Plex updates SmartTV and Playstation apps - <AUTHOR> https://blog.plex.tv/2015/08/27/a-massive-update-for-our-smart-tv-and-playstation-apps/

<comment><USER2> My wife and I have not been happy with the update.

<comment><USER3> I don't have a smart TV, but have been using Plex via a mix of web, android and Raspberry Pi's for about 6 months and have been really impressed.

The update looks great on paper -what's the problem in reality?</comment></comment>


An ancient Greek algorithm could reveal all-new prime numbers - <AUTHOR> http://www.sciencealert.com/an-ancient-greek-algorithm-could-be-the-key-to-finding-new-prime-numbers <comment><USER2> Blogspam of

[http://www.scientificamerican.com/article/new-take-on-an- anc...](http://www.scientificamerican.com/article/new-take-on-an-ancient- method-improves-way-to-find-prime-numbers/)

</comment><comment><USER3> ... but where is the link to the paper (or implementation)?</comment>


Sneak peak at Comcast's Skype on Xfinity service - <AUTHOR> http://gigaom.com/video/skype-comcast-xfinity/?utm_source=social&utm_medium=twitter&utm_campaign=gigaom

<comment><AUTHOR> why would anyone buy 3 bits of hardware when you could just do facetime + airplay mirroring from any iOS5 device?</comment>


Close The Libraries And Buy Everyone An Amazon Kindle Unlimited Subscription - <AUTHOR> http://www.forbes.com/sites/timworstall/2014/07/18/close-the-libraries-and-buy-everyone-an-amazon-kindle-unlimited-subscription/

<comment><USER2> Why would we want to give Amazon this much power?

From past history, they will just abuse it.</comment>


As a CTO, how do you know the latest trends in your profession? - <AUTHOR> _or as a person in a CTO-like role: IT manager, Head/Director of Engineering, Tech/Team Lead, or any other technical leadership role_
---
The latest trends, knowledge, and learning.
In every profession, you should be getting enough of it to "keep your saws sharp."
I, personally, love to read well-written blog posts that evoke emotion in me, and motivate me to do things and advance forward. I love listening to audiobooks on 2x-3x speed, as well.
I spoke to a few friends of mine, who are in technical leadership positions, and it seems that they get bored very quickly when reading long blog posts or books.
Instead, they just love watching videos and listening to podcasts.
Don't get me wrong, the written information is still valuable for reference.
So what is it for you? Are you a reader, listener or watcher? What form do you prefer your brain food to be in? And why? Tell us your story!
---
Thank you for your time reading this and giving a thoughtful response! :) <comment><USER2> I spend 2 full hours a day reading articles, forums and blogs. Speaking is slower than reading so I like videos less. On the other hand newer technologies tend to be presented before they are written about, so there is value there.

I toy with the really interesting stuff a couple of hours a week.

On the whole though i find it very straining to stay up to date on everything I think a CTO needs to know.

<comment><AUTHOR> Thank you for your answer!

Which blogs and forums do you like to read?

<comment><USER2> HN is my starting point, because everything new gets mentioned here, but whenever something new emerges, I subscribe to the blog/feed of whoever is behind it. Always go to the source.</comment></comment></comment>


Digital identity has three layers, and you can only protect one of them - <AUTHOR> https://qz.com/1525661/your-digital-identity-has-three-layers-and-you-can-only-protect-one-of-them/ <comment><USER2> The main issue I see is how they plan to fix this issue:

> Instead of guessing our location, relationships, or hidden desires behind > our backs, they could ask questions and respect our answers.

You __really__ cannot respect what someone tells you about themselves. Machines can rely on the information people feed into social media because that's things the person is personally OK with sharing to anyone and everyone (or, at least, their friend group), but once they start asking specifically about relationships, (bad) habits, and embarrassing situations ("were you at <a bar> yesterday at 2 AM?"), people often lie to the machine to make them seem like a better person or boost their own morale.

<comment><USER3> Yes, but that's okay. Why should humans not be able to lie to machines? We value privacy because there are some things that are not other people's (or other machine's) buisiness.

In the end it matters why you share the data. If you share the data with a service because you have an addiction problem and the service will help you to overcome it, then it is reasonable to be more open and personal. But if the same data is also given out to others to judge your credit-worthyness, then we have a breach of trust and that is rightfully not acceptable.

If you share your data on facebook (or any more trustworthy plattform) then your objectives are of a different kind: You want to share aspects of your social life. This is a lot less private than the addiction service and also a lot less critical when it comes to the correctness of the information.

<comment><USER4> It's not really lying to machines, though; the machines don't care. It's lying to the people on the other end of the machine.

Suppose somebody working on Hacker News wants to redesign it, and wants to know if they should optimize for long visits or short visits. If they call me on the phone and ask me how often I open HN and what my mean usage duration is, I'm just going to make up numbers. Their website analytics, on the other hand, can tell them something closer to reality.

I'm not saying that's good or bad; I'm just saying that our devices are often more reliable records of ourselves than our own memories and thoughts.

<comment><USER5> This gets into very deep water about what the "real" self it. And using this in the machine feedback loop produces weird side effects, like the tendency of Youtube to recommend far-right, conspiracy, anti-vax etc videos because those have high engagement. It's almost a dissociative effect, where people keep watching or clicking but understand less and less why they're doing it.

People who wire a machine directly into the _id_ have obviously never seen or understood _Forbidden Planet_.

<comment><USER6> It gets into the value of the humanities. Not the departments at universities but the course of study, which must be concerned with the functional sum of sensory systems.

Since Plato, the humanities has served critical purposes beyond the production of immersive experience. But the two are no more separable than science is from logic.

The value of the humanities, in my view, is in beginning with the sum of the effects and critiquing the mechanics from there. I am afraid this necessitstes something like the opposite of a technocracy, with no lack of sincerity and brevity. Hence it's historical conguencce with enlightenment, whatever that is ...

<comment><USER7> > Not the departments at universities but the course of study

Why are you making this distinction? I think most people undertaking that course of study will be doing at the department in the university.

<comment><USER8> >> _Not the departments at universities but the course of study_

> _Why are you making this distinction?_

Probably because there's a pretty deeply held belief among a lot of technologists that non-STEM degrees and departments are at best wastes of time, and at worst utterly corrupt.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Just wait until they have gaze tracking... they'll have real time interest/boredom (image order, time spent, ignored) detection along with an almost unmaskable biometric probability match (sequential novelty boredom detection on e.g cat pictures).

You don't have to click for them to know you like dark long haired angora goats... in compromising positions.

Hmmm are you jealous of that perfectly cabled rack next to him? Maybe we could interest you in... or we could just let your your mom know, if you don't pay for protection... she's not always so understanding these days.

<comment><USER10> Gaze tracking isn't necessary for this. You can track how long a user stopped scrolling through a feed on items classified as X, then build confidence by comparing the frequency of stops on X classified stories over time.

Also, for really weird stuff, it's probably enough to blackmail a person just by showing that Weird Thing appears in their social feed in the first place.

</comment></comment><comment><USER11> I pay a lot of attention to what goes in my profile. My wife and I are older so several of our friends have serious health issues. We are careful to use Tor or private browsing with DuckDuckGo when doing medical related web searches. I also switched over to G Suite for $10/month in the hope that I am not being 'harvested' as much as when I used to use Google's services for free. I cringe when I see the private data young relatives leak on FB.

EDIT: and, of course, keep location tracking turned off.

<comment><USER12> If you're really that paranoid why wouldn't work just go to a library and research the old fashioned way, books.

<comment> yjftsjthsd-h It's not paranoia when someone's actually out to get you;) And the web is convenient even taking reasonable precautions.

</comment></comment></comment><comment><USER13> I strongly disagree about the middle layer. We have a lot of possible control about what's observed about our digital behavior.

Location tracking (turn off)

IP address (use VPN)

Cookies (don't allow cookies, don't browse the web while logged in to facebook, google, etc)

Javascript, browser fingerprinting (disable unnecessary javascript)

Installing sketchy apps (which is most of them - don't)

Credit card purchases (use cash instead)

<comment><USER14> Not enough people recommend the Tor Browser at times like this. It's really good!

>Cookies (don't allow cookies, don't browse the web while logged in to facebook, google, etc)

Even better, try not to have account on those sites at all.

>Javascript, browser fingerprinting (disable unnecessary javascript)

Firefox has a good about:config option privacy.resistFingerprinting

>Installing sketchy apps (which is most of them - don't)

F-Droid is a good repository of trustworthy apps: [https://f-droid.org](https://f-droid.org)

<comment><USER13> Thanks for the additions!

I think Tor browser is great. However, it may not help much unless you also follow the above practices -- don't log in to things, don't allow cookies, run minimal javascript.

</comment></comment></comment><comment><USER15> I think instead of using screensavers when computer is idle, everyone should be running Page Rankster Apps random ad clicking with alternating porn surfing, Just to keep Surveillance Capitalism and A.I. dumbed down like a mushroom feed it shit!

</comment><comment><USER16> If we make the world a safe space where the goal is to meet everyone's needs, then maybe we can live our lives openly and not have to worry about information being weaponized like this?

<comment><USER17> I like the principal; I have not yet figured out what to think about laws that concern "immoral" private behaviour such as "extreme" porn (any jurisdiction, the point isn't any particular law — Japanese, USA, UK, Saudi — but the principle).

Even if all such laws were repealed, there would still be social consequences for violating taboos.

</comment></comment><comment><USER18> Admittedly i didn't read all the article, the flashing gifs were giving me a headache. However;

I wonder if this could be manipulated by a bot? Wouldn't be too hard to set up one that posted moral fiber and BS in a timely fashion, actually if you had access to the end data, and could create identities to test, this would be an interesting (maybe deep learning) project.

<comment><USER19> There are countless bots doing this exact thing, in countless different ways, for countless purposes.</comment></comment>


Shimming: the newest con for stealing credit card info from ATM machines - <AUTHOR> http://www.networkworld.com/community/node/63544

<comment><USER2> This doesn't work in the US because we don't have smart cards.

Edit: My point stands that _this particular attack_ does not exist in the US and people don't need to worry about it. Existing precautions against magstripe card skimming are adequate.

<comment><USER3> What? It's even easier in the US. Credit card data is just text. Hook up a magstripe reader to a PIC and go to town (literally hah). People have been doing it for years especially at gas stations and seedy bars where it's too dark to notice/patrons are too drunk to care.

[http://www.identitytheft.com/article/identity_theft_gas_stat...](http://www.identitytheft.com/article/identity_theft_gas_stations)

<comment><USER4> Since US cards are "dumb", the ATM doesn't need to send PIN information to it. The ATM card # can be stolen, however, that's not enough to complete the transaction.

<comment><USER5> Talking about old mag stripe card, the system used to authenticate the transaction is this:

1\. The account number is crypted in DES (ora a variant) with a _PIN key_ , the cryptogram is then decimalized and the first 4-5 digit extracted to obtain the so-called _natural PIN_.

2\. The user then can change is PIN by using an offset: user PIN + offset = natural PIN.

3\. Account number and offset are stored in the card.

4\. The ATM knows the PIN key (wich is a shared key common to all the ATMs system of a certain bank) and when a card is inserted the ATM calculates the natural PIN from the account number. Then it verifies the PIN number: if user PIN = natural PIN + offset then SUCCESS

</comment></comment></comment></comment><comment><USER6> From my understanding of smart cards, I don't see how this is possible.

Communication between the card and the reader is typically done using encryption with a Diffie-Hellman key exchange with a man-in-the-middle resistant protocol. You would need to attack whatever encryption algorithm is being used, which is non-trivial even with physical access. You would need to either perform differential power analysis attack or a timing attack or attack a weakness in the algorithm.

Seeing as how one of the primary purposes of smart cards was to eliminate skimming and similar attacks, I can't fathom why any reader would ever be created that didn't support session encryption. Why use a chip if it's basically the same as a magnetic stripe? I'll plead ignorance on the workings of the European debit system as I'm Canadian and we're just getting smart cards now.

Does anyone have a better source than the linked article?

EDIT: Nevermind, apparently the security was broken a while ago:

[http://www.cl.cam.ac.uk/research/security/banking/nopin/oakl...](http://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf)

</comment><comment><USER7> Interesting, but how could collected data be retrieved? Could a wireless transmitter be built to fit on this 0.1mm card?

<comment><USER2> Perhaps the thieves return later to remove the shim and its data.</comment></comment>


Ask HN: Super successful people, how do you use HN? - <AUTHOR> <comment><USER2> What is your definition of success?</comment>


Apollo Server 1.0  – GraphQL Server for Node.js Frameworks - <AUTHOR> https://dev-blog.apollodata.com/apollo-server-1-0-a-graphql-server-for-all-node-js-frameworks-2b37d3342f7c <comment><USER2> I never quite understood Apollo. I've written GraphQL servers using just the Node.js GraphQL implementation and they haven't been much code. Barely more boilerplate than the Apollo example given.

I'll have to dive into the code myself when I have some free time but can anyone explain to me what value this adds specifically?

I am assuming it does add value and I'm just not seeing it.

<comment><USER3> From the doc:

Comparison with express-graphql

\- express-graphql works with Express and Connect, Apollo Server supports Express, Connect, Hapi, Koa and Restify.

\- Compared to express-graphql, Apollo Server has a simpler interface and supports exactly one way of passing queries.

\- Apollo Server separates serving GraphiQL (an in-browser IDE for exploring GraphQL) from responding to GraphQL requests.

\- express-graphql contains code for parsing HTTP request bodies, Apollo Server leaves that to standard packages like body-parser.

\- Apollo Server includes an OperationStore to easily manage whitelisting.

\- Apollo Server is built with TypeScript.

<comment><USER2> Thank you for digging that up. You don't need to use express-graphql to use graphql on a server so that comparison is only meaningful if you already use a wrapper... I'm was curious why a wrapper is even needed. The base GraphQL.js library is not complicated.

The Apollo team member himself even said the wrapper is "thin."

</comment></comment></comment><comment><USER4> So we now have React/Webpack + Redux + Apollo + GraphQL + Node + Pogstgres where once we had Rails/PHP/Django + Postgres. Someone hit me over the head because I don't get how all this is progress. There's no way I can teach web development to a beginner if there are so many layers between request and response.

<comment><USER5> I don't really understand this criticism. If your web app is simple/static enough, then by all means use Rails. Everything will be simpler. But there are an entire class of applications that can't be built with that stack.

<comment><USER6> That's a very bold statement: "can't be built with that stack".

A large portion of apps aren't built with Node or React, they're built with, say, Rails, Java/Spring or .NET backends and a front end framework like Angular.

I get the theory behind React, the reality is that it is often a complete mess.

</comment></comment></comment><comment><USER7> Couldn't find if Apollo solves the database round trips issue with GraphQL (the joins/n+1 problem). Can anybody shed a light on it?

<comment><USER8> There are basically two approaches to this issue:

0) Do nothing

If you are just prototyping, you should do the simplest thing that could possibly work. (But this is not a real solution, so I won't count it)

2) Request Batching

This approach is popularised by Facebooks Dataloader library [https://github.com/facebook/dataloader](https://github.com/facebook/dataloader) Instead of directly querying the database in the resolver, you return a specification of what data you are interested in. When all resolvers on the same level in the query has returned this specification, the Dataloader library figures out how to batch queries together as much as possible

3) Big Join

You can inspect the GraphQL query in the top level resolver and basically perform one giant join up front. You will then pass the entire value down your resolve hierarchy, and all they have to do is pick out the correct data from the complete result set. Take a look at join-monster if you are interested in this approach.

The Graphcool hosted backend is serving millions of requests an hour using the Dataloader approach, and we have found this to be more flexible and more performant at scale than generating a big complex join up front.

For most queries we see single digit millisecond response time for a batched query, and the time complexity scales linearly with the depth of the query, which is not the case for joins.

<comment><USER9> 2) is easy, but leads to two queries no matter what, because you have to do a whereIn

3) here's the code:

const EagerQL = (info, allowed) => { let fields = info.operation.selectionSet.selections[0].selectionSet.selections; return fields .map(field => field.name.value) .filter(field => allowed.includes(field)); };

// in a resolver user(_, args, context, info) { let eagers = EagerQL(info); console.log(eagers); // ['posts'] }

This will give you fields that were queried for so you can do a big join. Hope this helps someone :P

<comment><USER10> trying to access fields like `info.operation.selectionSet.selections[0].selectionSet.selections` always feel wrong to me. I wish graphql library part comes with some utility function for these.

<comment><USER9> Completely agree.... I don't understand why there isn't a more standard way of accessing the fields queried for so that you can do joins.

</comment></comment></comment></comment></comment><comment><USER11> The image is pretty misleading. It looks as if GraphQL server connects you to REST and SQL.

In fact you simply have functions called _resolvers_ where you write your logic to get data from wherever you want. SQL, NoSQL, API, filesystem, etc.

<comment><USER10> I think the idea is that you shouldn't want to have GraphQL server code containing business logic code in it.

GraphQL should just be proxy layer between actual client and the actual, multiple, APIs.

<comment><USER11> But then why connect it to SQL and Redis?

</comment></comment></comment><comment><USER12> Is this a direct replacement for graphql-server-express?

I've been using it while following along the backend JS tutorial at howtographql.com and was wondering if it's now outdated and what the migration would look like.

<comment><USER13> It's exactly the same thing but renamed - we're going to make both names work for a few weeks and then deprecate the graphql-server name after all the resources are updated. It's exactly the same, just change your import to "apollo-server-express"

<comment><USER12> Awesome! I would suggest updating your documentation, as there are some places where the graphql-* variant is mentioned.

<comment><USER13> Just did it, thanks so much!</comment></comment></comment></comment>


Philly suburb wants to sell its water, offering a glimpse of post-Covid America - <AUTHOR> http://www.inthepublicinterest.org/a-philly-suburb-wants-to-sell-its-water-offering-a-glimpse-of-post-covid-america/ <comment><USER2> What's the point of civil rights, again, if we cannot afford our own water?</comment>