founder, but Mr. Shorr's contribution is underrated in the article. He's only mentioned in that paragraph.

I constantly see mentions of boy geniuses in the popular press. He's undoubtedly bright, but it's his access to connections and money, and in particular Mr. Shorr, that made the difference between a mom and pop payday check cashing operation and growing to sell a business after two years. Readers of HN should recognize that it's not through his brilliance alone.

</comment></comment></comment><comment><USER25> Fail. We don't need another subprime lender. This country has seen enough shenanigans from IndyMac, Countrywide, and the other clowns on Wall St. Entrepreneurs, find something else to create because this is a lousy way to make money and taxpayers are done with bailouts.

If you still want to do finance, see this link from HBS for ideas on how to build a nontoxic, sustainable form of it:

[http://blogs.harvardbusiness.org/haque/2009/04/manifesto.htm...](http://blogs.harvardbusiness.org/haque/2009/04/manifesto.html)

</comment><comment><USER26> This guy might be the best guy in the world but payday loans are predatory lending and regardless of the situation, puts people in a worse spot than they were before.

Depending on the situation, they can charge over 1,000% interest. If payday loans were to charge 30% interest they'd still be able to cover the people that wouldn't pay.

It's a dumb saying but "don't be evil" springs to mind. Taking money off of the backs of the people that can least afford it isn't capitalism, it's greed.

</comment><comment><USER27> Rob the poor when they need loans, then snap up all the properties in distress and rent them out with high technical proficiency. Hmmm, if you don't see the _serious_ problems here you should be asking yourself some really tough questions about where the state of your personal ethics is.

<comment><USER28> OK, I'll bite. Tell me what's wrong with what he did.

A person needs money to feed their children and will be broke 3 days before payday. That person can either (a) not get any money at all, or (b) borrow it at a high rate of interest. What, _exactly_ is wrong with option (b)? Don't add extra details like hidden gotchas, loopholes, what happened to a friend of your sister's etc. What is wrong with the situation exactly as I proposed it and why do you find it unethical?

Likewise, if I decide to snap up a property in distress and rent it out, why is there a (as you put it) " _serious_ problem here?" Why is it better to just let the property rot? Again, answer to the facts instead of letting your bias add conditions I haven't specified.

I'm serious: I'm approaching this with an open mind. Tell me why I'm wrong.

<comment><USER29> It's immoral to tempt someone into harming themselves, especially when it also benefits you.

Payday loans tempt the weak with options that help in the (very) short run, but harm in the long run.

The very existence of payday loans encourages self-destructive habits among the poor. Why budget carefully when you can just get a payday loan and kick the can down the road to next month?

And since many payday loan customers get these loans every month, the loans are really just an additional monthly bill for poor people.

<comment><USER28> I used to have a girlfriend who was a recovering alcoholic. I remember her telling me, "I couldn't pay my tuition; I had to struggle to get enough money to put gas in my car; I could barely pay my share of the rent. But I _never_ had trouble finding money for booze!" Luckily for her she eventually figured out she needed to fix her life and did so.

There's a segment of the population who habitually make bad decisions. I've known enough of them to understand that they usually know they're making bad decisions, but they either don't care or don't have an alternative. Here's the important part:

 _You can't fix people_

Some people will use payday loans to get themselves deeper in debt; most of them will use them as a temporary crutch to get out of a hole. Don't screw the latter over in your fervor to "help" (and I use that term loosely!) the former.

</comment></comment></comment></comment><comment><USER30> is it just me or does every rich guy always have some super smug look?

<comment><USER31> The photographer for an article like this might take 50 shots. The editors then pick one that looks the way they feel the subject ought to look.

If you look at pictures of US presidents in Japanese newspapers, they look slightly Japanese. The photos haven't been edited; the editors just select pictures that look right to them.

<comment><USER32> Really? Have you got a link?

<comment><USER33> To evidence that photographers often take more than one photo in a photo shoot?

<comment><USER18> Don't be fatuous, Jeffery.

The commenter was clearly referring to this:

> If you look at pictures of US presidents in Japanese newspapers, they look > slightly Japanese

<comment><USER34> [http://www.truthwinsout.org/wp- content/uploads/2007/10/obama...](http://www.truthwinsout.org/wp- content/uploads/2007/10/obama.jpg)

<comment><USER35> Was that from a Japanese paper?

(I think this thread's the first time I've seen Lebowski quotes infiltrate Hacker News, and I don't know if that's a bad thing or an awesome thing.)

<comment><USER36> Found one more for you:

<http://news.ycombinator.com/item?id=186563>

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER37> all hail the new slumlord! good god that's what this world needs...</comment>


Immigrants Fuel Innovation. Let's Not Waste Their Potential - <AUTHOR> https://www.wired.com/2016/10/immigrants-fuel-innovation-lets-not-waste-potential/ <comment><USER2> A small percentage of immigrants fuel innovation. What many people have been talking about is making it easier for these immigrants to go through the legal process to get their citizenship.

I really don't think we should welcome anyone that chooses to break our laws, overstay their visa, and then cry afoul when they don't get all of the same benefits enjoyed as a citizen.

"What is most maddening about this situation is also what is most hopeful: Granting legal status to undocumented immigrants would unleash massive potential, add an estimated 150,000 new jobs annually, and add $1 trillion to America's GDP"

What they fail to mention here is that many immigrants can't read or write English, let alone speak it. How will they possibly get jobs that will add anything to our GDP? Many will immediately go on welfare and start to pull money from the system that will never be replaced.

"When we start dividing people into the ones we accept and the ones we reject—the ones we embrace and the ones we demonize—we jeopardize the social compact at the very heart of the American experiment."

You mean like accepting or rejecting Donald Trump supporters? All developed countries have citizenship laws. This really is nothing new. It's not 'Xenophobic' to want our citizens to follow the current laws that are already in place.

"Immigrants have not only made our society wealthier and more productive but also more decent. "

If you mean when the US was founded, yes. But I don't see any proof to back this statement up to the current situation. Immigrants are not better or worse than the current citizens and do nothing to increase 'ethics'.

"How a society treats immigrants is a great test of its decency, and we are failing. Immigrants, with their hopes and energies, should be seen not as threats but as blessings."

The US treats immigrants better than almost any other country in the world. It's pretty disingenuous to cast such a broad brush over the citizens in the US when you aren't getting your way. A better term would be childish.</comment>


Diaspora Security - will this work? - <AUTHOR> http://github.com/diaspora/diaspora/wiki/Security-Architecture-Proposal

<comment><USER2> Diagram Why have a secure client and web browser? Why wouldn't both interfaces only be via the web and secured with TLS? Doesn't the local "secure" client provide a backdoor and increase attack surface? I could understand an out or band channel eg a management interface or SMS for two factor authentication and out of band messaging. I'm not sure that in social networking adding client into the permissions for Data, Posts and Comments make much sense

What interface is the seeds outside the pod communicating on? Should in not be via the web or secure interface? Or is this another API for seeds in different pods to communicate?

Why is there a database per pod?

Think the goal of encrypting only sensitive data and depending on the users risk appetite makes sense but it is not compatible with your low complexity goal. Also it is harder to explain to users and when security is left unto users in practice the lowest or default security option generally gets chosen. So this may work if encrypted and no access is the default

Minor point - why invent aspect when group works?

The security model looks like standard mandatory access control. I'm not sure this works well in social networking. A better model maybe discretionary access control with inheritance of permissions and management by Aspect, Audience and User. Permissions should be able to be granted or revoked at the Data, Post and Comment level

"Dual authentication is required. Users authenticate via a login name and password." If by duel authentication you mean two factor, this does not achieve that.

"Audience Seeds must request the Post and any encryption key from the Owner Seed." This sounds like manual key exchange, a better approach maybe any posts to an Audience is encrypted to the public keys of all members, so when the notification is received posts can be automatically decrypted by the private key of each Audience member

"However, this has the ramification that any change in Audience of a Post would also change the Audience of any Comments by other Users. This would suggest that Audience changes should not be allowed, but a easy method for enforcing this is not evident" You could let each Owner who comments change the access level of their comment. If this is set to a higher level than the post the comment is not visible to the additional audience

I would also be interested in the high level requirements that drove this architecture eg for a secure distributed social network some basic requirements I would have thought are: [+] least privilege access to data posts and comments based on explicitly authorized access for the audience set by the data owner. [+] the most restrictive permissions set by a owner, aspect or audience of the data to apply [+] secure in transit all data [+] secure in storage and backup unless owner sets as insecure [+] access to all data shall be authenticated and authorised and limited to least privilege on each access request for data (a vulnerability in the first release where simply by changing user ID other users content could be accessed [+] authentication and authorisation shall be based on open standards and federated eg open ID and oAuth [+] Multi factor authentication shall e supported [+] Sharing of of Data and access to functions with authenticated users, aspects and audiences shall be simple [+] Access granted to Audiences and Aspects shall be inherited by users belonging to those [+] Ideally the creation of Aspects and Audiences shall be self forming based e.g. on algorithmic analysis of common interests and existing connections

<comment><AUTHOR> I think a pod is a host, like wordpress.com is a host of WP blogs, hence a database per pod. A seed is an individual user account. The way I understand it, each seed can be encrypted so that even the pod owner can just look in the database.

The really interesting bit comes from key and information exchange between seeds. I agree it's going to be hard to explain all this succinctly to users. Theoretically, the goal is secure and decentralized social networking. One use case would say, a friend on another host can see your photos, but no one else on that other host. Can this ever be done in a foolproof and secure way? I can think of a lot of different things that can fail - malicious impostors, users setting the loosest security, revocation, but it might be good enough for a vast majority of users.

</comment></comment><comment><USER3> If it works as I think is described in the high security model, you will have to upload a copy of your update for every single friend. And when you add a new friend, you will either have to reupload all the old posts or your new friend will be presented with a blank profile.

And if it doesn't work like that, there's not much difference between low and high security that I can see.

<comment><USER4> You can reduce this workload by using an asymmetric algorithm like RSA to store an intermediate key.

Post = P Symmetric encryption of X with key Y = E(X, Y)

Posts are stored as E(P, K_master) Authorizations to posts are stored as E(K_master, K_reader)

You can trust your friends (that don't own quantum computers) with your RSA public key, allowing them to E(K_master, K_you) data that can only be decrypted with your private key.

It is weak to a known plaintext attack (in which a user Eve with both K_master and E(K_master, K_alice) could attack Alice's private key), and of course weak to an authorized user sharing the master key. It's also weak to copy and paste, just like every other private social network.

<comment><USER3> I assumed you would at least want to block people leaking the master key, even if you can't stop copy paste.

<comment><USER4> Since it's only for that particular item, it doesn't offer any reason to leak it and not just the item content.

</comment></comment></comment></comment><comment><USER5> All this high-level stuff is great and all, but honestly, after that developer "preview" release, I am extremely nervous about putting _any_ personal info on a seed (or whatever they call it).

I feel that they've lost a lot of trust, and they will need to do something more than a super high-level wiki page on github to win this trust back.

<comment><USER6> Don't spread FUD. These guys are at least trying to do something in a market where almost everyone else has assumed Facebook has won. And they built and shipped something. I can't even remember the last time I could claim that 100%. Finalize your opinion when their final release is available.

<comment><USER7> I'm curious -- what is your faith in them based on? I feel sorry for the amount of expectations they were shouldering, but are you being supportive because you truly believe in their (unproven) technical abilities, because you hate Facebook so much, or are you just being nice because startup criticism can be really soul-killing? If a large corporation had released alpha code like that, would you trust the corporation with your data, even down the line? As much as it may be a nice Don Quixote story, results and credibility are the only things that matter here. The four of them are probably wonderful people, but that means squat when it boils down to code.

<comment><USER6> Faith? Support? I certainly don't have faith in them any more than I have faith in you. I know neither you nor them. How could I have "faith" in an unknown? However, I believe that most of the time people attempt to be good. And given that they are willing to let us see their code (unlike many other institutions) I would argue they are living up to my belief at least for now. So they released an alpha that had security issues? The model of open source validated itself; they received critical feedback and will hopefully act on it. If they do not act on it, so be it, I will not trust them with my information. But I don't believe in cynicism especially cynicism aimed at a self-advertised alpha project.

Does that mean I support them? Very well then, I support them! Go hunt some giants! Change the world! Go make things better while your critics sit on their hands and tell you can't, too afraid to build things themselves!

<comment><USER8> Being good and being able to write secure software are very different, somewhat orthogonal, qualities.

</comment></comment></comment></comment></comment><comment><USER9> It seems kind of hand-wavy in parts. Looking at the Seed-to-Seed communications this part doesn't seem too well thought through: _Note - Audience authentication may be required to reduce the load of serving requests from non Audience Seeds._

What does the audience authenticate to? The origin or the serving seed?

How is revocation handled?

When person A comments on person B's item, who gets to decide who sees that comment?</comment>


How to Hire Great Devs: Interview Pairing with OO Design and TDD - <AUTHOR> https://medium.com/@SavageBits/how-to-hire-great-devs-interview-pairing-with-oo-design-and-tdd-d7967583393f#.53f86mw5l <comment><USER2> Interesting, I used to give the same kind of coding exercise to candidates but was leaving them alone in the room for 60 minutes and popped-in every 20min to ask them if everything was fine.

I also kindly insisted on the fact that they should feel free to come see me if they had any question. The reason is part of the exercise was to assess their ability to avoid wasting their time by being blocked on something and ask for clarification.

On the one hand I like this pair interview approach because it allows you to check the communication and social skills of a candidate. On the other hand I don't like it because you lose tons of valuable information.

You lose information on the autonomy of the candidate, on his creativity, on his coding habits, and more. You create a group effect (we're not the same in groups that when we are alone). And to me, while team work is important, the interview is about gauging the individual contribution that the candidate will make to the team and in an artificial environment it is done more accurately by allowing time to assess his individual work skills.

I also knew that in the particular company I worked for, we didn't do pair programming and we most of the time had to work alone on several mini- projects. So it made even more sense to assess how they would perform under their future work conditions.

I prefer my approach because you can get the same insight into their thinking patterns by reviewing their solution with them point by point afterwards, but you also get plenty of other information by doing so. I never focus on the syntax but ask questions on the strategy and the choices made. The code could even not compile I wouldn't care, the only point of the exercise is to have material for a discussion.

The one important thing to hire good developers is to always have a coding project of 1 hour or so relevant to the role in the interview process. This revealed the bad developers instantly, and the frightening thing is that all of them had otherwise performed very well during interviews.

Thanks for sharing though, I didn't know about this practice and it is always refreshing to know what other people do. While I don't think I will implement this approach for the reasons mentioned above, having a broader perspective can only benefit the mind.</comment>


A $1.6B Spotify lawsuit is based on a law made for player pianos - <AUTHOR> https://www.theverge.com/2018/3/14/17117160/spotify-mechanical-license-copyright-wixen-explainer <comment><USER2> This article was a really interesting explanation of how music licensing works if nothing else, I honestly couldn't have guessed the government sets the rate, the same for all music, as opposed to it being negotiated differently by various companies in the industry.</comment>


Sean Parker: Apple may have been behind Spotify's late US entry - <AUTHOR> http://thenextweb.com/insider/2012/05/31/sean-parker-apple-may-have-been-behind-spotifys-late-us-entry/?awesm=tnw.to_1EcuZ&utm_campaign=social%20media&utm_medium=Spreadus&utm_source=Twitter&utm_content=Sean%20Parker:%20Apple%20may%20have%20been%20behind%20Spotifys%20late%20US%20entry

<comment><USER2> I don't consider speculation and rumours of rumours to be news.

</comment><comment><USER3> So that was a story about nothing really, and they all lived happy ever after. Can I reclaim that lost time, please?</comment>


Barcelona residents used sensors to demonstrate high noise levels at night - <AUTHOR> https://www.bbc.com/news/technology-41015486 <comment><USER3> 'Police now move people on at 23:00. Rubbish lorries, which had previously cleared up when the partygoers left in the early hours, have been rescheduled for the morning, and steps that provided seating for gatherers have now been filled with plant boxes'

OK fine about rescheduling the garbage trucks, but is this really a success? A vibrant public space has been neutered by more intrusive policing and architectural changes that encourage people to stay away? I'm somewhat sympathetic to the people in these apartments, but if this has been going on for 20 years (and why 20? why not 200?) then property values should already have adjusted. If you're living here, it's because you made the calculation about the noise and decided to rent or buy anyway, or else you didn't, and why is that the City of Barcelona's problem?

<comment><USER4> > If you're living here, it's because you made the calculation about the noise > and decided to rent or buy anyway

These plazas are commonly located in the old town, so a lot of inhabitants might have inherited the properties. Also, it's sometimes hard to judge how loud an area is really going to be before signing the contract - <USER2> the night-life.

I recently rented a new apartment in a crowded street and while it was certainly a mistake to move here, I didn't expect it to be _that_ loud since when we were there for the apartment viewings there were also a lot of other interested parties and it was distracting from the street noise.

I really wish there would be a project to distribute those noise-tracking devices and make the realtime data available to the public. It would definitely influence buying/renting decisions and help for city planning as I think this serious problem is only tackled on the surface and it brings down quality of living.

<comment><USER5> Possibly there's a simpler solution. A few years ago San Francisco passed a law requiring developers to notify potential residents if there is a nearby music venue, and also protecting those venues from nuisance lawsuits.[1] Perhaps that could serve as a model for public spaces as well.

[1] [https://www.sfgate.com/bayarea/article/S-F-supes-back- music-...](https://www.sfgate.com/bayarea/article/S-F-supes-back-music-venues- against-noise-6244544.php)

<comment><USER6> I doubt it would work. Have you been to Barcelona? People party and make noise even without a music venue. Then there are concerts that get organized in squares. This one is easy to solve because it requires a permit from the city hall.

<comment><USER5> Yes I have been to Barcelona, but I think you misunderstood my point. The article is about a public space known as a regular gathering spot, not a one- off concert or party. That regularity is what makes it similar to a venue.

</comment></comment></comment></comment></comment><comment><USER7> Noise is a permanent issue of our current times. Noise at day in huge open space like offices ("Just use headphones"), noise by night in urban areas ("Just use ear plugs"). Meanwhile research has shown, that you can't adjust or get used to noise - you might think otherwise but your ear and brain is doing the heavy lifting for you.

"\- We do not get used to noise, but our ears "filter out" unpleasant sounds and cope as well as they can with the daily exposure to intensive noise.

\- People are unaware of the damage caused by exposure to high levels of noise due to a lack of information.

\- The damage affects not only our hearing ability. It may also appear in the form of insomnia, tiredness, lack of concentration, lack of attention at work, lack of efficiency, and even hypertension, heart problems and digestive disorders."

[https://www.hear-it.org/we-get-used-to-noise-](https://www.hear-it.org/we- get-used-to-noise-)

<comment><USER8> Yes. I get woken up by Heathrow air traffic at 4:30am. Bad. So bad.

</comment></comment><comment><USER9> Kinda sad but the gist is that this went on for years and years and it wasn't until the people got support that they could prove there was an issue with noise.

Nobody in authority listerned or even checked until then.

<comment><USER10> It'd been going on so long, I would argue that there is an element of "coming to the nuisance" [1] going on. That is, the situation is like people who move next to a farm in order to "get back to nature." Hey! Turn out it sucks to live next to a farm! Lets shut the farm down!

[1] [https://dictionary.thelaw.com/coming-to-the- nuisance/](https://dictionary.thelaw.com/coming-to-the-nuisance/)

<comment><USER11> I mostly disagree with the people who are arguing that late night shouting and general noisemaking is just part of the culture and people need to suck it up. But the farm example is a real one. The state where I live has "right to farm" communities, including the one I live in. On the one hand, it's some specific rules about being able to establish small farms. But it's also a reminder not to move out to this nice exurban/rural town and then complain about the smell of the dairy farm down the street.

<comment><USER12> Or the roosters crowing.

</comment></comment></comment></comment><comment><USER13> Quite a number of ex-bloc countries ban cars exceeding sanitary norm for sound emission.

My surprise upon my first days in the West was that no Western country seem to have them.

During my stay in Vancouver I got to know well the people who were reving their lambos on West Georgia in 3am.

</comment><comment><USER14> I live in Barcelona. It is a _noisy_ city. It is just normal for young locals to sit outside in plaças or on wide streets on weekend evenings, socialising, having a drink, talking loudly, and even sometimes singing. By evenings I mean the Spanish definition of evenings, which last until way after midnight.

As a foreigner living here, I try to accept the noise as part of the culture, even though the noise annoys me. So it is great to read of locals actively campaigning to reduce noise levels.

On Friday I was in the very plaça (Plaça del Sol) mentioned in the article with a friend, and it was crowded and loud. All the tables were full, people were sitting on the steps, and indeed all over the plaça. My friend said, "it must be bad for the residents". It is good to know at least one plaça in Barcelona is now moving the crowds on after 11:30pm.

<comment><USER15> If there is a particularly noisy group, don't be shy to yell at them "calleu d'una puta vegada".

<comment><USER16> I've only been in Madrid and Seville and Granada (from the states), but that sentence looks like Portuguese to me. Does Barcelona speak a different dialect of Spanish or did you just type out a Portuguese sentence?

<comment><USER17> I don't know enough Spanish to talk to that, but its definitely not Portuguese.

calleu d'una puta vegada

There is at least two words, calleu, and vegada that don't exist in any Portuguese I've encountered. Also, d'una is... not something I've seen in Portuguese before.

But I'm a new speaker so I may be missing something.

I found this slang for shut the fuck up in Portuguese, not sure how cromulent it is: [https://en.bab.la/dictionary/english-portuguese/shut-the- fuc...](https://en.bab.la/dictionary/english-portuguese/shut-the-fuck-up)

<comment><USER18> Definitely not Portuguese, you're right (source: I'm Brazilian.)

<comment><USER17> Thought as much, not enough a's at the ends tripped my spidey sense. >.<

</comment></comment></comment></comment></comment></comment><comment><USER19> This is about the Smart Citizen project.

[https://smartcitizen.me/](https://smartcitizen.me/)

</comment><comment><USER20> I've been idly wondering whether there is a comprehensive "quiet community" standard like there is for a "dark sky community"?

From my perspective the main noise pollution problem is fast moving cars, which have obvious fixes. People loudly hanging out in plazas seem like a more difficult problem, and not even something I'm all that comfortable with characterizing as a problem. But maybe turning down lighting could be part of the solution? Or are places people hang out loudly at already not lighted?

<comment><USER21> I'm from Spain and all city streets and plazas have at least some lighting at night (enough that one can comfortably walk through the city at any hour of the night) and even the least lit areas are popular for people to hang out in. I do not think it would be feasible, desirable or safe to reduce lighting to the point where it would be uncomfortable to be hanging out at night.

I might even predict the opposite effect: drinking on the street, although popular, is illegal in Spanish cities. Darker plazas would make it easier to hide drinking from the police, and could attract even more people.

<comment><USER20> Thanks for the perspective. I'm convinced darker streets/plazas is a non- solution (and note isn't really what dark sky protections are about: it's OK to illuminate down, just not up).

</comment></comment></comment><comment><USER12> _steps that provided seating for gatherers have now been filled with plant boxes_

So, the same policy of _hostile architecture_ that gets used to try to be unwelcoming of homeless people can be applied to other demographics and other social problems. Color me not thrilled with this approach.

I've just never had the kind of life that involved lots of alcohol and loud parties. So my admittedly biased tendency is to feel there is no tremendous value in fostering such things. But as other people have noted, this doesn't just impede loud carousers. It also prevents other kinds of just hanging out with people.

The article notes that the nearby commercial development basically sold pizza and beer and suggested this was influenced by the nighttime activities here. It seems to me that trying to get more of a commercial mix in the area could help or otherwise try to foster evening activities other than drinking, hanging in the plaza for free and being loud.

There was one charity that created a midnight basketball program to combat the problem of inner city youth having nothing to do but be troublemakers. It's not like you need to reinvent the wheel here, so to speak. There are examples out there for how to resolve similar kinds of problems in a win/win fashion that gives the offending parties something better to do instead of merely vilifying them.

</comment><comment><USER22> I wonder what the second and third order effects will be of this type of enforcement.

</comment><comment><USER23> I'm curious, could they use their sensors and other stuff to build some active noise cancellation system for local inhabitants instead?

<comment><USER24> Like, some buckets of cold water?

</comment></comment><comment><USER25> After reading, I chuckled and realized the title could have been: "Residents use Arduinos to tell at kids on their lawn..."

</comment><comment><USER26> We hear the voice of those who live there, but not of those who visit. Both are likely to be citizens, it seems one-sided to give in to the demands of one group, and ignore the other. (Or perhaps both were listened to, but the article gave no indication of that.)

<comment><USER27> In a society, peoples rights are a lot of times in conflict. In this case, I imagine that the right of the neigbours to be able to rest at night superseedes the right of the visitors to have fun by doing "botellón" (dinking on the street) at night in a residential area.

In any case, this is not special at all. Every European city has regulations about pollution, including noise pollution.

<comment><USER11> Hardly unique to Europe. It's very common in American cities to see signs outside of bars in primarily residential neighborhoods reminding people to be "considerate of our neighbors" and other words to that effect. Cities tend to be noisy but that doesn't mean everyone should take an attitude of "There are sirens and noise anyway, so honk your horn and carouse at 3 in the morning all you want."

</comment></comment></comment><comment><USER28> I misread the title somewhat and now got a «bright» idea: Why not put noise- canceling loudspeakers on plazas? No idea whether this really would work, but I think we should explore a technical solution. Because people need a place to let off steam. A possible double win?

Edit: I googled and found this: [https://physics.stackexchange.com/questions/87833/outdoor- ac...](https://physics.stackexchange.com/questions/87833/outdoor-active-noise- canceling-speaker#93420) \-- it seems that there are limits of physics which make such noise-canceling loudspeakers infeasible. It's a pity.

<comment><USER29> Your edit got there before I did :)

I live in a high-rise next to a motorway in London and at 3am I can measure the noise as 60-70db using a mobile phone noise meter (inaccurate but indicative).

I investigated the feasibility of using my stereo speakers as noise-cancelling for the room... mics on the window sills and the speakers to reduce the noise in the room. I figured it would work well enough to remove the constant background hum of the road. I was wrong. It doesn't really work, and it is just noise upon noise.

The best I've managed to do is hang materials inside of the windows (quilts, sheets) and have been able to knock off just under 10db of noise in the best case (when it's just the drone of vehicle volume rather than specific engines or sirens).

The downside is that my high-rise is a high fire-risk tower block and I'm trading one life affecting issue (noise pollution) for another (fire risk) as now I have flammable materials inside my windows. Hard to know which affects sleep more, certainly the noise is the most real and present issue.

<comment><USER30> Noise cancellation can be a little tricky depending in the frequency. Low frequencies are easiest. Trying feeding the signal through your PC and adjusting the delay, using different delay for different frequency ranges.

Some nice thick shag pile carpets, and wall-hung rugs will also help. If you like posters or pictures, consider using a block frame and putting some sound adsorbent material between the paper and the wall.

Double glazed windows are your best bet, but probably quite hard to install in a high rise. Ideally you want the ones where each glass layer is a slightly different thickness.

Otherwise get some custom fit earplugs from an audiologist, if it's just sleeping that is a problem. They can even fine tune them, so that voice frequencies pass through, but other frequencies are blocked.

<comment><USER29> More likely to get a pair of these [https://www.bose.com/en_us/products/headphones/noise_masking...](https://www.bose.com/en_us/products/headphones/noise_masking_sleepbuds/noise- masking-sleepbuds.html)

Though stopping or masking all noise carries risk by itself... being unable to hear what fire alarms we do have.

<comment><USER11> Assuming these are roughly equivalent to their in-ear headphones, I wouldn't worry about missing a fire alarm. They're pretty effective, especially for low frequency noise like aircraft engines, but they're a very long way from blocking all sounds.

<comment><USER31> the sleep pods are a combination of average ear plugs, and tiny little speakers playing white-ish noise rather loud. they don't do any active noise cancellation. sounds like they'll be good for somewhere around 90dB of noise masking.

still doubt they'd stop a fire alarm.

<comment><USER11> Interesting. I hadn't heard about those. I doubt it would handle 90db though. That's pretty loud, probably dangerously so for an extended period; it's about how loud a lawn mower is when you're operating it.

Standard ear protection attenuates about 15-30db.

<comment><USER31> the 90dB of noise masking isn't all sound energy. they're also ear plugs (on the less effective end of things) so 15-20dB of that 90 is from jamming them into the ear canal.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> I feel like they should have maybe subsidized soundproofing in the nearby buildings rather than ruin the nice outdoor space enjoyed by so many party goers.

</comment><comment><USER33> Kudos to the residents - but since this article is not just about BCN:

 _> People may not want everything monitored and who decides and shapes this agenda is a big question for future urban democracy._

That is actually my main problem with those fab labs: As collecting data becomes a means of power, the fabs are often an attempt to grab that power. I.e. the people running them are almost always heavily politically aligned towards one extreme of the spectrum and thus the labs themselves are ideological echo chambers (at least in my country).

No wonder it produces agendas like these:

 _> "We are trying to build a new productivity model for society, creating a new sustainable economy in cities where people can prototype and test ideas,"_

Like this (an implied technical ability of the masses) is ever going to happen. Especially if the ones advocating it, are either shunning people outside their belief-system or "promoting" the ability with projects and agendas, no one outside their belief-system is even remotely interested in.

Consider affluent neighbourhood residents going into these labs to print their own noise detectors because of their annoyance with the asylum-seeker-home next door. Not gonna happen.

And since Detroit was mentioned: What if those youngsters in plaça del sol where the ones equipped with sensors?</comment>