Cloud Programming Simplified: A Berkeley View on Serverless Computing - <AUTHOR> https://rise.cs.berkeley.edu/blog/a-berkeley-view-on-serverless-computing/ <comment><USER2> It's also great for vendor lock in and rent extraction. At least in its current iterations. I'm fairly certain Amazon isn't going to make it easy to run your "serverless" applications on anything but their infrastructure.

What would be more interesting would be languages and runtimes that run on the next network that is distributed, peer-to-peer, and able to be trusted. And easier to program for than they are today in their current iteration.

 _Edit_ : which is where I thought the BOOM group was going back in 2012 or so.

<comment><USER3> The interface between Lambda and your business logic is usually very thin so in case of simple REST APIs migrating from platform (as long as the target platform has a compatible language runtime) to another or to be executed in a web app framework is rather easy.

Serverless applications' reliance on other proprietary services like Cognito, DynamoDB etc is another thing however...

<comment><USER4> The problem is also that Lambda works really poorly with anything that is NOT Cognito and DynamoDB. For example, we were using some CouchBase we deployed ourselves - however, that meant that the Lambda now had a network interface in a private subnet, and start times skyrocketed, especially for concurrent access. When we also started doing our own authentication with yet another Lambda, request times for cold lambdas (which also means every new concurrent connection, remember) almost doubled.

There's also the fact that most of the code isn't really gone, it's just transformed from web server logic to lambda deployment/configuration logic.

The biggest win all told seems to be security - at least with Lambda you don't need to worry about staying on top of OS updates and the likes. I'm not at all convinced that we gained much of anything else.

Oh, and one thing that's rarely discussed is how much development&qa costs skyrocket when you have a larger team developing a fully serverless application, each with their own setup and running a few performance tests every few months...

<comment><USER5> We use lambdas all of the time with ElasticSearch, Aurora (Mysql), etc.

</comment></comment></comment></comment><comment><USER6> For the paper being introduced, the direct link is: [https://www2.eecs.berkeley.edu/Pubs/TechRpts/2019/EECS-2019-...](https://www2.eecs.berkeley.edu/Pubs/TechRpts/2019/EECS-2019-3.pdf)

I agree with a lot though I think they overegg the possibilities for data performance at the as-a-Function level.

Some more specific reactions:

> _Put precisely, there are three critical distinctions between serverless and > serverful computing ... 3. Paying in proportion to resources used instead of > for resources allocated._

I've taken to calling this "buying capacity vs buying consumption". You need to think about which you need (they touch on this in the fallacies section).

An ambulance is idle almost constantly. When I was a kid they were built on F150s and vapourised ten litres every time you glanced at them. But when I need one I don't care about the idleness and resource costs, I want to come to my aid ASAP. What I _don 't_ want is the paramedics converging from random locations on electric scooters rented on-the-fly.

> _In acritical departure, [AWS Lambda] charged the customer for the time > their code was actually executing, not for the resources reserved to execute > their program. This distinction ensured the cloud provider had "skin in the > game" on autoscaling, and consequently provided incentives to ensure > efficient resource allocation._

I'd say yes and no. Yes, it provides an incentive to the platform provider. But there is a much, much bigger incentive to achieve platform lockin through data services. Keeping the function alive after the first invocation is a subsidy. I would bet folding money that Amazon are tracking this cost and weighing it against their market strategy.

> _By allowing users to bring their own libraries, serverless computing can > support a much broader range of applications thanPaaS services which are > tied closely to particular use cases._

I'm not sure if the authors are familiar with buildpacks, despite citing Heroku. They don't mention buildpacks anywhere.

Disclosure: I work for Pivotal, we do a bunch of stuff in this area, including Buildpacks and Knative. But nothing is forward looking, personal opinion, consult your dr etc etc

</comment><comment><USER7> >We expect serverless computing to become simpler to program securely than serverful computing, benefiting from the high level of programming abstraction and the fine-grained isolation of cloud functions

In my view, that's the really key bit. Securing systems is an endless task, even (or especially) if they are cloud hosted.

<comment><USER8> Right now serverless is definitely not simpler than a monolith. It's "simple" if you squint but any real workloads have you dealing with high concurrency for almost all tasks that a single monolith could handle with a single instance.

<comment><USER9> You are right and I'm glad you're mentioning it, and the general skepticism about serverless; it's not a golden hammer, its applications are limited, and not every problem should be (can be?) solved with a serverless architecture. The same goes for microservices, which is another gold hammer that people picked up and started to apply to a lot of problems - I've seen a few projects where microservices was the initial architecture, while all of those would've been better off with a monolith for the first two years of operation (before any significant load) to figure out the actual problem to be solved.

</comment></comment></comment><comment><USER10> I'm surprised a Berkeley survey would neglect to mention PiCloud, which may be defunct but cloudpickle is still used heavily today (e.g. in Spark). The paper also appears to neglect the issue of code deployment, which can be a major undertaking and hidden cost of any web-based application, especially if the app has particular system dependencies.

There are (private) solutions out there for moving parts of running JVM programs across machines. Wouldn't one expect a forward-looking view of Serverless to encompass serialization and transport of the compute environment?

<comment><USER11> _moving parts of running programs across machines_

Why is this desirable and what is the magnitude of the benefit?

<comment><USER10> One application is fault tolerance. If you need to take a machine down, you can move the node (JVM program) to some other machine. So similar to pausing a long-running Lambda function, moving it elsewhere, and resuming it.

</comment></comment></comment><comment><USER12> Does anyone else not feel so good about a future of computing where everything but the application layer is rented from Jeff Bezos?

<comment><USER13> I agree with you on this, it is a moral dilemna I think about every day. Programming was one of the few professions where the practitioner owned/had access to their tools in their own spare time. Across history and professions this is a rare property, and I fear that we might lose this in the next 10-20 years.

Disclaimer: Views expressed are my own and do not reflect any positions held by my employer.

<comment><USER5> What I have access to with AWS just using their always free tier and their cheap offerings is more than I ever could have dreamed of 5 years ago, let alone as a hobbyist in my bedroom doing 65C02 assembly in the 80s.

</comment></comment></comment><comment><USER14> >[serverless computing] closely parallels past advances in programmer productivity, such as the transition from assembly language to high-level programming languages

Is this serious? The author seems to imply that we can just abstract away the entire internet in the same way we abstracted away copper wires.

<comment><USER15> But we did, didn't we? How is modern serverless different from shared LAMP hostings of the past?

<comment><USER5> Shared lamp hosting didn't give you the security, scalability or isolation that lambda gives you.

<comment><USER15> The implementation was lacking, but the concept is nearly identical.

</comment></comment></comment></comment><comment><USER16> Great paper, I've only gone through about 10% of it, but it offers a lot that the vendor docs and industry talks don't.

Btw, this is David Patterson one of the inventors of RISC fame. Great podcast with him here (mostly about new Tensorflow chip and history): [https://softwareengineeringdaily.com/2018/11/07/computer- arc...](https://softwareengineeringdaily.com/2018/11/07/computer-architecture- with-dave-patterson/)

Worth noting that he's at Google, but it looks like he had AWS reviewers.

</comment><comment><USER17> The paper is a good read for those fairly new to Cloud Computing, even though it was published about 10 years ago!

<comment><USER18> This is not that paper it is a new one on serverless.</comment></comment>


Rust optimizes async/await II: Program analysis - <AUTHOR> https://tmandry.gitlab.io/blog/posts/optimizing-await-2/ <comment><AUTHOR> Hacker news discussion of previous article in this series: [https://news.ycombinator.com/item?id=20738606](https://news.ycombinator.com/item?id=20738606)

Discussion of this article on the rust subreddit: [https://www.reddit.com/r/rust/comments/czn3mx/how_rust_optim...](https://www.reddit.com/r/rust/comments/czn3mx/how_rust_optimizes_asyncawait_ii_program_analysis/)</comment>


Jamie Dimon: Silicon Valley startups are coming to eat Wall Street's lunch - <AUTHOR> http://www.businessinsider.com/jamie-dimon-shareholder-letter-and-silicon-valley-2015-4

<comment><USER2> I dare say, by they time they, "... analyze all of our competitors in excruciating detail — so we can learn what they are doing and develop our own strategies accordingly ..." these startups will collectively have moved the ball downfield even further. So 'strategies' most likely just means 'acquisitions'.

<comment><AUTHOR> I wonder how much wall street is invested in silicon valley. If they're smart I'd say "at least enough to matter". (ie. if we go down, you go down. Let's just work together / be friends...)</comment></comment>


Show HN: Quotekey – Personalize your SSH keys - <AUTHOR> https://github.com/santoshankr/quotekey <comment><USER2> Reminds me of my personalized Bitcoin address: 1HiMoMgBaAikFHgAt3M4YJtetp4HrnsiXu

</comment><comment><USER3> You already can personalize them?

<comment><AUTHOR> I'm not sure what you mean - by personalize here, I'm talking about literally embedding an English readable string into the base64 encoding of the modulus as encoded in the authorized_keys file, not a comment or an option added directly.</comment></comment>


An Oral History of Something Awful - never-the-bride https://motherboard.vice.com/en_us/article/fuck-you-and-die-an-oral-history-of-something-awful <comment><AUTHOR> SA was great during the GWB years. The developer forum had really smart and helpful users. The Photoshop challenges produced work that was significantly better than what floats up to r/all today. The political arguments were vicious _and_ pretty smart. The front page could almost always make me laugh.

Another brilliant monetization not mentioned in the article: you could pay to customize your own user image and title. For twice the price, another user could pay to anonymously choose their own title/image for you, usually to insult. Want to change your appearance back? Pay again.

If you were banned you could pay to re-register and come right back. If you were permabanned you couldn't. A funny pseudo-permaban was that sometimes a user would get put on probation for a ridiculously long time like 9999 hours.

I'd love to find a modern SA: large enough to be always raucous and lively, moderated well enough to keep out really poisonous users. On Reddit the only good subreddits are locked down really tightly and the ones that aren't are full of garbage and full of meh.

<comment><USER2> The SA you describe still exists, and it still has those things you mention.

A lot of people (including SA posters) say it's not as good as it used to be, but that may be the same phenomenon HN users complain about when they say HN used to be better back in the day.

<comment><USER3> SA was the first forum I really got involved in and I posted there for years. When I was there I thought it was the pinnacle of comedy; I'd never been exposed to that brand of humor before it, and I thought it was genius.

When I look at SA today it just seems juvenile and try-hard. Really, painfully unfunny.

I think part of it has to do with the stricter moderation; SA in the early 2000s was 4chan before I knew there was a 4chan, and I appreciated the raucous, sometimes offensive humor.

Moreover though I think you're right, SA is still SA. My ideas about what is funny have changed, but SA is still the same.

<comment><USER4> >When I look at SA today it just seems juvenile and try-hard. Really, painfully unfunny.

this is how trends work. the originators are truly creative and interesting, but over time the paths they forge spread across populations, and inspire increasingly poorly executed knock-offs. eventually it becomes embarrassing for earlier adopters.

</comment></comment></comment></comment><comment><USER5> The SA forums were so amazing from 2000-2004. I spent some of my most formative years posting there (no regrets!). It's pretty crazy to think how many people who were active on SA around then went on do Big Things:

\- CliffyB

\- moot

\- notch

\- deadmau5

\- llamaguy (guessing most people here don't know who he is, but he created a Gamefaqs spinoff called Luelinks/EndOfTheInternet, and was one of the first 100 employees at Facebook and is now a 9-figure millionaire)

\- vilerat (aka Shawn Smith, one of the Americans who died in Benghazi)

\- garry (of garry's mod and rust fame)

\- Yahtzee

Stuff that can trace back to SA around that time:

\- 4chan itself

\- Memes ("image macros")

\- Let's Plays

\- Weird Twitter

\- That shitposting/shittexting ironic writing style that is now beloved by modern middle/upper class American teenagers everywhere

Nearly everyone that I met as a teenager and still keep in contact with is really successful.

Sadly, I think Lowtax is the most incompetent businessperson I've ever encountered. It's frankly amazing how badly he mismanaged the SA forums, and how much he took all of that amazing talent that was creating free content for him for granted.

I think the best example is how he initially offered Yahtzee some insultingly paltry compensation for doing Zero Punctuation. IIRC it was like $100 per episode. Zero Punctuation alone could have kept SA relevant, I think.

The stuff that went down in 2005 and beyond drove all of the best posters away, IMO.

<comment><USER6> Reading about all of those folks makes me feel like I wasted my time in the early 2000's on BBS systems talking about prerelease Windows systems like Neptune.

<comment><USER7> I spent most of the late '90s and early 2000's building fiber networks across the country-side and then helping with the technical aspects of increasing Cable Modem speeds and reliability - I guess I missed most of the important human aspects of the Internet at that time?

</comment></comment></comment><comment><USER8> Keep in mind SA forums hated "memes" unless you were really good at it. That made the forums great because it also involved an element of risk so if someone wasn't sure how good their stuff was they're at risk of getting banned.

A simple example: There use to be a forums poster who posted just screenshots from old NES video games that was always super relevant so he was never banned (usually if you just post a meme with nothing else in the post you'd get banned).

Another one: The whole concept of tricking users into reading a long fictional story that started one way and eventually delved into some other topic altogether. I guess you'd now call it a bait-and-switch (w /an anti-clamatic ending).

That too was started (or at least popularized) on SA. A user named, "Hakan" posted a lot of fictional stories that were pretty good and always had a twist ending. Imitators who tried to copy him but sucked were told, "You're No Hakan." Then that catchphrase became too memeish and was banned from the forums (unless again your comedic timing of the phrase was hilarious).

Edit: Even the meme of, "Read post, then read saw username <username>" meme, seems to have come from Hakan/SA which was a "meme" where you'd read a story, get tricked by it and make a post just to specifically say you were tricked. That got banned pretty quickly as well but it's so common in reddit and other parts of the internet now.

<comment><USER9> It's a shame that nearly all of gamequoter's history is gone.

<comment><USER10> Not sure if this applies to Gamequoter's posts specifically, but for a while there was a site called Waffleimages that was created basically for SA in the same sort of way Imgur was created for Reddit when all the other image hosts sucked. Just about everyone used Waffleimages for a while and when it eventually went away, tons of images went with it.

</comment></comment></comment><comment><USER11> Something Awful really set the stage for a lot of what followed in internet culture. "Let's Play" spawned from it. The template of the modern meme. 4chan's culture was really seeded with a lot of people kicked out of SA, which steered it in an interesting direction.

But it maintained quality via community, and through a simple $10 barrier. Rules were followed because they were simple and mutually agreed with.

I don't think anything like it could happen today.

<comment><USER12> Something Awful certainly spawned a lot of things.

But it's funny, I sort of have the opposite opinion of SA in regards to its content. Once the 10$ barrier was in place I felt it lost a lot of the quality. I understood why it needed to happen, it got too popular for its own good. However, I couldn't help but feel that once it created a barrier to entry a lot of the "aliveness" got sucked right out of it. Slowly.

A really interesting comparison of Reddit and SA takes place in Eve Online, where massive fleets clash on the regular. SA has a huge history there, and tons of political heroes (vilerat! rip) but they ended up sort of being the exclusionary bullies of the Eve universe. TEST/Dreddit (Reddit's corporation) ended up having that easy entry and encouraged a lot of growth from the people other companies in Eve were ignoring - the new player. This resulted in a lot of good fun and chaos. Now there are whole companies devoted to new players (Brave Newbies)

<comment><USER2> >>Once the 10$ barrier was in place I felt it lost a lot of the quality. I understood why it needed to happen, it got too popular for its own good. However, I couldn't help but feel that once it created a barrier to entry a lot of the "aliveness" got sucked right out of it.

Quantity went down, but quality increased.

I mean, that's what barriers to entry are about: they keep out the lowest- common-denominator trolls, while those who actually care about the community have no issues paying the entry fee (sometimes several times, as they get temp-banned).

<comment><USER13> The $10 entry fee and heavy use of bans made the topic subforums the best on the web. While FYAD may have given birth to the shitpost, shitposting is only allowed in the designated shitposting zones.

If you want to talk or read about a massively popular topic: cars, guns, motorcycles, games, money, pets, health, houses, coupons... it's nice to go somewhere that weeds out low quality posting. How ever quality happens to be defined in that particular forum.

</comment></comment></comment></comment><comment><USER14> I have all sorts of conflicted feelings about my time with SA during the Bush years when I was a college student. It was fun, but I think the time I spent there cost me a point or two off my GPA. The people I knew of that went off to the Microsofts, Googles, Apples, and various startups of the world were more focused in their studies and their technical passions and didn't pay too much attention to many of the things that concerned Goons (video games, politics chatter, the ongoing internet popularity contest).

In the end, SA's culture was something I should have put down earlier if I wanted to get ahead. Message boards are not where the 'A' players of the world spend their time. Caring about the fans of your stream is not exactly of the list of 'The Seven Habits of Highly Effective People'

<comment><USER15> I know many successful people (PhDs, government employees, "popular twitter users", SW engineers) who used SA to make weird jokes to get over boredom in college.

The most successful people either became mods or were permabanned. SA admins liked to take their life problems out on the forum by breaking it, a kind of self-harm, and then ban you if you complained.

Also liked to claim anime forum posters were "child molestors" and ban them as a joke, one of the sources behind 4chan's growth.

By the way, all of the least successful people I know identify as "gamers" and keep trying/failing to become pro Twitch streamers instead of applying for jobs.

<comment><USER16> Those guys can be amazing game QAs if they make the leap to trying to make a good game great by trying to find all the weird corner cases that can ruin someone's experience of the game.

As one described it to me, he's trying to protect the reputation of games as a creative medium by pushing back against bad works of the craft.

</comment></comment></comment><comment><USER17> The best times were when the internet was rapidly spreading but old people didn't understand how easy it was to fake thing. So many local news broadcasts punked. A lot of those early dot-com memes and hoaxes got their start on SA. It was way too easy back then and a bit more innocent. Goatse'ing a live on- air broadcast is gross but doesn't undermine democracy.

</comment><comment><USER18> Short 3rd-party addendum on SA's defunct politics subforum "Laissez's Faire", the secret birthplace of many parts of internet leftist political culture.

[https://www.reddit.com/r/ChapoTrapHouse/comments/64oqth/a_sh...](https://www.reddit.com/r/ChapoTrapHouse/comments/64oqth/a_short_history_of_lf_the_original_dirtbag/)

</comment><comment><USER19> There's a strange graduation you end up going through as a mid-term denizen of the internet (i.e late 90s), for me it was SA rather than Slashdot etc, even before Digg, 4chan and Reddit. Lots of high quality threads in the specialised forums like Debate & Discuss, dedicated games threads etc. Very fondly remembered. I do still prefer the threaded format rather than the subtree style of Reddit et al.

</comment><comment><USER10> A big part of Reddit's success has been the ability for any user to create a new subreddit for any topic. And a big part of the SomethingAwful forums' success has been having subforums for a whole lot of different general topics.

I wonder why no-one's made a forum site where anyone can create subforums the way reddit does subreddits (or have they?). There are still major benefits to proper chronological forum-type discussion, but forums for different things are spread in small groups all over the Internet and you have to discover, learn the interface, and sign up for every one separately.

I don't know if you could also make it a paid service like the SA forums in this day and age, but the $10 entry sure kept the site running and kept the spam and some of the idiots out as well (particularly since if you got banned you had to pay another $10 to come back).

<comment><USER5> They have, it's a private gamefaqs spinoff that's slowly dying ever since Megaupload shut down, since all of the site's content was hosted there. There are less than 300 active users at any given time when it used to peak at 10k. I'd be surprised if people are still posting a year from now. I hope the software gets open-sourced by the creator because it's the best forum I've ever used UX wise. I personally stopped using it a year ago.

<comment><USER20> Llamaguy:) already did source the core of it. I don't know if tags were included, but a large majority of it was there, and Tiko was working to replicate the other functionality awhile back too; not sure what happened with it though. He had a prototype where you could have a board up and running and make your own tags, etc. I think livelinks still didn't work at the time.

</comment></comment></comment><comment><USER21> The SA forums had predecessors on Usenet in the form of alt.flame, alt.tasteless and others.

alt.tasteless, in particular, promoted high quality and originality. Using catchphrases and hackneyed meme-like sentences resulted in humiliation.

There was the occasional real gem. It was quite a feat considering the lack of moderation.

Not that I would suggest reading it unless you have a stomach for actual (occasionally extremely) tasteless content.

<comment><USER22> alt.sysadmin.recovery was Slashdots precessor

</comment></comment><comment><USER23> Wow that site feels slugish on a Core i7 + GTX 970 with 16 gigs of RAM.

<comment><USER24> I'm amazed. What browser do you use? Firefox is flying by really well (that too on a Core i3 5th gen + NVIDIA 920m with 8GB RAM).

This sounds nuts.

<comment><USER23> I'm on Ubuntu with Google Chrome.

<comment><USER24> I think it could be some issue with hardware acceleration then? The link is a bit old so I don't know if things are still the same, but I used this long ago.

[http://www.webupd8.org/2014/01/enable-hardware- acceleration-...](http://www.webupd8.org/2014/01/enable-hardware-acceleration- in-chrome.html)

</comment></comment></comment></comment><comment><USER25> SA really had an amazing culture. I ran GBS FM (a 100% user-contributed online radio station for Goons) and some of my best friends to this day (offline and online) come from that project.

<comment><USER5> I remember GBS FM :)

I'm actually really surprised to see this on the front page of HN today. I wonder how many people who actively read/post on HN were also on SA back in the day, or still hang out in Cavern Of Cobol and/or YOSPOS.

<comment><USER26> I'm one of them. I didn't post much, but I was on SA as much as I am currently on HN and this is all a huge blast of nostalgia for me. I just read through the whole 9/11 thread and logged in an explored what's currently going on. Very strange feeling.

</comment></comment></comment><comment><USER27> Kyanka also gave several presentations over the years.

UIUC: [https://www.youtube.com/watch?v=9Gvo1uWAhHc](https://www.youtube.com/watch?v=9Gvo1uWAhHc)

MTU: [https://www.youtube.com/watch?v=ZM4D4wrk6Vs](https://www.youtube.com/watch?v=ZM4D4wrk6Vs)

A lot of the same content as this, he previously defined the tendency for the internet to form niche communities as the "parrot-ass club".

</comment><comment><USER28> Despite Something Awful's notoriety for shitposting as noted in this article, the Let's Play forum (the concept of which was incidentally pioneered by SA) is the highest-quality forum on the internet for video game playthroughs, due in part to the registration paywall, chronological ordering of posts, and _very_ heavy moderation.

I do think the older BBS architecture could still work in the 2017 for new discussion forums (e.g. Discourse), although it likely would not be very appealing to venture capitalists who want to see explosive growth metrics.

</comment><comment><USER29> I read this about a week ago and it is very well done. I've not logged into SA (I only used the forums) in a couple of years at least, glad to see they're still existing.

I still use a torrent site that was a SA spinoff.

<comment><USER30> Spin-off of a spin-off of a spin-off...

Edit:Wow, downvotes for making an oblique reference to the fact the SA offshoot torrent sites have disappeared and reappeared under new names a half dozen times in the last decade.

<comment><USER31> Yeah, I believe Demonoid had its beginnings rooted in SA (or at least some connection,) which was definitely the most popular.

Dreamhost also had beginnings on SA, they used to give steep discounts to SA members.

</comment></comment></comment><comment><USER32> I found out about SA via playing a norwegian real time browser strategy game planetarion. I remember the day AYB was discovered in much the same way I remember 9/11.

</comment><comment><USER33> Is there anything as relevant today as SA used to be back during its golden years? What's the site that gets the closest to that in 2017?

<comment><USER26> Reddit

</comment></comment><comment><USER34> Is this oral history written?

<comment><USER35> Transcribed, thankfully

</comment></comment><comment><USER36> I am surprised nobody mentioned [http://www.tranceaddict.com/forums](http://www.tranceaddict.com/forums)

It was massive! Well still is!

</comment><comment><USER37> Derek Smart Derek Smart Derek Smart?

</comment><comment><USER38> "fuck you and die". My CPU took this literally when it visited the site.

</comment><comment><USER39> I'm not sure it's worth remembering. Being funny wasn't unique to SA. Fark and Random Drivel and a bunch of sites existed with different allowed formats. SA as a 4chan lite was even less interesting. I did meet Kyanka a couple times when I was out and about.</comment>


Buzz Settings Page Goes Live in Gmail, Allows Total Disabling - <AUTHOR> http://lifehacker.com/5474654/

<comment><USER2> Apparently disabling Buzz does not actually delete your suggested/previous followers which, for those of us hit with the opt-in diaster, is clearly the biggest privacy concern. If you go to re-enable Buzz suddenly all that information is restored. So moral of the story seems to be un-follow before you un-Buzz for now. This has been a complete diaster for Google if not for the simple reason it has shown people new ways in which their privacy can be violated by people who almost certainly did not intend any harm. I think it's making a lot of people reconsider how much data they should be giving any one company. I was previously using GMail for both personal and work stuff and I'm seriously reconsidering it. I'll probably move one of them over to another mail provider just to be safe.</comment>


Ask HN: What is a project I can complete in a night? - <AUTHOR>

I have 8 hours to kill, and I can't work on any of my other code. I would like to be somewhat productive and build something. I know there is lots of 'weekend coding projects' but is there anything that you can attempt to build in a night? <comment><USER2> A simple game for smart phones.

Draw a pipe on the screen. First pipe is short and straight. They get longer and have more curves. "Drop" a ball into the pipe. The user tilts their phone clockwise or anti-clockwise to guide the ball through the pipe. That tilting is the only control the user has. Each pipe should be short enough to create the "I nearly did that; just one more go" effect.

</comment><comment><USER3> You could try contributing to some open source projects instead.

[http://up-for-grabs.net/](http://up-for-grabs.net/) has a list of projects with issues/tasks that are easy for new contributors to pick up.

<comment><USER4> That would be such an awesome site if practically everything wasn't on a Microsoft platform. I'd love to contribute towards some Objective-C but everything I see is .NET/F#

</comment></comment><comment><USER5> A Raspberry Pi with motion detection and SMS.

I've built one using an old nokia that supports AT commands.

Pretty fun stuff and no soldering required. Next up I'll try adding a camera and send MMS messages through the mobile phone with photos when motion is detected.

Helpful links:

[http://www.amazon.co.uk/Emgreat-Detecting-Pyroelectric-HC- SR...](http://www.amazon.co.uk/Emgreat-Detecting-Pyroelectric-HC- SR501-Arduino/dp/B00EDHGMEY/)

[http://www.amazon.co.uk/Pyroelectric-Infrared-Motion- Sensor-...](http://www.amazon.co.uk/Pyroelectric-Infrared-Motion-Sensor- Detector/dp/B008AESDSY/)

[http://www.raspberrypi-spy.co.uk/2013/01/cheap-pir- sensors-a...](http://www.raspberrypi-spy.co.uk/2013/01/cheap-pir-sensors-and- the-raspberry-pi-part-1/)

[http://www.adafruit.com/products/189](http://www.adafruit.com/products/189)

[https://www.modmypi.com/blog/raspberry-pi-gpio-sensing- motio...](https://www.modmypi.com/blog/raspberry-pi-gpio-sensing-motion- detection)

[http://raspberrypi.stackexchange.com/questions/13334/how- can...](http://raspberrypi.stackexchange.com/questions/13334/how-can-i-use-my- raspberry-pi-for-motion-detection-and-sms)

</comment><comment><USER6> Something that doesn't involve much user interface.

I have been working an a side project recently. The guts of the code is very simple and done already. Getting all the surrounding framework to serve it up as a web page and do input validation is taking forever (mainly because I only get an hour or two at a time to work on it). Its all the "polish" that takes the time. So something command line based would be easier.

</comment><comment><USER7> URL shortener

Flickr creative commons image search engine

Twitter bot

Quote scraper

Deal alerter for craigslist

IFTTT on a scale relevant to you

<comment><AUTHOR> Twitter Bot sounds good, like that Idea. Really like the idea of automation.

<comment><USER7> They're not allowed and if it's detectable as a bot it'll get shut down.

But they're still fun.

<comment><USER8> Actually they are allowed.

[https://support.twitter.com/articles/76915#](https://support.twitter.com/articles/76915#)

<comment><USER7> Good call.

My bots have always been @reply bots, hence my confusion.

In particular, I was doing stuff like this: "For example, sending automated @replies based on keyword searches is not permitted."

</comment></comment></comment></comment></comment><comment><USER9> If you are interested in mathematics and algorithms, you can solve Project Euler problems projecteuler.net/problems

<comment><AUTHOR> Yeah was thinking of that, there's currently an Algorithms Course on Coursera so might have a look at that.

</comment></comment><comment><USER10> "Yo" app :) It took 8 hours to build it. Then someone invested $1M. I don't get the world.

<comment><USER11> [http://yopeoplefinder.appspot.com](http://yopeoplefinder.appspot.com) took 1 hour to build...

</comment></comment><comment><USER12> I'll second the "find a bug to fix". There are a lot of projects out there that are welcoming to newbies.

</comment><comment><USER13> If you are using emacs, you can try to write some ELisp code to fix something you don't like or automate something you do often.

</comment><comment> clark-kent Try learning and hacking on some new technology you are not familiar with.</comment>


Stories about Maps on the first iPhone and the partnership with Google [video] - <AUTHOR> https://www.youtube.com/watch?v=xImAMe32Itg&feature=youtu.be&t=10426 <comment><AUTHOR> Also here's the part of the interview on Apple's decision to do their own mapping service which started in 2009: [https://youtu.be/ukTAAz5TfnY?t=7854](https://youtu.be/ukTAAz5TfnY?t=7854).</comment>


Frequent Password Changes Is a Bad Security Idea - <AUTHOR> https://www.schneier.com/blog/archives/2016/08/frequent_passwo.html <comment><USER2> For those who work at corporations with password rotation policies, it may actually be a good way to get creative. This guy changed password rotations into a lifehack:

[https://medium.com/the-lighthouse/how-a-password-changed- my-...](https://medium.com/the-lighthouse/how-a-password-changed-my- life-7af5d5f28038#.dlynk50b7)

Previous discussion on it: [https://news.ycombinator.com/item?id=8015470](https://news.ycombinator.com/item?id=8015470)

<comment><USER3> Thanks for the link, I reread it. Nice story but I think I can guess his current password now: "Plus, if you're interested in more of this, I'm writing a book!" :)

</comment></comment><comment><USER4> This reminds me of a story I read about the NHS (National Health Service) here in the UK.

Some edict came through that scans had to be stored and accessed digitally. There were numerous teething problems in accessing the system, so a brain surgeon was going nuts running back and forth across the hospital trying to do his work.

A nurse in another department said he could use their consultant's login with the password 'fuckoff'. He ran back to his own desk, no go. So he went back and they said, "Ah, he has to keep changing the password each week so try fuckoff45" because the system had been set up almost a year prior. It didn't work, but after realizing more time had passed, he tried "fuckoff47" and it did the trick(!) Note that the problem here wasn't just the password but that sharing _entire logins_ was/is rife.

(Update: I've found a reference to the story at [https://www.theguardian.com/books/2014/mar/30/do-no-harm- sto...](https://www.theguardian.com/books/2014/mar/30/do-no-harm-stories- brain-surgery-review-henry-marsh))

(The NHS is full of fun IT-related stories. Another was that due to patient privacy laws, _keys_ to access scans had to be sent under separate transport. So you'd end up with situations where two couriers would be delivering separate USB sticks each to access a single scan.)

</comment><comment><USER5> Does anyone aside from HN type folks listen to these recommendations?

I just had a major banking institution send me a plaintext pw instead of reset token, with a 15 char limit, and a rotation requirement.

<comment><USER6> > Does anyone aside from HN type folks listen to these recommendations?

Probably not. But if you work as a contractor for somebody with non-sensical requirements, at least you have some research that you can link to to support your point.

</comment></comment><comment><USER7> Does anyone actually have data showing that frequent password changes lead to better security?

Because to me requiring frequent password change seems like the ultimate non- technical management blunder: management wants to say they did something to prevent hacks, so they ask IT to require password changes; IT doesn't want to be blamed so they implement it; users comply with the requirements but can't remember their new password (and don't really care about the company's security in the first place), so they come up with something insecure and keep it somewhere even less secure.

<comment><USER8> In most cases at best it's neutral and at worst it creates a pre-scheduled phishing opportunity. Alice gets an email saying, " _Reminder: Your password will expire needs to be updated_ " and she cheerfully complies.

</comment></comment><comment><USER9> At a client's who requires frequent password changes, people simply write out their passwords on post it notes that they stick onto their screens. Some security. (That's a bank, by the way).

<comment><USER10> I'd say that for most people, their physical security is stronger than their digital security.

Obviously sticking it on your screen is a terrible idea, but if it's in a drawer (especially a locker one), it's probably not going to get stolen, especially not in a bank.

</comment></comment><comment><USER11> There is also the matter of cost-benefit analysis of time spent updating passwords. Where I work we have a special code that has to be typed in by logged in members of the team if they want to really delete a transaction, this code is the same for all members of the team. A manager sets this code to expire on a monthly basis because a new code will be good for security, apparently. In reality this means that on the first of each month a team are locked out for an hour or two whilst the new code gets generated and circulated - in email. So there is a misunderstanding on security plus an implementation issue leading to disruption equivalent to the loss of a person's productivity for a day.

A similar scenario of disruption happens if you use lots of devices and need to update a password on several boxes to get working again. There may not be the communication overhead of my special code analogy (which is invariably delayed due to waiting for the manager to get out of meeting), however there is still disruption and time taken out from the task in hand.

As an aside, I like 'ambient' passwords, e.g. the VAT number on the receipt that you got given buying your lunch, the receipt can be kept in the top drawer - safe from the cleaner - and, if it is lost, you can go to the shop again to get another receipt.

</comment><comment><USER12> I suspect that the requirement of (1) changing the password every _n_ days, (2) new password cannot be the same as previous _m_ passwords (usually, m=10) leads to insecure passwords for most.

I've seen people _handle_ such requirements by creating an initial password, say p@$$w0rd and then appending a digit to it. On any subsequent mandatory password change event, they _increment_ the new password from p@$$w0rd0 to p@$$w0rd1.

Not sure if it leads to anything more secure.

Wish more people started to use GPG based password store such as pass [0].

[0] [https://www.passwordstore.org/](https://www.passwordstore.org/)

<comment><USER13> Mentioned in the article.

<comment><USER12> Happened to see that _after_ posting the comment. So it's probably even more common!

</comment></comment></comment><comment><USER14> Not news to anyone in the security scene, especially as a 30-90 password lifetime disincentives people from actually creating a complex password so they'll do stuff like Sp0useName02 that technically meets the complexity requirements, but is horrendously insecure.

</comment><comment><USER8> I've never met anyone in the corporate world that does _not_ suffix a digit to their password that increments with each mandatory password change. Most people start with "foobar"[1] then become "foobar2", "foobar3", etc.

[1]: _Or maybe "Foobar" (because you need a capital letter) or "Foobar!" (because you need a capital letter and a non-alphanumeric letter)._

<comment><USER15> I've never met anyone in the corporate world who can do that; all of the important systems I've seen require the new password to be "different enough" from the old. Appending or changing a couple of digits isn't accepted.

<comment><USER8> Every LDAP password policy I've seen only prevents the previous N passwords (usually 5 or 6), requires some combination of upper case, lower case, and numbers, and possibly some punctuation. I've never seen one that actually compares permutations of your prior passwords to check for a minimum change set.

<comment><USER15> Like I said, that's all I see. I doubt these systems are backed by LDAP, but that's irrelevant.

<comment><USER8> Are the authentication backends in-house, FOSS, or off the shelf products?

<comment><USER15> The backends don't matter. It's the password-changing frontend that has both passwords at change time and makes the call.

This isn't about setting the characteristics of a single password, it's about setting the allowed editing distance between them during a password change.

<comment><USER8> > The backends don't matter. It's the password-changing frontend that has both > passwords at change time and makes the call.

I asked about the backend to see if you know of one that supports more than just the current password. You can assume you have the current one as it's required to confirm your current identity. What you wouldn't have is the plaintext of the prior N passwords (N>1).

A custom backend could save the previous N hashes and either check for exact matches or check permutations against it. I'm just not aware of any off the shelf system that does so.

> This isn't about setting the characteristics of a single password, it's > about setting the allowed editing distance between them during a password > change.

Sure but I meant across more than just one previous password. In the system you describe if I have "FooBar1" and "BazQuz7" as both being acceptable, I can hop between them endlessly.

<comment><USER15> > In the system you describe if I have "FooBar1" and "BazQuz7" as both being > acceptable, I can hop between them endlessly.

Just about all backends test the previous N passwords, so no, you couldn't.

What the system I describe does not prevent is switching between "FooBarX" and "BazQuxY" where X and Y are changing numbers or characters every time you switch back to them. To prevent that you would need a custom backend, sure.

<comment><USER8> > What the system I describe does not prevent is switching between "FooBarX" > and "BazQuxY" where X and Y are changing numbers or characters every time > you switch back to them. To prevent that you would need a custom backend, > sure.

Yes that's what I figured. Thanks!

Thinking about the problem a bit, I came up with two possible solutions[1].

The first is to save N prior hashes and brute force the permutations. The main issue with this is that if the CPU cost of the hashing is non-trivial (which you hope it would be) then this will be prohibitively slow (though still feasible for a small number of permutations).

The second is to store the plaintext of the old passwords encrypted using the current password. That way after verifying the current password you can decrypt the old ones and run the permutation checks against those as well. Updating the password would decrypt/encrypt the old passwords with the new password as the key[2].

[1]: _If anybody else is following this thread and wants to build this, it 's all yours!_

[2]: _Or more likely the new password would be the seed used to derive a key._

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> I also hate to have to mandatory change my password. I am paranoid, never used 2 times the same password for somewhat important account and have a mental trick system to remember my password. When asking for a password change, it's fucking it up. Looking at you Linkedin and Paypal. Thansk for crappy security and annoying password policy.

</comment><comment><USER17> Tell that to Wells Fargo commercial. 12 character max, change every other month.

<comment><USER18> If they nave a maximum pw length, they probably have a significant aecurity issue. Namely, they are likely not storing a hash.

</comment></comment><comment><USER19> I usually deal with this by appending the month and year of the change to a secure password. Broken if the secure password is revealed, but no less secure than no rotation policy.

Where I work, we change passwords every 90 days, but every password other than full disk encryption, login and password manager are auto generated by password manager, so this mechanic is less of a concern.

</comment><comment><USER20> I would guess that phishing works better than password guessing. Not arguing for weak passwords, just thinking big picture.

<comment><USER12> True.

Unless you have the same password across a dozen sites.

</comment></comment><comment><USER21> I have worked at a US DoD "secure facility". You can imagine the requirements they imposed on password length, characters, frequency of changing, uniqueness, etc. Perhaps you can also imagine that nearly everyone kept their current password written on a sticky-note somewhere in their desk.

</comment><comment><USER22> [https://en.wikipedia.org/wiki/Diceware](https://en.wikipedia.org/wiki/Diceware)

</comment><comment><USER23> This is echoed by CESG (part of GCHQ) in their password guidance: [https://www.cesg.gov.uk/guidance/password-guidance- simplifyi...](https://www.cesg.gov.uk/guidance/password-guidance-simplifying- your-approach)

</comment><comment><USER24> I usually just make up a crazy long sentence I'll remember, with no logical order in it. Something funny to me so I'll easily remember it. Throw in some assortment of numbers and symbols. Bam! Works like a charm!

<comment><USER25> Then the sysadmin hits you with a "at least 8 characters, no more than 13, one uppercase, one lowercase, a number, a special character, but not one that can't be encoded in EBCDIC and the password must differ in at least three places from the last 10 you used."

<comment><USER26> No more than three consecutive letters. That's when things get tedious.

<comment><USER14> Entropy? What's that.

</comment></comment></comment></comment><comment><USER27> To prevent people doing this just throw in a string similarity algorithm into your password-change UI.

if similarity(old_password,new_password) > 50% then reject password change...

<comment><USER28> How does that work? Or, rather, if that can work the system has even bigger problems because you must be storing the passwords in plain text instead of salted hashes.

<comment><USER29> It could be done on the client if you get them to enter their old and new passwords.

<comment><USER30> If they are going to have a "new not similar to old" policy, it should probably be done on the server rather than the client, because the client is less trustworthy.

A password change dialog needs to be asking for the old password anyway and then verifying that it is correct to protect against people who step away from logged in sessions having their passwords changed by pranksters or worse.

I doubt "new not similar to old" policies actually accomplish much. If they are implemented securely using standard technology they will only be able to check the proposed new password against the current password. That just means that instead of having a sequence of similar passwords, P1, P2, P3, ..., users will have two such sequences interleaved: P1, Q1, P2, Q2, ..., where all the P's are similar and all the Q's are similar but the P's are not similar to the Q's.

There's probably a way to do a similarity check between two passwords given just hashes of the passwords (for instance, using homomorphic encryption), but that kind of thing is more research level than deploy live level, I believe. If/when that becomes practical, then a no similarity policy could go back as far as you are willing to keep old password hashes around without being any less secure than a no reuse policy going back as far.

</comment></comment></comment></comment><comment><USER31> The point of changing your password is to counteract any hacked passwords, I think.

But WHY ARE YOUR PASSWORDS BEING COMPROMISED?

That's what you need to address.

</comment><comment><USER32> I think password + security tokens is a more common way to go nowadays, when you need to access externally.

</comment><comment><USER33> how about $ echo "password" | md5sum 286755fad04869ca523320acce0dc6a4

$ echo "Password" | md5sum 29f33cab54c2a8858885b95d8fbb7ff1

$ echo "PAssword" | md5sum 20a68cafb28eb68e306be529a29a8a62

$ echo "PASsword" | md5sum 2ed0aec406faee855f7739bc94fa60d0

</comment><comment><USER34> It's a double sword. The true issue with frequent password change is people really don't want to be creative. They ended up either changing one letter, or adding an extra letter. At least do a quick distance check and deny password at 90% similarity.

<comment><USER35> Oh, yeah. They'll never just write it down if you do that.

<comment><USER36> If everyone in the office wrote down their secure password and stored it in a locked desk drawer, that's probably more secure than the entire office using weak passwords.

If nothing else, it means the person has to have physical access and be able to pass off rifling through someones desk after breaking it open.

While this sort of stuff has happened in on-premise pentests, it's certainly not the normal way to attack when it's done for real.</comment></comment></comment>


A little feedback for our project? Thank you - <AUTHOR> http://www.kickstarter.com/projects/1260979319/combiform-the-combinable-game-controllers

<comment><USER2> I like the creativity in the design.

I think that having to snap the controllers together over and over is a little too gimmicky and would either get old fast or would perhaps be a lawsuit waiting to happen (small fingers getting smushed, old people's wrists breaking, etc.).

Do not show those games or the actors in the first video. It was unpolished and I got really confused and thought the controller contained those games, which look like really bad TV games.

I would not buy these controllers unless there were really nice looking games that utilized the features they provide. I could also see my youngest child getting hurt playing with them. You basically need a kickass game to show off what these can do for the game author and it needs to look less dangerous.</comment>


Facebook sued for storing biometric data mined from photographs - <AUTHOR> http://www.cnet.com/news/facebooks-newest-privacy-problem-faceprint-data/ <comment><USER2> I had the strangest interaction with the Messenger app a few months ago.

I was spending time with friends, and I took a few pictures of all of us (didn't send them through either FB or Messenger). A few hours later, messenger popped up a notification telling me something along the lines of "Hey, I see you took pictures today of <friend>. Want to send them to her?"

Made me feel incredibly creeped out that FB would take my photos and (presumably upload and) analyze them even when I hadn't given them to FB.

<comment><USER3> It's called Photo Magic:

"By recognizing your Facebook friends in the photos you take (just like when tagging or sharing photos on Facebook), Messenger can create a group thread for you to share the photos with those friends in just two taps."

[https://newsroom.fb.com/news/2015/12/messenger-adds-new- feat...](https://newsroom.fb.com/news/2015/12/messenger-adds-new-features-for- sharing-during-the-holidays/)

[http://www.theverge.com/2015/11/9/9696760/facebook- messenger...](http://www.theverge.com/2015/11/9/9696760/facebook-messenger- photo-sharing-face-recognition)

You can opt-out by turning off tagging suggestions: [https://www.facebook.com/settings?tab=timeline&section=sugge...](https://www.facebook.com/settings?tab=timeline&section=suggestions&view)

<comment><USER4> That should be opt-in. What a fucked up feature.

Edit: I don't give any of my friends consent to use that feature - yet the would still scan my face. How can this even be legal.

<comment><USER5> Lax data privacy laws in the US (compared to Europe).

Lobby your congressperson to fix it.

<comment><USER6> You don't need to take it to the congress; just stop using the services of a company whose practices you don't agree with. If more people would do this, maybe the company will get the message and change its practices.

<comment><USER7> This information is too valuable to dissuade companies from collecting and using it. You can't do much as an user if everyone is doing it. In many situations you might not even know that you're being tracked, there already technologies that track you in public places.

IMO this is something that should be regulated.

</comment></comment></comment></comment></comment></comment><comment><USER8> Facial recognition is really scary. This was recently demonstrated for Russia's Facebook, VKontakte, when a service appeared that let you look up people on that site by photo. So people started looking up the profiles of random subway passengers, outing sex workers to their families and friends, etc.

<comment><USER9> I really don't like having my picture taken anymore. You don't where it's going to end up.

I also do wonder how much infrastructure would need to be added in a country that already has a lot of video surveillance (like the UK) to implement a "find this person" feature, where you could just feed it a photo and it would go looking at all camera feeds.

<comment><USER10> Getting your picture taken kind of puts you on the defensive, but that probably isn't going away. You have to be able to go outside, go to the bank, go to work, and go to the grocery store. Each of those places are going to have cameras up for their own peace of mind.

The alternative would be to not go out and enjoy life, which is the worse of the two options.

<comment><USER11> There is always niqab.

<comment><USER12> Maybe we are the primitive ones.

<comment><USER13> What?

<comment><USER12> In terms of sociologic development the middle-eastern countries are considered backwards with their stone-age laws, ingrained religion, and treating women like lesser beings, and yet we may soon be wearing 'burka' like clothing to protects our identity. Of course apart from the physical look, there is no connection between the two.

<comment><USER14> There's at least a few options.

[https://cvdazzle.com/](https://cvdazzle.com/)

<comment><USER15> Now this is my type of dystopian future; those are very cool, like something straight out of Bladerunner. Fashion with a function, all that's missing is a clear raincoat.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> "Facebook hoped to get the case thrown out on the grounds that its user agreement states any disputes should be governed solely by California law".

What about those people whose biometric data is being stored but don't have accounts of Facebook?

<comment><USER17> Let me just guess ... probably the people who uploaded that data are liable for it.

</comment></comment><comment><USER18> To be clear: the article claims that Facebook can recognize anyone just by seeing them. They haven't demonstrated this ability.

It's far easier to judge who's in your picture among your 20 closest friends than it is to find that face among all two billion Facebook users.

State of the art recognition systems still have a few orders of magnitude of accuracy improvements to go before they can solve that problem.

See the Iarpa Janus project for some recent government+academic-sponsored work on this front: [http://www.nist.gov/itl/iad/ig/facechallenges.cfm](http://www.nist.gov/itl/iad/ig/facechallenges.cfm) The task is to recognize terrorists in airport surveillance pictures and such.

<comment><USER19> Using only facial recognition cannot identify a person in the world. However, combined with one or two GPS points (photo geotags), you can get pretty damn close.

</comment></comment><comment><USER18> If you don't want your face to be recognized, you can sometimes prevent it from being detected in the first place.

Our research group recently looked into how to hide from Facebook's face detector. If you're uploading photos, adding white bars around the eyes of the subjects in the photo is the best way to prevent Facebook from finding the face. However, if you're out and about in the real world, even scarves and masks aren't enough--facebook sometimes finds these occluded faces too. There aren't very many easy answers. [https://arxiv.org/abs/1602.04504](https://arxiv.org/abs/1602.04504)

<comment><USER15> Years ago, I read about a hat that some Hollywood stars had found useful for fighting paparazzi. Mind you, I don't recall the source, and it my have been tabloid nonsense.

The hat had a circle of IR LEDs (or something of the sort) emitting 360 degrees of invisible-to-the-naked-eye light. Photos of anyone wearing the hat had a similar effect to using a flash in a mirror, the subject was completely washed out by light.

Again, I'm not sure if this was bogus or not, but it seems the demand for such a product is only going to become greater. Hell, I'd buy one.

Does anyone with expertise in this area know if this type of device is technically possible? I'm voting no, otherwise we'd be seeing these devices everywhere, and there would be laws against wearing them.

<comment><USER20> Most cameras have an IR filter so that won't work.

In the past, phone cameras often didn't have an IR filter.

<comment><USER14> Near-red IR is hard to filter without also accidentally making red colors look off, because getting the frequency response perfectly match human eyes is extremely hard. You don't want to detect less, and detecting just a bit more usually won't hurt.

</comment></comment></comment></comment><comment><USER21> Not merely will it store biometric data, if you happen to use their Messenger to share photos, those photos will remain stored on their servers even after you've deleted the associated conversation. Facebook's disregard for privacy and content control for its users is the biggest problem with its platform by far. And with its latest profit reports, it's bound to get worse.

<comment><USER22> Yup, people laughed when photographers started moving off FB to other platforms that had a better perspective towards photo rights.

Won't use FB for a lot of what's already been mentioned in the thread.

</comment></comment><comment><USER23> I think technologists need to help the public understand how if they are going to continue to fully integrate technology in assisting with their lives, they will be moving closer to a "privacy free" future.

The trade-off between having tailored services and "smart" systems is privacy from machine systems.

The technology community pines for futuristic technology like amazing machine personal assistants, forgetting that human personal assistants (see: professional executive secretaries) know basically everything about the person they are assisting.

<comment><USER24> In the case of the human personal assistant the governing terms originate with the person being assisted, and so the data and the ways it can be used remain in control of the owner.

Tech companies are inverting this control, which has very dangerous implications for those they assist.

There are ways to keep control with the user, however these require a level of architecture inversion the consumers haven't fought for yet.

<comment><USER23> _In the case of the human personal assistant the governing terms originate with the person being assisted, and so the data and the ways it can be used remain in control of the owner._

Well, the data and ways it can be used are also in control of the user now, they just all agree to it - even without knowing it in many cases. My question is: how do we talk to consumers to show them the benefits while also informing them of how it works?

 _There are ways to keep control with the user, however these require a level of architecture inversion the consumers haven 't fought for yet._

I'd be curious to know how you see this working - especially in the case of providing a benefit from network effects. The benefit from these systems is using the inputs of other people, and those by definition release control.

Beyond that case, making each user train their own CNN is an impossible consumer demand. The way facebook does it with face tagging and google does it with number/letter recognition, everyone is training the CNN - crowd-sourced neural net training.

<comment><USER24> You seem to be arguing as though the current situation is preferable and consumers just need to be convinced of that.

Firstly, the user is not in control of the contract. They have no realistic means of modification or exerting pressure, nor resisting or requiring changes. Take it or leave it is not control.

Secondly. You are likely aware of the permissions systems being introduced on modern smartphones. This is an interesting step towards inverting the control of the device back towards the user.

Similar steps can be made in other areas. CNN training is certainly a different action to usage, and has different privacy implications, so they should obtain permissions independently.

Note how these systems are not permission forever, but permission for now. Handling this sort of data access is a pain, but it isn't actually hard.

<comment><USER23> _You seem to be arguing as though the current situation is preferable and consumers just need to be convinced of that._

My whole stance is that it's unknown if it's preferable because people don't know what the long term costs are - as no one has told them about it.

Clearly they are gaining value from utilizing these systems or they wouldn't be using them. What isn't understood is if they would still use them if they understood the potential long range privacy implications.

 _Firstly, the user is not in control of the contract. They have no realistic means of modification or exerting pressure, nor resisting or requiring changes. Take it or leave it is not control._

In the case of private services, it most certainly is control. Irrespective of that however, these systems aren't basic services or things that people have a right to, so your control argument is in the wrong context. Facebook et al. are frivolities - not needs.

</comment></comment></comment></comment></comment><comment><USER25> I attended a talk by Stallman last year and he implored anyone who took a picture of him not to post it on Facebook. Now I can see why.

<comment><USER26> Staying off Facebook is not enough. Facebook could easily write a web crawler to find off-site photos of people tagged on Facebook. They could even create shadow accounts to track tagged people who don't have Facebook accounts. Even people _not_ tagged could have shadow accounts seeded from Wikipedia or news photos.

<comment><USER27> Writing web crawlers and astroturfing to get all that data is hard. Facebook would more likely just buy that data straight from the source, since most other tech companies are similarly unscrupulous and happy to sell.

</comment></comment></comment><comment><USER28> Facebook was great when it was a way to connect with close friends and people in your immediate community (ex. university) and see what to happening around you. Now thats it trying to evolve into this platform that targets you so that it can make an insane amount of ad revenue, it has become less and less worth it. Especially in respect to our privacy.

<comment><USER29> I feel that was always the plan and people just didnt see it coming.

<comment><USER30> "They trust me. Dumb fucks." \-- Mark Zuckerberg ([http://www.businessinsider.com/well-these-new-zuckerberg- ims...](http://www.businessinsider.com/well-these-new-zuckerberg-ims-wont- help-facebooks-privacy-problems-2010-5?IR=T))

<comment><USER29> Thank you for posting that, I have never read that before, it does seem to give a glimpse of the problems I see with FB.

</comment></comment></comment></comment><comment><USER31> Maybe photos should carry a "robots.txt"-like permissions tag explicitly banning social networks from using it, and a cryptographic watermark embedded in the picture that is hard to remove, so they are not tempted to delete the tag.Cameras (and apps) should auto-tag files if the user so wishes.

<comment><USER32> [https://en.wikipedia.org/wiki/Analog_hole](https://en.wikipedia.org/wiki/Analog_hole)

<comment><USER31> I was thinking along the lines of a "Do not track" flag that is to be voluntarily observed by large social networks like, FB. It would be a "Do Not Share" flag.

<comment><USER32> I hear you, but I think enforcing compliance would be impossible not dissimilar to the "Evil bit".

</comment></comment></comment></comment><comment><USER33> Humans have evolved for millions of years on the expectation that other people will recognize our faces. I'm sure we'll come up with a better solution than "file lawsuits to hopefully make computers recognizing our faces illegal".

</comment><comment><USER34> To be honest, most of these are surface level traits of an individual. There are deeper traits which go much more personal, and have even been touched on in popular culture in recent times, like in the new James Bond movie (think gait recognition). But even gait, although highly individual, is still touching the surface. I was thinking of 'trimming the bloom filter' to such a degree that we can recognize not only a person on sight, but by cue words, and individual dictionaries alone.

It is no secret that our world is divided by language alone, so then as analysts we can attach certain words to certain behaviors, and this has been proven countless times to expose a person. If I speak English I probably respond in the same way to 'pizza'. Pizza means food, and therefore pizza emotes a pleasure response. But 'bomb' and other words must decide a different response then?

Marketers have copped this early on and frequently use talismanic phrases to elicit positive responses to products, so why not Facebook, and any other tech harvester of data such as Google, et al? Last time I checked it is not a crime to elicit responses using personal, and individualized key-phrases.

<comment><USER35> Which reminds me of the researcher at Berlin's Humboldt University who ended up in jail because he was the only one at the time who used the word 'gentrification'.

Him, and this left-wing group setting cars on fire.

<comment><USER30> I think you mean Andrej Holm: [https://de.wikipedia.org/wiki/Andrej_Holm](https://de.wikipedia.org/wiki/Andrej_Holm) (no article on him in the english Wikipedia, sorry).

</comment></comment></comment><comment><USER36> Stop fighting it, just stop using it.

<comment><USER14> [http://www.makeuseof.com/tag/facebook-shadow-profiles-you- pr...](http://www.makeuseof.com/tag/facebook-shadow-profiles-you-probably- have-one-too-weekly-facebook-tips/)

<comment><USER36> Oops.

</comment></comment></comment><comment><USER37> Photos permission access is too granular on iOS -- they should add a third access state for photos that grants an app permission to "write new photos to photo album, but prevents an app from scraping the photos library" ... Or maybe that should be the behavior of the current permission grant ...

</comment><comment><USER38> Assuming that the concentration and mining of huge personal datasets is inevitable, can we design systems (other than law) that prevent these data to be misused?

</comment><comment><USER29> One of the exact reasons I never used the data mining center known as facebook, creepy. The things You can do with such data is legion.

</comment><comment><USER11> Can you obfuscate your "faceprint" by tagging a few other people as you?

<comment><USER15> You'd have to be pretty vigilant, and it would require others to do the same. There'd have to be an equal, or greater, amount of photos tagged as another person. Who is this other person, anyhow? Where's their account? All data says it's Jill_the_Pill, so she must use pseudo-names. Flag her account for further investigation.

It's best to just stay off of Facebook if you care at all about privacy. At least, that's the underlying message that I get from this, and every other story I read about the site.

<comment><USER13> > It's best to just stay off of Facebook if you care at all about privacy

Anyone who cares about privacy already does not use facebook. It's the fact that facebook still gets your photos/info that is the problem. It's a difficult problem to solve. Simply avoiding facebook sadly does not cut it.</comment></comment></comment>


Ex-CyanogenOS dev: company might push adware to phones. Disable updates - <AUTHOR> https://www.reddit.com/r/programming/comments/5k55vo/the_death_of_cyanogenmod_and_what_it_means_for/dblok7b/ <comment><USER2> tl;dr I think the author in that post means that CyanogenOS is the problematic one. CyanogenMod /should/ be fine.

Although a migration to LineageOS is probably a better option (this is my opinion) at this point given that CM will soon become at best unmaintained.</comment>


Show HN: How to create a simple CMS with restdb.io - <AUTHOR> https://www.sitepoint.com/how-to-get-started-with-restdb-io-and-create-a-simple-cms/ <comment><USER2> Please don't use the "Show HN" category for these kinds of articles. "Show HN is a way to share something that you've made on Hacker News." ([https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)).

And I you've been told multiple times by other users before

[https://news.ycombinator.com/item?id=12000531](https://news.ycombinator.com/item?id=12000531), [https://news.ycombinator.com/item?id=12093243](https://news.ycombinator.com/item?id=12093243), [https://news.ycombinator.com/item?id=12452278](https://news.ycombinator.com/item?id=12452278)</comment>


How much do hackers at the CIA/NSA/FBI make? - <AUTHOR> These guys seem to be pretty good hackers. Anyone know how much they make?  Or is that classified?  If so, anybody have any idea? <comment><USER2> For the NSA, they list salary ranges on the job postings.

Examples:

       Cryptographic Vuln. Analyst - Entry: $68,586 - $85,464
       Cryptographic Vuln. Analyst - Mid-Level: $79,334 - $105,663
       Computer Network Analyst  - Entry/Mid: Same
       Systems Vulnerability Analyst - Entry/Mid: Same
       Capabilities Development Specialist - Entry/Mid: Same

The range for Senior positions is $94,796 - $145,629

There's also signing bonuses available, and language bonuses if you know foreign languages that are in demand. They also adjust the pay for living in Hawaii, since it's more expensive.

The CIA pays a little better, but it's more expensive to live near there.

<comment><USER3> damn thats terrible

<comment><USER4> It's not a job you go into for the money. They're making like twice the median income for the US, that's more than enough to live comfortably. Frankly, you don't get involved in that line of work without some serious patriotism.

<comment><USER5> Not in the DC area.

<comment><USER4> I live in the DC area and I live very comfortably on a similar salary

<comment><USER6> If you're single 105k in DC is amazing. If you have a family, you will have everything you NEED, but you won't be living by most peoples' definitions of "very comfortably".

</comment></comment></comment></comment></comment></comment><comment><USER7> North of 100k, south of 200k. Assuming some level of seniority or subject matter expertise.

After that, there is a ceiling, so most will work for private firms or consult, making 2x, 3x, or much more.

<comment><USER8> USG employees vs. contractor is an important distinction. Your ranges imply your friends are contractors. See techjuice's post for USG ranges.

<comment><USER9> GS12 w/ DC metro COLA and no engineering band bonus gets just across the line into 6 figures (103K).

Most senior technical folks (not just out of school/military, and not supervisor/team lead level) are going to be GS12-13.

Still, (almost) no one is making 200K as a federal employee.

</comment></comment></comment><comment><USER10> Speaking from personal experience (dating an employee) I can tell you it is not necessarily north of 100K. Most I have spoken with from NSA make less thank 100k and that's with 5+ years at the agency, non-management.

<comment><USER11> Yikes, hope those bennies are pretty sweet.

<comment><USER12> I don't know if they are(if military benefits are any example)... beyond the look you get from a traffic cop after they run your info and reality dawns on them.

<comment><USER13> Can you explain this to the unenlightened? Is employment at a national security organization somehow indicated in the DMV database or whatever it is that cops look you up in?

<comment><USER14> It's not. The only thing you may get is a official / displomatic passport for certain overseas work, otherwise it's not going to matter anymore than flashing a teachers union card.

</comment></comment></comment></comment></comment><comment><USER15> Hopefully the following helps, it is from research I have done comparing the public sector to the private sector pay and compensation over time, specifically comparing intelligence community pay to regular government agency pay and compensation for the independent agencies (FCC, SEC, CIA, CFTC, FTC, GSA, USPS, SSA, etc.) - [https://en.wikipedia.org/wiki/Independent_agencies_of_the_Un...](https://en.wikipedia.org/wiki/Independent_agencies_of_the_United_States_government)

If they are government employees they are normally paid on the regular government GS Pay scale (title 5) - [https://www.opm.gov/policy-data- oversight/pay-leave/salaries...](https://www.opm.gov/policy-data- oversight/pay-leave/salaries-wages/salary-tables/17Tables/html/DCB.aspx) so the really good ones get paid up to $161,900 if they can make it past the GS-14 pay grade.

Though, that is considered generally OK pay for a regular government job that is not extremely high stress, quick turn around and high demand. Though to the private sector's top hackers as many far exceed this as a senior cyber security engineer or CISOs making up to $380,000/year + stock options + other perks. In those cases the government also has Title 10 which limits pay to under the president's salary (section 102 of title 3) $400,000 - [https://www.law.cornell.edu/uscode/text/3/102](https://www.law.cornell.edu/uscode/text/3/102). This allows the federal government secretaries or heads of agency to be able to pay individuals of extraordinary talent and ability the same rate as they may pay a physician or other medical professional if that individuals salary requirements fall outside of the regular GS pay scale and they really want that person on board and want to pay them a competitive salary.

There is also the Senior Executive Service and other equivalents for the many agencies that puts the individual into a senior level(SL), scientific or professional (ST) positions. These positions may come with cash rewards up to $25,000 with approval from OPM/White House, eligibility to be nominated for the Presidential Rank Awards (Distinguished Rank (35% of annual basic pay) or Meritorious rank (20% of annual basic pay) - [https://www.opm.gov/policy-data- oversight/senior-executive-s...](https://www.opm.gov/policy-data- oversight/senior-executive-service/scientific-senior-level-positions/).

Though these positions for hackers would normally be reserved for those with at least 10 to 20+ years in the game with extreme in depth knowledge of the multiple operating systems, hardware and software, SCADA, Satellite, and other embedded/private/public/military communications systems out there. This normally means they are not just specialized in a few things, but have deep knowledge of many systems through practical experience working with them hands on over the years and hacking them to pieces during security audits, product evaluations, quality assurance, security validation and testing through reverse engineering to insure the products do what they say they do, etc.

There are also some agencies that use a pay band system 1 to 5, etc. and normally cap out at around $157,000/year then bump up to around $120,000 to $167,000 for their senior level positions and $120,000 to around $180,000 for their senior executive service compensation.

So in general the best of the best in terms of government employees could be paid up to $400,000/year under title 10 which is more of a government contractor type position that has to be renewed regularly, highly unlikely unless those in top positions see someone they want working for them and really want them badly to work on the inside of government. Normally the title 10 pay is around $160,000-$300,000, so in general the bulk of hackers would fall under the GS pay scale ranging from GS-9 to GS-14 Step 6. Anything higher would have to be negotiated and justified during the hiring process or worked into a promotion for those already working for the government.

<comment><USER16> Just to improve that answer: SES is usually reserved for management. It is designed to produce a general "gov't manager" able to be swapped into any agency and manage people. It is extremely rare for any SES to do research work directly. They usually manage a lab or similar larger organization.

The same goes for GS-14 and higher. Those ranks usually translate to management, or it is expected that they would have some management tasks (like team leader, etc.). Same with bands in that band 5 is usually reserved for managers or exceptional non-managers.

In non-DoD/Intel community, the normal model for IT is having one FTE (GS-13/14) managing a bunch of contractors, or a mix of FTEs doing specialized work (running key systems, networks, "DevOps") and contractors doing customer facing stuff like desktop support, etc. Can't speak for the intel community or DoD, who do their own thing.

<comment><USER9> to add a little bit of extra inside baseball (my experience only, YMMV) -

bands (short for pay bands) in FEDERAL (not contractor) competitive service vs. excepted service are slightly different.

Competitive service works as Band 1-4, followed by SES (senior executive service). With excepted service (which I expect most hacker type folks to be hired under) you don't have SES. You have Band 1-5, with Band 5 roughly = to an SES pay grade. Excepted services essentially means you are hired in for a special skill set, and you don't compete on the normal gov HR point system (which includes vet preference, disability, etc.). Excepted service tends to be used for hiring a specific person. Downside is that without competitive status, excepted service personnel can not move laterally in government.

in both cases, band 1-4 cover the same ground as GS 1-15, but with less stratification.

GS Grades go from 1-15, but each grade has 10 steps. GS 9 (average masters degree education starting point) will run 42K-56K base + whatever COLA (cost of living adjustment) you get for location. For Wash DC area COLA is +24.78%, bumping GS 9 to 53k (step 1)-69K (step 10). Each department/team is a little different, but most places I'm familiar with have a clear career path from GS7-GS13. GS14 and GS15 are more slot based, and generally are management positions.

Bands are tougher to move around in after your initial hire. It works out better for you if you just scrap into the next highest band, it works out worse if you land in the middle or the top of your band. Instead of step or grade based pay bumps, the band system is an "experiment" to incorporate pay for performance. Everyone gets their base pay (determined by band, and then further separated into high, medium, and low), and then there is an extra pool of money at the office level that is distributed by performance reviews. High performers get 1.5%-3% * (base pay + COLA), with low performers getting nothing. Without getting deeper into the weeds, most people can expect to get a ~1%-1.5% "bonus" annually. Theoretically, the bonus system is supposed to make up for the additional stratification of the Grade/Step system, but because of office politics the curve is pretty flat, and the high performers don't really see that much of a pay bump.

 __edited to add this is for FEDERAL employees. Contracting has a whole different set of issues and rules. In general, I 'd recommend going Federal to get experience and a clearance, then transition to contractor status later in your career. Whereas most Fed salaries will top out at 160K-ish, contractor salaries w/ bonus can be much higher (2x-4x). Downside is stability and employment risk, and working for a client rather then being the client.

<comment><USER17> COLA = Locality Pay: [https://www.federalpay.org/gs/locality](https://www.federalpay.org/gs/locality)

</comment></comment></comment></comment><comment><USER18> From the sounds of other posts you're making similar money to what you would at the big 4 (5?).

I think another question to ask is what other reasons would you want to work at these companies? The possibility to learn from other smart people? The opportunity to work on problems you couldn't get elsewhere?

<comment><USER19> After doing a bit of sleuthing on OP's account where did you see any information that would suggest he is working at the big 4/5?

<comment><AUTHOR> I think by "you're" he was referring to a general person working for government hacking agencies, not me.

<comment><USER19> ah! you are right. Thanks for the clarification!

</comment></comment></comment></comment><comment><USER14> Gs scale, +engineering pay band and locality pay(if applicable). The exceptions are military, they're paid at comparable ranks. Most civilians start around GS9, then get fed up and go contractor for better pay.

<comment><USER20> Yes. I worked in the intel space and never knew a SES who wasn't a project manager or had several direct reports. Software staff aren't SES unless they run a group. I'd be surprised if high GS numbers (i.e. 12-14) applied to software staff unless they had 10+ years of experience or direct reports.

<comment><USER14> Some of the ranges I'm seeing here are "best case too" much like "google pays 200k+". It all boils down to negotiation and open billets / funding. SES is extremely rare even in "TAO".

</comment></comment></comment><comment><USER21> Whatever amount they pay you isn't worth it. Private sector pays more, has less bureaucracy, and will help you sleep better at night.

</comment><comment><USER22> I have seen well north of $200k.

<comment><USER19> Where did you "see" this? Any source?

</comment></comment><comment><USER23> Hey everyone ,i have just concluded a deal with a real hacker and i mean real hacker after searching for a while , i am

so exicted thats why i am posting this to inform you guys , i hired him to help me hack my boy friends facebook and he

gave prove before i paid him , he made a complete video of him login into the facebook account as prove ,he said he can

also hack emails , twitter , whatsapp accounts , and phones , i am going to hire him again to hack an email dont hire any

of this fake hackers here just visit [http://www.cyphersecurityteam.ga](http://www.cyphersecurityteam.ga) or email him email@example.com</comment>


Blind recruitment trial to boost gender equality making things worse – study - <AUTHOR> http://www.abc.net.au/news/2017-06-30/bilnd-recruitment-trial-to-improve-gender-equality-failing-study/8664888 <comment><USER2> Other groups have found similar results: [https://blog.interviewing.io/we- built-voice-modulation-to-ma...](https://blog.interviewing.io/we-built-voice- modulation-to-mask-gender-in-technical-interviews-heres-what-happened/) . There seems to be some sexism going on, but it's not against women.

</comment><comment><USER3> Hopefully Google fires whoever was involved here. It's sickening that these researchers would suggest women don't deserve to work in engineering.

<comment><USER3> I can't edit my comment, but I was being sarcastic. Obviously it's unrelated to the Google debacle, except in the sense that it corroborates that author's view.

<comment><USER2> I got the sarcasm and appreciated it :)

I don't think it corroborates the authors viem though. They're seperate if related issues. I agree with the memo but never thought blind interviewing was a bad idea, I thought it would be good and combat some of the more overt racism I've seen.</comment></comment></comment>


William Gibson Wearing Google Glass - <AUTHOR> http://www.flickr.com/photos/1800joe/8665185463/in/photostream

<comment><USER2> I sure hope they arranged that the image he saw was the color of television, tuned to a dead channel.</comment>


A history of the codpiece, the personal protection for Renaissance equipment - <AUTHOR> https://www.newyorker.com/books/page-turner/a-brief-history-of-the-codpiece-the-personal-protection-for-renaissance-equipment <comment><USER2> The author seems not to know what a codpiece is, as if he thinks it's an unneeded extra garment men wore on top to draw attention to their genitals.

Mens' trousers in those days were two separate garments: a left leg and a right leg. It's why we still say "a pair of trousers". You needed a codpiece to cover the gap in the middle, and it would also help hold your trousers up.

Peasants didn't need to bother with all this stuff as they could not afford trousers and would just wear a dirty tunic like a sack.

Then someone invented modern trousers that are one garment and the codpiece was not needed any more.

<comment><USER3> It's amazing to me how different the reality of that era is from depictions of it in entertainment.

For example, I recently read that wars during that time were fought mostly by peasant hordes, and they didn't have the resources to train and equip them, so mostly they all just beat each other to death with wooden clubs or whatever blunt object happened to be available.

Thousands of starving and diseased peasants covered in dirt and potato sacks clubbing each other to death with sticks isn't exactly the story we want to see or read about, though.

We want skillful knights with swords, archers and trebuchets, chainmail and plate helmets, etc. But most of the violence was peasants, and most of the wars were won by peasants.

And somewhat ironically, a lot of the shiny equipment and weaponry we love served its most significant role in allowing the ruling class to subjugate their peasant hordes into fighting those wars for them (knowing that an even worse fate awaits them back at home if they refuse to fight)...

Peasants were then mostly written out of history, one common exception being peasant revolts, presumably because stories of revolt are more sympathetic to the ruling class than stories about peasants winning all of their wars for them...

I'm writing this because I think it's interesting, but also because you seem like you might know whether it's true or not haha. Do you think what I read is mostly true, or is it more theory/fantasy?

<comment><USER4> I would suggest looking in to the origins of the "company" for professionalization of the military in the renaissance. Before that it depends on where you were, but lords were generally responsible for raising and arming vassals for the kingdoms campaigns. The level of equipment and training varies, but there are interesting examples like english yeomanry.

Re peasant revolts these were almost never popular class uprising AFAICT. It looked a lot more like a commoner or minor noble taking on a warlord position against the local rulers. Think of afghanistan or parts of NE africa for equivalants.

</comment></comment></comment><comment><USER5> I keep advocating for the widespread adoption of the Koteka: [https://en.wikipedia.org/wiki/Koteka](https://en.wikipedia.org/wiki/Koteka) ; but the possibilities for personal expression don't seem to catch the enthusiasm of others the same way. Goofy Neckties were a brief fad; whereas these could bring joy to the whole world.

<comment><USER6> I'm a little worried about the guy's scrotum in the pic at that page.

</comment></comment><comment><USER7> Hmm, from this I've learned that Blackadder is historically inaccurate (who'd have guessed?); the first series, set in the late 15th century, features a ridiculously embellished codpiece, but according to the article that's probably a bit too early.

<comment><USER8> I can never forget that one of Baldrick's uncles was a stunt-codpiece:

[https://www.quotes.net/mquote/687873](https://www.quotes.net/mquote/687873)

<comment><USER9> > Blackadder: Did he have a large part?

> Baldrick: Depends who was playing Macbeth.

This sort of made up for the Crew Dragon launch being scrubbed.</comment></comment></comment>


Gogo plane Wi-Fi blocks YouTube (and can read your email) - <AUTHOR> http://money.cnn.com/2015/01/06/technology/security/gogo-wifi/

<comment><USER2> This is misleading to the point where it's not really true. They can't read your email -- or anything else -- unless you click through the _extremely_ dire security warning in your browser. They don't have some sort of CA cert. This is one of the few threat scenarios where HTTPS works exactly as designed.

They're serving a page with a mismatched certificate becaus they want to tell you _why_ YouTube isn't loading instead of simply just blocking it. Bogus HTTPS is at least a feeble attempt to do that

</comment><comment><USER3> The fact they block Youtube isn't anything new, it's how they're doing it that's the news story here. They are tricking your browser into thinking they are Google but it doesn't give any more technical details unfortunately.

On a side note, here's a pro tip: Always buy the full day pass before you're actually in the air. It's $16 on any network but their own, which is almost double that once you're in the air. They also don't give better deals for mobile vs laptops like they used to so this is your best bet for a 'deal' these days.

<comment><USER4> To add to your side note, business AMEX platinum comes with 10 flight segment passes ( _not day passes_ , my bad) as well. Probably a few startups here that already have that card and don't know about it.

<comment><USER5> Personal platinum amex covered by that as well?

<comment><USER6> Personal plat gives you an unlimited Boingo subscription - but it looks like although Gogo is a roaming partner, the subscription is not good on Gogo.

Still a worthwhile benefit if you don't know about it: [https://amex.boingo.com/](https://amex.boingo.com/)

<comment><USER5> Thank you!

</comment></comment></comment></comment></comment><comment><USER7> This story sounded really familiar, so the first thing I looked for in the article was the publication date. It was really hard to find. In small greyed- out print at the bottom, _after_ links to other articles:

 _CNNMoney (New York) January 6, 2015: 1:30 PM ET_

It's poor behavior to make such an important bit of information so hard to find.

<comment><USER8> This is a huge pet peeve of mine. Ideally, technical articles written online would include the versions of software they write about.

When referring to webapps or other software with difficult to find version numbers, a prominent date at the top of the page is a workable substitute.

Things written online can easily outlast what they were written about. Think of your future readers, and provide some context to your writing.</comment></comment>


Ask HN: Why isn't logic programming more popular? - <AUTHOR> It seems like such a powerful paradigm, but it doesn't get nearly the press these days that OO and functional programming have. What could be the reason for this?<p>I wonder if we're due for a young language to rejuvenate Prolog the way Clojure has done for Lisp. <comment><USER2> Here are a few recent takes on it, focusing mostly on the rise and fall of Prolog:

* <http://vanemden.wordpress.com/2010/08/21/who-killed-prolog/> \- Discusses how closely Prolog became tied to the rise and fall of the Japanese Fifth-Generation Computer Systems project

* <http://vanemden.wordpress.com/2010/08/31/the-fatal-choice/> \- Argues that Prolog was wrong-footed by the increased focus in industry on data structures and interfaces, rather than program logic. Prolog proposes a better way of doing program logic, but has little to say about data structures or encapsulation. (The article proposes how that might be fixed, too.)

* <http://synthese.wordpress.com/2010/08/21/prologs-death/> \- Argues that the difficulty of debugging and reasoning about Prolog execution, and its slow execution (especially in the early days), are bigger factors than many Prolog advocates admit.

* <http://www.kmjn.org/notes/prolog_lost_steam.html> \- Argues that Prolog's low-hanging fruit got poached. In the 1970s it was the only real declarative-programming game in town, but over the next few decades a bunch of more specialized declarative languages succeeded in various niches, reducing Prolog's uniqueness and appeal.

</comment><comment><USER3> While logical programming is powerful, it is only useful in certain situations. Due to the way Prolog backtracks to find a final solution, it can be increadibly slow, and it has to be able to 'undo' an operation.

While it is a much different language now, Erlang was originally based on Prolog, and has been adopted, modified and extended to be a much better "realworld" language.

<comment><USER4> It's not that Prolog necessarily backtracks to find the final solution. It's the forward computation that actually builds the solution, backtracking only when one can't be found with assumptions made so far.

Sloppy programming can lead to lots of unnecessary backtracking, of course, but some of the main benefits of Prolog come in using it for problems where you would have otherwise written your own ad-hoc backtracking search process to find a solution. That is, good Prolog code only likely to be slow because of it's backtracking when an imperative solution would have been slower/buggier.

Runtime slowness because Prolog is a dynamically-typed language that also strongly encourages the development of meta-intepreters as a common tactic is a separate issue. Often times a slower run time is acceptable in exchange for a much faster development time with the use of custom metalanguages (DSLs).

Integrated search aside, another benefit of logic programming comes in declarative knowledge representation. In an expression optimizer I wrote, it was easy to concisely define several code substitution patterns as simple logical statements and then create the overall optimizer as an interpreter over those declared patterns.

For problems that don't really revolve around search or knowledge representation (i.e. most CRUD web stuff), Prolog doesn't provide practical benefits. Nonetheless, understanding the otherwise foreign concepts of the language can give you the seeds of new design patterns and idioms for your familiar languages.

</comment></comment><comment><USER5> yes.</comment>