Web Request and Declarative Net Request: Explaining the impact on Extensions - <AUTHOR> https://blog.chromium.org/2019/06/web-request-and-declarative-net-request.html <comment><USER2> > _There's been a lot of confusion and misconception around both the > motivations and implications of this change_

Oh, heck off. This is Google's fallback whenever people call them out on anything -- "you just don't understand the entire picture." It's just their way of gaslighting critics.

People understand the change perfectly.

a) The privacy arguments are untrue because the Observational capabilities of the WebRequest API aren't being deprecated. There are no privacy benefits unless an extension voluntarily ignores that part of the API -- which no one will do because, as Google says:

> _when extension developers are given the choice between capability and > security, the vast majority of developers choose capability._

Google makes the argument that 42% of malicious extensions use this API. Well, guess what they'll still be able to do under Manifest V3?

b) The vast majority of data suggests that ad blocker performance is not a serious issue on the web right now. Ad blockers pretty much universally help more than they hurt, so it's not clear why performance is such a big concern.

c) The declarative model is a less powerful alternative, which is the exact reason why Google is deprecating the blocking capabilities in the first place -- if they didn't force it, no one would switch (again, see their "why not both?" argument).

So what don't consumers and developers understand about this? It's an objectively less powerful API that does very little to improve privacy for the sake of performance improvements that aren't necessary.

<comment><USER3> > _The Observational capabilities of the WebRequest API aren 't being > deprecated_

They are being severely curtailed.

[https://twitter.com/justinschuh/status/1138889508512866304](https://twitter.com/justinschuh/status/1138889508512866304)

> _Yes, but network requests won 't be observable without permission on the > relevant hosts. And host permissions are changing significantly in Mv3 (e.g. > they can't be granted as blanket install time permissions)._

> _The underlying issue with blocking Web Request is that it is effectively a > UXSS, which could not be bound by origin-based host permissions like the > rest of the API can._

Google's privacy argument is correct.

<comment><USER2> I strongly disagree. There is pretty much no chance that every ad blocker and every other extension isn't going to widely request that new permission, because without it you can't get the data you need to maintain adblock lists or do more advanced detection (ie Privacy Badger).

On the current discussion thread, Chrome devs say:

> _The webRequest API 's ability to observe requests is foundational for > extensions that modify their behavior based on the patterns they observe at > runtime._

And in this article, they say:

> _when extension developers are given the choice between capability and > security, the vast majority of developers choose capability._

So the argument that hiding observation requests behind a permission means that they are "severely curtailed" is just plain wrong. Most extensions (including ad blockers) will still request these permissions as wildcards across all hosts, and most users will still grant them as wildcards across all hosts.

Per-domain permissions for the blocking WebRequest API would be great (that's a change I would broadly support), and if Chrome devs honestly believed that per-domain permissions were an adequate user protection against malware, they'd look for ways to implement per-domain permissions with the blocking API, rather than deprecating the entire thing.

The Twitter post you link claims that's impossible, I don't see why. That would be a good thing for someone from Chrome to explain in either the massive developer thread that's been going on for months, or maybe in the article that complains about how much "confusion" users and developers have, instead of asking devs to blindly take their word.

<comment><USER3> You can't just request "that new permission" for all web sites ("hosts"), but only for certain specific hosts, and only with the permission of each host.

> _The Twitter post you link claims that 's impossible, I don't see why._

Your original post claimed that people understand this issue "perfectly." It turns out there was more to it than you thought.

<comment><USER2> Check the spec[0] -- Google isn't getting rid of the ability for users to grant full URL access for extensions, because of course they're not. That permission is absolutely necessary for a wide variety of extensions, including ad blockers. They're just implementing changes to how that permission is going to be granted.

With respect, a lot of us have been following these changes for a long time. We know about the permission stuff already. And to be clear, the permission changes are good -- they're just not going to significantly change normal user behavior in most cases.

> _It turns out there was more to it than you thought._

It turns out that a Google advocate on Twitter posted, "we can't do it the other way" with no explanation of why it would be a problem. Again, this exactly is how Google gaslights. They refuse to engage with the wider developer community, ignore proposals and objections, and then when the wider community finally gets mad enough to start complaining in mainstream channels, they start posting on Twitter and blogs that "actually, it's complicated."

If developers don't have the full picture, _give it to them._ The Chrome team can't complain that developers aren't informed about the technical limitations they're facing when they're posting arcane updates to Twitter instead of the official threads that everyone is following.

[0]: [https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz...](https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3NzzhHzc- qnk4w4PX-0XMw8/edit#heading=h.oenw1ekaaubz)

<comment><USER3> You say that they give "no explanation of why it would be a problem," in reference to Justin Schuh's tweet:

> _The underlying issue with blocking Web Request is that it is effectively a > UXSS, which could not be bound by origin-based host permissions like the > rest of the API can._

The reasoning here should be obvious. _Observing_ web requests can be useful with the cooperation/permission of the host you're observing, but it makes no sense to have an ad blocker that requires permission from the ad-blocked websites.

If you grant the core premise is that we don't want extensions to be allowed to observe all web traffic, because this permission will be abused, then the only logical conclusion is to use a rules engine. That's the only way to design an ad blocker that doesn't/can't observe all web traffic.

<comment><USER2> > _it makes no sense to have an ad blocker that requires permission from the > ad-blocked websites._

I don't follow what you mean by this.

Under the current V3 specification, as currently proposed, Privacy Badger (assuming they stick it out and keep maintaining a Chrome version) will need to be granted observation permissions on every single website, adblocked or not. The way Privacy Badger works is by determining at runtime based on request observation which domains it should blacklist. This is not going to be a fringe usecase.

Are you misunderstanding how the proposed permissions system works by some chance, or am I misunderstanding your argument? It's not the website you request permissions from -- it's the _user_ you request permissions from for domains/domain patterns.

Why doesn't it make sense for a user to grant an ad blocker permission to operate on domains where they want it to block ads?

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> They've addressed a number of complaints about limitations of the new API:

> _Since the original announcement of the Declarative Net Request API, we have > added significant functionality to the API as a result of these discussions. > The Declarative Net Request API now allows for the registration and removal > of dynamic rules - specified at runtime rather than statically in the > manifest. We've also added the capability to remove common tracking headers, > such as Referer, Cookie, and Set-Cookie._

> _We are actively exploring other ways to expand this API, including adding > methods to get feedback about matched rules, and support for richer > redirects leveraging URL manipulation and regular expressions. Additionally, > we are currently planning to change the rule limit from maximum of 30k rules > per extension to a global maximum of 150k rules._

They posted a simpler post to the Security blog also addressing these issues.

[https://security.googleblog.com/2019/06/improving- security-a...](https://security.googleblog.com/2019/06/improving-security-and- privacy-for.html)

They lead with the point that most-seemed to get lost in translation, even on technical sites like HN.

> _No, Chrome isn't killing ad blockers_

<comment><USER5> Killing? No. Handicapping? Yes. And why are we surprised? It's in their best interest to do so; expecting a for-profit company to go against its own monetary best interests forever is naïve, at best.

<comment><USER3> The rule limits Google's proposing are more generous than the limits Apple puts on content blockers. Apple allows only 50K rules. And it turns out 50K rules is actually fine!

Declarative rules engines are better and preserve privacy better. This is Google following Apple's lead and doing the right thing.

<comment><USER6> It does nothing for privacy because extensions will still be able to see the requests, they just won't be able to block them.

<comment><USER3> No, manifest v3 extensions will only be able to observe requests for specific hosts, with permission from each host.

<comment><USER6> This isn't mentioned in the public version of the v3 spec (perhaps I'm looking in the wrong place) or in today's blog post. Do you have a reference?

<comment><USER7> One of the other comments has a link to this tweet about it:

> _Yes, but network requests won 't be observable without permission on the > relevant hosts. And host permissions are changing significantly in Mv3 (e.g. > they can't be granted as blanket install time permissions)._

[https://twitter.com/justinschuh/status/1138889508512866304](https://twitter.com/justinschuh/status/1138889508512866304)

there's also some stuff in the design doc: [https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3Nzz...](https://docs.google.com/document/d/1nPu6Wy4LWR66EFLeYInl3NzzhHzc- qnk4w4PX-0XMw8/edit#heading=h.oenw1ekaaubz)

Which explains the specific hosts part, but only makes vague mention of how extensions that users _do_ want to run on every site will get permission to do so.

<comment><USER6> Thank you. If Google were trying to be obfuscatory they could hardly do a better job.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> This seems like massive spin. Their primary argument doesn't wash. As far as I understand it the web request API will still exist and still allow extension developers to view all request data. They just won't be able to block the request and change it (I.e block content from loading)

<comment><USER4> As much as I've defended this change, I agree with you. The only justification I could see is that it might require an extra permission in an extension's manifest, but even that I'm not sure of.

If this is part of a longer-term plan to deprecate webRequest and completely remove that ability, then they should say so now.

<comment><USER4> This might create a confusing link loop, but a dev commented to explain this rationale now.

[https://twitter.com/justinschuh/status/1138889508512866304](https://twitter.com/justinschuh/status/1138889508512866304)

<comment><USER8> So lets take an alternative look at this. The justification is that this improves privacy, security and performance. For who? I use 2 extensions, an Ad Blocker (uBlock Origin) and Password Manager.

uBlock Origin has over 10M installs and the author has stated publicly that they cannot effectively do what they do if this change goes ahead. I can guarantee that uBlock Origin does more to protect my privacy, security and performance than this change. How many people have been affected by malicious extensions? I seriously doubt it's greater than 10M. So to improve the privacy, security and performance for a few, they are going to make it worse for the many.

Surely there are better solutions to tackle this problem? Maintain the API but add in additional checks/vetting for any extensions that use it.

<comment><USER3> [https://www.vice.com/en_us/article/zmdxxj/the-hack- millions-...](https://www.vice.com/en_us/article/zmdxxj/the-hack-millions-of- people-are-installing-themselves)

> _Last year, hackers phished Chris Pederick, who runs Chrome Web Developer, > an extension with over one million users. Once they had grabbed Pederick's > developer login details, they swapped his extension on the Chrome Web Store > with their own malicious version, designed to inject adverts into users' > browsers. Then in September, someone loaded the popular Chrome extension for > file sharing service MEGA with code that could steal login details for > Amazon, GitHub, Microsoft, and Google accounts, as well as pinch > cryptocurrency keys. And a malicious browser extension appears to be behind > a recent dump of private Facebook messages. Once hackers gain control over > the extension, through hacking, coercion, or otherwise, they can replace > code as they see fit._

There's a lot more where that came from.

Aside from hacking the extensions, a couple of years ago there were severe issues with people buying control of popular extensions and then converting them into malware.

<comment><USER8> So there's a few things to unpack here.

> with their own malicious version, designed to inject adverts into users' > browsers

Your very first example wouldn't be prevented by these changes.

> 42% of malicious extensions use the Web Request API

So 58% don't event need the Web Request API to do something malicious. So these changes don't really improve safety at all.

> hacking the extensions, buying control of popular extensions

Both these scenarios need to be addressed at a different level. Things like enforcing 2-factor for high value extension authors (> 100K installs or something). Also remember Google operate a walled garden here. No extension can be published on the store without being vetted. They should be identifying high profile/value extensions and subjecting them to additional checks.

For me, and I'm sure many people, my biggest threat vector is ads. They threaten my security (malicious/malware laden ads), my privacy (tracking), and performance (slow, bloated ads). My ad blocker protects me every day from this threat vector. Google are now definitively weakening mine and a lot of other peoples protection in order to improve the security of the few. To me this does not seem like a reasonable compromise, especially when there are alternative ways to address their concerns.

And I'm sorry, but I really don't trust the motivations of a company that makes billions of dollars a year off online advertising, that has publicly stated that Ad Blocking is a threat to their business model, to then be making a change that just so happens to cripple Ad Blockers.

</comment></comment></comment></comment></comment></comment><comment><USER9> > In addition to these safety concerns, there are also significant performance > costs. In most cases, these costs are not from the evaluation of the > extension script processing events, but rather from everything else > coordinating the script. That overall performance impact can be very large, > even for an extension written as performantly as possible where the > JavaScript execution time is negligible.

Cannot they just instrument the code that intercept the requests and tell the user when performances are affected? Something like "It seems that extension xyz is slowing down Chrome. Do you want to disable it? Yes No [] Do not ask anymore"

</comment><comment><USER10> Related: [https://news.ycombinator.com/item?id=20167246](https://news.ycombinator.com/item?id=20167246)

</comment><comment><USER11> No. It is incredibly hard to be cordial when you're trying to ruin the web and say that you're actually helping. I am livid. Because of content blockers the speed of web browsing has increased substantially. Because of content blockers users' security is vastly improved. ublock Origin has been doing the right thing and now you're going to make it harder. With the limits imposed by the declarative net requests at 150k developers and extensions that are safeguarding us are being hamstrung.

In addition, because of the Chrome extension team's obsession with using js workers instead of persistent processes we're going to have to deal with finding work-arounds for holding important and unencrypted things in memory. Someone brought up the issue that some extensions will have to create a newly pinned tab to the top left of the browser because of these inane bullshit rules removing the background page. Imagine a stack of pinned tabs just so your extensions can do their jobs. Does that sound dumb enough yet? Sometimes it's necessary to hold a lot of information in memory because the user actually wants the extension to do a certain task in a reasonable amount of time. They are making our jobs harder because they're too stubborn to understand that extension developers are the ones who create the magic. This is central governance at its finest.

These rules are stupid as hell.

<comment><USER3> The rule limits Google's proposing are more generous than the limits Apple puts on content blockers. Apple allows only 50K rules. And it turns out 50K rules is actually fine!

Declarative rules engines are better and preserve privacy better. This is Google following Apple's lead and doing the right thing.

<comment><USER12> > The rule limits Google's proposing are more generous than the limits Apple > puts on content blockers

And Firefox and most Chromium forks have no limit. Does that mean they have _infinite_ generosity?

Seriously, how is Apple being bad at something an argument for lowering other options to the same level? Right now I have ~200K filters enabled on this machine. EasyList alone is sitting at 90K according to uBlock Origin.</comment></comment></comment>


How to find the size of an array in C without sizeof - <AUTHOR> https://arjunsreedharan.org/post/69303442896/array-in-c <comment><USER2> sizeof is at compile time, and this method is at runtime? Or am i missing something?

<comment><AUTHOR> Yes, this is at runtime as far as I can tell</comment></comment>


California city fights poverty with guaranteed income - <AUTHOR> https://www.reuters.com/article/us-california-income/california-city-fights-poverty-with-guaranteed-income-idUSKCN1J015D <comment><USER3> 18 months doesn't seem enough. It seems we need some tech philanthropists to stump up a sizable sum to run a serious longitudinal study.

Pick 2,000 random people, split into trial and control group. Match between the trial and control group for age control, and aim to have a sizable sample at both age 18 and ages above, so we can see what happens to people already in workforce. Those about to enter it. So on.

The trial group will be guaranteed $10,000 per year until retirement. The control group will be given a suitable payment for participation - <USER2> the quarterly surveys and annual health exams. Maybe $50 for each survery and health exam plus make the health exam free if they don't have insurance.

This would cost about $200-250 million. It can be put into trust and an annuity so lucky participants know it's really going to last.

To answer the question of whether and how much expected duration affects actions of participants create two or three more smaller groups that get the $10,000 for 2 years, and five years, and ten years. Now you can see how behavior varies between them.

This is the only way to answer the UBI question, until it's done we'll have endless debates about stuff like "people will just decide not to work" etc.

<comment><USER4> Actually you would need to take 2 billionaire's one that gives the money and one that doesn't.</comment></comment>


Show HN: An iPod Classic Built Using a Modern Web Stack - <AUTHOR> http://tannerv.com/ipod <comment><AUTHOR> Feel free to check out the source code on my GitHub: [https://github.com/tvillarete/ipod-classic- js](https://github.com/tvillarete/ipod-classic-js)

I built this during my free time over the holidays and thought it turned out pretty great. Would love to hear your feedback!</comment>


Distraction, on Street and Sidewalk, Helps Cause Record Pedestrian Deaths - <AUTHOR> http://www.npr.org/2017/03/30/522085503/2016-saw-a-record-increase-in-pedestrian-deaths <comment><USER2> The main solution here is for urban planners to create streets that force drivers to slow down and also allow pedestrians to cross easily.

We already know how to do this. We know that thinner streets cause drivers to slow down. We know that bulges at intersections shorten the distance that pedestrians have to cross, limiting interactions with cars. Cities need to rebuild their streets to be safer.

The onus is on drivers to pay attention, slow down, and not kill people. It's a reasonable expectation that a human can behave in an unexpected manner. Drivers need to behave accordingly. Good urban design can guide them into doing this naturally.

<comment><USER3> Deliberately creating obstacles to free-flowing traffic (speedbumps, chicanes, etc.) just frustrates drivers and makes them more aggressive.

<comment><USER4> Do you have a study on that? But GP wasn't suggesting actual obstacles. Just cutting excess width.

</comment></comment></comment><comment><USER5> Based on driving, biking, and walking around Portland on a consistent basis; I'm pretty sure people have straight away forgotten that cars can kill them.

I often hear something like, "I have the right of way!" as a common refrain. So I just assume they'll be self-satisfied getting killed and having their headstone read, "Here lies someone who was technically right."

<comment><USER6> This sounds a lot like victim blaming to me.

<comment><USER5> Riding at night, hands removed from the handlebars, no helmet, with no safety lights or reflective gear, wearing all black, on busy street, where the only indication of there being a person present is the faint glow of their cell phone screen and the ember of a lit cigarette. Often extremely reactionary and aggressive when they have a close call. Even more so when a fellow cyclist points out how dangerous it is.

The above is a common occurrence in inner-SE Portland after hours. Especially on Thursday, Friday, and Saturday.

It's fascinating from a particular perspective.

<comment><USER6> But you were specifically talking about people who assert their legal right. Riding at night without lights is illegal in Oregon. Perhaps those cyclists can be blamed, but innocent pedestrians who have the right of way shouldn't be.

<comment><USER5> Okay. Pedestrians looking straight down at their phone, walking full stride at a street corner, making no attempt whatsoever to look for oncoming traffic and strutting out into said oncoming traffic without out so much as a stutter- step.

The above is embarrassingly coming in downtown and NW Portland.

</comment></comment></comment></comment></comment><comment><USER7> This may be controversial, but I feel an alarmingly large number of people do not know how to properly cross the street on their own. They implicitly trust the crosswalk signal without both ways and once more to the left. Even more shocking is that people will not look up from their phones when crossing the street.

We should always design our transportation networks to be as safe as possible but one should take responsibility for their own life when crossing roads that two ton missiles hurtle down. You never know when someone is going to have a heart attack, stroke, be drunk, fall asleep at the wheel, etc. when approaching a crossing. Just because the light gives one the go ahead does not make it safe.

Also, too often I see pedestrians asserting their right of way to cars. Being right isn't more important than being alive.

<comment><USER8> I agree with your comment but the report also says 82% of the fatalities occurred outside of intersections, suggesting crossings aren't the main problem.

</comment></comment><comment><USER9> > But there's new evidence today that even walking across the street is > getting more dangerous.

This is such an odd way to phrase it. Walking across the street is not more dangerous. People are acting more reckless. The amount of danger is the same as it has always been, pull your face out of your phone and look at it!

<comment><USER10> And when the texting driver runs you over?

It is worth considering, but not really worth arguing about, since we don't have the data. This NPR piece is just following the reporter's agenda and not the study. The study does not give any suggestion that pedestrians distracted by their phones are causing the increase. In fact, pedestrian deaths in the top 10 cities decreased in 2016.

<comment><USER3> As a pedestrian: Assume the approaching car won't stop.

As a driver: Assume the pedestrian at the corner will step into the road.

This is basic common sense and I don't understand why people don't get it. In the story:

 _" It is alarming," says GHSA executive director Jonathan Adkins, "and it's counterintuitive."_

It's not counterintuitive. It's entirely predictable that people who are not paying attention to their surroundings and not exercising common-sense caution and defensive behavior are going to learn the hard way.

</comment></comment></comment><comment><USER11> Clearly the solution is 50mph speed limits. Tough on crime tactics should also encourage pedestrians to pay more attention and if they do get hit darwinism solves the problem.

Though to comment more seriously. I'm sick of everyone's knee-jerk reaction of "lower speed limits". As if that makes it OK for pedestrians and cars to interact.

The correct approach to safety is better design. Ideally provide cars and pedestrians completely isolated levels and/or venues of travel. A stopgap might be the installation of 'splash guards' and covered awning style sidewalks that provide an increased physical barrier, more as a mutual reminder that crossing the line is a bad idea. Once you've done that, it should also be possible to provide some kind of barrier at crosswalk portals.

</comment><comment><USER12> I'm actually surprised the numbers aren't a lot higher.

The bike path I ride to work goes through the local university and is split into three parts: one for walking, and two cycling (one for each direction). They're clearly marked, and it gets enough traffic that most people make sure to use the correct lane.

Almost every day, though, I ride past at least one person walking in the cycling lanes, headphones on, eyes glued to their phone, not paying any attention whatsoever to where they're going. Worse still, I've seen cyclists on their phones, riding down the walk lane, or the wrong way in one of the cycle lanes.

<comment><USER11> I think Capetian America: Civil War, in the beginning of the film, featured a little safety piece about this. The "On your left" call out.

That verbal reminder is great and exactly what everyone SHOULD be doing.

<comment><USER12> I would say, "obviously,", but in reality "on your left" doesn't even help most of the time because of the headphones.

I think you're underestimating just how oblivious people can be.

<comment><USER3> THe "on your left" call-out was commonly heard on the Lake Shore Drive bike/pedestrian path in Chicago. Pedestrians, skaters, and cyclists mostly coexisted without incident. It was the pre smartphone era though when I lived there.

</comment></comment></comment></comment><comment><USER13> A lot of these deaths are actually _caused_ by drivers breaking the law. It may well be that victim distraction is increasing, but looking at that as a "cause" sounds a little bizarre.

If that's the case, these deaths will indeed decline rapidly as human (i.e., poor) drivers are replaced with self-driving vehicles.</comment>


A dangerous conflict of interest between Firefox and Google - <AUTHOR> http://news.cnet.com/8301-13739_3-9776759-46.html

<comment><USER2> What a poorly written article. The main gist of the guys argument is that since Mozilla doesn't include some Firefox ad block extensions (which he likes, and perceives to be popular), as default feature's in Firefox and those extensions might be frowned upon by Google, Mozilla must be in Google's back pocket.

His gauge of the ad blocker extension's popularity is that these extensions are "getting to be extremely popular. It has been featured in The New York Times,"

This article reads like a 9/11 conspiracy theory. Esp. when he goes on to contradict himself by pointing out that this add blocking software that he loves does a good job on banner ads but misses many of Google's text ads. If this really is the evil scheme he is hatching it out to be wouldn't Google want an extension included that easily blocked it competitors banner adds whilst letting it's text adverts sneak through?

Maybe next week he can write a follow up about how Firefox3 doesn't include the DOM Inspector by default and hypothesize that Google strong armed Mozilla into removing it so folk wouldn't be able to get at all those juicy Google HTML secrets.

<comment><USER3> actually i would like an extension that only blocked large, obnoxious ads while leaving alone google-like ads.

<comment><USER4> I agree. Small text ads, or even some banner ads (non animated please) all fine. Big popup flash animated adverts with sound, not ok.

</comment></comment></comment><comment><USER5> The post's author seems to be having a bad blogging ettique. He seemed to have edited his posts after receiving comments/feeback. And he has included the 'update' section in his post only after a reader noticed the editing and told him to do so.

@pmorici: agree with you

If G and Mozillia really wanted to get rid of the ad blocking software, they would have released a patch to somehow make the extentension unworkable.

Now for the question as to why Mozilla Firefox doesn't come with ad blocking extensions pre-installed, the answer is easy and straight. It is because Firefox base system has always been kept to the bare minimals else they could have included all the usually used plugins & extensions like Flash player, Real Player, Java Runtime Environment, etc

As for shipping with Google Toolbar, the author shouldn't be bothered about this fact since the are two versions: with google toolbar pre-installed and without google toolbar. And you can choose what you want.

Yahoo! too shipped IE7 with Yahoo Toolbar. IE as fas as I know uses MSN's "page not found" (I have IE6 on XP and haven't bothered to update it since I use Firefox)

And for using Google as the default search engine, all my non-tech friends know is "internet is google". The moment they need something... Go to firefox address bar and type google.com

Even though other search engines are beginning to have clutter free pages homepages like Google. Its Google that made its mark first with the both - good results and clutter free pages - and quickly won users(most of them now being loyal followers of any 'good' and necessary G product).

<comment><USER6> "Go to firefox address bar and type google.com"

That cracks me up, because I have told my wife about 1024 times that the little box to the right of the address bar will Google things for her!

<comment><USER5> Yeah! I recently found out a trick too.

Instead of using the small google search box, you can directly use the search phrase into the firefox address bar.

But I have noticed something: I typed "Hacker" in the address bar and I got a google search page. But when I typed "distrowatch", it took me to distrowatch.com I think the behavior of this feature is like... it takes you to a website if the term entered is not a dictionary term. If the term entered is a dictonary term is takes you to a google search results page.

I have started using this frequently since I access the address bar with F6. I just enter my search terms. I am comfortable with this since most of my searches are with non-dictionary terms like "term vector tutorials" or "how to make pizza"

:)

</comment></comment></comment><comment><USER7> >Fact: Users who enter keywords or misspelled URLs into the Firefox 2.0 location bar will essentially be running a Google "I'm Feeling Lucky" search. That is, they will be taken to the first result for a Google search query for those terms.

From which Google makes exactly $0.

</comment><comment><USER8> I can't say I'm omfortable with the conflict of interest gray area for the two organizations. That being said, this article:

* Was written in November of last year, before FF3 release and some of Mozilla's latest initiatives.

* Is really stretching things a bit in terms of good reasoning.

* Has an "axe-to-grind" tone which I don't exactly understand.

I think there's some good points to be made about this relationship, but it doesn't feel like this author really has anything to show about where that Google influence is causing much in the way of problems.

</comment><comment><USER9> Being a web designer/developer I need to see the web as my customers do, with means handy plugins like AdBlock are useless to me.

The idea that any company would include ad blocking tech in their web browser is insane. The web is built on advertising... talk about biting the hand that feeds you.</comment>


Carbon Dioxide: An Open Door Policy - <AUTHOR> http://slatestarcodex.com/2018/08/23/carbon-dioxide-an-open-door-policy/ <comment><USER2> I first heard about the subject from a gwern blog post, and I live in a pretty enclosed space so I bought this co2 monitor by netatmo (which is.. okay, I wanted more power user features), and I found co2 levels would rise from 400ppm to over 3000ppm, correlated with me waking up to turn on an exhaust fan next to my bed, and going back to sleep. I wonder if there's a max co2 level at which you cannot sleep, or if it's coincidence.

A project I'd like to try is using a PID loop to control co2 levels in my room based on sensor data and fan control.</comment>


The Unpaid Bill that Launched a Thousand Starships - <AUTHOR> http://www.giantbomb.com/articles/the-unpaid-bill-that-launched-a-thousand-starships/1100-4857/ Interesting story on that big EVE battle from last week. Talks with a lot of the involved parties. <comment><USER2> Just to point out something about this whole battle that may not be readily apparent...

The article quotes the figure that a titan (the largest type of ship in _EVE Online_ ) costs the equivalent of $1500 to produce. But that doesn't mean you can just walk into _EVE,_ plunk down $1500 to buy ISK, and walk off with a titan. Far from it.

A titan has to be assembled out of over 7,000 individual components, each of which must be bought or (more frequently) manufactured, and, if you build them, you have to have the raw materials and blueprints for them. Assuming you have all that, it would take a single player two and a half months just to assemble all the components.

 _Then_ you can start building the titan's hull, which takes 40 days. But it has to be built inside a Capital Ship Assembly Array (itself a very expensive structure), which has to be anchored with a structure in player-controlled space. And then that structure has to be _defended,_ because if someone comes along and blows up your structure, you lose the titan hull that's under construction.

And even after you _have_ a hull, that hull has to be fitted with appropriate modules, such as the Doomsday weapon, jump bridge, and any other modules that suit the pilot's fancy. That can easily run to as much cost as for the hull alone, especially if you fit the kind of modules that can only be found in- world by defeating high-ranking NPCs (or buying them on the market from someone _else_ that has).

Hell, just _learning to fly_ one of those monsters can take months of training time, and skill books that themselves carry price tags in the billions of ISK.

Only the largest and most powerful organizations in the game, alliances, can actually build or fly titans, and they tend to jealously guard them. That really underscores just how big a loss 75 of them is. Such losses cause tectonic shifts in the balance of power.

<comment><USER3> But you can totally walk into EVE, drop down enough real money to buy gametime coupons that you can sell for enough ingame money to buy a character (on the offical forums) that can fly a titan and then buy an existing titan. You don't have to bootstrap your way to your spaceship with a pickaxe and a roll of duct tape.

<comment><USER4> Right, but SOMEBODY had to.

<comment><USER2> In actual practice, no single player will construct all the components for a titan. An alliance will spread the work of building the components around, especially since some of the same components used in titans are used in other capital ships and can be allocated to building whatever is necessary.

</comment></comment></comment></comment><comment><USER5> it's a sign of the awesomeness of our times that we create such profound and significant fantasies in real time, and that people who've never played Eve (me) can read about this and be enthralled.

<comment><USER6> There's also a big trend of Let's Play videos -- people watching other people play video games on YouTube. Don't have time/money/patience/skills to play GTA V? Just watch someone else play it, start to finish.

<comment><USER7> Even if you have all of those things, sometimes it's just a hell of a lot of fun to watch a good Let's Play. Some of the better ones I remember for years, and I have a feeling that one which showed a lot of promise but was discontinued far too soon will bother me for years to come as well.

<comment><USER8> Agreed - I have to mention necroscope86 on YouTube. By far my favorite LP'er. I think he had a snafu with his account that deleted a bunch of videos, but he had some very funny X-COM play throughs. It was more about his commentary and British accent that made it worth watching than the actual games themselves.

<comment><USER7> I'll have to check them out.

Some of my favorite LPs have come from LtMkilla (Dead Space and the ill-fated Bioshock LPs come to mind). His humor probably isn't for everybody (whose is?), but I love his videos.

<comment><USER9> If we're highlighting great LPs, I'll have to throw in a recommendation for ChipCheezum's LPs of the Metal Gear Solid games. The humour is spot on, and the games themselves are covered in exhaustive detail. His LPs of Mega Man Legends and the Uncharted series are great too.

</comment></comment></comment></comment></comment></comment><comment><USER10> As always, Mittani overplays his role in the situation and tries to capture all of the spotlight.

It was another "FC" (fleet commander) that decided to go "all in". Here are a couple of Reddit AMAs with the commanders from either side.

[http://bit.ly/1jcPJfp](http://bit.ly/1jcPJfp)

[http://bit.ly/1c0M2Bq](http://bit.ly/1c0M2Bq)

<comment><USER11> Why would you use a URL shortener for reddit links? If you don't like the long ones (don't know why you'd care, but..) you can use reddit's short links.

/me hates url shorteners except for exceptional circumstances and feels they miss the entire purpose of a link

</comment></comment><comment><USER12> Eve is probably the best game around to read about rather than play.

<comment><USER13> Perhaps. I feel EVE is a bit like reading about politics.

In the same way that SC2/LoL is a bit like reading about sports

</comment></comment><comment><USER14> Weird simulation. You own a starship, have shown to be willing to use it in battle, and somehow lose it to the police once you are behind one payment, even if, presumably, you are guarding it at that moment?

Do these things come with a kill switch that the government can operate? Even if it does, how does the government take control of the ship? Remote control?

Also, if this game has one faction controlling half the universe, isn't the game effectively over, just like Monopoly often is long over before the last losing player gets eliminated?

<comment><USER15> To clear up your points: the missed payment in question was not for a single starship but for the structure that designates control over a system. Simplified, the mechanics are such that so long as this structure exists taking the system is a difficult affair that favors the defender (structures have huge amounts of hp and then a invulnerability timer that gives defenders hours to realize they are being attacked and mount a retaliation). However, fail to put the resources into it and the time consuming step of removing sovereignty from a system is removed and the battle is more equal for both parties.

The way EvE is structured lends itself to shifts in the balance of power. Just because one faction is on top today doesn't mean they will hold their position indefinitely. The victors here, for example, come from much humbler roots and, when they entered the game, played a crucial part is annihilating the current ruling power.

<comment><USER14> All thanks for the replies. Makes more sense, but I would have put it in as "this defense system needs X amounts of this rare fuel Y each Z" (or, maybe, bring a statistical aspect into it: "the Foo in your bar are wearing out faster than usual. Please make sure you have spare parts"), not as "yes, you have a zillion extremely powerful guns, but if you don't pay rent in time, we, will take your guns away from you.". This, to me, makes this universe feel like some toy system with some all-powerful entity who really is in control (a bit like Q, but less disinterested).

Also, what would an all-powerful entity need that money for? It would have to be some accountant-deity to enjoy such regular payments. Or was that apparent glitch that showed the bill as paid to some part of the fun?

</comment></comment></comment><comment><USER16> Every story I've seen said this was a 'bug'. How do we know there wasn't a spy who did this deliberately? It's hard for an outsider to tell, but some of the factors behind this appear to be a bit too convenient.

<comment><USER17> Unless you postulate a spy within the game company, I don't see how a payment that wasn't made even though multiple people checked it and thought it had been made could be the work of a spy.

<comment><USER16> Someone could've turned off the setting after they checked it or any number of similar things.

</comment></comment></comment><comment><USER18> _ISK cannot be legally exported to real-world money, however. It would mean CCP could be treated like a bank and be subject to financial regulations_

um... isn't every crypto-currency a bank then?

<comment><USER19> Yup. BitCoin is actually the currency, but companies conducting banking operations with it are subject to financial regulation of banks. Look at BitInstant. Dudes didn't follow financial regulations written for traditional currencies when conducting transactions, so Charlie Shrem and Robert Faiella got arrested.

<comment><USER20> Didn't the BitInstant guys get busted for specific allegations of money laundering?

[http://www.bbc.co.uk/news/technology-25919482](http://www.bbc.co.uk/news/technology-25919482)

<comment><USER21> That's what a lot of the money handling regulations are about. Hence why you need to declare when you're going through an airport with more than 10k of currency (USD, AUD, etc).

</comment></comment></comment></comment><comment><USER22> Thought it said startups... Starships?

</comment><comment><USER23> This is much less dry than the last version of this article that showed up on HN [https://news.ycombinator.com/item?id=7136603](https://news.ycombinator.com/item?id=7136603)

<comment><USER24> Yeah, it's chock-full of the testosterone I'd have expected to see from something like this. To wit:

 _"They put their dick on the table, and we chopped it off," said Gianturco._

</comment></comment><comment><USER25> Wow, posted by Dave himself. Hi Dave!

<comment><AUTHOR> /waves

<comment><USER26> Hello Dave!

</comment></comment></comment><comment><USER27> His friend sent him a text that said "[laughs]"?? that seems improbable

<comment><USER23> Square brackets indicate that an editor has modified a quote. [http://askville.amazon.com/purpose-square-brackets- sentence/...](http://askville.amazon.com/purpose-square-brackets- sentence/AnswerViewer.do?requestId=11214678)

</comment></comment><comment><USER28> The face that launched one thousand shits</comment>


Show HN: Statixite, a management solution for static websites - <AUTHOR> https://statixite.com <comment><AUTHOR> I originally designed and built Statixite as a service but decided to release it as an open source project. It works with Jekyll[1] sites, but with the hopes to support other generators. The main goals were to include the ability to manage multiple sites, manage posts with a markdown editor, and simplify the deployment process. Feel free to hack away at the demo[2].

I've packaged it as a Ruby gem on Github[3]. It's basically a Rails Engine that can be mounted on any Rails project.

[1]: [http://jekyllrb.com](http://jekyllrb.com)

[2]: [https://app.statixite.com/users/sign_in?demo=true](https://app.statixite.com/users/sign_in?demo=true)

[3]: [https://github.com/rlafranchi/statixite](https://github.com/rlafranchi/statixite)

</comment><comment><USER2> Too much memory usage, the website has crashed my computer.

<comment><AUTHOR> Interesting, was it a blue screen of death sort of thing?

<comment><USER2> Also, I upvoted you because I like the idea, but couldn't read enough about exactly what is your service/software.

<comment><AUTHOR> Thanks for the upvote. The front page is quite bloated so I'll take the blame for that. The backend also uses a few third party javascript libraries.

The best way to describe the service is as a combined Content Management System and Hosting Service for Jekyll sites. Here's a few of the features in more detail.

* Multi-Site management

* Template Editor - A code editor[1] to manage partials, layouts, pages, etc.

* Template Picker - Ability to pick from a handful of Jekyll themes and the ability to import from any public git repository.

* A Markdown Editor for Posts - Markdown is parsed on the fly so you can see a rough preview (Not styled to the theme).

* Site Previews - You can preview the sites before publishing them to the public. Can be considered somewhat of a staging environment.

* Media Uploader - A very simple media uploader for images. Media can be inserted into posts easily.

* Private Git Repositories for each site - You can add your public ssh key to be able to clone the sites and develop locally.

* Hosting - (Paid service) Hosting is backed by CDN enabled Rackspace CloudFiles. Deploying sites is just a simple click.

Goals:

* Support for other static site generators besides Jekyll, such as Hugo, Middleman, Pelican, etc.

* Support for Collections[2]

* Expand Open Source Project - The project basically allows anyone to run their own "Statixite" and configure their own deployment/hosting solution.

* Expand templates (Thanks Jekyll theme authors!)

* Hope to get feedback from the community :)

[1] [https://ace.c9.io](https://ace.c9.io)

[2] [http://jekyllrb.com/docs/collections/](http://jekyllrb.com/docs/collections/)

<comment><USER3> I like it! Hope to see it out of beta.

Multi site management is a dream come true for me. Great job!</comment></comment></comment></comment></comment>


What happened to 'Operation Aborted' in IE? - <AUTHOR> http://blogs.msdn.com/ie/archive/2008/04/23/what-happened-to-operation-aborted.aspx

<comment><USER2> Glad to see it go.

This was the most painful thing to get rid of because you couldn't ever isolate it. I spent entire days removing chunks of code from a page, until finally arriving at this:

Refreshing the page in the browser _still_ gave that Operation Aborted error about half the time. It's like it was cacheing the ghost of the original page and executing its scripts.

Now to wait patiently until IE7 goes away so that I don't ever need to dive into that again.

</comment><comment><USER3> this is pretty topical for me, as this started happening to us the other day after implementing a lightbox gallery javascript. good writeup.</comment>


Apple Patents Keyboard That Knows What You'll Type Before You Do - <AUTHOR> http://techland.time.com/2011/05/12/apple's-patents-keyboard-that-knows-what-you'll-type-before-you-do/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+timeblogs%2Fnerd_world+(TIME%3A+Techland) <comment><USER2> With technology from the Sirius Cybernetics Corporation! (Share and enjoy!)</comment>


Open Hardware on Its Own Doesn't Solve the Trust Problem - <AUTHOR> https://www.bunniestudios.com/blog/?p=5706 <comment><USER2> Excellent work. I completely agree that today the easiest option to develop safe hardware is using FPGAs.

Two things to look forward:

       1. Usage of open source FPGA synthesis and implementation tools
       2. Usage of open source FPGA chips :)

I've already seen some traction happening for open source FPGA tools, but open source FPGA chips are only in my head (as far as I know).

I'm a chip designer myself, and for years I have been thinking on kickstarting something to pay for a tapeout of an open source FPGA. If anyone is interested let me know, I live in Ontario/Canada.

<comment><USER3> How will you know the mask of your FPGA isn't changed?

I think that the idea behind all of this is sound but that at some point we will have to accept that there always will be some remnant of insecurity unless you are willing to create your own fab or build your CPU up out of discrete transistors which can be (1) exhaustively tested and (2) are too simple to contain anything nefarious given that there is no way to know where in a circuit that transistor will end up.

<comment><USER2> A couple things:

       1. FPGAs are easier to verify cause they are regular structures.
       2. How do you insert a backdoor in an FPGA at the supply chain if you don't know what is the exact logic that is going to be uploaded?

<comment><USER3> > How do you insert a backdoor in an FPGA at the supply chain if you don't > know what is the exact logic that is going to be uploaded?

Popularity of certain open core designs might be one way to gain advance knowledge of how an FPGA might be used.

That suggests an interesting option: to scramble the input to an FPGA in such a way that the device will still work but that it is even more unpredictable how its internal connections will be used (otherwise you could take a number of open core designs and arrange for your attack to work with those configurations, which might be detectable in hardware or in the toolchain).

Better yet, scramble the bitstream on every boot (but what would do the scrambling?).

<comment><USER4> TFA says "We rely on logic placement randomization to mitigate the threat of fixed silicon backdoors" and goes on to talk about the tools they are working on, but there is still some way to go.

<comment><USER3> Ah good catch. I must have picked it up while skimming, but it also seems kind of obvious.

</comment></comment></comment></comment></comment></comment><comment><USER5> > open hardware is precisely as trustworthy as closed hardware. Which is to > say, I have no inherent reason to trust either at all

I think the sentence should be rewritten as "closed hardware is precisely untrustworthy as open hardware", meaning that open reveals limits and assumptions while close is pretending there are none and everything is secure, while it's precisely not.

The trust imo is not in the product, is in the company or team building the product.

> I'm a strong proponent of open hardware, because sharing knowledge is > sharing power.

This is what, I think, makes a company or team more trustworthy. Not just making a product (even if it's really great and has the ambition to protect millions) but also sharing knowledge with the ambition that more can learn.

<comment><USER6> One might quibble over implications, but I think yours is basically the right take. As Bruce Schneier said: "security is a process, not a product".

</comment></comment><comment><USER7> One idea on how to verify equivalence between a design and a physical chip:

If we have the design, could we generate instruction sequences (or, in general, input sequences) and deterministically predict the time required and power consumed to execute those instruction sequences? Then we could fuzz the chip with a bunch of generated code and measure that the consumed time and power matches what we expect. Any backdoor would throw off the measurements.

Can anyone who knows hardware better comment on whether there are other kinds of attacks that this wouldn't cover?

This idea is inspired by a paper I read once which used a somewhat similar approach for verifying that a hardware system hadn't been infected by persistent firmware malware. The authors had the system compute a function which had a known memory-optimal implementation which required the use of all the persistent memory available in the system (including firmware, etc.). Unfortunately I can't find the paper now.

<comment><USER8> While power signatures are repeatable on a single-chip basis, from chip-to- chip the variation in individual transistor performance will require a tolerance to be applied on the threshold criteria for determining if a given power signature is correct or not across a population of chips. Furthermore, power consumption is also dependent upon temperature and voltage so that will need to be carefully controlled for the measurement. The wider the tolerance on the power measurement, the larger the implant that can be buried.

Unfortunately transistor performance can vary quite widely for a single design; recall that a single CPU mask design is often sold in several speed grades. These aren't different designs, they are all the exact same design but then tested to pass at a given frequency and power profile.

My intuition is that a simple implant would probably escape power characterization, and larger implants can be left off until a trigger condition is met. That condition could be made so that fuzzing is highly unlikely to hit it, e.g. a particular 64-bit number pattern has to appear in a given register to power on the implant.

The technique may be suitable to detect gross anomalous execution in a single well-characterized chip but I feel any robust criteria against false positives would also leave a sufficiently large margin for small implants to slip through undetected.

<comment><USER7> Thanks for the in-depth reply! That makes sense that the primary flaw is that nondeterministic attributes of a particular physical chip generated from a design will cause its individual characteristics to vary too widely.

It's interesting - there is a loose analogy to reproducible builds chasing down and squashing every source of nondeterminacy in software builds. I'm guessing that's not possible to do that for chip fabs for deep physics reasons + reasons of efficiency, but maybe some other trick (recording the "random seed"?) could be used... And the thought that verified chips require a verified chip fab process is appealing! But I know nothing about chip fabrication processes, so I'll leave it at that.

</comment></comment></comment><comment><USER5> Related project: [https://betrusted.io](https://betrusted.io)

(announced towards the 2nd half of the post)

</comment><comment><USER3> That may be so but if I have to choose between open source software and closed software I know which one I trust more and I would assume the same goes for open hardware, in spite of the difficulties of transferring trust at the hardware level because of the parties over which you have no control. Of course if your threat model includes parties changing the masks of your chips then all bets are off but in general more openness is better and my implicit trust in people working on open source software and hardware is at a different level than the alternative.

If only because the ones seem to be driven by altruistic motives and the alternatives have already been shown many times to be willing to sell their - and your - soul to the devil for a price.

Open source hardware would need a verification and inspection method that reliably determines whether or not the manufacturer delivered what they said they would if you want that level of trust. And even then those tools could be compromised and so on.

To put it simpler: between say Intel or AMD and 'Bunnie's chip factory' I know which one I would trust more because with Intel and AMD I _know for sure_ that there will be a bunch of misery included and with Bunnie I would at least know that he didn't include it himself and would do his best to avoid others doing it. Trust, eventually, is always going to be in people.

I'd love to see his 'non destructive method for the verification of chips' become a reality. It would be at least an interesting exercise to compare that what we have with what we should have.

And if funding is an issue, this is exactly the sort of thing where I would be very happy to throw money at a kickstarter.

<comment><USER9> > Trust, eventually, is always going to be in people.

Funny thing about trust; you can trust your enemies to behave poorly too. Trust seems to be about predictability first and foremost, and great mathematical work is being done to factor humans out of it. Autonomous vehicles are subject to a formalized version of trust already and engineers are working to get dependent type theory to do verification for them.

</comment></comment><comment><USER10> I just got rid of my Google Home devices; gave them away as Christmas gifts and noticed half of those in the gift exchange didnt want any spying devices either.

Overall I really enjoyed using them especially the digital picture frame, but as long as they are spying devices to show you creepy ads (created by Google and Amazon) then Im not interested. I wish Apple would offer comparably tech at a normal price point. If not Apple another company whose is all about privacy and the device only connects to the Internet to download and store daily weather and traffic info. It would be a home network only device that listens when you summon it and it would alert you (via email or text) that a hacker is trying to hack it if it's Internet channel for downloading info is compromised.

<comment><USER11> Obviously, any device that communicates with an untrusted 3rd party whenever it's turned on is not even trying to be trustworthy. Watching for any unexpected network traffic would be a very basic step in assessing the trustworthiness of a device.

I suppose, lacking the kind of efforts that Bunnie is making, the best you can do is start with relatively simple mass produced hardware, purchase it in a way that it can't be tampered with specifically for you, install an open- source OS which doesn't communicate with 3rd parties, check the software checksums.

Some applications, like vote counters, may not even need an Internet connection. Creating a secure system to count votes isn't something I'd like to be asked to do.

</comment></comment><comment><USER12> I think there's always another layer of trust issues no matter how trustworthy your system is.

It might be you shouldn't even trust the physical environment, even power supply can be used to do evil things. Or radiation, even ambient temperature.

Don't forget code itself can affect the environment in unobvious fashion.

EDIT: My point is that we need to be aware security will never be a solved problem. We can't also consider security as a software-only issue, but have to have a holistic viewpoint considering the _whole_ system.

There's of course the point where risk mitigation is not worth the cost. That's another matter.

<comment><USER2> You are right, but in the scope of chip design we can solve all that. What we can not solve is supply chain trust (how do you now your temp sensor has not been tampered?)

<comment><USER3> You should be able to exhaustive test a temperature sensor, it is typically a two lead passive device.

<comment><USER2> It was just a simple example. There are counter-measures WAY more complex than a simple two lead sensor. I was part of a CC certified chip design, and I can tell you we must implement tests for every single countermeasure in the chip. But still you have no means to check whether your sensor/countermeasure hasn't been tampered all together in the supply chain.

<comment><USER3> > There are counter-measures WAY more complex than a simple two lead sensor.

Fair enough.

Has there to your knowledge ever been documented evidence that a mask had in fact been tampered with in a way that caused a system to be compromised?

<comment><USER2> During a CC certification, the design-house, mask shop, and fab are certified to reduce the chances of the chip being tampered. The certification ensures that all those places have decent security practices and protocols. It helps but is quite far from completely mitigating it.

I don't have any reference of a mask being modified to give to you, but it is so easy to do it that we don't actually need evidences to be worried.

If you think about it, just by changing implantation parameters on the transistors that form a ring oscillator for generating random numbers can bias it (this does not require not even modifying the mask).

<comment><USER3> Ah yes, that makes good sense. I once built a hardware RNG and it was surprisingly hard to keep it stable over the longer term to satisfy the certification criteria. In the end I managed but it was a lot of analog voodoo and I can see how easy it would be to tamper with that in a way that would not be detectable unless you monitored the device continuously.

RNGs are a weak spot. Thank you for that example.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Ideally, any piece of open hardware would be made by multiple competing companies and they would all be perfectly interchangeable. If one was discovered to be tampered with, you could easily switch, the offending company dies, and maybe some people are actually held accountable so others would be discouraged to try it again.

While the industry is still innovating, such an ideal world may not arise, but when things settle down and just about anyone can make a competitive version of any type of chip, it could, but only if we demand open hardware now to allow that competition to start forming.

<comment><USER14> The modularity of the supply chain is part of the challenge, as Bunnie illustrated. You could have interchangeability at the chip level or OEM level, but still have the same bad actor tampering at the foundry, chip packaging house, part distributor, SMT factory, FATP factory, 3PL, retailer, or any of the shipping companies between those.

</comment></comment><comment><USER15> > open hardware is precisely as trustworthy as closed hardware

Nice work but the conclusion is absolutely unwarranted:

Security is all about mitigating risk. With closed hardware, as much as software, it becomes much easier to implement backdoors _but also_ hide who did it and when.

Unsurprising, a lot of closed source comes with spyware functions - look at the phone "app market".

By all means an FPGA is better than trusting a SoC, but this does not mean that all hardware is the same.

Management Engine is a good counterexample.

</comment><comment><USER16> Single-source ISAs of the past relied on general industry verification technologies and methodologies, but open-source ISA-based processor users and adopters will need to review the verification flows of the processor and SoC [https://semiengineering.com/will-open-source-processors- caus...](https://semiengineering.com/will-open-source-processors-cause-a- verification-shift/)

</comment><comment><USER17> Great post. A well distilled argument as to the perceived virtues of open hardware and the actual root of the trust problem. The post strikes a great balance between showing the problem of complexity and yet highlighting a feasible step in the right direction. Kudos for not ignoring supply chain issues.

</comment><comment><USER18> Wow, that talk on silicon implants was super interesting.

I commend him for continuing in this quest for trustable hardware. I more or less gave it up. I fear it wont be really possible until the tech has moved so far that we can produce silicon and PCB at home on open hardware machines...

</comment><comment><USER19> I like this subset of the Hardest Problem: trusting other human beings to get enough things right.

</comment><comment><USER20> I trust my sliderule. (This probably sounds like a snarky joke, so let me qualify it by saying I'm pretty serious.)

I'm an "Apocalyptic": I literally believe that these are the "End Times" and that our global civilization is about to tank (in ~10-50 years.) So I'm not so much worried about spooks in my chips as I am about being able to compute effectively at all, at all.

In that context, I think pretty seriously about what computer hardware will be available in a post-apocalyptic scenario. In that case chips will likely be worthless due to unavailability of datasheets.

The things that will work are sliderules and nomographs[0], henges and other geophysical "calendars", clockwork, fluidics, and relays. You _might_ be able to make discreet transistors.

See the _Clock of the Long Now_ mechanism: [https://en.wikipedia.org/wiki/Clock_of_the_Long_Now#Design](https://en.wikipedia.org/wiki/Clock_of_the_Long_Now#Design) (Although a large pitch-drop[1] "water" clock[2] would be more reliable and much simpler.)

\- - - -

Note that, if civilization _doesn 't_ collapse, the Trust Problem will become much worse as IoT advances, and, in the limit, _nanotech_... and you can't trust anything. Within the limits of physics, reality will become permeated with "ghosts", we will haunt the world with our own daemons. The Daemon- Haunted World. ("'The Demon-Haunted World: Science as a Candle in the Dark' is a 1995 book by astrophysicist Carl Sagan, in which the author aims to explain the scientific method to laypeople, and to encourage people to learn critical and skeptical thinking." [https://en.wikipedia.org/wiki/The_Demon- Haunted_World](https://en.wikipedia.org/wiki/The_Demon-Haunted_World) )

\- - - -

Maybe we _will_ develop massive interlocking computer networks that respect (your idea of) your human rights, but that's certainly not a solid projection from current trends, eh?

[0] Image search for nomograph: [https://duckduckgo.com/?q=nomograph&t=ffcm&atb=v60-1&iax=ima...](https://duckduckgo.com/?q=nomograph&t=ffcm&atb=v60-1&iax=images&ia=images)

[1] [https://en.wikipedia.org/wiki/Pitch_drop_experiment](https://en.wikipedia.org/wiki/Pitch_drop_experiment)

[2] [https://en.wikipedia.org/wiki/Water_clock](https://en.wikipedia.org/wiki/Water_clock)

<comment><USER21> _I 'm an "Apocalyptic": I literally believe that these are the "End Times" and that our global civilization is about to tank (in ~10-50 years.)_

Why do you think that?

Despite the pessimism in the US and some other parts of the developed world, global civilisation has never been healthier.

It's true that nuclear war is a possible civilisation destroying event (as it has been for ~70 years) but beyond that there are no threats that haven't been there for millennia (eg, large asteroid strikes).

Things like global warming will cause huge destruction in some parts of the world, disrupt and perhaps kill millions of people (eg, Bangladesh isn't in a great way), and probably lead to wars that kill many more.

But even this is far from a global civilisation killer.

<comment><USER22> I think that total ecosystem collapse and the extinction of wildlife is a possible scenario this century (perhaps even likely, if we continue with business as usual rather than addressing the climate crisis).

You can see how it would happen with e.g. insects dying off: [https://news.ycombinator.com/item?id=18541536](https://news.ycombinator.com/item?id=18541536)

Followed by birds that eat insects dying off: [https://news.ycombinator.com/item?id=21018916](https://news.ycombinator.com/item?id=21018916)

Followed by the death of everything that depends on birds and insects, which is probably a large percentage of the remaining wildlife. Similar extinction scenarios are plausible with ocean life.

I guarantee that this would result in the collapse of civilization if it were to occur.

This is one reason it's absolutely vital to halt greenhouse gas emissions. Loss of habitat and pesticides are also huge problems for insects and other wildlife, so dealing with global heating is necessary but perhaps not sufficient to save them, but we have a clear deadline for when we must reach carbon neutrality, so that seems like the top priority.

<comment><USER21> I think that the decrease in biodiversity is dangerous, but not threatening an extinction event yet - or at least I've never seen a credible scientist who works in that field making that claim.

(I'd also note that both of these things seem to be caused primarily by pesticide usage and other agricultural practices, not climate change)

<comment><USER20> FWIW, In re: "decrease in biodiversity"

I once saw the Monarch migration. I can try to describe it but I can't tell you what it was like. Maybe if I was a poet. Can you feel it if I say "1/m^3"? I was _within_ them. The whole world was butterflies.

It doesn't happen anymore. We killed them. We took their food. They weren't hurting anyone. We didn't mean to kill them. We did it by accident. We weren't paying attention.

A world has _already_ been destroyed.</comment></comment></comment></comment></comment>


Learn how to enjoy - <AUTHOR> http://img704.imageshack.us/img704/5219/normal701441433q.jpg This lit guy enjoying something like omegle.com <comment><AUTHOR> Open this Image and see. This will make your day.</comment>


Go: It Mostly Doesn't Suck - <AUTHOR> https://athornton.github.io/go-it-mostly-doesnt-suck/#/step-1 <comment><USER2> I always enjoy content of this style, entertaining and effective. There's no unnecessary filler and I get to laugh along the way.

I've briefly used golang before and the experience was very smooth. Will find out soon whether it continues to be painless in a more complex context.

<comment><USER3> Hate the slide presentation. Got tired of clicking through tiny chunks without knowing when it would end.</comment></comment>


Meet the man who influenced your entire breakfast this morning - <AUTHOR> https://www.cbc.ca/radio/undertheinfluence/meet-the-man-who-influenced-your-entire-breakfast-this-morning-1.5019150 <comment><AUTHOR> podcast (mp3 file, runs 00:28:50) [https://podcast-a.akamaihd.net/mp3/podcasts/undertheinfluenc...](https://podcast-a.akamaihd.net/mp3/podcasts/undertheinfluence- URcmLkFh-20190213.mp3)</comment>


The Cocktail Creationist - Story about the man behind Grey Goose - <AUTHOR> http://nymag.com/nymetro/news/bizfinance/biz/features/10816/ <comment><USER2> The article (published in 2005) says that Sidney Frank's company "can't launch a new brand of vodka or gin for the next four years." According to Wikipedia, he sold the manufacturing rights to Bacardi in 2004. His noncompete has expired - I wonder what he's working on now?

 _Edit: Guess he's not up to anything. Wikipedia: "Before his death on January 10, 2006 at the age of 86 ..."_

</comment><comment><USER3> Convincing people to pay exorbitant amounts of money for an odorless, tasteless liquid is surely one of the most brilliant marketing ideas of all time.

From <http://www.ttb.gov/rulings/97-1.htm>: The standard of identity for vodka was promulgated in 1949, in T.D. 5707, 1949-2 C.B. 252. The standard for vodka provided that it was neutral spirits distilled from any material at or above 190 proof, reduced to not more than 110 proof and not less than 80 proof and, after such reduction in proof, so treated as to be without distinctive character, aroma, or taste. Although no explicit definition of the term "distinctive" could be found in the hearing record, the testimony indicates that vodka is to be as tasteless and odorless as possible.

<comment><USER4> Different vodkas do taste different, notwithstanding the official standard, and typically the premium ones tend to be better. I have tried blind taste tests. Neutral or not, there are still trace amounts of all sorts of compounds after distillation. Cheap vodkas seem harsh and may have an aftertaste. Premium vodkas are generally smoother in character. I find potato vodkas in particular to have more of a sweet and creamy flavor profile.

</comment></comment><comment><AUTHOR> best quote: "If you meet any important people," he said, "keep in touch with them . . . And marry a rich girl. It's easier to marry a million than to make a million."

</comment><comment><USER5> I came across an interesting article "Can malt whisky be discriminated from blended whisky? The proof. A modification of Sir Ronald Fisher's hypothetical tea tasting experiment." <http://www.ncbi.nlm.nih.gov/pmc/articles/PMC1550199/> via a blog post over at [http://keepyourspiritsup-faune.blogspot.com/2008/12/grey- goo...](http://keepyourspiritsup-faune.blogspot.com/2008/12/grey-goose- effect.html)

Basically, its all about creating a _perception_ of value.

</comment><comment><USER6> I'd never even heard of Grey Goose (shows how in touch with 'hip' society I must be) but the "Stop Acting Rich" book by Stanley seemed to obsess over it. I had the audio book and it felt like he'd gone on for two hours about how dumb it was to buy Grey Goose if you couldn't afford it, and that 'real millionaires' don't buy it. I guess I'm not surprised to learn it is a very recent invention, seemingly created specifically to target the late internet- boom 'new rich' generation's desire to signal wealth.

<comment><USER7> Really though, you can get Grey Goose for thirty bucks a bottle, compared to twenty bucks for something like Absolut or maybe a few dollars less for Smirnoff. If the extra ten dollars a bottle you pay to drink the better vodka is a significant part of your budget, you'd have to be drinking _way_ too much vodka.

Now, if you're paying $300 for the same bottle of Grey Goose in order to get "VIP" table service at some nightclub, then _that_ falls into the dumbass- desire-to-signal-wealth category.

<comment><USER8> It is not just about $10 once, it is a mindset. You can use the same excuse to markup everything you buy, and you end up spending a lot more in a week/month/year than you would have.

Hey, if that is worth it to you, then no problem, but I know that it is not worth it to me. When you have drunk that $30 bottle of vodka, I would be happier with the $10 extra I have, and being just as sated.

<comment><USER7> Of course you can also use the same reasoning to buy the cheapest-available option regardless of quality in everything you do. Live in a tiny studio apartment. Wear ten-dollar Walmart jeans and whatever t-shirts you can obtain for free. But if you're earning a decent income the only result of this is that you wind up dead with millions of dollars in cash in the bank. What's the point?

Unless you're at the poverty line, it's rational to pay a bit more to get stuff that's more enjoyable. (And if you are at the poverty line, you shouldn't be buying vodka at all). Whether it's worth paying 50% more for Grey Goose rather than Smirnoff is an entirely personal decision and depends whether you actually like it better... personally I don't like vodka much anyway.

My point: there's a lot of stupid overconsumption going on out there, but Grey Goose Vodka, being a probably-better product at a modestly higher price, isn't really a good symbol of it.

</comment></comment></comment></comment><comment><USER9> If someone had asked me how long Grey Goose had been around I would of said forever - I guess that is a testament to their great marketing and pricing. Now I know the rest of the story.

</comment><comment><USER10> The only premium Vodka I would ever consider buying is Crystal Head Vodka, because you get a badass Crystal Skull after you're done drinking the Vodka!

</comment><comment><USER11> _The story, at the height of LSU's Jager boomlet, quotes kids calling the herb- infused drink "liquid Valium," and theorizing that Jager was an aphrodisiac. When Sidney Frank saw this, he flew into action, assembling a team of hot chicks, dubbed Jagerettes, and dispatching them to New Orleans bars to hand out photocopies of the story._

:\ Marketing genius? Cool. Getting rich selling date rape? Less cool.

Although I guess that goes for everyone in the alcohol industry...

Edit: Turns out date rape is one of the things you can't criticize on HN. Who knew.

Edit 2: Wow, really? I'm disgusted. You five guys are dicks. I know, I know, no greater sin than complaining about downvoting, but this is disgraceful.

<comment><USER11> For the benefit of future generations of hackers reading this, I'm not opposed to alcohol or the producers of alcohol at all. I'm in college myself, and drink to excess as often as I can get away with.

Furthermore, I love casual sex (although I can't get away with that at all these days), and I absolutely do not believe that having sex while drunk makes it "date rape".

However, I feel that modern alcohol marketing which emphasizes that getting women drunk is the only way you are ever going to get laid is despicable, and does bear at least some _very real_ responsibility for the uncounted thousands of _very real_ rapes of intoxicated women that take place every year.

And if you disagree with me about that, but can't bring yourself to use your words to say it in public, yes, that makes you a dick.</comment></comment>


Tiny Brains Grown in Labs Produce Electrical Signals Like Premature Babies - <AUTHOR> https://interestingengineering.com/tiny-brains-grown-in-labs-produce-electrical-signals-like-premature-babies <comment><USER2> Main article: [https://www.nature.com/articles/d41586-018-07402-0](https://www.nature.com/articles/d41586-018-07402-0)</comment>


Israel Accused of RFID Tag Spying on Hezbollah (Photo of RFID Tag) - <AUTHOR> https://twitter.com/KhaledAbuToameh/status/1096998936009732096 <comment><USER2> That looks rather like the regular placement of RFID-chips to track inventory or am I overlooking something?

Also how can you track someone using RFID without installing detectors everywhere?</comment>


Tesla to begin deliveries of Model Y in March - <AUTHOR> https://techcrunch.com/2020/01/29/tesla-to-begin-deliveries-of-model-y-by-end-of-first-quarter/ <comment><USER2> They'll make the model Y in Fremont because once the Model3 line moves to the new cast superstructure process enough space will be freed up for both lines to coexist because of their shared parts. The other factor is the strong market acceptance of the cybertruck means they'll need space for that and Sparks Nevada is a better choice because it won't likely share many parts with the model3/Y other than the motors.</comment>


Ask HN: Why does Booking.com have such bad reputation? - <AUTHOR> I am currently interviewing for a position at Booking.com, researching online, I found out that they have so much bad reputation about the way they treat their developers. I'm really skeptical about continuing with the interview. Are these just disgruntled employees or is their claim credible? <comment><USER2> Booking.com has a bad reputation with users as well. Just saying.

<comment><USER3> Yeah, they just sent me an email implying my hotel reservation wouldn't be complete if I didn't verify my email, but what they meant was my booking.com account wouldn't be complete until I did that. I've never used it before this but it was definitely unpleasant. Then again, I don't think that business revolves around delightful UX.</comment></comment>


Show HN: Yelp for People, Reviewing Humans, chattel.me - <AUTHOR> http://chattel.me <comment><USER2> I dont know, a set of anonymous reviews of somebody does not sound like a measure of anything related to that person.

What will these reviews really tell me?

None of the reviews in the profiles that were linked here seemed to provide an quantifiable metric of any sort unlike say a set of LinkedIn recommendations or StackOverflow reputaton points.

</comment><comment><USER3> This site is just begging to be hit with a libel suit.

Who's going to be the first to "subscribe" $CELEBRITY?

<comment><AUTHOR> there's no libel suit without libel. (i challenge you to show me the libel on chattel.me. maybe that's a bad incentive. nevertheless, what i've written holds true in spirit. 1. no one cares about this website and as a result, there's no libel on it; 2. seems that even the opportunity for anonymous speech doesn't generate the amount of vitriol one might expect (maybe there should be a "... yet" after that), perhaps redeeming this project and all of humankind with it.)

</comment></comment><comment><USER4> Interesting... if you know me, please review me, HN: <http://www.chattel.me/humen/rodrigo-guzman-san-francisco-ca>

Smalter, some feedback:

\- I was initially hesitant to share via FB/twitter. Nothing in particular about the chattel itself, rather I don't always want to throw something on my news feed without knowing exactly what it'll do and even when I do know I'm not too inclined to put stuff on my feed from 3rd party apps. It'd be good to have a different adoption vector here. When someone signs up you persuade them to try to review any of their friends already on the system.

\- The overall tone is unclear: is this where friends review friends to say things like "he's cool" or this a place where professional contacts go to say "he sucks to work with". I think the latter would be more useful and that both sites could potentially exist, but you should make it more explicit.

<comment><USER5> Personally...regarding your last point, I'd rather there was _not_ any site like that where a person can leave feedback on a person as a whole. It's like Yelp! but for people instead, and quite frankly I don't have much trust in that site. On a professional level, LinkedIn probably works as well as I'm comfortable with.

But just for the fun of it, I gave you five stars on chattel with my city reference :)

</comment></comment><comment><USER6> Shouldn't there be pictures of the people being rated? Would this be evolved to something like the hotornot sites a while back?

<comment><AUTHOR> you can find links to various people's social media profiles and find pictures there. my friend is trying to get me to couch the site more as a hotornot type site where you meet someone's social media presence and tell them what you think about it.

</comment></comment><comment><USER7> can someone comment on issues of libel?

why is the url path named "humEn"?

also, i'm not sure what you were thinking with the name. slavery?

<comment><AUTHOR> the url path is humen, because that's how rails pluralizes human. the class name is "human". this is my first rails app. i didn't bother to change it out of laziness.

yeah see above. chattel has a neutral definition and it's just that chattel is personal property that's movable. throughout us history, people have been thought of as chattel, namely slaves and women. i suppose the site calls all people chattel, and in that way it's somewhat contentless and i don't think it takes a stand on the normative value of slavery and say, women's sufferage. (although i think it's fair to say, boo, slavery, yay, women.)

i'm actually a lawyer, and i'm sure that if anyone uses this site to say horrible things about some litigious person (or just really bad things about a normal person), and people actually use this site, then i will have to deal with civil litigation. i suppose there's a moral question as to creating a site in which libel is more freely available, but i'll leave that to the moralists to duke out.

</comment></comment><comment><USER8> the marker of a good idea is when it seems rediculously obvious in hindsight. the basic premise of the site, a forum to say things about people that isn't controlled by the people, seems rediculously obvious and i'm dumbfounded that there is this huge gap in the internet.

</comment><comment><AUTHOR> hello, hn. i built a website where you can rate a human out of 5 stars and write a review of them. i remember reading an article here about who would win the war as the measure for a person's online reputation. would it be quora or stackoverflow, linkedin, twitter, etc.?

everyone here on hn recognizes, say, patio11. big burly dude, hairy chest, stalking the halls with his smoking hot cheerleader girlfriend. online reputation in the forms listed above can give a sense of how cool someone is and how nice their clothes are, but it doesn't provide much room for dissenting opinions and critique.

i built chattel.me as a reaction to high school, consensus, the level of online activity as a measure of worth, etc. on chattel.me, someone can say their piece about how great or horrible you are in spite of what the crowds have concluded. or it's like picking a restaurant via yelp -- above, say, 4 stars, a restaurant is game, but reviews can be read to determine kind apart from quality.

as far as i can tell, the internet is useful for two purposes: 1. to explore deviate sexual practices in greater detail; and 2. to rip each other the shreds anonymously. satre's famous quote is that "hell is other people", a reference to how the opinion of the other shapes the way you experience the self. i've aspired to create the "hell" on the internet.

and by hell i mean the livejournal to blogger or the myspace to facebook, where the foil to chattel.me is about.me/flavors.me, personal branding, and "beautiful design". the former are typically internet ghettos, but they're places of more raw human emotion where anything goes versus the superficiality of self-constructed narrative and advertisement. chattel.me is what some might call "hella emo".

i'm trying to speak to the nerds, rejects, losers, etc., what i was in high school and what i'm again on the high school that is the internet. nerd heros these days spend all day communicating with customers via social media, are highly popular, etc., which requires a degenerate level of engagement and polish. what happened?

fair's fair, and i've added a page for myself here: <http://www.chattel.me/humen/walter-chen-new-york-ny>. i've already scoured my mental rolodex for who would merely think of me as "meh…" to no avail, and i've hit refresh a few times. i imagine that the site's primary engagement mechanism will be neurosis and narcissism and it's working fairly well on me.

i taught myself rails and did this. check it out, and give me your deepest thoughts.

<comment><USER9> You've chosen a very unfortunate name for your project. While chattel is defined as "moveable personal property", the word has a very close association with slavery in America.

<http://en.wikipedia.org/wiki/Slavery_in_the_United_States>

<comment><AUTHOR> i've done so purposefully, although probably in questionable taste. chattel.me is a play on the word chatter and the notion of persons as products. if people are products, they they deserve corresponding scrutiny and critique.

(added stuff via edit there)</comment></comment></comment>


My Top Picks from YC Demo Day - <AUTHOR> http://immad.me/post/58927628534/my-top-5-picks-from-yc-demo-day-s2013

<comment><USER2> What is your top 5?

I added a poll to crowd-predict top performers for summer 2013 batch of YC companies. [https://news.ycombinator.com/item?id=6249141](https://news.ycombinator.com/item?id=6249141)

</comment><comment><USER3> I like the RealCrowd idea, its one I've thought about off and on several times, especially when it comes to 'specialty' commercial real estate like data centers and startup incubators. This is something that has worked well for REITs but getting into a fund can be difficult and understanding risk is even more challenging unless you know the properties the fund buys or develops.

</comment><comment><USER4> Regalii sounds like a complete fraud nightmare, be interested to see what they have in place to deal with it.</comment>


Core found something, but it wasn't a sandboxing security hole - <AUTHOR> http://www.loopinsight.com/2011/11/14/core-found-something-but-it-wasnt-a-sandboxing-security-hole/

<comment><USER2> the point is, it should have been sandboxed! What's a sandboxing security hole if that isn't one?</comment>


Google Translate invented its own language to help it translate more effectively - <AUTHOR> https://www.linkedin.com/pulse/mind-blowing-ai-announcement-from-google-you-probably-gil-fewster <comment><USER2> No, it didn't. Or, rather, if it did, then so does every human. The neural network is doing what NNs do and associating particular input patterns with particular neurons / pathways. So the same or highly similar concepts end up in the same place, which is how they are connected for the purpose of translation.

All this likely has similar analogues in the human brain. That is, I would be rather surprised if there wasn't a dedicated neural pathway identifying a banana, which fires whenever the thought of a banana is invoked. This is also where banana is associated with yellow and food and delicious etc.

Also, don't forget that in the human brain reading and listening may as well be two separate languages processed by entirely different portions of the brain. I would have to see pretty convincing evidence to believe that reading "banana" and hearing it don't at some point touch the same part of the brain where the concept and associations of "banana" "live".

</comment><comment><USER3> I disagree with the authors conclusion that it invented a new language. I know a few languages if you can see into my brain you would probably find that my brain has saved meanings of words that only my brain could understand that is not a new language. What Google translate is doing now is that it comprehends multiple languages so articulates the output in the required language.

</comment><comment><USER4> This is fascinating... I wonder how it copes with the words and phrases that don't have any meaningful translation. Figures of speech that only work within a culture because of the culture and removing that removes the context in which the phrase makes sense.

I remember a past girlfriend who had cute little phrases which I'd love to remember right now by way of example but they escape me, which made no sense when translated to English because the context that made them make sense didn't exist outside of her language.

<comment><USER2> This is known as idiomatic speech, with any particular phrase being an idiom [0]. They are absolutely a part of translating natural language, and the must be treated as a complete phrase set-piece. One of the big original advancements in Google Translate was actually exactly this: Treating the phrase as the unit of translation rather than the word. I'm sure they didn't lose that moving forward.

[0] [https://en.wikipedia.org/wiki/Idiom](https://en.wikipedia.org/wiki/Idiom)

</comment></comment><comment><USER5> For technical HN readers, I think the article[1] that the author linked is better.

After reading Google's explanation, I don't think his comment is accurate:

 _> Google Translate invented its own language to help it translate more effectively.

>What's more, nobody told it to. It didn't develop a language (or interlingua, as Google call it) because it was coded to. It developed a new language because the software determined over time that this was the most efficient way to solve the problem of translation._

That makes it sound like the middle GNMT box (alternating in blue and orange) was automatically fabricated by the algorithm. Instead, what seems to have happened is that the _existence_ of an "intermediate" representation was a deliberate architecture choice by human Google programmers. What got "learned by machine" was the build up of internal data (filling up the vectors with numbers to find mappings of "meaning").

Google programmers can chime in on this but as an outsider, I'm guessing the previous incarnations of translate was more "point-to-point" instead of "hub-&-spoke".

With the 103 languages, the point-to-point when computed as "n choose k"[2] means 5253[3] possible direct mappings. (Although one example pair such as _African Swahili_ to _Australia Aborigine_ would probably not be filled with translation data.)

With the new GNMT (the intermediate hub), you don't need a 5253 mappings. Instead of (n!/k!(n-k)!) combinations, it's just n. (However, I'm not saying that reducing the mathematical combinations was the main motivator for the re- architecture.)

An analogy would be the LLVM IR intermediate representation. One can target an "intermediate hub" language like LLVM-IR. This reduces the combinatorial complexity of all frontend programming language compilers to understand all backend machine languages. Instead of languages like Rust & Julia writing point-to-point backends to specific machine languages like x86 & ARM & Sun. The difference with Google's GNMT is that the keywords of "intermediate language" was not pre-specified by humans.

[1] [https://research.googleblog.com/2016/11/zero-shot- translatio...](https://research.googleblog.com/2016/11/zero-shot-translation- with-googles.html)

[2] [https://en.wikipedia.org/wiki/Combination#Number_of_k- combin...](https://en.wikipedia.org/wiki/Combination#Number_of_k-combinations)

[3] [https://www.google.com/search?q=(103%5E2-103)%2F2](https://www.google.com/search?q=\(103%5E2-103\)%2F2)

<comment><USER6> > Instead, what seems to have happened is that the existence of an > "intermediate" representation was a deliberate architecture choice by human > Google programmers.

Which has been proposed as a machine translation technique for many, many years.

Maybe Google are the first to learn an interlingua, but they are not the first to use the term, much less the concept.

</comment></comment><comment><USER7> What is the difference between how this neural network translates from Japanese to Korean, and just translating from Japanese to English and then English to Korean.

</comment><comment><USER8> Is it just me or do you have to have a linkedin account to read the article?</comment>


The Avatar Effect - <AUTHOR> http://online.wsj.com/article/SB10001424052748703652104574651764117659286.html?mod=googlenews_wsj <comment><USER2> For reference: <http://en.wikipedia.org/wiki/Nail_house>

Quick summary: Back when they took their communism more seriously, the PRC abolished property rights, so it was common to get property for development by simply eminent-domaining the residents off the land, usually with a "fair" compensation. Property rights are sort of entering the scene now, and it's still controversial whether someone is allowed to benefit from a rise in their property value. This, obviously, makes for a certain amount of tension between developers building a strip mall over an old neighborhood, and the one family in a one-room shack in the middle of an ongoing construction site who refuses to sell.

</comment><comment><USER3> There was a discussion here recently on the Chinese perspective of Avatar:

<http://news.ycombinator.com/item?id=1039121>

</comment><comment><USER4> It also happened in "Up."

Houses in a small "village" I used to live in in china are being demolished... probably for factories. They aren't even compensating us because we can't "prove" ownership, since they didn't have "deeds" back when my parents lived there.

I'm not really complaining, since I don't live there, and don't want to live there (the houses were basically brick with cement), but it does have some sentimental value.

</comment><comment><USER5> If you think this doesn't happen in America, please read up on the Atlantic Yards project in Brooklyn:

<http://en.wikipedia.org/wiki/Atlantic_Yards#Controversy> [http://en.wikipedia.org/wiki/Develop_Don%27t_Destroy_Brookly...](http://en.wikipedia.org/wiki/Develop_Don%27t_Destroy_Brooklyn)

The whole premise of Develop Don't Destroy Brooklyn's argument is that the Government is taking from one private owner and giving to another. The argument is that eminent domain should only be used for the Government, not to benefit a for-profit company.

It's a little too late now, since Ratner has already bulldozed the neighborhood, effectively ruining it before the argument can be settled in courts.

</comment><comment><USER6> It will be interesting to see if the "People's" government will try to limit viewings of the film; if not countrywide, then at least in certain areas. Wouldn't surprise me at all.

</comment><comment><USER7> _We suspect that neither Mr. Cameron nor 20th Century Fox (a sister company to this newspaper) had any idea of the effect their movie would have on the other side of the world._

While Cameron probably did not predict that exact scenario, I find it hard to believe that he did not see the parallels between the film he created and what's happening _right now_ all over the world as first-world countries continue to exploit the third-world at the expense of those living in it.

In this situation it's only slightly different as the conflict is within the country itself. It's not surprising the film resonates strongly with those humans who find themselves in the same shoes as the Na'vi.

See: "The real Avatar story: indigenous people fight to save their forest homes from corporate exploitation"

<http://news.mongabay.com/2009/1222-hance_avatar.html>

<comment><USER8> I saw an advert on Lovefilm, basically _McDonald's_ waffling on about promoting Avatar. McDonald's are the essence of evil capitalism, wrecking the environment and people's health, yet Cameron let them promote his film.

<comment><USER9> And why not? If you made a propaganda piece to point out the flaws in a certain sector of society, wouldn't it be deliciously ironic if you could get that sector to promote and pay for it?

<comment><USER10> and if you were part of that sector, wouldn't it be deliciously ironic to promote, pay for, and _profit from_ the piece?

<comment><USER11> No. There's no part of being a successful businessman which means you can't care about the environment.</comment></comment></comment></comment></comment>