Math Anxiety: Why Hollywood Makes Robots of Alan Turing and Other Geniuses - <AUTHOR> http://bits.blogs.nytimes.com/2014/11/30/how-hollywood-portrays-alan-turing-and-other-math-geniuses/?ref=technology&_r=0

<comment><USER2> _Mr. Turing was a British math prodigy who during World War II broke a supposedly unbreakable Nazi code. He made a programmable machine, which took the information from one task to execute the next, reaching powerful conclusions._

So much wrong there. Polish cryptographers broke Enigma, and built the first "bombe", a key-testing machine. Turing figured out how to speed up the process, at a cost in wiring complexity. Turing never "built a programmable machine", although he conceptualized one. Flowers designed Colossus, which wasn't a general purpose computer, just an electronic key-tester, like a Bitcoin mining ASIC. At Bletchly Park, Turing was part of a team headed by Dilly Knox, working with John Jeffreys and Peter Twinn.

There's a forgotten history of electronic digital non-general-purpose computing devices: Teleregister (stock quotes), International Totalizator (racetracks), and Reservisor (airline reservations). The WWII cryptanalysis machines, and the ENIAC, all belong to that category. Programming of those involved big plugboards, not loading memory with a program. That sort of thing disappeared in the 1970s, as CPUs became cheaper. (It's back, with FPGAs and ASICs used for high-performance special purpose tasks like packet routing.)

The real inventor of the modern computer was John von Neumann, who's never had a movie about him. He's the one who insisted that random access memory, with both code and data in the same memory, was the way to go, and that computers should work in binary. His 1946 paper ([http://www.cs.princeton.edu/courses/archive/fall12/cos375/Bu...](http://www.cs.princeton.edu/courses/archive/fall12/cos375/Burks.pdf)) describes most of basic computer architecture, and will look very familiar to anyone who knows how a simple CPU works. In his spare time, he did some design work on the implosion system for the first atomic bomb, and, using an early computer he designed, the EDSAC, some of the design work for the H-bomb. Also lots of good papers on math and quantum mechanics. Von Neumann was a party guy, known for his dinner parties at the Institute for Advanced Study at Princeton. Married twice, divorced once. Not much angst in his life; he was a cheerful sort and had a good life. Died young, in 1957 at age 53, so he didn't get to see the computer era really take off.

Even less well known is the inventor of modern cryptanalysis, William F. Friedman. Friedman turned cryptanalysis from a guessing game to a number- crunching problem. He headed the effort that broke the Japanese "Purple" code, a tougher job than Enigma. Much of the theory behind cryptanalysis is his work. The auditorium at NSA headquarters is named after him. He was a military officer in WWI, married once. Famous quote: "No new cypher is worth looking at unless it comes from someone who has broken a very hard one." Friedman really did break some major cyphers on his own.

Neither von Neumann nor Friedman had unusual personal lives, so they don't have movies. Both were probably smarter than Turing.

<comment><USER3> > The auditorium at NSA headquarters is named after him

it is named after both william and elizabeth friedman, both of whom were professional cryptographers who worked for the US government.

</comment></comment><comment><USER4> The movie was lazy. They employed the same old brilliant "a ha" moment of insight at the bar they have done in so many others. Run to the office! Eureka! Bollocks.

They can't seem to imagine a world where its hard work that actually pays off.

<comment><USER5> Maybe they can imagine - writing movies is also hard work, believe it or not. But they also know that sitting at a desk and calculating for years is not very entertaining to look at.

</comment></comment><comment><USER6> I don't care that I'm beating a dead horse here - if you haven't read Andrew Hodges' excellent biography of Alan Turing, you should put it on your holiday reading list. Link: [http://www.amazon.com/Alan-Turing-Enigma-Inspired- Imitation/...](http://www.amazon.com/Alan-Turing-Enigma-Inspired- Imitation/dp/069116472X/ref=tmm_pap_title_0?ie=UTF8&qid=1417457678&sr=8-1)

</comment><comment><USER7> Hollywood is mostly a system of aggregating tropes into stories. The minority sidekick, token minorities, the plucky Southern Women (Steel Magnolias? Really?), the imminint danger down to the second, etc. There is a book on movie plot writing called, "Save The Cat" that is the most insightful book I've read on that subject.

The plot of "Avatar" was depressingly cliche; a standard retelling of the standard action movie plot, done once again. The special effects made it worth seeing, twice for me. Rarely does a movie rise above such things.

[http://www.amazon.com/Save-Last-Book-Screenwriting- Youll/dp/...](http://www.amazon.com/Save-Last-Book-Screenwriting- Youll/dp/1932907009)

<comment><USER8> The structure of most stories fall into one of a few categories; in fact Kurt Vonnegut's rejected Master's Thesis was based on cataloging those categories and diagramming their structures. [http://www.openculture.com/2014/02/kurt- vonnegut-masters-the...](http://www.openculture.com/2014/02/kurt-vonnegut- masters-thesis-rejected-by-u-chicago.html)

Really what makes it interesting is in the telling of the story. Did you end up writing Star Wars: A New Hope or another I Love Lucy episode?

<comment><USER9> Then again, that first _Star Wars_ movie is mostly taken from Kurosawa's _The Hidden Fortress_ ([https://en.wikipedia.org/wiki/The_Hidden_Fortress](https://en.wikipedia.org/wiki/The_Hidden_Fortress)), right down to the personalities of the robots... I gather _The Dam Busters_ and perhaps other films of that sort (none of which I've seen) get a lot of credit for the end.

<comment><USER5> "Mostly taken from..." is really stretching it. Yeah he was inspired by those movies, but to say "mostly taken from" is ignoring all the things which is original about the movie. And Star Wars really was an original movie when it arrived.

If you look at Shakespeare almost all his basic story lines (and many characters) are taken from history or from other plays or stories. That does not mean that Shakespeares plays are "mostly taken from" earlier sources.</comment></comment></comment></comment>


Winklevoss Twins' Bitcoin Exchange - <AUTHOR> https://gemini.com/ <comment><USER2> They have a reassuring security page[0]. It's nice to see they're enforcing good practices, I especially appreciate their "no-link email policy" where they will never send you links in emails, which seems like a great way to head off phishing attempts. I hope they actually present this to users in some way during sign-up though, or it won't be of much help unless a user manually navigates to the security page and reads through most of it.

I'm a little disappointed that they only have level 2[1] HSMs in the cloud, as I would be uncomfortable protecting my hot wallet keys with only tamper evident protections, rather than level 3+ that actually attempt to detect intrusion and delete keys. Bitcoin makes for very quick stealing once you have keys, so reactive defenses against key loss don't help much as you're literally in a race condition with the attacker to empty the wallet (you into a non-compromised one, the attacker into their own). But I would assume they weighed cost/risk and I've never heard of a security compromise of Amazon's HSMs so it was probably a reasonable choice.

edit: I should also applaud their use of PGP and (explicit) respect for responsible disclosure.

[0]: [https://exchange.gemini.com/security](https://exchange.gemini.com/security)

[1]: [https://en.wikipedia.org/wiki/FIPS_140-2#Level_2](https://en.wikipedia.org/wiki/FIPS_140-2#Level_2)

<comment><USER3> I personally know many of the engineers at Gemini and have worked with some of them in the recent past. If I were going to choose a team to build a bitcoin exchange, the people I know at Gemini would be on it. If you're into bitcoin, I think this is the place to put your money.

<comment><USER4> What benefit do they offer over something like Coinbase to a casual Bitcoin observer like me?

<comment><USER5> Looking at Coinbase and Gemini as a user I would probably prefer Gemini marginally because their bullshit about using HSM. They both seem to be hosted in AWS which from my POV is a major fuckup. Gemini and Coinbase are basically running a CTF where if you can find a hypervisor exploit and get lucky you can drain their hot wallet.

<comment><USER6> I saw a presentation at OWASP a couple of weeks ago by Coinbase, where they stated that the BTC are stored on air gapped servers, and that 97% of the Bitcoins never exist on routable servers.

</comment></comment></comment></comment></comment><comment><USER7> It's live! You can see there is some activity starting: [https://cryptowat.ch/gemini](https://cryptowat.ch/gemini)

Also, there was a great post on /r/bitcoinmarkets by the CTO of another exchange, picking apart Gemini's technical setup. Worth a read if you're into modern frontend web development.

[https://www.reddit.com/r/BitcoinMarkets/comments/3nkxh3/gemi...](https://www.reddit.com/r/BitcoinMarkets/comments/3nkxh3/gemini_approved_for_launch/cvp219l)

<comment><USER8> I'm not sure if 'picking apart Gemini's technical setup' is the right way to describe it, I tend to think of 'picking apart' being negative while the comments are entirely positive.

<comment><USER7> I meant it as in he scrutinized it.

</comment></comment></comment><comment><USER9> What is the difference between this exchange and say, Coinbase, that makes it "next generation"? The website is very light on details.

<comment><USER10> Well for a start coinbase is not an exchange

<comment><USER11> Yeah they are. They wern't originally but they launched 'Coinbase Exchange' a while back and now offer both their traditional broker service as well as Exchange services.

</comment></comment></comment><comment><USER12> Interesting (unfortunate?) time to launch this with the malleability attacks going on.

<comment><USER13> Is this a dank meme based on the fall of mtgox or are there actually malleability attacks going on?

<comment><USER14> The Bitcoin network is presently undergoing a malleability attack designed to cause Bitcoin nodes to run out of memory.

[http://motherboard.vice.com/read/i-broke- bitcoin](http://motherboard.vice.com/read/i-broke-bitcoin)

<comment><USER15> Not quite; there are two separate attacks currently ongoing against Bitcoin:

* The malleability attack: a transaction relayer is able to change the hash of the transactions, thus confusing senders or receivers who rely on this hash to check if the transaction has confirmed. This creates a nuisance, but all money arrive where they are supposed to. This attack does not affect memory usage on nodes, and it's an old and well-known issue.

* A transaction spam attack (misleadingly called a "stress test") where a shady group called coinwallet.eu creates a large amount of big transactions. These mostly have appopriate fees so that regular users who want their transactions to confirm in a timely manner has to out-bid the spammer. All the unconfirmed transactions are stored in the memory of nodes, so this severely affects memory usage (currently about 1 GB on some nodes).

<comment><USER16> Why do you say it's misleadingly called a stress test? Regardless of motives it is effectively stressing the bitcoin network AFAIK.

<comment><USER17> "stress testing" and "maliciously stressing" aren't the same, motive is inherent in the word "test"

</comment></comment></comment></comment></comment></comment><comment><USER18> Nifty. I think this is the first BTC operation I've seen where words like "compliance" are used in a serious fashion, and a direct aim at institutional investors is presented. Institutional investors are Very Serious Business, so it should be a fun ride.

I'm still holding out for a BTC ETF. :-)

</comment><comment><USER19> Very slick identity verification process.

Instead of requiring a scan of your driver's license or other identifying document, they ask you for questions about your history. I've seen a similar process used at etrade.

<comment><USER20> It's just a 3rd-party identity verification web service. I've gone through that at a number of sites.

</comment></comment><comment><USER21> > Gemini operates fully in the United States. We work exclusively with > American banks; your dollars are eligible for FDIC insurance and never leave > the country

Is this just for the cash balance with the exchange or the bitcoin balance as well? I can't imagine it does, but it would be a strong selling point if it did. If its not, its pretty misleading as written.

> FDIC insurance covers all types of deposits received at an insured bank, > including deposits in a checking account, negotiable order of withdrawal > (NOW) account, savings account, money market deposit account (MMDA), time > deposit such as a certificate of deposit (CD), or an official item issued by > a bank, such as a cashier's check or money order.

> FDIC insurance covers depositors' accounts at each insured bank, dollar-for- > dollar, including principal and any accrued interest through the date of the > insured bank's closing, up to the insurance limit.The FDIC does not insure > money invested in stocks, bonds, mutual funds, life insurance policies, > annuities or municipal securities, even if these investments are purchased > at an insured bank.

[0] [https://www.fdic.gov/deposit/covered/](https://www.fdic.gov/deposit/covered/)

<comment><USER22> I think it is written fairly. Bitcoins and not dollars, and the rest of those things you listed that are covered by FDIC insurance are denominated in dollars. If someone (not _you_ specifically) cannot understand the difference between dollars and bitcoins, they shouldn't be trading currencies.

<comment><USER21> Well, some people want exposure to bitcoins without necessarily understanding the block chain, recourse or anything really. That's the whole pitch behind everything the Winklevosses do in this domain. That's why they opened a bitcoin exchange traded fund and that's probably their rationale behind this exchange. Saying that "your dollars are eligible for FDIC insurance and never leave the country" makes someone think that their bitcoin balance is FDIC insured. I wasn't sure at first either and stock exchanges very explicitly state that their products are not FDIC insured and may lose value. Maybe the exchange has a similar disclaimer when you buy bitcoins on the exchange but I still think its a bit misleading to have that basically front and center.

Nothing wrong with wanting to invest in bitcoins without fully understanding them.

<comment><USER23> > Well, some people want exposure to bitcoins without necessarily > understanding the block chain, recourse or anything really. That's the whole > pitch behind everything the Winklevosses do in this domain.

Yes and no. They initially wanted to open up the bitcoin market to institutional investors who want exposure without having to change anything in the trading software they use, the accounting structures etc. This meant: provide a bitcoin security that can be traded by wall street typically, such as an ETF on the NYSE or NASDAQ or something to that effect.

Barry Silbert's Second Market (definitely a wall street player) got there first in terms of accounting structures. They created a bitcoin security that anyone can buy and put on the books just like any other security (like some oil or wheat derivatives or whatever). But that was still sort of an old- fashion security that you buy on the phone rather than on an automated exchange. Not something that pension funds, university endowment funds etc can easily get into and scale up, but it opened up the bitcoin market to say small family wealth funds that wanted some exposure to the bitcoin price. Bitcoin is one of those things that is likely to either go to $0 or become 3 orders of magnitude more valuable. So if you believe there's a 10% chance that'll happen, investing $100k has an expected value of $9.9m, of course these are just made up numbers but this is often the rationale for investing even modest amounts of money. Silbert's GBTC (marketed under Grayscale) did fairly well but in wall street terms it's a really tiny fund (iirc about $50m or so).

The 'holy grail' for bitcoin investment right now would probably be an ETF. Basically the above security, but then traded on an exchange, a derivative of bitcoins trading on mainstream exchanges (i.e. exposure to bitcoin's price potential traded on exchanges where anyone can easily and automatically buy in without having to know anything about bitcoin or change accounting/audit practices). The Winklevoss's pitch was always to set up that ETF, which they're still working on, and the fact they just launched a normal exchange tells me they're either 1) building up the orderbooks, building relations with investors and building up liquidity etc a bit for a potential ETF launch later down the line or 2) the ETF is facing major, perhaps insurmountable roadblocks so they're pivoting to something less ambitious which is launch their own exchange. (which generally sucks because 1) there are major established players, like Coinbase, which are true software companies with half a billion dollar valuations, solid engineering teams and a big headstart, and 2) because none of the big players, like an investment fund, will be likely to register for your tiny exchange just to trade some bitcoin. They did get a lot of the legal frameworks right though, so it may be an interesting partner for investors nonetheless.)

As for security... well bitcoins are obviously not FDIC insured, but their security looks really tight, I'd feel very comfortable trading with them. [0][1] They still offer the 'you don't need to know anything about bitcoin or worry about security' pitch, but you still need to register with them rather than just select their security on the NYSE and click 'buy', and that doesn't fly for most big investment funds with strict auditing and accounting practices and automated trading teams. We'll see how it works out.

[0] [https://exchange.gemini.com/security](https://exchange.gemini.com/security) [1] [https://www.reddit.com/r/IAmA/comments/3nu7gj/we_are_cameron...](https://www.reddit.com/r/IAmA/comments/3nu7gj/we_are_cameron_and_tyler_winklevoss_but_you/cvrbh0v)

<comment><USER24> Isn't Gemini their first step towards the ETF?

Also, FDIC insurance isn't for "if" your assets are lost, it's for "when". You can trust security and safety all you want, it's when things go wrong that you need insurance.

I really hope they get private insurance, because just like making sure there are enough lifeboats on the Titanic, hindsight is always 20/20.

</comment></comment></comment></comment></comment><comment><USER25> Did Uber open source their css?

</comment><comment><USER26> On an unrelated note, can anyone tell me what that parallaxy, image sliding feature of their website is, so search for it and learn it?

<comment><USER27> Start here. [http://keithclark.co.uk/articles/pure-css-parallax- websites/](http://keithclark.co.uk/articles/pure-css-parallax-websites/) [http://keithclark.co.uk/articles/pure-css-parallax- websites/...](http://keithclark.co.uk/articles/pure-css-parallax- websites/demo3/)

.. [http://lmgtfy.com/?q=vertical+parralax+css+template](http://lmgtfy.com/?q=vertical+parralax+css+template)

</comment></comment><comment><USER28> ha, "gemini", get it?

<comment><USER29> No, what's the joke?

<comment><USER30> Gemini = Twins. The Winklevoss brothers are twins.

</comment></comment></comment><comment><USER31> What is the best way to get bitcoin without associating it with your identity (credit cards, debt cards, etc).

Accepting pre-paid cards is fine too

<comment><USER32> Localbitcoin has sellers who accept cash-purchased gift card codes. You're going to pay above market rate.

</comment></comment><comment><USER33> Not operational in Texas yet, apparently.

<comment><USER34> Nor in Massachusetts.

</comment></comment><comment><USER35> What a beautiful, fast website.

<comment><USER36> Honestly when banks have crappy websites it makes me really feel like the engineers doing the backend work are terrible. I know this is a horrible bias but still if you can't spend the time to make a good website who says they didn't cut corners on security?

<comment><USER37> A local Credit Union had CAPTCHA's like, "4n1m4l" and (believe it or not) "b4nK3r". When I complained they snidely remarked that they were pretty sure they knew how to handle security.

That may be, but they no longer have my money.

Though, for what its worth, the biggest reason I left them is because they wanted to charge me a fee to deposit cash that my kids had saved up. "Because that's what Loomis Fargo charges us." So? Cost of doing business.

The irony that they were CHARGING ME TO GIVE THEM MONEY was completely lost on that particular teller.

</comment></comment></comment><comment><USER38> How does this not create a conflicting trademark with ISE Gemini?

</comment><comment><USER24> Kind of annoying that they try to push the Authy app install first, then let you authenticate without it.

Love the interface, but would even greater if they would let you short somehow.

</comment><comment><USER39> "Thank you! We will notify you when Gemini has launched in Netherlands."

Bleh.

</comment><comment><USER40> This is the perfect opportunity to hawk my own exchange because we should all have alternatives. [http://bitcoinsexchange.itmustbetrue.com](http://bitcoinsexchange.itmustbetrue.com)

<comment><USER41> Why would anyone want to have a sex change for their bit coins?

</comment></comment><comment><USER42> So now when does Mark Zuckerberg launch his Bitcoin exchange?

<comment><USER43> When he moves to a new neighborhood and wants to cloak the source of funds that buy up all the adjacent properties?

<comment><USER44> That's why lawyers and LLC's exist.

</comment></comment></comment><comment><USER27> So, Winklevoss + Bitcoins + HN. Who's found vulns?</comment>


How Law Enforcement Tracks Cellular Phones - <AUTHOR> http://www.crypto.com/blog/celltapping/ <comment><USER2> This is a really excellent article.

Here's an article that goes into a lot of the law that is relevant to the investigative techniques mentioned: [http://www.michiganlawreview.org/assets/pdfs/107/4/kerr.pdf](http://www.michiganlawreview.org/assets/pdfs/107/4/kerr.pdf). Note: the article makes a case in support of the third party doctrine, which justifies many of those investigative techniques, but is very well-researched and presents a pretty balanced view of what the law _is_ in addition to defending that status quo.

<comment><USER3> Matt Blaze is a really excellent person, and this is a research focus area for him.

For more in the same vein, try "The Eavesdropper's Dilemma" ([http://www.crypto.com/papers/internet- tap.pdf](http://www.crypto.com/papers/internet-tap.pdf)). This paper is dear to me for reasons obvious to those who worked with me in the 1990s.

</comment></comment><comment><USER4> So is the concept of someone remotely turning your cellphone into a microphone fact or fiction? Is their any proof in either direction?

<comment><USER5> _is the concept of someone remotely turning your cellphone into a microphone fact or fiction? Is their any proof in either direction?_

It is fact. [http://news.cnet.com/2100-1029-6140191.html](http://news.cnet.com/2100-1029-6140191.html)

Law enforcement absolutely has that capability, as well as turning your phone into a tracking beacon _even when it 's powered off_.

See here for more info and discussion: [https://news.ycombinator.com/item?id=6722519](https://news.ycombinator.com/item?id=6722519)

<comment><USER3> [https://twitter.com/mattblaze/status/411539368990363648](https://twitter.com/mattblaze/status/411539368990363648)

<comment><USER5> I don't understand. I hold your opinion in high regard, because your views are almost always well-researched and supported; if not with evidence, then usually with experience. For what it's worth, I strive to express my views with the same quality and clarity as your expressions.

So your reply is somewhat disconcerting, because it seems to indicate that you think the claims are bogus. And if you think so, then you have good reason to feel that way, since almost all of your views are, well, reasonable. (An aside: would you _please_ write something articulating your deep hatred for Soylent? It was shocking to discover you felt that way, and that I didn't see anything wrong with Soylent, so I've been silently hoping to someday see a writeup from you in order that I may find reasons to change my own view.)

In short, I accepted long ago that there's roughly zero chance of going through life without unintentionally believing in crazy things. Everyone does, at some point. Therefore the most important thing is to keep my eyes open for evidence of my own crazy beliefs, so that I can constantly reevaluate them.

So your reply seems to be strong evidence that someone I respect thinks I'm being a bit bogus regarding cell phone tracking. If that's the case, then I'd love to hear your thoughts on the subject so that I can revise my own.

<comment><USER6> Off = powered down = no broadcasting or receiving.

Now, in most devices these days you can't be sure "Off" is actually "Off." I bet many Android phones lie about "turning off" and just go into a low-power- with-quick-reboot sleep mode.

If you successfully redefine Off to be Maybe Off, nobody can argue with you because you changed the terms of reality.

<comment><USER5> To be clear, the claim is the following: _There is reason to believe phones have been remotely hacked by law enforcement using carrier credentials to leave the cellular radio running and registering with the cell network even after the off button has been pushed and the phone appears to be off. Starting point for further reading:_ [http://www.brighthub.com/electronics/gps/articles/51103.aspx](http://www.brighthub.com/electronics/gps/articles/51103.aspx)

The claim isn't my own; it's Trevor's, the founder of Anybots, and one of the best electronics hackers in the world. [https://news.ycombinator.com/item?id=6087399](https://news.ycombinator.com/item?id=6087399)

He seems to have a pretty good grasp of reality, and he's more intimately familiar with the electronics than most of us.

I also presented some circumstantial evidence indicating that law enforcement does in fact use this capability in practice, the last time this came up: [https://news.ycombinator.com/item?id=6722519](https://news.ycombinator.com/item?id=6722519)

If there's fault with this, then I'd like to understand why.

<comment><AUTHOR> There is at least fault with presenting all that assertion and speculation as "Law enforcement absolutely has that capability".

The first bit that approaches being evidence is the CNet article linked from the link, and it says

 _Details of how the Nextel bugs worked are sketchy. Court documents, including an affidavit (p1) and (p2) prepared by Assistant U.S. Attorney Jonathan Kolodner in September 2003, refer to them as a "listening device placed in the cellular telephone." That phrase could refer to software or hardware._

So the absolute proof is a court document that doesn't provide any details about the mechanism used to compromise a dumb phone in 2003.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Just to put it to rest: This whole theatre in movies where you have to stay on the line sufficiently long enough to be able to trace their location is bull?

<comment><USER8> Yes.

Ann makes a call to Bob and hangs up within a second.

That call is not free; it will be listed on Ann's bill.

<comment><USER9> And if it was made from/to a cellphone, what towers saw that phone is going to be logged. Hello triangulation!

</comment></comment></comment><comment><USER10> 'Cellular phones work by periodically scanning for and "registering" with the nearest base station (generally the one with the strongest radio signal).'

This is not true. A handset registers when it enters a new zone. A city is typically broken down into several zones. The handset does not register itself with every new cellsite ("tower") it encounters. If one's phone stays in the same area, it will never transmit while idle. This is the basis for its long battery life.

[http://denbeste.nu/cdmafaq/voicemail.shtml](http://denbeste.nu/cdmafaq/voicemail.shtml)

<comment><USER11> There was a DEFCON talk two years ago in which the presenter assembled large antennas and ran open-source software that allowed him to mimic a base station. Everyone who was using phones on a specific network (I don't remember which -- I want to say AT&T) connected to his base station within a few minutes, and he proved the concept by hijacking outgoing calls.

>If one's phone stays in the same area, it will never transmit while idle.

Maybe phones used to do this, but nowadays I'm not so sure.

</comment></comment><comment><USER12> Am I missing something, or where is the [http://www.trueposition.com](http://www.trueposition.com) tech included in this link? At least for the gsm networks, they can generally locate you with cross tower triangulation within 60 meters or so, far more accurate than just the nearest tower. Useful for e911 without GPS working. I'm not sure if they have any non gsm customers.

<comment><USER13> Before GPS hardware was commonly available in phones, some CDMA carriers offered phone-based navigation services that relied on tower triangulation. Thus, it's highly likely that triangulated location data was available to emergency services and law enforcement from CDMA networks as well.

</comment></comment><comment><USER14> Hence why dump phones are so important to drug dealers. Change, recycle.

<comment><USER15> Here's one case where that didn't work out: [http://jolt.law.harvard.edu/digest/telecommunications/united...](http://jolt.law.harvard.edu/digest/telecommunications/united- states-v-skinner)

Using a phone without your name attached to it is not equal to anonymity: [https://www.schneier.com/blog/archives/2009/05/on_the_anonym...](https://www.schneier.com/blog/archives/2009/05/on_the_anonymit.html)

Imagine if you had data on all cell phones, including location at time of call - wouldn't it be remarkably easy to match a disposable phone with it's predecessors based on when and where it was used, and who it was used to contact? For how, see this article: [http://justsecurity.org/2013/10/11/nsa- call-records-database...](http://justsecurity.org/2013/10/11/nsa-call-records- database-fingerprinting-burners/)

> The [Hemisphere project] slides emphasize the program's value in tracing > suspects who use replacement phones, sometimes called "burner" phones, who > switch phone numbers or who are otherwise difficult to locate or identify.

[http://www.nytimes.com/2013/09/02/us/drug-agents-use-vast- ph...](http://www.nytimes.com/2013/09/02/us/drug-agents-use-vast-phone-trove- eclipsing-nsas.html)</comment></comment>


Netflix to Stream On Xbox 360 - <AUTHOR> http://gizmodo.com/5025001/xbox-360-getting-netflix-streaming <comment><USER2> It's very rare when two things I have turn out to be able to be used with each other. But I do have Netflix, and I do have an Xbox 360. This could be useful :)

</comment><comment><USER3> Does anyone know if it will be restricted to US?

</comment><comment><AUTHOR> This might be the tipping point for getting a 360 as well.

</comment><comment><USER4> this is going to upset the ISPs - a lot of their bandwidth and no money

<comment><USER5> I don't really understand how this impacts the ISPs any differently than the current options to watch Netflix movies on-demand.

</comment></comment><comment><USER6> Smart move.</comment>


Hoare's Rebuttal and Bubble Sort's Comeback - <AUTHOR> https://blog.reverberate.org/2020/05/29/hoares-rebuttal-bubble-sorts-comeback.html <comment><USER2> A quick ramble on the article's point about using a hybrid approach:

As the article says, hybrid algorithms can make good sense, where you use a clever algorithm to break down large problems into many small problems, and use another simpler algorithm to solve the small problems. As the article says, in sorting, it makes sense to use something like quicksort to break down large problems, and to then use bubble sort to solve the resulting small problems. In matrix multiplication, it makes sense to use the mind-bending Strassen algorithm (with superior time complexity compared to the naive algorithm) to break down multiplications of large matrices, and to then use the naive algorithm to solve the resulting small matrix multiplication problems. [0]

The threshold for switching over to the clever solution increases year on year, as hardware improves. Clever algorithms tend to behave worse in terms of branch-prediction and cache.

Apparently a similar thing occurs in large integer multiplication. [1] I'm sure there are plenty of other examples besides.

Related: Of all the known matrix multiplication algorithms, the ones with the best time-complexity are _never_ used in practice, as their constant factors spoil things. [2]

[0] [https://en.wikipedia.org/wiki/Strassen_algorithm#Implementat...](https://en.wikipedia.org/wiki/Strassen_algorithm#Implementation_considerations)

[1] [https://en.wikipedia.org/wiki/Sch%C3%B6nhage%E2%80%93Strasse...](https://en.wikipedia.org/wiki/Sch%C3%B6nhage%E2%80%93Strassen_algorithm#Optimizations)

[2] [https://en.wikipedia.org/wiki/Coppersmith%E2%80%93Winograd_a...](https://en.wikipedia.org/wiki/Coppersmith%E2%80%93Winograd_algorithm)

<comment><USER3> The "hybrid" as used in this article referred to a partition scheme that combines a "Lomuto partitioning like algorithm" together with a "Hoare partitioning like algorithm".

This amplifies the the strength of each scheme and mitigates the weakness. Ie. Lomuto does too many swaps, but naturally fits a branchfree implementation. Hoare is frugal with swaps, but is rather branchy. The "hybrid" here inherits the frugality of swaps from Hoare's scheme, while benefits from the branchfree implementation of Lomuto scheme.

What you seem to describe here is the classical and well-known hybridization of divide and conquer algorithms. This is also used and implicitly implied when branchless bubble sort is discussed. But the "hybrid" as used in the article wasn't meant to refer to this.

<comment><USER2> Thanks.

</comment></comment></comment><comment><USER4> In what application are you going to sort an array of a pure scalar type that is native to the machine?

Usually you're sorting pointers to objects, and there is some indirection required to compare them (perhaps an outright call through a function pointer).

Here is one good application: ordering an array of pointers by increasing address. That doesn't require indirection upon them, and is useful: e.g. if these are pointers into a heap we wish to compact.

<comment><AUTHOR> Towards the end of the article, Gerben makes the point that the comparison is not on the critical path of his variant of QuickSort, so even if the comparison involves indirection, that comparison can still proceed in parallel with the main loop of the algorithm:

> Combining these two tricks could lead to merge sort on par with the simple > partition loop of QuickSort. However it's just a mitigation. If instead of > sorting a simple primitive value we would sort pointers to a struct. The > comparison operator would have an extra load which immediately adds to the > critical path. QuickSort is immune to this, even rather costly comparisons > do not influence the ability to make progress. Of course if the comparison > itself suffers from frequent branch misses, then that will limit the ability > to overlap different stages of the iteration in the CPU pipeline.

In the benchmark code for the blog, he includes a benchmark that has indirection to illustrate this, though these results were not included in the article itself. On my machine I get:

        $ CC=clang bazel build -c opt :all
        $ bazel-bin/bench_sort --benchmark_filter=BM_IndirectionSort
        </comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>-
        Benchmark                                              Time           CPU Iterations
        </comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>-
        BM_IndirectionSort<1, std_sort>                       64 ns         64 ns   10900000
        BM_IndirectionSort<1, std_stable_sort>                89 ns         89 ns    7900000
        BM_IndirectionSort<1, std_heap_sort>                 112 ns        112 ns    6300000
        BM_IndirectionSort<1, exp_gerbens::QuickSort>         26 ns         26 ns   27000000
        BM_IndirectionSort<1, HeapSort>                       96 ns         96 ns    7300000
        BM_IndirectionMergeSort<1>                            45 ns         45 ns   15500000

<comment><USER3> For more clarification. The number 0, 1 in these benchmarks mean the level of indirection. IndirectionSort<0, xxx> is sorting pointers on their address. While IndirectionSort<1, xxx> is sorting pointers on the value it's pointing to. Notice how MergeSort regresses much more then the QuickSort. Without an indirection MergeSort is competitive with an indirection QuickSort becomes relatively much better. As you point out sorting pointers to structs is much more important use case. This property becomes even more important as L1 cache is typically kind of small O(32kb), while L2/L3 cache is large O(1mb). So when sorting pointers it's not unreasonable to hit L2/L3 cache but miss L1. With L2/L3 typically being 10-20 cycles latency (vs 5 cycle for L1) QuickSort is largely insensitive to the L1 cache misses.

        BM_IndirectionSort<1, std_sort>                       93 ns         93 ns    7700000
        BM_IndirectionSort<1, std_stable_sort>               126 ns        125 ns    5600000
        BM_IndirectionSort<1, std_heap_sort>                 172 ns        172 ns    4200000
        BM_IndirectionSort<1, exp_gerbens::QuickSort>         34 ns         34 ns   19000000
        BM_IndirectionSort<1, HeapSort>                      157 ns        157 ns    4700000
        BM_IndirectionMergeSort<1>                            68 ns         68 ns   10400000
        BM_IndirectionSort<0, std_sort>                       74 ns         74 ns    9500000
        BM_IndirectionSort<0, std_stable_sort>                91 ns         91 ns    7800000
        BM_IndirectionSort<0, std_heap_sort>                 125 ns        125 ns    5800000
        BM_IndirectionSort<0, exp_gerbens::QuickSort>         26 ns         26 ns   27200000
        BM_IndirectionSort<0, HeapSort>                       77 ns         77 ns    9300000
        BM_IndirectionMergeSort<0>                            36 ns         36 ns   19400000

</comment></comment><comment><USER5> Andrei Alexandrescu's post, linked at the top, is a great read as well: [https://dlang.org/blog/2020/05/14/lomutos- comeback/](https://dlang.org/blog/2020/05/14/lomutos-comeback/)

</comment><comment><USER6> Great article, this isn't my domain so the results are unexpected and the fact that a domain expert working on the problem can miss stuff like this reinforces something I see over and over when it comes to optimization - forget your assumption, intuition and best practices - everything is context sensitive (size of data, hardware specific) and gets obsolete through hardware evolution - the only way to optimise is to measure to identify bottlenecks after you have working code and them test again that you actually succeeded - don't optimise in advance.

<comment><USER7> And measure. Always measure. Without data it's all posturing

<comment><USER8> the opposition usually sounds like this - "Microbenchmarks lie". On one of the past projects, the leading engineers and architects just loved that phrase and voiced it like a deep profound truth understanding of which was a hallmark of belonging to their circle of chosen. Any specific measurements showing issues with the supposedly brilliant architecture and implementation choices of that project (with many of these choices following the latest "best practices" fads published by some venerable technologists) were dismissed by that phrase just like by magic. Naturally that was one of the slowest, not to mention buggy, projects in my experience, and working in the enterprise space i've seen my share of slow and buggy.

<comment><USER9> Except that's not opposition? _Microbenchmarks_ do, always, lie; you need to measure the performance of your actual, real code that you're actually caring about the speed of.

</comment></comment></comment></comment><comment><USER10> I'm surprised that they found a legit use-case for bubble sort. I always had the impression that bubble sort had very little going for it because the naive implementation is much slower than insertion sort, while also not being as intuitive. [https://users.cs.duke.edu/~ola/bubble/bubble.html](https://users.cs.duke.edu/~ola/bubble/bubble.html)

Out of curiosity, does anyone know how selection sort would compare to bubble sort and insertion sort in this kind of problem?

</comment><comment><USER11> If you define

      inline bool swap_if(
        bool c, int& a, int& b)
      {
        int ta = a, tb = b;
        a = c ? tb : ta;
        b = c ? ta : tb;
        return c;
      }

and then use it in partition's inner loop like

       right += swap_if(
         *left < pivot,
         *left, *right);

..., compiled with Clang (which generates `cmov` instructions), a simplest- possible quicksort is more than twice as fast as `std::sort`. Then you can doctor up the endgame with heapsort, insertion sort, even bubble sort if you like, and get an incremental improvement.

But using AVX machinery to implement an optimal sorting network for small arrays is faster, if you are sorting scalars. See <[https://arxiv.org/abs/1704.08579>](https://arxiv.org/abs/1704.08579>)

A fully general swap_if,

      template <typename T>
      bool swap_if(
        bool c, T& a, T& b)
      {
        T v[2] = { a, b };
        b = v[c], a = v[1-c];
        return c;
      }

could and should be peephole-optimized to use a pair of `cmov` instructions, but is not in Clang, Gcc, Icc, or MSVC. But even without such an optimization, it makes Quicksort much faster than std::sort. It is slower than the cmov version probably because it costs more L1-bus traffic.

(Gcc, incidentally, is very, very sensitive to details of this version. Change the order of assigning a and b, or use `[!c]` in place of `[1-c]`, and it gets much slower, on Intel, for very non-(to me-)obvious reasons. Gcc also will never, ever produce two `cmov` instructions in a basic block. I have filed a bug.)

Another formulation is

      template <>
      bool swap_if(
        bool c, int& a, int& b)
      {
        int ta = a, tb = b;
        a =  -c&tb | c-1&ta;
        b = c-1&ta |  -c&tb;
        return c;
      }

which Clang also optimizes to a pair of `cmov` instructions. Gcc (like Icc and MSVC) emits the literal and/and/or instructions, which is also faster than std::sort, but less so than the array version.

If `swap_if` were in the Standard Library, it would probably be implemented optimally on all compilers, and almost half of the Standard algorithms could use it to get, often, ~2x performance improvement.

A partition using AVX machinery is potentially much faster, although not as much faster as one might hope. See

<[https://bits.houmus.org/2020-02-02/this-goes-to-eleven- pt5>](https://bits.houmus.org/2020-02-02/this-goes-to-eleven-pt5>)

That took much of a year to implement. AVX512 instructions enable even better optimizations, but AVX512 might not come out in AMD until Zen-4. (We are at Zen-2 now.)

<comment><AUTHOR> Your "simplest-possible quicksort" appears to be the same as the first branchless Lomuto partition given in the article.

The premise of the article is that, while branchless, this loop suffers from store/load dependencies that significantly inhibit instruction-level parallelism. Gerben's algorithm gets a 2x win over this approach by using a temporary buffer that prevents loads from aliasing previous stores.

<comment><USER11> Thank you for the correction.

The best sort in the article appears to yield 3x vs. std::sort for an array that fits in L2 cache. In my testing (with much larger arrays) I got 2.5x without any small-array transition, and 3x with a branchless sorting-network for ranges of 3 or less, and dramatically less code than that presented in the article.

I suspect that the algorithms used in the article, implemented just a little differently, could still yield substantially better performance, beating my simpler code.

This is a consequence of our deal with the devil: caches and speculation make our code faster, but we can no longer know whether it is objectively fast, or how much faster it could be. What seemed fast becomes slow the moment somebody does it faster.

</comment></comment></comment><comment><USER12> Hm interesting, so is there any analysis / theory that will capture branch mispredictions?

e.g. like big-O for something closer to real machines.

I feel like CPU cycles should already be analyzed separately from memory accesses (although I guess they are usually proportional). But analyzing branch mispredicts seems harder

How does this hold up on ARM and other architectures? (RISC V, etc.)

<comment><USER13> I'm not sure about much analysis and theory that explicitly captures branch prediction, but in last year's cppcon keynote Andrei offered a possible metric [0] where he takes into account the average "distance" between two subsequent array accesses.

It's basically, (C(n) + M(n) + kD(n)) / n

Where M is moves, C is comparisons, k is a some constant, and D is "distance".

[0]: [https://youtu.be/FJJTYQYB1JQ?t=2943](https://youtu.be/FJJTYQYB1JQ?t=2943)

</comment></comment><comment><USER14> Please take into account these discussions are about scalar sorting methods. For simple symbol types (i.e. cpu register) vectorized sorts are much better and don't suffer branch prediction per comparison (using result masks to do exchange/swap).

</comment><comment><USER15> Thanks for the interesting post! I liked the MergeDouble approach which I hadn't seen before. Couldn't that be extended to finding the median of the results using binary search and then doing four concurrent merges, for even more ILP?

<comment><USER3> Yes that is very much possible. In general you won't get 4 equal length ranges though. For instance in an already sorted array the median results in (n/2,0) and a (0,n/2) division. But the average case should be two sets of merge intervals both of size (n/4, n/4). In reality I think you will quickly run into other limits. You need quite a bit of registers, that shouldn't spill to stack.

<comment><USER15> I think the median of the results works great in any case (but, you are the expert here). If we find the result median in each of the two inputs, say 'a' and 'b' we have four merges (two forward, two reverse):

        [0, ..) w (0, ..)
        (.., a) w (.., b)
        [a, ..) w [b, ..)
        (.., n) w (.., n)

each of which should produce n/4 elements and then meet.

If the array is already sorted then great; that split will just "merge":

        [0, ..) w nothing
        (.., n/2) w nothing
        nothing w [n/2, ..)
        nothing w (.., n)

which should go very fast. Anyhow, possible I'm missing something!

<comment><USER3> No you are not missing something. This is, I think, correct. I haven't tried it but it seems possible and possibly very effective.

</comment></comment></comment></comment><comment><USER16> What program was used to create the dependency diagrams? And is there some more general introduction for using this sort of dependency analysis for low level optimizations?

<comment><USER3> That was just hand analysis of the data flow together with Google Diagrams.

As I mention in the article, dependency analysis has, IMO, not received the widespread attention it should. I like Fabian Giesen's article if you want an introduction.

[https://fgiesen.wordpress.com/2018/03/05/a-whirlwind- introdu...](https://fgiesen.wordpress.com/2018/03/05/a-whirlwind-introduction- to-dataflow-graphs/)

<comment><USER17> FWIW, there are some interesting tools for microarchitectural performance analysis which are getting closer (although it's a work in progress): [https://github.com/MattPD/cpplinks/blob/master/performance.t...](https://github.com/MattPD/cpplinks/blob/master/performance.tools.md#microarchitecture)

One particularly interesting example in this context is OSACA (Open Source Architecture Code Analyzer), [https://github.com/RRZE- HPC/osaca](https://github.com/RRZE-HPC/osaca)

The related publications explain the approach used to model and perform critical path analysis relevant for the modern superscalar out-of-order processors:

\- Automatic Throughput and Critical Path Analysis of x86 and ARM Assembly Kernels (2019): [https://arxiv.org/abs/1910.00214](https://arxiv.org/abs/1910.00214)

\- Cross-Architecture Automatic Critical Path Detection For In-Core Performance Analysis (2020): [https://hpc.fau.de/files/2020/02/Masterarbeit_JL- _final.pdf](https://hpc.fau.de/files/2020/02/Masterarbeit_JL-_final.pdf)

There's also a broader line of research on performance modeling in this vein (some pretty detailed, including microarchitectural details like branch misprediction penalties, ROB capacity, etc.): [https://gist.github.com/MattPD/85aad98ee8b135e675d49c571b67f...](https://gist.github.com/MattPD/85aad98ee8b135e675d49c571b67fde9#file- performance-modeling-criticality-md)

More on modeling microarchitectural details (chronological order):

\- Tejas S. Karkhanis and James E. Smith. "A First-Order Superscalar Processor Model." (ISCA 2004) - [http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.79....](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.79...).

\- Stijn Eyerman, Lieven Eeckhout, Tejas Karkhanis, and James E. Smith. "A mechanistic performance model for superscalar out-of-order processors." ACM Trans. Comput. Syst. 27, 2 (2009) - [http://www.elis.ugent.be/~leeckhou/papers/tocs09.pdf](http://www.elis.ugent.be/~leeckhou/papers/tocs09.pdf)

\- Maximilien B. Breughe, Stijn Eyerman, and Lieven Eeckhout. "Mechanistic analytical modeling of superscalar in-order processor performance." ACM Trans. Architec. Code Optim. 11, 4, Article 50 (2014) - [https://users.elis.ugent.be/~leeckhou/papers/taco2015-breugh...](https://users.elis.ugent.be/~leeckhou/papers/taco2015-breugh..).

\- "Modeling Superscalar Processor Memory-Level Parallelism", Sam Van den Steen and Lieven Eeckhout, IEEE Computer Architecture Letters (CAL), Vol 17, No 1 (2018) - [https://users.elis.ugent.be/~leeckhou/papers/cal2018-MLP.pdf](https://users.elis.ugent.be/~leeckhou/papers/cal2018-MLP.pdf)

</comment></comment></comment><comment><USER18> I wonder if they tried shell sort? IME it's so close to bubble sort in implementation that you can view it as a trivial optimization.

<comment><USER19> And just a few shells could be added, to make this optimization right? If the sequence is 1, 4, 10, 23, .. one could start by just adding a pass with 4 and then 1.

[https://stackoverflow.com/questions/2539545/fastest-gap- sequ...](https://stackoverflow.com/questions/2539545/fastest-gap-sequence-for- shell-sort)

I don't know how to select the fallback sort loop size (related to cache line size maybe?); in his github code he uses 16 elements as the threshold.

<comment><USER3> A very interesting suggestion indeed. Shell sort is an insertion sort though. It owes its better complexity from being able to breaking out of loop early. But these are difficult to predict branches that bubble sort avoids.

Certainly this is worth an experiment

<comment><USER19> Well, you are the expert :). I misremebered and thought of the base case for shell sort to be a kind of bubble sort.

</comment></comment></comment></comment><comment><USER20> No mention of Timsort though.

<comment><USER21> For this case, in tiny arrays, something like timsort would be a bad idea -- the basic idea of the article is that it takes so little work to sort tiny arrays that you want to run the simplest algorithm possible.

<comment><USER2> I think the _Fallback for sorting short arrays_ section makes it clear that it's not only about sorting small arrays, so I think it's reasonable to wonder why Timsort wasn't mentioned.

<comment><USER21> You are right. For people who like quicksort, the "timsort of quicksorts" is pattern-defeating quicksort (pdqsort), which is my usual goto algorithm nowadays.

<comment><USER2> So does this work out as a three-part hybrid algorithm? Timsort, 'then' Quicksort, then bubble sort/insertion sort for short sequences?

</comment></comment></comment></comment></comment><comment><USER22> Josh, Gerben!

Have you tried a sorting network, instead of the bubble sort?

<comment><USER3> No and I suspect that there is room for significant improvement here.</comment></comment>


The Coronavirus Called America's Bluff - <AUTHOR> https://www.theatlantic.com/ideas/archive/2020/03/coronavirus-showed-america-wasnt-task/608023/ <comment><USER2> _Chu was not threatened by the government, like Li had been in Wuhan. But she was just as effectively silenced by a rule-bound bureaucracy that was insufficiently worried about the pandemic_

This moral equivocation between America's bureaucratic incompetence and China's police state is ridiculous.

Chu may have been blocked by a bunch of stuffed shirts in the FDA etc, but she wasn't taken out back and shot like the citizen journalists in Wuhan.

[https://www.youtube.com/watch?v=7AI3R41dGnU&feature=youtu.be](https://www.youtube.com/watch?v=7AI3R41dGnU&feature=youtu.be)

<comment><USER3> The author wasn't making a "moral equivocation".

She was explaining how concerned citizens were trying to make a difference in 2 different countries, and were prevented by the government from succeeding.

I find the article to be reasonable and balanced. I suggest you more carefully read it.

</comment></comment><comment><USER4> This is a month old, with a lot of finger pointing and grumbling.

What does the data say so far as of today?

[https://ourworldindata.org/grapher/new-covid-deaths-per- mill...](https://ourworldindata.org/grapher/new-covid-deaths-per- million?tab=chart&time=44..&country=BEL+FRA+ITA+ESP+SWE+GBR+USA)

It is currently looking like Sweden is doing very well with their much criticized protocols. And, hey, the US is also doing pretty well when compared with many other countries that have transparent reporting of stats.

There will be a lot of lessons learned in the months ahead as we compare what different countries are doing. What worked, what didn't work, and why. Political mudslinging is unlikely to help this process.

<comment><USER5> By what metric is the US doing well? We have the highest number of cases and the highest number of deaths.

While it may be true that some countries are not reporting accurately, it's certainly not true that our numbers only look bad because the US is so transparent. We have a problem, a serious one, and the numbers lay it out quite clearly. We should try to improve.

<comment><USER4> Click on the link and look at the chart.

The US is currently below 5 new daily deaths per million, while many other countries have a much higher rate.

Keep in mind that if you add up the populations of the UK, France, Italy, Spain, and Germany - you still have fewer people than live in the US.

<comment><USER3> I looked at the chart you linked.

I don't see how you can draw any conclusions from it, as each country has different testing and death reporting.

Also, the USA contains many cities and large rural areas, so the rates would be different.

But most importantly, regardless of how the graph is interpreted, it doesn't answer any questions, such as:

\- when should we stop social distancing? forever isn't an answer.

\- do ventilators help or not?

\- how much testing do we need to do? tracing?

To conclude, I think you're confusing data with information.

<comment><USER6> I thought ventilators were pretty much a given - a 50% or better survival rate when needed. They give treatment the time to work. If used when treatment options are exhausted, then they simply prolong life a few days (and suffering) so there's that I suppose.

<comment><USER3> No. The numbers are 66% to 90% mortality rate (NY is 80%) on ventilators, and the survivors can't talk or climb a flight of stairs for an unknown amount of time.

The current recommendation is to use a cannula with an oxygen bottle as long as possible (until the patient can't stop fainting.)

There is no treatment yet. Your body can use the first week to try and recover itself, but after that most people die.

From a public health policy, ventilators don't work, so they're not really part of the equation now as they were in March.

What's misunderstood about ventilators is that being intubated requires general sedation and is more like major surgery than assistance.</comment></comment></comment></comment></comment></comment>


Use of Ad-Blocking Software Rises by 30% Worldwide - noir-york https://www.nytimes.com/2017/01/31/technology/ad-blocking-internet.html?smid=li-share <comment><AUTHOR> > "The best way for the industry to tackle this problem is to deliver > compelling ad experiences that consumers won't want to block."

Good luck trying to find a "compelling" way to sell paper towels, laundry detergent, and unhealthy food.

</comment><comment><USER2> Advertising as it exists is kind of evil. The majority of ads try to create want (which is a form of unhappiness) so that you are motivated to buy their product. Even if they don't do this, they attempt to subvert your decision making process to make their product more appealing - usually, to the detriment of your ability to make a good objective decision.

The simple answer is to stop direct advertising, and instead focus on things like giving out free merchandise to socially well connected people in exchange for public reviews. Additionally, if you want me to associate your company with good feelings, don't try to force it with advertising - go out and do good things like feed the hungry, provide medicine to people in impoverished nations, etc.</comment>


Ask HN: Where/How do I learn about credit card payments and payment gateways - <AUTHOR> I hope this is not the wrong place to post this.
I have been trying to learn about credit card payment gateways and I am not finding the proper resources. Specifically -
* I read (on HN) sometime ago that there is a specific way the card numbers are issued by companies and that you could tell by the number which company issued it. Where do I get this information?
* What exactly do the different players do in the ecosystem? We have the providers (Visa, MC), issuers (Citibank), payment gateways, processors. * When I swipe my card at Best Buy what happens after the card is read?
Could someone please point me in the right direction? <comment><USER2> This comment (and the two below it, since it got too long to fit in one comment) I wrote about 6 months ago covers my best attempt to figure out what the various players do: <http://news.ycombinator.com/item?id=2445866>

<comment><AUTHOR> This is great! Thanks for the reply. I am guessing all these are custom networks with their own API and no fixed interoperability between payment processors, correct?

</comment></comment><comment><USER3> FeeFighters has a pretty good free ebook called "How to Be a Credit Card Processing Ninja" - [http://feefighters.com/blog/free-ebook-launch-how-to-be- a-cr...](http://feefighters.com/blog/free-ebook-launch-how-to-be-a-credit- card-processing-ninja/)

<comment><USER4> FeeFighter's ebook and many of their blog posts are a pretty great resource. Another great resource (especially for Rubyists) is Amy Hoy and Thomas Fuchs' <http://jumpstartcc.com/>

If you don't want to bother worrying about the details of setting it all up, look into Stripe.com or Samurai from Feefighters

</comment></comment><comment><USER5> Read Gus Fuldner's posts on Quora. <http://www.quora.com/Gus-Fuldner/answers>

<comment><USER6> Seconded.

Also, Carol Benson & Scott Loftesness's book, _Payments Systems in the U.S._ , is quite an excellent introduction: <http://www.amazon.com/dp/098278970X>

</comment></comment><comment><USER7> I work in the debit side of things (well for only about the next few months) so my experience is a tad bit different, I'll approach it from a debit perspective, credit should be somewhat similar.

The device you swipe your card at Best Buy is a merchant device. Best Buy has made an agreement with the device vendor to route its traffic over a specific network, say First Data.

When you swipe the card the network(gateway) decides where to 'route' the request based on the BIN (typically first 6 digits of the card number, can be more depending on how the card profile is setup). The network has BIN tables setup so they can easily identify which cards go where. After the merchants gateway has determined where to route the card, the request then propagates to the issuing network, from there it is sent to the issuer to approve/deny the request.

This is a simple high level overview and by no means complete.

Ex. path

User swipes card @ device -> Merchant devices sends transaction to First Data (where FDC is the merchant device gateway) -> First Data routes transaction to issuing network (Visa, MC, Cirrus) -> Issuing Network forwards request to issuer (issuance processor) for approval

In debit world, it used to be that the more 'hops' a request took to route back to the issuer, the more that interchange that was incurred.

There are all sorts of scenarios that can occur, for example, I'm working on a project that would circumvent the networks if the transaction is for a card issued by our bank (closed loop transaction), which avoids interchange fees paid to the network.

</comment><comment><USER8> This is a big topic. The keyword you're looking for is the four-party system. Take a look at the GAO or Federal Reserve papers on interchange reform, they give a good high-level view. Gateways and merchant accounts are only half of the equation.

</comment><comment><USER9> It's been a while since I've seen an HN post where I can give valuable feedback, thanks for the questions!

1\. Here is a way to do it, in Python: [https://github.com/abunsen/Paython/blob/master/paython/lib/u...](https://github.com/abunsen/Paython/blob/master/paython/lib/utils.py#L102)

2\. Not sure on providers other than that they lend their brand / set guidelines for the banks that issue cards (Citibank). On the other hand, you've got a processor, like First Data who allow you to process cards (on the internet) via a gateway, like Authorize.Net. In some cases, the processor & the gateway are bundled, like in the case of the new Stripe payments.

3\. AFAIK: Your cards magnetic strip is converted to numbers, sent to a gateway to be processed as a "card present" transaction (different, typically lower, fees for these) & asked for approval from the issuing bank, once approved the amount collected will sit in limbo for 1-7 days then deposited into Best Buys bank account.

</comment><comment><USER10> _there is a specific way the card numbers are issued by companies and that you could tell by the number which company issued it._

Here is a good resource for that info: <http://www.merriampark.com/anatomycc.htm>

</comment><comment><USER11> You should try out Stripe (<https://stripe.com/>). They make credit card processing a piece of cake.

<comment><USER12> Agreed. I checked out Stripe last week and they look terrific. I am planning to use them for any payment processing that I may need. To simplify the task I have created a Clojure binding for their api, you can check it out at <https://github.com/abengoa/clj-stripe> . Just started, lot of work to do, but the functionality is all there. Feedback welcome, and much appreciated.

</comment></comment><comment><USER13> I learned a lot from this pivotal labs podcast and recommend giving it a listen: <http://pivotallabs.com/talks/88-demystifying-online-billing>

[http://www.slideshare.net/Recurly/lessons-learned-in- online-...](http://www.slideshare.net/Recurly/lessons-learned-in-online- billing)

</comment><comment><USER14> I think you're referring to the Mint infographic, "Cracking the Credit Card code"

Link: <http://www.mint.com/blog/trends/credit-card-code-01202011/>

</comment><comment><USER15> The creators of freckle offer a good overview of credit card processing: <http://jumpstartcc.com/>

</comment><comment><USER16> <http://en.wikipedia.org/wiki/Bank_card_number>

[http://en.wikipedia.org/wiki/List_of_Bank_Identification_Num...](http://en.wikipedia.org/wiki/List_of_Bank_Identification_Numbers)

<http://en.wikipedia.org/wiki/Interchange_fees>

</comment><comment><USER17> There was a post about stripe.com not too long ago. Perhaps you should try checking them out</comment>


Ask HN: Linode wants photos of the back of my credit card. Alternatives? - <AUTHOR>

This is what I got:
In regards to this order, we will need a signed authorization from the credit card holder before being able to activate this account.
Please copy the credit card holder's photo ID (front and back) and the credit card used (front and back) and use our secure submission form. Your unique link is located below:
https://manager.linode.com/signup/credentials/...
Alternatively, feel free to fax them to 1-609-380-7200 (fax) or email to email@example.com. Please complete this within 48 hours, or this signup will be cancelled and the charges voided.
Thank you, Linode.com
Digital Ocean is the same by the way. Pretty stupid for an online business to ask for both a photo ID and the back of the credit card with the signature and CVV. All for $10/month.
Sure, I could put something over the sensitive information. But that doesn't make any less stupid. So, what alternatives do you recommend? <comment><USER3> Neither company wants to ask for the information, but something about your order triggered an elevated risk profile. It's likely it will be the same at other hosting companies as well since it's probably tied to your CC/address/name combo. I know I ALWAYS have trouble with a particular Chase card - with this card they seem to flag all new online purchases as suspicious. It's a PITA, and I've called to complain but they don't care - <USER2> since it's not my money at risk (it's theirs) I don't have much of an option except cancel the card.

Also, the more purchase you attempt to make and don't complete with that card, the worse the risk profile is going to be going forward for similar purchases. So I wouldn't expect it to get easier from here.

</comment><comment><USER4> I've never been asked to provide these by Rackspace, Digital Ocean, Amazon, etc.

Is there something special that has your account flagged? Overseas? Something like that?

<comment><AUTHOR> Europe

</comment></comment><comment><USER5> I didn't need to send anything to Digital Ocean except my credit card infos.

What country are you from and what credit card you use ?

<comment><AUTHOR> I'm in Europe and I used a VISA.

</comment></comment><comment><USER6> i was using tor when i signed up do. so they wanted some id verification because they were curious about my location.. apparently my linkedin id didnt work. but they were ok when i asked them to whois a domain i ,er, owned..

</comment><comment><USER7> I did not send anything to Digital Ocean. But i did use Paypal.</comment>