Why I'm Investing $500M in Migrants - <AUTHOR> http://www.wsj.com/articles/why-im-investing-500-million-in-migrants-1474344001 <comment><USER2> At the risk of sounding overly cynical, while it's great that Mr. Soros is donating this money to a worthy cause, I wonder if, as long as he's feeling charitable, he might also be willing to stop domiciling his investment vehicles in jurisdictions known for supporting tax evasion/avoidance. Perhaps with the increased tax revenue, governments could afford to better shoulder the costs of adequately integrating migrants and refugees without the assistance of billionaires.

<comment><USER3> He's not donating money to a worthy cause. He's investing money in immigrants, and betting against the host nation's currency. It's how he's made his fortune.

<comment><USER2> You're right, I should have said investing rather than donating, but seeing as there seems to be a moral consideration on his part, I hope the rest of my post is still appropriate.

</comment></comment></comment><comment><USER4> [http://www.zerohedge.com/news/2016-08-16/soros-hack- reveals-...](http://www.zerohedge.com/news/2016-08-16/soros-hack-reveals-plot- behind-europes-refugee-crisis-media-funding-and-manipulation?page=2)

<comment><USER5> Reading that left me impressed with how thorough of a job Soros is doing to try to make the world a better place.

As far as I can tell the article tries to make the point that the Soros foundation is trying to manipulate global policy.

Which ... Yes. That's what these organizations do, and it's been essential to the process of developing good policy, over the last hundred years... There is absolutely nothing embarrassing about that memo. If I had written it I would be proud to see it leaked.

<comment><USER6> Sure as hell isn't making it a better place for Germans or anyone else in targeted nations.

</comment></comment></comment><comment><USER7> On a slight tangent here...

I've always thought one of the biggest problems with globalisation as a concept is the absence of free movement of people.

What _I_ mean by that is the ability of people anywhere to move anywhere else, to work, consume, pay tax, and otherwise take part in civic life, for as long as they wish.

We have free movement of capital and free movement of goods. However the limitation on movement of labour has turned some parts of the planet into labour ghettos, creating forced economic gradients that benefit a few. While this has been the case for some time, the free movement of information has informed even the most ignorant that this need not be the case.

The so-called "economic" migration sweeping the world is the inevitable result of this state of affairs. Its not just information that wants to be free.

I find it hard to see how one could be a true believer in the power for good of the free market, without including free movement of labour.

If you follow the thought experiment of what such free movement would look like, you could imagine the end state being an effective equalisation across most of the globe. The net effect would also be an acceleration of cultural equalisation (religious extremists notwithstanding).

Of course, the journey from here to there would be interesting!

<comment><USER8> Some cultures are more aggressive than others and do not allow for the free exchange of ideas. This is why this does not always work. The freedoms provided by western culture are fragile, a monopoly over a democracy can result in an antidemocratic anti-free society, one where the benefits of free anything are extinguished.

<comment><USER7> I think that's a bit of a simplistic generalisation. It's probably more accurate to say that there are aggressive and "dangerous" ideas that have taken hold among some groups of people, including among native westerners. And I agree that some of these ideas are inimical to free discourse and enlightenment ideals.

However, other than the pathological power-seekers that cynically exploit such ideas for their own benefit, most followers (those that are more inclined to support simplistic and extreme positions) are not much different across ideas. There is more in common between a neo-Nazi and a fundamentalist Muslim than either would care to admit. Both are fear-driven, exclusionary, apocalyptic, conspiratorial, and inclined to violent remedies. Both regard typical western centrists (both progressive and pale-conservative) as weak.

I'm not sure what the solution is, but surely some elements of a successful strategy must include education, focusing on unifying similarities, and forging alliances of moderate groups across religious, cultural, political and national boundaries. All of which take generations of sustained effort. There are no quick fixes, contrary to what demagogues would have us believe.

</comment></comment></comment><comment><USER9> This discussion if quickly being flooded with right-wing extremists. If you make a claim, please, provide a reputable source. If you see a claim being made without a source, do something for the intellectual health of this community and downvote.

<comment><USER10> I don't think just because people disagree with the preferred political narrative of the global rich that that automatically makes them right-wing extremists. You know, it's possible to not like George Soros while also not being a literal Nazi.

</comment></comment><comment><USER11> I would prefer to see policies that will cost soros his money:

\- weapons cannot be sold to countries we do not have reciprocal defence agreements with

\- weapon and oil sanctions are enforced globally

\- a decade long investment of around 5% of world GDP increasing energy efficiency, at the same time as building electricity pipelines to take solar from tropical zones to rest of world and an end to oil pipelines

\- end to oil subsidies globally

\- global agreements on water rights between countries, on investment and policy for efficient (drip) water use in agriculture

Grief, that's just off top of my head and is probably only half the problem. Basically if we can do all that, Soros will lose his wedge. I doubt he would mind too much.

</comment><comment><USER12> Heh, I just made a joke in another thread about how I like to imagine sometimes people like Soros are actually hidden ultra-conservatives. They promote pro-immigration policies because it is the most robust way to turn West Europeans towards conservatism and nationalism.

If one indeed wanted to achieve that goal, I couldn't think of a faster way.

At this rate, we'll probably see walls built in Europe before we see Trump's wall over here.

</comment><comment><USER13> I would invest in a fortified city in the middle east with added security and let people flee war there instead of having to go all the way to western countries. there they'll be able to claim asylum to their country of choice and when they are given a visa they'll get a free flight there.

<comment><USER14> The problem is - which country in the middle east will agree to host this city?

<comment><USER13> Syria at the turkish border

</comment></comment></comment><comment><USER15> "Investing in migrants" is an incredibly cheap way to buy votes.

</comment><comment><USER16> Soros seems to have a hand in everything...

</comment><comment><USER17> "I will invest in startups, established companies, social-impact initiatives and businesses founded by migrants and refugees themselves."

Delusion pro!

Sure there will be talented people, but they'll find a way, it's still nice they'll get help getting funded,

but what about the masses who come for social benefits, and don't really wish to work during their lifetime.

Not to mention the lack of single f*ck they give about European culture.

Come back and live in Europe Soros papa, THEN have it as your playground.

<comment><USER18> $500M wouldn't last very long if you had to split it among the masses. It's easy for Soros et al to support mass immigration if they aren't the ones who bear the cost.

</comment></comment><comment><USER19> Have no knowledge of Mr. Soros' policies or public stance on issues, but I ask: why is there even a need for a separate fund for migrants?

From what I know, investors are driven by profit, not be ethnicity. If a business has potential to turn a profit, I don't think any VC would want to turn away.

At least that's how things work for some of my Indian friends in the Valley. No one has ever denied them investment because they were immigrants.

<comment><USER18> It only makes sense from a PR stand point: Drawing attention to the far outliers at the top. On a cognitive level, we all know that migrants are people not entirely unlike ourselves, capable of a wide range emotion sand behaviors, but what the news would organically expose us to are the outliers at the bottom - rapists, terrorists, organized crime. By creating this fund, Soros is trying to steer the conversation towards the top outliers, the innovators and job creators.

<comment><USER20> I don't know anything about Soros' intentions, but there are many reasons besides PR to create a fund like this. Refugees have a complicated nationality status, which can exclude them from the global economy. A fund such as this could specialise in working around those limitations.

</comment></comment></comment><comment><USER21> IMHO he will be one of the people responsible for radically limitting the human right of asylum and the rise of right-wings all over Europe. Asylum once was a nice idea, but right now it is misused for mass-immigration in Europe.

</comment><comment><USER22> The "web" link isn't working me (on my setup at this particular moment). It just returns HN pages and old stories. If you experience the same problem, google:

 _Why I'm Investing $500 Million in Migrants I will invest in startups, established companies..._

Which is the story title + subtitle.

<comment><USER17> yep, paywalled.

Paste the url into google search and go from the results link.

</comment></comment><comment><USER23> I guess that wsj links are invariably paywalled. Can't HN stop such links from being submitted?

<comment><USER24> Clink on 'web' underneath the link and open the article through Google, that'll bypass the paywall.

<comment><USER25> Doesn't work for this article, Google shows only one hit and it's paywalled.

<comment><USER26> It worked for me (and that was after I clicked the direct link once and got the paywall, so presumably I'm cookied). Maybe try using the web link in private browsing mode?

</comment></comment></comment></comment><comment><USER27> wsj.com Why I'm Investing $500 Million in Migrants George Soros Sept. 20, 2016 12:00 a.m. ET

The world has been unsettled by a surge in forced migration. Tens of millions of people are on the move, fleeing their home countries in search of a better life abroad. Some are escaping civil war or an oppressive regime; others are forced out by extreme poverty, lured by the possibility of economic advancement for themselves and their families.

Our collective failure to develop and implement effective policies to handle the increased flow has contributed greatly to human misery and political instability—both in countries people are fleeing and in the countries that host them, willingly or not. Migrants are often forced into lives of idle despair, while host countries fail to reap the proven benefit that greater integration could bring.

Governments must play the leading role in addressing this crisis by creating and sustaining adequate physical and social infrastructure for migrants and refugees. But harnessing the power of the private sector is also critical.

Recognizing this, the Obama administration recently launched a "Call to Action" asking U.S. companies to play a bigger role in meeting the challenges posed by forced migration. Today, private-sector leaders are assembling at the United Nations to make concrete commitments to help solve the problem.

In response, I have decided to earmark $500 million for investments that specifically address the needs of migrants, refugees and host communities. I will invest in startups, established companies, social-impact initiatives and businesses founded by migrants and refugees themselves. Although my main concern is to help migrants and refugees arriving in Europe, I will be looking for good investment ideas that will benefit migrants all over the world.

This commitment of investment equity will complement the philanthropic contributions my foundations have made to address forced migration, a problem we have been working on globally for decades and to which we have dedicated significant financial resources.

We will seek investments in a variety of sectors, among them emerging digital technology, which seems especially promising as a way to provide solutions to the particular problems that dislocated people often face. Advances in this sector can help people gain access more efficiently to government, legal, financial and health services. Private businesses are already investing billions of dollars to develop such services for non-migrant communities.

This is why money now moves instantaneously from one mobile wallet to another, drivers find customers by using only a cellphone, and how a doctor in North America can see a patient in Africa in real time. Customizing and extending these innovations to serve migrants will help improve the quality of life for millions around the world.

All of the investments we make will be owned by my nonprofit organization. They are intended to be successful—because I want to show how private capital can play a constructive role helping migrants—and any profits will go to fund programs at the Open Society Foundations, including programs that benefit migrants and refugees.

As longtime champions of civil society, we will be focused on ensuring that our investments lead to products and services that truly benefit migrants and host communities.

We will also work closely with organizations such as the Office of the United Nations High Commissioner for Refugees and the International Rescue Committee to establish principles to guide our investments. Our goal is to harness, for public good, the innovations that only the private sector can provide.

I hope my commitment will inspire other investors to pursue the same mission.

Mr. Soros is chairman of Soros Fund Management LLC and founder of the Open Society Foundations.

<comment><USER28> The question is: why Europe specifically? There's plenty of neighboring countries that could take immigrants in and could use a boost of GDP by the businesses founded by migrants he speaks of. The migrants themselves would be better off there, since they wouldn't be affected by the rise of right-wing ideas in Europe.</comment></comment>


AMD Announces Four New Ryzen CPUs: 2700E, 2600E, 2500X, and 2300X - <AUTHOR> https://www.anandtech.com/show/13343/amd-announces-four-new-ryzen-cpus-2700e-2600e-2500x-and-2300x <comment><USER2> 45w 8c/16t has a very nice battery/performance balance for mobile workstations.

</comment><comment><USER3> Not exactly groundbreaking, but it's nice to see some more moderate and lower power options. Quite affordable, too.

<comment><USER4> Note how only one chip (called a CCX) iz being used for these new offerings? It looks like AMD has had yield improvements and is now able to offer these chips...

<comment><USER5> Only one chip was ever used in Ryzen.

AMD has 2 dies one which is used for Ryzen, TR and EPYC and one which is used for RavenRidge the RR has a GPU and only 4MB of cache per CCX and only one CCX per die the standard zeppelin die used for the rest has 8MB cache per CCX with two of them per die and no GPU on die.</comment></comment></comment>


Show HN: Discover the World of Mathematics - <AUTHOR> https://mathpendium.org/ <comment><USER2> The front page is too empty. You must add some links to popular topics (quadratic equation? topology?) and some link to random topics. Something like the Wikipedia main page.

There is an error in [https://mathpendium.org/view/5e33c092981ec41bc6b27939](https://mathpendium.org/view/5e33c092981ec41bc6b27939) (two missed $ and the rendered is unhappy with \subset)

Can I edit without an account? Please. I'm too lazy to create one :) . I guess it's a tradeoff between spam and making it easy to make small contributions.

<comment><AUTHOR> Thanks for the feedback. Yes, it seems I need to redesign the site to make it easier to navigate and feel less empty. I like your suggestions about adding popular topics.

Thanks for letting me know about the error. Right now Mathpendium has around 1000 entries, and so it is easy for some errors to slip through the cracks.

I was debating about whether or not to require an account to make a contribution. As you mentioned, making an account helps decrease the chance of spam. However, I am open to allowing anonymous contributions, and it is good to know that others would appreciate that.

</comment></comment><comment><USER3> I searched for "voronoi" and got no results. I don't know if this is because the site doesn't have any content about voronoi polygons, or if search is broken. I assume it's the former.

That then leads me to ask - how do I discover what content the site has, and what content is it likely to have in the near future?

<comment> r-zip There appears to be quite a lot of missing (basic) content. Try searching "Cauchy-Schwarz" (or its variants). Nothing. Same for "Fourier".

<comment><AUTHOR> Thanks for the feedback. The site's growth model more like Wikipedia's growth model in that it grows by user contributions.

This is something that I need to better communicate on the site and explains why the site currently has some content, but not others.

</comment></comment></comment><comment><USER4> I just searched for "game theory" and got no results which is jarring even though I understand why. Indexing LaTex snippets has its use but is too far removed from higher level concepts to be generally useful. Mathworld ([http://mathworld.wolfram.com/](http://mathworld.wolfram.com/)) had a huge number of high quality, high level articles. It would be very interesting if the top-down and bottom-up approaches respectively between the two could be combined.

If Eric Weisstein ([http://mathworld.wolfram.com/about/author.html](http://mathworld.wolfram.com/about/author.html)) is out there reading, thank you for your work. I can't believe the longevity and quality of Mathworld.

<comment><AUTHOR> Thanks for the feedback. Yes, I agree that Mathworld is great. Mathpendium is not meant to replace sites like Mathworld, but to work with them. I think this is something I need to make more clear on the site.

That is, sites like Mathworld are great for finding information and an overview about a topic.

For example, it is a great place to learn about what a solvable group is.

Mathpendium, on the other hand, is designed to help you if you only want a concise definition of a solvable group, want to find all theorems that describe when a group is solvable, or find all conjectures related to solvable groups.

That is, Mathependium is used for when you want to get a list of all theorems related to a topic, with links to other sides for a deep dive or overview.

In a sense, theorems are the tools of mathematics, Mathpendium is a toolbox that helps you find those tools, and each item on the site has links to other sites to learn more about the tool.

<comment><USER5> > Yes, I agree that Mathworld is great.

Slighty OT but,

Apart from the fact that it looks and feels like 2006 (that latex renderer is so, so horrible, it's a distraction), and that you can't copy anything meaningful out of it, Mathworld is great. But honestly, as of 2020, I would have thought we'd have much better tools to learn a domain as thoroughly defined as mathematics (interactive, intuitive, etc etc etc). As it stands, it's still really hard without a teacher, but it shouldn't: a rich web experience with text as a basis should be able to produce at least as good understanding as a video (whose only major difference is voice).

I'd expect to be able to hover over anything and get a tooltip definition, be able to move things in equations and sliders for constants to see real-time graphs or limits or edge cases etc; with formulas that self-update in real time.

I mean, it's a poor state of affairs that the combined body of mathematicians on Earth still haven't come up together to find a way to explain and teach mathematics at least as well as a freaking catalog website can show and sell products. It's not that hard to leverage decent frontends...

I love your efforts because I think they're truly headed in the right direction; we need so many more of these tools, innovation on the way to building an actual "base of mathematical knowledge" that's not Wikipedia (too general) nor Matlab (too specific) nor YouTube (good thing but not enough).

Back on topic:

\- are you considering a public-facing API?

\- I think "discover" (in your title) is misleading and explains some slightly harsh reactions here (failing to honor a promise is really bad marketing). I'd suggest something more like "pro tools for pro math", I mean make the promise that it's a tool for people who already know these things, who don't "discover" but rather "reference", "recall", sort of a modern lookup table. Like, say I've forgotten formula or theorem X, I'd really value being able to get that info as fast as possible.

<comment><AUTHOR> Thanks for your support. I share your views too, which is why I am creating Mathpendium :)

Right now I haven't thought about a public API. I am currently focusing on how users use the site since this will provide good feedback for how an API could be used.

I think you make a really good point for the discover title, and I really like your suggestion. This is definitely I will address. Thanks for the feedback. It is really helpful.

</comment></comment></comment></comment><comment><USER6> > What if you could easily answer the question "what is everything currently > known in mathematics."

I love this. I work on this problem a lot. More generally of the form "what is everything currently known in X"?

I would love to be able to make statements like "I am familiar with X/Y/Z% of the nodes in Computer Science/Medicine/Arrested Development Season 2". I would love it if the abstract idea of the "dent" ([http://matt.might.net/articles/phd-school-in- pictures/](http://matt.might.net/articles/phd-school-in-pictures/)) a researcher makes could actually be concretely measured as nodes added/updated/subtracted from some corpus of knowledge.

Have you thought about moving the content to a git repo and allowing people to contribute via a pull request?

<comment><AUTHOR> Yes, the goal is to help people know what is known in an area. I will update the docs to make this more clear.

I am open to supporting pull requests, but my thoughts were that the custom user interface Mathpendium has allows for an easier contribution process.

</comment></comment><comment><USER7> I'm not convinced about the usefulness of this format, but I'll reserve judgement for now. However, one thing I'm almost certain is that categorization and navigation by topic is a must-have; serendipity just doesn't cut it (unless you have made some truly groundbreaking advancements in search). Btw, I searched quite a few keywords in algebraic geometry and found nothing; maybe you could look into converting the Stacks project (they even have an API[1]) into your format and contemplate usefulness in the process.

Another meta suggestion: IMO knowing who you are is usually pretty important for establishing trust in academic circles. Maybe link to your personal homepage on the about page? Right now all we get is a project-specific email so you're basically anonymous.

[1] [https://stacks.math.columbia.edu/api](https://stacks.math.columbia.edu/api)

<comment><AUTHOR> Thanks for the feedback. I have a lot of feedback on the need for searching by topic, and it us something I will add.

Also, I can add a bio page about myself.

</comment></comment><comment><USER8> When I landed on the front page i thought it hadn't loaded properly. Had no idea what to do.

Is this just for people who already know lots about math? If so maybe that's why I didn't get it.

<comment><AUTHOR> Thanks for the feedback. Yes, it seems others too have felt the home page was hard to navigate because it was too empty. I will explore ways to make it more clear how to use the site.

I'm thinking perhaps a list of categories to explore (calculus, real analysis, abstract algebra, etc.) could be helpful if one doesn't have a specific term to search for.

<comment><USER9> Do entries have categories? Searching for e.g. "calculus" only brings up one result.

I think the home page needs to say what the site is for and what kinds of things are on it, otherwise we have no idea what to search for. Maybe start with something in the search box and the results already below?

</comment></comment></comment><comment><USER10> Are you using MathJax to display the equations? Why do I not get the MathJax context menu when I right-click on the equations?

<comment><USER9> It's using Katex, which is smaller and faster: [https://katex.org/](https://katex.org/)

<comment><AUTHOR> Yes, I'm using katex because I found the API easier to work with.

<comment><USER10> Are you rendering the LaTeX on server-side or on client-side using JavaScript? I am asking these questions because I find MathJax code in your website:

      <script type="text/plain" cookie-consent="strictly-necessary">
        window.MathJax = {
          tex: {
            inlineMath: [['$', '$'], ['\\(', '\\)']]
          },
          svg: {
            fontCache: 'global'
          }
        };
      </script>
      <script type="text/javascript" id="MathJax-script" async
        src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-svg.js">
      </script>

<comment><AUTHOR> Actually, that code should be deleted. At one time, I was experimenting with MathJax but don't use it anymore.

</comment></comment></comment></comment></comment><comment><USER11> It's a little lacking in content. I searched for 'Bernoulli' and came up with nothing, so widened this to 'probability' and nothing still.

It would benefit from some kind of taxonomy on the front page to give an indication of what content areas are available.

<comment><AUTHOR> Thanks for the feedback. I have learned that I need to add a way to view things by category.

Also the site is grown similar to Wikipedia with user contributions, which is why there isn't as much content now.

This is something I need to better communicate on the site.

</comment></comment><comment><USER12> Category -> search -> no results found.

</comment><comment><USER13> I searched for 'logic' and 'proof', and all I got was a request to consent to their use of cookies.

<comment><AUTHOR> Interesting. The consent for use of cookies dialog should appear the first time you open the site. After agreeing to the use of cookies, the dialog shouldn't be displayed anymore. If you don't mind me asking, what browser and system are you using?

<comment><USER13> Chrome/OS X. I didn't agree to the cookies, and wouldn't do so until I was satisfied that the site was of interest and value. Give people a chance to test drive it before requiring consent.

</comment></comment></comment><comment><USER14> "probability" search term doesn't give a useful result. How is data fed into the system?

<comment><AUTHOR> The system is mostly fed by user contributions. Better communicating this is something I need to improve on the site.

</comment></comment><comment><USER15> Long equations break out of the content box. E.g., view/5e33c093981ec41bc6b279b7

<comment><AUTHOR> Thanks for the feedback. This is a known issue, but I am working on other higher priority issues at the time.</comment></comment>


Somu by solokeys – open-source security key - <AUTHOR> https://www.crowdsupply.com/solokeys/somu <comment><AUTHOR> I've just received my Somu by Solokeys. It's an open-source security key for 2FA. I've tested it on Windows and Linux adding it as a security key for 2-Step verification and it works flawlessly. I backed this project on Crowdsupply in September for 25$ and I'm glad they delivered.</comment>


Solving the Wrong Problem - <AUTHOR> http://www.jaynathan.org/2012/03/solving-the-wrong-problem/

<comment><USER2> The anecdote told in this article makes no sense. The plain "Swiffer Sweeper" product is not used for wiping up spills, but for collecting dry dirt and dust. It wasn't until later that P&G introduced several wet products, which, again, aren't for cleaning up spills, but for getting stains up off the floor after you've used the dry Swiffer Sweeper. As far as I know, there is no circumstance in which it would be appropriate to pull out a Swiffer after spilling a cup of coffee.

Perhaps the true story is that Continuum noticed that people don't use mops to clean up wet spills, so they made something for cleaning dry floors?

<comment><USER3> I think the main takeaway here is that rather than creating a product that needed to elbow its way into an already-crowded market, they solved the problem by creating a new market. Seeing how people really cleaned minor spills and dirt was the inspiration for what is essentially a moist paper towel at the end of a stick.

<comment><USER2> Yes but what I'm saying is that takeaway is probably not true, because the original Swiffer _isn't_ a moist paper towel and is not used for cleaning up minor spills. It just doesn't add up.

You could say it's just an illustrative anecdote, but I think that illustrative anecdotes lose their power when they are fabricated.</comment></comment></comment>


Seven habits of highly fraudulent users - <AUTHOR> http://blog.siftscience.com/seven-habits-of-highly-fraudulent-users/? <comment><USER2> The night owl thing is misinterpreting the data. I am going to guess that the more likely scenario is that at 3am there are simply less total transactions, while fraudulent transactions stay at more or less the same level. Looking at a total volume of fraudulent transactions vs the hour or the day would be more helpful.

Another prediction: "fraudsters work on weekends" would yield the same graph if displayed as a percentage of total transactions.

Edit: [http://en.wikipedia.org/wiki/Lies,_damned_lies,_and_statisti...](http://en.wikipedia.org/wiki/Lies,_damned_lies,_and_statistics)

<comment><USER3> It's also partly due to them tending to be more international, meaning they are more likely to live in a different timezone.

The "outside of business hours" explanation is still a valid explanation but definitely not the whole story. Overall, I'd caution that when building fraud detection models understanding the stories behind the data is extremely important, or you risk having an algorithm that works for the wrong reasons.

For example, if suddenly your user base because more international (for example if you start allowing non-US users to use your website), you'll suddenly have a lot of false positives if you're not cautious because to your system it'll look like they're "operating outside of business hours".

<comment><USER4> It's also only a good signal as long as you aren't actioning on it.

As soon as it becomes advantageous enough to fit in with the normal user patterns, the attackers will modify their behavior accordingly.

The time-of-day, internationality, and many other signals mentioned in this post are easily evaded when it becomes profitable to do so.

</comment></comment></comment><comment><USER5> I love these. Building fraud detection systems is so funny because the signals themselves end up usually being really simple, it's just a matter of:

a) Having the tools to look at all your data to see where the patterns are

b) Having the tools to track instances of patterns once you've identified them.

But as I said, the patterns themselves are usually pretty simple, as you see in this article.

This one is a bit specific to Justworks since we use bank account numbers instead of credit card numbers, but one we've picked up is the source of the bank account is a great signal. If a company has bank accounts exclusively from certain banks then they are almost certainly fraudulent. We've even seen people try to sign up with consecutive bank account numbers from the same banks!

<comment><USER6> This goes for other industries as well.

For example every insurance claim from any insurance company is run through fraud detection software. Turns out there are some characteristics of a fraudulent insurance claims that have been identified over the years. The software can flag a claim as potentially fraudulent for further human review.

Discover Card's fraud detection worked extremely well in my case. My CC number was stolen and after only two fraudulent transactions (total about $500) it tripped the software to freeze the card. I have no idea how they identified those as fraud so quickly, they didn't seem out of place to my eyes considering my transaction history.

<comment><USER7> Sometimes the pattern only exists in data writ large.

For example, a particular merchant is breached, and then the fraudsters try to run most of the cards stolen in that breach at a few locations.

It could be obvious on your bank's end that a few dozen customers made a charge at Store A and then reported a charge at Store B to be fraudulent, so then they decided to freeze the cards of everyone with the same Store A -> Store B pattern.

<comment><USER6> Great point.

</comment></comment></comment></comment><comment><USER8> _Fraudsters tend to make multiple accounts on their laptop or phone to commit fraud._

Any idea how this can be tracked? Normal cookies, or something more in-depth?

A site I'm working on tracks page visits independently of logged-in user sessions.

I'm wondering if it's worth considering explicitly looking for multiple logged-in users sharing the same page visit session.

There are various tricks - e.g. Flash cookies, Etags etc - that make me feel a bit uneasy, despite how much I like the idea of tracking multiple accounts per device.

<comment><USER9> a relatively privacy friendly way is to compare accounts to ip addresses. You obviously expect there to be some nat-ing going on but it should be relatively constant over time. That is, if in your entire network you've seen, say, 10 accounts from a given ip and all of a sudden 5 accounts interact with a given shop, it's probably fraudulent.

You can monitor characteristics the browser reports, including user agent strings.

You can use techniques like differences in rendering of canvas drawings to images to fingerprint browsers. In fact, I'd bet good money this is a _great_ signal: what you're trying to do is not fingerprint, but detect when the reported user-agent has been overridden. Few people override user-agents.

Then you can go on to ways to bury identifiers in browsers. For example, etags on cached objects may be ok if you aren't using it for advertising and clear it in your privacy guidelines.

You can also fingerprint with time deltas, though this may be patented. Briefly: computers synchronize to milliseconds, I think. If you are careful, you can probably detect sub-millisecond clock skew between a client and your server. This should not be constant across devices.

etc etc etc

<comment><USER10> ...And then you start flagging businesses, ISPs, even entire countries as fraudulent.

The number of NATs there are make that sort of correlation... difficult.

For that matter, there are people that use UA "spoofing" for non-nefarious purposes. Me, for one.

<comment><USER11> Speaking as someone who's spent a lot of time in China... flagging entire countries as fraudulent isn't the end of some ridiculous slippery slope -- it's a thriving practice today. I have to hide my IP address to interact with the internet in almost any interesting way.

<comment><USER9> yeah, for a while I blackholed china and india with ipfw. Hacking attempts against my server fell like a rock. I felt a tiny bit bad, but if these countries / isps can't police their subscribers, what do they expect.

Eventually I got rid of wordpress/php and just use nginx to serve static files so I felt secure enough to drop the firewall rules.

</comment></comment></comment></comment></comment><comment><USER12> This was a great read. You know what fraudsters search for ? Vulnerable PHP web sites and sites with anonymous logins. Its kind of amazing. I would imagine that if you could take all of these signals and geo-track them back to the originating IP you would be able to illuminate fraud tolerant ISPs[1], and fraud schemes and targets. Sure its a big data problem but it seems imminently tractable if local vendors provide fraud detection data to central source.

[1] You could notify ISPs of their hosting fraudlent traffic and if they continue to host it ...

<comment><USER13> Getting consumer ISPs to respond to obvious abuse cases (DDOS attacks) is very difficult. Getting them to respond to fraud (which they'd have to investigate more then looking at a bandwidth graph) seems impossible.

Now throw a language barrier on top, and it's even more difficult.

Hell, getting accurate abuse contact information is a project all by itself.

</comment></comment><comment><USER14> So Microsoft domains account for the highest amount of fraud?

Maybe a third-party should seize hotmail and outlook.com in order to clean it up for them...

<comment><USER15> Those domains are more popular in countries where fraud is higher.

<comment><USER16> The OP was referring to how Microsoft seized domains from another company under the guise of security.

</comment></comment></comment><comment><USER17> The Four Habits of Highly Silicon-Valley Startups.

1\. Put something that doesn't belong there _in the cloud_.

2\. Make _undue generalizations_ about its applicability to third party businesses of which you have limited understanding.

3\. _Fake growth_ by dubious means, such as ramping up 'customers' (even if none of them actually use your service on an ongoing basis), hiring extensively, and waylaying all business processes to cater toward visible progress at investment rounds.

4\. Spend almost as much on _marketing_ as development.

</comment><comment><USER18> >Habit #2: Fraudsters Are Night Owls

Are they using local time? Or is there a chance that they are not accounting for the fact that most of the fraudsters are foreign and in a different time zone?

<comment><USER5> I believe they mean the SiftSciences customer's time, not the hacker's time. They are proposing that fraudsters tend to hit in the middle of the night based on where the target is hosted, not where they are.

<comment><USER19> If the targets were US-based, this could fit with the "fraudsters are international" finding.

</comment></comment></comment><comment><USER20> > outlook

> Some of the most fraudulent email domains are operated by Microsoft. Why > could this be? Two possible reasons are that 1) Microsoft has been around > for a lot longer and 2) email addresses were easier to create back in the > day. Today, websites use challenge responses such as image verification or > two-factor authentication to verify your legitimate identity.

But outlook.com is the most recent Microsoft web mail domain. Why is it already much more used than other Microsoft web mail domains (hotmail, live, etc.) ?

<comment><USER21> Go to hotmail.com and look at the login portal.

<comment><USER22> So what? The mail server name has practically nothing to do with the email address. The address is still @hotmail.com.

He makes a valid point: why did @outlook.com addresses suddenly become used for scamming?

<comment><USER23> Here's a possibility:

\- - - - @outlook.com is a relatively new email domain (< 2 years)

\- - - - Most people buying online are over age 18

\- - - - Most people do not change their email address

\- - - - Most people over the age of 18 have had their email address longer than two years

So, by that logic, if someone has a @outlook.com email address, there are a few possibilities:

\- - - - They had an old email address, but switched/forwarded it to @outlook.com sometime in the last 2 years (unlikely - generally people don't suddenly change their email)

\- - - - They made an @outlook.com address for ecommerce signups (unlikely - why not use your current provider e.g. Gmail?)

\- - - - This is their first email account (unlikely)

\- - - - They registered it to commit fraud (hmmmm)

Obviously this is all speculation and there are exceptions to all those assumptions, but it seems logical that the last option is more likely than the others, especially shen weighted by the fact that fraudsters almost always create more than one email account.

</comment></comment></comment></comment><comment><USER24> Pretty interesting insights. Though in Habit #6: "Fraudsters Are Really Boring" : the digits in email addresses appear pretty obvious (non-fraudster) to me. We need to remember that there are 600 million + email accounts registered with Gmail for example and it is really difficult to increase your chance of creating new email ID without using any digit(s) while registering your email address.

I myself use email address with 2 digits and I have so many of my friends using 4 digits or so. I personally don't think having more digits in your email ID is directly proportional to being more fraudulent.

<comment><USER25> I would say that while there can be legitimate email addresses with multiple digits, and fraudulent email addresses with no digits, neither of these facts precludes the possibility of a correlation.

<comment><USER24> that's exactly my point. Looking at this habit of "email address with multiple digits" alone seems correlation rather than causation. Making an anti-fraud algorithm by including all or most of these habits might point to causation and help solve the problem though.

</comment></comment></comment><comment><USER26> Is it just me, or did they really just fit a quintic curve to theirs "Fraudsters are Sneaky" plot? There had better be a good reason for their using such a high-dimensional polynomial.

<comment><USER27> It may be a non parametric estimate. My guess is that they used loess ([https://en.wikipedia.org/wiki/Local_regression](https://en.wikipedia.org/wiki/Local_regression)).

</comment></comment><comment><USER28> I've built a system like this recently and most of these are supported by the analysis I made. Even so, there are _many_ more signals possible than the ones listed here and only in the aggregate can you use any of this, a single signal is never strong enough to distinguish between fraud and friend.

False positives will always happen, no matter how many signals you throw into the mix, there will always be exceptions. Even so the difference between running with a system like this and being wide open is like day and night.

</comment><comment><USER29> Fascinating. I can't get over why Fraudsters Go Hungry. Rampant speculation: they're used to eating in front of a computer screen, they're doing what they love so no reason to do anything differently during lunch hour, they're shut- ins and socially inept. International nerds, male, unmarried, above average IQ but didn't get into the top Indian/Russian/Chinese universities so making a living and finding meaning hacking into America.

<comment><USER30> The "mechanical turk" style fraudster setups probably rely more on getting desperate, unemployed people to work in regions so scarcely regulated that lunch breaks aren't even expected.

</comment></comment><comment><USER31> These articles always seem to imply that you can use those traits for detection. Can you? I mean, the numbers and wording imply that you can, but some of the stats are not very clear or intuitive.

For example, just because group X usually doesn't eat lunch doesn't mean that not eating lunch is a good trait to detect them in the general population.

Also, 6% of outlook.com is used for fraud? This is a huge percentage.

How does this company detect multiple accounts on the device?

<comment><USER32> Only only 'you can', it is being done by thousands of companies across the world every second. (not these properties directly, just building a statistical model of fraudulent users and comparing transactions to that model to flag potentially fraudulent transactions - in wire transfers, online purchases, credit card use, ...)

</comment></comment><comment><USER33> Outlook is seriously broken! 10 minutes after creating an account, my spam mailbox had already 20 messages. I don't believe that spammers are mailing every possible combination of a username; there must be some leak or other way.

Also it seems that Microsoft gave up on verifying whether your message is spam or not. I had government emails (USPS, for example) as well as emails from my gmail and yahoo friends landing straight in junk.

</comment><comment><USER34> I doubt how much the data can used as an overall generalization. They should analyse the pattern and go little more deeper.

And what is exact meaning of fraudulent user here ?

</comment><comment><USER35> This is interesting and well-informed, but it's important to remember that fraud is an adversarial problem. The bad guys will change their behavior to evade detection. The habits described here may exist when there is no defense in place, but if you use them to detect fraud, you'll likely see shifts in behavior to appear more "normal" and evade detection.

</comment><comment><USER36> Seems they should be keeping these signals secret.

<comment><USER37> These traits aren't unknown to anyone who is processing credit card transactions and keeping an eye out for fraud. It's pretty clear that they don't consider them trade secrets either, or they wouldn't be sharing.

</comment></comment><comment><USER38> LOL, I am hitting most of these for completely different reasons and never attempted nor plan to attempt a fraud. I guess another overreaching application of statistics (it must be because confidence intervals say so and our prediction model agrees!). It resembles to me the saying that all murderers eat bread, so bread is dangerous!!!

I really hate oversimplifications in these serious matters.

It happened to me that my bank was using a similar silly algorithm to consistently block my credit card during my world travel every time I arrived to a new country/airport, even if I told them about it in advance. A way to lose customer for life for sure, especially when their emergency line operates only during working days between 9am-6pm in Germany...

<comment><USER30> The article clearly says that these factors are not to be taken individually, but in addition to hundreds or thousands of others.

</comment></comment><comment><USER39> I'm pretty impressed with how the header and side bar operate on this site. Enlarge/zoom the page and the sidebar becomes the header. I'd like to know how this is achieved.

<comment><USER25> The website has a responsive design [0], which adapts to the available viewport. It looks like this one was implemented with Bootstrap [1].

[0]: [http://en.wikipedia.org/wiki/Responsive_web_design](http://en.wikipedia.org/wiki/Responsive_web_design)

[1]: [http://getbootstrap.com/](http://getbootstrap.com/))

<comment><USER40> I want to point out that this commenting style is very good. You provided helpful answers, looked into the original question, and then provided sources. More people should comment like this.

</comment></comment></comment><comment><USER41> It's interesting that gmail is the least likely used for fraud, why is that? Can't anybody create multiple gmail accounts?

VPN traffic would also be an interesting metric.

<comment><USER42> IIRC you have to do text message validation. If not I believe the amount of messages you can send are under 50. However these things change over time, and I believe at one point (maybe now) you couldn't make a gmail account without text verification.

Feel free to correct me if my memory is wrong because it very well could be.

<comment><USER43> At one point I was thinking about setting up a tv channel for VLC... you can write a lua script to let VLC extract video urls from a webpage. So I'd use Tor/bitcoin to get hosting somewhere, put up a simple page for that purpose, and use Youtube to host the videos. You need Google accounts though, lots of them (Google would suspend them quickly, after all).

The solution I considered was paying people in Africa to sign up for gmail for me, and I'd pay them per account. I figured I'd only need 50-100 per month, so the low volume might make it possible. They often have smartphones, and amounts that are too low for you to bother with might be a decent payday for them for 5 minutes work.

Now, I know what you're going to say... Youtube detects copyrighted works, won't let you upload them. That part was easy.

Just invert the video color, and flip it upside down. Then the lua script for VLC would de-invert and unflip it. And I could even bring in the audio from another site (VLC allows muxing), since Youtube uses audio signatures more than they do video signatures for that stuff.

I had a prototype going for awhile. Called it "Space Potato Channel". It just played videos others had uploaded (wrote a little backend to schedule movies). If you tuned in 5 minutes late, it'd show the video 5 minutes in, etc. Then I learned about how the NSA was giving tips to law enforcement and doing the parallel reconstruction thing, and I reconsidered my scheme to become a bitcoin millionaire.

Long story short, gmail accounts were never something I thought would be much of a problem.

<comment><USER23> Or you can go to "account brokers" who sell accounts for something like $20/1000\. Reliability of those accounts varies per broker but some I understand to be quite good (never bought any myself).

Hang out on any blackhat SEO forum (or more illegal carding shops, etc. I would imagine) and you'll see plenty of guys peddling this service.

Incidentally, the youtube method you're describing has been automated many times. My first real PHP project was a script that found popular videos on non-youtube sites, downloaded them, watermarked them with my blog URL, and uploaded them to youtube. That resulted in a fair amount of direct traffic.

If you trawl around youtube these days you'll see plenty of watermarked videos that are clearly not original content. But as long as nobody is claiming copyright -- which nobody is doing for cat videos -- Google doesn't give a shit. Honestly, uploading non-original videos to Youtube only helps their numbers.

I think a common misconception is that companies care about fake/"spam" user accounts on their services. But what incentive do they actually have to ban them? In the world of venture capital, user numbers are an incredibly important metric, so as long as they aren't actively diluting the service for other users, companies have an incentive to allow them to propagate and pad their stats.

Take Snapchat for example. Looking at my friend request page, I have dozens of obviously spam accounts asking to be my friends. Is Snapchat including these accounts in their user numbers? Almost definitely. In fact, they probably even count as "active users" because they are "sharing photos" so often!

One has to wonder how many popular services have been built on VC money given to them on the presumption of accurate user statistics, when in reality 20-30% of accounts could be shills. Snapchat, Twitter, Facebook... There are tons of fake users on all of them, and yet these companies make relatively little effort to exclude them from stats (except, of course, when reporting monetization per user).

<comment><USER43> I was going to upload A list movies and tv shows. It was going to be a Syfy channel alternative. Just saying.

</comment></comment></comment></comment></comment><comment><USER44> Ghostery blocks access to the content due to how they're doing a redirect.

I wonder if that's intentional, was one of the seven habits users who block trackers?

</comment><comment><USER45> The drawback to services like this is that they are great at hindsight (Aha! Based on the signals we should have known!) but bad at prediction. Take the example of Doral, FL that they offer; it has 8X higher fraud. But, should you avoid Doral customers? No. Should you avoid people who use forwarding services? No. But if you're scammed, you can look back and say "I should have known!"

<comment><USER9> If a scam works once, it will probably be tried again. Even if you are correct, there is probably value in simply detecting similar scams. Plus, if sift's network is big enough, a given business will be protected against scams that hit other businesses.

</comment></comment><comment><USER46> Argh, that's not how you use an <abbr> element! (in "Fraudsters are really boring")

</comment><comment><USER47> This makes the ridiculous assumption that fraudsters don't use proxies, they do.

</comment><comment><USER48> A while ago I really wanted to build a bot farm, not to do anything particular malicious (farm reddit upvotes and push content to the front page).

Now this post feels like its encouraging me too.

<comment><USER49> > A while ago I really wanted to build a bot farm, not to do anything > particular malicious (farm reddit upvotes and push content to the front > page).

You and I have very different definitions of the word "malicious".

<comment><USER50> Hmmm,I wouldn't say it was malicious as long as there was no legal activity created by it.</comment></comment></comment>


Ask HN: Tips on raising money for Dev Bootcamp - <AUTHOR>

Hi HN,
I'm in a predicament. After many interviews and a lot of waiting and wondering, Dev Bootcamp emailed me and said, "We loved meeting you. You're in." I'm super excited! But now I'm faced with a fast-approaching deadline to generate $20k ($11k for tuition and $3k/mo for living expenses in SF). This is the next phase of my project: raising the funds. I'm ineligible for a school loan, because Dev Bootcamp is a company, not a .edu institution. I'm also ineligible for a private loan because I'm 23 and I have no assets for collateral.
I've turned to raising cash from friends/acquaintances. Parents aren't in the picture. To date, I've raised $9k, which is super, but I'm not even half way there, and I think it was just due to a mixture of beginner's luck and the great amount of enthusiasm and conviction I conveyed during my pitch. I'm still pursuing the fundraising route (and I also began a project on Invested.in here => http://inv.st/27N). The adrenaline and social aspect of raising money and being persuasive is addicting. I feel very entrepreneurial. One year ago, I could never have fathomed having the capacity to raise this sort of money. But my leads are running dry, and I'm not sure what to do next.
I wish there was a sort of YC entity for people who want to get an unofficial education. Dbc isn't a real school, so financial aid and grants, etc. are inapplicable. Maybe there IS such a thing, and I don't know about it. Is there?
Does anyone have any light they can shed on what my next step should be? Also, if you're feeling philanthropic and you'd like my Wells Fargo checking account number, I'm happy to provide that too. ;)
Thank you, all.
Nima
PS: Do you guys think it would be inappropriate to cold email Paul Graham and ask for his financial help? After all, he's always pushing the philosophy that he invests in people, not ideas or plans.
Any wisdom is deeply appreciated. There's nothing I want more than to attend this program. <comment><USER2> I would email Paul Graham; though make it as concise as possible. There is a nice world out there, you just need to go and look for it.

Could you not ask this company to do some sort of negotiation? Surely they can understand your position?</comment>


PyPy 7.3 Released - <AUTHOR> https://morepypy.blogspot.com/2019/12/pypy-730-released.html <comment><USER2> PyPy is a much-faster drop-in replacement for CPython. I wish more people would use it.

<comment><USER3> Does it support cython bindings as well? I thought there were issues but that was awhile back.</comment></comment>


Cloudant (YC S08) Releases In-Database, Distributed Search - <AUTHOR> http://blog.cloudant.com/announcing-cloudant-search/

<comment><USER2> Nice! I really appreciate the tone of Tim's post in that it acknowledges both the strengths and weaknesses of NOSQL in general and of Cloudant Search in particular in an honest manner.

</comment><comment><USER3> How does this compare to the various existing Lucene based search options for CouchDB? The post says the new Cloudant Search "is a way that would not require you to set up a third-party, financially or operationally expensive solution." Adding basic Lucene searches to a CouchDB setup isn't all that hard. What about elasticsearch and solr? Aside from the cost and hosting, are there other differentiaters between Cloudant's Search and these third party options?

<comment><AUTHOR> I already responded to this partly in <http://news.ycombinator.com/item?id=2764736> — We think the integration into a single deployment is in itself a big gain. Maintaining several of those infrastructures can be very painful, especially as your clusters grow large. Also, as mentioned, we've also already added several features on top of Lucene, and we'll be adding more in the future.

<comment><USER3> Yes, thank you. Just after I posted my question here I realized that much of what I was wondering about was also answered in another post on the Cloudant blog: <http://blog.cloudant.com/technical-look-at-cloudant-search/>

</comment></comment></comment><comment><USER4> I have a very noob question. For most databases, suffix search is always super slow. However, can't someone just build an index based on the string reversed, then treat suffix search exactly the same way as prefix search? This doubles your index storage requirement. But index storage is generally not a problem. Finally this could be perhaps extended to cover any wildcard searches (hell*world)

<comment><USER5> The issue there is that you're still anchoring your index to one end of the string which means you're not solving the general problem, only a specific manifestation of it.

A general example would be given the string "foo bar baz", your solution could find "foo%" or "%baz" efficiently, but not "%bar%". Its not out of the question if what you really want is a suffix search, but the general problem of finding an internal substring is still less than optimal.

Edit: Formatting

</comment></comment><comment><USER6> Maybe slightly off-topic here, but are there plans to eventually merge Big Couch upstream into Couch core?

<comment><USER5> Its hard to say. There are quite a few ways in which this could play out.

Firstly, there are two important points to consider. Currently, BigCouch is more or less a superset of Apache CouchDB. The only patches we have to CouchDB sources can and should be back-ported but require that we solve a couple possibilities for bugs in non-clustered deployments. Secondly, Erlang is a language which allows for an easy mish-mashing of code so that once we have back-ported these patches there's no real requirement for a merge at all.

There are also a few things that we're discussing in the CouchDB community that could very well contribute to not needing to merge the projects. Specifically rearranging our source tree to be more prototypically Erlang as well as some tools like a couch-config script that could allow plugin-type extensions to CouchDB.

In the end, its hard to tell how things will shape up. It could be a full on back-port, or it could just be a general improvement to CouchDB's source tree and build system so that BigCouch is strictly "CouchDB + Other Erlang Apps" if that makes sense. And with my CouchDB committer hat on, it really depends on what the community wants. Its easy to fall into think of the trap of "it's obvious" but we also have to consider that others are taking CouchDB and porting it to mobile phones. What we end up with in "core" CouchDB has to consider a lot of use cases.

<comment><USER6> Thanks for this response, and thanks for the great work on both Couch and BigCouch.

</comment></comment></comment><comment><USER7> An "open" alternative could be the CouchDB integration that elasticsearch provides:

[http://www.elasticsearch.org/guide/reference/river/couchdb.h...](http://www.elasticsearch.org/guide/reference/river/couchdb.html)

</comment><comment><USER8> Will this make its way upstream into the open-source BigCouch?

<comment><USER9> For now, this feature will stay a part of the closed-source hosted and licensed products. But remember you can always try it out for free with our Oxygen plan at cloudant.com

</comment></comment><comment><USER10> Wouldn't it be possible to do the same thing with Apache Lucene/Solr?

<comment><AUTHOR> Not entirely. The big difference here is that you only have one, integrated architecture to maintain. So that means less operational complexity, smoother "scalability" of your infrastructure, tighter integration between DB & Search. Also, we added stuff like queries across several indices, typed queries, etc.

<comment><USER10> Hm, as far as I understand multiple-index (core) search has been implemented in Solr 1.3?

<comment><USER11> Sharded search is not new. Solr, elastic-search, and Riak do it as well. The difference here is that we've built the Search on top of the BigCouch map- reduce view model. Views are calculated post commit so there are no data insertion locks. Multiple copies of each shard exist for fault-tolerance. Also, multiple map-reduce analytics passes can be used as input to the search.

</comment></comment></comment></comment><comment><USER12> Come and kick the tires!</comment>


Yikes: Square hack lowers the bar for credit card fraud - <AUTHOR> http://venturebeat.com/2011/08/05/square-hack-credit-card-fraud/

<comment><USER2> FTA: "Square's card reader dongle doesn't use encryption or authentication." Really? That's surprising.</comment>


Ask HN: Possible to re-compress JPEG on the client before upload? - <AUTHOR>

When offering photo file uploading, usually the user will have badly compressed and huge (10+ megapixels) JPEG files from their cameras or phones. On the server side, these files will get re-compressed to something like 800x600px and JPEG quality 7 or 8.
Is it (already) possible to do that re-compression on the client side? So that I would only need to transmit some 100kB (800x600px) and not 3 MB or more. Something like:
(1) With javascript's new FileSystem API ( http://slides.html5rocks.com/#filewriter ) it would be possible to read the photo file's data into client side JS.
(2) Then it would be necessary to re-encode the JPEG data, which is possible, but I counld not find any library for that (yet). Anybody knows such a library?
(3) Last step would be to POST the re-compressed JPEG data to the server side for storage and get a URL to the stored photo file back from the server for inclusion into the client's HTML.
I am looking for some jQuery plugin, other JS library or example web page that does this. Suggestions <comment><USER2> Plupload appears to do that, but I haven't used it myself: <http://www.plupload.com/>

<comment><USER3> Digging through code a bit, it looks like plupload accomplishes the resize by handing off to Flash or Silverlight, so I don't think it would work in a pure JS environment without either of those.

<comment><USER2> Their features matrix claims that it can do JPEG resize in HTML5 in both Firefox 3.5+ and Chrome, but not Safari or Opera, which makes it sound like they have something non-Flash/Silverlight working (otherwise there'd be no Firefox/Chrome/Safari/Opera difference). Haven't dug up where that's implemented, though.

</comment></comment></comment><comment><USER4> From a technical perspective it's definitely possible. I can't remember off hand, but i'm almost certain I came across something that did this before..

A quick google turned up the following:

[http://www.bytestrom.eu/blog/2009/1120a_jpeg_encoder_for_jav...](http://www.bytestrom.eu/blog/2009/1120a_jpeg_encoder_for_javascript)

<https://gist.github.com/1245476>

Hope it helps

<comment><AUTHOR> Thanks. I had seen this encoder before, it has one problem

>> The encoder expects a "CanvasPixelArray" (as returned by the "getImageData" method of a canvas).

I'd like to use raw binary data simply read from the local file system, and run it through an encoder.

</comment></comment><comment><USER5> How about creating an 800x600 2D canvas, load the huge photo to an Image() object, drawImage() to the canvas at 800x600, then upload via toDataURL()?

TBH this seems to me to be more of a StackOverflow question than Ask HN though.

<comment><USER6> "TBH this seems to me to be more of a StackOverflow question than Ask HN though." +1

</comment></comment><comment><USER7> Large images ( > 1 MB or so ) put into a Canvas in Chrome cause Chrome to crash with the frowny face Uh oh. At least it did as of a few months ago, not sure if it's been fixed yet.

</comment><comment><USER8> It should be relatively trivial (mechanical) to implement a JPEG encoder in Javascript compatible with most browsers.

More so if you don't care about IE < 10.

<comment><AUTHOR> Relative to what? Because it looks like nobody has done it yet.

</comment></comment><comment><USER9> You could compile libjpeg with Emscripten.</comment>


US may ban laptops from all flights into or out of the country - <AUTHOR> http://www.reuters.com/article/us-usa-airlines-electronics-idUSKBN18O0KL <comment><USER2> Why aren't scanners heavily reliant upon machine learning? It's not like there'd be any lack of training data.

Millions of bags daily that we can say with a fairly high degree of confidence do not pose a threat. Train the system against enough red team bags, and they'd probably stick out like a sore thumb given the scale of the data.

The system could probably be sensitive enough to know what a normal laptop looks like.

</comment><comment><USER3> soon you will be naked and caged on flights to US >.> Guantanamo air!</comment>


YouTube to end community captions feature and deaf creators aren't happy - <AUTHOR> https://www.theverge.com/2020/7/31/21349401/youtube-community-captions-deaf-creators-accessibility-google <comment><USER2> Ongoing discussion here since last night: [https://news.ycombinator.com/item?id=24004573](https://news.ycombinator.com/item?id=24004573)

</comment><comment><USER3> Bad move as some channels love that their content gets translations into other languages as helps them and they can't afford to pay for that and it's fans/supporters/people learning that create that. That's all going to go.

What they should and hopefully will still do is - allow it to happen still, but give control to the content creator to authorise it and only authorised is public. That way you get the best of it all. Then you would have a way to acknowledge any abuse/spam and get on that instead of liberally tarnishing all community captioners as spammy evil people who should be stopped as that is how they are doing it. Playing the, we're doing this as bad things happen focus and utterly and completely ignoring every positive good aspect of this. A pattern many a company/government uses and still don't make it right. This approach is what I call "Think of the children 2.0", same thing in effect, just more meanutiatered and subtle approach and yet still heavy on the blinkers.

</comment><comment><USER4> It looks like it will still be possible, but only through a paid third-party service.

I suppose Google thinks auto-captions are enough to satisfy the ADA. We'll see.

<comment><USER5> They're not. You should see how the auto-captions work for the Scottish guy who does 1Bike1World.

</comment></comment><comment><USER6> Heh - so much for diversity and support of minority communities despite all of Google's virtue signaling around how much they value and support them.

</comment><comment><USER7> I remember reading some Ivy put up a bunch of course material for free and was sued under the ADA so they took it down. This article made me think of that. To what extent are YouTube or content creators responsible for producing accessible material?

</comment><comment><USER8> Youtube seems to be being run by idiots? All their decisions I have been seeing over the last ~year all ___appear_ __to me to be idiotic. But I dont know their business - anyone care to elucidate?

<comment><USER9> YouTube crushed their competition years ago. Of course the product is going to shit- there is no motivation to improve.

<comment><USER10> I get the no improvement part, but why _make it worse_ by removing stable, useful features? How much maintenance does it need? What are they gaining from this?

<comment><USER11> From the YouTube help page

"This feature was rarely used and had problems with spam/abuse so we're removing them to focus on other creator tools. You can still use your own captions, automatic captions, and third-party tools and services."

That seems fair enough to me. Creators can still add captions, it's just viewers that can't add them without a 3rd party service.</comment></comment></comment></comment>


Google Music natively on Linux - <AUTHOR> http://packetfire.org/content/google-music-all-access-natively-linux

<comment><USER2> I'm the author of the unofficial client library OP referenced. It's great to see folks building such awesome things on it =)

Shameless plug: gmusicapi has plenty of contributor-friendly work for all skill levels. If you're interested, shoot me an email or feel free to dive right into some issues.

[https://github.com/simon-weber/Unofficial-Google-Music- API](https://github.com/simon-weber/Unofficial-Google-Music-API)

</comment><comment><USER3> Great post. I may check this out, although I usually need more flexibility than just playing radio.

It is pretty sad to me that in 2014, my Sandy Bridge Core i7 machine with 16GB RAM occasionally stutters while playing Google Music in Chrome.

<comment><USER4> That would give me pause considering I run it without issue on a much slower Mac and have in fact run it on 5-year-old PCs without that issue.

<comment><AUTHOR> When you're pushing triple digits of open tabs, it can definitely become an issue. Plus the web interface runs on flash and support isn't great for Linux, even chrome's Pepper version has a ton of issues.

edit: Point being that playing an mp3 should never freeze any system built in this millennium, and yet it does. So this is a bit of a workaround to avoid that. Plus with this setup you can enable global media keys/hotkeys and get a lot more control over playing your music.

<comment><USER4> I'm certainly not saying what they have is ideal, so don't take offense on that note. I welcome a native-ish client ala Spotify since I foolishly subscribe to both.

But as someone who keeps their open tabs in the double digits (although pushing it sometimes), I've not encountered much playback issue.

<comment><AUTHOR> I haven't run into any issues on my i5 machine, but on a core2duo machine it was many many times a day I had to kill firefox/plugin-container just in time or I'd have to reboot.

<comment><USER4> To be honest I've only run it in Chrome and it's been pretty happy there on Ubuntu, Windows or OSX.

</comment></comment></comment></comment></comment></comment><comment><USER5> If you were to go down the mopidy route instead, you could use the mopidy- gmusic extension and not bother with GMusic Proxy or those extra scripts. [http://docs.mopidy.com/en/develop/ext/external/#mopidy- gmusi...](http://docs.mopidy.com/en/develop/ext/external/#mopidy-gmusic)

<comment><USER6> Could you? It seems to me that mopidy-gmusic does not have All Access support. That's according to this issue: [https://github.com/hechtus/mopidy- gmusic/issues/5](https://github.com/hechtus/mopidy-gmusic/issues/5)

<comment><USER7> It does have all access support now but I can't get it to work at all for me.

</comment></comment></comment><comment><USER8> This looks brilliant, thank you for such a comprehensive guide. I look forward to trying this out tonight at home.

</comment><comment><USER9> For anyone interested in this purely for the hotkeys/media keys functionality that a desktop client provides, you should check out this chrome extension - [https://chrome.google.com/webstore/detail/swayfm-unified- mus...](https://chrome.google.com/webstore/detail/swayfm-unified-music- medi/icckhjgjjompfgoiidainoapgjepncej) I've only tried it on my dell latitude with media keys, but it works great.

</comment><comment><USER10> can someone explain to me how google can hold deduplicated files of copyrighted works and give access with only an assumption that the user uploading has the right to do so?

or is that just "not how it works"?

if it is how it works, what kind of questions can google be asked by copyright holders about those who are uploading?

their lobbying and legal department must be so far ahead of the content owners that it's not even funny.

<comment><USER11> I thought it was similar to iTunes "music match"? They pay a small amount of money to the copyright holders, who accept it on the premise that it's better to get some money for pirated music than none. Also it's a way to make former pirates "legitimate" without asking them to pay huge amounts of money for their collections. The copyright holders hope that they will stay straight after signing up.

<comment><USER12> After I uploaded my music collection to google music I've since bought 50 or so songs on the service. Before that I'd only purchased one CD from a local band in the last decade. So a good solid product at a reasonable price converted me.

<comment><USER13> Are you using all access? I don't buy most music now, since it's on GMAA.. makes me feel guilty, but also happy heh

<comment><USER11> I used All Access for a while but if I really wanted some music, I often went and bought it. That way, even though I don't subscribe anymore, I still have some of the music I really like.

</comment></comment></comment></comment></comment><comment><USER14> Awesome! It would be great to see this on the AUR.</comment>


A Russian Expat Leading the Fight to Protect America - <AUTHOR> http://www.esquire.com/news-politics/a49902/the-russian-emigre-leading-the-fight-to-protect-america/ <comment><USER2> "Falcon had identified not one but two Russian intruders: Cozy Bear, ... and Fancy Bear ..."

I'm not that knowledgeable about current hacking technologies so maybe this is a dumb question, but how can they 'identify' the origin of these spy-/malwares?

Wouldn't a group with equal or more knowledge be able to obfuscate their origin?

I think it's kind of suspicious that Russian state hackers would send the data to a server that's apparently already known to be owned by Russia.

<comment><USER3> Reading a report on one of the groups, I believe they only worked during Russian business hours, took off Russian holidays, etc. I mean, sure, you could do all that from Tahiti, but you couple that with other indicators and it starts to form a clearer picture.

<comment><USER2> That is pretty flimsy, any other examples of those indicators?

<comment><USER3> I was just offering an example of another indicator, not that it was proof of anything by itself.

Some technical indicators: [https://www.crowdstrike.com/blog/bears-midst- intrusion-democ...](https://www.crowdstrike.com/blog/bears-midst-intrusion- democratic-national-committee/)

</comment></comment></comment></comment><comment><USER4> CrowdStrike is very close to the FBI. I would take anything they say with a grain of salt.

<comment><USER5> A headline with the phrase "Leading the Fight to Protect America" encourages skepticism as well.

TFA, Alperovitch, and one supposes the ruling party as well, can't seem to make up their mind about Alperovitch. For a security dude, he seems to make a lot of political judgments. Maybe that's a natural part of the whole attribution "know thy enemy" shtick, but it does undermine the impartiality of his attributions. Then again, maybe they do need some help with diplomacy:

 _Administration officials asked Alperovitch to attend a meeting to consider what to do. He was the only native Russian in the room._

<comment><USER6> If you're to take the article at face value, I find the following interesting.

>"You have to let them save face," he told the group. "escalation will not end well."

Why is it these so called Russian friends always encourage everyone to do nothing, it's always something like "best not to do anything and just let it go".

Seems like that would just encourage more of the same.

Now who knows what was really said and this is just an article that isn't any official report. Its not like the Administration is going to tell Esquire their plans. Never the less if that is what he said I would be hesitant to trust such a person.

<comment><USER7> > escalation will not end well

This seems like a good moment to differentiate what we _want_ to do from what we _can_ do. One reading of this is "just ignore the bully and they won't make things worse", which I agree is silly. But the other reading is "holy shit guys, don't set a norm of publicizing state hacking efforts, _we will not look good_."

Granting the claim that Russia did this, it's worth following up with the possibility that the Equation Group auction was done to embarrass the TAO and the US more broadly. A few people I've seen (including the grugq, who is hardly a partisan) have suggested that it was revealed to threaten escalation if the US keeps pushing to embarrass Russia over hacking.

In which case, the compliance argument may be totally reasonable. It wouldn't be giving in, it'd just be counseling politicians that maybe they don't want to take the moral high ground here.

</comment></comment></comment></comment><comment><USER8> > AND PUTIN'S WORST NIGHTMARE

Yes, we know that the "U.S. No Longer An Actual Democracy" [1] but, can the US MSM at least TRY to make us think that it is? I mean, look at these:

[http://static3.businessinsider.com/image/54dca6ffeab8ea393e4...](http://static3.businessinsider.com/image/54dca6ffeab8ea393e4a3dec-800-/screen%20shot%202015-02-12%20at%208.12.25%20am.png)

[http://gdb.rferl.org/4881AF9E-1328-47C6-B468-559DBCE349DF_w9...](http://gdb.rferl.org/4881AF9E-1328-47C6-B468-559DBCE349DF_w974_n_s.jpg)

[http://gdb.rferl.org/4D8132DF-9979-4338-8545-2FE3A9B7E259_w9...](http://gdb.rferl.org/4D8132DF-9979-4338-8545-2FE3A9B7E259_w974_n_s.jpg)

[http://cdn.spectator.co.uk/content/uploads/2016/10/cover_spe...](http://cdn.spectator.co.uk/content/uploads/2016/10/cover_spec_22-oct_issues-426x570.jpg)

[http://cdn.static- economist.com/sites/default/files/imagecac...](http://cdn.static- economist.com/sites/default/files/imagecache/print-cover-full/print- covers/20161022_cuk400.jpg)

(This is just a small excerpt. Search Google images for _putin cover page_. Just for fun, Google search for _trump cover page_ as well.)

Is this objective, non-partisan, peace-oriented media? Or lying, partisan and warmongering media?

Where are the evidences that Russia or Putin himself are breaking into US servers? No one provides one.

Why is this not a headline news:

James Clapper: Non-state actor likely to blame for massive cyberattack

[http://www.cbsnews.com/news/james-clapper-non-state-actor- li...](http://www.cbsnews.com/news/james-clapper-non-state-actor-likely-to- blame-for-massive-cyberattack/)

Where is Joe Biden to threaten Russia after these revelations by Clapper?

Listen, I want to live in peace and prosperity and not have to die (or be maimed) in some war or to be a refugee or to have to build my home. And, I hope, neither do YOU.

[1] Don't believe me. Believe the son of the US billionaire Herbert Sandler:

[https://wikileaks.org/podesta- emails/emailid/3723#efmAMnANJA...](https://wikileaks.org/podesta- emails/emailid/3723#efmAMnANJANLAN9)

<comment><USER9> One thing I learned from following the US elections for a year is that all those people saying "omg free media is soooooo important in a democracy" turned out to be absolutely right.

The subtlety is that "controlled media" isn't just "state-owned media" (something that the US media loves pointing out about RT for example). If you have a system where incentives are put in place so that the media has an interest in presenting an image of those in power which is the image that those in power would like to present, then the media won't show you an objective picture. In the case of democracies (and here I'm not only talking about the US) these incentives are what's called "access". That is, the idea that if someone in the media wants to call an insider in the government, that guy will take the call. Media companies who don't have this access aren't seen as serious and lose viewers. That is why media in the US (and most democracies) isn't really free (for the most part; there are exceptions): because if they're seen to be very anti-establishment, they won't get any access.

Here's a thought experiment. Imagine that we institute by law a "Chinese wall" [1], of the type that banks already have, between government and media. Prediction: the first time this idea will be proposed, both the government and the media will hysterically oppose this idea. The government because they lose on of the most important forms of control that they have over the media, and the media because they lose their competitive advantage over any well informed youtuber with smart things to say.

[1] [https://en.wikipedia.org/wiki/Chinese_wall](https://en.wikipedia.org/wiki/Chinese_wall)

<comment><USER10> What does compliance with your rule look like? The media only talking to designated spokespeople on recorded video? The media just publishing press releases? How do they investigate things that the government PR doesn't want to discuss?

I have a problem with the way access is traded on, but I think the solution is to convince some media companies to have some backbone (we invited Titus J. Stuffington on tonight, he didn't want to talk about the bribes he took, we decided not to get some damn fool to defend the bribes in his stead), not to ban them from talking to government officials.

<comment><USER9> I hear you, this is the old debate of incentives versus regulation: which one should you use in order to extract the outcome you believe is better. I don't know.

The problem with "convince media companies" to have backbone is one of incentives. Media companies are fighting amongst them, and if the incentives are such that the ones that "have a backbone" will always lose to the ones that don't, then your approach is a non-starter (and I believe this is currently the case because viewers demand that the media company have "access").

So how could you align a media company having a backbone with it winning in the media company competition? Well, for example by targeting a niche audience that hates seeing media companies pandering for the establishment. With that audience, your media company would win. Of course, only small companies target small niches. Then the question becomes: is that audience big enough that the big established media companies notice and want to gun for it?

Then there's an additional complication which is that with your method media companies aren't _really_ calling out poor bad governmental behaviours, but only having the appearance of doing so. That is, they try to appeal to the "no bullshit crowd" by calling out minor pre-negociated points, while still cuddling with the government on the things that really matter.

It's a complicated world.

<comment><USER10> Again, what does compliance with your rule look like? How do journalists do journalism if they can't talk to key players in the stories they investigate?

<comment><USER9> Again, I don't know.

Maybe the answer isn't that they can't talk altogether, but that regulations should be put in place for communications. For example, if a journalist wants to talk to a government official they can do so whenever the government officla say so, but the _full_ content of the conversation has to be made available to all media companies before any one of them can publish anything. The downside with this approach is that it removes the incentive of any one media company to put much resources into investigative journalism that gets it scoops from conversations with the government. The upside with this approach is that it removes the obvious conflict of interests which is that media companies won't trash the government in order to be fed these scoops (and when I say "the government" I'm including the opposition; one's business model is to be fed by the Republicans (Fox) the other's will be to be fed by the Democrats (MSNBC))

</comment></comment></comment></comment></comment></comment><comment><USER5> Is _Esquire_ always like this? "A tall, bald fifty-four-year-old"... "met a striking dark-haired computer geek"... "her friend was short, swarthy, and squint-eyed". "Alperovitch was in New York when"... "on a rare vacation, in Italy"... "while piloting his hand-built Polynesian proa around Cape Horn." Too many inane trivial details!

<comment><USER7> Yes, they're always like that. Grantland and Vice and Vanity Fair are the same.

It's a very specific kind of journalism that's contorting straight-news reporting into human interest column space by focusing on individuals and appearances. I often don't like it, but the alternative for _Esquire_ was running an essay on mixology or something, not a cleaner version of this piece.

</comment></comment><comment><USER11> It looks good but ... how does Falcon allow crowdstrike to monitor a network?

It presumably is an endpoint installed agent with root access, but if the attacker has got there first how do you trust your install. And even if you trust it (maybe they have not subourned the kernel) but even so ... how?

Is it as simple as "we know what code they are using, so we look for that code?"

<comment><USER11> So it seems they have a database of known exploits (their homemade page shows a "sticky-keys" exploit of windows login).

They had come across the Russian malware before - to the extent of decompiling it enough to extract comments or variable names - so they had a pretty good idea of what to look for.

Interesting - I suppose the only way to get good at this game is to start and collect as you go along. Pokemon for IDS</comment></comment>