Google Employees Uncover Ongoing Work on Censored China Search - <AUTHOR> https://theintercept.com/2019/03/04/google-ongoing-project-dragonfly/ <comment><USER2> Google execs know that as long as they have the best benefits in the industry and keep their workers cushy they'll also have complete control over them. This is because when you're at the top of the food chain, very few people are actually willing to put their money where their mouth is and take meaningful action. It's deliciously hypocritical to see Google workers here (and HN posters in general) lament Facebook workers for being morally corrupt when they continue to enable and find excuses for Google and are guilty of the same thing.

Google _will_ move forward with expansion into China. Anyone who doesn't believe that is frankly naive. The further censorship of the Chinese populace will be 100% in the name of greed and profit. But why should Googlers care? After all, those free meals, pools, video game rooms, and gyms aren't going to pay for themselves.

<comment><USER3> Pushback from employees, human rights groups, and congress has already significantly set back the project. The fight has to continue, but I don't understand your defeatism.

Source: I publicly resigned from Google over dragonfly and dedicated months of my life and income to fighting it.

<comment><USER4> I admire you courage but have you considered the possibility that you might be wrong on this? Probability that China would change anything because of lack of Google products is about zero. In fact, not having Google benefits them even more because now there is no one reviewing of any censorship rules. If Google is there (1) they can _minimize_ censorship as much as possible by pushing back frequently (2) people in China benefits from access to much better search and subsequently gets better educated over time.

Consider the fact that vast majority of search queries will not be affected by the censorship. Your actions are depriving billion+ people from these queries. Think of all the things kids could have found out about science and western literature by better search that they currently aren't.

Finally, I would to leave a note on cultural aspects. Being in western world, we _assume_ that every culture in the world wants democracy. We firmly believe that every culture resents censorship. From my contact with many asian folks, I have changed my assumptions and such belief. Chinese culture is fundamentally different. Government is not looked at some agency that people _allowed_ to govern but rather an agency that is charted to protect culture even if it is at the expense of individualism. My theory is that even if Chinese government was toppled, the replacement would still have same characteristics because that is the expectation that people have from their government.

<comment><USER5> >(2) people in China benefits from access to much better search and subsequently gets better educated over time.

This is the point I rarely heard here, or any Western communities.

As a Chinese, I was genuinely baffled when I first heard that there are people actually boycotting the re-entry of Google in China, instead of celebrating this milestone. I thought we can finally have a usable search engine.

I guess we get in the way of ideality. Oh well.

<comment><USER6> The Chinese government is uninterested in letting Western companies compete on the same ground as Chinese companies (e.g. any company with a significant market share in China vs their foreign counterparts doing business).

Entering China at the cost of 1) having to hand over personal information wholesale to the Chinese government in compliance with "local laws" (remember not to look at Xinjiang!) and 2) being forced into a losing position against local competitors like Baidu anyway is neither ethically great nor financially prudent.

In any case, Google is acting only in the interest of profit (as a for profit company beholden to shareholders), and painting it as some kind of great privilege for China to be receiving is big-headed on Google's part and a saccharine narrative justifying a purely business decision to make more money.

<comment><USER5> Agreed with you. I'm not delusional to think Google's attempt of entry is "for Chinese people", just that practically it will help. And most importantly, it won't do more harm (some other people in this thread mentioned that it may help them to "export" censorship tool to other countries, which is a valid point.)

On the other hand, I don't feel Google's departure from China in 2010 was _purely_ based on ideals either.

</comment></comment></comment></comment></comment></comment><comment><USER7> I find kind of hypocrite to reject the idea of a company working in a product that serves the Chinese market (which, btw, is ultra protectionist), while actively consuming goods that are manufactured in China.

I'm not saying that people don't have the right to morally object something like this project, but it's kind of baffling that many are loudly voicing their concerns and demonizing any company that is attempting to do something in China, while looking the other way when tweeting from their Chinese made iPhones, and writing dissenting articles in their Chinese made computers.

People should try to find better ways to calibrate their moral compass and focus their activism into more important and threatening issues. There are liberties that are being violated right here, right now.

If you think you can't work at Google because they are building a product for China, it would be pretty hard to work for any company in America, given how everything in this country is piggybacked on Chinese made goods.

<comment><USER8> While its not necessarily my opinion, the issue is not about working in/with China, its about building a censored search engine.

<comment><USER9> Why do you think censored search engine is bad? All other search engine in China have same censorship but worse quality. Why it's bad to have another censored search engine with higher quality?

Or do you want to say you can't have better search engine until the whole censorship is overhauled? If that's the case, why not first stop use oil from Middle East until the war is complete ended there?

<comment><USER10> The argument is that Google shouldn't build a censored search engine for one authoritarian state, because once it's built, it's easier for other states to ask for the same treatment. China's existing censored search engines are confined to that country, and I would also oppose any adoption of those services in the US.

(As a side note: Is it wrong of me to be suspicious of comments on HN that are enthusiastically pro-China because they have English grammar errors in every sentence? Maybe, but I'm going to do that anyway.)

<comment><USER11> > Is it wrong of me to be suspicious of comments on HN that are > enthusiastically pro-China because they have English grammar errors in every > sentence? Maybe, but I'm going to do that anyway.

I think it's wrong of you to label someone as "enthusiastically pro-China" for thinking that having access to a censored version of Google would improve the state of the Chinese search engine market (without using VPNs, anyway). That's more of an anti-China position.

If you ignore comments by Chinese people on China (presumably because you suspect them of being government shills?) you're just discounting the opinion of those with actual first-hand experience and an incentive to see things improve.

<comment><USER12> It's also worth considering that besides this thread, the only other post from that account was "Wow, GTA V IRL.". I think it's reasonable to be suspicious of the veracity of the account.

</comment></comment></comment></comment></comment></comment><comment><USER13> Google invited these long-term problems onto itself (and so did many other startups) by marketing a culture aside from their technology that got people to join them. "Do good" they said, which invited people to judge them and decide to work there based on whether they continued doing good.

Compare to other companies that were not so "hot" that just promised some less fulfilling employment, but no strong moral or global cause.

Now it has come back to bite them in an employee culture that feels the need to talk about politics at work, invite college-level-immature debate in internal forums, redirect the business with non-business-related concerns -- especially chasing each year's latest fad of social concern.

They now feel the pressure to become a more grown up company, one that has to stomach having customers who hold the same ideals as they do. But every business has to blind itself sometimes to customers who use your product in ways you didn't intend or choose to. That's the cost of being a public company.

I'm exhausted even just watching Google have to tune its morals for the new political flavor of each season. I say, all for the better, for it to act like a normal business.

<comment><USER14> A counterpoint: Google believed they could attract better engineers (which can be explained either as genuinely more skilled people, who have more ability to choose where they work, or simply more passionate people) with the "Don't be evil" policy. Oracle existed all along. Google wanted to not be Oracle.

Now, Google has decided they want contracts like they're Oracle _and_ they want staff like they're not Oracle. They can't have it both ways. It's not so much that Oracle is a more grown-up company because it learned to pursue profits and not good - it's just that it's easier to survive that way. (Hence the appearance that Oracle is a "normal" business; it's an easier way to run a business, is all, so more businesses do that.)

Nobody forced Google to be a public company. Nobody forced Google to grow as big as it did. Nobody forced Google to talk to China. They brought this on themselves, and they should have known that they couldn't do this and still remain Google.

<comment><USER15> > Nobody forced Google to be a public company

This is the relevant part.

As soon as you're public, it inevitably introduces strong pressures to pursue profit no matter its cost, as it decouples the negative social externalities corporate actions can cause from the profit made from those actions.

<comment><USER16> No it doesn't. There is no threat to google given that the majority voting control is held amongst the founders. Same for Facebook. There is no risk of a hostile takeover or being voted out by public shareholders.

<comment><USER15> Shareholders have plenty of ways of impacting corporate direction that fall far short of hostile takeovers. E.g. lawsuits; the very fact that a public company has to provide more information about its finances. There's a reason Ruth Porat was brought on after IPO and not before.

</comment></comment></comment></comment></comment><comment><USER17> I think what will end up happening is Google employees will just self-sort until there aren't enough people left in the company to oppose projects like this. People who are strongly opposed on moral grounds will leave, further strengthening management's choices. While Google is probably sad to see them go, it would be even sadder to continue missing out on the world's largest market. I doubt the employee protests will win out here in the long run.

<comment><USER11> For that reason, Googlers who oppose these kinds of projects should enthusiastically sign up to work on them, so they can have a chance at influencing the outcome. It may feel like the morally superior choice to avoid getting involved, but it just means that the dirty work is done by someone who doesn't care.

For the same reason, I don't think creating a censored search engine for the Chinese market is bad in itself. If you accept that the Chinese government isn't going to change its mind on censorship any time soon, you can still try to do your best within that constraint, e.g. by finding a site with the censored content that's not on the blacklist yet.

<comment><USER18> This is blind optimism in the face of hard facts.

If Google wants to play in China, they will have to bend to the whims of the CCP. No amount of employee foot-dragging will change that fact.

> _For the same reason, I don 't think creating a censored search engine for > the Chinese market is bad in itself._

This is one the arguments that got trotted out by Google employees last time Dragonfly made headlines. The CCP is putting people in concentration camps[1]. Dragonfly would help them do that better.

[1] [https://www.reuters.com/investigates/special- report/muslims-...](https://www.reuters.com/investigates/special- report/muslims-camps-china/)

<comment><USER11> They will have to bend, no doubt, but if they bend even slightly less than everyone else, that's still a win.

<comment><USER18> No, it's not. "Everyone else is doing it" is not an excuse to help put people in camps.

<comment><USER11> It is if you doing it puts fewer people in camps than the alternative.

<comment><USER18> The entire point of entering the Chinese market is to make money. Google will make more money doing what the CCP asks well and without question. Putting less people in camps and playing games with the CCP means less money or even losing the Chinese market.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> > We think we have an open society because we can criticize our government, > but the company we work for has far more impact on our lives, and if you > criticize them publicly they will fire you. The private sphere is still run > like a dictatorship, by thousands of petty tyrants. Source: > [https://twitter.com/existentialcoms/status/10515474130836520...](https://twitter.com/existentialcoms/status/1051547413083652096)

In this particular case, Google and other top tech companies tend not to fire employees for being too critical but still lack any sort of democratic control by their stakeholders (workers, community, etc). More on the matter: < [https://newsyndicalist.org/2017/09/30/union-cooperative- stra...](https://newsyndicalist.org/2017/09/30/union-cooperative-strategy- david-oconnell/) >

</comment><comment><USER20> While it seems like people don't like the idea of this censored search engine called Dragonfly, I wonder what people think about Microsoft's Bing. Bing is definitely running a censored version in China, or it will not survive the government regulation.

Is Bing less bad than Dragonfly in terms of censorship? or is it also bad but engineers in Microsoft care little about that?

<comment><USER21> Google is the one that matters. Priorities.

Given infinite time and resources, by all means: pursue infinite objectives.

Given finite resources, sort in impact-priority order.

search engines aren't like weeds

</comment></comment><comment><USER22> > [Sundar Pichai views] the censorship as a worthwhile trade-off to gain > access to the country's more than 800 million internet users

Citation needed.

Alternatively, Google's mission of "organizing the world's information" isn't quite complete if it continues not serving China.

Alternatively still, the real danger is not lost opportunity, but the emergence of a strong Chinese ecosystem (from network equipment all the way up to search and apps) that will steamroll Google's current Android-based hold onto the developing world.

Which would you rather believe, the CEO as a sellout who would do anything for a buck, or as a purist on a principled quest to be as useful as possible to mankind, or as a strategic leader aware of the risk of letting competition grow unchallenged?

Believe what you want about it, but neither is "news", just opinion.

<comment><USER23> Sundar has as much vision as a blindfolded mole. He is after the money, plain and simple.

Source: work at google, for ~8 years

<comment><USER24> Second that. I worked for 5 years there including directly with Sengupta (in charge of Dragonfly) and in passing with Pichai. Pichai was a politician who saw his mission in finding a balance between power groups, nothing more.

</comment></comment></comment><comment><USER25> Objective observation: What do you call censorship in other countries? Legal obligations. What is the algorithmic effect of pushing something below the first fold? The same, but global. It is nonsensical to be outraged at one and calm regarding the other. The system powering the other has always been closed, deniable, safely distant from a legal perspective... and wields far more power globally than any government, answering to nobody.

Here in China, Baidu really is terrible ... a censored Google would be useful, but one may argue it sets a poor precedent. Unfortunately, AFAIK national censorship rules are an existing feature of all major search engines...

</comment><comment><USER26> Love it when Americans make decisions for Chinese people and presume to know what they'd want. Maybe try asking them what they want. Or even just think about what you'd want if you lived in China. Living in China, you know your search engine will be censored. But still, wouldn't you want the best censored search engine that you can get?

<comment><USER27> > Love it when Americans make decisions for Chinese people and presume to know > what they'd want.

This is a discussion about Google (an American company) employees talking about one of Google's projects (as directed by the American company's leadership), but it happens to be about a product for another country.

> Living in China, you know your search engine will be censored. But still, > wouldn't you want the best censored search engine that you can get?

As many folks in China use VPNs to get around the Great Firewall, it seems like they would like an uncensored internet.

<comment><USER26> Oh certainly I think they're like an uncensored internet but unfortunately Google is not going to cause that to happen. Even with an uncensored Google you still wouldn't be able to access the links. It should also be said that while many Chinese do have VPN they are often pretty bad (SLOW!) and often break. They are also only used by more sophisticated users or enthusiastic users. Most people are too lazy to bother, cost is a consideration or they are not technical enough. I do give shout-out to Google for Outline VPN though. That is them actually doing something that is changing the game

</comment></comment></comment><comment><USER28> Just because you don't like be censored, you'd rather deprive _every_ Chinese's access to information of much much better quality. Yes, a few percent of searches will be censored, but the other 90+% of them are still miles better than Baidu's. Yet the righteous Google employees rather let people die of misinformation provided by Baidu([https://en.wikipedia.org/wiki/Death_of_Wei_Zexi](https://en.wikipedia.org/wiki/Death_of_Wei_Zexi)). They'd rather see event like this happen everyday in China: [https://www.ft.com/content/9be0b974-10e9-11e6-bb40-c30e3bfcf...](https://www.ft.com/content/9be0b974-10e9-11e6-bb40-c30e3bfcf63b). They'd rather let ordinary people comb through pages of thinly disguised ads to get to truly useful pages. They'd rather let good people be bombarded with false information by Baidu. They'd rather deny billions of people's access to vast number of educational videos on Youtube. Yeah, right, this is some people's version of justice.

Yup, political ideal certainly is more important than the quality life of billions of real, ordinary people.

What a bunch of hypocrites.

<comment><USER29> >but the other 90+% of them are still miles better than Baidu's

And you know this how, given that google hasn't operated in china for the last ten years?

<comment><USER28> [https://www.washingtonpost.com/technology/2018/10/16/google-...](https://www.washingtonpost.com/technology/2018/10/16/google- really-is-trying-build-censored-chinese-search-engine-its-ceo- confirms/?noredirect=on&utm_term=.cab0c09d7760)

Okay, let's say you don't trust Google's number, then think about this: how many web pages are about politics that are sensitive to Chinese government, and how many web pages are about our everyday life?

Edit: oh you mean quality of Google search compared with Baidu's? Well, for one, Google does not use paid listing, and there are numerous reports that compare Google and Baidu's search quality.

</comment></comment></comment><comment><USER30> Maybe this isn't what people want to hear, but there is no reason why Google should not work on some version of their search for China. Google is a huge company (one of the biggest in the world), and they need to diversify their risk by having such an endeavor in their pocket. It DOES NOT mean they need to release it, and it does not mean that even if they do, the version will look like the one they are working on right now.

</comment><comment><USER31> Why would they? Google fears China is going to create their own version of Google and will lose access to the country and possibly more of Asia. They are going to try very hard to keep their foot in the door there.

<comment><USER32> > Why would they?

Morals, perhaps.

<comment><USER31> Money will always trump morals with companies. It's not ideal but the truth.

<comment><USER33> If corporations are people, then laws are corporation's moral compass. The solution would likely be to produce regulations to provide a moral compass to corporations so that they are required to exhibit the behavior we would like them to have. Corporations are legal automatons, and need to be treated as such.

This doesn't necessarily mean we need more rules - we could easily improve regulation by creating rules with fewer, broader commands. Certainly, this would create some inefficiency, but it would be inefficiency on the commercial side, rather than the legislative one. (i.e. simpler, broader laws make certain commercial activities illegal when there might be nuanced reasons that they should be allowed, vs detailed and exhaustive regulations create more corporate opportunity but also more loopholes and regulatory surface area.)

<comment><USER34> This is pretty challenging for a multinational corporation operating in a globalized world.

The issue here is that Google is trying to produce a product that conforms to Chinese _laws_ for doing business in China. These laws are deeply offensive and immoral to many people in Google's largely-American workforce.

Trying to create a moral compass that multinational corporations can live by requires creating laws that apply to everyone on earth. Personally, I think that's a great idea. Then the hard work is in finding a set of global laws that everyone can agree on, and _that 's_ the sticking point, because peoples' moral sensibilities on earth are largely contradictory.

Americans would be quick to say "Well, we should all operate under democracy - let the people decide what these laws should be", not realizing that if we actually did world democracy 1-person-1-vote style, the legal framework they would live under would likely be some weird amalgamation of the Chinese & Indian political systems, because close to 50% of the population lives in those countries. America would get about 5% of the vote, so it's a good bet that our wishes would be ignored. Personally, though I love the _idea_ of world government in theory, I didn't sign up for those conditions. Given the general resistance to globalization by populist bodies in basically every nation on earth, most other people didn't either.

<comment><USER10> American companies have to follow American laws. If those laws are incompatible with China's then too bad, those companies can't make money in those exact ways. There's no need to fearmonger about a non-existant world government.

<comment><USER34> That gets complicated too. The way multinationals are usually setup - particularly with incompatible jurisdictions like US + China - is for a new company to be formed in the country they want to do business in, but with shares wholly owned by the parent. (In the case of China, they often need to partner with a domestic Chinese company that owns some of the shares - this is a sticking point in US/China trade relations, because it's commonly a front for industrial espionage.) Google China is not an American company; it is a Chinese company, headquartered in Beijing, that is partially owned by Google, which itself is owned by Alphabet.

If you want to block cross-border capital flows, you're looking at _a lot_ of collateral damage. Apple, Coca-Cola, Pepsi, Nike, McDonald's, KFC, Altria (Phillip Morris), and many others would lose > 50% of their revenue if they could not do business through international subsidiaries that operate according to the laws of the country that they do business in. That's a lot of American jobs lost and a lot of underfunded pension plans.

The problem with a lot of "too bad - just close the borders and have American companies build things in America for Americans" is that it ignores that the 1950s utopia they want to go back to was itself built on globalization. America was the engine of the Marshall Plan, and basically rebuilt the world after WW2. That allowed Americans of the 50s-80s to enjoy standards of living well above what the domestic economy would support. If we actually wanted to shut ourselves off from the world, the resulting economy would likely look a lot more like the America of the 1850s (before steamships made crossing the ocean a routine occurrence) or the North Korea/Cuba/Iran of today (as examples of other countries that have isolated themselves from the world economy).

</comment></comment></comment></comment></comment></comment></comment><comment> CKN23-ARIN If Google didn't use a monorepo, it would have been much harder for these employees to keep tabs on Dragonfly-related code.

<comment><USER35> I personally find it a bit suspicious that every single piece of information we have on Dragonfly has come from The Intercept, which probably got it all from a single source. And yet everyone in these threads take all this info as fact. Clearly if it was so open, we'd have a lot more sources here.

I also don't feel right making judgement on a project when I've only heard one side of the story, from a source which is clearly biased against it.

<comment><USER36> The Intercept is an obvious choice to leak this sort of information, especially given their reputation for having the backs of their sources (with one notable failure -- the NSA leak where they published raw documents leading inadvertently to an identification of the source due to printer stenography) and focus on tech/surveillance issues. The previous stories re: Dragonfly were widely corroborated by many involved at Google since the story broke and reputable sources like the NYT had significant corroborating coverage. I don't see why it's suspicious or indicative that it's coming from a single source just because the Intercept is breaking more of these stories. Anyone familiar with what's been leaked and any interest in publishing an update on this story would have little reason to send it elsewhere instead.

</comment></comment></comment><comment><USER37> Seems more like a hydra than a Dragonfly at this point.

</comment><comment><USER38> Dragonfly will fail anyway even if it enters China. Google won't be allowed to do any social, payment or map related business. By offering a search product alone, there's no way Dragonfly can compete with existing eco-system, at best, it can only achieve a market share as much as DuckDuckGo obtained in US. And internet landscape in China is way more mobile-centric, and iterates faster than US already. Not sure how a crippled Google can fit in. It makes more sense for Google to focus more on GCP in China. No need to deal with all those political stuff.

</comment><comment><USER39> Did the Author ever determine if the source images came from Drone-based WAMI or Satellite-based WAMI as originally reported? The original article in the intercept noted that the Google e-mails they had obtained showed that it was Satellite-based WAMI - which would sort of be a big deal..... AKA - who needs solar powered High Altitude Long Endurance (HALE) drone planes, blimps or aerostats to deploy Wide Area Persistent Surveillance when you can just put WAMI on Micro-sats that never come down and never blink?

</comment><comment><USER40> Did the Author ever determine if the source images came from Drone-based WAMI or Satellite-based WAMI as originally reported? The original article in the intercept noted that the Google e-mails they had obtained showed that it was Satellite-based WAMI - which would sort of be a big deal..... AKA - who needs solar powered High Altitude Long Endurance (HALE) drone planes, blimps or aerostats to deploy Wide Area Persistent Surveillance when you can just put WAMI on Micro-sats that never come down and never blink?

</comment><comment><USER41> AdSense China grew 60% last year.

Yeah Google is making a profit in China. which need some kind of tool to support it. Maybe harvest list of content you are not allowed to advertise with?

<comment><USER42> AFAIK, That's Chinese companies using AdSense to advertise in Western markets, it's not "AdSense in China". I've never seen a single Chinese website using AdSense.

<comment><USER41> Maybe the "Chinese-feeling-friendly" ads is a growing requirement in Western markets. No chinese wish to see their country is a shithole from AdSense.

</comment></comment></comment><comment><USER43> I wonder how people working for the dragonfly project are feeling. It looks like the rest of the company hate what they are doing. But if they support censorship, they might not care what other people are thinking.

<comment><USER44> A lot of people support the dragonfly project, you just don't hear about them on HN (namely, almost every Chinese people I've talked to).

</comment></comment><comment><USER45> Eh, if they ever release it we know Google being Google will just shut it down a few years later like every other new Google product they have released.

</comment><comment><USER46> This means Google has not realized the situation when the bottom line of Chinese government is touched. They will learn this lesson from China.

</comment><comment><USER47> What a joke, Google as a company (and its employees) are massive hypocrites who criticizes China for its censorship and silencing speeches and free thoughts, then they themselves silence and punish employees for not aligning with THEIR opinion and political views on things. Let's not forget the time Google fired the employee for having a different view on diversity.

</comment><comment><USER48> I miss Larry :(

</comment><comment><USER49> I don't even care what other Googlers are doing but it's the best time to deliver performance when Google is in turnmoil, I'll be securing trust of stakeholders and promotion.

I'll work overtime and crank more code, while others try to debate their moral stance

Always think about how you can benefit from a particular scenario

</comment><comment><USER50> I don't think I would want to develop a censored search engine (though I'd certainly reconsider for enough money), nor do I think it's "right" (whatever that means), but I still think that in the intetests of its shareholders, it has a moral and fiscal obligation to make as much money as possible, in perpuitity. I think this implies that Google should go into China. It's unlikely that Google would make less net profit after entering China, the blowback isn't impacting financials, and therefore, it's probably the right decision to move into China.

Personally, I think censorship ( _all_ censorship, not just political) is wrong, but if I was the CEO of Google I would be forced to either resign or go into China. And since I follow the money, I probably wouldn't resign.

<comment><USER51> > it has a moral and fiscal obligation to make as much money as possible, in > perpuitity.

This is simply untrue.

Also a 'moral obligation to make as much money as possible' is fucking hilarious.

<comment><USER50> How's that? And what is untrue about the obligations to its shareholders? Not maximizing shareholder value is illegal.

<comment><USER52> > How's that?

Someone already explained much of it to you 13 hours ago, in a reply to another comment of yours expressing the similar ideas:

[https://news.ycombinator.com/item?id=19308149](https://news.ycombinator.com/item?id=19308149)</comment></comment></comment></comment>


UCLA CS88S: Safety in the Cloud – Introduction to Cybersecurity - <AUTHOR> https://docs.google.com/forms/d/e/1FAIpQLScgGUCbNfFfg6QuShzJAUlcCueiXDqeZKF1--ba9YRTVv6tTg/viewform?c=0&w=1 <comment><USER2> We're doing training sessions for journalists and NGOs on these topics right now (I'm off to NYC tomorrow to do a big session with Erin, the Latacora people, Maciej Ceglowski, and others). Let us know if you want to compare notes; we do this work professionally.

<comment><USER3> Can you share your notes/slides that are used to train journalists and NGOS? Content vetted by security professionals can go a long way in educating the general population. Eg- In this case OP might find your notes useful, but more generally, it would be a good starting point for anyone who wants to increase awareness about security in their local communities. Given the fact that even on HN there is objectively terrible security advice and recommendations floating around, security professionals' advice needs to be heard.

<comment><USER4> A short outline of the material is here:

[https://techsolidarity.org/resources/basic_security.htm](https://techsolidarity.org/resources/basic_security.htm)

</comment></comment></comment><comment><USER5> I think this is something worth showing in your class

[https://www.xudongz.com/blog/2017/idn- phishing/](https://www.xudongz.com/blog/2017/idn-phishing/)

<comment><AUTHOR> Thanks for the suggestion! Will look into it.

</comment></comment><comment><USER6> What kind topics will you be covering? What do you mean by "The Cloud?" That's kind of an catch-all term these days.

<comment><AUTHOR> I have a course syllabus available here: [http://kfrankc.me/cs88s/USIE_Syllabus.pdf](http://kfrankc.me/cs88s/USIE_Syllabus.pdf)

<comment><USER7> That's a sharp looking PDF. May I ask what software or template you used?

<comment><USER8> I'd assume LaTeX. The wizardry is strong with this one.

<comment><USER9> I am betting on Microsoft Publisher. Isn't it hard to get the template right using LaTex?

<comment><USER10> PDF metadata confirms that you are correct, it was MS Publisher 2013.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> No programming or prior knowledge in cs is required, just an interest for a more cybersecurity-aware population! Fill out this form if you want to receive weekly updates on materials and slides!

<comment><USER11> Can you tell us a little more about the qualifications you have for teaching such a class?

<comment><AUTHOR> Hi! The seminar is part of a program at UCLA called Undergraduate Student Initiated Education (USIE); it is specifically for undergraduate students who want to teach a 1 unit seminar. I have personally taken an upper division CS course on cybersecurity at UCLA, and my professor is my faculty mentor!

<comment><USER12> Teaching something is a great way of reinforcing the material for yourself, since to end up having to conceptualize the material in a few different ways to meet your students at their own level of understanding. I think it's cool that UCLA is giving undergraduates that opportunity.

<comment><AUTHOR> Thank you for the support!

</comment></comment></comment></comment></comment><comment><USER13> Some confirmation that this isnt fake:

[http://kfrankc.me/cs88s/](http://kfrankc.me/cs88s/) links to the same form. [https://github.com/kfrankc?tab=repositories](https://github.com/kfrankc?tab=repositories) includes a photo of him and links to the same kfrankc.me

[https://scholar.google.com/citations?user=v2iJEd8AAAAJ&hl=en](https://scholar.google.com/citations?user=v2iJEd8AAAAJ&hl=en) Links to the same kfrankc.me

seems legit.

<comment><USER5> You can also check out the class schedule listed at UCLA's class listing.

[https://sa.ucla.edu/ro/Public/SOC/Results/ClassDetail?term_c...](https://sa.ucla.edu/ro/Public/SOC/Results/ClassDetail?term_cd=17S&subj_area_cd=COM%20SCI&crs_catlg_no=0088S%20%20%20&class_id=187266200&class_no=%20001%20%20)

</comment></comment><comment><USER14> > "nothing is more important to democracy than an educated electorate"

You would do a great service to the privacy scene by not using Google Docs for sign up forms! (Or in general..)

</comment><comment><USER15> Are there any deadlines involved or exams for those of us following online? Sorry if this sounds a bit off but I've never partaken in anything like this. Thanks!

<comment><AUTHOR> No worries, there were others who also asked this question! There are no exams or deadlines; I'll be simply sending out a weekly email with the slides and relevant articles that we discussed in class.

<comment><USER16> Do you have any plans to also release video of the seminar?

<comment><AUTHOR> As of right now, I don't have video setup, but I'm working on that!

</comment></comment></comment></comment><comment><USER17> Apparently you can only sign up if you have a google account?

<comment><USER5> UCLA creates gmail accounts for all students (if they don't already have one) so using Google products is standard. A lot of people are hating on him for using Google stuff, but not all of these decisions are up to him, he has to get them approved and Google is (unfortunately) pretty standard here

<comment><USER17> That's unfortunate, interesting though.

</comment></comment></comment><comment><USER18> "No programming or computer science background is required to understand the material"

No thanks.

</comment><comment><USER19> If any CS students are reading this, and want to get published, I know of a couple security-themed journals that are always looking for general interest articles. Something like "The state of security awareness within NGOs" is exactly what some are looking for. An article in a proper journal is a badge on any resume.

<comment><USER20> Could you share some of these journals?

<comment><USER19> I am involved with this one and we are always looking for good material: [http://www.issa.org/?CallforArticles](http://www.issa.org/?CallforArticles)

Our editorial board does read everything submitted. I cannot remember any article that has been published without at least some back-and-forth. I can promise that you will at least get some feedback, something many don't provide.

And for law/policy types: [http://www.americanbar.org/publications/scitech_lawyer/2017/...](http://www.americanbar.org/publications/scitech_lawyer/2017/winter.html)

</comment></comment></comment><comment><USER21> i like the fact that the course number is 88. nice.

<comment><USER5> All courses at ucla that are taught by undergrads are 88S courses, just happens to be that way interestingly

<comment><USER22> > _All courses at ucla that are taught by undergrads are 88S courses_

So kfranc is the only CS UG doing it? (Since it's listed as CS88S.)

> _just happens to be that way interestingly_

Can you or GP explain why '88' is 'interesting', or something to 'like'?

<comment><USER21> In China, "Number 88 symbolizes fortune and good luck in Chinese culture" according to Wikipedia: [https://en.wikipedia.org/wiki/88_%28number%29](https://en.wikipedia.org/wiki/88_%28number%29) which is why I thought it nice.

My original comment was downvoted and I didn't understand why. Now I think I know. I just learned that there's another really disturbing meaning of 88. It's used by Neo-Nazis as shorthand for "HH" since "H" is the eighth letter in the alphabet. (You get one guess what "HH" is shorthand for.)

That meaning is NOT nice. It's awful.

Sorry if my comment was interpreted to mean that I thought Neo Nazism or Hitler was nice. That is definitely not what I meant.

(What can I say? I've seen 88 in Chinese restaurants and stores. But I've never seen it used in a Neo Nazi way before. Ugh. Sorry folks.)</comment></comment></comment></comment>


Gates says iPad users are frustrated, iPad should be like the Surface - <AUTHOR> http://www.loopinsight.com/2013/05/06/gates-says-ipad-users-are-frustrated-ipad-should-be-like-the-surface/ <comment><USER2> Here is the general algo: Make a ton of money, surround yourself with yes- men/women, make asinine statements based on intensive market analysis (sample size of 1), use your PR machine to recast tax avoidance as philanthropy.

<comment><USER3> It's worked for centuries. It does require some amount of large-scale violence and/or business domination, that's kind of the missing ??? step you forget in your algo.

<comment><USER2> How could I forget large scale violence!

Probably need to add celebrity, which is another type of business domination.

</comment></comment></comment><comment><USER4> I know what he means. Bill wants those iPads sat in warehouses across the globe going nowhere.

</comment><comment><USER5> One thing I like to thank microsoft for is that they keep their overpriced productivity suite off the devices we actually use - iPads and Android tablets. They do that for their own selfish reasons (they are delusional enough to think it'll make surface fly off the shelves). But at the end of the day this will convince a growing segment of the device buying population that office is no longer needed - something us tech-savvy people knew for a long time.

So yeah, thanks microsoft. /s</comment>


FYI: The entire new 'Cosmos' series is now on Netflix - josh-wrale

I binge-watched it all yesterday.  This is what all educational media should be like. <comment><AUTHOR> Unfortunately it is just in the USA Netflix. Hope the rest of the world subsidiaries get it soon (in their national languages!)

<comment><USER2> I think every Netflix Canada subscriber pays for Unblock US or other proxy services.

<comment><USER3> Aren't there quite a few free unblockers?

<comment><USER2> You get what you pay for. Running a full proxy for a video streaming service ain't cheap, so don't expect a good free product.

</comment></comment></comment></comment><comment><USER4> Awesome! I have been unable to watch it due to lack of TV signal.

Is the original available for viewing anywhere?

<comment><USER5> It was available on Netflix a while ago, but it looks like it has been taken down and I don't know when they might put it back up.

It's available to stream on Youtube: [https://www.youtube.com/watch?v=dADUBcoEEHw&list=PLBA8DC67D5...](https://www.youtube.com/watch?v=dADUBcoEEHw&list=PLBA8DC67D52968201)

</comment></comment><comment><USER6> Apparently Duck Dynasty is similar to Cosmos....

</comment><comment><USER7> whudder</comment>


The brain's 5-million core, 9 Hz computer - <AUTHOR> http://biophilic.blogspot.com/2011/05/neural-waves-of-brain.html <comment><USER2> "Unlike transistors, neurons are intrinsically rhythmic to various degrees due to their ion channel complements that govern firing and refractory/recovery times. So external "clocking" is not always needed to make them run."

Transistors don't need a clock in order to run. They can in fact be set up to create their own clocks. The purpose of clocks is for synchronization across the chip so that we mere mortals can modularize the operation of a CPU. That is, clocks exist mostly so that we can think in terms of sequential gate operations (or from the programmer point of view, assembly code).

The author seems to confuse the chosen approach to designing computers (VLSI), and the actual physical capabilities of a transistor. We have opted over the last forty years to develop the CMOS logic gate way of organizing computers. There are other ways, as the brain demonstrates, but it is not clear at all that you can't do it with novel transistor topologies.

<comment><USER3> Whenever I see comparisons of the brain to a computer along with the implicit suggestion that computers will someday replicate brains, I am reminded of this passage from Leibniz's Monadology and that today's computers are but yesterday's mills:

 _"Moreover, it must be confessed that perception and that which depends upon it are inexplicable on mechanical grounds, that is to say, by means of figures and motions. And supposing there were a machine, so constructed as to think, feel, and have perception, it might be conceived as increased in size, while keeping the same proportions, so that one might go into it as into a mill. That being so, we should, on examining its interior, find only parts which work one upon another, and never anything by which to explain a perception. Thus it is in a simple substance, and not in a compound or in a machine, that perception must be sought for. Further, nothing but this (namely, perceptions and their changes) can be found in a simple substance. It is also in this alone that all the internal activities of simple substances can consist."_

[<http://philosophy.eserver.org/leibniz-monadology.txt>]

[<http://en.wikipedia.org/wiki/Monadology>]

<comment><USER4> Whenever I see Searle's Chinese Room argument, or a version of it, invoked to show that brains cannot possibly be computers I am reminded of a passage of Terry Bison's "They're Made out of Meat" [1]:

"They're made out of meat."

"Meat?"

"Meat. They're made out of meat."

"Meat?"

"There's no doubt about it. We picked up several from different parts of the planet, took them aboard our recon vessels, and probed them all the way through. They're completely meat."

"That's impossible. What about the radio signals? The messages to the stars?"

"They use the radio waves to talk, but the signals don't come from them. The signals come from machines."

"So who made the machines? That's who we want to contact."

"They made the machines. That's what I'm trying to tell you. Meat made the machines."

"That's ridiculous. How can meat make a machine? You're asking me to believe in sentient meat."

[1] [http://www.eastoftheweb.com/short- stories/UBooks/TheyMade.sh...](http://www.eastoftheweb.com/short- stories/UBooks/TheyMade.shtml)

<comment><USER3> Despite it's entertainment value, there is nothing in the passage which supports the belief that the brain is a computer (or even a "meat computer") or demonstrates why the analogy of brain as computer is logically different from brain as mill. That's not to say that the complexity of a computer may not create a more attractive analogy, but one must keep in mind that no matter attractive Camelot appears on screen, it's only a model.

<comment><USER4> You quoted a statement Leibniz made about 300 years before Turing proved that there are machines that can compute everything that is computable. I and others explained in comments below, why we have reason to believe, that computers are fundamentally different from mills and that Leibniz's argument as well as Searle's fall flat. By the way, it is not the necessarily the "complexity of a computer that may create a more attractive analogy". The physical parts of computers can be less complex than those of mills. I wonder how Leibniz would have reacted if he had been shown Google. Would he have believed, for example, that the essence for its face recognition software must be "sought in simple substance"?

For more rebuttals of the Chinese Room argument see its Wikipedia page. I like this one in particular: A guy sits in a room and waves a magnet up and down therefore creating electromagnetic waves. But you don't see light coming out. So light cannot possibly be electromagnetic waves.

</comment></comment></comment></comment></comment><comment><USER5> Just a small nitpick. While the state of the art in x86 land might be 3GHz, the IBM Power chips and I think the Z mainframes too, not sure on that, have gone far beyond that speed.

POWER6 chips reached 5.0GHz in 2008: <http://en.wikipedia.org/wiki/POWER6>

POWER7 chips however have been clocked down to 4.25GHz: <http://en.wikipedia.org/wiki/POWER7>

<comment><USER6> The limit to how fast you can clock a CPU is mostly due to how long the chains of CMOS devices run before they hit a cocked latch. Having one CMOS drive 10 other devices takes longer than having one CMOS drive only 1, so there's a standard metric called the FO4 (Fan Out of 4) that can be used to measure gate delay. IBM has often put more effort into having low fo4s for its processors (usually around 15 or) vs. x86 (around 20).

</comment></comment><comment><USER7> Hmm, so, if their metaphor really held, the brain's computation could be simulated with a 45MHz CPU? Well, let's fix this up a bit...

(1) Give it 1000 clock cycles of cpu work to simulate a single neuro-tick.

(2) The clock is actually variable 5-500Hz (from the article).

So, 500Hz*5m = 2.5GHz, at 1000 cycles required, so 2500 Ghz of CPU power. An amazon large-instance cluster box is 8 cores of xeon at 2.93 Ghz, about 110 cluster instances to simulate a brain?

<comment><USER8> Bare in mind that you also need to somehow do a brain scan with enough resolution to map every single connection if you want something functional. Also, what are you going to do about the sensory inputs (sight, hearing, nervous system). I'm sure it can't be good for a person's sanity to suddenly get completely 100% disconnected from the world.

And while a 1:1 map of the brain would maybe be feasible to do at the moment or in a few years, but very expensive (although getting ever cheaper), it's kind of like the straw-man AI researcher's answer to everything : do a neural network, repeat training set and hope that it computes what we want. Trying to flaunt your lack of knowledge and trying clever ways to avoid solving the problem yourself is just asking for trouble in so many ways.

In the end, the point is that AI is a software problem. Adding hardware will allow you a more stupid approach in solving it, but effective solutions are those that matter most.

<comment><USER9> Imitating the brain may be a matter of having enough computation power to allow a simple method to work. It reminds me of NLP where it seems we are doing a full circle back to the simple methods like Naive Bayes as they are showing better results than complex methods with enough data.

</comment></comment></comment><comment><USER10> This reminds me of Chuck Moore's 144-core, unclocked (!) colorForth CPU: <http://greenarraychips.com/home/documents/greg/GA144.htm>

I wonder when he'll catch up to 5 million.

<comment><USER11> <http://colorforth.com/blog.htm>

"Here's GreenArrays' latest receipt of GA144 chips: 12 wafers; 14561 chips; 2,096,784 computers. And the fun is just beginning."

</comment></comment><comment><USER12> At the time of this comment this article has 35 points and 0 comments. Over the past 6 months or so I've noticed a trend that the best HN worthy articles often have points : comments ratios of 5 to 1 or less. This is a clear indication of that.

<comment><USER13> For what it's worth, in the case of this article I found it very interesting, but since I only have a passing knowledge of the topics it's discussing, I don't feel there's anything I can personally contribute to a conversation about it.

It's still a great article though, and a lack of comments doesn't detract from that.

</comment></comment><comment><USER14> I've been fascinated by Buzsaki and others in complementary fields since learning of them, and I've also written down some of my own ideas on the subject, from a purely theoretical perspective at least. I can't wait for what we might see in the next few decades.

<http://guscost.com/2011/04/12/science-analog-confabulation/>

</comment><comment><USER15> My layman thinking on related subject of building brain-like computer is that currently it's possible (although expensive) to build required hardware - i.e. custom system that will have required number of connected electronic neurons, but I don't see a way to "boot it up". Human brains essentially boots from the DNA - i.e. it's layout and basic functions are predetermined by the DNA and then it gets trained for specifics. Even if we can train machine brain, how do we boot it up to the trainable state?

</comment><comment><USER16> When we finally design a simulated brain, I wonder if (1) it will be really good at spatial and behavioral behavior (balancing, motor skills, quick non- explicit decision making etc), but really bad at doing math?

Not to say we shouldn't keep trying, but we all seem to think that the best computer will evolve from solving lots and lots of partial differential equations into being like the brain, but animal brains have evolved to solve really different questions than why we have been making computers.

<comment><USER17> _Not to say we shouldn't keep trying, but we all seem to think that the best computer will evolve from solving lots and lots of partial differential equations into being like the brain, but animal brains have evolved to solve really different questions than why we have been making computers._

The thing that always strikes me as interesting about the evolution of intelligence is that it's a mostly unnecessary latecomer to the evolutionary party: plenty of things thrive in nature without anything even remotely resembling human intelligence, even plenty of large animals that function quite well in complex environments rely mostly on hard coded "unintelligent" systems in their brains.

The fact is, most of the problems that need to be solved to survive and reproduce can be solved very effectively without much general intelligence. Sure, once evolution discovers intelligence it turns out to be a very efficient way to implement a lot of functionality that would otherwise need to be hard coded, but it's not strictly _necessary_ , and nature did just fine without it for a long time.

The good news: that also means that it's unlikely that significant evolutionary pressures went into designing the complex systems responsible for intelligent thought, so they were probably accidentally "designed" via random drift. If you think about that, given the complexity of the algorithms involved, it means that the algorithm space at that level complexity is probably fairly dense with algorithms that function intelligently (where by "fairly dense" I mean that it's a lot denser than we might assume otherwise, and the solution that evolution came up with is probably not the only possible one).

That means if we ever figure out how to do a guided search through algorithms of the right complexity in the right way, we may yet stand a chance of "accidentally" discovering intelligence rather than deliberately designing it.

<comment><USER18> > that also means that it's unlikely that significant evolutionary pressures > went into designing the complex systems responsible for intelligent thought, > so they were probably accidentally "designed" via random drift

I find this unlikely. Perhaps the initial "push" towards intelligence was based in random drift, but humans' evolutionary path has actually paid quite a dear price to have the high intelligence that we have:

* Larger brains led to larger heads

* Larger heads led to the need to give birth earlier, and with more risk

* Earlier birth lead to helpless babies

* Helpless babies require much more care, and mothers become dependent on fathers

* Large brains are only very useful if trained for long periods of time leading to long, expensive and dangerous childhoods

I don't think this whole process can be explained by random drift.

I think the question of what caused pressure towards higher intelligence in our evolutionary process can be answered by competition.

Analogously, consider tree heights. A tree doesn't need to be very high at all to collect sunlight. But a tree competing with other trees can grow to tremendous heights due to competition.

When competing for resources with other similarly intelligent beings, more intelligence could definitely yield an evolutionary edge.

</comment></comment></comment><comment><USER19> Some of the comments seem to revolve around the confusion of maps with territory - CF Lewis Carroll's map "the scale of a mile to the mile" - [http://en.wikipedia.org/wiki/Map%E2%80%93territory_relation#...](http://en.wikipedia.org/wiki/Map%E2%80%93territory_relation#.22The_map_is_not_the_territory.22)

</comment><comment><USER20> The brain is also water cooled. Without proper water cooling it overheats causing segfaults and a white screen of death.

<comment><USER21> i disagree on the screen color

</comment></comment><comment><USER22> transisotr technology cannot emulate brain activity. something new and more analog oriented suits better imho

</comment><comment><USER23> nature's had a long time to sort out some decent hardware and software configurations. let's follow with computers.

</comment><comment><USER21> While it's true that some cells, e.g. pyramidals in the hippocampus can exhibit intrinsic oscillations, it's not true for most of the brain. Plus rhythms usually arise in networks, not single cells, and require the network to sustain themselves (that's why for example theta doesn't persist in vitro). Is there an example of a cell that can generate rhythms?

<comment><USER24> You are correct, single neurons are not intrinsic oscillators in vivo as far as anyone can tell. They could theoretically be -- there are ion channel combinations that would put neurons into an intrinsic oscillatory regime -- but that isn't really seen afaik.

Oscillations in the brain arise due to excitatory-inhibitory loops.</comment></comment>


Comparison of self-hosted web-based Git repository managers - <AUTHOR> http://www.slant.co/topics/1440/~what-are-the-best-self-hosted-web-based-git-repository-managers

<comment><USER2> It's interesting how GitHub, the defacto standard for hosted solutions, is considerably trailing GitLab and Stash in the self-hosted world. Something tells me the pricing has a lot to do with it. I wonder if it's not worth lowering the price to get a bigger market share.</comment>


Mapping Motor Vehicle Collisions in New York City - <AUTHOR> https://toddwschneider.com/posts/nyc-motor-vehicle-collisions-map/ <comment><USER2> Nice work, I am glad that there is a paragraph talking about exposure. Crash trends based strictly on total number of crashes are easy to predict just based on where there is more traffic. Using crashes per vehicle mile traveled for road segments or crashes per entering vehicle for intersections can help tease out trends. Controlling for severity is also important.

When I do a crash analysis for a city, one of the tasks I do regularly for my job, I generate a crash rate and severity index for each intersection. The severity index is basically a weighted average based on severity, non- injury=1, minor injury=3, and severe injury or fatality=8. The crash rate and severity index are divided to create a Severity Rate. While not perfect or statistically valid, it does help identify trends. Also, I am in a rural state so it is rare that there are enough crashes to make any statistically valid conclusions.

<comment><USER3> What's the basis for the severity weights? I'd expect the weights to be way more spread out, like 1/10/100/1000\. It would definitely not be a good trade off to eliminate nine non-injury crashes at the cost of one additional fatality. But I certainly could be missing something about this sort of evaluation.

<comment><USER4> Fatalities are a tiny minority of crashes and aren't really interesting to study because usually you basically wind up studying the behavior of drunk people and people who don't wear seat-belts and if you filter those out there's not much data left making meaningful conclusions hard to draw. Fatal accidents are often just normal accidents with a couple aggravating variables on top (e.g. person rear ends semi-truck instead of normal truck or person gets in minor accident but not wearing seat-belt) so it doesn't make sense to fixate one them. Anything that reduces normal crashes by some amount will also affect fatal crashes.

<comment><USER2> Drunk drivers and people that don't wear seat belts are still worth reviewing. While there are rarely engineering solutions to the fatalities that result, it can help inform education programs and initiatives. Amazingly, buckle-up and don't drive drunk advertising can make a difference.

<comment><USER5> They absolutely are, but are rare enough that it's difficult to reach statistical significance when talking in the aggregate. That a particular part of town went from one fatality one year to zero fatalities the next year is probably not evidence of the success of any particular safety-related policy intervention, it's just noise. Studying all crashes provides a proxy that hopefully helps decrease the odds that the fatal ones will occur will making it possible to make robust, data-driven claims about success or failure.

<comment><USER2> On a project I am currently working on, we saw pedestrian fatalities shift from 7 to 13 in consecutive years. it is a nearly 100% increase but like you said, it is just noise. This is in a city with around 100,000 residence. Convincing politicians that it is just noise is a whole different story.

</comment></comment></comment></comment></comment></comment><comment><USER6> I've worked extensively with this dataset on a similar project, [http://crashmapper.org](http://crashmapper.org), and through that process found that the data is extremely error prone. Perhaps 20% of the collisions recorded are not geocoded (e.g.lack lat, long coordinates) and don't contain other location information such as street, cross street, and zip code that could be used to geocode them. It appears that some precincts of the NYPD do a better job at recording a crash location then others. Even more of the data lacks values for "contributing factors" so it seems difficult to use as a metric for analysis. Often there is a mismatch between the total number of persons injured or killed and the number of pedestrians, cyclists, or motorists injured or killed. Furthermore, whomever maintains this dataset will periodically go back in time and update it seemingly at random, editing existing data or adding new data, potentially months or years back in time. Often it appears to be that the data maintainer is changing values for fields such as the number of pedestrians, cyclists, motorists injured or killed. Presumably this is because more information surfaced about an incident at a later point in time and the city must go back and update it. However this can result in stats from the data not aligning with the NYPD's or DOT's official stats from a previous year. I would advise anyone to keep these facts in mind if trying to use the data for analysis and policy recommendations, such is open data.

</comment><comment><USER7> Having done something similar for the Long Beach, CA area in college, one of the most interesting takeaways was the relative spatial distribution between fatal and non-fatal accidents.

Non-fatal accidents clearly clustered around high traffic areas, but fatal accidents didn't reveal the same clustering. Instead they appeared to be uniformly distributed across the city.

I'm sure there is an explanation in this, and this was only 10 years data for a single city, but it always felt a little spooky that these accidents were equally likely to happen anywhere (though most likely later in the night).

<comment><USER8> High traffic areas tend to move traffic much slower than lower density areas. Getting into a fatal traffic crash when going 15 miiles per hour in stop and go traffic is much harder than when you lose control of a car when going 50 on an empty street.

</comment></comment><comment><USER9> I'm not sure what constitutes a "collision", but in 2015, I lived on Lexington between 121 and 122 and saw the investigation of a Hit and Run of a homeless man. I talked to a couple of the witnesses who saw it happen.

This incident was at Lexington and 123rd. In the data, I do not see this incident.

</comment><comment><USER10> The question is if the highlighted area are really more dangerous or if there are just more visitors. Shouldn't one take into account the traffic counts?

BTW: there is similar (open) data for Germany: [https://unfallatlas.statistikportal.de/](https://unfallatlas.statistikportal.de/) (It clearly shows the problem I mentioned)

Update: sorry, it seems that this issue is already discussed in this thread

<comment><USER11> Yup. This is pretty much a map of population density in NYC.

</comment></comment><comment><USER12> Lots of crashes in Hell's Kitchen. That area is full of people going out to bars and restaurants, tiny sidewalks, and lots of impatient drivers trying to get through Manhattan to New Jersey.

</comment><comment><USER13> The map of total deaths includes a significant blip on the west side near Pier 40 and the Holland Tunnel, which I think is from the 2017 truck attack.

[https://en.wikipedia.org/wiki/2017_New_York_City_truck_attac...](https://en.wikipedia.org/wiki/2017_New_York_City_truck_attack)

Map: [https://imgur.com/a/jNbOv7W](https://imgur.com/a/jNbOv7W)

<comment><USER14> That area has a higher rate of incidents in general because of Brooklynites trying to avoid the excessive toll on Verrazano when leaving the city.

</comment></comment><comment><USER15> I would bet that the shadow/light patterns on Roosevelt Avenue & 94th Street, Queens cause significant visual distractions to drivers and pedestrians.

</comment><comment><USER4> Drivers mostly hit other things when there's too many things demanding their attention (poor visibility + difficult left turn + busy traffic + bikes + pedestrians = high risk of accidents) so this is probably just a heat map of intersections that are the busiest (in terms of things going on, not necessarily throughput).

I'd like to see a month by month heat map.

<comment><USER16> >Drivers mostly hit other things when there's too many things demanding their attention

And this is exactly why humans shouldn't be driving. Hopefully human driving will be banned before too long, as machines can do it so much better.

</comment></comment><comment><USER17> I would love to pay the author to do this for my city. I'm fairly certain I could get the local govt to pay up for this.

</comment><comment><USER18> Very impressive!

</comment><comment><USER19> [https://xkcd.com/1138/](https://xkcd.com/1138/)

<comment><USER20> To be fair, they mention that in the first paragraph after they introduce what the data is actually doing.

There is still a value to looking at a population-correlated heatmap in order to draw conclusions from the discrepancies between the two.</comment></comment>


Habit Labs Gets $250K To Turn Leading A Healthier Life Into A Game - <AUTHOR> http://techcrunch.com/2011/08/14/habit-labs-gets-250k-to-turn-leading-a-healthier-life-into-a-game/

<comment><USER2> Note that "Contagion Health" AKA "I Move You" (YC S10), merged with "Health Month" to form "Habit Labs". No mention of the other "I Move You" founder Andrey Petrov. I wonder whether he's involved or not.

<comment><USER3> I think Andrey left the team.

www.linkedin.com/pub/dir/Andrey/Petrov <http://twitter.com/#!/shazow></comment></comment>


'Malware' strike, thought to be from Russia, hits US combat zone computers - <AUTHOR> http://www.latimes.com/news/nationworld/iraq/complete/la-na-cyberattack28-2008nov28,0,230046.story

<comment><USER2> Sorry, guys, I'll run my antivirus in a sec.</comment>


Inside V8 - A Javascript Virtual Machine - <AUTHOR> http://channel9.msdn.com/shows/Going+Deep/Expert-to-Expert-Erik-Meijer-and-Lars-Bak-Inside-V8-A-Javascript-Virtual-Machine/ <comment><USER2> I'm a little confused by how Google plans to go back and add further optimization steps. From what I gathered from the video, they skip any IR step, and compile the javascript source straight to machine code. Lars Bak said a couple of times that the amount of code they generate was enormous.

If they skip building an IR, does that mean they intend to optimize the javascript representation itself to get performance? I'm a novice here, so I'm confused about where would they do things like unrolling loops and inlining methods if not against the IR?

<comment><USER3> I haven't watched the video yet, but it's not _that_ hard to do loop unrolling and inlining directly on the generated machine code.

It's tricky (but by no means impossible) to do this on arbitrary machine code, but in this case they control the code generator, so they can make guarantees about the structure, and if necessary they can keep track of information to make optimizing the machine code directly easier.</comment></comment>


Has Banksy Monkeyed Around with His Parliament of Chimps? - <AUTHOR> https://www.nytimes.com/2019/09/19/arts/design/banksy-auction.html <comment><AUTHOR> Maybe he's up to some more shenanigans here?</comment>


How to create persistent website? - <AUTHOR> I would love to pay some fixed amount of dollars to have some website hosted into practically eternity.<p>Is this actually possible or viable? I know that there are some solutions like IPFS or just inserting metadata into blockchain but I'm looking into something that will just work. <comment><USER2> If I were faced with this problem I would, if money allows, a trust fund that used treasury bill interest for expenses, and a non profit corporation run it.

That won't really work forever. The best bet has aways been interesting information is saved longer than non interesting all by itself.

Carving a website in stone...

<comment><USER3> Yeah, have kicked this idea around before; "everstore". The cost would initially be ridiculous, on the order of say $100/gb or $200/gb to have data stored "forever". The interest on the money paid plus lowering cost of storage mean that you really only have to get past the first 10 years after which storage is anticipated to be more or less free.

The hard part is _governance_ of the data. Stuff like, dealing with the data of deceased people, how you structure the trust, access resets (after say 10 years many many people will lose access), etc. Legal issues like laws changing around legality of content. The technical part is actually quite easy in comparison.

Trying to ensure the continuance of a human institution seems harder.</comment></comment>


Show HN:Status Scheduler - My 3 week sprint. - <AUTHOR>

Hi everyone,
I want to share my latest creation. I have a few beta users using it, but would love more feedback.
I spoke to some HN users and they suggested I revamp the layout, so I did that before posting it to the HN site.
Please check it out and let me know what you think. http://www.statusscheduler.com <comment><USER2> I like the layout...clean. I've used LaterBro before which ultra-simple and free I believe. You may want to add more screenshots of what you're offering to show a little more value ;)

<comment><AUTHOR> Did you use laterbro to publish to your facebook pages?

</comment></comment><comment><AUTHOR> here is a link : <http://www.statusscheduler.com>

</comment><comment><USER3> I never saw LaterBro, but if the complaint before was the layout, you should definitely consider it remedied.

That site is gorgeous.

<comment><AUTHOR> Thank you. Do you have a facebook page?

<comment><USER3> I do.</comment></comment></comment>


Twitter's Evolving Plans to Make Money from Its Data Stream - <AUTHOR> http://bits.blogs.nytimes.com/2015/04/11/twitters-evolving-plans-to-make-money-from-its-data-stream/ <comment><USER2> Compared to Facebook, Google+ and all the others, to me Twitter is by far the most attractive social network. Sad that they have such big problems to monetize it.</comment>


Duplicate SSH Keys Everywhere - <AUTHOR> https://blog.shodan.io/duplicate-ssh-keys-everywhere/ <comment><USER2> Related: if you don't have enough entropy when creating keys, your public keys might not be identical, but they can share primes. Sharing primes allows this cool factoring attack by DJB and others.

[https://scholar.google.com/scholar?cluster=92037504584829650...](https://scholar.google.com/scholar?cluster=9203750458482965051&hl=en&as_sdt=0,5&sciodt=0,5)

 _This paper explains how an attacker can efficiently factor 184 distinct RSA keys out of more than two million 1024-bit RSA keys downloaded from Taiwan 's national "Citizen Digital Certificate" database._

 _These keys were generated by government-issued smart cards that have built- in hardware random-number generators and that are advertised as having passed FIPS 140-2 Level 2 certification. These 184 keys include 103 keys that share primes and that are efficiently factored by a batch-GCD computation. This is the same type of computation that was used last year by two independent teams (USENIX Security 2012: Heninger, Durumeric, Wustrow, Halderman; Crypto 2012: Lenstra, Hughes, Augier, Bos, Kleinjung, Wachter) to factor tens of thousands of cryptographic keys on the Internet._

<comment><USER3> Taiwan has a citizen digital certificate process - cool !

I mean that's a seriously big advance over anything I imagined a govt capable of. Estonia was the only other place I heard even close.

And is 183 out of 2 million so bad? Just sign the next round of certificates with this lot and move on.

<comment><USER4> Portugal also has a national ID card that's a smart card and includes a key. The last time I tried to use it in the justice ministry website it required accepting a self-signed HTTPS certificate. When I reported the issue I got a "oh, just accept it and it will be fine" response from a supposedly technical person.

So yeah, these things are getting deployed in some places but I'm not too hopeful it will end up being much more than a gimmick. At least I hope not because the next step on the minds of some of these "technical" people is electronic voting and that won't end well...

<comment><USER5> There's similar problem in Kazakhstan. egov.kz is their e-government site. They issued their own root certificate and they use it to sign all users certificates. And they signed their SSL certificate with that certificate which causes it to show alarm.

Not very smart move if you ask me. If you teach users to ignore HTTPS errors, then MITM attack becomes easier because user don't see anything suspicious.

<comment><USER6> It's a dumb move from browser makers (self-signed certificates really shouldn't be the same kind of error as outright fraud). Maybe they can get the Kazakh root certificate incorporated into major browsers? But until then what other approach is possible to bootstrap it? There are obvious reasons the Kazakh government infrastructure wouldn't want to be dependent on e.g. Verisign.

</comment></comment></comment></comment></comment><comment><USER7> This is not really news, this was already discovered by Nadia Heninger and others in a paper in 2012. From their faq about their research: "We found significant numbers of insecure RSA and DSA public keys in use on the Internet: we found that 5% of HTTPS hosts and nearly 10% of SSH hosts shared keys for reasons we considered a vulnerability." See here: [https://factorable.net/faq.html](https://factorable.net/faq.html) Mostly embedded devices that auto-generate their key on bootup. There was a pretty interesting talk at ccc where part of this research is mentioned: [http://media.ccc.de/browse/congress/2012/29c3-5275-en- factha...](http://media.ccc.de/browse/congress/2012/29c3-5275-en- facthacks_h264.html#video)

</comment><comment><USER8> This also applies to those of you building "template" VMs in VMWare or Xen -- before you save that template _please_ delete the SSH keys in /etc/sshd/ so they are generated on first boot of the deployed template!

<comment><USER9> It would not surprise me if there are other bits of unique info on the template VM that need to be cleared before freezing the image, e.g. hostnames.

This is a solved problem in Windows. The sysprep tool wipes out the hostname, security keys, user accounts and a bunch of other things one can configure, so the image initializes properly the first time it's booted.

I am curious if there are similar tools for Linux & Unix that the image builders simply failed to use here, or if this points to an opportunity to build a useful tool.

<comment><USER10> cloud-init

[https://cloudinit.readthedocs.org/en/latest/](https://cloudinit.readthedocs.org/en/latest/)

<comment><USER11> +1

</comment></comment></comment></comment><comment><USER12> On the same topic, what are the other pitfalls of re-using OS images?

I can think of:

\- Hostname conflicts

\- SSH key duplication

\- Driver issues if the hardware is not the same

Are there more?

This seems like a compelling argument for bootstrapping new instances with configuration management, rather than trying to re-use OS images.

<comment><USER13> MAC Address duplication on virtual interfaces for VMs started from a template.

<comment><USER14> No (mainstream) Hypervisor does this and you'd run into networking problems pretty quickly if any of those VMs share a network.

<comment><USER15> Libvirt has serious issues with this [https://www.redhat.com/archives/libvirt- users/2014-November/...](https://www.redhat.com/archives/libvirt- users/2014-November/msg00009.html)

</comment></comment></comment></comment><comment><USER16> Another implications of this is that if a security flaw is found in this re- used image, it's trvial to write a worm, as it can very easily seek out and find vulnerable hosts.

Ooops.

</comment><comment><USER17> This is particularly problematic for virtual machines, which are starved of entropy (no sensors, audio device, etc.).

I have VM images begin without ssh host keys and have a service dependency on haveged: [http://www.issihosts.com/haveged/](http://www.issihosts.com/haveged/) and [http://security.stackexchange.com/questions/34523/is-it- appr...](http://security.stackexchange.com/questions/34523/is-it-appropriate- to-use-haveged-as-a-source-of-entropy-on-virtual-machines)

<comment><USER18> For Qemu 1.3 and later, there is VirtIORand where you can have VMs attach to a HWRNG on the hypervisor, then food that into the kernel CSPRNG. This should be imaged by default, so on first boot, each VM has enough entropy for key generation.

</comment></comment><comment><USER19> Not my domain of expertise; can someone explain why this is problematic?

<comment><USER20> If you can read the private key from just one of these machines then you can impersonate any of them.

<comment><USER21> That is: MITM SSH connections to these devices without getting any warning. Of course you first have to get in a position to MITM the person who connects to these devices.

<comment><USER22> I was surprised to learn that you can't man-in-the-middle an SSH connection if the client is using a key for authentication instead of a password:

[http://www.gremwell.com/ssh-mitm-public-key- authentication](http://www.gremwell.com/ssh-mitm-public-key-authentication)

You'd still be able to impersonate the server, but that's less useful in the general case unless you can emulate the remote machine convincingly long enough to gather useful information.

<comment><USER23> I'm not sure what you say is true. On it's face, it doesn't make any sense, if you have completely MiTM's the network connection, and can pass along traffic from each part to the other, I don't see how client key auth would prevent MiTM.

Even the thing you link to actually says:

> The algorithm itself does not protect against active MITM attack, but it > makes it impossible for MITM attacker to influence the choice of the shared > key (and by extension the session ID) by the victims.

Does not protect against active MITM attack. It _does_ keep an attacker from influencing choice of shared key, but an active MITM attack is still in the middle and doesn't need to influence choice of shared key to mount many many kinds of attacks.

<comment><USER24> The pubkey authentication will fail because the signature is over the session key. If there's a MITM going on then each side will see a different session key. Check out the RFCs 4253 and the auth one (425?)

<comment><USER25> I'm confused by this. I know that HTTPS is supposed to be fixing this problem too supposedly. But I don't understand how. If an attacker fully replicates a SSH server, and responds to all client messages with the victim correctly, while then relaying their commands to the real SSH server, and acting as a full SSH client, isn't there still an issue?

The attacker just has to authenticate with the correct signature to each, but if it's an attacker, why would it just pass along the victim's data anyway? The whole point of an MITM is that you can modify data before it hits its target.

<comment><USER26> In the hypothetical scenario the attacker doesn't have the client's private key so it can't authenticate to the server. It can pass along the session key from the server but then it won't be able to read the data.

<comment><USER23> Ah, I get it now. It's not just the authentication step, it's the fact that the data is encrypted so only the original client can read it? That's right?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> What about "personal" private keys? I find it a hassle to add new keys for every device to each host I ssh into, so I usually just end up copying them from device to device..

<comment><USER28> Are you talking about SSH host keys? Those are normally generated automatically, and should be unique for each server.

(These are the things you're asked to verify the first time you connect to a new server.)

<comment><USER27> Sorry, meant my key, the one I use to connect with and have added the public part of to numerous servers.

<comment><USER28> There's nothing wrong with adding your public key to many servers, as long as you keep the private key secure -- almost everyone does this. The article is discussing sharing of SSH host keys, which allows impersonation of an SSH server.

</comment></comment></comment></comment><comment><USER29> I'm not sure how I feel about Shodan. Their statistics are interesting, but apparently the primary use is finding vulnerable systems and matching exploits?

This is the list of most popular searches: [https://www.shodan.io/explore](https://www.shodan.io/explore)

</comment><comment><USER30> Given the purpose of the key, this doesn't necessarily seem like a security flaw. If individual owners ssh on to the system, then it is a flaw, but if the primary purpose is to allow system updates, this seems like a perfectly reasonable approach.

</comment><comment><USER31> This was also the case with Digital Ocean's droplets on Debian for a time (they were re-imaging without re-genning keys.) It's not as uncommon as it sounds.

Userify (cloud ssh key manager) is getting a feature to force re-generation of server-side keys across an entire cluster remotely.

</comment><comment><USER24> I'd suggest that a larger security issue is that the 250,000 hosts are unnecessarily running SSH to the world. A MITM issue doesn't matter if noone's using the connection!

</comment><comment><USER32> Dumb question, why not have all processors contain a new hardware RNG based on thermal noise or some such thing? That was even VMs can get some stable entropy.

<comment><USER31> Great point. and Intel's and AMD's black box RNG generators (RDRAND etc) provide entropy... but they're thought to be compromised (which would be nearly impossible to detect). At least other firmware attacks would/should/might be detectable. By definition, RNG's produce unpredictable output -- detecting predictability is much harder than with other potential attacks (versus, for example, the sum of two numbers, which should always give the same result).

So, FreeBSD and Linux both use hardware RNG's as entropy inputs and mix-in other sources of entropy as well (which hopefully mitigates any loss of available entropy and also adds in other believed-good sources of entropy such as timing, network traffic, etc).

Ubuntu is using a new network-attached source of entropy which is itself constantly reseeded with the network traffic used to access it. (There's some inception joke there somewhere..) Of course, you may not be able to rely on the SSL/TLS connection that you're using to access it, so you might be seeding with an attacker's steady stream of 1's...

Of course, getting access to real hardware entropy in a hypervisored or virtualized cloud server/instance is the second part of the problem.

The third part is to make sure that SSH server and client keys are distributed properly. That's what Userify is for, but it really only helps with the client/user keys.. it doesn't help with server keys. (Yet?)</comment></comment>


Tony Fadell's Struggle to Build Nest - <AUTHOR> http://daringfireball.net/linked/2016/03/24/the-information-tony-fadell-nest <comment><AUTHOR> As someone working at a consumer hardware company, it's easy to see how you can get bogged down by details and micromanagement, like Tony Fadell seems to have done at Nest. Hardware seems to involve so many more things to focus on and perfect when compared to a SaaS product.

</comment><comment><USER2> Its hard to put any credibility into scandalous stories like this because there's always 2 sides to a story.

If this was really true, I can't imagine why anyone with multiple options to work elsewhere would tolerate his BS.

Personally, I don't care even a bit about Nest. My $30 non programmable thermostat is just perfect. If his head is bloated over that invention, he needs to get it checked.

<comment><USER3> I used to work there, not very long ago. When the last HN thread happened where someone mentioned PTSD from Tony's yelling, I was thinking to myself 'wow that's stretching it'. A day later I realized I had been in the same boat all along, with mini-Tony's on my team (boy were they worshipped as stars..), and the only thing that had prevented me from accepting that PTSD remark was association as I still worked there. I quit soon after and while I have a new job with a nice team, it has taken quite a bit of therapy to get over the scars from micromanagement, f-bomb language and other artefacts.

<comment><USER4> Tony is most definitely /not/ a leader. Firsthand experience here from what amounted to an attempted takeover of another team inside of Google. He came, said our work was shit, said we were going to start from scratch, and shortly after, lost nearly the entire software division.

</comment></comment></comment><comment><USER5> which it to say: don't these type of pieces usually come out as part of a structured public relations campaign that culminates in an announcement that the company is for sale?

</comment><comment><USER6> How many people are working no the nest thermostat and how many years will they take to finish it? I haven't seen anything new come from them in a while.

</comment><comment><USER5> wait is google trying to sell off nest?</comment>


Get ready for GitHub Universe - <AUTHOR> https://github.com/blog/1955-get-ready-for-github-universe-october-1-2-in-san-francisco

<comment><USER2> Quite an exciting development! I'm surprised it's taken this long for GitHub to make a splash with an event like this (it's not their first event but seems to be the first of this nature). I wonder how it'll compare to something like OSCON.

</comment><comment><USER3> cant find the talk list yet. being in SF and being github i suspect it may attract quite a wide range of ppl, which could be interesting</comment>


Company sued EFF over "Stupid Patent of the Month;" EFF now flips the script - <AUTHOR> https://arstechnica.com/tech-policy/2017/04/eff-sues-classic-patent-troll-in-fracas-over-stupid-patent-of-the-month-post/ <comment><USER2> Someone really should patent "a method for identifying and litigating on patent infringement".

</comment><comment><USER3> What a scummy company.</comment>


Tracking one author across multiple publications. Possible? - <AUTHOR>

Let us say I like an author. Ed Glaeser, an economics professor at Harvard. He contributes regularly to Economix (economix.blogs.nytimes.com), but he also writes for other publications. E.g., an article in TNR ( http://www.tnr.com/article/books-and-arts/what-city-needs?page=0,1 )
Unless Glaeser maintains a Twitter feed or a blog and updates it when he's written something new, there's no comprehensive way to track his mainstream publications. (He has neither.)
Has someone developed a method of aggregating content like this and consolidating it in the form of an RSS feed or tweet stream? <comment><USER3> This covers news sites: [http://news.google.com/news?ned=us&hl=en&q=author:%2...](http://news.google.com/news?ned=us&hl=en&q=author:%22Edward+L.+Glaeser%22&scoring=n)

<comment><AUTHOR> Cool, that works pretty well, actually. Except that it doesn't index quite a few blogs. I did create my own RSS feeds for a couple of people, though. Double excellent that if the entries are dupes in Google Reader, reading an entry in one section causes it to disappear from the other.

</comment></comment><comment><USER4> hi, my startup will allow you to track authors across multiple sources - <USER2> at launch - but within the next few months.

</comment><comment> onreact-com Create a FriendFeed account dedicated to him and add his RSS feeds :-)

Or try Yahoo Pipes.

<comment><USER5> Yahoo Pipes is yummy for this sort of the thing--the Willy Wonka GUI will make your day. It's what I use to gather my favorite webcomics into a single massive feed.</comment></comment>


How not to lose family photos and videos in the next 10 years. - <AUTHOR> http://osherove.com/blog/2014/1/28/why-i-am-not-likely-to-ever-lose-my-family-photos-and-videos.html

<comment><USER2> > Total cost for managing all my files ever: $65-$75 a month.

Lowest Newegg price for 1T external USB hd (2014-01-28): 69.99.

Buy one 1T USB drive from Newegg every 2 months (half the cost of $75/month).

Backup Windows 1T drive to each in turn.

After 1 year, have seven redundant copies of the data (1T drive in Windows machine, plus six redundant external HD copies, if each drive is refreshed every 2 months to include the full dataset at that time).

Half the cost per month (69.99/2 months vs. 75/month).</comment>


Should you use JavaScript or CSS - <AUTHOR> http://alexsblog.org/2014/07/27/should-you-use-javascript-or-css/

<comment><USER2> My approach is (1) use CSS for as much as I can, (2) fill in the important compatibility gaps with JS (polyfill style) then (3) use JS to layer on any extra behaviours. That approach seems to play the best with the widest variety of configurations, and everybody gets something at least 80% usable. (With exceptions; I'm not talking about pure JS 'apps'.)

My thinking with the above is that CSS code paths in the browser are (with a very few exceptions) going to be a lot faster than trying to do the same in JS, and you don't have to wire up e.g. onresize handlers yourself.

Some things I'll just ignore; if your browser doesn't support border-radius or text-shadow, you get square corners and flat text; if your browser doesn't support box-sizing, the layout will be wrong but at least everything will still be visible.</comment>


Antiobjects - <AUTHOR> http://en.wikipedia.org/wiki/Antiobjects <comment><USER2> Now I remember why this seems so familiar ...

I used a similar method to the pacman solution to make a simulation of traffic. By modelling the road as well as the cars, I could measure the distance between cars by having the road remember when a car last passed over, and give that information to the next car that passes over. The simulation was enormously simpler by modelling the road and storing information in that, rather than just in the obvious objects - the cars.

In effect, cars left traces behind for the next cars to collect and process. Distances between cars could be calculated simply by knowing the times of transits and speeds of cars. Uncertainties needed to be taken into account, but the road could also contain pointers/references to the cars that had passed over.

In my case I distributed the simulation over 1024 processors and the messages were explicit. I find object-oriented programming largely to miss the point. As Alan Kay once said, the point was never the objects - it was always intended to be about the messages.

Of course, that's a religious argument, and probably better discussed elsewhere.

ADDED IN EDIT: I really ought to write up some of my experiences ...

<comment><USER3> Rambling thoughts your comment triggered:

When we model position of things in code, we often put the position within the thing being modeled - car, game character, window, etc. So you can do things like: aCar.position - but I think that might be conceptually wrong and have been thinking that for a long time but haven't had much chance to explore the idea.

The idea of putting the responsibility for (eg.) location of each object within the world into the world itself seems to fit better with reality, too. After all, in our physical reality there's rules that "the world" imposes on things within it. One big one is that only one physical object (atom or what- have-you) can exist in a given location in space at a given time. Having the location of an atom in space be stored in the atom itself would seemingly make it a lot more difficult to make sure that rule goes unbroken and, arguably, can't be how the universe works as we seemingly cannot "see" location encoded within physical objects in our universe (that I know of). Therefore the location of a thing is probably "stored" within the fabric of the universe itself...

Anyway... If you write up your experiences, please post them to HN - I'm betting they'd be interesting!

<comment><USER4> _When we model position of things in code, we often put the position within the thing being modeled - car, game character, window, etc. So you can do things like: aCar.position - but I think that might be conceptually wrong and have been thinking that for a long time but haven't had much chance to explore the idea._

But of course, you can have this API and delegate the responsibility of calculating the position:

       class Street {
           has 'cars';
           method add_car(){
               $car = Car->new( street => $self );
               $self->cars->add($car);
               return $car;
           }
        }

        class Car {
            has 'street';
            method position() {
                $self->street->position_of($self)
            }
        }

Now, given a random Car, you can still ask "$car->position", but the actual calculation is handled by something else.

(The deeper issue here is how consumers of Car are not coupling themselves to a particular position-calculation strategy. Change the storage of the position value from the Street to the Car, and consumers are none the wiser. This is the point of OOP.)

</comment></comment></comment><comment><USER4> This is not a new concept, but rather just exercising good programming technique. If you are modeling a collection of elements, and the elements need to be aware of themselves in relation to the other elements, then you need to model the container.

A simple example is an array. You don't ask an array element for the array's length or for the i-th array element; you model the container and let the container do that.

</comment><comment><USER5> That's actually a quite common pattern in artificial life community (inspired by real world behaviors from insects):

<http://en.wikipedia.org/wiki/Stigmergy>

<http://en.wikipedia.org/wiki/Ant_colony_optimization>

Also Sims had some "intelligence" embedded into objects instead of the agents:

[http://www.gamedev.net/columns/events/coverage/feature.asp?f...](http://www.gamedev.net/columns/events/coverage/feature.asp?feature_id=51)

</comment><comment><USER6> This reminds me of Luca Cardelli's theory of objects:

[http://books.google.com/books?id=4xT3LgCPP5UC&pg=PA7&...](http://books.google.com/books?id=4xT3LgCPP5UC&pg=PA7&lpg=PA7&source=bl&ots=9FMwvzLe9M&sig=U3K5GwytAgpPWXi4ZwgI8EhJ3ac&hl=en&ei=nE4dS- TsMI2VtgeS7O3lAw&sa=X&oi=book_result&ct=result&resnum=2&ved=0CA8Q6AEwAQ#v=onepage&q=&f=false)

According to Luca the correct way to think about objects is not as the entities of the software model, but as the construction materials for the software model. He uses the analogy of making a physical model of the solar system. In your model the planets don't move themselves, they're moved by gears, tracks, and motors.

So it could be entirely appropriate to think of the pacman board being made up of tiles and those being true, properly understood, OOP objects.

I think he would say that _"The metaphor of objects can go too far by making us try to create objects that are too much inspired by the real world."_ is exactly how not to think about OOP in the first place.

</comment><comment><USER2> Looking at the pacman solution, there's a problem when two ghosts end up on the same square, then they might tend to follow the same path, whereas programming them as objects (and not anti-objects) you can include avoidance strategies.

To get that from the scent-following, hill-climbing algorithm requires some work.

<comment><USER7> Yeah, because ghosts are physical corporeal entities that couldn't possibly be in the same place at once :-)

<comment><USER8> I wonder if there's an upper limit to the number of cospatial ghosts...

<comment><USER9> Modern scholasticism! :)

</comment></comment></comment></comment><comment><USER10> This duality shows up in fluid simulation as well: [http://en.wikipedia.org/wiki/Lagrangian_and_Eulerian_specifi...](http://en.wikipedia.org/wiki/Lagrangian_and_Eulerian_specification_of_the_flow_field)

</comment><comment><USER11> This reminds me of a funny Cracked skit about the 1979 game developer's conference wherein the birth of Frogger was reenacted. "Ok ok you are a truck driver and you try to run over frogs crossing the road". "No, no, you ARE the frog!" "Whoooa"

[http://www.cracked.com/video_16019_video-game-pitch- meeting-...](http://www.cracked.com/video_16019_video-game-pitch- meeting-1979.html)

</comment><comment><USER12> A major difference between the Pacman ghosts as described here, and cars in traffic, is that the ghosts will _always_ be able to smell the pacman, no matter how far he is, and a driver in a car has a limited view on the traffic surrounding him.

The latter (limited) is easier if you use objects for the cars, the former (unlimited) is easier using antiobjects.

<comment><USER13> You could have tiles forget the scent/roads forget the traffic. With each simulation step, decrease it until it's gone after however long you want it to be remembered. Then, ghosts would have to be somewhat near pacman, and cars are only influenced by what goes on around them, not what happened a while ago.

Of course, simulating the actual view of a driver, i.e., excluding things behind the vehicle etc., takes a lot more work.

</comment></comment><comment><USER14> I would be tempted to call these "co-objects" since they are in some sense dual to your standard objects.</comment>